Cybersecurity Threats and Controls Quiz

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

Which of the following is NOT directly mentioned as a type of threat from the provided content?

Buffer overflow

Malware injection (correct)

Amplified DDoS

DNS poisoning

Requiring a username, password, and smart card for application access is BEST described as which of the following?

Federation

Accounting

Authorization

Authentication (correct)

An online retailer provides only public-facing IP addresses for a penetration test. This methodology is BEST described as:

Partially known environment (correct)

Black box testing

Passive reconnaissance

Known environment

What is considered the MOST significant threat when allowing mobile devices inside a manufacturing facility that produces radar?

Data Breach (A) Signup and view all the answers

What would be the BEST way for an organization to verify the digital signature provided by an external email server?

Use a trusted CA public key (B) Signup and view all the answers

A security control requiring multiple forms of identification to gain access to a system is an example of:

Multi-Factor Authentication (A) Signup and view all the answers

What BEST describes the purpose of a penetration test for an online retailer as it relates to PCI DSS validation?

To identify security vulnerabilities (B) Signup and view all the answers

A company allows mobile devices inside their facility, which also deals with private intellectual property. What should be a high priority security concern based on this scenario?

Theft of intellectual property (A) Signup and view all the answers

What is the primary purpose of a provided key for decrypting an ISO file after download?

It ensures the downloaded file is not corrupt. (D) Signup and view all the answers

A company requires login access to be restricted to users physically within the server's building. Which of these is the BEST method to enforce this?

Biometric scanner (C) Signup and view all the answers

A new application and database on a cloud service are found to have the database accessible to anyone. What vulnerability is MOST associated with this?

Open permissions (C) Signup and view all the answers

Employees receive an email with a link offering a cash bonus for completing an internal training course. What type of attack does this email BEST represent?

Phishing campaign (A) Signup and view all the answers

Which risk management strategy includes the purchase and installation of an NGFW?

Mitigate (B) Signup and view all the answers

What is one of the primary functions of the key, provided after downloading an ISO file from an official distribution site?

To ensure the downloaded ISO file has been fully transferred and is intact. (C) Signup and view all the answers

What is the MOST significant weakness exploited when a cloud database is accessible without authentication?

Inadequate access control settings. (A) Signup and view all the answers

Which of these options is the MOST likely impact of an organization choosing to 'accept' a risk?

They acknowledge and assume the potential damage from the threat. (A) Signup and view all the answers

A company is deploying access points at remote sites. Which of these would provide confidentiality for wireless data?

WPA3 (C) Signup and view all the answers

A keylogger is found in an update of accounting software. Which action is MOST effective in preventing the transmission of the collected logs?

Block all unknown outbound network traffic at the Internet firewall (D) Signup and view all the answers

A marketing user cannot connect to wireless, receiving a 'Credentials provided by the server could not be validated' message. The AP uses WPA3 and 802.1X. What is the MOST likely cause?

The client computer does not have the proper certificate installed (C) Signup and view all the answers

Which statement is true regarding cryptographic hashing?

Two identical messages always share the same hash. (C) Signup and view all the answers

A security administrator is hardening web servers. Besides changing the administrator password, which two actions are essential to include in the project plan for controlling access and ensuring data confidentiality?

Use HTTPS for all server communication, and enable a host-based firewall. (A) Signup and view all the answers

Why is using MD5 hashes prohibited due to collision issues?

Two different messages can result in the same hash (C) Signup and view all the answers

What is the primary function of 802.1X in a wireless network setup?

To authenticate network users (C) Signup and view all the answers

Following a ransomware attack on a database server that has been quarantined, what is the most critical procedure to ensure the integrity of the evidence during the investigation?

Maintaining a documented chain of custody. (A) Signup and view all the answers

If a keylogger is active on a system, what type of network traffic should be MOST closely monitored by a security professional?

Outbound traffic on unusual ports (A) Signup and view all the answers

What represents the MOST secure environment for application testing, ensuring isolation from the production network?

An air gap network physically isolated from the production one. (B) Signup and view all the answers

What does a RADIUS server primarily manage in a network?

User authentication and authorization (C) Signup and view all the answers

A new IPS is being installed. What best describes an `fail open` configuration to ensure network operations are not disrupted if the IPS device fails?

Network traffic is allowed to continue flowing if the IPS fails or is disabled. (C) Signup and view all the answers

Which aspect of security does WPA3 primarily enhance compared to its predecessor?

Data encryption (A) Signup and view all the answers

What is the process of embedding data inside a different media type to hide it from those who shouldn't see it?

Steganography (D) Signup and view all the answers

What method is used to ensure data confidentiality during web server communications?

Using HTTPS. (B) Signup and view all the answers

What is the main purpose of a chain of custody in a security incident?

To maintain integrity and prevent tampering during a forensic investigation. (A) Signup and view all the answers

Which of the following best describes an appliance that protects web-based applications from SQL injections?

WAF (B) Signup and view all the answers

What is the most reliable method for verifying if files were modified after forensic data acquisition?

Create a hash of the data (C) Signup and view all the answers

Which password control is essential to enforce a policy necessitating letters, numbers, and special characters?

