Test Questions Flashcards
A governmental agency is storing information for a new project on a fileshare. The system has been classified as critical to the project. How should this project data be classified? (Select TWO)
� Private
� Confidential
� Public
� Unrestricted
� Restricted
Confidential
Restricted
A perimeter firewall is set up to block suspicious connections. The system administrator notices a suspicious connection between internal hosts. Which of the following should be used to prevent this communication?
� Host-based firewall
� Cloud Access Security Broker
� Access control list
� Application allow list
Host Based Firewall - installed on individual computers or hosts and can be used to control traffic between internal hosts
A technician has been tasked with applying a firmware update. Which of the following is being affected?
� Application
� BIOS
� Dump file
� Windows 10
BIOS.
Which of the following exercises should an organization use to thoroughly review a new incidence response procedure?
� Tabletop
� High availability
� Failover
� Simulation
Tabletop exercises involve discussing and analyzing hypothetical scenarios, allowing teams to walk through the incident response procedure step by step, identify gaps, and ensure that all stakeholders understand their roles and responsibilities
A system administrator is setting up authentication for a new SaaS application and would like to reduce the overhead burden for authentication of each user between Active Directory and the cloud application. The company has decided to use Active Directory credentials for the application. Which of the following methods would meet this requirement?
� SSO
� 802.1x
� EAP-TTLS
� EAP-FAST
SSO allows users to log in once and access multiple applications without re-entering credentials, meeting the requirement of reducing authentication overhead between Active Directory and the SaaS application.
A company is planning a disaster recovery site and needs to ensure any environmental disaster does not result in complete loss of data. Which of the following should be implemented?
� Warm site
� Clustering
� Hot site
� Geographic dispersion
Geographic dispersion involves the set up of data centers or disaster recovery sites in different geographical regions, thereby reducing the risk of data loss due to environmental disasters in any single location.
A network technician is going to upgrade the mail server to a newer version of software. Which of the following steps should be completed first?
� Perform a firmware upgrade.
� Submit a change control request.
� Remove the mail server from the network.
� Ensure the current mail server is fully patched.
Submitting a change control request is an important step in a controlled IT environment. The change control request outlines the changes being made.
A suspicious caller rang the Human Resources Manager and requested her credit card information to pay a bill. This is MOST LIKELY an example of which of the following attacks?
� Phishing
� Social engineering
� Impersonation
� Whaling
Social engineering
A network engineer placed a firewall in front of a legacy critical system. Which of the following best describes the action that the engineer carried out?
� Compensating controls
� Segmentation
� Risk transfer
� Risk tolerance
Compensating controls are security measures put in place to mitigate risks when the primary control is not feasible or effective.
A military unit is leaving a location in the middle east and has hired a Department of Defense contractor to dispose of the data on classified systems and paper classified waste. Which of the following will the contractor provide to the military unit?
� Asset Register
� Certificate
� Inventory List
� Method of destruction
When sensitive or classified data and materials are disposed of, a Certificate of Destruction is often issued as proof that the data or materials have been properly and securely destroyed.
Which of the following automation use cases would benefit the company’s security posture by updating security permissions immediately after an employee leaves the organization?
� Disabling access.
� Implementing least privilege.
� Change Advisory Board
� Escalating permission requests
Disabling access promptly upon an employee’s departure enhances security by helping to prevent unauthorized access to company resources and data.
Which of the following is a vulnerability that could affect a router or a printer?
� Firmware version
� Buffer overflow
� SQL injection
� Integer overflow
The firmware version of a device can contain security vulnerabilities. Manufacturers often release updates to patch these vulnerabilities and improve device security.
A security administrator finds files with a file extension of .ryk on three of their systems during an attack. Which of the following types of malware has infected the systems?
� Polymorphic Virus
� Backdoor
� Ransomware
� Remote Access Trojan (RAT)
Ransomware is when malware is used to encrypt files and then a ransom is demanded for decryption. The presence of a .ryk extension is an application called RYUK ransomware
A Cloud Service Provider based in Texas is considering expanding its operations internationally to include major European businesses. Which of the following should the hosting provider consider first prior to this expansion? (Choose TWO)
� General Data Protection Regulations
� Threats from Nation States
� Local data protection regulations
� CCPA
Local Data Protection Regulations
GDPR - General Data Protection Requlations
During a security inspection, an employee was found to have installed a computer game on his company desktop. This could have been more serious had it been malware. What can the security team do to stop incidents like this?
