6

Question 1

Which of the following answers does not refer to an email communication threat vector?

Answer 1

Skimming

Question 2

Which of the following mitigates the risk of supply chain attacks?

Answer 2

Vendor/Intermediary checks

Question 3

Examples of social media threat vectors include:

Answer 3

• PII harvesting
• Social engineering
• Identity/account theft
• Malicious URLs
  ** All of the above **

Question 4

Which of the following terms refers to threat intelligence gathered from publicly available sources?

Answer 4

** OSINT **
(Open Source Intelligence (OSINT) is the collection, analysis, and dissemination of information that is publicly available and legally accessible. Right now, OSINT is used by a organizations, including governments, businesses, and non-governmental organizations)

Question 5

Which of the following answers refer to vulnerability databases?

Answer 5

• CVE (Common Vulnerabilities and Exposures (CVE) is a list of publicly disclosed vulnerabilities and exposures that is maintained by MITRE.)
• NVD (The National Vulnerability Database (NVD) is a database, maintained by NIST, that is fully synchronized with the MITRE CVE list)

Question 6

Which of the following statements does not apply to dark web?

Answer 6

Forms a large part of the deep web

Question 7

A type of forensic evidence that can be used to detect unauthorized access attempts or other malicious activities is called:

Answer 7

** IoC **
During a cybersecurity incident, indicators of compromise (IoC) are clues and evidence of a data breach.

Question 8

Which of the following terms refers to a US government initiative for real-time sharing of cyber threat indicators?

Answer 8

** AIS **
(Automated Indicator Sharing (AIS) is a service the Cybersecurity and Infrastructure Security Agency (CISA) provides to enablereal-time exchange of machine-readable cyber threat indicators and defensive measures between public and private-sector organizations.)

Question 9

What is STIX?

Answer 9

Common language for describing cyber threat information

STIX (Structured Threat Information eXpression) is a standardized XML programming language for conveying data about cybersecurity threats in a common language that can be easily understood by humans and security technologies.

Question 10

Which of the following terms refers to a dedicated transport mechanism for cyber threat information?

Answer 10

TAXII

TAXII, short for Trusted Automated eXchange of Intelligence Information, defines how cyber threat information can be shared via services and message exchanges

Question 11

GitHub is an example of:

Answer 11

File/code repository

Question 12

A type of formal document that describes the specifications for a particular technology is known as:

Answer 12

RFC

A Request for Comments (rfc) is a publication in a series from the principal technical development and standards-setting bodies for the Internet, most prominently the Internet Engineering Task Force

Question 13

Which of the following describes the behavior of a threat actor?

Answer 13

TTPs

(Tactics, Techniques, and Procedures)

Question 14

A type of attack aimed at exploiting vulnerability that is present in already released software but unknown to the software developer is called:

Answer 14

Zero-day attack

Question 15

Which of the following answers refers to a deprecated encryption protocol?

Answer 15

** SSL **

The deprecated encryption protocol among the options you provided is SSL (Secure Sockets Layer). SSL has been largely replaced by its successor, TLS (Transport Layer Security), due to vulnerabilities and security issues found in SSL. TLS is a more secure and up-to-date protocol for securing data transmission over the internet.
It is essential to use TLS instead of SSL to ensure the security and privacy of data in transit.

Question 16

FTP, HTTP, IMAP, POP, SMTP, and Telnet are all examples of cleartext (i.e. unencrypted) network protocols.

Answer 16

True

Question 17

The importance of changing default usernames and passwords can be illustrated on the example of certain network devices (such as routers) which are often shipped with default and well-known admin credentials that can be looked up on the web.

Answer 17

True

Question 18

Vulnerability scanning: (Select all that apply)

Answer 18

• Identifies lack of security controls
• Identifies common misconfigurations
• Passively tests security controls

Question 19

An antivirus software identifying non-malicious file as a virus due to faulty virus signature file is an example of:

Answer 19

** False positive error **

A false positive state is when the IDS identifies an activity as an attack but the activity is acceptable behavior. A false positive is a false alarm.

Question 20

Which of the following terms refers to a situation where no alarm is raised when an attack has taken place?

Answer 20

** False negative **

A false negative state is the most serious and dangerous state. This is when the IDS identifies an activity as acceptable when the activity is actually an attack.

Question 21

An industry standard for assessing the severity of computer system security vulnerabilities is known as:

Answer 21

** CVSS **
The Common Vulnerability Scoring System is a free and open industry standard for assessing the severity of computer system security vulnerabilities.
CVSS attempts to assign severity scores to vulnerabilities, allowing responders to prioritize responses and resources according to threat

Question 22

Which type of server is used for collecting diagnostic and monitoring data from networked devices?

Answer 22

Syslog Server

Question 23

A security solution designed to detect anomalies in the log and event data collected from multiple network devices is called:

Answer 23

** SIEM **

Security information and event management, SIEM for short, is a solution that helps organizations detect, analyze, and respond to security threats before they harm business operations.

Question 24

Which of the following tools enables automated response to security incidents?

Answer 24

** SOAR **

SOARs can make alerts more manageable by centralizing security data, enriching events, and automating responses. As a result, SOCs can process more alerts while reducing response times. SOCs can use SOAR playbooks to define standard, scalable incident response workflows for common threats.

Question 25

Penetration testing: (Select all that apply)

Answer 25

• Actively tests security controls
• Exploits vulnerabilities