What is the primary function of a DMZ?

b) Provide external access to services

What is the primary focus of the CIA triad?

b) Confidentiality, Integrity, Availability

What is the purpose of a security baseline?

a) Establish minimum security requirements

What is the difference between a standard and a guideline?

a) Standard is mandatory, guideline is optional

What is the purpose of risk management?

b) Reduce risk to acceptable level

What is the primary goal of confidentiality in information security?

a) Protect data from unauthorized access

Mateo wants to conduct a fail over test for his datacenter. What will he need to do to accomplish this?

Force a fail over using his network or other systems.

What is the likely outcome of a cryptographic collision attack?

Two files that both have the same hash but have different contents.

What is the primary goal of security awareness training?

a) Educate users on security best practices

studbud

Sec 701 outside Combo

115 termsStudBud Administration1 play

Imported from external platform

Flashcards115 cardsFPractice quizPHost liveL

Questions 115

Answers

1
What is the purpose of a secure protocol?
a) Encrypt data in transit
c) Authorize access
b) Authenticate users
all of the above
2
Which of the following data types best describes data covered by the European Union’s GDPR?
Legal information
Intellectual property
Regulated data
Trade secrets
3
Company requires individuals to use their personal phones for work purposes? Deployment method?
MDM
CYOD
COPE
BYOD
4
Which of the following answers refers to a NIST's voluntary framework outlining best practices for computer security?
RMF
CSF
SSAE
CIS
5
What is the primary function of a DMZ?
Conduct vulnerability scans
c) Improve network performance
a) Segment network for security
b) Provide external access to services
6
A technique that allows to recover changes that occurred since the last backup in the event of a system crash is:
Virtualization
Journaling
Mirroring
Replication
7
What is the primary focus of the CIA triad?
a) Confidentiality, Integrity, Authentication
c) Confidentiality, Access, Authentication
b) Confidentiality, Integrity, Availability
d) Integrity, Availability, Authentication
8
What type of malware encrypts files for ransom?
Trojan
Ransomware
Worm
Virus
9
Which of the terms listed below can be used to describe the basic principles of information security?
GDPR
PKI
AAA
CIA
10
What holds the position of the root of trust in a certificate chain?
A hardened hardware device
A TPM
A root certificate
A wildcard certificate
11
Which of the following best applies to the concept of non-repudiation?
Encryption
Hashing
Digital certificate
MFA
12
Which security control type prevents unauthorized access?
Compensating
Corrective
Preventive
Detective
13
When is a BCP or DRP design and development actually completed?
Once senior management approves
Never
Only after testing and drilling
Only after implementation and distribution
14
What type of security testing involves reviewing logs?
b) Vulnerability scanning
a) Penetration testing
d) Log analysis
c) Compliance testing
15
What type of security control involves physical access?
c) Physical
b) Administrative
a) Technical
d) All of the above
16
What is the primary purpose of encryption as a control in enterprise environments?
To preserve availability
To preserve least privilege
To preserve confidentiality
To support physical security
17
What is the benefit of network segmentation?
a) Improves performance
c) Enhances security posture
b) Reduces risk
d) All of the above
18
The purpose of PCI DSS is to provide protection for:
Personal health information
Credit cardholder data
User passwords
Licensed software
19
What is the purpose of a security baseline?
c) Conduct vulnerability scans
a) Establish minimum security requirements
b) Define security incident response
d) Implement Access controls
20
Which of the following terms refers to the process of establishing a standard for security?
Baselining
Normalization
Hardening
Security evaluation
21
What type of attack involves exploiting weak passwords?
b) Dictionary attack
c) Rainbow table attack
All of the above
a) Brute force
22
Which type of user account violates the concept of non-repudiation?
Shared account
Standard user account
Service account
Guest user account
23
What type of malware steals sensitive information?
Spyware
Virus
Trojan
Worm
24
Which type of attack is WEP extremely vulnerable to?
Evil twin
IV attack
Cloning
Bluesnarfing
25
Which protocol does HTTPS use to offer greater security in web transactions?
Telnet
SSL
Kerberos
IPsec
26
Which vulnerability scanning technique identifies potential exploits?
c) Vulnerability scanning
b) Port scanning
d) Penetration testing
a) Network scanning