� Windows defender firewall
� Least privilege
� Application block list
� Application allow list
Application Allow List - Ensures that only approved and trusted software can run on company desktops, thereby effectively preventing the installation and execution of unauthorized software or malware.
Which of the following topics should the cybersecurity administrator include in their upcoming presentation in the annual security awareness program? (Choose TWO)
� How to recognize and report a phishing attack
� Detecting insider threats using anomalous behavior recognition.
� Confirming information on a word document.
� Reporting suspicious activities
How to recognize and report a phishing attack
Reporting suspicious activities
A cybersecurity administrator is creating a way to present a monthly report of data collected in the IT infrastructure to the board of directors. Which of the following should the systems administrator use?
� Excel spreadsheet
� Dashboard
� Metadata
� PowerPoint presentation
Dashboards
A user attended a presentation based on how to identify and report a phishing attack. To which of the following categories does this presentation belong?
� Annual risk training
� Security awareness training
� Compliance training
� Communication skills training
Security Awareness Training
The chief executive officer of an organization has decided to use a third party to complete a penetration test to measure the organization�s security. Which of the following needs to be carried out before the penetration tester can begin their work?
� Sign a contract
� Right to audit clause
� Rules of engagement
� Obtain a network diagram
Rules of Engagement - This document outlines the scope of the test, what systems can be tested, the testing methodologies, the schedule, and any limitations or restrictions imposed by the organization
You are a change manager overseeing a critical system upgrade. What key component of change management provides comprehensive and detailed instructions for routine operations, contributing to consistent and secure execution during the change process?
� Operational guidelines
� A procedural framework
� A standard operating procedure
� An operational manual
A standard operating procedure is an essential element of change management that comprises comprehensive and detailed instructions for routine operations, ensuring consistent and secure execution during the change process.
The cybersecurity team has been tasked with finding the root cause of a recent security incident. Why is this important?
� To see how the incident was dealt with.
� To prevent it from happening again.
� To gather Indicators of Compromise
� To update threat feeds.
To prevent it from happening again.
A cybersecurity administrator found a honey file on the corporate database server. To determine who created the honeyfile, the last access date, and any changes made to the honey file which of the following actions should be carried out?
� Check the files hash.
� Use hexdump on the file’s contents.
� Check endpoint logs.
� Check the metadata.
Check the metadata. Examining the metadata associated with the file can provide information about its creation, last access, and changes made
After a test showed that a form on a website can be overwhelmed and possibly hacked due to too much data, which security method should an analyst suggest the coder use to stop this from happening?
� Secure cookies
� Input validation
� Stored procedure
� Code signing
Input Validation - Ensures that data entered into form fields adheres to specified criteria, preventing malicious input that could lead to buffer overflow vulnerabilities.
Which of the following are you protecting using a L2TP/IPSec VPN?
� Data at rest
� Data in transit
� Data in use
� Data sovereignty
Data in Transit
An employee has been asked to sign an Acceptable Use Policy (AUP) for a new CAD system. Which of the following controls does this fulfil?
� Corrective
� Compensating
� Preventive
� Deterrent
Preventative Controls - Measures put in place to proactively prevent or deter undesirable events or actions. In this context, by signing the AUP, employees agree to adhere to the established rules and guidelines for using the CAD system.
Which of the following is used to add extra complexity to a credential before applying a one-way data transformation algorithm?
� Steganography
� Data masking
� Salting
� Hashing
Salting - involves adding a random value (the “salt”) to the plaintext password before hashing it. This adds complexity and uniqueness to each hashed value, making it more resistant to attacks like rainbow tables.
A company employee has been allowed to bring his personal smartphone and tablet into the workplace to use when carrying out his job. Which of the following would be the GREATEST security risk? (Select TWO)
� End of life
� Data exfiltration
� Lack of updates.