Complexity (D) Signup and view all the answers

What vulnerability poses the greatest security concern when protecting against a hacktivist?

Lack of patch updates on an Internet-facing database server (D) Signup and view all the answers

Which technique is commonly used to obfuscate data in security settings?

Masking (D) Signup and view all the answers

Which control would be least effective in securing weak authentication protocols?

User training on phishing (C) Signup and view all the answers

Which of the following activities is least likely to help during an incident response process?

Training employees on security policies (C) Signup and view all the answers

What security measure is critical for protecting sensitive information during data transfer?

Data encryption (B) Signup and view all the answers

What is the MOST likely result of plaintext application communication?

Replay attack (A) Signup and view all the answers

Which method is the BEST way for a system administrator to be notified if configuration files are modified again?

File integrity monitoring (A) Signup and view all the answers

For configuring a network infrastructure to support 802.1X, which option is the BEST choice?

LDAP (C) Signup and view all the answers

What best describes a time clock appliance that does not allow access to its operating system or firmware upgrades?

Embedded system (A) Signup and view all the answers

Which scenario is supported by having laptops enumerated during each employee login?

Device identification (A) Signup and view all the answers

Which of the following is a common result of insufficient input validation in applications?

SQL injection (A) Signup and view all the answers

What type of attack involves an adversary capturing a data transmission and re-sending it at a later time?

Replay attack (B) Signup and view all the answers

Which of the following best describes penetration testing?

Simulated cyber attack against a system (C) Signup and view all the answers

Study Notes

Practice Exam A - Multiple Choice Questions

A6: Passive reconnaissance is the BEST description of a third-party gathering information about a company's servers and data from external sources without direct network access.
A7: DMARC will determine the disposition of an email with a non-matching origination server.
A8: Organized crime is MOST likely to attack systems for direct financial gain.
A9: Root cause analysis is the BEST description of a security finding from a compromised server with a known OS vulnerability.

Practice Exam A - Multiple Choice Questions (Page 2)

A10: System availability is the highest priority when building an ambulance service network.
A11: Maintenance window and acknowledgement best describes a text alert for a database access right change.
A12: Creating an operating system security policy to block removable media and defining a removable media block rule in the UTM are the BEST ways to prevent data exfiltration using external storage drives.

Practice Exam A - Multiple Choice Questions (Page 3)

A13: Regulated describes data used in creating standard government reports.
A14: Restrict login access by IP address and GPS location, conduct monthly permission auditing, and archive the encryption keys of all disabled accounts are BEST practices for handling data breaches.

Practice Exam A - Multiple Choice Questions (Page 4)

A15: The victim's IP address is 136.127.92.171, and a Trojan was blocked.
A16: The message "Your connection is not private. NET::ERR CERT INVALID" likely means a Deauthentication attack.
A17: SSO (Single Sign-On) is the BEST way to provide website login using existing third-party credentials.

Practice Exam A - Multiple Choice Questions (Page 5)

A18: MTBF (Mean Time Between Failures) is the measure describing the time between repairs of internet-facing firewalls.
A19: Social engineering best describes an attack where an attacker pretends to be someone else to gain important information.
A20: SLA (Service Level Agreement) describes an agreement between two organizations.

Practice Exam A - Multiple Choice Questions (Page 6)

A21: Confidentiality is why a company would automatically add a digital signature to each outgoing email message.
A22: Resource consumption is the most likely cause for a system rebooting constantly.
A23: Password complexity and password expiration are suitable to correct the policy issues with password attempts and changing passwords.

Practice Exam A - Multiple Choice Questions (Page 7)

A24: A login banner is a deterrent security control.
A25: Purchasing cybersecurity insurance is the best way to handle unpatched servers.
A26: A continuity of operations plan would describe how to process orders if the primary connection fails.
A27: Access control vestibule best enables credential examination of data center building personnel.

Practice Exam A - Multiple Choice Questions (Page 8)

A28: Full-disk encryption is the encryption strategy that encrypts data in use.
A29: Off-site backups would minimize database corruption during power failure.
A30: MDM (Mobile Device Management) is the BEST way to establish security policy for corporate mobile devices.

Practice Exam A - Multiple Choice Questions (Page 9)

A31: A zero-day attack is when a significant vulnerability is discovered and exploited before a patch is available. The vulnerability is not listed in the vulnerability scan.
A32: Continuous integration would apply to an IT helpdesk automating security responses.
A33: 802.1X is used to authenticate users with their corporate username and password when they connect to the company's wireless network.
A34: Configuration enforcement describes a VPN service performing a posture assessment during the login attempt.

Practice Exam A - Multiple Choice Questions (Page 10)

A35: Discretionary access model allows users to assign individual rights and permissions to files, folders, and resources on their network drive.
A36: Smishing (SMS phishing) attacks deliver a text message with a harmful link or request.
A37: Acceptable use policy applies to a process where a company formalizes application programmer design and implementation procedures.
A38: Containment describes a phase in incident response where a suspected malware is actively contained in a sandbox.

