Topics

Cybersecurity

27 free questions with worked answers, and 599 more in the full bank.

Free questions

More Cybersecurity questions (page 2 of 10)

Answers and explanations are in the full bank.

• After successfully removing a ransomware infection and rebuilding servers from clean backups, the team documents what went wrong and updates their firewall rules to prevent recurrence. This occurs in which phase? · 3 marks
• A SOC analyst uses SIEM alerts and endpoint logs to confirm that anomalous activity on a workstation is a confirmed breach, not a false positive. Which IR phase does this represent? · 4 marks
• A forensic investigator creates a cryptographically signed document detailing who collected a hard drive, where it was stored, and who had access to it at all times until it was presented in court. This document ensures... · 3 marks
• When responding to a compromised live server, the investigator captures the RAM before powering down the machine to image the hard drive. This follows the principle of... · 4 marks
• To ensure a hard drive image is exactly identical to the original suspect drive and has not been altered during the copying process, an investigator should... · 4 marks
• A security analyst reviews a vulnerability scanner report and sees a vulnerability with a CVSS v3.1 base score of 9.5. How should this vulnerability be prioritized? · 3 marks
• During an engagement, an ethical hacker discovers an open port, determines the service version, uses an exploit to gain a shell, and then extracts the password hashes from the registry. The extraction of hashes represents which penetration testing phase? · 4 marks
• A company automatically applies OS updates to test servers on Tuesday, verifies stability, and pushes the updates to production servers on Friday. This process is known as... · 3 marks
• A retail store that processes online credit card transactions must implement network segmentation, encrypt cardholder data, and undergo regular security assessments to avoid heavy fines. Which framework governs this? · 1 mark
• A clinic is audited to ensure that electronic Protected Health Information (ePHI) is encrypted at rest and that access logs are strictly maintained. Which regulatory requirement enforces this in the US? · 3 marks
• A European citizen requests that a social media company permanently delete all their personal account data and telemetry. The company complies to avoid massive penalties. This right is granted by... · 3 marks
• A fraudster finds a stack of printed company directories and org charts in the recycling bin behind an office building, which they later use to craft targeted emails. This is an example of... · 1 mark
• An attacker identifies that a company's marketing team frequently visits a specific industry forum. The attacker compromises that forum and injects a malicious payload to infect the marketing team's computers. This is a... · 3 marks
• A user receives an urgent message appearing to be from the IT department, claiming their account is compromised and instructing them to type a specific command into their terminal to fix it. The command actually grants the attacker remote access. This is... · 4 marks
• A user notices their computer's fan is constantly spinning at max speed and their CPU usage is at 100% even when idle. The security team finds an unauthorized program solving cryptographic puzzles. The system is infected with... · 1 mark
• A disgruntled system administrator writes a script that will automatically delete all customer databases if their employee ID is removed from the active payroll system. This malicious script is a... · 3 marks
• A user downloads a free game toolbar. While the toolbar works, it also constantly displays pop-up advertisements on the desktop and tracks browsing habits to serve more targeted ads. This is considered... · 3 marks
• A sophisticated threat group uses malware that dynamically modifies its underlying code structure every time it infects a new file, ensuring the file hash is never the same twice. This evasion technique is known as... · 4 marks
• A tester types `<script>alert("Hacked")</script>` into a website's search bar, and the browser immediately displays an alert box containing the word "Hacked". This indicates the site is vulnerable to... · 1 mark
• An attacker sends a crafted request to a web server that includes the payload `ping -c 4 attacker.com` appended to a legitimate IP address field. The server executes the ping. This is an example of... · 4 marks
• A mobile application hardcodes an API key in its source code to authenticate to a backend database. An attacker reverse-engineers the APK, extracts the key, and accesses the database. This vulnerability is... · 3 marks
• An attacker tricks a web server into making internal HTTP requests to a protected internal administrative portal that is normally firewalled off from the internet. This vulnerability is called... · 4 marks
• A network technician notices a switch's MAC address table is overflowing because thousands of frames with randomly generated source MAC addresses are flooding the switch in seconds. The attacker is attempting a... · 3 marks
• An attacker crafts an 802.1Q tagged frame with two VLAN tags. The native VLAN tag is stripped by the first switch, forwarding the payload with the second tag to a restricted VLAN. This attack is known as... · 4 marks
• A threat actor sets up a fake cell tower near a busy financial district to intercept mobile phone traffic, downgrade connections, and capture IMSI numbers. This device is commonly referred to as an... · 3 marks
• An attacker sends unsolicited, inappropriate images to a stranger's mobile device over a Bluetooth connection in a crowded coffee shop. This nuisance attack is called... · 1 mark
• A developer ensures that their application logs all critical administrative actions to an append-only, tamper-evident ledger. If a breach occurs, the security team can definitively prove who altered a configuration. This achieves... · 3 marks
• A datacenter installs redundant power supplies, backup generators, and multiple internet transit providers to ensure an application remains online during physical outages. This is an implementation of... · 1 mark
• A company requires that the master encryption key used to encrypt all customer databases cannot be decrypted by a single administrator. It requires three out of five executives to insert their smart cards simultaneously. This is an application of... · 3 marks
• When a user connects to a web server via TLS, the server generates a unique session key that is not derived from the server's long-term private RSA key. If the server's private key is later compromised, past sessions remain secure. This property is... · 4 marks