� Jailbreaking
Jailbreaking (Rooting if android)
Data Exfiltration
A security administrator has set up alerts on a new device. After the first day of monitoring, it was determined that about 40% of the alerts received were false positives. What can be done to reduce this figure?
� Correlating events
� Adjust the tuning
� Quarantining
� Archiving
Adjusting the Tuning
A covert spy plans to conceal information inside the graphical image of a company�s business notepaper. What technique are they using?
� Tokenization
� Hashing
� Steganography
� Data masking
Steganography
A junior technician was tasked with patching a file server. They download the patch onto the server, but it fails to install. What is the most likely reason for this?
� Role based access control.
� Rule based access control.
� Least privilege
� Privilege access management
Least Privilege
A small company needs to build a backup site but cannot afford to install equipment at that site or replicate the data. Which of the following sites meets their needs?
� Hot Site
� Warm Site
� Cold Site
� Disaster Recovery Site
Cold site - Most cost-effective option for a small company with budget constraints. While it doesn’t have the equipment or data readily available, it still provides the basic infrastructure (space and power) needed for setting up equipment and restoring data in case of a disaster.
As a cybersecurity analyst, you are tasked with enhancing an organization’s defenses against malware and unauthorized applications. What primary objective does the implementation of an application allow list strategy serve within cybersecurity measures?
� Simplifying network architecture
� Expediting software deployment
� Enhancing user authentication.
� Mitigating malware and unauthorized applications
Mitigating malware and unauthorized applications - by permitting only approved software to run, thereby enhancing security.
You are the IT director responsible for managing a complex enterprise environment with numerous interconnected services. What critical strategic aspect should be carefully evaluated before executing a service restart, ensuring optimal system availability while mitigating potential security vulnerabilities?
� Hardware compatibility
� Staff training
� Network latency
� The potential impact on interconnected services
Potential Impact on interconnected Services
A contractor has been hired by a hospital to sanitize data held in an archive. However, the contractor states that he cannot sanitize 20% of the archive data. What would be the reason for this?
� Encryption
� Least Privilege
� Classification
� Retention
Retention - Retention policies dictate how long certain types of data should be kept before it can be deleted or destroyed. Medical data needs to be retained for 6 years.
A research and development department works on new inventions, designs, and patents. How would you categorize this data?
� Sensitive
� Intellectual property
� Public
� Regulated data
Intellectual property - The data produced by the research and development department, including inventions, designs, and patents, represents intellectual property that needs to be protected and managed to maintain its value and exclusivity.
Which of the following is the BEST method to protect data at rest on the laptops of sales personnel?
� Full Disk Encryption (FDE)
� Tokenization
� Hashing
� Normalization
FDE - Full Disk Encryption
Which of the following refers to the maximum risk a company can bear and accept? (Choose TWO)
� Risk transference
� Risk threshold
� Risk tolerance
� Quantitative risk
Risk Threshold
Risk Tolerance
A hacker gained access to a system using a hyperlink in a phishing attack and ransomware was deployed across the network. Which of the following would have prevented the spread?
� NIPS
� NIDS
� HIDS
� HIPS
NIPS - Monitors network traffic and can detect and block known malware or suspicious activity in real-time, which can help prevent the spread of ransomware across a network.
A client asked a security company to provide a document outlining the project as well as its cost and completion time frame. Which of the following documents should the company provide to the client?
� Master Service Agreement (MSA)
� Business Partnership Agreement (BPA)
� Statement of Work (SOW)
� Memorandum of Understanding (MOU)
SOW - Statement Of Work
A network engineer has ensured that a host-based firewall on a legacy system allows connections from only specific internal IP addresses. Which of the following does this describe?
� Compensating control
� Segmentation
� Geographic dispersal
� Risk Transference
Compensating control - By implementing this firewall rule, the engineer has put in place a compensating control to mitigate security risks and enhance the system’s security posture.
A company employs researchers to security test their internet-based applications. If vulnerabilities are found, then the researchers who find them will be rewarded. In which of the following categories do these researchers belong?
� Known environment penetration tester
� Blue team
� Bug bounty
� Unknown environment penetration tester
Bug Bounty
Which of the following agreement types defines the metrics by which the vendor must respond?
