Information Security Exam 1

Quiz Answers

A ‘Procedure’ in the IT security policy framework is best described as:

a detailed, step-by-step instruction for a specific task

Procedures are the:

most granular level of the policy framework, providing explicit ‘how-to’ instructions for a specific task

The IT security policy framework (Policies, Standards, Procedures, Guidelines) is considered a ‘bottom-up’ approach, beginning with guidelines and ending with policies

false

Your company is experiencing a Distributed Denial of Service (DDoS) attack! Your website is overwhelmed with a flood of traffic, causing it to crash and become unavailable to the public. Which principle of the CIA Triad does this attack most directly compromise?

availability

Your company requires all employees to use two-factor authentication (2FA) and a Virtual Private Network (VPN) to access the company network while working off-site. These controls are primarily designed to protect which domain of the IT infrastructure?

remote access domain

Remote Access Domain:

to secure the connection from an off-site location

An employee at your University clicks on a link in a phishing email, which installs a virus on their computer that begins encrypting student records. As you analyze the incident, you identify the employee's action as a failure within which domain of the IT infrastructure?

user Domain

User Domain:

where security failures related to human behavior, like a lack of awareness or poor judgement, can occur

You experience a data breach where sensitive customer information is leaked from your company's database to the public internet. This incident is a direct compromise of which security principle in the CIA Triad?

confidentiality

You're tasked with backing up your company's financial database to a remote server. You verify that the backup data matches the original data exactly using a hash function (a special algorithm used in cryptography). This action is a direct measure to ensure which principle of the CIA Triad?

integrity

Implementing multiple security controls only at the LAN-to-WAN domain is still considered a defense-in-depth strategy.

false

If a system's integrity is compromised, it always means a hacker has stolen data.

false

A new software patch has been released for a security flaw in a popular web browser that your company uses. Your company, however, asks you not to deploy the patch immediately. Which two security terms best describe the unpatched flaw and the potential for a hacker to exploit it?

vulnerability and threat

A major hotel company is experiencing an outage of its reservation servers due to a denial-of-service (DoS) attack. The IT team is working to restore services, but for every minute the system is down, the company is losing thousands of dollars in unbooked rooms. This financial loss is best described as:

opportunity cost

Single Loss Expectancy:

a theoretical calculation (AVXEF) that estimates the loss of a single event

A business continuity plan (BCP) is primarily concerned with restoring the IT infrastructure, while a disaster recovery plan (DRP) focuses on ensuring that business functions can continue to operate in the face of an outage.

false

A business continuity plan (BCP) makes sure that regular processes or “business as usual” can:

ontinue in the face of a realized risk, while a disaster recovery plan (DRP) focuses on addressing damage, loss, or destruction of IT systems and data.

You're security professional for a new e-commerce startup, tasked with justifying a significant expenditure on a new, cutting-edge security information and event management (SIEM) system. The CEO questions the cost, arguing that the company has not yet experienced a major attack. Based on the risk management principles discussed, what is your most compelling argument for the investment?

the cost of the SIEM is a fixed expense, whereas the potential costs of a breach (lost customers, reputational damage, legal fees) are unpredictable and could be far higher.

You discover a critical zero-day vulnerability in your company's proprietary software. A person contacts you, claiming to have found the same flaw, and offers to provide details on how to fix it in exchange for a "bug bounty." They also warn that if you don't pay, they might "have to go public with the information." Based on the provided definitions, what type of hacker best fits this individual's behavior?

gray-hat hacker

A "brute-force password attack" and a "dictionary password attack" are both considered active attacks, even though they do not require any direct interaction with a live user and only involve trying combinations against a static password file.

true

Both brute-force and dictionary attacks are active attacks because:

they involve a direct attempt to gain unauthorized access by "hammering away" at the code or attempting to log on by entering each dictionary entry.

