Security Concepts Overview

Which is a key difference between Diffie-Hellman and RSA algorithms in secure communications?

A multinational corporation seeks to streamline its employees' access to a suite of internal and external cloud-based tools. They want a system where employees can log in once and have access to all necessary applications without needing to re-authenticate for each one. Which protocol is best suited for this type of enterprise-wide single sign-on (SSO) functionality?

An online retail website experiences variable traffic patterns, with periods of low activity and sudden bursts of high user demand, especially during sales events. Which cloud computing principle should be implemented to efficiently manage these fluctuating resource requirements?

In this type of cyber attack, an attacker tries multiple usernames with a few commonly used passwords rather than trying many passwords on a single user. Which attack method does this describe?

A user unknowingly submits a web form on a banking website that transfers funds without their consent. This action was triggered by visiting another malicious website. What type of attack has occurred?

Megan, a cybersecurity specialist, is reviewing the port configuration of a critical server in her organization's network. An nmap scan reveals that TCP ports 21 (FTP), 443 (HTTPS), and 3389 (RDP) are open. Given the organization's strict security policy that mandates the use of secure, encrypted protocols for all remote connections and data transfer, Megan needs to determine which port(s) should be disabled to comply with this policy. Which port(s) should Megan disable to align with the organization's secure protocol requirements?

In the field of cryptography, one technique is particularly effective for ensuring both the integrity and authenticity of a message. This method combines a cryptographic hash function with a secret cryptographic key. What is this technique called?

In the realm of Bluetooth security vulnerabilities, which term best describes an attack where the attacker gains full access to a phone, installs a backdoor, and can initiate actions such as listening in on conversations or enabling call forwarding?

A web developer is implementing a system where users can log in to an application using their existing social media accounts. Which protocol is most suitable for allowing this type of third-party authentication without sharing the user's password with the application?

For a network administrator responsible for managing user accounts and permissions in a large organization, which solution is best suited for providing a centralized system to store, authenticate, and make user information accessible to various applications and services?

In the context of cloud computing, an organization is considering various cloud deployment models to facilitate resource sharing among multiple organizations while maintaining separation from the public. Which cloud deployment model is most suitable for this scenario?

Which of the following cybersecurity frameworks is best suited for integrating networking and security services into a single, cloud-based platform to support the evolving secure access needs of organizations?

A corporation is focusing on enhancing its security measures by isolating critical applications from potential threats within a shared physical server infrastructure. Which technology is MOST suitable for achieving effective isolation of these critical systems?

What is the primary objective of conducting an account audit in the context of Privileged Access Management (PAM)?

What is the primary role of the embedded certificate in a smart card used for authentication purposes in a network environment?

What is the primary purpose of EAP (Extensible Authentication Protocol) in a network security context?

In a decentralized network where anyone can freely conduct financial transactions, how does blockchain technology ensure the integrity and security of these transactions?

What term is used to describe the likelihood that a potential danger might exploit a weakness in a system, leading to negative consequences for an organization?

Kevin, an IT security analyst a large corporation, receives an alert about unusual activity on an office workstation. He discovers a suspicious executable, sync_tool.exe, running in the background and a corresponding batch file scheduled in the Windows Task Scheduler to execute hourly. The batch file, named sync.bat and located at C:\Windows\Tasks, contains the following commands:

1. @echo off
2. rem Sync system data
3. net use Z: \10.0.0.150\data_share /user:sync_user /p:yes
4. Z:\tools\sync_tool.exe
5. net use Z: /delete

Kevin observes that sync_tool.exe is not part of any standard software on the workstation and notes its regular communication with external IP addresses. Evaluate the batch file and the behavior of sync_tool.exe to determine the likely type of malware present on the workstation.

When it comes to enforcing security policies and procedures for employees and systems in a company, which term best describes the responsibility and approach?

In a cybersecurity incident, an attacker captures encrypted authentication credentials as they are transmitted over a network. The attacker then uses these credentials later to impersonate the user and gain unauthorized system access. What type of attack does this scenario most closely represent?

In the Zero Trust model, the Policy Decision Point (PDP) controls access to resources based on strict policies. What are its key components?

Diffie-Hellman vs. RSA

Single Sign-On (SSO)

OAuth

SAML

LDAP

Kerberos

ALE

ARO

RPO

SLE

Scalability

CDN

Elasticity

Brute Force Attack

Dictionary Attack

Spraying Attack

XSS

CSRF

HMAC

SSL

AES

Bluejacking

Bluesnarfing

Bluebugging

OpenID

RSA