- Which three properties make up the CIA triad, the foundational model of information security?
- Identification, Authentication, and Auditing
- Confidentiality, Integrity, and Availability
- Authorization, Accountability, and Assurance
- Nonrepudiation, Authenticity, and Possession
Correct answer: Confidentiality, Integrity, and Availability
The triad names confidentiality, integrity, and availability as the three goals every security program protects. Identification, authentication, and auditing are access-management steps rather than protection goals. Authorization, accountability, and assurance are governance outcomes built on top of the goals. Nonrepudiation, authenticity, and possession come from the Parkerian hexad, an extension of the model rather than the model itself.
- What does the principle of confidentiality primarily ensure?
- Systems are reachable at the promised hours
- Records are identical to the stored version
- Documents are visible to the vetted readers
- Actions are traceable to the named operator
Correct answer: Documents are visible to the vetted readers
Confidentiality means documents are visible to the vetted readers who hold a need to know, and to nobody else. Systems staying reachable at the promised hours is availability. Records staying identical to the stored version is integrity. Actions being traceable to the named operator is accountability, which records who acted rather than limiting who may look.
- Which security concept ensures that data has not been altered in an unauthorized manner?
- Constant availability
- Document authenticity
- Email confidentiality
- Information integrity
Correct answer: Information integrity
Information integrity is the property that data stays complete and unmodified except through changes that were approved. Constant availability concerns uptime rather than accuracy. Document authenticity proves who produced a file, not whether its contents later changed. Email confidentiality restricts who may read a message and says nothing about modification.
- A denial-of-service attack most directly threatens which element of the CIA triad?
- Resource availability
- Field confidentiality
- Transaction integrity
- Sender nonrepudiation
Correct answer: Resource availability
Flooding a server exhausts its capacity so legitimate users are turned away, and resource availability is the property destroyed. Field confidentiality concerns who may read stored values, which a flood never exposes. Transaction integrity concerns whether values were altered, and a flood alters nothing. Sender nonrepudiation concerns proving who originated a message.
- What is the term for the assurance that a sender cannot deny having sent a message?
- Periodic authorization
- Digital nonrepudiation
- Transaction accounting
- Signature verification
Correct answer: Digital nonrepudiation
Digital nonrepudiation is the assurance that binds a message to its originator so the originator cannot later disown it. Periodic authorization decides what an identity may do once its claim is accepted. Transaction accounting logs what was done afterwards. Signature verification is a mechanism that supports the assurance rather than the name of the assurance itself.
- Which of the following is an example of something you know used in authentication?
- A synchronized token
- A fingerprint sample
- A memorized password
- A personal smartcard
Correct answer: A memorized password
A memorized password is a secret held in the head, which is the knowledge factor. A synchronized token is a physical item that generates codes, so it is a possession factor. A personal smartcard is likewise carried rather than remembered. A fingerprint sample is a biometric trait, which is the inherence factor.
- Which factor of authentication does a fingerprint scan represent?
- A secret you recall
- A device you handle
- A region you occupy
- A trait you exhibit
Correct answer: A trait you exhibit
A fingerprint is a biometric characteristic, so a scan of it measures a trait you exhibit. A secret you recall is the knowledge factor. A device you handle is the possession factor. A region you occupy is the location factor, which relies on geolocation rather than on the body itself.
- What does multi-factor authentication require?
- Two factors drawn from separate categories
- Two factors drawn from identical knowledge
- Two factors drawn from similar credentials
- Two factors drawn from consecutive screens
Correct answer: Two factors drawn from separate categories
The requirement is satisfied when the two factors are drawn from separate categories such as knowledge, possession and inherence. Two factors drawn from identical knowledge sit in one category, so a single stolen secret defeats both. Two factors drawn from similar credentials repeat the same proof. Two factors drawn from consecutive screens simply ask twice.
- In risk management, what is a vulnerability?
- A disruption an attacker can cause
- A weakness an attacker can exploit
- A control an attacker can sidestep
- A prize an attacker can compromise
Correct answer: A weakness an attacker can exploit
A vulnerability is a weakness an attacker can exploit, meaning a gap in protection rather than the harm itself. A disruption an attacker can cause is the impact that follows. A control an attacker can sidestep is a failed safeguard, not the flaw it was meant to cover. A prize an attacker can compromise is the asset placed at stake.
- What term describes anything of value that an organization wants to protect?
- Known exposure
- Active control
- Business asset
- Insider threat
Correct answer: Business asset
Anything the organization values and wants to keep safe is a business asset, whether data, hardware, facilities or people. A known exposure is a gap already identified, not the thing being guarded. An active control is a safeguard applied to protect it. An insider threat is a source of harm rather than the object of protection.
- What is a threat in the context of risk management?
- A crack that can admit unwanted users
- A shield that can deflect known raids
- A holding that can tempt lone raiders
- A peril that can render flaws harmful
Correct answer: A peril that can render flaws harmful
A threat is a peril that can render flaws harmful, that is, the actor or event able to turn a weakness into damage. A crack that can admit unwanted users is the weakness itself. A shield that can deflect known raids is a control. A holding that can tempt lone raiders is the asset placed at stake.
- Risk is most accurately described as the combination of which two elements?
- Probability and impact
- Adversary and weakness
- Motives and capability
- Valuation and exposure
Correct answer: Probability and impact
Risk pairs probability and impact: how likely a loss is, weighed against how badly it hurts. Adversary and weakness name the threat and the flaw, which together create the opening but are not the definition. Motives and capability describe the attacker alone. Valuation and exposure describe the asset alone.
- Which risk treatment option involves purchasing insurance to handle potential losses?
- Risk mitigation, which blunts the probability
- Risk transference, which shifts the liability
- Risk avoidance, which cancels the undertaking
- Risk acceptance, which concedes the shortfall
Correct answer: Risk transference, which shifts the liability
Paying a premium moves the financial consequence to an insurer, and that is risk transference, which shifts the liability onto another party. Risk mitigation, which blunts the probability or the severity through controls, still keeps the loss in house. Risk avoidance, which cancels the undertaking, means the exposure never arises at all. Risk acceptance, which concedes the shortfall, absorbs the loss out of your own funds.
- Choosing not to perform an activity that carries risk is an example of which response?
- Softening the probable damage
- Insuring the likely shortfall
- Skipping the doubtful project
- Accepting the leftover danger
Correct answer: Skipping the doubtful project
Declining to run the work at all is avoidance, so skipping the doubtful project is the response described. Softening the probable damage with safeguards is mitigation, which keeps the work going. Insuring the likely shortfall is transference, which pays for a loss that still occurs. Accepting the leftover danger also keeps the work going.
- What is the term for the remaining risk after controls have been applied?
- Inherent risk
- Systemic risk
- External risk
- Residual risk
Correct answer: Residual risk
Whatever is left once safeguards are in place is residual risk. Inherent risk is the level measured before any safeguard is applied. Systemic risk describes exposure that spreads across a whole environment. External risk comes from outside the organization and says nothing about what safeguards have already removed.
- Implementing antivirus software to reduce malware risk is an example of which strategy?
- A tool that shrinks the exposure
- A policy that refunds the damage
- A retreat that drops the venture
- A decision that keeps the hazard
Correct answer: A tool that shrinks the exposure
Installing antivirus software adds a tool that shrinks the exposure, which is mitigation. A policy that refunds the damage is transference, since a third party carries the cost. A retreat that drops the venture is avoidance. A decision that keeps the hazard with no new safeguard is acceptance.
- Which type of security control is implemented through technology such as firewalls and encryption?
- Directive safeguard
- Technical safeguard
- Detective safeguard
- Deterrent safeguard
Correct answer: Technical safeguard
Firewalls and encryption are enforced by hardware and software, which makes each of them a technical safeguard. A directive safeguard tells staff what they are required to do. A detective safeguard notices an event once it has already begun. A deterrent safeguard discourages an attempt but enforces nothing in the machinery itself.
- A company policy requiring annual security awareness training is an example of which control type?
- Electronic control
- Structural control
- Managerial control
- Monitoring control
Correct answer: Managerial control
A written rule that directs how staff must behave is a managerial control, imposed by policy rather than by equipment. An electronic control is enforced in software or hardware. A structural control is a barrier such as a wall, a gate or a lock. A monitoring control watches for events instead of directing behavior.
- A locked server room door is an example of which control type?
- Advisory safeguard
- Software safeguard
- Remedial safeguard
- Physical safeguard
Correct answer: Physical safeguard
A lock on a door is a barrier you can touch, so it is a physical safeguard. An advisory safeguard is written guidance issued to staff. A software safeguard is enforced in code, such as a password check. A remedial safeguard repairs damage after an incident rather than keeping an intruder out.
- What is the primary purpose of the principle of least privilege?
- Sizing the access grant to the duties performed
- Scaling the access grant to the seniority level
- Setting the access grant to the widest coverage
- Extending the access grant to the whole project
Correct answer: Sizing the access grant to the duties performed
Least privilege means sizing the access grant to the duties performed and no further, which shrinks what a stolen account can reach. Scaling the access grant to the seniority level rewards rank rather than need. Setting the access grant to the widest coverage is the opposite of the principle. Extending the access grant to the whole project leaves rights in place long after the work is done.
- Defense in depth refers to which security approach?
- Shielding the estate with one hardened perimeter
- Shielding the estate with several stacked layers
- Shielding the estate with strong physical fences
- Shielding the estate with yearly staff briefings
Correct answer: Shielding the estate with several stacked layers
Defense in depth means shielding the estate with several stacked layers, so a failure in one is caught by the next. Shielding the estate with one hardened perimeter is the single-point approach the model replaces. Shielding the estate with strong physical fences covers a single dimension. Shielding the estate with yearly staff briefings trains people but leaves the technology unguarded.
- What is the main goal of separation of duties?
- To free a leader from a heavy approval queue
- To shield a server from a lone outside probe
- To keep a worker from a whole sensitive task
- To guard a process from a wider staff circle
Correct answer: To keep a worker from a whole sensitive task
Separation of duties exists to keep a worker from a whole sensitive task, so that creating and approving cannot rest with one person. To free a leader from a heavy approval queue is delegation, which concentrates authority rather than splitting it. To shield a server from a lone outside probe is a perimeter matter. To guard a process from a wider staff circle is need to know.
- Which of the following best describes due care?
- Studying the local market to guide spending
- Handing the heavy burden to hired suppliers
- Ignoring the plain warning to guard profits
- Taking the prudent steps to shield holdings
Correct answer: Taking the prudent steps to shield holdings
Due care is the continuing practice of taking the prudent steps to shield holdings that a careful organization would take. Studying the local market to guide spending is due diligence, the investigation that comes first. Handing the heavy burden to hired suppliers moves cost but never moves responsibility. Ignoring the plain warning to guard profits is the negligence due care exists to prevent.
- What does the term 'privacy' primarily concern in information security?
- The care and control of personal records
- The design and reach of network defenses
- The purpose and depth of internal audits
- The cost and value of chosen protections
Correct answer: The care and control of personal records
Privacy concerns the care and control of personal records: how data identifying an individual is collected, used, kept and shared. The design and reach of network defenses is an architecture question. The purpose and depth of internal audits is assurance work. The cost and value of chosen protections is a risk-economics judgment rather than a privacy one.
- Which ISC2 Code of Ethics canon comes first in order of priority?
- Offer clients diligent, skilled, and honest service
- Shield society, the common good, and infrastructure
- Advance the profession, its methods, and reputation
- Act with honor, integrity, fairness, and lawfulness
Correct answer: Shield society, the common good, and infrastructure
The first and highest canon is to shield society, the common good, and infrastructure, and it outranks the rest whenever duties collide. Act with honor, integrity, fairness, and lawfulness is the second canon. Offer clients diligent, skilled, and honest service is the third, owed to principals. Advance the profession, its methods, and reputation is the fourth and last.
- What is a qualitative risk assessment based on?
- Currency totals for each reported failure
- Annual estimates for each expected outage
- Opinion ratings for each weighed exposure
- Exact percentages for each measured asset
Correct answer: Opinion ratings for each weighed exposure
A qualitative assessment sorts hazards using opinion ratings for each weighed exposure, such as high, medium and low bands. Currency totals for each reported failure and annual estimates for each expected outage are quantitative results, the SLE and ALE figures. Exact percentages for each measured asset are quantitative as well, since they rest on measurement rather than judgment.
- Which calculation represents Annualized Loss Expectancy (ALE)?
- Asset worth times the raw exposure ratio
- Repair bills times the daily fault count
- Threat score times the flaw severity gap
- Single outage cost times the yearly rate
Correct answer: Single outage cost times the yearly rate
The annualized figure is the single outage cost times the yearly rate, that is SLE multiplied by ARO. Asset worth times the raw exposure ratio yields the single loss expectancy itself, one step earlier in the chain. Repair bills times the daily fault count is an operations statistic. Threat score times the flaw severity gap is a scoring heuristic with no place in the formula.
- What does authentication establish?
- The identity of the visitor seeking access
- The privileges of the party holding access
- The logbook of the actions touching access
- The strength of the secret guarding access
Correct answer: The identity of the visitor seeking access
Authentication proves the identity of the visitor seeking access, confirming that a claimant really is who they say. The privileges of the party holding access are settled by authorization, which happens afterwards. The logbook of the actions touching access is accounting. The strength of the secret guarding access is a credential policy matter rather than something the process establishes.
- What does authorization determine?
- The proof checked for a strange caller
- The actions allowed for a known caller
- The trail recorded for a repeat caller
- The uptime pledged for a paying caller
Correct answer: The actions allowed for a known caller
Authorization settles the actions allowed for a known caller once the identity claim has been proved. The proof checked for a strange caller is authentication, which must come first. The trail recorded for a repeat caller is accounting. The uptime pledged for a paying caller is a service level commitment and says nothing about permissions.
- What is the purpose of accounting (auditing) in the AAA model?
- To assign and revoke user rights
- To check and confirm user claims
- To follow and store user actions
- To encrypt and mask user traffic
Correct answer: To follow and store user actions
Accounting exists to follow and store user actions so activity can be reviewed later and tied back to a person. To assign and revoke user rights is authorization. To check and confirm user claims is authentication. To encrypt and mask user traffic is a confidentiality control and forms no part of the tracking role.
- Which term describes information that, if disclosed, could harm an individual, such as a Social Security number?
- Deliberately published archives
- Statistically combined averages
- Automatically attached pointers
- Personally identifiable details
Correct answer: Personally identifiable details
Anything that can single out one human being, such as a Social Security number, counts as personally identifiable details and needs protection. Deliberately published archives are already open to anyone. Statistically combined averages describe a group and no longer point at one person. Automatically attached pointers are metadata about a file rather than about an individual.
- What is the best description of a security policy?
- A broad statement of intent and expectation
- A binding contract of service and penalties
- A ranked register of hazards and treatments
- A yearly summary of findings and exceptions
Correct answer: A broad statement of intent and expectation
A security policy is a broad statement of intent and expectation issued by senior management, setting direction without naming products. A binding contract of service and penalties is an agreement struck with a supplier. A ranked register of hazards and treatments is the risk register. A yearly summary of findings and exceptions is an audit report.
- Which document type provides mandatory step-by-step instructions to accomplish a task?
- Compulsory standard
- Sequenced procedure
- Departmental policy
- Additional guidance
Correct answer: Sequenced procedure
A sequenced procedure sets out ordered, obligatory steps for carrying out one task from start to finish. A compulsory standard fixes what must be achieved or which product must be used, not the order of the steps. A departmental policy states intent at a high level. Additional guidance is advisory and carries no obligation.
- A guideline differs from a standard in that a guideline is:
- A rule a firm is bound to follow
- A value a system is set to apply
- A hint a user is free to decline
- A step a clerk is told to repeat
Correct answer: A hint a user is free to decline
A guideline is advice: a hint a user is free to decline without breaching anything. A rule a firm is bound to follow is a standard, which is compulsory. A value a system is set to apply is a baseline configuration. A step a clerk is told to repeat is a procedure, and that is obligatory too.
- What is the goal of an organization performing a risk assessment?
- To pick, deploy, and tune modern defenses
- To erase, deny, and dismiss known dangers
- To fund, renew, and file yearly contracts
- To find, weigh, and rank probable threats
Correct answer: To find, weigh, and rank probable threats
An assessment exists to find, weigh, and rank probable threats so the organization can decide what to treat first. To pick, deploy, and tune modern defenses is what happens afterwards, once a priority has been named. To erase, deny, and dismiss known dangers is not achievable. To fund, renew, and file yearly contracts is insurance, which is one treatment rather than the goal.
- Which concept ensures that individuals are held responsible for their actions on a system?
- Personal accountability
- Constant authentication
- Positive identification
- Provable nonrepudiation
Correct answer: Personal accountability
Personal accountability ties each recorded action back to the human who performed it, so that person can be answerable for it. Constant authentication only proves who is present at the keyboard. Positive identification only asserts a claimed name. Provable nonrepudiation stops a party denying one specific message rather than covering everything they did.
- What is meant by 'risk acceptance'?
- Adding a filter and then tuning it yearly
- Noting a hazard and then leaving it alone
- Buying a policy and then claiming it back
- Ending a project and then closing it down
Correct answer: Noting a hazard and then leaving it alone
Acceptance means noting a hazard and then leaving it alone, taking no further step because acting would cost more than the exposure is worth. Adding a filter and then tuning it yearly is mitigation. Buying a policy and then claiming it back is transference. Ending a project and then closing it down is avoidance.
- Which of the following best describes a 'control' in security?
- A hole that attracts a burglar
- A trophy that tempts a prowler
- A measure that lowers a hazard
- A raider that plots a takeover
Correct answer: A measure that lowers a hazard
A control is a measure that lowers a hazard, a safeguard put in place to shrink either the likelihood or the impact of harm. A hole that attracts a burglar is a vulnerability. A trophy that tempts a prowler is an asset. A raider that plots a takeover is a threat, the source of harm rather than the defense against it.
- Encrypting data so only authorized parties can read it primarily supports which security goal?
- Instant availability
- Message authenticity
- Order nonrepudiation
- File confidentiality
Correct answer: File confidentiality
Scrambling content so that only holders of the proper key can read it protects file confidentiality. Instant availability concerns whether records can be reached when wanted, which scrambling does not improve. Message authenticity proves who wrote something. Order nonrepudiation stops a party denying that they sent a transaction, which needs signatures rather than secrecy.
- What is the primary purpose of a Business Continuity Plan (BCP)?
- Restoring damaged technology equipment afterward
- Ranking critical process dependencies beforehand
- Sustaining essential operations amid disruptions
- Managing active intrusion containment procedures
Correct answer: Sustaining essential operations amid disruptions
A business continuity plan exists so that sustaining essential operations amid disruptions remains possible while the event is still under way. Restoring damaged technology equipment afterward is recovery work carried out once the event has passed. Ranking critical process dependencies beforehand is an impact analysis, done in advance. Managing active intrusion containment procedures belongs to incident response, not continuity.
- What does a Disaster Recovery Plan (DRP) primarily focus on?
- Preserving everyday production and customer services
- Investigating live intrusions and malicious activity
- Estimating downtime losses and functional priorities
- Reinstating unreachable servers and missing datasets
Correct answer: Reinstating unreachable servers and missing datasets
Recovery planning is aimed at reinstating unreachable servers and missing datasets once the event is over. Preserving everyday production and customer services is what a continuity plan does while the event is still in progress. Investigating live intrusions and malicious activity is incident response work. Estimating downtime losses and functional priorities is the output of an impact analysis performed beforehand.
- What does Recovery Time Objective (RTO) define?
- Longest permissible delay of system restoration
- Largest acceptable window of unrecoverable data
- Average measured interval of equipment failures
- Median historical duration of completed repairs
Correct answer: Longest permissible delay of system restoration
This target sets the longest permissible delay of system restoration that the business is willing to accept before an outage becomes intolerable. Largest acceptable window of unrecoverable data is the recovery point objective, a data measure rather than a clock measure. Average measured interval of equipment failures is mean time between failures, a reliability statistic. Median historical duration of completed repairs records past performance instead of a forward-looking target.
