64 Practice Questions & Answers
An organization needs to ensure that data transmitted over the network cannot be read by unauthorized parties. Which of the following best addresses this requirement?
-
A
Using network segmentation with VLANs
-
B
Deploying intrusion detection systems
-
C
Configuring firewall access control lists to block suspicious traffic patterns and anomalies
-
D
Implementing encryption protocols such as TLS/SSL
✓ Correct
Explanation
Encryption protocols like TLS/SSL protect data confidentiality in transit by encoding data so only authorized parties with the proper keys can read it. While other options provide security benefits, only encryption directly prevents unauthorized parties from reading transmitted data.
Which cryptographic algorithm is considered quantum-resistant and is recommended by NIST for post-quantum cryptography?
-
A
ECDSA with P-256 curve
-
B
Triple DES with 168-bit keys for enhanced security measures
-
C
RSA-2048
-
D
ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism)
✓ Correct
Explanation
NIST has standardized ML-KEM as a post-quantum key encapsulation mechanism that resists attacks from both classical and quantum computers. Traditional algorithms like RSA, ECDSA, and 3DES are vulnerable to quantum attacks and therefore not considered quantum-resistant.
A company wants to implement a solution that allows employees to access company resources from personal devices without storing sensitive data on those devices. Which approach best meets this requirement?
-
A
Implementing bring-your-own-device (BYOD) with containerization and data isolation
-
B
Installing Mobile Device Management (MDM) and requiring full device encryption
-
C
Deploying endpoint detection and response (EDR) tools on all personal devices with mandatory logging
-
D
Virtual Desktop Infrastructure (VDI) or application streaming
✓ Correct
Explanation
VDI and application streaming keep data on secure company servers while users access only the interface remotely, preventing sensitive data storage on personal devices. While MDM and containerization help with BYOD security, they don't prevent data from residing on the device.
An attacker gains access to a password hash file. The hashes were created using SHA-256 without salt. What vulnerability does this demonstrate?
-
A
SHA-256 is fundamentally broken and cannot be used for password storage
-
B
The lack of proper key derivation functions and the absence of salt makes the hashing function vulnerable to precomputation attacks and significantly weakens resistance to brute force attempts
-
C
Rainbow table attacks become feasible because identical passwords produce identical hashes and no salt is used
✓ Correct
-
D
The hashes are reversible, making the passwords recoverable
Explanation
Without salt, identical passwords produce identical hashes, and attackers can use precomputed rainbow tables to reverse common passwords efficiently. While the answer explains issues with salt and key derivation, the core vulnerability here is the absence of salt combined with predictable hash outputs.
Which of the following best describes the principle of least privilege in access control?
-
A
Users should be granted only the minimum permissions necessary to perform their assigned duties and no more
✓ Correct
-
B
Users should have administrative rights to perform their daily job functions
-
C
All users within the same department should have identical access permissions for consistency and ease of management
-
D
Privileged access should be distributed across multiple administrators to ensure accountability and reduce the risk of unauthorized changes to critical systems and resources
Explanation
Least privilege means granting users only the minimum necessary permissions for their role, reducing the attack surface and limiting damage from compromised accounts. Administrative rights and broad departmental access violate this principle.
A security team discovers that an attacker used a zero-day exploit to compromise a web server. Which security control would have provided the BEST detection capability in this scenario?
-
A
Static code analysis performed during the development phase
-
B
Network segmentation preventing lateral movement after initial compromise
-
C
Web Application Firewall (WAF) with known attack signature detection
-
D
Behavioral analysis and anomaly detection monitoring unusual system activity and network connections
✓ Correct
Explanation
Since zero-day exploits are unknown, signature-based detection cannot work. Behavioral analysis and anomaly detection can identify suspicious activities even from unknown attacks by detecting deviations from normal patterns. The other options focus on prevention rather than detection of unknown exploits.
What is the primary purpose of a Security Information and Event Management (SIEM) system?
-
A
To collect, analyze, and correlate logs and security events from multiple sources for threat detection and investigation
✓ Correct
-
B
To replace the need for firewalls and intrusion prevention systems
-
C
To automatically block all suspicious traffic detected across the enterprise network infrastructure and endpoints
-
D
To encrypt all data at rest and in transit across the network
Explanation
SIEM systems aggregate and analyze security data from multiple sources to detect threats, identify patterns, and facilitate incident response. They complement but don't replace other security controls like firewalls or IPS systems.
An organization implements a Privileged Access Management (PAM) solution. Which of the following is a key benefit of PAM?
-
A
It reduces the cost of security operations by automating all security tasks and eliminating manual reviews
-
B
It provides centralized control, monitoring, and logging of privileged account access and activities
✓ Correct
-
C
It eliminates the need for multi-factor authentication on administrative accounts
-
D
It guarantees that no security breaches will occur because all privileged actions are encrypted and stored in a secure vault with redundant backups
Explanation
PAM centralizes management of privileged accounts, monitors their usage, and creates audit trails of privileged actions. This reduces risk and improves accountability. PAM doesn't eliminate MFA, cost, or guarantee breach prevention.
