Information Security Quizes

A 'Procedure' in the IT security policy framework is best described as:

A detailed, step-by-step instruction for a specific task.

A specific, mandatory technical requirement.

A recommended best practice for a technical control.

A high-level statement from senior management.

A detailed, step-by-step instruction for a specific task.

Procedures are the most granular level of the policy framework, providing explicit 'how-to' instructions for a specific task.

Your company is experiencing a Distributed Denial of Service (DDoS) attack! Your website is overwhelmed with a flood of traffic, causing it to crash and become unavailable to the public. Which principle of the CIA Triad does this attack most directly compromise?

Availability

Confidentiality

Integrity

Accountability

Availability

The DDoS attack made your website inaccessible, directly compromising the principle of availability, which ensures that systems are available to authorized users when they're needed.

A natural disaster, like a hurricane, can be considered a 'threat' in the context of information security. true or false

true

A company decides to implement a new policy that requires all employees to use a VPN when working from home. Which of the following is the most appropriate IT security 'standard' to support this policy?

A mandatory requirement that all VPN software must use AES-256 encryption.

A list of all employees and their approved VPN access levels.

A step-by-step guide on how to install and connect to the VPN software.

A recommendation to use a strong password with the VPN.

A mandatory requirement that all VPN software must use AES-256 encryption.

The policy sets the goal ("use a VPN"). The standard provides a specific, mandatory, technical detail for how that goal must be met ("must use AES-256").

An undiscovered software flaw is considered a 'risk' on its own. true or false

false

If a system's integrity is compromised, it always means a hacker has stolen data. true or false

false

You're tasked with backing up your company's financial database to a remote server. You verify that the backup data matches the original data exactly using a hash function (a special algorithm used in cryptography). This action is a direct measure to ensure which principle of the CIA Triad?

Integrity

Confidentiality

Availability

Non-repudiation

Integrity

The use of a hash function in cryptography is a direct method of verifying that data has not been altered. By comparing the hash of the original data with the hash of the backup, you're ensuring the data's integrity.

A company's security must be a defense-in-depthstrategy, with layers of protection across all domains.

true or false

true

A new software patch has been released for a security flaw in a popular web browser that your company uses. Your company, however, asks you not to deploy the patch immediately. Which two security terms best describe the unpatched flaw and the potential for a hacker to exploit it?

Vulnerability and Threat

Risk and Threat

Threat and Attack

Exposure and Risk

Vulnerability and Threat

The unpatched flaw is a vulnerability (a weakness in the system), and the potential for a hacker to exploit that flaw is the threat (a potential danger or negative action).

You experience a data breach where sensitive customer information is leaked from your company's database to the public internet. This incident is a direct compromise of which security principle in the CIA Triad?

Confidentiality

Integrity

Availability

Accountability

Confidentiality

A data breach, by definition, is the disclosure of information to unauthorized users. Confidentiality is the principle that prevents this from happening.

You discover a critical zero-day vulnerability in your company's proprietary software. A person contacts you, claiming to have found the same flaw, and offers to provide details on how to fix it in exchange for a "bug bounty." They also warn that if you don't pay, they might "have to go public with the information."Based on the provided definitions, what type of hacker best fits this individual's behavior?

A script kiddie

A black-hat hacker

A gray-hat hacker

A white-hat hacker

A gray-hat hacker

This is a classic "gray-hat" scenario, where the individual finds a vulnerability without authorization and is not immediately malicious (they aren't exploiting it to steal data). However, they are not a "white-hat" because their actions are not authorized, and they are using the threat of public disclosure as leverage to demand a reward.

Your company has a server room with an asset value (AV) of $250,000, which includes the hardware, software, and critical data. You estimate that in the event of a fire, 80% of the asset's value would be lost. Based on historical data, a fire of this magnitude is expected to occur once every 50 years. What is the Annualized Loss Expectancy (ALE) for this risk?

$4,000

$200,000

$50,000

$250,000

$4,000

A new polymorphic malware variant has been detected, capable of rapidly changing its code to evade traditional signature-based detection. Your organization relies on a layered security defense model. As a security analyst, what is the primary reason why this layered approach is more effective against this specific threat than relying on a single, powerful antivirus solution?

Layered security makes it easier to track the malware's polymorphic changes because each layer provides a new signature for the antivirus to detect.

Polymorphic malware is only a threat to organizations without a layered security model, making this a hypothetical concern for your company.