- What does Recovery Point Objective (RPO) measure?
- Committed maximum recovery window, minutes
- Greatest tolerable information loss, hours
- Scheduled automated snapshot cadence, days
- Estimated quarterly downtime cost, dollars
Correct answer: Greatest tolerable information loss, hours
This target states the greatest tolerable information loss, hours of it at the outside, by fixing how far back the newest usable copy is allowed to sit. A committed maximum recovery window, minutes long, is the recovery time objective instead. A scheduled automated snapshot cadence, days apart, sets how often copies run rather than how much work may be lost. An estimated quarterly downtime cost, dollars per outage, is a financial figure and not a data measure.
- What is the first phase of the incident response process according to common models?
- Eradication phase
- Containment phase
- Preparation phase
- Restoration phase
Correct answer: Preparation phase
Common models open with the preparation phase, in which policies, tooling, staffing, and training are put in place before anything goes wrong. The containment phase can only begin once something is already under way. The eradication phase strips out the cause after containment has held the damage. The restoration phase returns service to its usual state at the end.
- During incident response, what is the goal of the containment phase?
- Deleting hostile binaries and patching weaknesses
- Reviewing recorded events and revising checklists
- Rebuilding scrubbed hosts and resuming operations
- Limiting immediate damage and halting propagation
Correct answer: Limiting immediate damage and halting propagation
Containment succeeds when it is limiting immediate damage and halting propagation, so the trouble stops spreading while responders work. Deleting hostile binaries and patching weaknesses is eradication, which comes later. Rebuilding scrubbed hosts and resuming operations is the recovery step. Reviewing recorded events and revising checklists is the lessons-learned step, taken once everything has closed.
- Which incident response phase involves removing the cause of the incident, such as deleting malware?
- Eradication effort
- Damage containment
- Detection analysis
- Recovery procedure
Correct answer: Eradication effort
Stripping out the root cause, wiping the hostile code and closing whatever it abused, is the eradication effort. Damage containment comes first and only limits the spread, leaving the cause in place. Detection analysis establishes that something is wrong but changes nothing on the host. Recovery procedure returns cleaned systems to service afterward.
- What is the purpose of the lessons-learned phase after an incident?
- Assigning personal blame, disciplining careless employees
- Strengthening future responses, using documented findings
- Preserving forensic exhibits, aiding eventual prosecution
- Producing regulatory notices, alerting affected customers
Correct answer: Strengthening future responses, using documented findings
The review exists for strengthening future responses, using documented findings from the event that has just closed. Assigning personal blame, disciplining careless employees, is explicitly not the aim and drives honest reporting underground. Preserving forensic exhibits, aiding eventual prosecution, is evidence handling done much earlier. Producing regulatory notices, alerting affected customers, is a legal and communications duty rather than process improvement.
- What is a Business Impact Analysis (BIA) used to determine?
- Rating threat likelihood and countermeasure adequacy
- Sequencing server rebuilds and network reconnections
- Ranking function criticality and outage consequences
- Cataloging compliance gaps and remediation deadlines
Correct answer: Ranking function criticality and outage consequences
The study produces exactly this: ranking function criticality and outage consequences, so the organization learns what matters most and what losing it costs. Rating threat likelihood and countermeasure adequacy is a risk assessment, which studies causes rather than consequences. Sequencing server rebuilds and network reconnections is recovery planning, written afterward. Cataloging compliance gaps and remediation deadlines is audit work and says nothing about criticality.
- Which type of recovery site is fully equipped and can take over operations almost immediately?
- Regional warm site
- Reserved cold site
- Leased mobile site
- Alternate hot site
Correct answer: Alternate hot site
An alternate hot site already runs duplicated hardware, software, and current data, so it can absorb production almost at once. A regional warm site holds some equipment but still needs configuration and a data load. A reserved cold site supplies space and power only. A leased mobile site is a transportable shell that must be delivered and fitted out first.
- A recovery site that has space and power but no installed hardware or data is called a:
- Separate standby cold site
- Live synchronized hot site
- Partly furnished warm site
- Rented external cloud site
Correct answer: Separate standby cold site
A separate standby cold site offers the building, power, and cooling and nothing else, so equipment and data must both be brought in before it is usable. A live synchronized hot site is already running with current data. A partly furnished warm site holds some hardware that still needs configuring. A rented external cloud site supplies compute on demand rather than an empty shell.
- What characterizes a warm site?
- Duplicated servers, live replication, immediate cutover
- Partial hardware, offline copies, delayed configuration
- Bare floorspace, utility hookups, unfurnished interiors
- Towable trailers, portable generators, temporary layout
Correct answer: Partial hardware, offline copies, delayed configuration
The middle option is best described as partial hardware, offline copies, delayed configuration: some kit is racked, but the data must be loaded and the build finished before work can move there. Duplicated servers, live replication, immediate cutover describes a hot facility. Bare floorspace, utility hookups, unfurnished interiors describes a cold one. Towable trailers, portable generators, temporary layout describes a mobile unit.
- What is the primary reason for maintaining regular data backups?
- Retaining older records, satisfying statutory examiners
- Surviving disk failures, avoiding service interruptions
- Recreating lost material, undoing accidental corruption
- Duplicating live changes, mirroring active transactions
Correct answer: Recreating lost material, undoing accidental corruption
Copies exist for recreating lost material, undoing accidental corruption, so a clean earlier version can be put back. Retaining older records, satisfying statutory examiners, describes archiving, which serves retention rather than restoration. Surviving disk failures, avoiding service interruptions, describes redundant arrays, which cannot help against a bad write. Duplicating live changes, mirroring active transactions, describes replication, which faithfully copies the damage too.
- Why should backup media be stored at an offsite location?
- Releasing valuable floor space inside congested rooms
- Speeding routine restores using nearby tape libraries
- Meeting basic licensing terms covering archived media
- Keeping duplicate copies outside one catastrophe zone
Correct answer: Keeping duplicate copies outside one catastrophe zone
Distance is the whole point: keeping duplicate copies outside one catastrophe zone means the fire, flood, or storm that takes the primary building cannot take the copies with it. Releasing valuable floor space inside congested rooms is a convenience, not a protection. Speeding routine restores using nearby tape libraries argues for the opposite of distance. Meeting basic licensing terms covering archived media has no bearing on survivability.
- What is an event in the context of security operations?
- Detectable occurrence, benign or disruptive
- Confirmed compromise, hostile or unintended
- Automated notification, scripted or refined
- Unauthorized exposure, slight or widespread
Correct answer: Detectable occurrence, benign or disruptive
In security operations a detectable occurrence, benign or disruptive, is the definition: anything observable on a host or network counts, whether or not it turns out to matter. Confirmed compromise, hostile or unintended, describes an incident, the narrower subset that actually harms security. Automated notification, scripted or refined, describes an alert, the output of a monitoring rule. Unauthorized exposure, slight or widespread, describes a breach, a legal category narrower still.
- What is the primary purpose of access control?
- Checking stated identities against issued credentials
- Deciding whether requesters obtain shielded resources
- Recording completed actions inside protected journals
- Scrambling archived documents using published ciphers
Correct answer: Deciding whether requesters obtain shielded resources
The whole mechanism exists for deciding whether requesters obtain shielded resources, and on what terms, once identity is already known. Checking stated identities against issued credentials is authentication, the step that comes before that decision. Recording completed actions inside protected journals is accounting, which happens afterward. Scrambling archived documents using published ciphers is encryption, which guards content even where no such rules apply.
- In access control, what is a 'subject'?
- Passive container holding protected documents
- Mediating component enforcing declared limits
- Active initiator issuing operational requests
- Persistent table listing permitted operations
Correct answer: Active initiator issuing operational requests
A subject is the active initiator issuing operational requests: a person, a service account, or a running program that asks for something. A passive container holding protected documents is the object, the thing acted upon. A mediating component enforcing declared limits is the reference monitor that adjudicates the request. A persistent table listing permitted operations is the list consulted while that decision is made.
- In access control, what is an 'object'?
- Active requester seeking restricted material
- Portable token conveying registered identity
- Sensitivity label ranking classified records
- Inert repository storing retrievable content
Correct answer: Inert repository storing retrievable content
An object is the inert repository storing retrievable content, such as a file, a table, or a printer queue, which is acted upon rather than acting. An active requester seeking restricted material is the subject on the other side of the transaction. A portable token conveying registered identity is a credential used during authentication. A sensitivity label ranking classified records is metadata that drives the decision, not the thing being reached.
- Which access control model assigns permissions based on a user's job role?
- RBAC group inheritance
- ABAC attribute lookups
- MAC clearance criteria
- DAC creator discretion
Correct answer: RBAC group inheritance
Rights travel with the position someone holds, so RBAC group inheritance is the scheme that hands out permissions by job. ABAC attribute lookups decide from properties of the requester, the resource, and the surroundings rather than from a named post. MAC clearance criteria compare system-assigned labels with clearances and ignore job titles entirely. DAC creator discretion leaves the choice with whoever owns the file.
- In Discretionary Access Control (DAC), who determines access to a resource?
- Central authority
- Information owner
- Platform software
- Records custodian
Correct answer: Information owner
Under discretionary rules the information owner decides who may read or change the material and can pass that right along at will. A central authority setting permissions from system-wide labels is mandatory control instead. Platform software merely enforces whatever the owner has already chosen. A records custodian looks after the material day to day but holds no power to grant anyone entry.
- Which access control model uses security labels and clearances enforced by the system?
- RBAC group aggregation
- DAC individual choices
- MAC mandated hierarchy
- ABAC contextual rating
Correct answer: MAC mandated hierarchy
Sensitivity markings are set centrally and cannot be overridden by whoever happens to hold the file, which is MAC mandated hierarchy. RBAC group aggregation hands out rights by job position and involves no clearances at all. DAC individual choices leave the decision with the owner, the opposite arrangement. ABAC contextual rating weighs properties such as time, device, and location rather than fixed sensitivity rankings.
- What is the purpose of an Access Control List (ACL)?
- Recording individual rights and portable tickets
- Filtering packet headers and blocking handshakes
- Storing observed activity and precise timestamps
- Naming qualified subjects and allowed operations
Correct answer: Naming qualified subjects and allowed operations
An entry set attached to an object works by naming qualified subjects and allowed operations, so the system knows who may read, write, or delete that object. Recording individual rights and portable tickets describes a capability list, which hangs off the subject instead. Filtering packet headers and blocking handshakes describes a firewall ruleset working on traffic. Storing observed activity and precise timestamps describes an audit trail, written after the fact.
- What does the principle of least privilege require for access control?
- Granting employees minimal rights, matching delegated duties
- Splitting risky workflows, involving several separate people
- Rotating personnel yearly, exposing quietly hidden collusion
- Reviewing privileges annually, catching stale surplus grants
Correct answer: Granting employees minimal rights, matching delegated duties
The principle comes down to granting employees minimal rights, matching delegated duties, so nobody holds more reach than the work actually needs. Splitting risky workflows, involving several separate people, is segregation of duties, a different control. Rotating personnel yearly, exposing quietly hidden collusion, is job rotation. Reviewing privileges annually, catching stale surplus grants, is recertification, which cleans up afterward rather than setting the floor.
- What is the concept of 'need to know' in access control?
- Clearance ranking matching published sensitivity tiers
- Information released solely serving stated assignments
- Group membership conferring extensive inherited rights
- Paired employees jointly unlocking sensitive documents
Correct answer: Information released solely serving stated assignments
The idea is information released solely serving stated assignments, so even a properly cleared person is handed nothing beyond the task at hand. Clearance ranking matching published sensitivity tiers is the separate condition of holding a high enough clearance, which by itself entitles nobody to anything. Group membership conferring extensive inherited rights is role assignment, which is deliberately broader. Paired employees jointly unlocking sensitive documents is dual control, a safeguard against one person acting alone.
- Which physical access control uses a small space with two doors to control entry?
- Rotating metal turnstile
- Concrete traffic bollard
- Sealed mantrap vestibule
- Contactless badge reader
Correct answer: Sealed mantrap vestibule
A sealed mantrap vestibule holds one person between two interlocked doors, and the second will not open until the first has shut and the occupant is verified. A rotating metal turnstile meters people one at a time but provides no holding space. A concrete traffic bollard stops vehicles rather than people. A contactless badge reader authenticates at a door but traps nobody between two of them.
- What is the purpose of a bollard in physical security?
- Recording visitor movement enabling delayed reviews
- Lighting dark approaches deterring evening prowlers
- Marking property boundaries guiding regular callers
- Stopping speeding trucks reaching building frontage
Correct answer: Stopping speeding trucks reaching building frontage
These are short, deeply anchored posts, and their job is stopping speeding trucks reaching building frontage, whether the approach is careless or deliberate. Recording visitor movement enabling delayed reviews describes cameras, a detective measure. Lighting dark approaches deterring evening prowlers describes exterior illumination. Marking property boundaries guiding regular callers describes fencing and signage, which direct people but halt no vehicle.
- Which of the following is a logical access control?
- Automated password checking
- Reinforced hardware locking
- External perimeter lighting
- Yearly background screening
Correct answer: Automated password checking
Automated password checking runs in software and decides whether an account may proceed, which is what makes it logical rather than physical. Reinforced hardware locking is a physical barrier placed around equipment. External perimeter lighting is a physical deterrent placed around the grounds. Yearly background screening is an administrative measure applied to people before hiring, not a technical gate on a system.
- What is the main benefit of using Role-Based Access Control in a large organization?
- Separate folder settings maximize personal flexibility
- Bundled position rights shrink administrative overhead
- Encrypted traffic hides harvested credentials entirely
- Continuous logging records individual account activity
Correct answer: Bundled position rights shrink administrative overhead
With thousands of staff the win is that bundled position rights shrink administrative overhead: define each set once, then attach and detach people as they move. Separate folder settings maximize personal flexibility describes discretionary ownership, which is exactly what becomes unmanageable at scale. Encrypted traffic hides harvested credentials entirely is a confidentiality measure and says nothing about who may do what. Continuous logging records individual account activity supports accountability afterward rather than simplifying assignment.
- What does provisioning a user account involve?
- Disabling departed employees and stripping leftover access
- Recertifying existing holdings and removing surplus grants
- Creating onboarding profiles and attaching suitable rights
- Reissuing forgotten passwords and unlocking blocked logins
Correct answer: Creating onboarding profiles and attaching suitable rights
The task covers creating onboarding profiles and attaching suitable rights, so a new joiner arrives with an identity and exactly the reach the post requires. Disabling departed employees and stripping leftover access is the reverse operation. Recertifying existing holdings and removing surplus grants is a periodic review of people already in place. Reissuing forgotten passwords and unlocking blocked logins is routine credential support rather than establishment.
- Why is it important to deprovision accounts when an employee leaves?
- Reclaiming dormant enterprise software licenses
- Preserving departed mailboxes pending discovery
- Tidying inaccurate directory listings quarterly
- Blocking intrusions using abandoned credentials
Correct answer: Blocking intrusions using abandoned credentials
The security reason is blocking intrusions using abandoned credentials: a login nobody watches is an ideal foothold for a former insider or for whoever buys the password. Reclaiming dormant enterprise software licenses saves money but is a finance argument. Preserving departed mailboxes pending discovery is a retention obligation that in fact argues for keeping data. Tidying inaccurate directory listings quarterly is housekeeping with no bearing on intrusion.
- What is single sign-on (SSO)?
- Authenticating once, afterward reaching many connected systems
- Copying matching passwords, updating separate local registries
- Demanding paired proofs, combining knowledge plus fingerprints
- Storing assorted secrets, releasing individual entries briefly
Correct answer: Authenticating once, afterward reaching many connected systems
The mechanism is authenticating once, afterward reaching many connected systems, because a trusted assertion is presented on the person's behalf to each of them. Copying matching passwords, updating separate local registries is password synchronization, which still forces a fresh login everywhere. Demanding paired proofs, combining knowledge plus fingerprints is multifactor authentication, which strengthens one login rather than removing the rest. Storing assorted secrets, releasing individual entries briefly is a credential vault, which fills in passwords but federates no trust.
- What is the purpose of a security badge with an embedded chip?
- Displaying printed photographs, aiding instant visual recognition
- Proving identity electronically, unlocking guarded inner doorways
- Broadcasting wearer whereabouts, tracking motion inside buildings
- Tagging portable equipment, deterring casual unauthorized removal
Correct answer: Proving identity electronically, unlocking guarded inner doorways
The chip exists for proving identity electronically, unlocking guarded inner doorways when the holder presents the card at a reader. Displaying printed photographs, aiding instant visual recognition, is what the printed face of a pass does and needs no electronics. Broadcasting wearer whereabouts, tracking motion inside buildings, describes an active location tag, a different device entirely. Tagging portable equipment, deterring casual unauthorized removal, describes an asset tag fixed to hardware rather than carried by a person.
- Which access control approach evaluates multiple characteristics such as user, resource, and environment to make decisions?
- RBAC positional bundling
- MAC clearance outranking
- ABAC condition weighting
- DAC proprietary granting
Correct answer: ABAC condition weighting
Judging several properties of the requester, the item, and the surrounding circumstances at the moment of the request is ABAC condition weighting. RBAC positional bundling looks only at the post a person holds. MAC clearance outranking compares a fixed label against a fixed clearance and consults nothing else. DAC proprietary granting leaves the call to the owner, who need weigh no conditions at all.
- What is the concept of 'segregation of duties' designed to prevent in access control?
- Guessable passwords cracked and replayed remotely
- Historical records altered and deleted undetected
- Departed workers retained and ignored permanently
- Bogus payments approved and hidden singlehandedly
Correct answer: Bogus payments approved and hidden singlehandedly
Splitting a sensitive process between two people is aimed squarely at bogus payments approved and hidden singlehandedly, since whoever raises a payment should never be the one who releases it. Guessable passwords cracked and replayed remotely is answered by credential policy. Historical records altered and deleted undetected is answered by immutable logging. Departed workers retained and ignored permanently is answered by prompt account removal.
- What is a CCTV system primarily used for in physical security?
- Overseeing and recording continuous activity
- Triggering and flashing urgent notifications
- Verifying and matching presented credentials
- Blocking and delaying determined trespassers
Correct answer: Overseeing and recording continuous activity
Cameras earn their place by overseeing and recording continuous activity, which both deters and leaves evidence that can be reviewed afterward. Triggering and flashing urgent notifications describes an alarm panel, which announces an event but keeps no picture. Verifying and matching presented credentials describes a reader mounted at a door. Blocking and delaying determined trespassers describes a barrier, which resists entry rather than observing it.
- A turnstile that allows only one person to pass per authentication helps prevent which physical threat?
- Discreet shoulder surfing
- Silent doorway tailgating
- Nighttime dumpster diving
- Clandestine badge cloning
Correct answer: Silent doorway tailgating
A turnstile admits exactly one body per successful read, which is what defeats silent doorway tailgating by somebody walking in on the heels of a legitimate holder. Discreet shoulder surfing lifts a PIN by watching and is unaffected by the gate. Nighttime dumpster diving harvests discarded paper outside the building. Clandestine badge cloning copies a credential, so the intruder crosses the gate with a read of their own.
- What is tailgating in the context of physical security?
- Propping monitored exits open, overriding automatic closures
- Persuading security staff, obtaining unearned visitor passes
- Trailing badged coworkers inside, skipping reader validation
- Shimming latch mechanisms, bypassing locked restricted doors
Correct answer: Trailing badged coworkers inside, skipping reader validation
The behavior is trailing badged coworkers inside, skipping reader validation, so the follower presents no credential of any kind. Propping monitored exits open, overriding automatic closures, is door propping, which leaves a gap rather than following somebody through. Persuading security staff, obtaining unearned visitor passes, is impersonation, in which a credential really is issued. Shimming latch mechanisms, bypassing locked restricted doors, is a mechanical attack on the lock itself.