Which attack vector is MOST likely to bypass network-based security controls such as firewalls and intrusion prevention systems?
-
A
Phishing emails containing malicious attachments delivered to end-user email accounts
✓ Correct
-
B
SQL injection attacks delivered through HTTP requests to web applications
-
C
Distributed denial-of-service (DDoS) attacks from multiple compromised servers
-
D
Port scanning reconnaissance activities from external threat actors attempting to map network topology
Explanation
Phishing with malicious attachments bypasses network security controls because the email and attachment appear to come from legitimate sources and are allowed through. The attack happens at the endpoint after passing through network controls. SQL injection, DDoS, and port scanning are more likely to be detected by network-based defenses.
An organization uses certificate pinning in its mobile application. What threat does this primarily mitigate?
-
A
SQL injection vulnerabilities in the application's backend database queries
-
B
Man-in-the-middle (MITM) attacks using fraudulent SSL/TLS certificates
✓ Correct
-
C
Reverse engineering attacks that attempt to extract sensitive algorithms and data structures from the compiled application binary code
-
D
Brute force attacks against the application's authentication mechanism
Explanation
Certificate pinning binds the app to specific valid certificates, preventing MITM attacks where attackers use fraudulent certificates to intercept communications. It doesn't address brute force, SQL injection, or reverse engineering threats.
During a security assessment, a penetration tester discovers that a company's DNS servers accept recursive queries from any source on the internet. What vulnerability does this represent?
-
A
The DNS servers can be used to perform DNS amplification attacks, where they are leveraged to reflect and amplify traffic toward a targeted victim
✓ Correct
-
B
The DNS servers will automatically update their records to match attacker-controlled nameservers
-
C
End users will experience slower DNS resolution times because their queries are prioritized lower than external recursive queries on the server
-
D
The DNS servers are vulnerable to SQL injection attacks through DNS queries
Explanation
Unrestricted recursive queries allow attackers to use the DNS server as an amplifier in DDoS attacks, sending small queries that generate large responses directed at victims. This is a known DNS amplification attack vector. The other options don't accurately describe the vulnerability.
A company wants to ensure that only authorized users can access sensitive documents stored in the cloud. Which of the following is the MOST important control?
-
A
Ensuring the cloud service provider has obtained SOC 2 Type II certification
-
B
Selecting a cloud provider located in the same geographic region as the company headquarters for reduced latency and legal compliance with local data residency requirements
-
C
Implementing strong encryption at rest and encrypting all data before uploading to cloud storage
-
D
Implementing robust identity and access management (IAM) with proper authentication and authorization controls
✓ Correct
Explanation
Strong IAM with authentication and authorization ensures only authorized users can access documents. While encryption is important for confidentiality, it doesn't control WHO can access data. SOC 2 certification and geographic location don't directly address user access control.
An organization discovers that a recent software patch introduced a new vulnerability. What is this type of vulnerability called?
-
A
A zero-day vulnerability that was previously unknown to the software vendor and security community
-
B
A supply chain vulnerability from a compromised third-party vendor
-
C
A regression vulnerability introduced unintentionally through the patch development and testing process
✓ Correct
-
D
An advanced persistent threat (APT) that exploits multiple chained vulnerabilities for deep system penetration
Explanation
A regression vulnerability is introduced when a patch or update inadvertently creates a new security flaw while fixing another issue. This is distinct from supply chain compromise, zero-days, or APTs.
Which of the following best describes the purpose of a Disaster Recovery Plan (DRP)?
-
A
To maintain detailed documentation of all user access requests and approval procedures throughout the year
-
B
To outline procedures for restoring IT systems and services to normal operations after a disruptive event
✓ Correct
-
C
To prevent all possible security incidents and cyber attacks before they occur
-
D
To ensure that employees receive annual security awareness training
Explanation
A DRP focuses on recovery procedures after a disaster disrupts services. While related to business continuity, it specifically addresses restoring systems and operations. It doesn't prevent incidents, provide security training, or document access requests.
An attacker performs a timing attack against a cryptographic implementation. What vulnerability is being exploited?
-
A
Variations in execution time based on input can leak information about the secret being processed, allowing an attacker to deduce the secret through statistical analysis
✓ Correct
-
B
The cryptographic system uses weak random number generation that produces predictable outputs and sequences allowing attackers to forecast future key values
-
C
The algorithm's mathematical properties make it breakable through algebraic manipulation and computational shortcuts
-
D
The implementation stores the cryptographic key in plaintext in memory, making it easily accessible to anyone with system access
Explanation
Timing attacks exploit variations in execution time that correlate with secret values, allowing attackers to infer the secret through careful measurement and analysis. This is a side-channel attack rather than an algorithmic weakness, key storage issue, or RNG problem.