27
Which security technology provides secure remote access?
SSH
SSL/TLS
All of the above
VPN
28
What is the purpose of a security information and event management (SIEM) system?
c) Analyze security logs
d) All of the above
b) Monitor network traffic
a) Conduct vulnerability scans
29
What type of mitigation places a malicious file or application in a safe location for future review or study?
Deletion
Quarantine
Isolation
Containment
30
What is the benefit of continuous monitoring?
Enhances security posture
Improves incident response
Reduces risk
All of the above
31
What is the purpose of a security policy?
c) Provide guidelines for secure configuration
b) Establish security roles and responsibilities
d) All of the above
a) Define incident response procedures
32
Which of the following threat actors is most likely to be associated with an advanced persistent threat (APT)?
Unskilled attacker
Nation-state actors
Hacktivists
Insider threats
33
What is the difference between a standard and a guideline?
a) Standard is mandatory, guideline is optional
c) Standard is industry-specific, guideline is organization-specific
d) Guideline is industry-specific, standard is organization-specific
b) Guideline is mandatory, standard is optional
34
What is the purpose of risk management?
b) Reduce risk to acceptable level
d) Ignore risk
a) Eliminate all risks
c) Transfer risk to third party
35
Which of the following answers refers to a deprecated wireless authentication protocol developed by Cisco?
EAP-TTLS
PEAP
EAP-TLS
LEAP
36
What is the primary goal of confidentiality in information security?
b) Ensure data integrity
d) Detect security threats
a) Protect data from unauthorized access
c) Maintain data availability
37
Mateo wants to conduct a fail over test for his datacenter. What will he need to do to accomplish this?
Force a fail over using his network or other systems.
Cause an outage of a critical system
Simulate what would occur during a datacenter outage.
Turn off all systems in his datacenter.
38
Which of the following answers refers to an obsolete protocol used for secure data transfer over the web?
SRTP
S/MIME
SHTTP
SMTPS
39
Which part of the AAA security architecture deals with the verification of the identity of a person or process?
Authorization
Authentication
Accounting
PKI
40
Which security framework provides guidelines for incident response?
c) COBIT
a) NIST 800-61
d) All of the above
b) ISO 27035
41
What is the typical use of a public key?
All of the above
Data encryption
User/device authentication
Data decryption
42
What type of access control uses user identity?
DAC
MAC
RBAC
ABAC
43
Which security process involves monitoring for potential threats?
a) Continuous monitoring
b) Vulnerability management
Risk management
c) Incident response
44
Which of the following sends unsolicited business cards and messages to a Bluetooth device?
Bluebugging
Bluejacking
Bluesnarfing
Slamming
45
Which alternate site allows for the fastest disaster recovery?
Mobile site
Hot site
Cold site
Warm site
46
What is the likely outcome of a cryptographic collision attack?
Attackers can decrypt the file without the public key.
Two files that both have the same hash but have different contents.
Two files that have the same encrypted output but are different files.
Attackers can decrypt a file without the private key.
47
CVE is an example of what type of feed?
A critical infrastructure listing feed
A vulnerability feed
A critical virtualization exploits feed
A threat intelligence feed
48
What is the primary goal of security awareness training?
d) Conduct vulnerability scans
b) Conduct risk assessments
c) Implement security patches
a) Educate users on security best practices
49
Which of the following is the first step in the Waterfall application development model?
Design
Maintenance
Implementation
Requirements
50
Which of the following is not a common control focused on availability?
Disk encryption
Uninterruptible power systems
Redundant Internet connectivity
Load balancers
51
What is the benefit of conducting regular security audits?
d) All of the above
a) Identifies vulnerabilities
b) Improves incident response
c) Enhances security posture
52
Which security technology provides intrusion prevention?
Firewall
IPS
All of the above
IDS
53
Bug bounty programs are an example of what type of program?
Contracted penetration testing
Responsible disclosure
Third-party bounty
Trusted threat
54
A mandatory IT security and risk management framework for U.S. federal government developed by NIST is known as:
RMF
SSAE
CSF
CSA
55
What is the purpose of a disaster recovery plan (DRP)?
a) Ensure business operations during disruption
c) Implement security patches
b) Conduct risk assessments
Restore IT systems
56