- In access control, what does the term 'authorization creep' describe?
- Newcomers granted sweeping rights, overshooting actual demands
- Departed personnel keeping live logins, unnoticed indefinitely
- Attackers chaining flaws, seizing administrator powers quickly
- Longtime employees hoarding excess entitlements, gained slowly
Correct answer: Longtime employees hoarding excess entitlements, gained slowly
The term names longtime employees hoarding excess entitlements, gained slowly as they move between posts while nothing is ever taken back. Newcomers granted sweeping rights, overshooting actual demands, is over-provisioning at hire, which happens all at once. Departed personnel keeping live logins, unnoticed indefinitely, describes orphaned accounts. Attackers chaining flaws, seizing administrator powers quickly, is an outside attack rather than gradual internal drift.
- Why should default accounts and passwords be changed on new systems?
- Factory credentials fill published manuals, aiding intruders
- Complexity rules demand varied characters, satisfying policy
- Personal logins improve forensic tracing, naming individuals
- Rotation schedules force quarterly resets, limiting exposure
Correct answer: Factory credentials fill published manuals, aiding intruders
Shipped logins are documented in public, so factory credentials fill published manuals, aiding intruders who simply look them up and try them. Complexity rules demand varied characters, satisfying policy, which is a separate requirement and does nothing about a pair the world already knows. Personal logins improve forensic tracing, naming individuals, which serves accountability. Rotation schedules force quarterly resets, limiting exposure from aging secrets rather than from published ones.
- What is the benefit of a periodic access review?
- It grants new hires baseline directory privileges
- It forces routine root credential rotation cycles
- It blocks risky privilege pairs inside enrollment
- It confirms retained user rights remain justified
Correct answer: It confirms retained user rights remain justified
A periodic review confirms retained user rights remain justified for the job someone holds now, so entitlements that outlived their purpose get withdrawn. It grants new hires baseline directory privileges is provisioning, a separate joiner process that runs long before any review. It forces routine root credential rotation cycles is a password policy, which governs secrets rather than entitlements. It blocks risky privilege pairs inside enrollment is separation-of-duties enforcement, applied at the moment of assignment.
- What does a lighting control in physical security primarily deter?
- Covert approach and undetected presence outdoors
- Levered doorframe and defeated deadbolt hardware
- Piggyback entry and unescorted visitor movements
- Vehicular impact and forcible perimeter breaches
Correct answer: Covert approach and undetected presence outdoors
Illumination removes the darkness an intruder depends on, so it deters covert approach and undetected presence outdoors and makes camera coverage usable. Levered doorframe and defeated deadbolt hardware are resisted by door hardware and strike-plate reinforcement, which light does nothing about. Piggyback entry and unescorted visitor movements are stopped by a turnstile, mantrap or escort rule. Vehicular impact and forcible perimeter breaches are the job of bollards and crash barriers.
- Which is an example of a biometric access control?
- Token secrets checked at the turnstile
- Iris patterns checked at the turnstile
- Keypad digits checked at the turnstile
- Photo permits checked at the turnstile
Correct answer: Iris patterns checked at the turnstile
The iris is a physiological trait, so iris patterns checked at the turnstile is the biometric example: the reader measures something you are. Token secrets checked at the turnstile is a possession factor produced by hardware you carry. Keypad digits checked at the turnstile is a knowledge factor you memorize. Photo permits checked at the turnstile is a visual credential a guard inspects, not a measured body trait.
- What is the role of a security guard as an access control?
- A technical control that applies preconfigured filters
- A directive control that mandates documented processes
- A physical control that exercises situational judgment
- A detective control that surfaces anomalous signatures
Correct answer: A physical control that exercises situational judgment
A guard is a physical control that exercises situational judgment, deciding case by case whether to admit someone and adapting to circumstances no written rule anticipated. A technical control that applies preconfigured filters describes a firewall or an access list, not a person. A directive control that mandates documented processes describes written policy. A detective control that surfaces anomalous signatures describes an intrusion detection sensor.
- Which model is most appropriate when access must be strictly controlled by classification levels in a military environment?
- Resource owner discretion (DAC)
- Job function assignments (RBAC)
- Context attribute policy (ABAC)
- Enforced clearance labels (MAC)
Correct answer: Enforced clearance labels (MAC)
Enforced clearance labels (MAC) is the model the question describes: the system compares a subject clearance with an object label and no user can override that decision, which is why defense environments adopt it. Resource owner discretion (DAC) lets whoever owns the data hand out rights at will. Job function assignments (RBAC) bind rights to a position rather than to a clearance. Context attribute policy (ABAC) evaluates dynamic attributes such as time of day and device posture.
- What is the purpose of logging access attempts?
- To supply defensible records for accountability reviews
- To correlate multisource telemetry for instant response
- To throttle successive failures for privileged accounts
- To bind cryptographic signatures for external transfers
Correct answer: To supply defensible records for accountability reviews
Logs exist to supply defensible records for accountability reviews: they tie an action to an identity and give investigators a timeline after the fact. To correlate multisource telemetry for instant response describes a SIEM platform built on top of logs rather than the logs themselves. To throttle successive failures for privileged accounts describes account lockout. To bind cryptographic signatures for external transfers describes non-repudiation through digital signing.
- Which concept describes giving a temporary, elevated level of access only when needed?
- Authority retained on hire
- Elevation issued on demand
- Powers layered on transfer
- Rights pruned on principle
Correct answer: Elevation issued on demand
Just-in-time access is elevation issued on demand: the account carries no extra power until a request is approved, and the grant expires by itself afterward. Authority retained on hire describes standing privilege, the arrangement this concept replaces. Powers layered on transfer describes privilege creep, the slow accumulation that recertification hunts for. Rights pruned on principle describes least privilege, which limits how much is held rather than how long.
- What is the function of a fence in physical security layering?
- A concrete bollard that deflects vehicular assaults
- A locked vestibule that isolates solitary occupants
- A perimeter barrier that discourages informal entry
- A mounted camera that preserves evidentiary footage
Correct answer: A perimeter barrier that discourages informal entry
A fence is a perimeter barrier that discourages informal entry: it marks where the site begins, slows a casual intruder and buys detection time for the layers behind it. A concrete bollard that deflects vehicular assaults addresses ramming, not walking. A locked vestibule that isolates solitary occupants is a mantrap controlling one person at a time. A mounted camera that preserves evidentiary footage is a detective control that records rather than obstructs.
- What does the OSI model layer 3 (Network layer) primarily handle?
- Voltage signaling and bitstream timing
- Frame buffering and adapter identities
- Port numbering and reliable sequencing
- Logical addressing and route selection
Correct answer: Logical addressing and route selection
Layer three does logical addressing and route selection, choosing a path for a packet between separate networks. Voltage signaling and bitstream timing belong to layer one, where raw bits meet the medium. Frame buffering and adapter identities belong to layer two, which works with physical adapter identities on one segment. Port numbering and reliable sequencing belong to layer four, which manages end-to-end conversations.
- At which OSI layer does a switch primarily operate?
- The data-link layer, which forwards frames
- The network layer, which directs datagrams
- The physical layer, which encodes voltages
- The transport layer, which orders segments
Correct answer: The data-link layer, which forwards frames
A traditional switch reads hardware addresses and so belongs to the data-link layer, which forwards frames onto the correct port. The network layer, which directs datagrams, is where a router works. The physical layer, which encodes voltages, is the domain of cabling, repeaters and hubs. The transport layer, which orders segments, is software on the endpoints rather than a forwarding device.
- Which protocol is the primary connection-oriented transport protocol providing reliable delivery?
- UDP, per RFC
- TCP, per RFC
- RTP, per RFC
- ARP, per RFC
Correct answer: TCP, per RFC
TCP, per RFC, is the connection-oriented transport: it completes a handshake, numbers every byte and retransmits whatever goes unacknowledged. UDP, per RFC, is the connectionless sibling with no handshake and no retransmission. RTP, per RFC, carries real-time media and tolerates loss rather than repairing it. ARP, per RFC, resolves addresses on a local segment and carries no application payload at all.
- Which protocol is connectionless and prioritizes speed over reliability?
- TLS, per RFC
- SSH, per RFC
- UDP, per RFC
- TCP, per RFC
Correct answer: UDP, per RFC
UDP, per RFC, is connectionless: it fires datagrams with no handshake and no retransmission, trading reliability for low latency in streaming and lookups. TCP, per RFC, is the opposite, guaranteeing ordered delivery at the cost of overhead. TLS, per RFC, adds confidentiality and integrity on top of a reliable stream. SSH, per RFC, is an encrypted remote-access protocol, not a lightweight datagram carrier.
- What is the primary function of a firewall?
- To spread client sessions by measured capacity
- To flag suspicious behavior by signature match
- To quarantine infected binaries by hash lookup
- To regulate network traffic by declared policy
Correct answer: To regulate network traffic by declared policy
A firewall exists to regulate network traffic by declared policy, permitting or denying each flow against an ordered rule set at a boundary. To spread client sessions by measured capacity is what a load balancer does. To flag suspicious behavior by signature match is detection work, done by an intrusion sensor. To quarantine infected binaries by hash lookup is endpoint antivirus.
- What does a stateful firewall track that a simple packet filter does not?
- The status of established sessions
- The location of learned interfaces
- The contents of inspected payloads
- The metrics of advertised prefixes
Correct answer: The status of established sessions
A stateful firewall keeps a table recording the status of established sessions, so a returning packet is judged by the conversation it belongs to rather than by its header alone. The location of learned interfaces is what a switch holds in its address table. The contents of inspected payloads is deep inspection, done by a proxy or application gateway. The metrics of advertised prefixes is what a router holds in its routing table.
- What is the primary purpose of a Virtual Private Network (VPN)?
- To check device health on corporate laptops
- To tunnel encrypted data on untrusted links
- To demand additional proof on remote logins
- To block outbound files on managed gateways
Correct answer: To tunnel encrypted data on untrusted links
A VPN exists to tunnel encrypted data on untrusted links, so traffic crossing a shared or public path stays confidential and intact end to end. To check device health on corporate laptops is network access control posture checking. To demand additional proof on remote logins is multifactor authentication. To block outbound files on managed gateways is data loss prevention.
- What is the function of a DMZ (demilitarized zone) in network design?
- To funnel admin logins in hardened jumpboxes
- To bait curious adversaries in decoy systems
- To place public servers in isolated segments
- To strand vital records in shielded enclaves
Correct answer: To place public servers in isolated segments
A DMZ exists to place public servers in isolated segments, so anything reachable from outside sits behind its own controls and a compromise there does not reach the trusted interior. To funnel admin logins in hardened jumpboxes describes a bastion host. To bait curious adversaries in decoy systems describes a honeypot. To strand vital records in shielded enclaves describes an air-gapped store.
- What does an Intrusion Detection System (IDS) do?
- Terminates hostile streams and resets sessions
- Evaluates headers and enforces perimeter rules
- Aggregates remote logs and compiles dashboards
- Observes network packets and signals anomalies
Correct answer: Observes network packets and signals anomalies
An IDS observes network packets and signals anomalies, raising an alert for an analyst or a correlation platform to act on; it does not itself intervene. Terminates hostile streams and resets sessions describes an IPS, which sits inline. Evaluates headers and enforces perimeter rules describes a firewall. Aggregates remote logs and compiles dashboards describes a SIEM platform.
- How does an Intrusion Prevention System (IPS) differ from an IDS?
- An IPS drops matched packets on arrival
- An IPS posts daily summaries on request
- An IPS awaits manual approval on alerts
- An IPS deletes infected files on reboot
Correct answer: An IPS drops matched packets on arrival
An IPS sits inline in the traffic path, so an IPS drops matched packets on arrival instead of merely recording them, and that active intervention is the whole difference. An IPS posts daily summaries on request describes reporting, which is what a detection-only sensor offers. An IPS awaits manual approval on alerts describes the human-in-the-loop workflow of a detection sensor. An IPS deletes infected files on reboot describes antivirus cleanup.
- What is the purpose of Network Address Translation (NAT)?
- To lease one temporary number for mobile laptops
- To share one routable number for private clients
- To publish one static number for common services
- To locate one hardware number for local delivery
Correct answer: To share one routable number for private clients
NAT exists to share one routable number for private clients, rewriting the source of outbound packets so many inside hosts appear outside as a single identity. To lease one temporary number for mobile laptops is DHCP. To publish one static number for common services is what the well-known port registry does. To locate one hardware number for local delivery is ARP.
- Which port is commonly associated with secure web traffic using HTTPS?
- 636 at L4
- 993 at L4
- 443 at L4
- 465 at L4
Correct answer: 443 at L4
HTTPS is web traffic wrapped in TLS, and it listens on TCP port 443, so 443 at L4 is correct. The others are also TLS-protected services on different ports: 636 is LDAPS for directory lookups, 993 is IMAPS for mailbox retrieval, and 465 carries mail submission over implicit TLS. Encryption alone does not identify the service; the port number does.
- Which port does standard unencrypted HTTP use?
- 21 at L4
- 23 at L4
- 25 at L4
- 80 at L4
Correct answer: 80 at L4
Cleartext web traffic uses TCP port 80, so 80 at L4 is correct. The other three are also cleartext services on well-known ports: 21 is the FTP control channel, 23 is Telnet for remote terminals, and 25 is SMTP for mail relay between servers. Each carries a different application, and only one of them serves web pages.
- Which protocol securely replaces Telnet for remote command-line access?
- SSH on TCP
- SCP on TCP
- RDP on TCP
- TLS on TCP
Correct answer: SSH on TCP
SSH on TCP replaced Telnet for interactive remote administration, encrypting the session and authenticating the server before any password is typed. SCP on TCP copies files across that same secure transport but offers no interactive shell. RDP on TCP delivers a graphical desktop rather than a command line. TLS on TCP is a security layer that other protocols call on, not a remote-access protocol of its own.
- What is a key security weakness of the Telnet protocol?
- It picks weakened ciphers in handshakes
- It moves typed credentials in cleartext
- It honors expired certificates in setup
- It stores recovered passwords in memory
Correct answer: It moves typed credentials in cleartext
Telnet has no transport protection at all, so it moves typed credentials in cleartext and anyone on the path can read the whole session. It picks weakened ciphers in handshakes cannot be the answer, because Telnet negotiates no cipher whatever. It honors expired certificates in setup fails for the same reason: there is no certificate handling in the protocol. It stores recovered passwords in memory describes a credential-harvesting tool rather than a design flaw of Telnet.
- What does the term 'network segmentation' refer to?
- Sorting queued packets into prioritized classes
- Doubling critical circuits into resilient pairs
- Splitting one estate into isolated compartments
- Stacking unrelated controls into layered series
Correct answer: Splitting one estate into isolated compartments
Segmentation means splitting one estate into isolated compartments, so a foothold in one zone cannot reach the rest and anything crossing a boundary is policed. Sorting queued packets into prioritized classes is quality of service. Doubling critical circuits into resilient pairs is redundancy engineering. Stacking unrelated controls into layered series is defense in depth, which adds layers rather than dividing the estate.
- What is a VLAN used for?
- To divide address ranges with masked prefixes
- To duplicate raw frames with mirrored uplinks
- To bundle parallel links with added bandwidth
- To reassign wired ports with unchanged cables
Correct answer: To reassign wired ports with unchanged cables
A VLAN exists to reassign wired ports with unchanged cables, grouping devices into one broadcast domain by configuration rather than by where the cable happens to run. To divide address ranges with masked prefixes is subnetting, a layer three exercise. To duplicate raw frames with mirrored uplinks is port mirroring for monitoring. To bundle parallel links with added bandwidth is link aggregation.
- Which type of malware disguises itself as legitimate software to trick users into installing it?
- A Trojan horse
- A boot rootkit
- A fileless bot
- A spyware tool
Correct answer: A Trojan horse
A Trojan horse is malware wrapped in something the victim wants, so the install is voluntary and the code then runs with that user's own rights. A boot rootkit hides in the startup path to survive cleanup, but it does not pose as a desirable download. A fileless bot lives in memory and arrives through an exploit rather than a willing install. A spyware tool harvests activity quietly once it is already resident.
- Which type of malware self-replicates and spreads across networks without user action?
- Parasitic virus
- Autonomous worm
- Bundled trojans
- Quiet keylogger
Correct answer: Autonomous worm
An autonomous worm needs no host file and no human click: it finds reachable hosts, exploits them and copies itself onward without help. A parasitic virus attaches to an existing file and runs only when someone opens it. Bundled trojans arrive hidden inside wanted software and depend entirely on the user installing them. A quiet keylogger records input where it lands and has no propagation mechanism of its own.
- What does ransomware do to a victim's data?
- Destroys it and forbids retrieval
- Copies it and markets credentials
- Scrambles it and ransoms recovery
- Corrupts it and delays disclosure
Correct answer: Scrambles it and ransoms recovery
Ransomware scrambles it and ransoms recovery: the files stay where they are but unreadable, and the operator sells the decryption key back to the owner. Destroys it and forbids retrieval describes a wiper, which offers no recovery at any price. Copies it and markets credentials describes an information stealer. Corrupts it and delays disclosure describes quiet sabotage meant to go unnoticed.
- What is the purpose of a wireless network using WPA3?
- To mask broadcast beacons for external scanners
- To admit registered adapters for shared airtime
- To ease simple enrollment for household routers
- To supply stronger cryptography for radio links
Correct answer: To supply stronger cryptography for radio links
WPA3 exists to supply stronger cryptography for radio links, replacing the weaker handshake and cipher choices of the protections that came before it. To mask broadcast beacons for external scanners is SSID hiding, which stops no determined attacker. To admit registered adapters for shared airtime is MAC filtering, defeated by address spoofing. To ease simple enrollment for household routers describes WPS, a convenience feature that weakened security.
- Why is WEP considered insecure for wireless networks?
- It uses breakable ciphers for ordinary traffic
- It rejects legacy adapters for absent firmware
- It demands fresh certificates for plain access
- It caps sustained throughput for modern radios
Correct answer: It uses breakable ciphers for ordinary traffic
WEP is unsafe because it uses breakable ciphers for ordinary traffic: its short initialization vectors repeat, letting a listener recover the shared secret from captured frames. It rejects legacy adapters for absent firmware is backwards; WEP accepts almost anything. It demands fresh certificates for plain access is false, since WEP has no certificate mechanism. It caps sustained throughput for modern radios is a performance claim, not a security weakness.
- What is a man-in-the-middle (MITM) attack?
- An attacker floods and stalls exposed webservers
- An attacker relays and alters live conversations
- An attacker baits and harvests unwary recipients
- An attacker records and resends captured packets
Correct answer: An attacker relays and alters live conversations
In this attack an attacker relays and alters live conversations: both ends believe they are talking directly, while in fact everything passes through a third party who is free to change it. An attacker floods and stalls exposed webservers describes denial of service. An attacker baits and harvests unwary recipients describes phishing. An attacker records and resends captured packets describes a replay attack.
- What is the purpose of DNS in a network?
- To place fresh clients into leased allocations
- To bind local machines into burned identifiers
- To turn typed hostnames into numeric addresses
- To route distant visitors into nearby replicas
Correct answer: To turn typed hostnames into numeric addresses
DNS exists to turn typed hostnames into numeric addresses, so people can use names while machines forward on numbers. To place fresh clients into leased allocations is DHCP. To bind local machines into burned identifiers is ARP, which works only within one segment. To route distant visitors into nearby replicas is what a content delivery network does.
- What does a Distributed Denial-of-Service (DDoS) attack use to overwhelm a target?
- Lone leased server exhausting bandwidth
- One malformed packet crashing listeners
- Bulk leaked logins replaying constantly
- Many hijacked machines blasting packets
Correct answer: Many hijacked machines blasting packets
The distributed part of the name is the point: many hijacked machines blasting packets at once, a botnet of enlisted hosts whose combined volume is hard to filter or trace back. Lone leased server exhausting bandwidth is an ordinary single-source flood. One malformed packet crashing listeners is an exploit-based outage rather than a volumetric one. Bulk leaked logins replaying constantly describes credential stuffing.
