Which of the answers listed below best describes the characteristics of a public-private key pair?

A pair of keys where 1 is used for encryption and the other for decryption

What is the difference between a threat and a vulnerability?

c) Threat is potential harm, vulnerability is weakness

What is the primary goal of confidentiality in information security?

a) Protect data from unauthorized access

What is the primary goal of security awareness training?

a) Educate users on security best practices

What is the likely outcome of a cryptographic collision attack?

Two files that both have the same hash but have different contents.

What is the purpose of risk management?

b) Reduce risk to acceptable level

What is the primary goal of incident response?

a) Contain and eradicate threat

What is the purpose of a Business Continuity Plan (BCP)?

a) Ensure business operations during disruption

What is the purpose of a disaster recovery plan (DRP)?

a) Ensure business operations during disruption

studbud

Sec 701 outside Combo

115 termsStudBud Administration1 play

Imported from external platform

Flashcards115 cardsFPractice quizPHost liveL

Questions 115

Answers

1
The purpose of PCI DSS is to provide protection for:
Licensed software
User passwords
Credit cardholder data
Personal health information
2
Which of the answers listed below best describes the characteristics of a public-private key pair?
Two keys that are identical
Both keys are examples of a symmetrical key
A pair of keys where 1 is used for encryption and the other for decryption
Both keys are examples of a shared key
3
What is the purpose of a security policy?
a) Define incident response procedures
c) Provide guidelines for secure configuration
d) All of the above
b) Establish security roles and responsibilities
4
Which security process involves identifying and classifying assets?
b) Vulnerability management
c) Incident response
a) Risk management
d) Asset management
5
Which of the following is a method of implementing security controls?
Managerial controls
Financial controls
Sales controls
Marketing controls
6
What is the difference between a threat and a vulnerability?
a) Threat exploits vulnerability
b) Vulnerability is a type of threat
d) Vulnerability is external, threat is internal
c) Threat is potential harm, vulnerability is weakness
7
What is the primary goal of confidentiality in information security?
d) Detect security threats
b) Ensure data integrity
c) Maintain data availability
a) Protect data from unauthorized access
8
What is the purpose of a security information and event management (SIEM) system?
d) All of the above
c) Analyze security logs
a) Conduct vulnerability scans
b) Monitor network traffic
9
Which of the following data types best describes data covered by the European Union’s GDPR?
Intellectual property
Regulated data
Legal information
Trade secrets
10
What is the primary goal of security awareness training?
b) Conduct risk assessments
d) Conduct vulnerability scans
a) Educate users on security best practices
c) Implement security patches
11
Which of the following regulates personal data privacy of the European Union (EU) citizens?
HIPPA
PHI
GDPR
FERPA
12
In the certificate authority trust model known as a hierarchy, where does trust start?
Third-party CA
Registration authority
Issuing CA
Root CA
13
Quarantine and isolation are both common options in what phase of the incident response process?
Eradication
Analysis
Containment
Detection
14
Which alternate site allows for the fastest disaster recovery?
Warm site
Hot site
Mobile site
Cold site
15
What type of malware encrypts files for ransom?
Virus
Trojan
Worm
Ransomware
16
What holds the position of the root of trust in a certificate chain?
A wildcard certificate
A root certificate
A hardened hardware device
A TPM
17
What threat actor is most likely to be motivated by political beliefs?
Insider threats
Hacktivists
Organized crime
Unskilled attackers
18
What is the purpose of a secure protocol?
c) Authorize access
b) Authenticate users
a) Encrypt data in transit
all of the above
19
What is a honeynet in the context of cybersecurity?
A network of infected hosts
A network of IPSs
A network of IDSs
A network of honeypots
20
In the AAA security architecture, the process of granting or denying access to resources is known as:
Accounting
Digital Signatures
Authentication
Authorization
21
What is the likely outcome of a cryptographic collision attack?
Attackers can decrypt the file without the public key.
Attackers can decrypt a file without the private key.
Two files that both have the same hash but have different contents.
Two files that have the same encrypted output but are different files.
22
Which of the following controls is typically the most expensive to implement?