A layered approach ensures that if the malware bypasses the antivirus (a single layer), other controls like an intrusion prevention system (IPS) or network firewalls (other layers) might still detect and block it.

A defense-in-depth model reduces the single point of failure by replacing the antivirus software with multiple, more specialized security tools.

A layered approach ensures that if the malware bypasses the antivirus (a single layer), other controls like an intrusion prevention system (IPS) or network firewalls (other layers) might still detect and block it.

A single antivirus solution relies on known signatures, which the polymorphic malware is designed to evade. By having multiple, different security controls (layers) in place, you increase the chances that even if one layer fails, another will catch the threat.

As a cybersecurity professional, you are presenting to your company's board about the risk of a major ransomware attack. Your qualitative risk assessment places this risk in the upper-right quadrant of the risk matrix. What does this placement primarily signify, and what is the recommended immediate response?

The risk is an opportunity that should be exploited for business gain.

The risk has both high probability and high impact, and it should be the immediate focus for risk management efforts to reduce it.

The risk is minor and should be accepted, as the cost of countermeasures would be too high.

The risk has a low probability and high impact, and you should consider transferring it through insurance.

The risk has both high probability and high impact, and it should be the immediate focus for risk management efforts to reduce it.

Applying countermeasures to reduce the probability or impact of any risks appearing in the upper-right quadrant should be the primary focus of initial risk response efforts.

A qualitative risk assessment is considered more objective than a quantitative risk assessment because it relies on the consensus of a diverse group of experts from various departments, reducing the influence of any single person's bias. true or false

false

A quantitative risk assessment will be more objective, because it attempts to describe risk in terms of dollar values. Conversely, qualitative risk assessments are usually very subjective and rely on ratings or other relative measurements from subject matter experts.

A "whaling" attack is a form of social engineering that specifically targets high-value individuals, such as executives or senior managers, by using highly personalized and convincing deceptive tactics.

true or false

true

Whaling is defined in the book as "Targeting the executive user or most valuable employees, otherwise considered the 'whale' or 'big fish' (often called spear phishing)."

You are asked to perform a risk assessment for a new software development project. Your team has identified a potential software bug that could be exploited by a malicious actor to gain unauthorized access to customer data. In the context of the provided text, which of the following best describes the identified bug and the malicious actor, respectively?

The bug is a threat, and the malicious actor is a vulnerability.

The bug is an event, and the malicious actor is an incident.

The bug is a countermeasure, and the malicious actor is an event.

The bug is a vulnerability, and the malicious actor is a threat.

The bug is a vulnerability, and the malicious actor is a threat.

The malicious actor represents the source of the potential harm, making them the threat, while the software bug is the vulnerability they can exploit.

A major hotel company is experiencing an outage of its reservation servers due to a denial-of-service (DoS) attack. The IT team is working to restore services, but for every minute the system is down, the company is losing thousands of dollars in unbooked rooms. This financial loss is best described as:

Single loss expectancy (SLE)

Annualized loss expectancy (ALE)

Opportunity cost

Residual risk

Opportunity cost

Opportunity cost (or "true downtime cost") is money lost during intentional or unintentional downtime (i.e., a direct measure of the lost opportunity for revenue).

Which of the following best describes the core difference between a phishing and a pharming attack?

Phishing uses a deceptive email or message to trick the user, while pharming "poisons" a DNS server to redirect the user without their knowledge.

Phishing attempts to steal credit card numbers, while pharming attempts to steal login credentials.

Phishing uses a spoofed website URL, while pharming relies on an authentic, non-spoofed URL.

Phishing targets large groups of people at once, while pharming targets specific individuals.

Phishing uses a deceptive email or message to trick the user, while pharming "poisons" a DNS server to redirect the user without their knowledge.

Phishing is a scam where an attacker attempts to trick the victim, via email or instant message, into providing private information. Pharming, on the other hand, poisons a domain name so that when a user enters the correct URL, they are automatically sent to the attacker's site instead.

A "brute-force password attack" and a "dictionary password attack" are both considered active attacks, even though they do not require any direct interaction with a live user and only involve trying combinations against a static password file. true or false

true

Both brute-force and dictionary attacks are active attacks because they involve a direct attempt to gain unauthorized access by "hammering away" at the code or attempting to log on by entering each dictionary entry. A passive attack, in contrast, involves simply eavesdropping or monitoring data without making changes to the system.