Which authentication method provides the strongest protection against phishing attacks?
-
A
Multi-factor authentication (MFA) using passwordless methods like FIDO2 hardware keys
✓ Correct
-
B
One-time passwords (OTP) sent via SMS to the user's registered phone number
-
C
Single sign-on (SSO) with username and password
-
D
Biometric authentication using fingerprint or facial recognition tied to device sensors and local storage mechanisms
Explanation
FIDO2 hardware keys provide the strongest phishing protection because they use public-key cryptography and verify the legitimate website/service, preventing attackers from capturing credentials even if users are tricked. SMS OTP can be intercepted, SSO with passwords is vulnerable, and biometrics don't verify service legitimacy.
A security team is implementing a data classification system. Which of the following should be classified as the MOST sensitive?
-
A
General company policies and procedures documented in the employee handbook
-
B
Published marketing materials and press releases available on the company website
-
C
Employee directory with names and office locations
-
D
Customer payment card information and personally identifiable information (PII)
✓ Correct
Explanation
Payment card data and PII require the highest protection due to regulatory requirements (PCI DSS, GDPR, etc.) and high value to attackers. The other items have lower sensitivity and regulatory requirements.
An organization implements network segmentation using microsegmentation. What is the primary security benefit?
-
A
It eliminates the need for endpoint protection software on individual devices
-
B
It limits lateral movement by creating granular security zones and restricting traffic between specific workloads and applications
✓ Correct
-
C
It reduces the bandwidth consumed by network traffic and improves overall network performance
-
D
It provides automatic encryption of all network traffic and ensures compliance with industry standards and regulatory requirements
Explanation
Microsegmentation restricts communication between workloads, limiting an attacker's ability to move laterally after initial compromise. It doesn't primarily improve performance, eliminate endpoint protection, or provide automatic encryption.
A developer implements input validation using a whitelist approach. Why is this considered more secure than blacklist validation?
-
A
Whitelist validation is faster and uses less processing power than blacklist validation
-
B
Whitelist validation only allows known good inputs, making it harder for attackers to bypass with unexpected attack variations and new techniques
✓ Correct
-
C
Whitelist validation is the industry standard and is recommended by all security frameworks and compliance standards
-
D
Whitelist validation automatically detects and blocks zero-day exploits before they can execute on the server and compromise data integrity
Explanation
Whitelisting only allows known good inputs, preventing unexpected attack variations that blacklists might miss. Blacklists try to block known bad inputs but fail against new attack methods. Performance and zero-day detection aren't primary benefits.
An organization uses container technology for application deployment. Which security consideration is MOST critical?
-
A
Using only open-source container technologies to ensure complete transparency and community security review
-
B
Ensuring containers are deployed only on physical servers and not on virtual machines
-
C
Deploying containers across multiple data centers to ensure geographic redundancy and automatic failover capabilities for business continuity
-
D
Scanning container images for vulnerabilities and ensuring proper access controls to the container registry
✓ Correct
Explanation
Vulnerability scanning and registry access control prevent compromised or vulnerable images from being deployed. Container deployment platform (physical/virtual) and geographic distribution don't address core container security risks.
Which of the following is the PRIMARY objective of a Secure Software Development Lifecycle (SSDLC)?
-
A
To eliminate all developers who make coding errors or security mistakes throughout the development process
-
B
To reduce the time it takes to develop software and get products to market faster than competitors
-
C
To integrate security practices and reviews at every stage of software development from design through deployment and maintenance
✓ Correct
-
D
To ensure all software is developed using the most popular programming languages and frameworks available in the market
Explanation
SSDLC incorporates security throughout the development lifecycle, including threat modeling, secure coding, code review, and testing. It addresses security at each stage rather than focusing on programming language choice, time-to-market, or personnel decisions.
An attacker uses a compromised credential to access the company's cloud environment. The attacker's activities are logged, but no alerts were triggered. What is the PRIMARY gap in the security monitoring?
-
A
The organization did not implement network segmentation to prevent cloud access from untrusted networks
-
B
The organization did not encrypt the logs stored in the cloud infrastructure with a strong encryption algorithm and regularly rotate encryption keys
-
C
The organization did not require multi-factor authentication for all cloud account access
-
D
The organization did not configure alerting rules to detect anomalous user activity such as access from unusual locations or at unusual times
✓ Correct
Explanation
Logging without alerting provides no real-time detection. Behavioral analytics that alert on anomalies (unusual location, time, data access patterns) would have detected the compromised credential's misuse. MFA and encryption don't address detection gaps; they address prevention and protection.
A company experiences a data breach where confidential information is exfiltrated by an insider. Which control would BEST prevent this specific threat in the future?