Access badges
Security guards
Bollards
Access control vestibules
23
Which security control type prevents unauthorized access?
Detective
Corrective
Preventive
Compensating
24
What must be protected to maintain the security and benefit of an asymmetric cryptographic solution?
Hash Values
Private Keys
Public Keys
Cryptographic algorithm
25
Which vulnerability scanning technique identifies potential exploits?
d) Penetration testing
c) Vulnerability scanning
a) Network scanning
b) Port scanning
26
What type of security control involves policies and procedures?
a) Technical
c) Physical
d) All of the above
b) Administrative
27
What is the benefit of implementing patches and updates?
a) Reduces risk
All of the above
c) Enhances security posture
b) Improves performance
28
What type of encryption uses a single key?
Digital signature
a) Symmetric
b) Asymmetric
c) Hashing
29
What is the primary purpose of encryption as a control in enterprise environments?
To preserve confidentiality
To support physical security
To preserve availability
To preserve least privilege
30
Which security technology provides secure remote access?
All of the above
VPN
SSL/TLS
SSH
31
What is the purpose of a security policy?
b) Establish security roles and responsibilities
a) Define incident response procedures
d) All of the above
c) Provide guidelines for secure configuration
32
What is the purpose of risk management?
b) Reduce risk to acceptable level
d) Ignore risk
a) Eliminate all risks
c) Transfer risk to third party
33
What is the typical use of a public key?
Data decryption
All of the above
Data encryption
User/device authentication
34
What is the benefit of network segmentation?
d) All of the above
c) Enhances security posture
b) Reduces risk
a) Improves performance
35
What type of access control uses user identity?
DAC
ABAC
MAC
RBAC
36
Which mitigation technique reduces risk of social engineering?
b) Incident response planning
a) User education
c) Vulnerability patching
d) Network segmentation
37
What is the primary goal of incident response?
c) Implement security patches
b) Conduct vulnerability scans
d) Conduct risk assessments
a) Contain and eradicate threat
38
Which of the following threat actors is most likely to be associated with an advanced persistent threat (APT)?
Unskilled attacker
Nation-state actors
Insider threats
Hacktivists
39
What type of mitigation places a malicious file or application in a safe location for future review or study?
Isolation
Quarantine
Deletion
Containment
40
Which security process involves reviewing and updating security policies?
c) Incident response
b) Vulnerability management
d) Security governance
a) Risk management
41
What technology is record-level encryption most commonly associated with?
Stored audio files
Removable storage
Physical disks
Databases
42
Which of the following answers refers to an obsolete protocol used for secure data transfer over the web?
SHTTP
SMTPS
SRTP
S/MIME
43
A mandatory IT security and risk management framework for U.S. federal government developed by NIST is known as:
RMF
CSF
SSAE
CSA
44
What is the purpose of a Business Continuity Plan (BCP)?
c) Implement security patches
d) Conduct vulnerability scans
a) Ensure business operations during disruption
b) Conduct risk assessments
45
Which security model focuses on mandatory access control?
c) Clark-Wilson
a) Bell-LaPadula
b) Biba
non-interference
46
Julie wants to conduct a replay attack. What type of attack is most commonly associated with successful replay attacks?
SQL injection
Brute force
An on-path attack
A DDoS
47
The success of asymmetric encryption is MOST dependent upon which of the following?
The secrecy of the algorithm
The secrecy of the key
The integrity of the individuals who created the cryptosystem
The complexity of the ciphertext
48
A technique that allows to recover changes that occurred since the last backup in the event of a system crash is:
Mirroring
Journaling
Virtualization
Replication
49
Which security technology provides email security?
All of the above
IDS
Spam filter
Firewall
50
What is the purpose of a disaster recovery plan (DRP)?
a) Ensure business operations during disruption
Restore IT systems
b) Conduct risk assessments
c) Implement security patches
51
Which security concept involves ensuring data remains unchanged?
Confidentiality
Availability
Authenticity
Integrity
52
Which of the following is not a common concern in change management processes related to legacy applications?
Ongoing licensing costs
Availability of third-party or consultant expertise
Lack of patches and updates
Lack of vendor support
53
Which of the following answers refers to a data storage device equipped with hardware-level encryption functionality?
SED
TPM
EFS
HSM
54