You've discovered a new, unauthorized wireless access point connected to the internal network. This rogue access point allows wireless devices to bypass the network perimeter defenses and directly access the internal network.

What is the most significant security risk posed by this discovery?

It indicates that the company's network infrastructure defenses are completely useless.

The rogue access point is a sign of an indirect attack.

The rogue access point provides a new and easy entry point for an attacker to conduct a direct attack.

It is likely that the wireless access point is infected with a virus.

The rogue access point provides a new and easy entry point for an attacker to conduct a direct attack.

Employees attaching unauthorized (rogue) access points not only compromise existing perimeter defenses, they can provide an easy entry point for direct, real-time malware attacks.

You are working on a security policy for your company's public-facing servers. You want to use a honeypot as part of your defense strategy. Which of the following is a key characteristic that a honeypot must have to be effective?

It must be identical to the company's production network.

It must not be placed in a DMZ.

It must have a dedicated firewall that prevents all outbound traffic in case it is compromised.

It must have a silent alarm that alerts the attacker when they are detected.

It must have a dedicated firewall that prevents all outbound traffic in case it is compromised.

This is a critical safety measure to prevent an attacker from using the compromised honeypot to attack other systems.

Your security team wants to study a new, highly sophisticated hacking group to understand its attack methods. To do this, they set up a dedicated environment that includes several servers and a virtual router, all intentionally configured with known vulnerabilities. The environment is completely isolatedfrom the company's production network.

What is the name for this type of decoy environment, and what is its primary purpose?

A low-involvement honeypot, to provide a safe, limited decoy.

A DMZ, to separate internal servers from external-facing servers.

A bastion host, to protect the network from direct attacks.

A honeynet, to simulate a real network.

A honeynet, to simulate a real network.

A honeynet is a suite of servers separated from the real network intended to easily detect and analyze an attack to test the strength of the network. Honeynets are beneficial because they provide more data and are more attractive to attackers.

During a security briefing, your manager expresses concern about a file-infecting virus that spreads by attaching itself to common programs. They suggest that the company's reliance on file sharing and email is making them vulnerable to this specific threat.

Based on the historical context provided by the textbook, how would you respond to your manager's concern?

You would acknowledge the concern but explain that file-infecting viruses are not the primary threat today; network-based threats are much more common due to the Internet.

You would agree, as file-infecting viruses like Jerusalem are the most dangerous threats.

You would state that all viruses today use multiple infection vectors, so the focus should not be on file sharing alone.

You would explain that this type of threat only exists on older systems and is not a concern for modern networks.

You would acknowledge the concern but explain that file-infecting viruses are not the primary threat today; network-based threats are much more common due to the Internet.

As LANs and the internet became more widespread (increasing the attack surface), more traditional boot sector and file-infecting viruses began to diminish (although their frequency is not entirely zero). Now, network-based, email, and web-based exploits have filled the vacuum those viruses left behind.

You are part of an incident response team investigating a breach. The security logs show that an attacker first performed a series of DNS lookups and ping sweeps, followed by a detailed port scan of your company's servers.

Based on the phases of an attack, what do you think is the primary objective of the attacker's actions at this point in the attack?

To execute the final stage of the attack and cover their tracks.

To maintain a persistent connection to the network.

To gain administrative access to your systems.

To collect information necessary to identify potential vulnerabilities for a future exploit.

To collect information necessary to identify potential vulnerabilities for a future exploit.

DNS lookups, ping sweeps and port scanners all belong to the "Reconnaissance and Probing" phase, during which an attacker collects as much information as possible while trying to find a possible point of entry.

A new employee in your department is frustrated and wants to know why the company has a strict policy regarding the use of personal USB drives and the installation of unauthorized software. Which of the following is the best rationale to give this employee for these policies?

To comply with legal requirements and avoid lawsuits.

To ensure a standardized and controlled software environment that allows for efficient patching and vulnerability management.

To stop attackers from stealing company data.

To simplify the network infrastructure.

To ensure a standardized and controlled software environment that allows for efficient patching and vulnerability management.

While other answers may also be applicable depending on context, this is the key rationale provided for controlling software installations in all instances.

A business unit leader is concerned about their employees accidentally downloading malware from infected websites. They suggest that the best solution is to simply block access to all social media sites to prevent threats. Knowing what you know about the types of threats to a business and where they originate from, how would you refine your security approach?