A passive attack:

involves simply eavesdropping or monitoring data without making changed to the system

A company's brand image and reputation are considered non-essential assets in risk management because they are difficult to assign a tangible financial value to, making their protection a lower priority than that of financial or intellectual property assets.

false

Which of the following best describes the core difference between a phishing and a pharming attack?

phishing uses a deceptive email or message to trick the user, while pharming "poisons" a DNS server to redirect the user without their knowledge.

Phishing:

a scam where an attacker attempts to trick the victim, via email or instant message, into providing private information

Pharming:

poisons a domain name so when a user enters the correct URL, they are automatically sent to the attacker’s site instead

A new polymorphic malware variant has been detected, capable of rapidly changing its code to evade traditional signature-based detection. Your organization relies on a layered security defense model. As a security analyst, what is the primary reason why this layered approach is more effective against this specific threat than relying on a single, powerful antivirus solution?

a layered approach ensures that if the malware bypasses the antivirus (a single layer), other controls like an intrusion prevention system (IPS) or network firewalls (other layers) might still detect and block it.

Single antivirus solutions reply on:

known signatures, which the polymorphic malware is designed to evade

By having multiple, different security controls (layers) in place, you increase the chances that:

even if one layer fails, another will catch the threat

A qualitative risk assessment is considered more objective than a quantitative risk assessment because it relies on the consensus of a diverse group of experts from various departments, reducing the influence of any single person's bias.

false

A quantitative risk assessment will be more objective because:

it attempts to describe risk in terms of dollar values

A qualitative risk assessment are usually:

very subjective and rely on ratings or other relative measurements from subject matter experts

As a cybersecurity professional, you are presenting to your company's board about the risk of a major ransomware attack. Your qualitative risk assessment places this risk in the upper-right quadrant of the risk matrix. What does this placement primarily signify, and what is the recommended immediate response?

the risk has both high probability and high impact, and it should be the immediate focus for risk management efforts to reduce it

A security professional who has a good understanding of the phases of an attack can anticipate an attacker's next move and implement a specific countermeasure.

true

The primary purpose of understanding the attack phases is to:

know what to look for in logs and network traffic during each stage and to have appropriate controls in place to prevent the next stage from occurring

An low-level employee at your company, angry at a recent demotion, uses their credentials to gain unauthorized access to a server and deletes a number of critical files. This is an example of a structured attack, because the individual is highly motivated by anger.

false

Structured attack is based on the:

attacker’s skill level, use of complex tools, and sophisticated hacking techniques

A business unit leader is concerned about their employees accidentally downloading malware from infected websites. They suggest that the best solution is to simply block access to all social media sites to prevent threats. Knowing what you know about the types of threats to a business and where they originate from, how would you refine your security approach?

you would explain that while blocking some sites is a good idea, threats can also originate from trusted sources and even from within the company, so a comprehensive strategy is needed.

You're a security professional tasked with briefing a company's leadership on emerging threats. Primarily, you need to explain why you believe threats to AI-powered mobile devices and IoT will become a major concern.

Based on historical patterns of how malware has developed, which of the following is the most compelling argument for why this new wave of attacks is a significant risk?

the history of malware shows that new threats always tend to appear when new platforms increase the number of vulnerable targets.

A manager (who is not in IT) at your company expresses skepticism about the cost of a security project. They believe that a physical security breach is far more likely and damaging than a cyberattack.

Based on the threats to a business and their consequences presented in the textbook, which of the following might be the most persuasive and substantiated argument to counter their opinion?

you would explain that cyberattacks can lead to all the same consequences as a physical breach (reputational damage, financial loss, etc.), but can occur on a global scale at a much faster speed

You are part of an incident response team investigating a breach. The security logs show that an attacker first performed a series of DNS lookups and ping sweeps, followed by a detailed port scan of your company's servers.

Based on the phases of an attack, what do you think is the primary objective of the attacker's actions at this point in the attack?

to collect information necessary to identify potential vulnerabilities for a future exploit

You've discovered a new, unauthorized wireless access point connected to the internal network. This rogue access point allows wireless devices to bypass the network perimeter defenses and directly access the internal network.