-
A
Increasing the frequency of security awareness training to ensure all employees understand information protection policies and procedures
-
B
Requiring all employees to sign a non-disclosure agreement before employment begins
-
C
Deploying intrusion detection systems (IDS) at all network perimeter points to detect outbound traffic
-
D
Implementing Data Loss Prevention (DLP) tools that monitor and restrict the movement of sensitive data to unauthorized locations
✓ Correct
Explanation
DLP tools specifically monitor and prevent unauthorized data exfiltration by controlling where sensitive data can be sent. While NDAs, IDS, and training provide some deterrent, DLP is the technical control specifically designed to prevent data exfiltration. IDS alone may not stop encrypted or approved-looking outbound traffic carrying sensitive data.
An organization wants to verify that a digital file has not been tampered with since it was created. Which cryptographic technique is MOST appropriate?
-
A
Implementing steganography to hide the file within another innocuous-looking file to prevent detection
-
B
Computing and verifying a cryptographic hash or digital signature of the file
✓ Correct
-
C
Using elliptic curve cryptography to establish a secure communication channel between the sender and recipient of the file
-
D
Symmetric encryption using AES-256 to encrypt the entire file with a shared key
Explanation
Cryptographic hashes and digital signatures verify file integrity and authenticity without needing to decrypt data. Any modification to the file produces a different hash, detecting tampering. Encryption hides content but doesn't verify integrity; steganography hides data but doesn't verify it; ECC is for key exchange.
A vulnerability scanner reports that a database server is running an outdated version of the database software. What is the MOST critical reason to patch this vulnerability?
-
A
Outdated versions may contain unpatched security flaws that attackers can exploit to compromise the database and access sensitive data stored within it
✓ Correct
-
B
Running old software versions may prevent the organization from using the newest features and performance optimizations
-
C
Vendors no longer provide technical support for older versions, making it difficult to get help during system performance issues and compatibility problems
-
D
Old versions are not compatible with modern hardware and will require expensive server replacement
Explanation
The primary security risk is that outdated versions contain known vulnerabilities that attackers actively exploit. While features, hardware compatibility, and vendor support are business concerns, the critical security reason is closing known exploitable vulnerabilities.
Which of the following best describes a keylogger in the context of endpoint security threats?
-
A
A network monitoring device that captures and logs all IP packets traversing the network infrastructure for forensic analysis and incident investigation
-
B
A system utility that monitors and logs all file access attempts to ensure compliance with data protection regulations
-
C
An antivirus signature that identifies and blocks known malware based on its code patterns and behavioral characteristics
-
D
A hardware or software tool that records keyboard input, potentially capturing passwords and sensitive information without the user's knowledge
✓ Correct
Explanation
A keylogger captures keyboard input to steal sensitive information like passwords and credentials. The other options describe legitimate monitoring tools, network monitoring, and antivirus signatures rather than the malicious threat of keylogging.
Which of the following best describes the principle of least privilege in access control?
-
A
Administrators should have unrestricted access to all systems and data
-
B
All users in the same department should have identical access rights
-
C
Users should be granted only the minimum permissions necessary to perform their job functions
✓ Correct
-
D
Users should have the maximum permissions needed for their role to ensure efficiency
Explanation
The principle of least privilege is a fundamental security concept that restricts user access to only what is required for their specific role or task, minimizing the attack surface if credentials are compromised.
A security analyst discovers that an attacker has obtained valid user credentials and is accessing systems without triggering alerts. Which of the following attacks is most likely occurring?
-
A
Man-in-the-middle attack intercepting network traffic
-
B
Cross-site scripting (XSS) attack
-
C
Lateral movement using legitimate credentials to access systems and maintain persistence
✓ Correct
-
D
Credential stuffing with valid account credentials
Explanation
Lateral movement occurs when an attacker uses valid credentials to move through a network accessing multiple systems, often remaining undetected because they are using legitimate authentication. This is a post-compromise technique used to expand access and maintain persistence.
Which encryption standard is most commonly used to protect data in transit over modern networks?
-
A
WEP (Wired Equivalent Privacy)
-
B
MD5 hashing
-
C
DES (Data Encryption Standard)
-
D
TLS 1.2 or higher
✓ Correct
Explanation
TLS 1.2 and 1.3 are the current standards for encrypting data in transit, commonly used in HTTPS and other secure communications. WEP and DES are deprecated due to known vulnerabilities, and MD5 is a hash function, not an encryption cipher.
An organization implements multi-factor authentication (MFA) for remote access. Which of the following represents a valid combination of MFA factors?
-
A
Username and password stored in the user's email
-
B
A password and a time-based one-time password (TOTP) generated by an authenticator app
✓ Correct
-
C
Two different passwords for the same account
-
D
A password and a security question about the user's mother's maiden name
Explanation
Valid MFA combines different factor types: something you know (password) and something you have (TOTP token). Two passwords are still a single factor type, and security questions alone are not considered strong second factors in modern security practices.
Which of the following best describes a zero-trust security model?
