Domain 2: Threats, Vulnerabilities, and Mitigations

Question 1

What determines if a risk exists in a system?

Accepted Answer

Existence of both threat and vulnerability

Question 2

What does a security awareness phishing campaign involve?

Accepted Answer

Simulated phishing emails and training

Question 3

What is dumpster diving in cybersecurity?

Accepted Answer

Searching physical trash for data

Question 4

Which social engineering trigger relies on creating pressure to act fast?

Accepted Answer

Urgency

Question 5

What is a honeytoken?

Accepted Answer

Fake data or credential used to detect intrusions

Question 6

What defines a vulnerability?

Accepted Answer

A weakness in system design or implementation

Question 7

What motivates most organized crime groups?

Accepted Answer

Financial Gain

Question 8

Which of the following attacks targets Bluetooth vulnerabilities?

Accepted Answer

BlueBorne

Question 9

A user is tricked into thinking a fake invoice is real. What is this called?

Accepted Answer

Invoice scam

Question 10

Which deception technique involves fake DNS entries?

Accepted Answer

Bogus DNS

Question 11

Pretexting is a form of:

Accepted Answer

Deception via false narrative

Question 12

Which actor has government sponsorship and high sophistication?

Accepted Answer

Nation-State actor

Question 13

An attack that involves impersonating a trusted brand is called:

Accepted Answer

Brand Impersonation

Question 14

An attacker leaves a malware-infected USB in a parking lot. What technique is being used?

Accepted Answer

Baiting

Question 15

Which form of social engineering involves watching someone enter a password?

Accepted Answer

Shoulder Surfing

Question 16

What is used to reduce the attack surface?

Accepted Answer

Disabling unused protocols

Question 17

What is a common goal of impersonation attacks?

Accepted Answer

Harvest credentials

Question 18

Watering hole attacks target:

Accepted Answer

Popular websites used by targets

Question 19

Smishing attacks use what medium?

Accepted Answer

Text Messages

Question 20

What is the definition of a threat?

Accepted Answer

Anything that can cause harm to systems

Question 21

What is the purpose of a honeypot?

Accepted Answer

Attract and monitor attackers

Question 22

What type of attack uses voice calls to trick victims?

Accepted Answer

Vishing

Question 23

What term refers to employees using IT without approval?

Accepted Answer

Shadow IT

Question 24

Which is an example of disinformation?

Accepted Answer

Deliberate false content to deceive

Question 25

Business Email Compromise (BEC) typically involves:

Accepted Answer

Hijacking internal email accounts

Question 26

What type of phishing targets specific executives?

Accepted Answer

Whaling

Question 27

What attack spoofs a legitimate phone call to gain credentials?

Accepted Answer

Vishing

Question 28

What is the goal of Advanced Persistent Threats (APTs)?

Accepted Answer

Maintain stealthy long-term access

Question 29

Virus or spyware is planted in your computer that "poisons" your DNS + hijacks the web browser, redirecting to fake site

Accepted Answer

Pharming

Question 30

A “script kiddie” is defined as:

Accepted Answer

A low-skilled individual using prebuilt tools

Question 31

Which threat vector involves email attachments?

Accepted Answer

File-based

Question 32

Which threat actor type is most likely to conduct cyber espionage?

Accepted Answer

Nation-State

Question 33

Which attack relies on provoking fear to act?

Accepted Answer

Fear-based

Question 34

What social engineering tactic involves making a fake emergency?

Accepted Answer

Urgency

Question 35

What is the best defense against social engineering?

Accepted Answer

Security awareness training

Question 36

What is the primary difference between whaling and spear phishing?

Accepted Answer

Whaling targets executives

Question 37

Tailgating differs from piggybacking in that:

Accepted Answer

Tailgating happens without consent

Question 38

Which is a group of honeypots on a network?

Accepted Answer

Honeynet

Question 39

Which trigger involves users doing something because others are doing it?

Accepted Answer

Social Proof

Question 40

What does a spear phishing attack focus on?

Accepted Answer

Specific individuals or groups

Question 41

What is typosquatting?

Accepted Answer

Registering a domain similar to a popular one

Question 42

Which technique makes malicious links appear legitimate?

Accepted Answer

Mismatched URLs

Question 43

Which of the following is a natural threat?

Accepted Answer

Earthquake

Question 44

What are the key components of a phishing email?

Accepted Answer

Urgency, poor grammar, mismatched URLs

Question 45

How can users verify link safety in emails?

Accepted Answer

Hovering to see actual URL

Question 46

What makes Business Email Compromise dangerous?

Accepted Answer

Uses real internal accounts

Question 47

What is a honeyfile?

Accepted Answer

Decoy document to detect unauthorized access

Question 48

Misinformation is different from disinformation because:

Accepted Answer

Lacks intent to harm

Question 49

A malicious image file is an example of what threat vector?

Accepted Answer

Image-based

Question 50

What is vhishing?

Accepted Answer

Voice-based phishing

Question 51

An attacker follows an authorized employee through a door unnoticed. This is:

Accepted Answer

Tailgating

Domain 2: Threats, Vulnerabilities, and Mitigations

Questions 51

Domain 2: Threats, Vulnerabilities, and Mitigations

Questions 51