� BPA
� SLA
� MOA
� SOW
SLA - Service License Agreement - Specify the agreed-upon service levels, including metrics, response times, and performance targets that a vendor must meet
When a criminal has been apprehended by law enforcement agents, which of the following should be implemented to show that the evidence is handled properly?
� Legal hold
� Record the time offset
� Chain of custody
� Right to audit clause
Chain of custody refers to the documentation and procedures used to chronologically track the handling, transfer, and storage of evidence.
Following an instance of financial fraud, an auditor is sifting through all of the financial transactions. What control type is the auditor adopting?
� Deterrent
� Compensating
� Corrective
� Detective
Detective controls are focused on identifying and detecting security incidents or unauthorized activities after they have occurred.
A security engineer is placing a legacy device in its own subnet. Which of the following control types are they implementing?
� Compensating
� Deterrent
� Access Control
� Detective
Compensating controls are put in place to reduce the risk of a vulnerability or a weakness that cannot be resolved by a primary control.
Security controls in a data center are being audited to ensure that both the data and human life are properly protected. How should the security controls be set up? Select the BEST option.
� Security control logging with fail open.
� Safety controls with fail closed.
� Safety controls with fail open.
� Logical security controls with fail closed.
Safety controls (Fail Open), especially those related to physical safety, should be configured to “fail open” in case of system failures. This means that if a safety control or mechanism malfunctions, the system should allow unrestricted access to ensure people’s safety, particularly in emergency situations like fires.
Which is the BEST way for a cybersecurity administrator to monitor for unauthorized software installation and settings changes?
� EDR software on all workstations and servers
� Collect network data using Wireshark
� Deploy a SIEM system
� Credentialed vulnerability scan
EDR software is designed to monitor and respond to security threats on individual endpoints (workstations and servers). It can detect unauthorized software installations and changes to settings.
Which of the following is an example of active reconnaissance?
� Patching Software
� Running a port scan
� Restoring a backup
� Filtering firewall traffic
Running a port scan is an example of active reconnaissance. In active reconnaissance, an attacker actively probes and interacts with the target system to gather information.
A security consultant needs a secure connection to the company for remote users. Which of the following should the security consultant implement?
� IPsec
� Jump Server
� Network Address Translator
� Proxy Server
Internet Protocol Security (IPsec) is a suite of protocols used to secure communications over IP networks using a VPN. It provides a secure tunnel for remote users to connect to the company’s network securely.
Which of the following can be used to validate a user�s certificate that is installed on his smart card? (Select two).
� Key Escrow
� CRL
� CSR
� OCSP
A Certificate Revocation List (CRL) is a list of certificates that have been revoked by the Certificate Authority (CA) before their expiration date. It
The Online Certificate Status Protocol (OCSP) is another method for checking the validity of a certificate.
A small organization has just hired a third party to remediate several vulnerabilities that were found on their network. Which of the following tasks should be done last?
� Audit
� Penetration Test
� Written Report
� Run another vulnerability scan
Run another vulnerability scan to ensure that the remediation efforts have been successful.
A cybersecurity administrator needs to oversee the accurate deployment of cloud resources using the least amount of administrative access. Which of the following should be implemented?
� Software as a service
� Infrastructure as code
� Infrastructure as a service.
� Platform as a service
Infrastructure as Code (IaC) - allows you to define and manage cloud resources using code and automation, reducing the need for manual administrative access and minimizing human error.
A forensic investigator is trying to determine which employee emailed PII data to an external customer. Which of the following tools will help the forensic investigator?
� EDR
� Proxy Server
� Net Flow
� DLP
Data Loss Prevention (DLP) solutions are specifically designed to monitor, detect, and prevent the unauthorized transfer of sensitive data such as PII and can help identify who sent the data and where it was sent.
A cybersecurity analyst previously set up a honeypot and has since successfully gathered information about a new attack method. Which of the following should the cybersecurity analyst do prior to setting up the SIEM and SOAR servers to identify this new attack method?
� Threat hunting
� E-discovery
� Incident response plan
� Disaster recovery plan
Threat Hunting - involves actively searching for signs of malicious activity and potential threats within the network. This is done to create the data on the threat needed to effectively implement SIEM and SOAR. It is a proactive approach to identifying and mitigating new attack methods
A company is going to roll out FDE to all of the company laptops and desktops. Which of the following are critical to this implementation? (Select TWO).