-
A
Allowing trusted employees unrestricted access to all systems and data without additional authentication
-
B
Trusting all users on the internal network while blocking external access entirely
-
C
Implementing a firewall that blocks all traffic except from whitelisted IP addresses
-
D
Verifying and authenticating every user and device regardless of location, before granting access to resources
✓ Correct
Explanation
Zero-trust assumes that no user or device should be automatically trusted, even if they are on the internal network; instead, every access request must be verified and authenticated. This replaces the older perimeter-based security model.
A company experiences a data breach where customer personally identifiable information (PII) is exposed. Under most data protection regulations, what is the organization's primary obligation?
-
A
Publish a press release summarizing the breach without identifying specific customers
-
B
Immediately shutdown all systems to prevent further data loss
-
C
Notify affected individuals and regulatory bodies within a specified timeframe
✓ Correct
-
D
Only inform law enforcement after completing an internal investigation
Explanation
Most data protection regulations such as GDPR, CCPA, and state breach notification laws require organizations to notify affected individuals and relevant authorities within a specified timeframe (typically 30-72 hours) after discovering a breach involving PII.
Which of the following security controls is an example of a preventive control?
-
A
Reviewing access logs to detect unauthorized activity after it occurred
-
B
Conducting a post-incident review to understand what happened
-
C
Using intrusion detection systems to alert administrators of ongoing attacks
-
D
Implementing firewall rules to block malicious traffic before it reaches internal systems
✓ Correct
Explanation
Preventive controls stop security incidents from occurring in the first place, such as firewall rules blocking traffic. Detective controls (like logs and IDS) identify incidents after they occur, while corrective controls remediate the damage.
An organization wants to implement a security information and event management (SIEM) system. What is the primary benefit of a SIEM solution?
-
A
Prevents all malware infections by blocking known malicious file signatures
-
B
Automatically encrypts all data stored on the company servers
-
C
Centrally collects, analyzes, and correlates security logs and events from multiple sources to detect threats
✓ Correct
-
D
Replaces the need for individual antivirus solutions on each endpoint
Explanation
A SIEM solution aggregates log data from numerous sources, applies analytics and correlation rules to identify suspicious patterns, and generates alerts for potential security incidents. This enables faster threat detection and response across the entire infrastructure.
Which type of malware is specifically designed to encrypt a victim's files and demand payment for decryption?
-
A
Trojan horse
-
B
Spyware
-
C
Ransomware
✓ Correct
-
D
Logic bomb
Explanation
Ransomware encrypts user files and demands payment (ransom) to decrypt them. Trojans are malicious programs disguised as legitimate software, spyware monitors user activity, and logic bombs are malicious code triggered by specific conditions.
A penetration tester gains shell access to a web server running with administrative privileges. Which post-exploitation technique is the attacker most likely to use to maintain persistent access?
-
A
Immediately exfiltrating all data and disconnecting to avoid detection
-
B
Creating a detailed log of all actions for documentation purposes
-
C
Scanning the network for other vulnerable systems using built-in OS tools
-
D
Installing a web shell or backdoor to allow future access even if the initial vulnerability is patched
✓ Correct
Explanation
Installing a web shell or backdoor is a common persistence technique that allows an attacker to maintain access even after the initial vulnerability is remediated. This enables long-term compromise of the system.
Which of the following cryptographic algorithms is suitable for digital signatures and asymmetric encryption?
-
A
SHA-256
-
B
AES (Advanced Encryption Standard)
-
C
HMAC-MD5
-
D
RSA (Rivest-Shamir-Adleman)
✓ Correct
Explanation
RSA is an asymmetric encryption algorithm commonly used for digital signatures and public-key encryption. AES is symmetric encryption, SHA-256 is a hash function, and HMAC-MD5 is a message authentication code.
An organization uses a cloud storage service where files are encrypted using the cloud provider's encryption keys. What is the primary security risk with this approach?
-
A
Users will be unable to share files with others securely
-
B
The cloud provider could potentially access the unencrypted data if they maintain the encryption keys
✓ Correct
-
C
Encryption keys are more vulnerable to theft when stored in the cloud
-
D
The encryption algorithm used by the provider might be weaker than industry standards
Explanation
When the cloud provider manages encryption keys, they theoretically have access to decrypt the data, compromising confidentiality. This is why organizations often prefer client-side encryption where users maintain control of encryption keys.
Which of the following best describes the purpose of a certificate authority (CA) in public key infrastructure (PKI)?
-
A
Creating and signing digital certificates to verify the authenticity of public keys and the identity of certificate holders
✓ Correct
-
B
Preventing access to websites that do not have valid SSL/TLS certificates installed
-
C
Ensuring that all data transmitted over the internet is encrypted using AES-256
-
D
Generating encryption keys for all users in an organization automatically
Explanation
A Certificate Authority is a trusted entity that issues and digitally signs certificates, binding a public key to an identity. This allows other parties to verify that a public key belongs to a specific person or organization.