You would agree and implement the control, as social media is the number one source of malware.

You would disagree and explain that external threats are rare, so the focus should be on internal threats.

You would explain that malware can't be introduced via a website, only through email attachments.

You would explain that while blocking some sites is a good idea, threats can also originate from trusted sources and even from within the company, so a comprehensive strategy is needed.

You would explain that while blocking some sites is a good idea, threats can also originate from trusted sources and even from within the company, so a comprehensive strategy is needed.

You should acknowledge the manager's idea as a valid part of a solution, but also present a broader, more comprehensive (defense-in-depth) strategy that addresses the full range of external threats (like a website attack) and internal threats (like an employee introducing malware via a USB drive), as well as attack vectors (attackers can easily use 'trusted' sources, like a third-party's compromised system).

You're investigating a recent series of attacks that have compromised multiple different organizations. The attacks all seem to be linked to a new piece of malware capable of infecting web servers, spreading to other computers on the local network, and also sending copies of itself via email to a victim's contacts.

Based on the history of malware, what is the best historical comparison for this malware's behavior?

The Morris Worm, which proved that network-based worms could overwhelm a large number of systems.

The "Brain" boot sector virus, which demonstrated malware's ability to infect physical media.

The Melissa email worm, which showed how social engineering and email could be used for rapid propagation.

The W32/Nimda worm, which was the first to use multiple propagation vectors (email, network shares, web servers) to spread.

The W32/Nimda worm, which was the first to use multiple propagation vectors (email, network shares, web servers) to spread.

The W32/Nimda worm was the "first to propagate itself via several methods," including email, network shares, and infected websites, meaning this multi-vector approach is probably the most direct historical comparison to the malware in the scenario.

Your security team is considering implementing a new policy to combat the threat of zero-day malware. Some team members argue for a whitelisting policy, while others prefer a blacklisting approach.

What is the most significant advantage of a whitelisting policy over a blacklisting policy for preventing zero-day attacks?

Whitelisting is more effective at blocking messages from known dangerous sites.

Whitelisting is less restrictive and easier to maintain.

Blacklisting is more secure because it has a more comprehensive list of malicious sites.

Whitelisting prevents unknown threats from executing by default, whereas blacklisting can only block threats that are already known.

Whitelisting prevents unknown threats from executing by default, whereas blacklisting can only block threats that are already known.

Zero-day attacks are a threat because they are not yet in signature databases. Whitelisting is a way to combat this category of malware because only traffic from trusted sites are allowed, while everything else is ignored. This makes it highly effective against unknown threats that blacklisting would miss.

You are reviewing logs from your company's network perimeter firewall. You notice a series of scans from an unknown IP address that is attempting to communicate with an unusual port that is normally not active. Your company's intrusion detection system (IDS) did not generate an alert.

What do you think is the most likely reason the IDS failed to alert on this activity?

 The IDS is a only meant to monitor the network and does not have the ability to generate alerts.

The IDS is an anomaly-based system and did not recognize the activity as an threat.

The IDS is a signature-based system, and the scan originated from a new and unknown tool that is not in the signature database.

The IDS has a corrupted signature database.

The IDS is a signature-based system, and the scan originated from a new and unknown tool that is not in the signature database.

The textbook discusses how signature-based systems can only detect 'known exploits.' An attacker using a new or custom-developed tool might bypass the signature database, especially if they are trying to discover vulnerabilities that are not commonly exploited.

A cryptanalyst has intercepted a large amount of encrypted data and also has access to several known plaintext-ciphertext pairs from the same communication channel. This allows the analyst to directly compare the unencrypted messages with their encrypted counterparts, which is known as performing a known-plaintext attack (KPA).

true or false

true

The presence of known plaintext and its corresponding ciphertext in a known-plaintext attack (KPA) is a fundamental advantage for an attacker, so the ability to compare both sides of the encryption process is a powerful tool for a cryptanalyst to find patterns and weaknesses.

A financial analyst needs to send a sensitive report to a colleague. The analyst wants to ensure that no one can read the report if it is intercepted, and the colleague wants to be certain that the report has not been changed since it was sent. What combination of cryptographic principles are used to achieve both of these goals?