- What is the main purpose of a proxy server?
- To fetch and cache requests for internal users
- To queue and send messages for outside domains
- To store and publish entries for logon lookups
- To sample and share clocks for scattered hosts
Correct answer: To fetch and cache requests for internal users
A proxy stands between the client and the wider world: it exists to fetch and cache requests for internal users, which is what lets it filter, log and reuse responses. To queue and send messages for outside domains is a mail relay. To store and publish entries for logon lookups is a directory server. To sample and share clocks for scattered hosts is a time server.
- Which device connects different networks and directs traffic between them based on IP addresses?
- The ethernet switch
- The upstream router
- The wireless bridge
- The signal repeater
Correct answer: The upstream router
The upstream router joins separate networks and forwards packets by their destination IP addresses, which is exactly what the question describes. The ethernet switch forwards frames inside one network using hardware addresses. The wireless bridge joins two segments at the same layer and never examines IP. The signal repeater only regenerates a fading signal and makes no forwarding decision at all.
- What is the primary security concern with using public Wi-Fi?
- Screens may be seen by close bystanders
- Folders may be opened by joined devices
- Traffic may be read by nearby attackers
- Signups may be resold by portal vendors
Correct answer: Traffic may be read by nearby attackers
On an open hotspot the medium itself is shared, so traffic may be read by nearby attackers who capture frames or stand up a lookalike access point; a VPN is the usual answer. Screens may be seen by close bystanders is a genuine cafe risk, but a physical one. Folders may be opened by joined devices matters only where sharing was left switched on. Signups may be resold by portal vendors is a privacy nuisance, not the main exposure.
- What does port scanning typically reveal to an attacker?
- Which patches lapse on assessed endpoints
- Which accounts exist on local controllers
- Which gateways forward on distant subnets
- Which listeners answer on reachable hosts
Correct answer: Which listeners answer on reachable hosts
A scan tells the attacker which listeners answer on reachable hosts, mapping the exposed services that become candidate entry points. Which patches lapse on assessed endpoints comes from a vulnerability scanner, not a sweep of open sockets. Which accounts exist on local controllers comes from directory enumeration. Which gateways forward on distant subnets comes from a route trace.
- What is the function of TLS (Transport Layer Security)?
- To add encryption and identity for exchanged data
- To post digests and detection for saved documents
- To mint credentials and lifetimes for named users
- To grant tickets and renewals for domain sessions
Correct answer: To add encryption and identity for exchanged data
TLS wraps a session in order to add encryption and identity for exchanged data, proving which server you reached and keeping the conversation private in transit. To post digests and detection for saved documents describes hashing, which reveals change but conceals nothing. To mint credentials and lifetimes for named users describes a certificate authority, which TLS relies on but is not. To grant tickets and renewals for domain sessions describes Kerberos.
- What is the main risk of leaving unused network ports and services enabled?
- They confuse the inventory for compliance reviewers
- They widen the exposure for opportunistic intruders
- They shorten the interval for scheduled maintenance
- They dissolve the separation for internal workloads
Correct answer: They widen the exposure for opportunistic intruders
Every listening service is another door, so leaving them enabled means they widen the exposure for opportunistic intruders, which is why hardening closes whatever is not needed. They confuse the inventory for compliance reviewers is an administrative nuisance rather than the main risk. They shorten the interval for scheduled maintenance is not a consequence of open sockets at all. They dissolve the separation for internal workloads describes weak segmentation, a different design fault.
- Which addressing scheme uses 128-bit addresses?
- IPv6 unicast prefixes
- IPv4 classful subnets
- MAC physical identity
- ARP resolution caches
Correct answer: IPv6 unicast prefixes
IPv6 unicast prefixes are drawn from a 128-bit space, four times the width of the older scheme. IPv4 classful subnets come from a 32-bit space; MAC physical identity values are 48 bits burned in by the adapter vendor; and ARP resolution caches merely store learned pairings rather than defining any address width.
- What is the purpose of a honeypot in network security?
- To contain malware by opening a walled workspace
- To bait intruders by mimicking a prized resource
- To shield servers by fencing a neutral perimeter
- To flag intrusions by matching a known signature
Correct answer: To bait intruders by mimicking a prized resource
A decoy host earns its keep by baiting intruders, mimicking a prized resource so an adversary's tools and methods can be watched while real assets stay untouched. A sandbox instead contains malware by opening a walled workspace for suspect code; a screened subnet shields servers by fencing a neutral perimeter around public systems; and an intrusion detection sensor flags intrusions by matching a known signature. None of those three is a deliberate decoy.
- What does the term 'attack surface' refer to?
- The precise corridor one intrusion actually traveled
- The persistent adversaries one entire industry faces
- The combined reachable openings one platform exposes
- The downstream damage one successful breach inflicts
Correct answer: The combined reachable openings one platform exposes
An attack surface is the combined reachable openings one platform exposes — every place a hostile party could try to get in or pull data out. The precise corridor one intrusion actually traveled is a vector, a single path rather than the whole set. The persistent adversaries one entire industry faces make up its threat landscape. The downstream damage one successful breach inflicts describes impact, not exposure.
- Which protocol resolves IP addresses to MAC addresses on a local network?
- DNS supplies website addresses
- DHCP assigns numeric addresses
- RARP learns internet addresses
- ARP locates hardware addresses
Correct answer: ARP locates hardware addresses
ARP locates hardware addresses for a known logical address on the same segment, which is exactly the translation described. DNS supplies website addresses by translating names into numbers; DHCP assigns numeric addresses when a host joins; and RARP learns internet addresses starting from a hardware address, the reverse direction.
- What does DHCP automatically provide to devices on a network?
- Leased IP address settings
- Local DNS hostname records
- Verified PKI trust anchors
- Burned MAC hardware labels
Correct answer: Leased IP address settings
A joining client receives leased IP address settings — number, mask, gateway and resolver — for a bounded lease period. Local DNS hostname records map names to numbers and are served by the name service itself; verified PKI trust anchors come from a certificate authority; burned MAC hardware labels are fixed in the adapter by its maker and are never handed out dynamically.
- What is the main purpose of patch management?
- To rank weaknesses that scanners already reported
- To install repairs that resolve published defects
- To record settings that engineers later reproduce
- To approve requests that alter production systems
Correct answer: To install repairs that resolve published defects
The point of the discipline is to install repairs that resolve published defects before an adversary can weaponize them. Ranking weaknesses that scanners already reported is vulnerability management, which finds problems but fixes none; recording settings that engineers later reproduce is configuration management; approving requests that alter production systems is change management.
- What is the recommended practice for handling sensitive data when it is no longer needed?
- Archive or relocate the older drives
- Encrypt or compress the stored files
- Destroy or overwrite the spent media
- Reformat or relabel the reused disks
Correct answer: Destroy or overwrite the spent media
Once the information has reached end of life the safe move is to destroy or overwrite the spent media so nothing can be reconstructed from it. Archive or relocate the older drives only moves the exposure somewhere else; encrypt or compress the stored files keeps it in existence and dependent on key custody; reformat or relabel the reused disks leaves recoverable remnants behind.
- What does data classification help an organization do?
- Schedule retention limits covering archived paperwork
- Discover hidden repositories holding personal records
- Grant individual employees narrowly scoped privileges
- Give sensitive material suitably stronger protections
Correct answer: Give sensitive material suitably stronger protections
Sorting holdings by sensitivity lets a firm give sensitive material suitably stronger protections while routine holdings get routine handling. Schedule retention limits covering archived paperwork is records management; discover hidden repositories holding personal records is data discovery; grant individual employees narrowly scoped privileges is access management. None of those three decides how strongly a given item must be guarded.
- Which term describes data at rest?
- Data retained in persistent storage hardware
- Data transmitted in shared carrier backbones
- Data loaded in volatile processing registers
- Data buffered in outbound replication queues
Correct answer: Data retained in persistent storage hardware
Data retained in persistent storage hardware is the state the phrase names — sitting on a disk, tape or database rather than moving or being computed on. Data transmitted in shared carrier backbones is in motion between endpoints; data loaded in volatile processing registers is actively in use; data buffered in outbound replication queues is also in motion, merely parked briefly on the way out.
- What is data in transit?
- Records parked unchanged on offline tapes
- Records relayed quickly on carrier trunks
- Records changed live on shared processors
- Records duplicated nightly on disk arrays
Correct answer: Records relayed quickly on carrier trunks
Records relayed quickly on carrier trunks are the ones crossing a link between endpoints, which is why transport encryption matters most there. Records parked unchanged on offline tapes are stationary; records changed live on shared processors sit in memory while a program works on them; records duplicated nightly on disk arrays become a stored copy the moment the job finishes.
- What is the primary purpose of security awareness training?
- To give auditors dated attendance and headcount sheets
- To certify engineers using vendor and partner consoles
- To help workers uncover and refuse everyday deceptions
- To replace mail filters and endpoint scanners outright
Correct answer: To help workers uncover and refuse everyday deceptions
The program exists to help workers uncover and refuse everyday deceptions — the lures, pretexts and manufactured urgency that walk straight past technology. To give auditors dated attendance and headcount sheets is a byproduct of running the program, not its aim; to certify engineers using vendor and partner consoles is product training for specialists; and to replace mail filters and endpoint scanners outright is never the goal, since people and controls are meant to back each other up.
- What is phishing?
- Poisoned resolvers quietly steering victims elsewhere
- Leaked password pairs tested automatically everywhere
- Unauthorized entry obtained behind badged contractors
- Deceptive messages coaxing readers toward disclosures
Correct answer: Deceptive messages coaxing readers toward disclosures
Deceptive messages coaxing readers toward disclosures is the definition: a fraudulent note that talks a person into handing over credentials or confidential detail. Poisoned resolvers quietly steering victims elsewhere describes pharming, which subverts name resolution rather than the reader. Leaked password pairs tested automatically everywhere describes credential stuffing. Unauthorized entry obtained behind badged contractors describes tailgating, a physical trick with no message at all.
- What distinguishes spear phishing from general phishing?
- It studies one chosen recipient personally beforehand
- It approaches victims using automated telephone menus
- It singles out boardroom executives handling payments
- It carries hostile scripted payloads inside downloads
Correct answer: It studies one chosen recipient personally beforehand
The targeted variant works because it studies one chosen recipient personally beforehand, so the note can name real colleagues, projects and deadlines. It approaches victims using automated telephone menus describes a voice-based scam, a different channel entirely; it singles out boardroom executives handling payments describes whaling, a narrower subtype rather than the distinguishing trait; and it carries hostile scripted payloads inside downloads describes a delivery method that untargeted campaigns use just as often.
- What is social engineering?
- Abusing memory handling to seize or inject shellcode
- Tricking people to reveal secrets or perform actions
- Mapping open ports to catalog or fingerprint daemons
- Grinding stolen hashes to recover or guess passwords
Correct answer: Tricking people to reveal secrets or perform actions
The discipline means tricking people to reveal secrets or perform actions: the target is a person's judgment, not a machine. Abusing memory handling to seize or inject shellcode is a technical exploit; mapping open ports to catalog or fingerprint daemons is reconnaissance; grinding stolen hashes to recover or guess passwords is offline cracking. All three attack the technology rather than the human operating it.
- What is the purpose of an Acceptable Use Policy (AUP)?
- To grade incidents and drive containment toward recovery
- To grant worker accounts and withdraw dormant privileges
- To describe allowed employee conduct and hardware limits
- To harden shipped defaults and disable unneeded services
Correct answer: To describe allowed employee conduct and hardware limits
The document exists to describe allowed employee conduct and hardware limits, so staff know what counts as fair use of company systems before anything goes wrong. To grade incidents and drive containment toward recovery belongs in an incident response plan; to grant worker accounts and withdraw dormant privileges is access administration; to harden shipped defaults and disable unneeded services is a configuration standard.
- What is the main benefit of encrypting data at rest?
- It hides messages crossing a shared carrier backbone
- It proves a preserved record escaped quiet tampering
- It stops a local account reading unrelated documents
- It leaves a lost drive holding unreadable ciphertext
Correct answer: It leaves a lost drive holding unreadable ciphertext
Encrypting storage matters because it leaves a lost drive holding unreadable ciphertext, so a disk that walks out of the building discloses nothing to whoever finds or takes it. It hides messages crossing a shared carrier backbone describes transport encryption instead; it proves a preserved record escaped quiet tampering describes hashing or signing, an integrity control; it stops a local account reading unrelated documents describes access control, which still governs a running system.
- What is configuration management used for?
- Recording and governing shifts to installed components
- Cataloging and mapping equipment to physical locations
- Scheduling and verifying backups to promised timelines
- Measuring and forecasting throughput to future demands
Correct answer: Recording and governing shifts to installed components
The practice is about recording and governing shifts to installed components, so each system's known state stays documented and silent drift is caught early. Cataloging and mapping equipment to physical locations is asset management; scheduling and verifying backups to promised timelines is backup administration; measuring and forecasting throughput to future demands is capacity planning.
- What is the purpose of change management?
- To restore broken service and reopen customer access
- To screen proposed edits and record written approval
- To trace repeated failures and eliminate root causes
- To compile tested builds and deliver signed packages
Correct answer: To screen proposed edits and record written approval
The process exists to screen proposed edits and record written approval, so nothing reaches production untested, unapproved or undocumented, and any later problem can be traced to a decision. To restore broken service and reopen customer access is incident management; to trace repeated failures and eliminate root causes is problem management; to compile tested builds and deliver signed packages is release engineering.
- What is a security baseline?
- The typical activity profile of one unremarkable period
- The absolute exposure ceiling of one cautious boardroom
- The mandatory hardening floor of newly deployed systems
- The recorded snapshot of one running production machine
Correct answer: The mandatory hardening floor of newly deployed systems
A baseline in this sense is the mandatory hardening floor of newly deployed systems — the minimum configuration a build must meet before it is allowed to run. The typical activity profile of one unremarkable period is a behavioral baseline used for anomaly detection, a different sense of the word. The absolute exposure ceiling of one cautious boardroom is risk tolerance. The recorded snapshot of one running production machine is a configuration record, not a standard.
- Why is logging and monitoring important in security operations?
- To assemble regulator evidence, dated and signed properly
- To forecast storage needs, sizing and budgeting purchases
- To time database queries, trimming and rebuilding indexes
- To notice suspicious activity, examine causes and respond
Correct answer: To notice suspicious activity, examine causes and respond
Visibility exists so a team can notice suspicious activity, examine causes and respond before an intruder finishes. To assemble regulator evidence, dated and signed properly is a compliance byproduct; to forecast storage needs, sizing and budgeting purchases is capacity planning; to time database queries, trimming and rebuilding indexes is performance work. Each uses the same records for a purpose that is not defensive.
- What is the purpose of hashing data?
- To derive a compact fingerprint revealing later edits
- To scramble a letter hiding meaning beyond keyholders
- To shrink a payload cutting needless transfer seconds
- To bind a statement proving genuine authorship claims
Correct answer: To derive a compact fingerprint revealing later edits
The operation exists to derive a compact fingerprint revealing later edits: recompute the digest and any alteration shows at once. To scramble a letter hiding meaning beyond keyholders is encryption, which is meant to be undone by whoever holds the secret; to shrink a payload cutting needless transfer seconds is compression; to bind a statement proving genuine authorship claims is a digital signature, which consumes a digest but adds identity on top.
- How does hashing differ from encryption?
- Encryption shortens incoming inputs while hashing expands output
- Encryption reverses given keys while hashing precludes inversion
- Encryption verifies integrity while hashing hides secret meaning
- Encryption locks securely while hashing unlocks stored passwords
Correct answer: Encryption reverses given keys while hashing precludes inversion
Encryption reverses given keys while hashing precludes inversion is the real distinction: ciphertext returns to plaintext for whoever holds the secret, but a digest can never be turned back into its input. Encryption shortens incoming inputs while hashing expands output gets both sizes wrong. Encryption verifies integrity while hashing hides secret meaning swaps the two jobs. Encryption locks securely while hashing unlocks stored passwords points the reversibility the wrong way round.
- What is the principle behind a 'whitelist' (allow list) approach?
- Block known offenders, welcome everyone unrecognized
- Delay unfamiliar senders, accept determined attempts
- Admit preapproved entries, refuse unlisted strangers
- Score message reputation, favor reliable originators
Correct answer: Admit preapproved entries, refuse unlisted strangers
The governing idea is to admit preapproved entries, refuse unlisted strangers — default deny, with an explicit register of what may run or connect. Block known offenders, welcome everyone unrecognized is the opposite, default-permit posture. Delay unfamiliar senders, accept determined attempts is greylisting, which stalls rather than decides. Score message reputation, favor reliable originators ranks by behavior instead of enumerating what is sanctioned.
- What is the purpose of a 'blacklist' (deny list)?
- Permit approved software while rejecting unsigned executables
- Quarantine suspicious attachments while awaiting human review
- Throttle chattering senders while excessive traffic continues
- Refuse cataloged threats while permitting everything unproven
Correct answer: Refuse cataloged threats while permitting everything unproven
A deny list works by refusing cataloged threats while permitting everything unproven, which is exactly why a brand-new sample walks straight through it. Permit approved software while rejecting unsigned executables is the opposite, default-deny model. Quarantine suspicious attachments while awaiting human review defers the decision to a person rather than deciding by name. Throttle chattering senders while excessive traffic continues limits rate, not identity.
- Which practice helps prevent unauthorized software from running on a system?
- Sanctioned binary enforcement
- Malicious signature detection
- Narrowed privilege allocation
- Perimeter firewall inspection
Correct answer: Sanctioned binary enforcement
Sanctioned binary enforcement means only programs on an approved register may execute, so anything unrecognized is refused before it ever starts. Malicious signature detection catches samples it already recognizes and misses novel ones. Narrowed privilege allocation limits what an account can reach but does not decide which programs may run. Perimeter firewall inspection filters traffic at the edge rather than code on the host.
- What is the main purpose of antivirus and anti-malware software?
- To filter inbound packets and drop unwanted connections
- To catch hostile executables and delete infected copies
- To duplicate critical archives and restore lost content
- To close published defects and shrink attacker openings
Correct answer: To catch hostile executables and delete infected copies
These tools exist to catch hostile executables and delete infected copies, whether they recognize a sample by signature, heuristic or behavior. To filter inbound packets and drop unwanted connections is what a firewall does at the network edge; to duplicate critical archives and restore lost content is backup; to close published defects and shrink attacker openings is patching. None of the three inspects a running file for malice.
- What does a Security Information and Event Management (SIEM) system do?
- Stores forwarded records and rotates archives promptly
- Probes reachable machines and grades outstanding fixes
- Correlates scattered logs and reveals quiet intrusions
- Watches endpoint processes and blocks suspicious tasks
Correct answer: Correlates scattered logs and reveals quiet intrusions
The platform correlates scattered logs and reveals quiet intrusions, joining records from firewalls, servers and applications that mean little in isolation. Stores forwarded records and rotates archives promptly describes a plain log server, which keeps but does not reason. Probes reachable machines and grades outstanding fixes is a vulnerability scanner. Watches endpoint processes and blocks suspicious tasks is endpoint protection, confined to a single host.
- What is the recommended approach to creating strong passwords?
- Familiar words carrying predictable digit substitutions
- Compact memorized secrets rotated quarterly nonetheless
- One memorable phrase safeguarding innumerable resources
- Lengthy convoluted passphrases unrepeated anywhere else
Correct answer: Lengthy convoluted passphrases unrepeated anywhere else
The advice is lengthy convoluted passphrases unrepeated anywhere else, because length defeats guessing while uniqueness contains any single breach. Familiar words carrying predictable digit substitutions barely slow a cracking rule set. Compact memorized secrets rotated quarterly nonetheless remain short and guessable, and forced rotation tends to produce weaker variants. One memorable phrase safeguarding innumerable resources turns one leak into a total compromise.