Binary data is an example of what type of data?
Human-readable
Non-human-readable
Masked
Encrypted
57
What is the primary goal of incident response?
c) Implement security patches
a) Contain and eradicate threat
d) Conduct risk assessments
b) Conduct vulnerability scans
58
What is the benefit of implementing a security awareness program?
b) Improves incident response
a) Reduces risk
d) All of the above
c) Enhances security posture
59
What is the primary goal of risk management?
b) Reduce risk to acceptable level
d) Ignore risk
c) Transfer risk to third party
a) Eliminate all risks
60
Which security model focuses on mandatory access control?
c) Clark-Wilson
a) Bell-LaPadula
b) Biba
non-interference
61
What must be protected to maintain the security and benefit of an asymmetric cryptographic solution?
Private Keys
Hash Values
Cryptographic algorithm
Public Keys
62
In the AAA security architecture, the process of granting or denying access to resources is known as:
Digital Signatures
Accounting
Authorization
Authentication
63
Which security process involves identifying and classifying assets?
c) Incident response
b) Vulnerability management
d) Asset management
a) Risk management
64
Which security process involves identifying and mitigating risks?
b) Vulnerability management
c) Incident response
d) Compliance testing
a) Risk assessment
65
Which of the answers listed below refers to a deprecated TLS-based method for secure transmission of email messages?
S/MIME
STARTTLS
SMTPS
DKIM
66
What is the primary goal of penetration testing?
d) Conduct risk assessments
b) Exploit vulnerabilities
a) Identify vulnerabilities
c) Improve incident response
67
An MS Windows component that enables encryption of individual files is called:
EFS
Bitlocker
FDE
SED
68
What is the difference between a threat and a vulnerability?
a) Threat exploits vulnerability
c) Threat is potential harm, vulnerability is weakness
d) Vulnerability is external, threat is internal
b) Vulnerability is a type of threat
69
Which of the following is a method of implementing security controls?
Marketing controls
Managerial controls
Financial controls
Sales controls
70
What type of threat actors are most likely to have a profit motive for their malicious activities?
Hacktivists
State actors
Organized crime
Unskilled attackers
71
Which of the following controls is typically the most expensive to implement?
Security guards
Access control vestibules
Access badges
Bollards
72
What is the purpose of a security policy?
d) All of the above
a) Define incident response procedures
b) Establish security roles and responsibilities
c) Provide guidelines for secure configuration
73
The AAA security architecture, the process of tracking accessed services as and amount of consumed resources is called:
Auditing
Authentication
Accounting
Authorization
74
Which of the following is an entity that accepts and validates information contained within a request for a certificate?
Enrollment agent
Certificate authority
Recovery agent
Registration authority
75
An attacker has circumvented a web-based application to send commands directly to a database. What type of attack?
Cross-site scripting
SQL injection
Downgrade
On-Path
76
What type of encryption uses a single key?
a) Symmetric
c) Hashing
Digital signature
b) Asymmetric
77
The success of asymmetric encryption is MOST dependent upon which of the following?
The secrecy of the algorithm
The integrity of the individuals who created the cryptosystem
The complexity of the ciphertext
The secrecy of the key
78
An ISO/IEC standard defining requirements for information security management systems is known as:
ISO/IEC 27002
ISO/IEC 27701
ISO/IEC 27001
ISO/IEC 31000
79
What is the typical goal intent or goal of hacktivists?
Financial gain
Gathering high-value data
Increasing their reputation
Making a political statement
80
What is the benefit of implementing patches and updates?
All of the above
b) Improves performance
c) Enhances security posture
a) Reduces risk
81
Which malicious actors are likely to show great interest in another country's energy infrastructure?
Shadow IT
Semi-authorized hackers
State actors
Unauthorized hackers
82
What is the purpose of intrusion detection systems (IDS)?
a) Block unauthorized access
b) Detect potential intrusions
d) Conduct vulnerability scans
c) Prevent malware infections
83
What type of security control involves policies and procedures?
a) Technical
c) Physical
b) Administrative
d) All of the above
84
Which of the following is not a common concern in change management processes related to legacy applications?
Ongoing licensing costs
Lack of vendor support
Lack of patches and updates
Availability of third-party or consultant expertise
85
What is the purpose of a firewall?
a) Block unauthorized access