Authentication and Nonrepudiation

Confidentiality and Nonrepudiation

Confidentiality and Integrity

Integrity and Authentication

Confidentiality and Integrity

Confidentiality ensures the message remains secret from unauthorized eyes, and integrity ensures that the message hasn't been altered during transmission.

The German Enigma cipher machine was famous for having a massive number of possible key configurations, making a brute-force attack computationally infeasible. Despite this, the Allies were able to break the Enigma cipher during World War II. What was the primary reason for this success?

The Germans were reusing the same key-encrypting key for every message, which made it easy to compromise.

The Enigma's mathematical algorithm had a fundamental flaw that the Allies discovered.

The German key management protocol had a weakness that allowed cryptanalysts to exploit patterns in the message keying.

A German spy revealed the daily key to the Allies, bypassing the cryptographic system entirely.

The German key management protocol had a weakness that allowed cryptanalysts to exploit patterns in the message keying.

The solution involved identifying a weakness in the cipher and keying protocol, which required that only the key in the codebook be used as a key-encrypting key. This created a pattern of a repeated message key at the beginning of each transmission.

A contract is sent from a client to a lawyer. The client digitally signs the contract before sending it. The lawyer receives the contract and verifies the digital signature. Which of the following statements accurately describes the security benefits the lawyer gains from verifying the digital signature?

The lawyer is assured of the sender's identity and that the contract's contents have not been altered.

The lawyer is assured that the contract has been encrypted and is safe from a brute-force attack.

The lawyer is assured that the contract is confidential and that only they can read its contents.

The lawyer is assured that the contract's sender cannot deny having sent it and that it is unreadable to anyone else.

The lawyer is assured of the sender's identity and that the contract's contents have not been altered.

A digital signature is a hash encrypted with the sender's private key. The ability to successfully decrypt this hash using the sender's public key proves that the sender's private key was used to create it, thus verifying their identity (authentication). The matching hash values ensure that the document's content is exactly as the sender intended, confirming its integrity.

A small Indie game developer publishes a game update on its website and includes a hash value (a unique, fixed-size string of characters). A user downloads the update file and calculates its hash on their own computer. The calculated hash does not match the one provided by the developer, so the user can be confident that the downloaded file is the one the company intended to provide.

true or false

false

A cryptographic hash function is designed to produce a unique, fixed-size output for a given input. Any change to the input, no matter how small, will result in a completely different hash. As such, the user cannot be certain that the file they downloaded is the exact, unaltered file the company intended to put on its server.

A hospital's IT department is implementing a new system to store patient medical records. To comply with HIPAA, they want to ensure that unauthorized employees cannot view the records. They also want to prevent any employee from compiling seemingly harmless data (like dates of visits, diagnoses, and postal codes) to identify specific patients. Which two cryptography principles are the IT department trying to enforce?

Confidentiality and Privacy

Integrity and Nonrepudiation

Authentication and Authorization

Confidentiality and Anonymity

Confidentiality and Privacy

An researcher at your university needs to securely send a very large sensitive file to a fairly large number of users and is considering which type of encryption cipher to use. They're aware that symmetric (private) encryption is faster but requires sharing a secret key first, while asymmetric (public) encryption is slower but solves the key sharing problem. Which of the following describes the BEST (i.e., most common and efficient) method to address this scenario?

Ignore the lack of speed and encrypt the file using a public key cipher, because it's the most secure method for transmitting data.

Use an asymmetric cipher to exchange a temporary symmetric "session key," and then use that session key to encrypt the very large file.

Use a symmetric key for the entire communication session, relying on an out-of-band exchange to share the key initially.

Rely on a one-way hashing function to protect the file, as it doesn't require a key and ensures integrity.

Use an asymmetric cipher to exchange a temporary symmetric "session key," and then use that session key to encrypt the very large file.

This is the fundamental process behind protocols like TLS/SSL and tries to leverage the best of both worlds; the slow but secure asymmetric method is used for the initial, brief key exchange, then the much faster symmetric algorithm can be used to encrypt the large data transfer.

Your company is developing a highly secure system for transmitting sensitive government communications. To ensure the highest level of confidentiality, they are considering using a one-time pad because it is theoretically unbreakable, as long as the key is 1) generated from a truly random source, 2) is as long as the message, and 3) is used for only one message.

true or false

true

A one-time pad (true to its name) has those three requirements for being unbreakable because, when those conditions are met, there is no pattern for an attacker to analyze, making it a (theoretically) "perfect" cipher.