Practice Exam A - Multiple Choice Questions (Page 11)

A39: DNS poisoning is when a malicious actor alters the DNS records to redirect users to a false destination.
A40: Considerations like microservice outages, network protection mismatches, and backups are associated with hybrid cloud models.
A41: Validating the offboarding processes and procedures is the safest way to verify that systems cannot be accessed by former employees.
A42: Risk appetite describes how cautious an organization is in taking a specific risk.

Practice Exam A - Multiple Choice Questions (Page 12)

A43: A technician should contact stakeholders in the case of a web server failure that involves critical errors.
A44: A replay attack is when a system crashes from receiving specially crafted packets sent to the operating system.
A45: The recovery phase of an incident response process focuses on restoring systems and services.
A46: Misconfiguration is when information is accessed due to security lapses.

Practice Exam A - Multiple Choice Questions (Page 13)

A47: End of life describes the situation where firewalls are no longer available for sale or there is no plan to patch vulnerabilities.
A48: Tabletop exercise describes a disaster recovery exercise.
A49: DNS filtering describes blocking users from malicious software web sites.
A50: The security administrator is implementing the recovery step by restoring a system to a good/previous version.

Practice Exam A - Multiple Choice Questions (Page 14)

A51: A segmented network is where a system is placed on a separate network with restricted access from the rest of the corporate network.
A52: Spraying or brute-force attacks were used on a web server, as shown in log failures repeated attempts and excessive failures.
A53: Decommissioning is the process of disabling a device or network resources for an employee who is leaving the company.
A54: Two-factor authentication (2FA) requires more than one way to validate a user, like a password and a PIN.

Practice Exam A - Multiple Choice Questions (Page 15)

A55: BYOD (Bring Your Own Device) is the model which supports multiple devices in the field.
A56: A UPS (Uninterruptible Power Supply) is a directive control, which is the BEST description of installing a UPS.
A57: Blockchain is the best technology for tracking part progress.
A58: Hacktivists are most likely to replace website content with political messages.

Practice Exam A - Multiple Choice Questions (Page 16)

A59: Hash value verification validates data integrity post-transfer.
A60: USB security key is the best way to require physical presence before enabling login access.
A61: Open permissions is a weakness when a company would add a digital signature that allows anybody to query.
A62: An email with a link offering a bonus for completing an internal training course constitutes a phishing attack.

Practice Exam A - Multiple Choice Questions (Page 17)

A63: Transference and Mitigation are the best ways to process risk management strategies.
A64: Zero Trust describes validating all application requests at a centralized policy enforcement point.
A65: Audit committee handles the assignment of data security in a cloud environment.
A66: Sanitization is the term for decommissioning a device that thoroughly erases all data from it.

Practice Exam A - Multiple Choice Questions (Page 18)

A67: Buffer overflow describes an attacker sending more information than expected in an API call.
A68: Private keys should be in escrow to back up the central server.
A69: Default credentials and misconfigurations are the leading causes for breaches during application rollouts.
A70: Using separate VLANs for network segmentation is the best way to isolate networks.

Practice Exam A - Multiple Choice Questions (Page 19)

A71: Secure Access Service Edge (SASE) is the best option for configuring a remote access solution for a field-service app.
A72: Suspicion report from users and an itemized statement of work are included in a security awareness campaign.
A73: Change management is to prevent vulnerabilities from occurring in the future when patches are reintroduced.
A74: Salting is the best way to add random data when generating password hashes.

Practice Exam A - Multiple Choice Questions (Page 20)

A75: Digital Signatures verifies data identity, especially if it is digitally signed using a public key.
A76: Training users to identify phishing attempts and sharing internal audit results with the board are effective parts of a SCAP implementation.
A77: The data owner is responsible for managing the access rights for data.
A78: Expanded privacy compliance is the likely reason for adding the classification of "Private."

Practice Exam A - Multiple Choice Questions (Page 21)

A79: HSM is a secure way to manage webserver keys.
A80: Embedded scripts and an invalid user agent header are detected by IPS logs.
A81: ALE (Annualized Loss Expectancy) is the metric for monetary loss.
A82: SQL injection is when a user inserts harmful input values into a server query.

Practice Exam A - Multiple Choice Questions (Page 22)

A83: A Trojan horse is the most likely reason for a laptop's poor performance, pop-up messages, and cursor moving issues triggered by a spreadsheet with vendor data.
A84: Compliance reporting is the justification for encryption and authentication measures for credit card information.
A85: On-path attacks alter routing or intercept data transit.
A86: DLP (Data Loss Prevention) can determine suspicious email transmissions.

Practice Exam A - Multiple Choice Questions (Page 23)

A87: A honeypot is a deliberately vulnerable virtual machine set up to attract potential attackers.
A88: A company uses SPF (Sender Policy Framework) records to verify whether an email was legitimately sent from the company's domain.
A89: A company could deploy applications securely using containerization.
A90: Penetration testing would identify vulnerabilities within a new application server before production.

Studying That Suits You

Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

Description

Test your knowledge on various cybersecurity threats and controls. This quiz covers topics such as penetration testing, access security, and threats posed by mobile devices in sensitive environments. Assess your understanding of best practices for securing digital communication and data integrity.