Module 2

Question 1

What is a computer virus?

Answer 1

Malicious code written to interfere with computer operations and cause damage to data and software.

Question 2

What is Social Engineering?

Answer 2

A manipulation technique that exploits human error to gain private information, access, or valuables.

Question 3

What is Phishing?

Answer 3

The use of digital communications to trick people into revealing sensitive data or deploying malicious software.

Question 4

What is BEC?

Answer 4

“Business Email Compromise”
A threat actor sends an email message that seems to be from a known source to make a seemingly legitimate request for information, in order to obtain financial advantage.

Question 5

What is Spearphishing?

Answer 5

A malicious email attack that targets a specific group of users. The email seems to originate from a trusted source.

Question 6

What is Whaling?

Answer 6

A form of spear phishing. Threat actors target company executives to gain access to sensitive data.

Question 7

What is Vishing?

Answer 7

The exploitation of voice communication to obtain sensitive information or to impersonate a known source.

Question 8

Explain the Security and Risk Management domain

Answer 8

Defines security goals and objectives, risk mitigation, compliance, business continuity, and the law

Question 9

Which domain defines security goals and objectives, risk mitigation, compliance, business continuity, and the law

Answer 9

Security and Risk Management

Question 10

Explain the Asset Security domain

Answer 10

Secures digital and physical assets. It is also related to the storage, maintenance, retention, and destruction of data

Question 11

Which security domain secures digital and physical assets. It is also related to the storage, maintenance, retention, and destruction of data

Answer 11

Asset Security

Question 12

Explain the security architecture and engineering domain

Answer 12

Optimizes data security by ensuring effective tools, systems, and processes are in place

Question 13

Which security domain Optimizes data security by ensuring effective tools, systems, and processes are in place

Answer 13

Security Architecture and Engineering

Question 14

Explain the Communication and Network Security domain

Answer 14

Manages and secures physical networks and wireless communications

Question 15

Which security domain Manages and secures physical networks and wireless communications

Answer 15

Communication and Network Security

Question 16

Explain the Identity and Access Management domain

Answer 16

Keeps data secure by ensuring users follow established policies to control and manage physical assets, like office spaces and logical assets, such as network applications

Question 17

Which security domain keeps data secure by ensuring users follow established policies to control and manage physical assets, like office spaces and logical assets, such as network applications

Answer 17

Identity and Access Management

Question 18

Explain the Security Assessment and Testing domain

Answer 18

Responsible for:
- conducting security control testing
- collecting and analysing data
- conducting security audits
to monitor for risks, threats, and vulnerabilities

Question 19

Which security domain is responsible for conducting security control testing, collecting and analysing data, and conducting security audits to monitor for risks, threats and vulnerabilities

Answer 19

Security Assessment and Testing

Question 20

Explain the Security Operations domain

Answer 20

Responsible for conducting investigations and implementing preventative measures

Question 21

Which security domain is responsible for conducting investigations and implementing preventative measures

Answer 21

Security Operations

Question 22

Explain the Software Development Security domain

Answer 22

Uses secure coding practices, which are a set of recommended guidelines that are used to create secure applications and services

Question 23

Which security domain Uses secure coding practices, which are a set of recommended guidelines that are used to create secure applications and services

Answer 23

Software Devopment Security

Question 24

What are the 8 CISSP security domains

Answer 24

1. Security and Risk Management
2. Asset Security
3. Security and Architecture Engineering
4. Communication and Network Security
5. Identity and Access Management
6. Security Assessment and Testing
7. Security Operations
8. Software Development Security

Question 25

What is a “password attack”?

Answer 25

An attempt to access password-secured devices, systems, networks, or data.

Question 26

What are some forms of Password Attack?

Answer 26

Brute force
Rainbow Table

Question 27

What security domain do Password attacks fall under?

Answer 27

Communication and Network Security

Question 28

What are some forms of Social Engineering attack?

Answer 28

• Phishing
• Smishing
• Vishing
• Spear fishing
• Whaling
• Social media fishing
• Business Email Compromise (BEC)
• Watering hole attack
• USB (Universal Serial Bus) baiting
• Physical social engineering

Question 29

What security domain do social engineering attacks fall under?

Answer 29

Security and Risk Management

Question 30

What is a Physical Attack?

Answer 30

A security incident that affects not only digital but also physical environments where the incident is deployed.

Question 31

What are some forms of Physical Attack?

Answer 31

• Malicious USB cable
• Malicious flash drive
• Card cloning and skimming

Question 32

What security domain do physical attacks fall under?

Answer 32

Communication and Network Security

Question 33

What is Adversarial Artificial Intelligence?

Answer 33

A technique that manipulates AI and machine learning technology to conduct attacks more efficiently.

Question 34

Which security domain do Adversarial AI Attacks fall under?

Answer 34

Both the Communication and Network Security and the Identity and Access Management domains.

Question 35

What is a Supply-Chain Attack?

Answer 35

Targets systems, applications, hardware, and/or software to locate a vulnerability where malware can be deployed.

Question 36

Why can Supply-Chain Attacks be costly?

Answer 36

Security breaches can occur at any point of the supply-chain so they can affect multiple organisations and individuals.

Question 37

What is a Cryptographic Attack?

Answer 37

Affects secure forms of communication between sender and intended recipient.

Question 38

What are some forms of Cryptographic Attack?

Answer 38

• Birthday
• Collision
• Downgrade

Question 39

Which security domain do Cryptographic Attacks fall under?

Answer 39

Communication and Network Security

Question 40

What are “APTs”?

Answer 40

Advanced Persistent Threats

Question 41

What are some characteristics of Advanced Persistent Threats?

Answer 41

• Have significant expertise accessing an organisation’s network without authorisation.
• Tend to research their targets in advance and can remain undetected for an extended period of time.

Question 42

What are some motivations and intentions of APTs?

Answer 42

• Damaging critical infrastructure, such as the power grid and natural resources
• Gaining access to intellectual property

Question 43

What are Insider Threats?

Answer 43

Individuals abuse their authorised access to obtain data that may harm an organisation.

Question 44

What are some motivations and intentions of Insider Threats?

Answer 44

• Sabotage
• Corruption
• Espionage
• Unauthorised data access or leaks

Question 45

What is a Hacker?

Answer 45

Any person who uses computers to gain access to computer systems, networks, or data.

Question 46

What are the three main categories of Hackers?

Answer 46

• Authorised Hackers (Ethical Hackers)
• Semi-authorised Hackers
• Unauthorised Hackers (Unethical Hackers)

Question 47

What is an Ethical Hacker (Authorised Hacker)?

Answer 47

They follow a code of ethics and adhere to the law to conduct organisational risk evaluations. Motivated to safeguard people and organisations from malicious threat actors.

Question 48

What is a Semi-Authorised Hacker?

Answer 48

Considered researchers. Search for vulnerabilities, but don’t take advantage of the ones they find.

Question 49

What is an Unauthorised Hacker (Unethical Hacker)?

Answer 49

Malicious threat actors who do not follow or respect the law. Their goal is to collect and sell confidential data for financial gain.