Binary data is an example of what type of data?
Non-human-readable
Masked
Human-readable
Encrypted
55
What type of malware steals sensitive information?
Virus
Spyware
Worm
Trojan
56
What type of security control involves physical access?
d) All of the above
c) Physical
a) Technical
b) Administrative
57
What type of threat actors are most likely to have a profit motive for their malicious activities?
Hacktivists
Unskilled attackers
State actors
Organized crime
58
How is phishing different from general spam?
It is sent only to specific targeted individuals.
It is intended to acquire credentials or other data.
It includes malware in the message.
It is sent via SMS.
59
An SMTP server is not properly and securely configured, it can used maliciously as an SMTP relay agent. Type of Attack?
Data diddling
Spamming
Salami attack
Virus hoax
60
Which of the following sends unsolicited business cards and messages to a Bluetooth device?
Slamming
Bluesnarfing
Bluebugging
Bluejacking
61
What is the primary goal of risk management?
a) Eliminate all risks
d) Ignore risk
b) Reduce risk to acceptable level
c) Transfer risk to third party
62
What is the primary function of a DMZ?
c) Improve network performance
Conduct vulnerability scans
b) Provide external access to services
a) Segment network for security
63
Which protocol does HTTPS use to offer greater security in web transactions?
IPsec
Telnet
Kerberos
SSL
64
What type of encryption uses public and private keys?
a) Symmetric
b) Asymmetric
c) Hashing
Digital signature
65
What is the purpose of a firewall?
a) Block unauthorized access
d) All of the above
c) Detect intrusions
b) Allow authorized access
66
What type of attack involves sending malicious emails?
Whaling
Phishing
Spear phishing
Smishing
67
What type of backup method stores data off-site?
a) On-site backup
d) All of the above
c) Cloud backup
b) Off-site backup
68
What type of security testing involves reviewing logs?
d) Log analysis
c) Compliance testing
b) Vulnerability scanning
a) Penetration testing
69
CVE is an example of what type of feed?
A threat intelligence feed
A critical virtualization exploits feed
A critical infrastructure listing feed
A vulnerability feed
70
What is the purpose of a security baseline?
b) Define security incident response
a) Establish minimum security requirements
d) Implement Access controls
c) Conduct vulnerability scans
71
Which of the following terms refers to the process of establishing a standard for security?
Security evaluation
Normalization
Hardening
Baselining
72
The AAA security architecture, the process of tracking accessed services as and amount of consumed resources is called:
Authentication
Authorization
Accounting
Auditing
73
Which of the following is the first step in the Waterfall application development model?
Requirements
Maintenance
Design
Implementation
74
Which part of the AAA security architecture deals with the verification of the identity of a person or process?
Authentication
Accounting
PKI
Authorization
75
What is the typical goal intent or goal of hacktivists?
Gathering high-value data
Making a political statement
Financial gain
Increasing their reputation
76
Which of the following sends unsolicited business cards and messages to a Bluetooth device?
Slamming
Bluebugging
Bluejacking
Bluesnarfing
77
Company requires individuals to use their personal phones for work purposes? Deployment method?
BYOD
CYOD
COPE
MDM
78
Which malicious actors are likely to show great interest in another country's energy infrastructure?
State actors
Semi-authorized hackers
Shadow IT
Unauthorized hackers
79
What is the purpose of intrusion detection systems (IDS)?
a) Block unauthorized access
c) Prevent malware infections
d) Conduct vulnerability scans
b) Detect potential intrusions
80
Which security framework provides guidelines for security programs?
d) All of the above
a) NIST Cybersecurity Framework
c) COBIT
b) ISO 27001
81
What type of security testing involves evaluating security controls?
d) Log analysis
a) Penetration testing
b) Vulnerability scanning
c) Compliance testing
82
What is the difference between a standard and a guideline?
d) Guideline is industry-specific, standard is organization-specific
c) Standard is industry-specific, guideline is organization-specific
b) Guideline is mandatory, standard is optional
a) Standard is mandatory, guideline is optional
83
What is the benefit of implementing a security awareness program?
a) Reduces risk
d) All of the above
c) Enhances security posture
b) Improves incident response
84
Which of the answers listed below refers to a deprecated TLS-based method for secure transmission of email messages?
S/MIME
SMTPS
DKIM
STARTTLS
85
What is the name of a network protocol that secures web traffic via SSL/TLS encryption?
SNMP
FTPS
SFTP
HTTPS
86
