full book

What controls are being adopted by the company for access management?

Preventive and Physical

What type of control is the investigation of log files by the IT administrator after an attack?

Detective control

What describes the task of creating a standard operating procedure by administrators?

Operational control

Which control focuses on minimizing threats before they occur?

Preventive control

What type of control is applied by the cybersecurity team when they immediately update systems after a critical patch is released?

Corrective control

After a ransomware attack, what control should be implemented to prevent future occurrences?

Preventive control

What physical control would deter someone from entering a quarry?

Bollards and Barrier signs

What type of control describes the action of including additional instructions in compliance policies?

Directive control

What control is used by a cybersecurity administrator employing homomorphic encryption?

Technical control

Which control category is tasked with establishing protocols to enhance organizational oversight?

Managerial control

What is the best resource for an IT administrator investigating attack methods?

MITRE ATT&CK

What system can track user access when using 802.1x authentication?

RADIUS

What can provide non-repudiation in transactions?

Asymmetric encryption

What is the best source to identify the culprit of a theft in a banking scenario?

An audit trail

What does a honeypot do?

Presents as a prized target to track attackers

What process describes assessing current resources against future aspirations?

Gap analysis

What method uses a private key to verify email integrity?

A digital signature

Which concept adapts access controls based on user risk profiles?

Adaptive identity management

What type of sensor detects changes in frequency?

Microwave sensors

What log ensures accountability for individuals?

A visitors log

What component of change management ensures that security operations aren't affected?

An approval process

What is the best solution to prevent employees from installing games on company systems?

An application allow list

What practice ensures the accuracy of system representations?

Updating diagrams

What outlines steps for unexpected change issues in change management?

A backout plan

In software development, what describes interconnections of services and drivers?

Dependencies

Why do organizations schedule maintenance windows for system updates?

To ensure updates do not disrupt users

What action helps refresh resources in applications?

An application restart

What's the primary purpose of reviewing test results before deploying software?

To identify potential issues

What vital process assesses potential consequences of changes?

Impact analysis

What is crucial to consider before executing a service restart in an enterprise?

Potential impact on interconnected services

What is the primary use of a private key in PKI?

Decryption and digital signatures

What's the type of encryption for large data volumes using a single key?

Symmetric encryption

What involves transforming sensitive data into unique tokens for secure transactions?

Tokenization

Which cryptographic method guarantees irreversible data transformation during encryption?

Asymmetric encryption

Which catalogs ensure security of digital certificates?

Certificate revocation lists (CRLs) and OCSP

What is needed to securely store cryptographic keys?

A Hardware Security Module (HSM) and Full-Disk Encryption (FDE)

What does key exchange involve in cryptography?

Securely transmitting cryptographic keys

What type of digital certificate lacks third-party validation?

Self-signed certificate

What technology serves as a decentralized digital ledger?

Blockchain

What technique obscures code to make it complex?

Obfuscation

What type of attack is an email urging personal information from a user?

Phishing

What is the technique used to hide messages in a picture?

Steganography

What is the most likely attack vector if a CEO’s phone gets hacked?

Connecting to a public Bluetooth headset

What differentiates spear phishing from regular phishing?

Targets high-profile individuals.

What type of threat might arise from a software download from a suspicious website?

A Trojan.

What protects data on company mobile phones from theft?

Remote wipe.

What do watering hole attacks aim to achieve?

Infect visitors of a compromised website.

What distinguishes a business email compromise attack?

The attacker poses as a legitimate organization.

What attack involves redirecting a misspelled website URL?

Typosquatting.

What describes creating a social media account to impersonate someone?

Disinformation.

What should a security administrator do if a laptop with sensitive data is left logged in?

Revoke the certificate.

What is the best practice to prevent rogue virtual machines?

Implement explicit provisioning guidelines.

What security practice should a CEO follow with their mobile for music?

Turn off Bluetooth after use.

What is the greatest risk in using a third-party service for an HR application?

Outsourcing code development.

What proactive measure can minimize data breaches in a company?

Implement Data Loss Prevention (DLP) measures.

What can counteract automated account compromises?

Deployment of Multi-Factor Authentication (MFA).

What's a security risk from a USB drive found in an office?

A malicious USB attack.

What unique risk accompanies software purchased from a market stall?

Uncertain origin and authenticity.

What is a VM escape?

An attack gaining unauthorized access to the host from a VM.

What should developers be cautious of when using third-party libraries?

Exposure to vulnerabilities.

What is the best description of a logic bomb?

A malicious code that executes on a set condition.

What type of attack involves malware disguising itself as legitimate software?

Trojan.

What is responsible for repeated user account lockouts in a company?

A brute-force attack.

What type of malware records bank credentials without permission?

A keylogger.

Which type of attack utilized stolen credentials to access company networks?

Credential stuffing.

What cyberattack overwhelms systems with excessive traffic?

A DDoS attack.

What type of vulnerability allows unauthorized file access via manipulated input parameters?

Directory traversal vulnerability.

What attack occurs when different inputs lead to the same hash output?

A collision attack.

What describes an attacker downgrading a secure connection for eavesdropping?

A TLS/SSL downgrade attack.

What describes systematic login attempts with common passwords?

A password spraying attack.

What technique minimizes risk through isolation in an enterprise?

Creating a VLAN.

What prevents users from installing unapproved software?

Creating an application allow list.

Which of the following protects system file integrity?

Executing 'sfc / scannow'.

What allows administrators to enforce settings in Windows environments?

Group Policy.

What does SELinux provide in Linux systems?

Mandatory access controls.

What type of authentication relies on physical devices?

Hard Authentication Tokens.

What technology enables passwordless access to Apache web servers?

SSH keys.

What describes ephemeral credentials in security?

Temporary access rights.

What is viewed as a biometric factor in multi-factor authentication?

Fingerprint Scan.

What enhances secure password practices for online accounts?

Password manager.

How many factors does smart card authentication involve?

Dual-factor.

What prevents recycling of passwords too often in a company?

Minimum password age.

What temporary access rights reduce exposure in privileged access?

Just-in-time permissions.

What best practices define secure identity federation?

SAML.

What approach combines automation and security operations?

SOAR.

What method assesses network security postures for weaknesses?

Penetration testing.

What type of audit identifies weaknesses in internal controls?

External audit.

What plays a key role in government compliance for organizations?

Right-to-audit clause.

What phase identifies risks in vendor management?

Due diligence.

What type of compliance is critical for industry regulations?

External compliance audits.

What should be prioritized in information security auditing?

Risk assessments.

Which stage involves oversight for ensuring organizational goals after audits?

Internal audits.

What helps verify compliance with external regulations in organizations?

Audits.

What is primarily focused on analyzing vulnerabilities through external review?

Independent assessments.

What outlines promises for confidential information management?

NDA.

What serves as the foundation for work orders in projects?

MSA.

What allows for the assessment of vendors and risk evaluations?

Supply chain analysis.

What demonstrates compliance adherence in a comprehensive manner?

Auditing practices.

What aspect is critical in determining acceptable data loss?

Recovery point objective (RPO).

What defines the risk acceptance strategy without proactive measures?

Acceptance.