- Why should passwords not be reused across multiple accounts?
- A single leak unlocks matching logins everywhere else
- A recycled secret ages quicker inside busier services
- A repeated entry gives shoulder surfers extra chances
- A duplicate value breaks audit trails naming sessions
Correct answer: A single leak unlocks matching logins everywhere else
The real hazard is that a single leak unlocks matching logins everywhere else: attackers replay a stolen pair against dozens of unrelated services within hours of a breach becoming public. A recycled secret ages quicker inside busier services is not how secrets behave. A repeated entry gives shoulder surfers extra chances is a minor, local risk. A duplicate value breaks audit trails naming sessions is untrue, since logs identify the account rather than the secret.
- What is the purpose of a password manager?
- To exchange one credential and reach federated portals
- To vault distinct secrets and mint sturdy replacements
- To emit rotating numbers and confirm device possession
- To hold signed certificates and check remote endpoints
Correct answer: To vault distinct secrets and mint sturdy replacements
The tool exists to vault distinct secrets and mint sturdy replacements, so a person can hold a different long string for every site without memorizing any of them. To exchange one credential and reach federated portals describes single sign-on; to emit rotating numbers and confirm device possession describes an authenticator app; to hold signed certificates and check remote endpoints describes a certificate store.
- What is the security purpose of a screen lock with timeout?
- To render a powerless machine totally unreadable later
- To expire a stale server session automatically nightly
- To deny a stranger a temporarily abandoned workstation
- To tether a laptop tightly beneath immovable furniture
Correct answer: To deny a stranger a temporarily abandoned workstation
An automatic lock exists to deny a stranger a temporarily abandoned workstation, forcing re-authentication before anyone can act as the signed-in user. To render a powerless machine totally unreadable later describes full-disk encryption, which does nothing while the session is live. To expire a stale server session automatically nightly is a server-side control on the application. To tether a laptop tightly beneath immovable furniture stops theft of the hardware, not misuse of the session.
- What does 'data loss prevention' (DLP) technology aim to do?
- Replicates business folders and rebuilds vanished content
- Blocks outbound traffic and refuses unlisted destinations
- Wraps documents cryptographically and limits later access
- Spots confidential material and prevents unsafe transfers
Correct answer: Spots confidential material and prevents unsafe transfers
The technology spots confidential material and prevents unsafe transfers, inspecting content on its way to mail, cloud storage or removable media. Replicates business folders and rebuilds vanished content is backup, which restores rather than restrains. Blocks outbound traffic and refuses unlisted destinations is an egress firewall, filtering by address rather than by what the payload contains. Wraps documents cryptographically and limits later access is rights management.
- What is the purpose of an exit interview process revoking a departing employee's badge access?
- To cancel physical entry credentials straight away
- To disable federated logons plus shared workspaces
- To reclaim issued laptops besides company handsets
- To retain archived messages satisfying legal holds
Correct answer: To cancel physical entry credentials straight away
The security purpose is to cancel physical entry credentials straight away, closing the doors the moment employment ends rather than at the end of a paperwork cycle. To disable federated logons plus shared workspaces covers the logical side, a parallel but separate task; to reclaim issued laptops besides company handsets recovers property rather than access; to retain archived messages satisfying legal holds serves litigation readiness.
- A security analyst is explaining the foundational goals of the field to a new hire. How is information security best summarized in terms of the CIA triad?
- Encrypting content stored, transmitted and actively processed
- Keeping business records confidential, intact and retrievable
- Checking identity, permitting actions and recording decisions
- Stopping intrusions, noticing breaches and answering warnings
Correct answer: Keeping business records confidential, intact and retrievable
Keeping business records confidential, intact and retrievable maps one for one onto the three goals of the model, and those goals drive nearly every control decision. Checking identity, permitting actions and recording decisions describes authentication, authorization and accounting, which supports the model but is not it. Encrypting content stored, transmitted and actively processed names the three states of data, not the three goals. Stopping intrusions, noticing breaches and answering warnings lists control functions.
- An organization wants to ensure that financial records cannot be modified without authorization and that any change can be detected. Which element of the confidentiality, integrity, and availability model is this requirement most directly addressing?
- Shielding against unwelcome bystanders
- Resilience against unplanned shutdowns
- Protection against unseen manipulation
- Attribution against convenient denials
Correct answer: Protection against unseen manipulation
Protection against unseen manipulation is the element in play: information stays accurate and complete, and any edit that was not sanctioned becomes visible. Shielding against unwelcome bystanders is confidentiality, which governs who may read rather than who may rewrite. Resilience against unplanned shutdowns is availability, which governs whether the ledger can be reached at all. Attribution against convenient denials is non-repudiation, a related property but not one of the three goals in the model.
- A hospital must guarantee that patient monitoring systems remain reachable around the clock so clinicians can view vital signs. Which CIA triad goal is the primary concern for this requirement?
- Confidentiality of archived records
- Integrity of forwarded measurements
- Nonrepudiation of clinician actions
- Availability of bedside instruments
Correct answer: Availability of bedside instruments
Availability of bedside instruments is the primary concern, because the requirement is uninterrupted access to the monitors whenever staff need them. Confidentiality of archived records governs who may read the data, not whether it can be reached. Integrity of forwarded measurements governs whether the numbers are trustworthy, which matters but is not what round-the-clock access means. Nonrepudiation of clinician actions ties a person to a recorded act and is a separate property again.
- Which statement best describes the relationship between threats, vulnerabilities, and risk?
- A threat exploits a vulnerability and the potential loss becomes the risk
- A risk is the vulnerability that a threat manufactures inside a workplace
- A threat and a vulnerability describe the same risk under different names
- A vulnerability preys upon a risk and afterward produces a genuine threat
Correct answer: A threat exploits a vulnerability and the potential loss becomes the risk
A threat exploits a vulnerability and the potential loss becomes the risk is the correct chain: the threat is the potential danger, the vulnerability is the weakness it uses, and risk is the likelihood and impact of the two meeting. A risk is the vulnerability that a threat manufactures inside a workplace inverts the roles, since a weakness exists before any threat arrives. A threat and a vulnerability describe the same risk under different names conflates three distinct terms. A vulnerability preys upon a risk and afterward produces a genuine threat runs the chain backwards.
- A manager asks what risk management actually is. Which description is most accurate?
- The outright removal and permanent refusal of business risks
- The endless routine of weighing and treating tolerable risks
- The bulk purchase of policies and attachments covering risks
- The yearly assessment of recently cataloged and ranked risks
Correct answer: The endless routine of weighing and treating tolerable risks
The endless routine of weighing and treating tolerable risks is the accurate description: a continuing cycle that surfaces exposures, sizes them, treats them and holds whatever remains inside an agreed tolerance. The outright removal and permanent refusal of business risks is neither possible nor cost-effective. The bulk purchase of policies and attachments covering risks is a single treatment option, transfer, rather than the whole discipline. The yearly assessment of recently cataloged and ranked risks is one snapshot, not an ongoing practice.
- During risk treatment, a company decides to stop offering a product line entirely because the associated cybersecurity exposure is too great. Which risk treatment option does this represent, and how does it differ from risk mitigation?
- Risk acceptance, because the board tolerated the exposure
- Risk transference, because the insurer absorbs the losses
- Risk avoidance, because the entire activity ends outright
- Risk mitigation, because the controls curb the likelihood
Correct answer: Risk avoidance, because the entire activity ends outright
Risk avoidance, because the entire activity ends outright is the treatment shown: the firm deletes the exposure by ceasing what creates it, whereas reduction would keep the product line running and merely add controls to shrink likelihood or impact. Risk acceptance, because the board tolerated the exposure would mean carrying on unchanged. Risk transference, because the insurer absorbs the losses shifts the financial consequence to a third party but leaves the activity in place. Risk mitigation, because the controls curb the likelihood is the very contrast the question draws.
- An organization has four broad ways to respond to an identified risk. Which set correctly lists these risk treatment options?
- Prevention, deterrence, detection, and compensation
- Mitigation, transference, avoidance, and acceptance
- Identification, analysis, monitoring, and reporting
- Administrative, technical, physical, and managerial
Correct answer: Mitigation, transference, avoidance, and acceptance
Mitigation, transference, avoidance, and acceptance are the four recognized ways to treat an identified exposure. Prevention, deterrence, detection, and compensation name functional control types, not treatment choices. Identification, analysis, monitoring, and reporting are assessment activities that run before any treatment is picked. Administrative, technical, physical, and managerial name control categories rather than responses.
- A firm uses descriptive ratings of high, medium, and low to rank risks rather than calculating dollar figures. How does this qualitative approach differ from a quantitative one?
- Qualitative grading is monetized, while quantitative grading is intuitive
- Qualitative scaling is objective, while quantitative scaling is imprecise
- Qualitative scoring is subjective, while quantitative scoring is monetary
- Qualitative modeling is optional, while quantitative modeling is required
Correct answer: Qualitative scoring is subjective, while quantitative scoring is monetary
Qualitative scoring is subjective, while quantitative scoring is monetary: bands such as high, medium, and low rest on informed opinion, whereas quantitative work attaches measurable dollar figures to assets and losses. Qualitative grading is monetized, while quantitative grading is intuitive swaps the two methods around. Qualitative scaling is objective, while quantitative scaling is imprecise reverses which method is the rigorous one. Qualitative modeling is optional, while quantitative modeling is required invents a rule that no framework imposes; either method may be used.
- An asset worth $200,000 would lose 25 percent of its value in a single fire event. What is the single loss expectancy (SLE) for this scenario?
- An SLE of $200,000 net
- An SLE of $25,000 firm
- An SLE of $20,000 paid
- An SLE of $50,000 flat
Correct answer: An SLE of $50,000 flat
An SLE of $50,000 flat is correct: single loss expectancy is asset value multiplied by the exposure factor, so $200,000 times 0.25 gives $50,000. An SLE of $200,000 net is the whole asset value and ignores the exposure factor entirely. An SLE of $25,000 firm reads the figure 25 straight off the stem as though the percentage were already a dollar amount. An SLE of $20,000 paid applies a ten percent factor instead of the twenty-five percent the stem gives.
- A risk analyst calculates a single loss expectancy of $40,000 for a flood and estimates the flood will occur once every four years. What is the annualized loss expectancy (ALE)?
- An ALE of $10,000
- An ALE of $40,000
- An ALE of $20,000
- An ALE of $80,000
Correct answer: An ALE of $10,000
An ALE of $10,000 is correct: annualized loss expectancy is the single loss expectancy multiplied by the annualized rate of occurrence, and an event expected once every four years carries a rate of 0.25, so $40,000 times 0.25 gives $10,000. An ALE of $40,000 uses a rate of one, treating the flood as an annual event. An ALE of $20,000 uses a rate of one half. An ALE of $80,000 uses a rate of two, which would mean two floods a year.
- A new analyst confuses risk priorities with risk tolerance. Which statement correctly describes risk tolerance?
- The ranked order of risk tasks a team handles before others
- The upper limit of risk a firm accepts before action begins
- The portion of risk that exists before a control is applied
- The register of risk entries a unit retains before a review
Correct answer: The upper limit of risk a firm accepts before action begins
The upper limit of risk a firm accepts before action begins is risk tolerance: it marks the point past which an exposure has to be treated rather than carried. The ranked order of risk tasks a team handles before others is risk priority, the very idea the analyst confused it with. The portion of risk that exists before a control is applied is inherent risk. The register of risk entries a unit retains before a review is the risk register, a record rather than a limit.
- Which scenario best illustrates defense in depth?
- A firm deploys a firewall, another firewall, a backup, and one vendor
- A firm orders a gateway, top firmware, broad support, and blind trust
- A firm layers a filter, subnet splits, device scans, and staff drills
- A firm mirrors its servers, its databases, its storage, and two racks
Correct answer: A firm layers a filter, subnet splits, device scans, and staff drills
A firm layers a filter, subnet splits, device scans, and staff drills is the illustration wanted: several independent controls of different kinds, so one failure still leaves the asset covered. A firm deploys a firewall, another firewall, a backup, and one vendor buys duplicates of a single control type, which all share the same flaw. A firm orders a gateway, top firmware, broad support, and blind trust rests everything on one control, however good that control is. A firm mirrors its servers, its databases, its storage, and two racks buys fault tolerance, which serves availability rather than layered protection.
- Why is defense in depth considered more resilient than relying on one control?
- It removes the need for a dedicated tier of control documents
- It lowers the quantity of control barriers a group is running
- It shifts control duties from the team onto an outside vendor
- It keeps a lone control failure from exposing the whole asset
Correct answer: It keeps a lone control failure from exposing the whole asset
It keeps a lone control failure from exposing the whole asset is the reason layering is resilient: independent controls cover for one another, so one breakdown is not enough to reach the asset. It removes the need for a dedicated tier of control documents is false, because layering usually adds governance work. It lowers the quantity of control barriers a group is running reverses the effect, since depth means more controls, not fewer. It shifts control duties from the team onto an outside vendor describes outsourcing, which moves work rather than adding layers.
- A database administrator is granted access only to the specific databases required for daily duties and nothing more. Which security principle does this reflect?
- Least privilege for accounts
- Least functionality for apps
- Implicit denial for requests
- Mandatory labels for records
Correct answer: Least privilege for accounts
Least privilege for accounts is the principle at work: the administrator holds only the rights the job needs and nothing beyond them, so a compromised login reaches very little. Least functionality for apps strips software down to the features a system truly requires, which is a hardening step rather than a rights decision. Implicit denial for requests is the default rule that whatever is not expressly allowed is refused. Mandatory labels for records assign rights from central classifications set by policy, not from what a job needs.
- What is the primary security benefit of enforcing the principle of least privilege across an organization?
- It removes the need for a password or rotation policy
- It caps the damage a stolen or misused account causes
- It blocks malware from reaching a user on the network
- It lowers the hours a helpdesk spends on daily resets
Correct answer: It caps the damage a stolen or misused account causes
It caps the damage a stolen or misused account causes is the main benefit: an account held to what the job needs cannot reach far once it falls into the wrong hands. It removes the need for a password or rotation policy is wrong, because least privilege sits alongside authentication rules rather than replacing them. It blocks malware from reaching a user on the network describes network filtering, not rights management. It lowers the hours a helpdesk spends on daily resets is a support metric with no bearing on how wide an account's rights are.
- In a financial system, the person who can create a vendor record is not allowed to also approve payments to that vendor. Which principle is being applied, and what does it prevent?
- Least privilege, which limits a user account to its bare minimum
- Risk acceptance, which lets a known exposure stay free from work
- Separation of duties, which bars a lone worker from full control
- Defense in depth, which stacks a wide set of separate safeguards
Correct answer: Separation of duties, which bars a lone worker from full control
Separation of duties, which bars a lone worker from full control is the principle applied: splitting a sensitive process means nobody can both set up a payee and pay it, so abuse would take collusion. Least privilege, which limits a user account to its bare minimum governs how much access somebody holds, not how a single task is divided. Risk acceptance, which lets a known exposure stay free from work takes no action at all. Defense in depth, which stacks a wide set of separate safeguards piles up protections instead of splitting a workflow.
- How does segregation of duties reduce the risk of fraud within an organization?
- By encrypting one local volume for the data it holds onsite
- By logging keystrokes so one monitor is able to spot misuse
- By giving staff one broad access role for their daily tasks
- By requiring two people for one task so collusion is needed
Correct answer: By requiring two people for one task so collusion is needed
By requiring two people for one task so collusion is needed is how splitting a process cuts the danger: a single dishonest employee can no longer finish the job alone. By encrypting one local volume for the data it holds onsite protects stored records but divides no responsibilities. By logging keystrokes so one monitor is able to spot misuse detects afterwards rather than splitting the work. By giving staff one broad access role for their daily tasks would widen access and raise the danger instead.
- A digitally signed contract provides proof of who sent it so the sender cannot later deny having signed it. Which information assurance concept does this provide?
- Non-repudiation of a message
- Authentication of a customer
- Confidentiality of a summary
- Accountability of a coworker
Correct answer: Non-repudiation of a message
Non-repudiation of a message is what a digital signature supplies: it ties the signing act to one verified identity, so the signer cannot credibly disown the contract later. Authentication of a customer proves who somebody is at the moment of login, but on its own it leaves no lasting proof a third party can weigh. Confidentiality of a summary keeps content secret from outsiders, which is a different goal entirely. Accountability of a coworker traces activity back to a person for review, yet by itself it does not defeat a denial.
- Which statement best defines non-repudiation in cybersecurity?
- The assurance that an outsider cannot read the stored data
- The assurance that a signer cannot disclaim a sent message
- The assurance that an outage cannot disrupt a live service
- The assurance that a transfer cannot change a saved record
Correct answer: The assurance that a signer cannot disclaim a sent message
The assurance that a signer cannot disclaim a sent message is the definition: the originator of an act is bound to it and cannot credibly deny having done it, which digital signatures, logs, and audit trails deliver. The assurance that an outsider cannot read the stored data defines confidentiality. The assurance that an outage cannot disrupt a live service defines availability. The assurance that a transfer cannot change a saved record defines integrity.
- An organization implements controls so that customer addresses and phone numbers are collected, used, and retained only as permitted and protected from misuse. Which information assurance concept is the primary focus?
- Confidentiality of a log
- Integrity of held emails
- Privacy of personal data
- Availability of a server
Correct answer: Privacy of personal data
Privacy of personal data is the focus here: the controls govern how customer details may be gathered, used, kept, and shielded from misuse, which is exactly the ground privacy covers. Confidentiality of a log limits who may read something but says nothing about what may be collected or how long it is held. Integrity of held emails concerns accuracy and freedom from tampering. Availability of a server concerns keeping service reachable, not the handling of personal information.
- How does privacy differ from confidentiality in information security?
- Privacy applies to wire traffic, while confidentiality covers saved disks
- Privacy is simply another label, while confidentiality means exactly that
- Privacy decides who can read, while confidentiality guards customer files
- Privacy governs personal data use, while confidentiality limits who reads
Correct answer: Privacy governs personal data use, while confidentiality limits who reads
Privacy governs personal data use, while confidentiality limits who reads is the correct split: privacy sets the rules for gathering, using, sharing, and keeping personal information, and confidentiality is the control that restricts who may see it. Privacy applies to wire traffic, while confidentiality covers saved disks invents a moving-versus-stored divide that neither term carries. Privacy is simply another label, while confidentiality means exactly that treats the two as synonyms. Privacy decides who can read, while confidentiality guards customer files reverses their roles.
- Which scenario best demonstrates the use of multi-factor authentication?
- A worker enters a password, then approves a handset request
- A worker enters a password, then enters a second passphrase
- A worker enters a password, then answers a memorized prompt
- A worker enters a password, then attaches a stored username
Correct answer: A worker enters a password, then approves a handset request
A worker enters a password, then approves a handset request combines two different factor types: the password is something you know and the enrolled handset is something you have. A worker enters a password, then enters a second passphrase uses the knowledge factor twice over. A worker enters a password, then answers a memorized prompt is also knowledge twice, since a remembered answer is no different in kind from a password. A worker enters a password, then attaches a stored username adds an identifier, which is not a factor at all.
- An employee logs in with a smart card and a PIN to access a secure workstation. Which two authentication factor types are being combined?
- A knowledge factor with a biometric check
- A possession factor with a knowledge code
- A knowledge factor with a location signal
- A biometric factor with a location beacon
Correct answer: A possession factor with a knowledge code
A possession factor with a knowledge code is the pairing on show: the smart card is an item the employee physically holds and the PIN is a secret the employee remembers. A knowledge factor with a biometric check would call for a fingerprint or face scan, and nothing here reads a body trait. A knowledge factor with a location signal would call for geolocation. A biometric factor with a location beacon involves neither of the two items described.
- A company hires a third party to host and secure its email, shifting the financial consequences of a related breach to that provider through a contract. Which risk treatment option is this?