An ISO/IEC standard defining requirements for information security management systems is known as:
ISO/IEC 27002
ISO/IEC 27001
ISO/IEC 27701
ISO/IEC 31000
87
What type of information is phishing not commonly intended to acquire?
Email addresses
Passwords
Personal information
Credit card numbers
88
What is the primary focus of the CIA triad?
b) Confidentiality, Integrity, Availability
d) Integrity, Availability, Authentication
c) Confidentiality, Access, Authentication
a) Confidentiality, Integrity, Authentication
89
Which type of attack is WEP extremely vulnerable to?
Evil twin
Cloning
IV attack
Bluesnarfing
90
Which type of user account violates the concept of non-repudiation?
Shared account
Standard user account
Service account
Guest user account
91
Which of the following best applies to the concept of non-repudiation?
Digital certificate
MFA
Hashing
Encryption
92
Which security process involves monitoring for potential threats?
c) Incident response
b) Vulnerability management
a) Continuous monitoring
Risk management
93
What is the benefit of conducting regular security audits?
b) Improves incident response
d) All of the above
c) Enhances security posture
a) Identifies vulnerabilities
94
Which of the following is not a common control focused on availability?
Redundant Internet connectivity
Load balancers
Disk encryption
Uninterruptible power systems
95
An attacker has circumvented a web-based application to send commands directly to a database. What type of attack?
On-Path
Downgrade
SQL injection
Cross-site scripting
96
What is the primary concern for security professionals about legacy hardware?
Lack of patches and updates
Its likelihood of failure
Lack of vendor support
Inability to support modern protocols
97
Bug bounty programs are an example of what type of program?
Third-party bounty
Responsible disclosure
Contracted penetration testing
Trusted threat
98
An attacker has gained access to the administrator's login credentials. Which type of attack has MOST likely occurred?
Backdoor
Buffer overflow
Privilege escalation
Password cracking
99
Which of the following is not a common practice used to secure data in transit?
TLS
VPN
Geolocation
Encryption
100
Which security framework provides guidelines for incident response?
c) COBIT
a) NIST 800-61
d) All of the above
b) ISO 27035
101
Which security process involves identifying and mitigating risks?
a) Risk assessment
d) Compliance testing
c) Incident response
b) Vulnerability management
102
What is the primary goal of penetration testing?
d) Conduct risk assessments
a) Identify vulnerabilities
c) Improve incident response
b) Exploit vulnerabilities
103
Which of the terms listed below can be used to describe the basic principles of information security?
PKI
GDPR
AAA
CIA
104
What is the benefit of continuous monitoring?
Reduces risk
All of the above
Enhances security posture
Improves incident response
105
Which security technology provides intrusion prevention?
IDS
All of the above
IPS
Firewall
106
Hierarchical system for the creation, management, storage, distribution, revocation of digital certificates is known as
RA
PKCS
CA
PKI
107
The following is a policy that defines appropriate and inappropriate usage of company resources, assets, and etc?
Disaster recovery plan (DRP)
Business continuity plan (BCP)
Acceptable use policy (AUP)
Business impact analysis (BIA)
108
What type of attack involves exploiting weak passwords?
All of the above
c) Rainbow table attack
b) Dictionary attack
a) Brute force
109
Which of the following is an entity that accepts and validates information contained within a request for a certificate?
Registration authority
Enrollment agent
Certificate authority
Recovery agent
110
Henry accesses a database server from his computer. What data state best describes the data while it is on the network
Data in use
Data in transit
Data on the wire
Data at rest
111
Mateo wants to conduct a fail over test for his datacenter. What will he need to do to accomplish this?
Force a fail over using his network or other systems.
Turn off all systems in his datacenter.
Simulate what would occur during a datacenter outage.
Cause an outage of a critical system
112
Which of the following answers refers to a deprecated wireless authentication protocol developed by Cisco?
EAP-TLS
EAP-TTLS
LEAP
PEAP
113
Which of the following answers refers to a NIST's voluntary framework outlining best practices for computer security?
RMF
CIS
SSAE
CSF
114
When is a BCP or DRP design and development actually completed?
Once senior management approves
Never
Only after implementation and distribution
Only after testing and drilling
115
An MS Windows component that enables encryption of individual files is called:
FDE
Bitlocker
SED
EFS

Sec 701 outside Combo Flashcards | StudBud