A software company has developed a new cryptographic algorithm that boasts a very large keyspace, claiming it's computationally secure because of the sheer number of possible keys. However, an independent security audit reveals a flaw in the algorithm's design that allows an attacker to break the key one part at a time, proving that a large keyspace alone does not guarantee a cipher is computationally secure.

true or false

true

A large keyspace does not inherently guarantee security; the design of the algorithm itself is also crucial. If an algorithm's design allows it to be broken down into smaller, independent sub-problems, the total time to crack it can be drastically reduced, regardless of the overall keyspace size.

A large, multi-national company wants to implement a secure communication system for its 10,000 employees, where any employee must be able to securely communicate with any other employee. The IT security team is debating between a symmetric (private) key system and an asymmetric (public) key system. Given the need for scalability and efficiency in key management, which system below is the most practical choice, and why?

A symmetric key system, because it is much faster and more efficient for encrypting large volumes of data.

A symmetric key system, because the single key can be issued to all employees, simplifying distribution.

A combination of both systems, where the symmetric (private) system is used for key distribution and the asymmetric (public) system is used for secure communication.

An asymmetric key system, because it requires each employee to manage only two keys—a public and a private key.

An asymmetric key system, because it requires each employee to manage only two keys—a public and a private key.

This is the primary reason asymmetric key cryptography was invented. Instead of needing 49,995,000 unique keys (as calculated in the text for 10,000 employees with a symmetric system), each employee needs only one key pair. Their public key can be shared widely and their private key is kept secret, making the system highly scalable and manageable.

A hardware manufacturer is developing a new type of fiber-optic cable for better signal clarity. According to the OSI Reference Model, they must ensure the cable is compatible with both IP addressing standards (Layer 3) and a reliable (TCP-based) transmission protocol (Layer 4) to be successful in the marketplace.

true or false

false

The manufacturer is working at the Physical Layer (Layer 1), dealing with the physical medium (fiber-optic cable) and signal conversion. According to the OSI model's principle of separation, this manufacturer only needs to ensure the cable meets the requirements of the layer directly above it, the Data Link Layer (Layer 2) (i.e., acceptable signal standards for Ethernet).

You are designing an application that requires highly sensitive data (i.e., payment information) to be securely transmitted across a public network. To ensure confidentiality and proper data formatting for the recipient, which two adjacent OSI layers are most critical for implementing encryption and managing the secure presentation of this data?

Session Layer (L5) and Transport Layer (L4)

Network Layer (L3) and Data Link Layer (L2)

Presentation Layer (L6) and Session Layer (L5)

Application Layer (L7) and Presentation Layer (L6)

Presentation Layer (L6) and Session Layer (L5)

While the Presentation Layer (L6) is explicitly responsible for data coding, formatting, and (from a security perspective) encryption, the Session Layer (L5) manages the connection's lifetime and is not a primary layer for data formatting and confidentiality.

You're configuring a new border firewall and need to implement the most secure rule management practice for your organization's web server: it needs to allow only inbound HTTPS traffic (Port 443).

Which configuration best demonstrates the principle of implicit deny for this scenario?

Add a rule to allow only HTTPS traffic on Port 443 to the web server, with the last rule in the sequence being to Deny Any/Any.

Create a rule that allows all traffic on Port 443, and then add a rule that denies all traffic on Port 80.

Use a stateful inspection firewall, as it automatically handles all secure denial requirements.

Add a rule to allow all inbound traffic, and then add specific rules to deny known malicious IPs.

Add a rule to allow only HTTPS traffic on Port 443 to the web server, with the last rule in the sequence being to Deny Any/Any.

Implicit Deny means that everything not explicitly allowed is blocked. By placing a specific "Allow" rule for the needed traffic (HTTPS 443) and making the final, default rule Deny Any/Any, you ensure that any other unmentioned traffic (including all other ports and protocols) is automatically rejected, minimizing the attack surface.

You're a systems administrator setting up a new server and need to configure remote administration access. You're debating between using Telnet (Port 23) and Secure Shell (SSH, Port 22).

From a security perspective, why should you choose SSH over Telnet for this purpose?

SSH supports a wider range of network ports, making it easier to confuse potential attackers.

SSH is a faster protocol because it uses UDP, whereas Telnet uses the slower TCP.

SSH operates at the Network Layer (L3) to hide the server's IP address, while Telnet does not.