- Risk acceptance of a recorded exposure
- Risk mitigation by adding new controls
- Risk transfer by a purchased indemnity
- Risk avoidance by dropping the service
Correct answer: Risk transfer by a purchased indemnity
Risk transfer by a purchased indemnity is the treatment used: the financial consequences move to another party under a contract or insurance policy, even though accountability stays at home. Risk acceptance of a recorded exposure would mean logging the exposure and living with it untouched. Risk mitigation by adding new controls would mean cutting the likelihood or the impact with safeguards. Risk avoidance by dropping the service would mean not offering hosted email at all.
- What is the correct order of the steps in the risk management process?
- Repair the exposure, then detect it, then rate it
- Score the exposure, then handle it, then chart it
- Accept the exposure, then shift it, then dodge it
- Find the exposure, then measure it, then treat it
Correct answer: Find the exposure, then measure it, then treat it
Find the exposure, then measure it, then treat it is the right sequence: you cannot judge severity before you know an exposure exists, and you cannot choose a response before you know how severe it is. Repair the exposure, then detect it, then rate it acts before anything has been learned. Score the exposure, then handle it, then chart it records the exposure last, after it has already been dealt with. Accept the exposure, then shift it, then dodge it lists three treatment choices rather than the stages of the process.
- An IT team installs a web filter that blocks access to known malicious websites before users can reach them. Which functional type of control is this?
- Preventive control on traffic
- Detective control on activity
- Recovery control on databases
- Compensating control on flaws
Correct answer: Preventive control on traffic
Preventive control on traffic is the functional type: the filter stops the unwanted event from happening at all by barring the request before a user ever reaches the site. Detective control on activity would notice and report the visit after it happened. Recovery control on databases restores service once something has already gone wrong. Compensating control on flaws stands in for a control that cannot be implemented as written, which is not what a blocking filter does.
- A document states, 'All employees must protect company information and use systems only for authorized purposes.' What type of governance document is this high-level statement?
- A written hardware standard
- A published security policy
- A detailed backup procedure
- An optional style guideline
Correct answer: A published security policy
A published security policy is what the quoted sentence is: a short, high-level expression of management intent that sets direction without listing steps. A written hardware standard would fix uniform requirements such as an approved model or a minimum key length. A detailed backup procedure would give ordered, step-by-step instructions for one task. An optional style guideline offers recommended practice that nobody is obliged to follow.
- An organization arranges its governance documents into policies, standards, procedures, and guidelines. Which document type specifies mandatory, uniform requirements such as a minimum password length of 12 characters?
- A guideline, which is looser than a standard
- A policy, which is broader than the standard
- A standard, which is tighter than a proposal
- A procedure, which is fuller than a standard
Correct answer: A standard, which is tighter than a proposal
A standard, which is tighter than a proposal is the document type wanted: standards state mandatory, uniform requirements such as a twelve-character password, and they turn a policy's intent into something enforceable. A guideline, which is looser than a standard offers recommended practice only. A policy, which is broader than the standard states high-level intent and names no figures. A procedure, which is fuller than a standard gives the ordered steps for carrying the work out.
- What is security governance within an organization?
- The locks and doors that guard a server room at night
- The ciphers and keys that screen data on an open link
- The scans and probes that reveal a flawed host or two
- The rules and roles that steer and check a whole firm
Correct answer: The rules and roles that steer and check a whole firm
The rules and roles that steer and check a whole firm is what governance means: the structure of policies, assigned responsibilities, and oversight that directs how security is run and holds it to account. The locks and doors that guard a server room at night are one physical control. The ciphers and keys that screen data on an open link are one technical control. The scans and probes that reveal a flawed host or two are an assessment activity. Each of those sits inside the governance structure rather than standing in for it.
- A regulation such as a data protection law differs from an internal policy in which key way?
- A regulation is set by the state and carries legal penalties
- A regulation binds a separate unit and leaves the rest alone
- A regulation offers guidance a team can take or leave freely
- A regulation is drafted and then enforced by the firm itself
Correct answer: A regulation is set by the state and carries legal penalties
A regulation is set by the state and carries legal penalties is the difference that matters: it comes from an outside government or legal authority and breaking it is punishable, whereas an internal policy is written and enforced by the organization for its own purposes. A regulation binds a separate unit and leaves the rest alone is false, since a regulation reaches everyone in scope. A regulation offers guidance a team can take or leave freely describes a guideline instead. A regulation is drafted and then enforced by the firm itself describes exactly what an internal policy is.
- Which statement correctly distinguishes due care from due diligence?
- Due diligence repairs a flaw, while due care finds one
- Due diligence studies a risk, while due care treats it
- Due diligence ends fast, while due care runs for years
- Due diligence buys a policy, while due care extends it
Correct answer: Due diligence studies a risk, while due care treats it
Due diligence studies a risk, while due care treats it is the right split: diligence is the investigating and understanding, and care is the reasonable, continuing action a prudent organization then takes. Due diligence repairs a flaw, while due care finds one reverses the two. Due diligence ends fast, while due care runs for years wrongly makes diligence a one-time event, when both are ongoing duties. Due diligence buys a policy, while due care extends it turns both into insurance, which is risk transfer rather than either duty.
- The ISC2 Code of Ethics preamble and canons guide member conduct. Which behavior would most clearly violate the canon to act honorably, honestly, justly, responsibly, and legally?
- Completing the regular study hours that a license asks of us
- Sending a newfound fault to the vendor that owns the product
- Feeding a customer a faked finding that masks a known defect
- Turning down a task that rests outside a certified skill set
Correct answer: Feeding a customer a faked finding that masks a known defect
Feeding a customer a faked finding that masks a known defect is the clear breach: knowingly giving a client untrue information about a security finding is neither honest nor just. Completing the regular study hours that a license asks of us upholds the duty to stay competent. Sending a newfound fault to the vendor that owns the product is responsible disclosure. Turning down a task that rests outside a certified skill set honors the duty to work only within one's competence rather than breaking it.
- ISO 27001 is frequently referenced in security governance discussions. What is ISO 27001 best described as?
- A federal statute for holding patient health records
- A private protocol for shaping firewall policy files
- A biometric formula for matching a fingerprint image
- A worldwide standard for running a management system
Correct answer: A worldwide standard for running a management system
A worldwide standard for running a management system is the right description: ISO 27001 sets out the requirements for building, operating, and improving an information security management system, and an organization can be certified against it. A federal statute for holding patient health records describes a national health privacy law. A private protocol for shaping firewall policy files describes a technical configuration format. A biometric formula for matching a fingerprint image describes an algorithm.
- A team lists hackers, malware, natural disasters, and disgruntled insiders as potential dangers to its systems. In risk terminology, these dangers are collectively referred to as what?
- Threats, the harmful sources
- Controls, the sound barriers
- Weaknesses, the unfixed gaps
- Residuals, the leftover bits
Correct answer: Threats, the harmful sources
Threats, the harmful sources is the collective label: a threat is any circumstance or actor, human, technical, or natural, with the potential to cause harm by exploiting a weakness. Controls, the sound barriers are the safeguards put in place against them. Weaknesses, the unfixed gaps are the vulnerabilities a threat exploits, not the dangers themselves. Residuals, the leftover bits are the exposure that survives once controls have been applied.
- A security analyst is comparing two recovery metrics for a customer database. One metric answers the question 'how much data, measured in time, can we afford to lose?' and the other answers 'how quickly must we get the system running again?' Which pairing correctly maps these questions?
- Missing files are RTO and reboot tempo is RPO
- Lost records are RPO and restart speed is RTO
- One RTO value answers both and RPO is ignored
- One MTD figure settles both and RTO is unused
Correct answer: Lost records are RPO and restart speed is RTO
Lost records are RPO and restart speed is RTO is the correct mapping: the recovery point objective sets how much data, expressed as a span of time before the disruption, may be lost, while the recovery time objective sets how long restoration may take. Missing files are RTO and reboot tempo is RPO swaps the two. One RTO value answers both and RPO is ignored collapses two distinct targets into one. One MTD figure settles both and RTO is unused reaches for maximum tolerable downtime, which bounds the whole outage rather than answering either question.
- A team is documenting its data-protection targets and states: 'We back up the order system every 4 hours, so we can lose at most 4 hours of transactions, and we must have it running again within 2 hours of any failure.' Which values do the 4-hour and 2-hour figures represent?
- 4 hours to bring data back and 2 hours of unsaved time
- 4 hours of mean repair work and 2 hours of data losses
- 4 hours of data at risk and 2 hours to restore service
- 4 hours and 2 hours are two downtime goals at one host
Correct answer: 4 hours of data at risk and 2 hours to restore service
4 hours of data at risk and 2 hours to restore service is the correct reading: the backup interval fixes the recovery point objective at four hours of transactions, and the deadline to be running again is the recovery time objective. 4 hours to bring data back and 2 hours of unsaved time swaps the two. 4 hours of mean repair work and 2 hours of data losses reaches for mean time to repair, an average fix duration rather than a target. 4 hours and 2 hours are two downtime goals at one host treats both figures as the same kind of target.
- How is disaster recovery best described within an organization's resilience planning?
- The hiring and training of temp staff after a merger
- The pricing and selling of a service after a rollout
- The scrambling and signing of emails on an open link
- The restoring of servers and data after a bad outage
Correct answer: The restoring of servers and data after a bad outage
The restoring of servers and data after a bad outage is what disaster recovery means: the technology-focused work of getting applications, hardware, and information back in service once an incident has struck. The hiring and training of temp staff after a merger is a personnel matter. The pricing and selling of a service after a rollout is commercial work. The scrambling and signing of emails on an open link is cryptographic protection in transit, not restoration.
- An organization wants the cheapest standby facility and accepts that recovery could take days, but a competitor needs near-instant failover and is willing to pay for a duplicate, fully running environment. Which facilities match these two needs, in that order?
- A cold site, then a hot site with active data
- A hot site, then a cold site with empty racks
- A cold site, then a warm site with basic gear
- A warm site, then a hot site with spare power
Correct answer: A cold site, then a hot site with active data
A cold site, then a hot site with active data matches the two needs in that order: a cold site supplies only space, power, and connectivity, so it is cheapest but slowest to bring up, while a hot site is a fully equipped, continuously updated duplicate that can take over almost at once. A hot site, then a cold site with empty racks reverses them. A cold site, then a warm site with basic gear offers a middle option that still needs configuration and data, so it is not near-instant. A warm site, then a hot site with spare power gets the cheap end wrong.
- How does a business continuity plan differ from a disaster recovery plan?
- Continuity plans cover just payroll, while recovery plans handle the rest
- Continuity plans keep the firm open, while recovery plans rebuild systems
- Continuity plans are the technical bit, while recovery plans are clerical
- Continuity plans and recovery plans describe the exact same process today
Correct answer: Continuity plans keep the firm open, while recovery plans rebuild systems
Continuity plans keep the firm open, while recovery plans rebuild systems is the real difference: continuity takes the organization-wide view of sustaining critical functions during a disruption, often with manual workarounds, while recovery is the narrower technology effort. Continuity plans cover just payroll, while recovery plans handle the rest invents a scope split neither plan has. Continuity plans are the technical bit, while recovery plans are clerical reverses which one is technical. Continuity plans and recovery plans describe the exact same process today ignores the distinction altogether.
- Before writing recovery plans, an organization performs a study that identifies its critical processes, estimates the financial and operational harm of losing each one over time, and ranks them by priority. What is this study called?
- A study of stale software patches
- A study by simulated live attacks
- A ranked study of business impact
- A study of unreviewed source code
Correct answer: A ranked study of business impact
A ranked study of business impact is what the exercise is called: a business impact analysis lists the critical functions, estimates the financial and operational harm of losing each one over time, and ranks them so recovery targets can be set. A study of stale software patches is a vulnerability scan. A study by simulated live attacks is a penetration test. A study of unreviewed source code is a code review. None of those three weighs business consequence or sets recovery priorities.
- According to the NIST incident-handling lifecycle taught in the ISC2 Certified in Cybersecurity curriculum, which sequence correctly orders the four phases of the incident response process?
- Preparation; Incident Identification; Containment; Eradication; Recovery; Lessons Learned
- Incident Logging; Categorization; Prioritization; Diagnosis and Resolution; Final Closure
- Identification and Assessment; Preparation; Containment, Eradication, and Recovery; Incident Review
- Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity
Correct answer: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity
Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity is the correct order: the lifecycle begins by building the plan, team, and tooling, moves to spotting and confirming an event, then limits, removes, and restores, and closes with a review that feeds the next round. Identification and Assessment; Preparation; Containment, Eradication, and Recovery; Incident Review uses genuine phase names but puts preparation second, when preparation has to come first. Preparation; Incident Identification; Containment; Eradication; Recovery; Lessons Learned is the SANS six-step model, whose phase names and phase count differ from the four this curriculum teaches. Incident Logging; Categorization; Prioritization; Diagnosis and Resolution; Final Closure is an ITIL service-desk flow for handling tickets, not a security incident-response lifecycle.
- An incident response plan exists primarily to accomplish what for an organization?
- To lay down a written manual for spotting and fixing trouble
- To settle the pay bands and benefit tiers covering a payroll
- To promise a future in which no intrusion ever comes through
- To stand in for a firewall and the antivirus suites outright
Correct answer: To lay down a written manual for spotting and fixing trouble
To lay down a written manual for spotting and fixing trouble is the purpose: the plan fixes roles, communication paths, and ordered actions in advance so responders are not improvising under pressure. To settle the pay bands and benefit tiers covering a payroll is a human resources task. To promise a future in which no intrusion ever comes through claims a guarantee that no plan can give. To stand in for a firewall and the antivirus suites outright is wrong, because responding never replaces preventive controls.
- A help-desk monitor logs a user successfully logging in at 9:00 a.m. Separately, the security team confirms that an attacker exfiltrated customer records overnight. Using ISC2 terminology, how should each of these be classified?
- The access is an incident, and the breach is an event
- The session is an event, and the theft is an incident
- The logon and the loss are one incident, not an event
- The visit and the leak are one event, not an incident
Correct answer: The session is an event, and the theft is an incident
The session is an event, and the theft is an incident is the right classification: an event is any observable occurrence, and a routine successful login is benign, while an incident actually or potentially jeopardizes confidentiality, integrity, or availability, which confirmed theft of customer records plainly does. The access is an incident, and the breach is an event reverses the labels. The logon and the loss are one incident, not an event would make every routine log entry a crisis. The visit and the leak are one event, not an incident would leave a real breach unhandled.
- While assembling an incident response team, a manager argues that only IT and security staff are needed. Why does the ISC2 curriculum recommend including roles such as legal counsel, public relations, and human resources?
- Because a rule bars tech workers and forbids the response
- Because a broader lineup is cheaper to staff and maintain
- Because a breach raises law and media and people problems
- Because the legal team runs the malware sweep and cleanup
Correct answer: Because a breach raises law and media and people problems
Because a breach raises law and media and people problems is the reason a mixed roster is advised: incidents throw up liability, public messaging, and personnel questions that engineers are not equipped to answer. Because a rule bars tech workers and forbids the response is invented, since no regulation excludes technical people from responding. Because a broader lineup is cheaper to staff and maintain is not the argument; cost is not why the roles are added. Because the legal team runs the malware sweep and cleanup gets the division of labor backwards.
- Business continuity is best understood as which of the following?
- The choice to close the doors for good after failure
- A method of squeezing backup files into a tiny space
- The cipher suite that card networks ask for in shops
- The knack of serving core customers in a hard crisis
Correct answer: The knack of serving core customers in a hard crisis
The knack of serving core customers in a hard crisis is what business continuity means: the capability to keep delivering essential functions during and after a disruption, often through alternate sites or manual workarounds. The choice to close the doors for good after failure is the opposite of continuity. A method of squeezing backup files into a tiny space is compression, a storage technique. The cipher suite that card networks ask for in shops is a payment security requirement rather than a resilience capability.
- During an active ransomware outbreak, responders disconnect the infected file server from the network to stop the malware from reaching other systems, but they have not yet removed the malware or rebuilt anything. Which incident response activity does disconnecting the server represent?
- Remediation
- Contingency
- Containment
- Restoration
Correct answer: Containment
Pulling the server off the network is Containment, which limits how far the incident can reach while evidence is still preserved. Remediation would mean cleaning the malicious code out of the host, which the responders have not yet done. Restoration would mean returning a cleaned system to production service, a later step again. Contingency work is the advance planning carried out long before any incident, such as writing playbooks and staffing the team.
- A backup designer wants to be able to lose at most a few seconds of data if a database fails, so they implement continuous replication to a second site. Which recovery metric is this design choice most directly intended to satisfy?
- A loosened RTO for the restart
- A widened MTD for the shutdown
- A raised MTBF for the hardware
- A tightened RPO for the ledger
Correct answer: A tightened RPO for the ledger
Continuous replication exists to shrink how much data can be lost, which is exactly what a tightened RPO for the ledger expresses. A loosened RTO for the restart would allow a longer wait before service returns, not less lost data. A widened MTD for the shutdown states how long the business can survive without the system at all. A raised MTBF for the hardware is a reliability statistic about how often equipment fails, not a recovery target.
- A new help desk technician must reset user passwords but should never be able to change firewall configurations or server settings. Applying the principle of least privilege, what access should the technician receive?
- Only the narrowest rights the assignment permits
- Only the unrestricted rights the backlog demands
- Only the copied rights the predecessor possessed
- Only the administrator rights the audit revisits
Correct answer: Only the narrowest rights the assignment permits
Least privilege gives the newcomer only the narrowest rights the assignment permits and nothing beyond that, so a compromise of the account cannot touch firewalls or servers. Only the unrestricted rights the backlog demands inverts the principle by letting workload set the grant. Only the copied rights the predecessor possessed carries forward whatever that person accumulated, excess included. Only the administrator rights the audit revisits leaves broad power in place until someone gets around to trimming it.
- Which statement best distinguishes authentication from authorization in an access control system?
- Authentication records the steps taken, while authorization verifies the token presented
- Authentication proves the identity claimed, while authorization sets the actions allowed
- Authentication grants the rights needed, while authorization confirms the password typed
- Authentication labels the account holder, while authorization stores the session history
Correct answer: Authentication proves the identity claimed, while authorization sets the actions allowed
Authentication proves the identity claimed, while authorization sets the actions allowed: the system first establishes who is asking, then decides what that requester may reach. Saying authentication grants the rights needed, while authorization confirms the password typed, simply reverses the two. Authentication records the steps taken, while authorization verifies the token presented, promotes accounting into the first slot. Authentication labels the account holder, while authorization stores the session history, describes identification and accounting instead.
- In the Identification, Authentication, Authorization, and Accounting (IAAA) model, which step occurs first when a user begins to access a system?
- Testing the password, since the secret proves ownership
- Assigning the privileges, since the rights guard access
- Asserting the username, since the checks come afterward
- Recording the activity, since the trail enables tracing
Correct answer: Asserting the username, since the checks come afterward
The model opens with Asserting the username, since the checks come afterward: nothing can be verified or permitted until an identity has been claimed. Testing the password, since the secret proves ownership, is the second step. Assigning the privileges, since the rights guard access, is the third. Recording the activity, since the trail enables tracing, is the last, and none of those three can run against an identity that was never asserted.
- A bank requires customers to enter a password and then approve a prompt on a registered mobile app before transferring funds. Why does this qualify as multi-factor authentication?
- The two steps rely on the identical knowledge factor
- The two steps rely on the registered hardware factor
- The two steps rely on the lengthened password factor
- The two steps rely on wholly separate factor classes
Correct answer: The two steps rely on wholly separate factor classes
It qualifies because the two steps rely on wholly separate factor classes: the typed secret is something the customer knows and the app approval is something the customer has. Steps that rely on the identical knowledge factor, such as two passwords or a memorized answer, stay inside one class. Steps that rely on the registered hardware factor repeat a single possession check. Steps that rely on the lengthened password factor only make one knowledge secret harder to guess.
- What is multi-factor authentication (MFA)?