b) Allow authorized access
d) All of the above
c) Detect intrusions
86
Which of the following is not a common practice used to secure data in transit?
Encryption
Geolocation
TLS
VPN
87
Which security process involves reviewing and updating security policies?
d) Security governance
a) Risk management
c) Incident response
b) Vulnerability management
88
An attacker has gained access to the administrator's login credentials. Which type of attack has MOST likely occurred?
Privilege escalation
Buffer overflow
Password cracking
Backdoor
89
How is phishing different from general spam?
It is sent via SMS.
It includes malware in the message.
It is sent only to specific targeted individuals.
It is intended to acquire credentials or other data.
90
The following is a policy that defines appropriate and inappropriate usage of company resources, assets, and etc?
Disaster recovery plan (DRP)
Business impact analysis (BIA)
Acceptable use policy (AUP)
Business continuity plan (BCP)
91
In the certificate authority trust model known as a hierarchy, where does trust start?
Registration authority
Third-party CA
Root CA
Issuing CA
92
Which of the following sends unsolicited business cards and messages to a Bluetooth device?
Bluejacking
Slamming
Bluebugging
Bluesnarfing
93
Henry accesses a database server from his computer. What data state best describes the data while it is on the network
Data in use
Data in transit
Data at rest
Data on the wire
94
What is the purpose of a Business Continuity Plan (BCP)?
a) Ensure business operations during disruption
b) Conduct risk assessments
c) Implement security patches
d) Conduct vulnerability scans
95
What type of information is phishing not commonly intended to acquire?
Credit card numbers
Email addresses
Passwords
Personal information
96
What technology is record-level encryption most commonly associated with?
Physical disks
Removable storage
Databases
Stored audio files
97
What is a honeynet in the context of cybersecurity?
A network of honeypots
A network of infected hosts
A network of IDSs
A network of IPSs
98
What is the name of a network protocol that secures web traffic via SSL/TLS encryption?
FTPS
SFTP
SNMP
HTTPS
99
Which security framework provides guidelines for security programs?
b) ISO 27001
d) All of the above
a) NIST Cybersecurity Framework
c) COBIT
100
What type of attack involves sending malicious emails?
Whaling
Phishing
Smishing
Spear phishing
101
Which of the following answers refers to a data storage device equipped with hardware-level encryption functionality?
EFS
TPM
HSM
SED
102
Which security technology provides email security?
Firewall
Spam filter
All of the above
IDS
103
Quarantine and isolation are both common options in what phase of the incident response process?
Analysis
Detection
Containment
Eradication
104
What threat actor is most likely to be motivated by political beliefs?
Organized crime
Insider threats
Hacktivists
Unskilled attackers
105
What type of encryption uses public and private keys?
a) Symmetric
b) Asymmetric
Digital signature
c) Hashing
106
Julie wants to conduct a replay attack. What type of attack is most commonly associated with successful replay attacks?
A DDoS
Brute force
An on-path attack
SQL injection
107
What type of security testing involves evaluating security controls?
d) Log analysis
a) Penetration testing
c) Compliance testing
b) Vulnerability scanning
108
Which of the answers listed below best describes the characteristics of a public-private key pair?
Two keys that are identical
Both keys are examples of a symmetrical key
A pair of keys where 1 is used for encryption and the other for decryption
Both keys are examples of a shared key
109
Which security concept involves ensuring data remains unchanged?
Availability
Integrity
Confidentiality
Authenticity
110
What type of backup method stores data off-site?
c) Cloud backup
a) On-site backup
b) Off-site backup
d) All of the above
111
Which of the following regulates personal data privacy of the European Union (EU) citizens?
FERPA
HIPPA
GDPR
PHI
112
Hierarchical system for the creation, management, storage, distribution, revocation of digital certificates is known as
CA
PKI
PKCS
RA
113
What is the primary concern for security professionals about legacy hardware?
Its likelihood of failure
Lack of vendor support
Inability to support modern protocols
Lack of patches and updates
114
An SMTP server is not properly and securely configured, it can used maliciously as an SMTP relay agent. Type of Attack?
Virus hoax
Spamming
Salami attack
Data diddling
115
Which mitigation technique reduces risk of social engineering?
c) Vulnerability patching
b) Incident response planning
a) User education
d) Network segmentation

Sec 701 outside Combo Flashcards | StudBud