What is the most significant security risk posed by this discovery?

the rogue access point provides a new and easy entry point for an attacker to conduct a direct attack

Your company's website is the primary channel for sales and customer service, so you're considering a fairly large cybersecurity investment to protect it.

Based on the types of threats to a business outlined in the text, which of the following attack scenarios would pose the greatest risk to the company's immediate revenue and customer trust, and why?

a denial of service (availability) attack that takes the website offline for several hours

You are working on a security policy for your company's public-facing servers. You want to use a honeypot as part of your defense strategy. Which of the following is a key characteristic that a honeypot must have to be effective?

it must have a dedicated firewall that prevents all outbound traffic in case it is compromised

A new employee in your department is frustrated and wants to know why the company has a strict policy regarding the use of personal USB drives and the installation of unauthorized software. Which of the following is the best rationale to give this employee for these policies?

to ensure a standardized and controlled software environment that allows for efficient patching and vulnerability management

The direct reason for the policy is to:

control the environment to prevent vulnerabilities

An auditor is reviewing your company's financial records and notices that a very important log file has a cryptographic hash attached to it. The auditor asks for a separate, un-hashed copy of the log file and then calculates the hash of this new copy. They find that it does not match the hash of the original file. What cryptography objective was the cryptographic hash intended to protect, and what does the mismatch indicate?

the objective was Integrity, and the mismatch indicates that the file has been altered

You're a junior cybersecurity professional and your company's IT department is considering a new secure communication system. The head of IT proposes using an in-house developed, proprietary encryption algorithm, arguing that its secrecy will make it more secure against attacks. You disagree, arguing that open-source, publicly scrutinized algorithms are generally more secure.

true

A small Indie game developer publishes a game update on its website and includes a hash value (a unique, fixed-size string of characters). A user downloads the update file and calculates its hash on their own computer. The calculated hash does not match the one provided by the developer, so the user can be confident that the downloaded file is the one the company intended to provide.

false

The German Enigma cipher machine was famous for having a massive number of possible key configurations, making a brute-force attack computationally infeasible. Despite this, the Allies were able to break the Enigma cipher during World War II. What was the primary reason for this success?

the German key management protocol had a weakness that allowed cryptanalysts to exploit patterns in the message keying

Your company is developing a highly secure system for transmitting sensitive government communications. To ensure the highest level of confidentiality, they are considering using a one-time pad because it is theoretically unbreakable, as long as the key is 1) generated from a truly random source, 2) is as long as the message, and 3) is used for only one message.

true

A large, multi-national company wants to implement a secure communication system for its 10,000 employees, where any employee must be able to securely communicate with any other employee. The IT security team is debating between a symmetric (private) key system and an asymmetric (public) key system. Given the need for scalability and efficiency in key management, which system below is the most practical choice, and why?

an asymmetric key system, because it requires each employee to manage only two keys—a public and a private key

Asymmetric (public key) cryptography is typically used:

to solve the key distribution problem by securely exchanging a temporary symmetric key

An researcher at your university needs to securely send a very large sensitive file to a fairly large number of users and is considering which type of encryption cipher to use. They're aware that symmetric (private) encryption is faster but requires sharing a secret key first, while asymmetric (public) encryption is slower but solves the key sharing problem. Which of the following describes the BEST (i.e., most common and efficient) method to address this scenario?

use an asymmetric cipher to exchange a temporary symmetric "session key," and then use that session key to encrypt the very large file

You discover that your company is using a substitution cipher where each character in a message is replaced by another character based on a static (unchanging) substitution table. Curious, you preform some basic cryptanalysis, and confirm that the letter 'E' appears much more frequently than any other letter in the ciphertext. Worried, you sound the alarm that this cipher could be easy to break.

true

A hospital's IT department is implementing a new system to store patient medical records. To comply with HIPAA, they want to ensure that unauthorized employees cannot view the records. They also want to prevent any employee from compiling seemingly harmless data (like dates of visits, diagnoses, and postal codes) to identify specific patients. Which two cryptography principles are the IT department trying to enforce?