- A scheme drawing proof from two unrelated evidence classes
- A scheme pulling responses from one memorized question set
- A scheme hiding typed secrets from hostile packet sniffers
- A scheme forcing freshly chosen passwords from staff daily
Correct answer: A scheme drawing proof from two unrelated evidence classes
It is a scheme drawing proof from two unrelated evidence classes, so an attacker who captures one item still lacks the other. A scheme pulling responses from one memorized question set stays wholly inside the knowledge class. A scheme hiding typed secrets from hostile packet sniffers protects a single factor in transit rather than adding a second one. A scheme forcing freshly chosen passwords from staff daily rotates one factor and never introduces another.
- Role-Based Access Control (RBAC) assigns permissions in which way?
- To secrecy labels, which the monitor then enforces
- To job-linked groups, which the staff then inherit
- To owner settings, which the originator then edits
- To live attributes, which the engine then compares
Correct answer: To job-linked groups, which the staff then inherit
Permissions go to job-linked groups, which the staff then inherit, so administration means maintaining a small set of groups instead of editing every individual account. To secrecy labels, which the monitor then enforces, describes mandatory access control. To owner settings, which the originator then edits, describes discretionary access control. To live attributes, which the engine then compares, describes attribute-based access control.
- What does Role-Based Access Control (RBAC) primarily restrict access by?
- The secrecy label the document carries
- The personal preference the owner sets
- The job function the employee performs
- The arrival moment the gateway records
Correct answer: The job function the employee performs
Access is restricted by the job function the employee performs, so everyone doing that work gets one consistent set of rights and joiners and leavers are simple to handle. The secrecy label the document carries drives mandatory access control. The personal preference the owner sets drives discretionary access control. The arrival moment the gateway records is a time-of-day condition, at most one attribute among many that a context-aware policy might weigh.
- An organization needs access decisions that consider the user's department, the file's classification, the time of day, and the device's location together. Which access control model is designed for this kind of multi-attribute evaluation?
- RBAC, because decisions weigh assigned duties plus titles
- DAC, because decisions weigh owner choices plus instincts
- MAC, because decisions weigh secrecy markings plus grades
- ABAC, because decisions weigh subject object plus context
Correct answer: ABAC, because decisions weigh subject object plus context
The scenario calls for ABAC, because decisions weigh subject object plus context: department is a subject trait, classification an object trait, and clock time and place are environmental ones. RBAC, because decisions weigh assigned duties plus titles, keys off a static grouping and cannot combine changing conditions. DAC, because decisions weigh owner choices plus instincts, leaves the call to whoever owns the file. MAC, because decisions weigh secrecy markings plus grades, compares one label against one clearance.
- Which statement correctly contrasts Role-Based Access Control (RBAC) with Attribute-Based Access Control (ABAC)?
- RBAC follows fixed groupings, while ABAC weighs assorted surroundings
- RBAC monitors variable signals, while ABAC accepts permanent postings
- RBAC enforces classified markings, while ABAC obeys individual owners
- RBAC reflects creator choices, while ABAC imposes military clearances
Correct answer: RBAC follows fixed groupings, while ABAC weighs assorted surroundings
The real contrast is that RBAC follows fixed groupings, while ABAC weighs assorted surroundings: one maps a user to a static grouping, the other evaluates subject, object and environmental traits at the moment of the request. RBAC monitors variable signals, while ABAC accepts permanent postings, states the pair backwards. RBAC enforces classified markings, while ABAC obeys individual owners, describes mandatory and discretionary control instead. RBAC reflects creator choices, while ABAC imposes military clearances, swaps in those same two models again.
- In a Discretionary Access Control (DAC) system, who has the authority to decide which other users may access a file?
- The central clearance officer
- The individual resource owner
- The presently active operator
- The mandatory label evaluator
Correct answer: The individual resource owner
Under DAC the individual resource owner decides, because ownership itself carries the discretion to grant or revoke rights on what you own. The central clearance officer describes mandatory access control, where a central authority issues clearances nobody may override. The presently active operator would mean anyone with a live session could hand out rights, which no model permits. The mandatory label evaluator is again the system-enforced approach rather than the owner-driven one.
- What is Discretionary Access Control (DAC)?
- A model where groupings convey bundled mandates
- A model where secrecy markings restrain readers
- A model where owners themselves nominate guests
- A model where traits settle individual requests
Correct answer: A model where owners themselves nominate guests
DAC is a model where owners themselves nominate guests, so whoever holds a resource may grant or withdraw rights on it at will, which is flexible but drifts easily into over-sharing. A model where groupings convey bundled mandates describes role-based control. A model where secrecy markings restrain readers describes mandatory control. A model where traits settle individual requests describes attribute-based control.
- Which characteristic is unique to Mandatory Access Control (MAC) compared with Discretionary Access Control (DAC)?
- Groupings gather rights that the staff simply inherit
- Owners edit rosters that the creator casually revises
- Traits decide requests that the engine quickly scores
- Labels bind clearances that the kernel alone rewrites
Correct answer: Labels bind clearances that the kernel alone rewrites
What sets MAC apart is that labels bind clearances that the kernel alone rewrites, so the system itself makes the decision and even a file's owner cannot loosen it. Groupings gather rights that the staff simply inherit describes role-based control. Owners edit rosters that the creator casually revises is exactly the discretionary behavior MAC removes. Traits decide requests that the engine quickly scores describes attribute-based control.
- What is Mandatory Access Control (MAC)?
- A scheme where central labels outrank personal wishes
- A scheme where task groupings collect assigned duties
- A scheme where resource creators pick trusted readers
- A scheme where packet filters inspect address headers
Correct answer: A scheme where central labels outrank personal wishes
MAC is a scheme where central labels outrank personal wishes: a central authority classifies objects and clears subjects, the system enforces the comparison, and no ordinary user can relax it. A scheme where task groupings collect assigned duties is role-based control. A scheme where resource creators pick trusted readers is discretionary control. A scheme where packet filters inspect address headers describes a firewall, which is not an access control model at all.
- In a defense agency, the system labels documents 'Secret' and grants access only to users holding a Secret clearance or higher, with no user able to relabel a document. Which access control model is in use?
- Owner controlled sharing (DAC)
- Imposed secrecy rankings (MAC)
- Duty linked entitlement (RBAC)
- Runtime context scoring (ABAC)
Correct answer: Imposed secrecy rankings (MAC)
The scenario is imposed secrecy rankings (MAC): a central authority classifies each document and clears each person, the system enforces that comparison, and nobody may relabel anything. Owner controlled sharing (DAC) would let whoever owns a document hand out rights, which this scenario explicitly forbids. Duty linked entitlement (RBAC) keys off job groupings rather than secrecy levels. Runtime context scoring (ABAC) weighs many changing traits at request time instead of one fixed clearance test.
- What does the term 'access control' refer to in information security?
- The scrambling of stored archive contents
- The duplication of distant storage copies
- The narrowing of permitted resource reach
- The inspection of inbound network traffic
Correct answer: The narrowing of permitted resource reach
The term means the narrowing of permitted resource reach: deciding which subjects may view or use which objects, and under what conditions. The scrambling of stored archive contents is encryption. The duplication of distant storage copies is backup. The inspection of inbound network traffic is monitoring. Each of those is a genuine safeguard, but none of them is what the term itself denotes.
- Which of the following is an example of a logical (technical) access control rather than a physical one?
- A bollard diverting trucks to protected lanes
- A warden comparing badges to approved rosters
- A scanner binding doorways to enrolled prints
- A setting limiting accounts to database reads
Correct answer: A setting limiting accounts to database reads
A setting limiting accounts to database reads is the logical example, because it is enforced in software and configuration rather than by anything you could touch. A bollard diverting trucks to protected lanes is a physical barrier. A warden comparing badges to approved rosters is a physical staffing measure. A scanner binding doorways to enrolled prints governs bodily entry, so it counts as physical even though the mechanism is electronic.
- An organization protects its data center with a perimeter fence, a badge-controlled lobby door, an access-control vestibule, and a locked cage around the servers. This stacking of multiple physical barriers is an example of which principle?
- Layers of defense
- Division of tasks
- Transfer of risks
- Chain of evidence
Correct answer: Layers of defense
Stacking a fence, a badge door, a vestibule and a locked cage illustrates layers of defense: several independent controls in series, so defeating one still leaves the rest standing. Division of tasks splits a sensitive process between people and says nothing about stacking barriers. Transfer of risks moves financial exposure onto an insurer or a supplier. Chain of evidence tracks who handled an item and when, which is a forensics concern.
- Which set of measures are all examples of physical access controls?
- Passwords, lockouts, and privileges
- Fences, turnstiles, and floodlights
- Firewalls, detectors, and honeypots
- Ciphers, checksums, and credentials
Correct answer: Fences, turnstiles, and floodlights
Fences, turnstiles, and floodlights are physical access controls, because every one of them deters or blocks entry to a place rather than to data. Passwords, lockouts, and privileges are logical controls enforced in software. Firewalls, detectors, and honeypots are technical network controls. Ciphers, checksums, and credentials are cryptographic mechanisms, so none of those three sets is physical.
- Why are privileged accounts, such as system administrator accounts, a priority for Privileged Access Management (PAM)?
- Their frequent requests crowd support queues
- Their costly licenses inflate annual budgets
- Their extensive rights render misuse ruinous
- Their exempt status bypasses password resets
Correct answer: Their extensive rights render misuse ruinous
They are the priority because their extensive rights render misuse ruinous: one stolen administrator credential can rewrite configurations, mint new accounts and switch off controls across a whole estate, which makes such accounts high-value targets. Their frequent requests crowd support queues is a workload claim, and ordinary staff raise far more tickets. Their costly licenses inflate annual budgets is a purchasing matter. Their exempt status bypasses password resets is simply untrue, since these accounts are authenticated more strictly, not less.
- A cloud engineer normally works with standard permissions but is granted administrator rights only for the 30 minutes needed to patch a server, after which the rights are automatically revoked. Which Privileged Access Management practice does this illustrate?
- Credential replacement
- Permanent entitlements
- Administrator vaulting
- Time-limited elevation
Correct answer: Time-limited elevation
This is time-limited elevation, the just-in-time approach: rights are issued for the exact window a task needs and withdrawn automatically, so no standing privilege is left lying around for an attacker to find. Permanent entitlements are the very arrangement this practice removes. Credential replacement rotates the secret on an account but leaves that account powerful around the clock. Administrator vaulting stores and checks out the credential centrally, which governs custody rather than duration.
- How do the principle of least privilege and the concept of need to know differ?
- Least privilege bounds actions, while need to know restricts facts
- Least privilege covers seniors, while need to know shields juniors
- Least privilege means barriers, while need to know suits passwords
- Least privilege screens documents, while need to know limits tasks
Correct answer: Least privilege bounds actions, while need to know restricts facts
Least privilege bounds actions, while need to know restricts facts: one governs what you may do, the other what you may see, and the two are normally applied together. Least privilege covers seniors, while need to know shields juniors invents a split by rank that neither idea makes. Least privilege means barriers, while need to know suits passwords miscasts them as physical and logical control types. Least privilege screens documents, while need to know limits tasks states the pair the wrong way round.
- An employee transfers from accounting to marketing but keeps the accounting system permissions in addition to new marketing access. Which access control problem does this represent, and what practice would catch it?
- Orphaned logins, caught by monthly roster matching
- Privilege creep, caught by periodic rights reviews
- Toxic pairings, caught by strict conflict matrices
- Shared secrets, caught by session activity logging
Correct answer: Privilege creep, caught by periodic rights reviews
This is privilege creep, caught by periodic rights reviews, which compare what each person can currently do against the job they now hold and strip whatever no longer fits. Orphaned logins, caught by monthly roster matching, are accounts whose owner has left the company entirely, which is not this case. Toxic pairings, caught by strict conflict matrices, are separation-of-duty clashes rather than leftover rights. Shared secrets, caught by session activity logging, concern several people using one credential.
- What does the accounting (auditing) component of the IAAA model provide that supports accountability?
- It compares supplied proofs to records
- It scrambles moving bytes to gibberish
- It traces finished deeds to identities
- It attaches verified callers to powers
Correct answer: It traces finished deeds to identities
Accounting is the step that traces finished deeds to identities, producing the audit trail on which accountability and non-repudiation rest. It compares supplied proofs to records is authentication, the earlier step that establishes who someone is. It attaches verified callers to powers is authorization. It scrambles moving bytes to gibberish is encryption, a confidentiality safeguard that says nothing about who did what.
- A company wants to ensure no single employee can both create a vendor and approve payments to that vendor, so it splits those permissions between two roles. Which access control concept is being applied?
- Rotation of positions
- Layering of obstacles
- Retention of receipts
- Segregation of duties
Correct answer: Segregation of duties
Splitting vendor creation from payment approval is segregation of duties: no one person controls a whole sensitive transaction, so committing the fraud would require collusion. Rotation of positions moves people through jobs so long-running schemes surface, which is related but is not what the company did here. Layering of obstacles is defense in depth, about stacking controls rather than dividing one task. Retention of receipts governs how long records are kept.
- A guard verifies a visitor's badge against a list and lets only people with valid badges into a restricted floor. Which two access-control functions is the badge-and-list process performing at the door?
- Identification and admission
- Encryption and certification
- Segmentation and translation
- Containment and notification
Correct answer: Identification and admission
The badge-and-list process performs identification and admission: the badge asserts who the visitor is and the list decides whether that person may enter, which is authorization applied to a physical space. Encryption and certification protect data in transit and vouch for keys. Segmentation and translation are network functions. Containment and notification belong to incident response, and none of those three is happening at a badge desk.
- What is the OSI model?
- A cabling standard that governs connector tolerance
- A seven-tier framework that charts networking steps
- A wireless protocol that scrambles roaming handsets
- A filtering appliance that rejects unwanted uploads
Correct answer: A seven-tier framework that charts networking steps
It is a seven-tier framework that charts networking steps, a conceptual reference dividing communication from Physical up to Application and used mainly for teaching and troubleshooting. A cabling standard that governs connector tolerance is a hardware specification. A wireless protocol that scrambles roaming handsets is link encryption. A filtering appliance that rejects unwanted uploads is a firewall, and none of those three is a layered reference model.
- How many layers does the OSI model define?
- Four listed layers
- Five ranked layers
- Seven named layers
- Six labeled layers
Correct answer: Seven named layers
The model defines seven named layers: Physical, Data Link, Network, Transport, Session, Presentation and Application. Four listed layers is the count for the TCP/IP model, which is where this confusion normally comes from. Five ranked layers and six labeled layers match no standard reference model at all.
- Which layer of the OSI model is responsible for end-to-end delivery and is where TCP and UDP operate?
- The Session layer
- The Network layer
- The Data-Link layer
- The Transport layer
Correct answer: The Transport layer
The Transport layer handles end-to-end delivery, and it is where TCP and UDP live. The Session layer opens and closes conversations between applications. The Network layer does logical addressing and routing between networks. The Data-Link layer moves frames across a single physical link, so none of those three carries the segments and datagrams these two protocols produce.
- How does the TCP/IP model differ from the OSI model in terms of structure?
- The TCP/IP model compresses seven layers into four
- The TCP/IP model divides single layers into dozens
- The TCP/IP model groups wireless links into layers
- The TCP/IP model folds hardware labels into layers
Correct answer: The TCP/IP model compresses seven layers into four
Structurally the TCP/IP model compresses seven layers into four: one Application layer covers what the older reference splits into Session, Presentation and Application, and one Link layer covers Physical and Data Link. The TCP/IP model divides single layers into dozens claims the opposite. The TCP/IP model groups wireless links into layers wrongly narrows it to radio networks. The TCP/IP model folds hardware labels into layers confuses an addressing scheme with stack structure.
- Which set correctly lists the four layers of the TCP/IP model?
- Physical, Datalink, Network, and Handshake
- Link, Internet, Transport, and Application
- Session, Presentation, Circuits, and Cable
- Routes, Switches, Addresses, and Datagrams
Correct answer: Link, Internet, Transport, and Application
The four are Link, Internet, Transport, and Application, with Link covering the two lowest reference layers and Application covering the top three. Physical, Datalink, Network, and Handshake mixes borrowed layer names with an invented one. Session, Presentation, Circuits, and Cable lists upper reference layers plus hardware terms. Routes, Switches, Addresses, and Datagrams names network objects rather than layers.
- What is malware?
- Layered cryptography applied to hide idle records
- Sealed appliances wired to sample passing packets
- Hostile programming built to wreck stored systems
- Licensed utilities shipped to copy shared folders
Correct answer: Hostile programming built to wreck stored systems
Malware is hostile programming built to wreck stored systems; the word is short for malicious software and the defining feature is deliberate harm. Layered cryptography applied to hide idle records is encryption. Sealed appliances wired to sample passing packets are hardware sensors. Licensed utilities shipped to copy shared folders are ordinary backup tools, and none of those three is written to cause damage.
- A user installs a free utility, and afterward their browsing habits are secretly recorded and sent to a third party. Which type of malware best describes this behavior?
- Modern ransomware
- Widespread botnet
- Conventional worm
- Notorious spyware
Correct answer: Notorious spyware
Quietly logging browsing habits and shipping them to a third party is notorious spyware behavior: it gathers information about the user and transmits it without their knowledge. Modern ransomware encrypts files and demands payment. A widespread botnet enrolls the machine into a remotely commanded network used for attacks. A conventional worm copies itself across networks under its own power, which is not what happened here.
- Which type of malware is specifically designed to hide its presence and maintain privileged access to a system?
- Well-known rootkit
- Commonplace trojan
- Troublesome adware
- Distributed botnet
Correct answer: Well-known rootkit
A well-known rootkit is written to conceal its own presence while preserving root-level control of a compromised machine. A commonplace trojan disguises itself as legitimate software to get in, but staying hidden afterwards is not its defining trait. Troublesome adware pushes unwanted advertisements. A distributed botnet is a herd of compromised machines driven from a command server, so none of those three centers on stealth plus retained privilege.
- Which malware type lies dormant until a specific condition or date triggers its malicious payload?
- A boot virus
- A logic bomb
- A web trojan
- A spy applet
Correct answer: A logic bomb
A logic bomb sits inert inside a system until a chosen date or condition fires its payload. A boot virus infects the startup sector and runs every time the machine powers on. A web trojan activates as soon as the disguised program is executed. A spy applet harvests data continuously instead of waiting for any trigger.
- An email appears to come from a bank and urges the recipient to click a link and enter their login credentials on a fake site. What is this attack called?
- Cache pharming
- Phone smishing
- Inbox phishing
- Cable sniffing
Correct answer: Inbox phishing
Mail that impersonates a bank to harvest credentials on a lookalike site is inbox phishing. Cache pharming poisons name resolution so a correctly typed address silently lands on the attacker's server, with no lure to click. Phone smishing runs the same deception over text messages rather than mail. Cable sniffing captures traffic passively off the wire and never asks the victim for anything.
- What distinguishes spear phishing from ordinary phishing?
- It sprays random inboxes bearing identical wording
- It requires bodily entry defeating locked doorways
- It prefers telephone calls avoiding typed messages
- It targets named people quoting researched details
Correct answer: It targets named people quoting researched details
The difference is that it targets named people quoting researched details, which makes the lure far more convincing than a generic blast. It sprays random inboxes bearing identical wording describes the broad campaign it is being contrasted with. It requires bodily entry defeating locked doorways is a physical intrusion, not a message-based one. It prefers telephone calls avoiding typed messages describes a voice-channel variant instead.
- What is spoofing in a network security context?
- Faking sender details to mimic trusted parties
- Splitting large estates to isolate risky hosts
- Encoding moving traffic to block idle watchers
- Copying live records to reach distant archives
Correct answer: Faking sender details to mimic trusted parties
Spoofing means faking sender details to mimic trusted parties: forging a source address, a hardware address or a mail sender so the target believes the traffic came from someone it already trusts. Splitting large estates to isolate risky hosts is segmentation. Encoding moving traffic to block idle watchers is encryption. Copying live records to reach distant archives is backup, and none of those three involves impersonation.