� Key escrow
� PGP
� TPM
� CRL
TPM - A hardware-based security feature that can securely store encryption keys and help protect against unauthorized access to encrypted data. It is crucial for secure FDE implementations.
A company suffered a buffer overflow on one of its internet web servers. Which of the following should be installed to mitigate the risk of buffer overflow on internet web servers?
� IP Sec
� WAF
� CASB
� SD-WAN
A Web Application Firewall (WAF) is designed to protect web applications from various attacks, including buffer overflows. It can help filter and block malicious traffic before it reaches the web server.
Which of the following threat actors is the MOST LIKELY to be able to fund criminal organizations in neighboring countries to launch influence campaigns?
� Unskilled attacker
� Hacktivist
� Competitor
� Nation state threat actor
� Advanced persistent threat
Nation State Threat Actor - most likely to have the financial means and resources to fund criminal organizations in neighboring countries for large-scale influencing campaigns.
Following a third-party audit, the auditor noticed that some of the security settings on a server were incorrect. Which of the following should the company use to continuously verify security settings?
� CIS Benchmarks
� Attestation
� Morning inspection
� Automation
Automation - Involves using software or scripts to regularly check and enforce security settings on a server automatically. With automation, you can set up continuous monitoring and remediation processes to ensure that security settings remain correct over time.
A network administrator is having problems with users being unable to access the internet. During their investigation, they discover that network logs show only a small number of DNS queries and that the server resources are using minimal CPU and memory; however, there is a huge amount of inbound traffic. Which of the following types of attacks does this describe?
� Reflected denial of service
� Botnet
� On-path resource consumption
� Login Bomb
Reflected denial of service attacks involve attackers sending requests to a large number of intermediary servers, which then reflect and amplify the attack traffic towards the target server, causing network congestion.
A financial administrator receives a text message from an unknown number claiming to be the Human Resources Manager and asking the employee to purchase several gift cards for the Christmas raffle. Which of the following types of attacks is this?
� Impersonation
� Smishing
� Vishing
� Phishing
Smishing
A security manager has recently created new policies to deal with security incidents. Which of the following should be their next step?
� Set the data retention policy.
� Encrypt of policies.
� Classify each of the policies.
� Organize a tabletop exercise.
Organize a tabletop Exercise - Helps test the effectiveness of the newly created policies and ensure that employees understand how to respond to security incidents.
A company based in Florida suffered 20 storms this year, resulting in environmental damage that led to data loss. Which of the following solutions would be the most effective?
� Load balancers
� Geographic dispersion
� Cluster servers
� Off-site backups
Geographic dispersion - Involves the setting up of data centers or resources in different geographical regions to enhance disaster recovery and availability. This can help mitigate the impact of storms and environmental disasters.
A legacy IoT device used for testing has a new security vulnerability. Which of the following tasks should a security administrator perform FIRST to mitigate risk of new vulnerabilities in a legacy IoT device?
� Insurance
� Patching
� Upgrade
� Segmentation
Segmentation - Involves the isolation of vulnerable devices from the rest of the network to limit their ability to communicate with other devices and reduce the potential impact of the security vulnerability.
An organization wants to monitor the latest attack methods without impacting the company�s servers. Which of the following would be the best choice for this?
� Honeyfile
� Honeypot
� SIEM monitoring
� SOAR monitoring
Honeypot - Decoy system or network that is set up to attract attackers and capture their activities. Honeypots can mimic real systems and services, making them attractive targets for attackers. They are designed to be isolated from production servers, so any attacks or suspicious activities do not impact the company’s actual servers. Honeypots are an effective way to monitor the latest attack methods without exposing your servers to risk.
A security administrator is responsible for data theft prevention of PII and sensitive data. This includes four different types of data. What type of solution should be implemented, and what should the setup requirements be? (Choose TWO)
� Deploy a Data Loss Prevention system.
� Create a rule to block outgoing email attachments.
� Classify the data.
