Pass for Test

What is the primary role of the Domain Name System (DNS)?

Translating domain names into IP addresses

What is the goal of DNS poisoning (DNS cache poisoning)?

To redirect users to malicious websites

ARP poisoning is most commonly used to

Intercept traffic on a local network

What enables an attacker to intercept traffic during an ARP poisoning attack?

Associating their MAC address with another device’s IP

What is the primary security benefit of SSH?

Encrypted remote access and file transfer

Why is key-based authentication more secure than passwords in SSH?

Keys eliminate password transmission entirely

What is the primary purpose of a hash function?

Producing fixed-length, one-way digests

What security properties do digital signatures provide?

Authentication, integrity, and non-repudiation

IP spoofing is commonly used to

Hide attacker identity or impersonate trusted systems

Which IPsec protocol provides encryption? 

ESP

What is the primary purpose of a firewall?

Controlling inbound and outbound network traffic based on rules

What is the primary purpose of a Virtual Private Network (VPN)?

To create a private connection over a public network using encryption

An organization outlines in writing that employees must use multi-factor authentication, update software monthly, and report suspected phishing attempts. What is this type of formal document called?

Security policy

An HR database stores sensitive salary information. During a system review, the security team highlights that only authorized staff should be able to view these records. Which principle of security is the primary concern here?

Confidentiality

A company allows only finance employees to enter the accounting software, while denying all other staff. What mechanism is this restriction an example of?

Access control

A security analyst intercepts a message but sees only scrambled characters with no obvious meaning. This is the result of applying what transformation to the data?

Ciphertext

During a file transfer, the recipient uses a short, fixed-length output to verify that the file was not altered in transit. Which method is being applied here?

Hash function

An executive signs an electronic contract, and the receiving party later verifies that the message has not been modified and truly came from the executive. What mechanism provides this assurance?

Digital signature

A developer is troubleshooting an encryption process and notices that before any transformation, the input file can be read in clear, understandable English. What is this form of the message called?

Plaintext

A company removes unnecessary services, patches vulnerabilities, and disables unused ports on servers. What practice is being performed?

System Hardening

An intruder enters a server room by tailgating behind an authorized employee. Which type of attack is this?

Social-Based Attack

At a café, someone quietly watches an employee type in their company VPN password. Which attack method does this represent?

Shoulder Surfing

A user gets a text message claiming their delivery has been delayed, with a link that installs malware when clicked. What is this attack called?

Smishing

An unauthorized individual slips into a secure building by walking closely behind an employee with an access badge. Which type of physical attack is this?

Tailgating

What is the primary goal of a denial-of-service (DoS) attack?

To prevent authorized users from accessing a resource

How does a distributed denial-of-service (DDoS) attack differ from a DoS attack?

It uses multiple attacking systems simultaneously

What is the primary function of the Domain Name System (DNS)?

Translating domain names into IP addresses

What is the primary goal of DNS poisoning?

To redirect users to malicious websites

What problem does the Address Resolution Protocol (ARP) solve?

Mapping IP addresses to MAC addresses

What is the primary goal of an ARP poisoning attack?

To intercept traffic intended for another host

What defines an IoT device?

A device connected to the internet for sensing or automation

What security benefit does code signing provide?

It confirms the publisher’s identity and code integrity

What is the primary goal of fuzzing?

To test how software handles unexpected or invalid input

What is the primary purpose of the Open Web Application Security Project (OWASP)?

To publish tools, documentation, and methodologies to improve web application security

What is the primary goal of confidentiality in software and component security?

Ensuring sensitive data is accessible only to authorized users or systems

Which statement best describes encryption?

It converts plaintext into unreadable ciphertext

How does hashing support confidentiality?

By protecting sensitive data using one-way transformations

What is the primary purpose of a checksum?

To verify that data has not been altered

What is the primary security benefit of modularity?

Allows systems to be updated or secured independently

A SaaS provider wants formal certification of its information security program to win enterprise contracts. Which standard should it pursue? 

ISO 27001

Developers improperly have access to production systems that affect financial reporting accuracy. Which law applies?

SOX

A financial institution must secure customer financial data with administrative, technical, and physical safeguards. Which law applies?

GLBA

A company that designs online games for children must acquire parental consent before collecting data.  Which law applies?

COPPA

A hospital must notify patients and HHS after PHI is exposed in a ransomware attack. Which law applies?

HIPAA

A university exposes student grades due to a misconfigured LMS. Which law applies?

FERPA

A European customer requests deletion of all personal data. Which law grants this right?

GDPR

A California resident asks a business to stop selling their data. Which law applies?

CCPA

A company redesigning a hybrid network wants best practices for zones, segmentation, and VPN security. Which standard applies?

ISO/IEC 27033

A company wants a cloud-specific control framework and STAR certification. Which organization provides these?

CSA

Why should SSH be enabled and Telnet disabled for remote access?

SSH provides encrypted communication while Telnet does not

What is data sanitization?

Thoroughly removing data so it cannot be recovered

Which of the following is the first phase of the system SDLC?

System planning

Which NIST publication defines impact levels for data classification?

NIST SP 800-53B

What is data at rest?

Data stored on physical or digital media

Which control is most important for protecting data in transit?

Encryption

What is the primary goal of tokenization?

To replace sensitive data with a non-sensitive token

Which technique converts input into a fixed-length value using a mathematical algorithm?

Hashing

What distinguishes data masking from tokenization?

Masking partially hides data, tokenization replaces it entirely