- What is a port number used for in networking?
- To find the right node on a local network
- To burn the fixed code on a metal adapter
- To sort the mixed packets on a busy cable
- To flag the exact service on a given host
Correct answer: To flag the exact service on a given host
A port number exists to flag the exact service on a given host, so one machine can offer web, mail and file transfer at the same time. An IP address is what lets a router find the right node on a local network; a MAC address is the fixed code burned onto a metal adapter at the factory; and TCP sequence numbers are what sort the mixed packets arriving on a busy cable.
- Which well-known port is used by the File Transfer Protocol (FTP) for control connections?
- 21 at L4
- 23 at L4
- 20 at L4
- 22 at L4
Correct answer: 21 at L4
FTP opens and holds its command channel on transport port 21 at L4, then moves file content over a separate connection. Port 20 carries only that FTP data stream, port 22 belongs to SSH and SFTP, and port 23 to Telnet, so none of those is the FTP control port.
- Which port number is associated with the Domain Name System (DNS)?
- 43 at L4
- 53 at L4
- 80 at L4
- 67 at L4
Correct answer: 53 at L4
DNS answers name lookups on transport port 53 at L4, using UDP for ordinary queries and TCP for zone transfers. Port 43 serves WHOIS registry lookups, port 67 is the DHCP server port that hands out addresses, and port 80 carries plain HTTP, so none of those resolves names.
- Which port number is the well-known port for SMTP email delivery between mail servers?
- 23 at L4
- 80 at L4
- 25 at L4
- 53 at L4
Correct answer: 25 at L4
Mail servers relay messages to one another over SMTP on transport port 25 at L4. Port 23 is Telnet, useful only for hand-testing an SMTP conversation; port 53 is DNS, which finds the receiving server's MX record but carries no mail itself; and port 80 is plain HTTP, which serves webmail pages rather than server-to-server delivery.
- An administrator needs the well-known port for Remote Desktop Protocol (RDP) to a Windows server. Which port is it?
- 5900 at L4
- 1723 at L4
- 5985 at L4
- 3389 at L4
Correct answer: 3389 at L4
RDP presents a Windows desktop over transport port 3389 at L4. Port 5900 belongs to VNC, port 5985 to WinRM remote management, and port 1723 to PPTP tunnels, so none of those reaches a Windows remote desktop session.
- What is the key difference between IPv4 and IPv6 addresses?
- IPv4 addresses occupy 32 bits while IPv6 addresses occupy 128 bits
- IPv4 addresses cover 32 bytes while IPv6 addresses cover 128 bytes
- IPv4 addresses list 32 digits while IPv6 addresses list 128 digits
- IPv4 addresses carry 4 groups while IPv6 addresses carry 16 groups
Correct answer: IPv4 addresses occupy 32 bits while IPv6 addresses occupy 128 bits
IPv4 addresses occupy 32 bits, about 4.3 billion values in total, while IPv6 addresses occupy 128 bits and give a vastly larger pool. They do not cover 32 or 128 bytes, since 32 bits is only four bytes; they are not written as a list of 32 or 128 hex digits, since an IPv6 address is thirty-two hex digits; and IPv6 addresses carry eight groups, not sixteen, so group count is not the distinction either.
- Why was IPv6 developed as a successor to IPv4?
- To lock the privacy of raw packet traffic
- To end the shortage of free address space
- To shrink the size of large router tables
- To dodge the burden of local name lookups
Correct answer: To end the shortage of free address space
IPv6 was created above all to end the shortage of free address space, because the 32-bit pool of roughly 4.3 billion values could not cover a world of always-connected devices. It was not built to lock the privacy of raw packet traffic, since IPsec is optional in practice and available on IPv4 too; nor to shrink the size of large router tables; and it does not dodge the burden of local name lookups, which DNS still performs.
- What is a firewall?
- A probe that spots and logs traffic under silent watch
- A server that fetches and hides traffic under one name
- A gate that reads and stops traffic under stated rules
- A relay that steers and sends traffic under set routes
Correct answer: A gate that reads and stops traffic under stated rules
A firewall is a gate that reads and stops traffic under stated rules, permitting or denying each flow at the boundary between a trusted and an untrusted network. A probe that spots and logs traffic under silent watch is an IDS, which alerts but does not block; a server that fetches and hides traffic under one name is a proxy; and a relay that steers and sends traffic under set routes is a router, which forwards by destination rather than by policy.
- How does a next-generation firewall (NGFW) extend a traditional firewall?
- It grants fast address swaps and wide port maps
- It keeps plain alert files and long event notes
- It holds local page stores and short name lists
- It adds deep packet reads and app aware filters
Correct answer: It adds deep packet reads and app aware filters
A next-generation firewall adds deep packet reads and app aware filters, so it can decide from the actual application and content instead of from port and address alone. It does not merely grant fast address swaps and wide port maps, which is what NAT does; it does not simply keep plain alert files and long event notes, which is the work of an IDS or a SIEM; and it does not hold local page stores and short name lists, which is what a caching proxy and a resolver do.
- What is symmetric encryption?
- Locks and unlocks under one shared secret value
- Seals and opens under two linked partner values
- Grinds and prints under one fixed digest length
- Marks and proves under one private trust anchor
Correct answer: Locks and unlocks under one shared secret value
Symmetric encryption locks and unlocks under one shared secret value, so the same key both protects and recovers the data and must be distributed safely. A scheme that seals and opens under two linked partner values is asymmetric encryption; one that grinds and prints under one fixed digest length is hashing, which is one-way and recovers nothing; and one that marks and proves under one private trust anchor is a digital signature, which proves origin rather than hiding content.
- What is asymmetric encryption?
- A shared token where one side locks and the other unlocks
- A matched pair where one side seals and the other reveals
- A fixed digest where one side stamps and the other checks
- A random nonce where one side sends and the other returns
Correct answer: A matched pair where one side seals and the other reveals
Asymmetric encryption uses a matched pair where one side seals and the other reveals: content locked with the public half can be opened only with the private half. A shared token where one side locks and the other unlocks is symmetric encryption, which reuses a single secret. A fixed digest where one side stamps and the other checks is hashing, which is one-way. A random nonce where one side sends and the other returns is challenge-response authentication, not encryption.
- A company needs to securely exchange a secret key over the internet before using fast bulk encryption. Which combination reflects how this is typically handled?
- A shared secret for the key and a plain code for the data
- A tiny digest for the key and a signed token for the data
- A public pair for the key and a block cipher for the data
- A clear message for the key and a raw stream for the data
Correct answer: A public pair for the key and a block cipher for the data
The normal pattern is a public pair for the key and a block cipher for the data: asymmetric cryptography safely carries the session key, then fast symmetric encryption protects the bulk traffic. A shared secret for the key and a plain code for the data cannot work, because that shared secret has no safe way across the internet in the first place. A tiny digest for the key and a signed token for the data fails, since hashing is one-way and leaves the far end nothing to decrypt with. A clear message for the key and a raw stream for the data exposes both.
- What is the difference between a DoS and a DDoS attack?
- A DoS hits web servers while a DDoS hits edge routers
- A DoS locks user files while a DDoS locks admin disks
- A DoS fills open ports while a DDoS fills quiet links
- A DoS uses one origin while a DDoS uses spread agents
Correct answer: A DoS uses one origin while a DDoS uses spread agents
A DoS uses one origin while a DDoS uses spread agents: the distributed form drives the flood from many compromised machines, usually a botnet, so it delivers far more volume and is much harder to filter out. Both target availability, so it is false that a DoS locks user files while a DDoS locks admin disks; both can strike any exposed service, so it is not that a DoS hits web servers while a DDoS hits edge routers; and neither is defined by whether it fills open ports or quiet links.
- Which of the following best describes a man-in-the-middle (on-path) attack at a high level?
- An attacker sits amid two live parties to read or alter traffic
- An attacker stores past valid frames to send or push new copies
- An attacker adds fake name replies to bend or steer web lookups
- An attacker tries many common words to guess or break one login
Correct answer: An attacker sits amid two live parties to read or alter traffic
In an on-path attack the attacker sits amid two live parties to read or alter traffic, relaying both directions so neither end notices anything wrong. An attacker who stores past valid frames to send or push new copies is running a replay attack; one who adds fake name replies to bend or steer web lookups is poisoning DNS resolution; and one who tries many common words to guess or break one login is running a brute-force or dictionary attack.
- An organization places its public web and email servers in a separate network segment between two firewalls, isolated from the internal LAN. What is this segment called?
- A tunneled VPN
- A screened DMZ
- A switched LAN
- A trunked VLAN
Correct answer: A screened DMZ
A screened DMZ, also called a screened subnet, is the buffer segment that holds public-facing servers between an outer and an inner firewall so they stay off the trusted network. A tunneled VPN carries remote users inward rather than isolating exposed servers; a switched LAN is the internal network this segment is deliberately kept apart from; and a trunked VLAN carries several tagged VLANs over a single link, which is logical separation, not a perimeter segment.
- Why does network segmentation improve security?
- It adds bulk speed and pushes frames in thicker cables
- It wraps live packets and hides text in sealed tunnels
- It blocks free spread and keeps hosts in walled groups
- It stores full records and shows steps in signed files
Correct answer: It blocks free spread and keeps hosts in walled groups
Segmentation blocks free spread and keeps hosts in walled groups, so an intruder who lands in one zone cannot move sideways through the rest of the estate and a breach stays contained. It does not add bulk speed or push frames in thicker cables, which is a capacity matter; it does not wrap live packets and hide text in sealed tunnels, which is what encryption or a VPN does; and it does not store full records or show steps in signed files, which is the work of logging.
- A hospital must keep patient billing records for a defined number of years to satisfy a legal requirement, then dispose of them. Which security operations concept governs how long the records must be kept before disposal?
- Records ownership
- Records remanence
- Records integrity
- Records retention
Correct answer: Records retention
Records retention is the practice that fixes how long information must be kept before it is destroyed, driven by legal, regulatory and business need. Records ownership names who is accountable for a data set; records remanence is the residue left behind on media after deletion; and records integrity is about information staying accurate and unaltered. None of those three sets a keeping period.
- An organization is retiring magnetic hard drives that held confidential files and wants to physically render the platters unusable so no data can ever be recovered. Which data destruction method best fits this goal?
- Shredding the media with heavy blades
- Wiping the media with random patterns
- Erasing the media with destroyed keys
- Purging the media with firmware calls
Correct answer: Shredding the media with heavy blades
Shredding the media with heavy blades is physical destruction: the platters are reduced to fragments, so nothing can be read back by any laboratory. Wiping the media with random patterns is overwriting, which leaves the drive whole and reusable; erasing the media with destroyed keys is a cryptographic erase, which only works if every block was encrypted; and purging the media with firmware calls invokes the drive's own secure-erase command, which also leaves the platters intact.
- Which data destruction technique uses a strong magnetic field to erase data from magnetic media such as traditional hard drives and tapes?
- Overwriting the sectors
- Degaussing the surfaces
- Dropping the passphrase
- Reformatting the volume
Correct answer: Degaussing the surfaces
Degaussing the surfaces applies a powerful magnetic field that scrambles the magnetic domains, destroying the recording and usually the drive with it. Overwriting the sectors replaces content with new patterns, which is a logical method rather than a magnetic one; dropping the passphrase is a cryptographic erase; and reformatting the volume only rebuilds the file table. Degaussing also has no effect on flash-based solid-state drives, which store no magnetic charge.
- A security team writes a rule stating that internal documents may only be emailed to addresses ending in the company domain and must never be posted to public file-sharing sites. This rule is an example of which security operations practice?
- Access vetting rules
- Backup testing plans
- Data handling policy
- Media disposal steps
Correct answer: Data handling policy
The rule is an example of a data handling policy, which sets out how information may be used, shared, stored and released through its life, including where it may be sent. Access vetting rules decide who is granted rights rather than how information may travel; backup testing plans confirm that restores actually work; and media disposal steps govern how storage is destroyed at end of life.
- An administrator disables unused services, closes unnecessary open ports, and removes default sample accounts on a new web server before deployment. What is this process called?
- Malware monitoring
- Signature updating
- Asset provisioning
- Platform hardening
Correct answer: Platform hardening
Platform hardening is the process of shrinking the attack surface: unneeded services, ports, accounts and features are switched off before the system goes live. Malware monitoring watches for hostile code once a system is running; signature updating keeps detection content current; and asset provisioning is the act of issuing and setting up equipment, none of which is the lock-down step described.
- A new analyst asks where in the organization security events from many systems are collected, monitored, and analyzed around the clock by a dedicated team. What is this centralized facility called?
- Security operations center
- Security awareness program
- Security incident handling
- Security metrics reporting
Correct answer: Security operations center
The centralized facility is the security operations center, the SOC, where a dedicated team watches, triages and responds to events from across the estate around the clock. A security awareness program teaches users to recognize threats; security incident handling is a process the SOC runs rather than the facility itself; and security metrics reporting summarizes performance for management.
- An organization labels its files as Public, Internal, Confidential, and Restricted so that the most sensitive data receives the strongest protection. What is the primary benefit of assigning these labels?
- It binds the storage to the life of the record
- It scales the control to the worth of the item
- It grants the rights to the holder of the file
- It traces the access to the name of the person
Correct answer: It scales the control to the worth of the item
Classification pays off because it scales the control to the worth of the item, so the most sensitive material gets the strongest safeguards while routine material is not over-protected at needless cost. Labeling does not by itself bind the storage to the life of the record, which is retention; it does not grant the rights to the holder of the file, which is authorization; and it does not trace the access to the name of the person, which is what audit logging does.
- A company encrypts customer records stored on its database servers and also encrypts the same records as they travel across the internet to a partner. Which statement correctly distinguishes these two protections?
- At rest it guards live streams while in transit it guards still vaults
- At rest it guards backup tapes while in transit it guards email trails
- At rest it guards saved blocks while in transit it guards sent packets
- At rest it guards logon rights while in transit it guards public ports
Correct answer: At rest it guards saved blocks while in transit it guards sent packets
At rest it guards saved blocks while in transit it guards sent packets: one protects information sitting on disk or tape, the other protects the same information as it crosses a network, and both are needed for full cover. The version that guards live streams at rest and still vaults in transit reverses the two states. Neither is limited to backup tapes at rest and email trails in transit, and neither protects logon rights or public ports, which is the job of access control.
- What is the primary goal of patch management as a security operations process?
- To scan and score the hosts that show known flaws
- To copy and store the files that hold known value
- To vet and grant the rights that suit known roles
- To test and load the fixes that close known holes
Correct answer: To test and load the fixes that close known holes
Patch management exists to test and load the fixes that close known holes, shrinking the window in which a published flaw can be exploited. To scan and score the hosts that show known flaws is vulnerability management, which finds problems but never remedies them; to copy and store the files that hold known value is backup; and to vet and grant the rights that suit known roles is access provisioning.
- A small business applies vendor patches to a few non-critical machines first and confirms nothing breaks before rolling the patches out to all production servers. Why is this staged testing recommended?
- To spot the bad update before the wide rollout
- To ease the steep load before the busy quarter
- To meet the firm rule before the yearly review
- To free the disk space before the large backup
Correct answer: To spot the bad update before the wide rollout
Staged testing exists to spot the bad update before the wide rollout, so a patch that breaks an application is caught on a handful of low-risk machines instead of across production. It is not done to ease the steep load before the busy quarter, nor to meet the firm rule before the yearly review, nor to free the disk space before the large backup; none of those is why a pilot group is patched first.
- An IT department keeps an authoritative record of every server's approved hardware, installed software versions, and settings, and updates that record whenever an approved change is made. Which practice does this describe?
- Vulnerability management
- Configuration management
- Documentation management
- Certification management
Correct answer: Configuration management
Configuration management is the practice that establishes and maintains an authoritative, documented baseline of hardware, software and settings, and tracks approved changes against it. Vulnerability management finds and ranks weaknesses rather than recording an approved state; documentation management stores and versions documents, not system state; and certification management handles certificates and accreditation.
- Why is logging and monitoring considered essential to security operations?
- It seals a volume and hides the raw block
- It vets a badge and opens the right doors
- It keeps a trail and flags the odd events
- It clones a drive and holds the spare set
Correct answer: It keeps a trail and flags the odd events
Logging and monitoring matter because the practice keeps a trail and flags the odd events, so unusual or hostile behavior is noticed, alerted on and investigated rather than passing unseen. It seals a volume and hides the raw block only where encryption is applied, which is a separate control; it vets a badge and opens the right doors describes access control; and it clones a drive and holds the spare set describes backup.
- An employee receives an email that appears to come from the IT helpdesk asking them to click a link and confirm their password. After completing security awareness training, what is the best action?
- Delete a phish and ignore the whole link
- Email a sender and verify the plain link
- Change a secret and trust the clean link
- Report a threat and refuse the fake link
Correct answer: Report a threat and refuse the fake link
Awareness training teaches the user to report a threat and refuse the fake link, so the security team learns a campaign is under way and no credentials are exposed. To delete a phish and ignore the whole link leaves the rest of the organization unwarned. To email a sender and verify the plain link writes to an address the attacker controls and confirms a live mailbox. To change a secret and trust the clean link still hands the new password straight to the attacker.
- A new employee must read and sign a document describing what they may and may not do with company computers, internet access, and email before being granted system access. What is this document?
- Acceptable use policy
- Software license list
- Access control matrix
- Non disclosure notice
Correct answer: Acceptable use policy
The document is the acceptable use policy, which states what staff may and may not do with company computers, networks, mail and internet access, and is signed before access is granted. A software license list records entitlements held by the company; an access control matrix maps subjects to the permissions they hold; and a non disclosure notice binds the reader to confidentiality rather than governing how equipment may be used.
- A developer wants to verify that a downloaded file was not altered in transit by comparing a value computed from the file against a value published by the vendor. Which technique produces that fixed-length value used to confirm integrity?
- Padding the bytes
- Hashing the bytes
- Masking the bytes
- Signing the bytes
Correct answer: Hashing the bytes
Hashing the bytes produces a fixed-length digest from the input, so any change at all yields a different digest and the download can be checked against the value the vendor published. Padding the bytes only adds filler so data fits a block size; masking the bytes replaces real values with substitutes for privacy; and signing the bytes proves who sent something using a private key, which is a different assurance from a published checksum.
- Before any modification is made to a production system, a company requires the change to be documented, reviewed, approved, and scheduled. What is this formal process called?
- Change backout
- Change logging
- Change control
- Change staging
Correct answer: Change control
The formal process is change control, also known as change management: every modification is written up, reviewed, approved and scheduled before it touches production, so its impact is understood in advance. Change backout is only the rollback step a controlled change plans for; change logging records what was done after the fact; and change staging is the rehearsal of a change in a test environment. None of those three is the governing process.
- A company applies a hardened, standardized configuration to every new laptop so each device starts from the same secure state. What is this approved standard configuration commonly called?
- The recovery playbook
- The password standard
- The hardware register
- The security baseline
Correct answer: The security baseline
The approved standard build is the security baseline: a defined minimum configuration applied to every device so each one starts from the same known good state. The recovery playbook sets out how service is restored after an outage; the password standard governs credential strength and rotation only; and the hardware register is an asset inventory, none of which is a whole approved configuration.
- An organization wants to ensure that records flagged for legal hold are not deleted even after their normal retention period ends. Which security operations practice must account for this exception?
- Archive keeping and disposal
- Backup copying and rotations
- Vendor vetting and oversight
- Patch testing and deployment
Correct answer: Archive keeping and disposal
Archive keeping and disposal is the data retention practice: it sets how long records are held and when they are destroyed, and it must suspend routine destruction while a legal hold is in force. Backup copying and rotations govern how restore points are cycled; vendor vetting and oversight covers third-party assurance; and patch testing and deployment governs software updates. None of those three decides when a record may be destroyed.