� Implement Least Privilege
DLP - Data Loss Prevention
Classifing the Data - IOT apply appropriate DLP rules to the data
A cybersecurity administrator identifies that an attack in which the CPU register was overwritten by a malicious address that is similar to shellcode. What type of attack is this?
� XML injection
� Shimming
� Buffer overflow
� SQL injection
Buffer Overflow - Attack occurs when an attacker inputs more data into a buffer (memory storage) than it can hold, causing the excess data to overwrite adjacent memory locations, including CPU registers. This can be used to inject and execute malicious code that is written with shellcode.
Who is responsible for securing the company’s servers procured through an IaaS contract under a shared responsibility cloud model?
� Cloud Access Security Broker
� Third- party vendor
� Cloud service provider
� Client
Client - In a shared responsibility model, the client (that is, the company) is responsible for securing the servers and the data they store or process within the IaaS environment. This includes configuring and managing security settings, access controls, and the operating system.
A network engineer has discovered that network devices within their organization do not meet the new encryption standard. Which of the following should the network engineer recommend?
� Use a lower encryption standard
� Move the device into a VLAN
� Decommission the device and replace it
� Implement a compensating control
Decommission and replace the device - eplacing outdated hardware with devices that comply with current encryption standards ensures that the organization’s network security posture remains strong and aligned with best practices and regulatory requirements.
Which of the following should be disabled on a network router to harden it? (Select the BEST choice).
� Console access
� ACLs
� SNMP
� Web-based administration
Web-based Adminstration - Disabling it helps prevent remote access to the router through a web interface, thereby enhancing security.
A cybersecurity administrator observes that several existing accounts have been locked following attempted logins from users overseas? What type of attack is this and how can we mitigate the risk? (Select TWO).
� Brute force
� Password spraying
� Multifactor authentication
� Increase account lockout threshold
Brute Force
MFA
Which of the following threat actors might be employed by a nation state to carry out their work?
� Organized crime
� Shadow IT
� Hacktivist
� Insider threat
Organized Crime
An organization is looking for a cloud based, low-cost solution for their application development. Which of the following is the best solution for this?
� VDI
� Hyper V
� SAN
� Serverless Architecture
Serverless Architecture
A Chief Information Security Officer (CISO) wants to monitor attacks on the company servers. The company uses a reverse proxy to provide SSL/TLS decryption so that incoming traffic can be monitored. Which of the following should the CISO implement?
� Capture all of the traffic entering and leaving the servers
� Deploying a network-based intrusion detection system.
� Logging operating system security logs
� Deploy a network-based intrusion prevention system
Captruing all traffic entering and leaving the servers - (especially after SSL/TLS decryption provided by the reverse proxy) allows for comprehensive monitoring and analysis of attacks on the servers.
A cybersecurity analyst notices that there has been an increase of login attempts from users in remote locations. This has resulted in brute force attacks. Which of the following can mitigate this type of attack in the future?
� Federation Services
� Data in Use
� Multifactor authentication
� Least Privilege
multifactor authentication adds an extra layer of security by requiring users to provide more than one form of verification before gaining access. This can mitigate brute force attacks by making it significantly harder for attackers to successfully authenticate even if they manage to guess passwords.
Which of the following real-time systems defense mechanisms is tailored for mitigating the risk of malware and rootkit attacks on desktops?
� HIPS
� HIDS
� EDR
� Sandbox
EDR - Endpoint Detection and Response - A cybersecurity solution that continuously monitors and analyzes endpoint activities to detect and respond to suspicious behavior, (including malware and rootkit attacks) on desktop computers.
HIPS - is not specific to malware and rootkits and focuses on prevening unauthorized access to a system.
An unknown penetration tester is going to test the organization�s perimeter security. Which of the following documents will outline the duration of the penetration test?
� MSA
� CIS benchmarks
� SLA
� SOW
SOW - Statement Of Work - outlines the specific details of a project, including the scope, deliverables, timeline, and duration of the penetration test.
Which of the following does a digital signature provide?
� Hashing
� Encryption
� Non-Repudiation
� Authentication
Non-repudiation is a key feature of digital signatures, ensuring that a person or entity cannot deny the validity of their electronic signature or sending a message. It provides proof of the origin and integrity of the data, making it possible to verify who signed the document and ensuring that the document has not been altered after signing.