A security team identifies that users are frequently reusing passwords across multiple systems and applications. Which of the following controls would most effectively mitigate this risk?
-
A
Reducing the password length requirement to make passwords easier to remember
-
B
Implementing a password manager solution and requiring unique passwords for each system
✓ Correct
-
C
Requiring users to write down their passwords in a secure location for reference
-
D
Manually auditing user password choices on a monthly basis
Explanation
A password manager securely stores and generates unique passwords for different systems, eliminating password reuse and improving security. If one system is compromised, the attacker cannot use that password to access other accounts.
Which of the following attack vectors is most likely to be successful against users who have not received security awareness training?
-
A
Phishing emails designed to trick users into disclosing credentials or downloading malware
✓ Correct
-
B
Intercepting SSL/TLS traffic using a sophisticated network attack
-
C
Brute-forcing encrypted passwords using quantum computing
-
D
Exploiting a zero-day vulnerability in the operating system kernel
Explanation
Phishing is a social engineering attack that exploits human behavior rather than technical vulnerabilities. Users without security awareness training are more likely to click malicious links, open infected attachments, or provide sensitive information to attackers.
An organization implements application whitelisting on all endpoints. What is the primary security benefit of this control?
-
A
It ensures that only approved and trusted applications can execute on the system, reducing the risk of malware execution
✓ Correct
-
B
It eliminates the need for antivirus software on the protected systems
-
C
It allows users to install any application they need for their work without restrictions
-
D
It prevents all network-based attacks from reaching the endpoints
Explanation
Application whitelisting restricts execution to only pre-approved applications, significantly reducing the likelihood that malware or unauthorized software can run. This is a more restrictive approach than blacklisting and provides stronger protection.
Which of the following scenarios represents a violation of data confidentiality?
-
A
Authorized personnel accessing data for legitimate business purposes within their role
-
B
An unauthorized individual obtaining sensitive data through exploitation or social engineering
✓ Correct
-
C
A system administrator backing up data to a secure, encrypted offsite location
-
D
A user receiving a copy of public information from an organization's website
Explanation
A confidentiality violation occurs when unauthorized parties gain access to sensitive information they are not supposed to see. Authorized access for legitimate purposes, proper backups, and access to public information do not violate confidentiality.
A company suffers a successful SQL injection attack against its web application. Which of the following secure coding practices would have prevented this vulnerability?
-
A
Disabling error messages displayed to users on the web application
-
B
Installing a web application firewall to inspect all incoming HTTP requests
-
C
Using parameterized queries or prepared statements with input validation and output encoding
✓ Correct
-
D
Implementing SSL/TLS encryption for all network communications
Explanation
SQL injection is prevented through secure coding practices such as parameterized queries, prepared statements, and input validation, which ensure that user input cannot be interpreted as executable SQL code. While WAFs can help mitigate the risk, they are not a substitute for secure coding.
An organization's security policy requires that all sensitive data be classified and handled according to its classification level. Which of the following best describes the purpose of data classification?
-
A
To determine the appropriate level of protection and handling requirements based on the impact of unauthorized disclosure
✓ Correct
-
B
To automatically encrypt all data using the strongest available algorithms regardless of sensitivity level
-
C
To prevent users from accessing any classified information under any circumstances
-
D
To replace the need for other security controls such as access management and encryption
Explanation
Data classification assigns sensitivity levels to information based on the potential impact of unauthorized access or disclosure. This drives appropriate security controls, handling procedures, and access restrictions tailored to each classification level.
Which of the following best describes the purpose of a vulnerability assessment?
-
A
To ensure that all software is completely free of any possible security flaws before deployment
-
B
To actively exploit vulnerabilities to demonstrate impact to stakeholders and executives
-
C
To systematically identify, quantify, and prioritize vulnerabilities in systems and applications without exploitation
✓ Correct
-
D
To test only network-based vulnerabilities while ignoring application-level weaknesses
Explanation
A vulnerability assessment is a systematic process of identifying and documenting weaknesses without exploiting them. This differs from penetration testing, which actively exploits vulnerabilities. Assessments help prioritize remediation efforts based on risk.
An attacker sends a crafted network packet that causes a web server to crash, making it unavailable to legitimate users. What type of attack is this?
-
A
Distributed denial-of-service (DDoS) attack
-
B
Denial-of-service (DoS) attack
✓ Correct
-
C
Man-in-the-middle attack
-
D
Cross-site request forgery (CSRF) attack
Explanation
A denial-of-service attack crashes or overwhelms a system to make it unavailable to legitimate users. A DDoS attack uses multiple sources. CSRF and MITM are different attack types targeting different aspects of systems.
A security architect is designing a network for a high-security facility and wants to implement network segmentation. Which of the following approaches would be most effective?