• An attacker gains access to a password database and sees that all passwords have random, unique data appended to them before they are hashed. This makes precomputed rainbow table attacks ineffective. What technique was used? · 3 marks
• A developer is choosing a hashing algorithm to securely store passwords. They select PBKDF2 because it runs the hash thousands of times, making brute-force attacks computationally expensive. This technique is known as... · 4 marks
• A retinal scan is used to access a highly secure biometric facility. Which authentication factor does this represent? · 1 mark
• A bank requires users to log in with a password and a physical RSA SecurID token that generates a random number every 60 seconds. What two factors are being used? · 3 marks
• A biometric system is tuned to be extremely strict to prevent unauthorized access, but as a result, legitimate employees are frequently denied entry and have to scan their fingerprints multiple times. The system has a high... · 4 marks
• A security administrator conducts a review and revokes access for an employee who transferred to a new department three months ago but still retained their old permissions. This process prevents... · 3 marks
• A database uses a security mechanism where data in a table is automatically classified. A user with "Secret" clearance querying the database will see 50 rows, but a user with "Top Secret" clearance querying the same table will see 60 rows. This is an example of... · 4 marks
• An administrator creates a firewall rule: `ALLOW TCP SRC:ANY DST:192.168.1.50 PORT:443`. What type of traffic is this rule intended to permit? · 3 marks
• A network relies on a firewall architecture where an external firewall connects to the internet, and an internal firewall connects to the corporate LAN. The web servers are placed on a subnet between these two firewalls. This subnet is called a... · 4 marks
• A system administrator installs a software agent on a critical database server to monitor local file integrity, registry changes, and system logs. This tool is best described as a... · 1 mark
• A company requires all traveling employees to route their web traffic through the corporate VPN, even when browsing personal sites at a hotel, so the corporate web filter can inspect the traffic. This VPN configuration is called... · 3 marks
• In a modern enterprise, relying solely on a perimeter firewall and assuming anyone inside the corporate office is trusted is considered an outdated model. The modern alternative that verifies every request is called... · 1 mark
• During an incident, the response team isolates a compromised server. They then begin changing passwords, closing vulnerable ports, and applying a critical OS patch that the attacker exploited. Which IR phase is this? · 4 marks
• Following a data breach, the CISO requires the security team to write a report detailing the timeline of the attack, the effectiveness of the response, and recommendations for improving future incident handling. This occurs in the... · 3 marks
• An investigator seizes a smartphone connected to a crime. They immediately place the phone inside a metallic mesh bag to prevent it from receiving remote wipe commands over cellular or Wi-Fi networks. This bag is a... · 1 mark
• To copy data from a suspect's hard drive without accidentally modifying its contents, an investigator uses a hardware device placed between the suspect drive and the forensic workstation. This device is a... · 3 marks
• A security analyst performs an authenticated scan of the environment and finds that a critical Apache vulnerability is present. However, the analyst knows the firewall completely blocks external access to this specific server. This compensating control lowers the... · 3 marks
• A penetration testing team is hired to assess a company. The team is given no prior knowledge of the company's network architecture, IP ranges, or source code. This type of engagement is called a... · 4 marks
• A company utilizes an automated system that hooks into their CI/CD pipeline. Every time a developer commits code, the system scans the source code for hardcoded passwords and SQL injection flaws before it is compiled. This tool is a... · 4 marks
• A publicly traded company in the United States must ensure strict accuracy of their financial reports and implement internal controls to prevent corporate fraud. Which regulation dictates these requirements? · 4 marks
• A cloud service provider hires an independent auditor to attest to the effectiveness of their security controls over a 12-month period. The auditor produces a detailed report intended for the cloud provider's enterprise customers. This report is a... · 3 marks
• A US federal agency requires that all data processed by a new cloud application be categorized according to its impact level (Low, Moderate, High) and secured using specific baseline controls. Which framework mandates this? · 1 mark
• An organization identifies that storing legacy, unencrypted customer passwords poses a severe risk. They decide to permanently delete this old database rather than attempting to secure it. Which risk management strategy is this? · 3 marks
• To protect against the financial impact of a potential ransomware attack, a hospital purchases a cybersecurity insurance policy. Which risk management strategy does this represent? · 1 mark
• A user downloading a supposedly legitimate file unknowingly downloads a small script instead. When executed, this script reaches out to a remote command-and-control server, downloads the actual malicious payload, and executes it. This initial script is a... · 3 marks
• An attacker identifies a race condition in a web application's banking module. They write a script to simultaneously send 100 withdrawal requests in the exact same millisecond before the database can update the account balance. This type of vulnerability exploits a flaw in... · 4 marks
• A threat actor copies the exact email signature and logo of a trusted vendor, sending an email to the accounts payable department stating that their banking details have changed and requesting all future payments be sent to the new account. This attack is... · 3 marks
• A malicious actor actively modifies the OSPF routing tables on a compromised internal router, causing traffic destined for the payroll server to be redirected to a packet sniffer before reaching its final destination. This is a form of... · 3 marks
• An IT department requires all administrative users to log into a jump server using MFA before they can initiate an RDP session to sensitive domain controllers. The jump server acts as a... · 1 mark
• A cyber incident responder is analyzing a compromised Windows machine and needs to view the chronological sequence of system events, application errors, and security audits. Which tool should they review? · 3 marks