Which of the following should a cybersecurity analyst implement to ensure they are informed if the system 32 files have been altered? Choose the best option.
� FIM
� SOAR
� SIEM
� EDR
FIM - File Integrity Monitoring - Continuously monitors and detects changes to files, including modifications, deletions, or additions, and alerts the analyst if any unauthorized changes occur. It can detect any changes to system files by a rootkit.
Which of the following would prevent the installation of a computer game or ransomware on a user�s corporate laptop? Select the best option.
� IPS
� Least Privilege
� Application Allow List
� Host-Based Firewall
Application Allow List (aka Whitelisting) - Ensures that only approved and trusted software can run on company desktops, thereby effectively preventing the installation and execution of unauthorized software or malware.
Two car manufacturers decide to participate in a joint venture to create a new super car engine. Which of the following would be the best authentication method for them to choose during the project?
� Open Authentication
� Mandatory Access Control
� Federation Services
� Role-Based Access Control
Federation services provide authentication for joint venture and cloud authentication. This would allow employees from both car manufacturers to access the resources and systems needed for the project using their own organization’s credentials. This ensures SSO, seamless authentication, and collaboration between the two companies.
Which of the following enables you to hide a credit card number so that only the last three digits on the right-hand side are visible?
� Masking
� Encryption
� Tokenization
� Salting
Masking - A data protection feature that obscures specific data within a database so that sensitive information is hidden from those without the need to know the full details
A company is transitioning to the cloud and needs to open ports on the firewall to complete the task. What type of risk does this represent?
� Federation Services
� Supply Chain
� Insider Threat
� RAT
Opening ports on the firewall introduces a supply chain risk. These are potential vulnerabilities and threats that arise from third-party vendors, services, or processes involved in the supply chain.
Why would a company that is PCI DSS compliant be subject to an annual audit? Choose the BEST answer.
� Internal audit requirement
� Third party audit requirement
� Check the firmware update
� Regulatory Requirement
Payment Card Industry Data Security Standard (PCD DSS) Compliance is a regulatory requirement for companies that handle credit card transactions. These companies are therefore, subject to an annual audit to ensure ongoing compliance with this regulatory standard.
Users at a company need to sign up for a cybersecurity conference. When they attempt to sign up to the website, they are blocked by the proxy server as the site was deemed to be a gambling website. Which of the following actions should the network administrator take to ensure users can sign up for the conference?
� Change the proxy to a reverse proxy.
� Modify the URL block list on the proxy server.
� Modify the content filter on the proxy server.
� Change the firewall rules.
The content filter on the proxy server is responsible for categorizing and blocking access to certain websites based on predefined criteria. In this scenario, the network administrator should modify the content filter to allow access to the cybersecurity conference website while still blocking access to gambling websites.
There is no need to modify the URL as the users got to the website before being blocked.
A company wants to decommission 50 laptops and donate them to a local school. Which of the following decommission methods will they use?
� Destruction
� Pulverizing
� Degaussing
� Sanitization
Sanitization - Does not physically destroy them.
A person working on the reception desk at a major multinational company received a phone call from someone claiming to be the Chief Financial Officer asking for their company credit card to pay a bill. Which of the following attack types is this MOST LIKELY an example of?
� Whaling
� Phishing
� Social Engineering
� Misinformation
A social engineering attack relies on manipulating individuals to gain sensitive information or access.
A cybersecurity consultancy wants to reduce the threat scope for a major customer. Which of the following will the cybersecurity consultancy implement first?
� Proxy Server within Data Plane
� Zero Trust within Data Plane
� Implied Trust within Data Plane
� Segmentation within Data Plane
Zero Trust within the data plane ensures that no entity is inherently trusted within the network and that all communication and access attempts are thoroughly verified and authenticated to mitigate potential security risks and threats.
Which of the following sets of identity proofs could be used for multifactor authentication? Choose the best answer.
� Password, PIN, birth date
� Gait, retina, username
� Fob, token, iris
Password, typing dwell time, gait
Gait, Retina and Username - Includes a mix of authentication factors: something you are (retina), something you have (username), and something you do (gait).