SSH provides built-in encryption for the communication session, while Telnet transmits credentials and data in plain text.

SSH provides built-in encryption for the communication session, while Telnet transmits credentials and data in plain text.

The core security difference between SSH and Telnet is confidentiality (encryption). SSH encrypts all data, including login credentials, making it safe for remote administration over untrusted networks. Telnet sends everything in plain text, making it highly vulnerable to eavesdropping.

A security audit discovers that your organization's wireless network is using Wired Equivalent Privacy (WEP). The primary risk associated with continued use of WEP is the immediate threat of:

MAC address filtering becoming impossible to maintain on the network.

Eavesdropping, leading to the compromise of data Confidentiality, due to the protocol's known, easily broken encryption.

IP address exhaustion, as WEP uses the outdated IPv4 addressing standard.

A Smurf attack (DoS) being amplified by the WAP.

Eavesdropping, leading to the compromise of data Confidentiality, due to the protocol's known, easily broken encryption.

The central weakness of WEP is its reliance on weak, easily cracked encryption (RC4). The immediate consequence of this vulnerability is that any attacker in range can quickly decrypt and read all network traffic (eavesdropping), resulting in a loss of Confidentiality.

You notice unusually high network traffic attempting to establish numerous simultaneous connections to an internal database server, potentially indicating a Distributed Denial-of-Service (DDoS) attack. You decide to implement a rule on the perimeter firewall tolimit the number of new connection attempts per second destined for the database's service port.

Which layer of the OSI model are you primarily applying this defense mechanism?

Layer 2: Data Link

Layer 7: Application

Layer 3: Network

Layer 4: Transport

Layer 4: Transport

The firewall rule is based on the service port (TCP port 1433) and connection attempts/flow control. Service ports and the management of data flow/connections are core functions of the Transport Layer (Layer 4), so limiting connection attempts (rate limiting) is a form of flow control and protection typically enforced at this layer (or just above it).

Your security team discovers that an internal threat actor has been passively listening to network traffic by connecting a device to an unmanaged network tap in the server room. The primary defense implemented to immediately mitigate the risk of data compromise from this incident is to enforce end-to-end encryption for all internal file transfers.

Which security goal from the CIA triad does this specific defense best protect, and which network riskdoes it primarily address?

Confidentiality, addressing Eavesdropping

Integrity, addressing Denial of Service

Integrity, addressing Reconnaissance

Availability, addressing Denial of Service

Confidentiality, addressing Eavesdropping

Eavesdropping is the act of passively listening to network traffic, which directly violates Confidentiality (the secrecy of data). Implementing encryption scrambles the data, rendering it unreadable to the eavesdropper and restoring confidentiality.

You are designing a highly secure network for a hospital. You need to ensure that the patient records system cannot communicate with the guest Wi-Fi network, even though both physical network cables connect to the same core switch. Additionally, you want to minimize broadcast traffic on the sensitive patient records segment.

Which network device feature would be the most efficient and cost-effective in meeting both the traffic separation and security goals?

Virtual Local Area Network (VLAN)

Network Address Translation (NAT)

Border Router

Physical Layer (L1) separation using separate wiring closets

Virtual Local Area Network (VLAN)

A VLAN allows an administrator to logically segment (partition) the network, separating the patient records and guest Wi-Fi into two distinct broadcast domains. This separation is configured on the switch and meets the goal of separation without requiring new physical cabling, as well as minimizing broadcast traffic.

The Transmission Control Protocol (TCP) is always preferred over the User Datagram Protocol (UDP) by security professionals because TCP's flow control and error checking at the Transport Layer (L4) make it a more reliable and thus inherently more secure choice for all data transmission.

true or false

false

While TCP is more reliable (guaranteed delivery, order, and error checking), that does not make it inherently more secure than UDP. Neither TCP nor UDP provides native encryption, so security must be provided by a separate protocol like SSL/TLS, regardless of whether TCP or UDP is used.

You find out that a user in your organization is accessing a critical online service over the public Internet using an unencrypted connection (no VPN or HTTPS). This means an attacker performing a "man-in-the-middle" attack on the network path could potentially view the user's session data.

Which network security concept does this scenario best illustrate?