-
A
Requiring all users to use VPN connections to access any network resource, eliminating the need for network segmentation
-
B
Implementing multiple VLANs and firewall rules to isolate critical systems and restrict inter-segment communication based on business requirements
✓ Correct
-
C
Using only wireless networking to reduce the complexity of managing wired network segments
-
D
Creating a single flat network where all devices communicate directly without any restrictions
Explanation
Network segmentation using VLANs and firewalls isolates different parts of the network and restricts traffic between segments based on business needs. This limits lateral movement if one segment is compromised and improves overall network security.
Which of the following is the most important consideration when implementing a disaster recovery (DR) plan?
-
A
Creating a DR plan once and never updating it unless a disaster occurs
-
B
Ensuring that the DR plan is documented and regularly tested to verify recovery time and recovery point objectives can be met
✓ Correct
-
C
Purchasing the most expensive backup hardware available regardless of actual business needs
-
D
Implementing only offsite backups while eliminating onsite backup systems to reduce costs
Explanation
An effective DR plan must be regularly tested and updated to ensure that recovery time objective (RTO) and recovery point objective (RPO) can be achieved. Testing identifies gaps and ensures that both technical and procedural aspects work as intended.
An organization implements a security information and incident management process. During an incident, the security team needs to preserve evidence for potential legal proceedings. Which of the following best describes the proper approach?
-
A
Deleting evidence after initial analysis is complete to protect user privacy
-
B
Sharing all evidence freely with anyone who requests it to ensure transparency
-
C
Modifying evidence to clarify what happened and improve clarity for legal representatives
-
D
Maintaining a chain of custody documenting all access to and handling of evidence to ensure its integrity and admissibility
✓ Correct
Explanation
Chain of custody is critical in incident response to ensure evidence is admissible in legal proceedings. It documents who accessed the evidence, when, why, and how it was handled to maintain integrity and prevent tampering allegations.
Which of the following describes the main difference between authentication and authorization?
-
A
Both terms describe the same security process and can be used interchangeably
-
B
Authentication verifies user identity, while authorization determines what authenticated users are allowed to do
✓ Correct
-
C
Authentication applies to users, while authorization only applies to systems and applications
-
D
Authorization is used to verify user identity, while authentication determines what users can access
Explanation
Authentication is the process of verifying that a user is who they claim to be (using credentials like passwords or biometrics), while authorization determines what resources and actions that authenticated user is permitted to access.
A security team discovers that an attacker has compromised a Certificate Authority's private key. What is the most critical risk resulting from this compromise?
-
A
All users will be unable to access any websites using SSL/TLS encryption
-
B
The attacker will be able to access the cleartext passwords of all users who authenticated using certificates issued by this CA
-
C
The attacker can issue fraudulent certificates that appear valid, allowing them to impersonate legitimate organizations in man-in-the-middle attacks
✓ Correct
-
D
All encrypted communications using TLS will be decrypted by the attacker
Explanation
A compromised CA private key allows an attacker to issue fraudulent but apparently valid certificates for any domain, enabling them to impersonate legitimate organizations, intercept encrypted communications, and perform sophisticated MITM attacks.
An organization needs to ensure compliance with regulations requiring that terminated employees cannot access company systems. Which of the following represents the most comprehensive control approach?
-
A
Implementing an automated offboarding process that immediately disables accounts, revokes credentials and tokens, and removes system access upon employee termination in the HR system
✓ Correct
-
B
Informing terminated employees verbally that they should no longer access systems and relying on their compliance
-
C
Only requiring terminated employees to change their passwords before leaving the office
-
D
Manually reviewing access lists weekly to identify terminated employees and removing their access
Explanation
An automated offboarding process ensures that access is promptly revoked across all systems and applications when termination occurs, reducing the window for unauthorized access. This is far more reliable than manual processes or informal notifications.
A web application uses client-side validation to check if a password meets complexity requirements before submission. Why is this approach insufficient as a security control?
-
A
Client-side validation is impossible to implement in modern web applications
-
B
Client-side validation requires JavaScript to be enabled, which reduces compatibility with older browsers
-
C
Client-side validation can be bypassed by attackers, so server-side validation must also be implemented to ensure security
✓ Correct
-
D
Client-side validation is too strict and prevents legitimate users from accessing the application
Explanation
Client-side validation can be easily bypassed using browser developer tools or by modifying requests directly. Server-side validation is essential as it runs on the trusted server and cannot be bypassed, making it a critical security control.
A security analyst discovers that an attacker has obtained valid credentials and is accessing resources during normal business hours without triggering alerts. Which type of attack does this represent?
-
A
Lateral movement using valid credentials
✓ Correct
-
B
Brute force attack
-
C
Living off the land
-
D
Credential stuffing
Explanation
This scenario describes an attacker using legitimate credentials to move through the network and access resources, which is characteristic of lateral movement. The attacker blends in with normal activity by using valid credentials during business hours.
Which of the following best describes the principle of least privilege?