confidentiality and privacy

Anonymity is about:

disguising a user’s identity, not the identity of a person whose data is being protected

A software company has developed a new cryptographic algorithm that boasts a very large keyspace, claiming it's computationally secure because of the sheer number of possible keys. However, an independent security audit reveals a flaw in the algorithm's design that allows an attacker to break the key one part at a time, proving that a large keyspace alone does not guarantee a cipher is computationally secure.

true

A Network Access Control (NAC) system performing posture checking is primarily focused on authenticating the user's credentials (username/password) to determine which resources they can access

false

Posture checking focuses on:

device health, not user credentials

Your company is shifting its network security model. Historically, any employee logged into the corporate LAN was automatically granted access to all internal servers. The new policy requires that no matter where it comes from, every request must be authenticated and checked against policy, even to a file server on the same floor.

This change in security philosophy aligns with which network model?

zero trust network

You find out that a user in your organization is accessing a critical online service over the public Internet using an unencrypted connection (no VPN or HTTPS). This means an attacker performing a "man-in-the-middle" attack on the network path could potentially view the user's session data.

Which network security concept does this scenario best illustrate?

the open “postcard” nature of data transmission on a WAN

You notice unusually high network traffic attempting to establish numerous simultaneous connections to an internal database server, potentially indicating a Distributed Denial-of-Service (DDoS) attack. You decide to implement a rule on the perimeter firewall to limit the number of new connection attempts per second destined for the database's service port.

Which layer of the OSI model are you primarily applying this defense mechanism?

layer 4: transport

You're configuring a new border firewall and need to implement the most secure rule management practice for your organization's web server: it needs to allow only inbound HTTPS traffic (Port 443).

Which configuration best demonstrates the principle of implicit deny for this scenario?

add a rule to allow only HTTPS traffic on Port 443 to the web server, with the last rule in the sequence being to Deny Any/Any

Stateful inspection is a:

firewall type that improves performance and security for establish connections but it doesn’t automatically implement or enforce the implicit deny configuration logic

You're a systems administrator setting up a new server and need to configure remote administration access. You're debating between using Telnet (Port 23) and Secure Shell (SSH, Port 22).

From a security perspective, why should you choose SSH over Telnet for this purpose?

SSH provides built-in encryption for the communication session, while Telnet transmits credentials and data in plain text.

SSH:

encrypts all data, including login credentials, making it safe for remote administration over untrusted networks

Telenet:

sends everything in plain text, making it highly vulnerable to eavesdropping

You are designing a highly secure network for a hospital. You need to ensure that the patient records system cannot communicate with the guest Wi-Fi network, even though both physical network cables connect to the same core switch. Additionally, you want to minimize broadcast traffic on the sensitive patient records segment.

Which network device feature would be the most efficient and cost-effective in meeting both the traffic separation and security goals?

virtual local area network (VLAN)

VLAN allows:

an administrator to logically segment (partition) the network, separating the patient records and guest Wi-Fi into two distinct broadcast domains

Implementing MAC address filtering on a corporate wireless access point is a strong security measure for preventing unauthorized external devices from connecting to the network, because an attacker would need physical access to the building's wiring to defeat it.

true

A hardware manufacturer is developing a new type of fiber-optic cable for better signal clarity. According to the OSI Reference Model, they must ensure the cable is compatible with both IP addressing standards (Layer 3) and a reliable (TCP-based) transmission protocol (Layer 4) to be successful in the marketplace.

false

You are designing an application that requires highly sensitive data (i.e., payment information) to be securely transmitted across a public network. To ensure confidentiality and proper data formatting for the recipient, which two adjacent OSI layers are most critical for implementing encryption and managing the secure presentation of this data?

application layer (L7) and presentaion layer (L6)

The application layer (L7) is where:

the sensitive data is generated and interacts with the user program

The presentation layer (L6) is:

explicitly responsible for data coding, formatting, and (from a security perspective) encryption