The need for Network Address Translation (NAT) to hide internal addresses

The spread of malware due to lack of protection between hosts on a LAN

The open "postcard" nature of data transmission on a WAN

The vulnerability of Layer 3 IP addressing to spoofing

The open "postcard" nature of data transmission on a WAN

The reading of unencrypted data by an attacker during transit is the classic risk of using an open network like the Internet (WAN). This is similar to a postcard where the message is visible to anyone handling it. The core defense here is encryption, which addresses the open nature of the WAN.

Scenario:

A student downloads a file called: Biology_Textbook_Free.pdf.exe from an online Google Drive. When opened, a pop-up asks for their Gmail username and password; the student logs in with their Scarletmail. An hour later, the student's email account starts automatically sending phishing emails to their entire contact list, including students and professors.

Action:

How could you respond to stop the malware from spreading further across campus? Is changing the password enough if a hacker already logged in? How can you tell if a file is a real document or a hidden program?

One way to stop the malware from spreading further across campus is to disconnect from the Wi-Fi or network you are connected to. You can also try resetting your passcode, and if you can't, try doing it on a different device. I don't think changing the password is enough. If possible, you can try signing out of all devices and enabling MFA. One way you could tell if the file is real is looking at extension, for example, in this case it ended in .exe which should have been a red flag. 

Scenario:

Current IAM architecture isn’t built to handle tools like agentic AI, which acts autonomously and on “inferred intent”, not static instructions. Imagine an AI agent (Agent A) decides it needs more processing power, so it creates a sub-agent (Agent B) and gives it credentials to spin up new cloud servers. The cloud servers are then used for a DDoS attack.

Action:

Who is legally and technically "attributed" to the attack? The employee who started Agent A? The company the employee works for? The developer or company who wrote Agent A’s code? The cloud provider? Defend your choice.

I would place primary responsibility on the company if it controlled Agent A’s deployment, because it was responsible for limiting permissions and overseeing credential sharing. Technically, investigators would need cloud and agent logs to trace the attack through Agent B and Agent A to the employee or company account involved. However, tracing an account does not automatically prove legal liability. The employee, developer, or cloud provider could share liability depending on their conduct and applicable law, but simply starting, building, or hosting the agent does not establish criminal responsibility.

Scenario:

The E-Sports Club just moved into a new student lounge and installed a high-end Smart TV and a gaming console to host tournaments. To prepare for a tournament tonight, they’ve installed a high-end Smart TV and a Gaming Console. They plugged both into the Ethernet wall jacks labeled "Admin Use Only." Within minutes, your network monitor flags the Smart TV because it is performing an unauthorized scan of the local network.

Action:

Describe what technical and administrative controls you would use to mitigate the risk of this and other "Shadow IoT" devices, while deciding how to support the club's needs (i.e., disabling the wall jacks might be helpful, but doesn’t solve the entire issue). Explain your choice.

From an administrative standpoint, the club should have reached out to their IT department to register and approve their devices to connect to the network so they don’t run into an issue like this again. Another policy they can implement is not allowing students to connect to random ethernet connections. From a technical standpoint, the network should've had network access controls that automatically blocks unauthorized devices from connecting to the network. Having a label saying admin use only isn’t an effective way for stopping people from connecting to that network. For them to continue with the tournament that night, they can ask the IT team to create a VLAN specifically for their club. This would allow them to have internet access while being blocked or disconnected from accessing the administrative network.

Scenario:

You’re conducting a scheduled, authorized vulnerability scan on the Financial Aid Office’s subnet. Your vulnerability management tool identifies a "Critical" Zero-Day vulnerability on their main application server. A patch is available, but the software vendor warns that the patch is "unstable" and could crash a misconfigured server. It’s currently 2:00 PM on a Tuesday, a time when the office’s services are in high demand for students, and one of your team members called out sick.

Action:

Weighing the risk of a “Critical” breach against the risk of a temporary server crash, do you apply the patch immediately, plan an overnight deployment during off-hours, or test the patch in a sandbox then deploy? Explain your answer.

I think the best option for this scenario would most likely be to test the patch in a sandbox environment then deploy. Planning an overnight deployment during off hours would be a poor choice because the vulnerability is showing as critical. Unless temporary protections were used to reduce the risk then waiting for off hours wouldn't be the best idea. Also, applying the patch immediately may work, but you are risking your system to crash during its peak hours and you are already down a team member. The best choice would be to test it in an isolated environment that's similar to the actual server you'd be working on. If testing is successful in the sandbox then I would deploy the patch.