-
A
Users should be granted only the minimum permissions necessary to perform their job functions
✓ Correct
-
B
Users should have administrative access to all systems they use
-
C
Privileges should be granted permanently once a user is hired
-
D
All users in a department should have identical access rights
Explanation
Least privilege is a fundamental security principle that limits user access to only what is necessary for their role, reducing the attack surface and potential damage from compromised accounts.
A company implements multi-factor authentication using something you know (password) and something you have (hardware token). An attacker compromises the user's password but cannot access the account. Why is this attack unsuccessful?
-
A
The hardware token provides an additional authentication factor that the attacker does not possess
✓ Correct
-
B
Multi-factor authentication prevents all forms of password attacks permanently
-
C
The password is encrypted with the token's serial number
-
D
The token automatically locks after three failed login attempts
Explanation
MFA requires multiple independent authentication factors. Even with a valid password, the attacker cannot gain access without the second factor (the physical hardware token), making unauthorized access impossible.
During a penetration test, a security professional uses a tool that captures unencrypted network traffic and extracts credentials. Which of the following would BEST prevent this type of attack?
-
A
Requiring users to change passwords every 30 days
-
B
Using encryption protocols such as TLS/SSL for all communications
✓ Correct
-
C
Increasing firewall rule complexity
-
D
Implementing network segmentation only
Explanation
Encryption protocols like TLS/SSL render captured network traffic unreadable to attackers, protecting credentials and sensitive data from packet sniffing attacks even if traffic is intercepted.
A security team notices that several user accounts have been created with generic names like 'Admin2' and 'Test_User' that were never requested by management. Which control should be implemented to prevent this?
-
A
Disabling all local account creation
-
B
Implementing a change management process with approval requirements and regular account reviews to detect and remove unauthorized or dormant accounts
✓ Correct
-
C
User account auditing and periodic review of active accounts
-
D
Requiring all accounts to contain the user's real name
Explanation
A comprehensive control includes both preventive measures (change management/approval) and detective measures (regular reviews). This combination prevents unauthorized account creation while identifying accounts that should not exist.
Which of the following best describes a zero-day vulnerability?
-
A
A network vulnerability that affects systems at midnight UTC
-
B
A previously unknown security flaw for which no patch has been released
✓ Correct
-
C
A vulnerability that was discovered and patched more than 90 days ago
-
D
A vulnerability that only affects systems with zero security updates installed
Explanation
A zero-day vulnerability is an unknown flaw that developers and vendors are unaware of, meaning no patch exists. Attackers may exploit it before vendors can release a fix.
A company's intrusion detection system (IDS) generates an alert about suspicious network traffic matching a known attack pattern. However, investigation reveals the alert was triggered by legitimate business traffic that mimics the attack signature. What is this called?
-
A
A false negative
-
B
A false positive
✓ Correct
-
C
A signature bypass
-
D
A true positive
Explanation
A false positive occurs when a security tool incorrectly identifies legitimate activity as malicious. In this case, the IDS alert was triggered by normal business traffic that matched a malicious signature pattern.
An organization is implementing a data loss prevention (DLP) system to monitor and control sensitive information. Which of the following scenarios would BEST benefit from DLP implementation?
-
A
Detecting and blocking attempts to exfiltrate customer data or intellectual property through email or unauthorized channels
✓ Correct
-
B
Limiting the number of USB ports available on company computers
-
C
Preventing users from accessing websites during work hours
-
D
Monitoring the physical location of employees in the office
Explanation
DLP systems are designed specifically to identify, monitor, and prevent the unauthorized transmission of sensitive data through various channels, protecting intellectual property and customer information from exfiltration.
A security administrator configures a web application firewall (WAF) to block requests containing SQL injection patterns. A developer reports that legitimate API requests from a third-party vendor are being blocked. What is the MOST appropriate next step?
-
A
Disable the WAF entirely to resolve the issue
-
B
Ask the vendor to stop using their API and integrate differently
-
C
Create a whitelist exception for the vendor's IP address and requests, then monitor for any actual attacks through this exception
✓ Correct
-
D
Remove all SQL injection pattern rules from the WAF
Explanation
Whitelisting allows legitimate traffic from known sources while maintaining protection against attacks. This balanced approach preserves security while enabling necessary business operations and includes monitoring to detect any abuse.
A company's security policy requires that all sensitive data be classified and handled according to its classification level. Which of the following is a PRIMARY benefit of data classification?
-
A
It automatically removes sensitive data from company systems after 30 days
-
B
It enables appropriate security controls and handling procedures to be applied based on the data's sensitivity and value
✓ Correct
-
C
It ensures all employees have the same access to all company data
-
D
It eliminates the need for encryption by hiding classified data from users
Explanation
Data classification allows organizations to apply proportionate security controls—highly sensitive data receives stronger protections while less sensitive data requires fewer restrictions, optimizing both security and usability.