Cybersecurity Essentials FINAL Quiz Answers Full Questions

Cybersecurity Essentials 1.1 Final Quiz Answers Full Questions

1. Which statement best describes a motivation of hacktivists?

  • They are trying to show off their hacking skills.
  • They are interested in discovering new exploits.
  • They are curious and learning hacking skills.
  • They are part of a protest group behind a political cause.

Explanation: Each type of cybercriminal has a distinct motivation for his or her actions.

2. Which type of cybercriminal is the most likely to create malware to compromise an organization by stealing credit card information?

  • white hat hackers
  • black hat hackers
  • gray hat hackers
  • script kiddies

Explanation: Malware is a tool used by certain types of hackers to steal information.

3. A specialist in the HR department is invited to promote the cybersecurity program in community schools. Which three topics would the specialist emphasize in the presentation to draw students to this field? (Choose three.)

  • a career-field in high-demand
  • service to the public
  • high earning potential
  • a job with routine, day-to-day tasks
  • a field requiring a PhD degree
  • the CompTIA A+ certification provides an adequate knowledge base for the field

Explanation: The increased demand for cybersecurity specialists offers several unique career opportunities.

4. An organization allows employees to work from home two days a week. Which technology should be implemented to ensure data confidentiality as data is transmitted?

  • SHS
  • VLANS
  • RAID
  • VPN

Explanation: Protecting data confidentiality requires an understanding of the technologies used to protect data in all three data states.

5. Which type of networks poses increasing challenges to cybersecurity specialists due to the growth of BYOD on campus?

  • wireless networks
  • wired networks
  • sneaker net
  • virtual networks

Explanation: A cybersecurity specialist must be familiar with the types of technologies used to store, transmit, and process data.

6. A cybersecurity specialist is working with the IT staff to establish an effective information security plan. Which combination of security principles forms the foundation of a security plan?

  • confidentiality, integrity, and availability
  • technologies, policies, and awareness
  • secrecy, identify, and nonrepudiation
  • encryption, authentication, and identification

Explanation: The CIA Triad is the foundation upon which all information management systems are developed.

7. Which framework should be recommended for establishing a comprehensive information security management system in an organization?

  • ISO/IEC 27000
  • ISO OSI model
  • NIST/NICE framework
  • CIA Triad

Explanation: A cybersecurity specialist needs to be familiar with the different frameworks and models for managing information security.

8. What are three states of data during which data is vulnerable? (Choose three.)

  • data in-process
  • stored data
  • data in-transit
  • data encrypted
  • purged data
  • data decrypted

Explanation: A cybersecurity specialist must be aware of each of the three states of data to effectively protect data and information. Purged data was stored data. Encrypted and decrypted data can be in any of the three states.

9. Users report that the database on the main server cannot be accessed. A database administrator verifies the issue and notices that the database file is now encrypted. The organization receives a threatening email demanding payment for the decryption of the database file. What type of attack has the organization experienced?

  • man-in-the-middle attack
  • ransomeware
  • Trojan horse
  • DoS attack

Explanation: A cybersecurity specialist needs to be familiar with the characteristics of the different types of malware and attacks that threaten an organization.

10. What three best practices can help defend against social engineering attacks? (Choose three.)

  • Enable a policy that states that the IT department should supply information over the phone only to managers.
  • Add more security guards.
  • Resist the urge to click on enticing web links.
  • Deploy well-designed firewall appliances.
  • Educate employees regarding policies.
  • Do not provide password resets in a chat window.

Explanation: A cybersecurity specialist must be aware of the technologies and measures that are used as countermeasures to protect the organization from threats and vulnerabilities.

11. Which statement describes a distributed denial of service attack?

  • An attacker sends an enormous quantity of data that a server cannot handle.
  • An attacker builds a botnet comprised of zombies.
  • An attacker views network traffic to learn authentication credentials.
  • One computer accepts data packets based on the MAC address of another computer.

Explanation: A cybersecurity specialist needs to be familiar with the characteristics of the different types of malware and attacks that threaten an organization.

12. A cyber criminal sends a series of maliciously formatted packets to the database server. The server cannot parse the packets and the event causes the server crash. What is the type of attack the cyber criminal launches?

  • DoS
  • man-in-the-middle
  • packet Injection
  • SQL injection

Explanation: A cybersecurity specialist needs to be familiar with the characteristics of the different types of malware and attacks that threaten an organization.

13. An executive manager went to an important meeting. The secretary in the office receives a call from a person claiming that the executive manager is about to give an important presentation but the presentation files are corrupted. The caller sternly recommends that the secretary email the presentation right away to a personal email address. The caller also states that the executive is holding the secretary responsible for the success of this presentation. Which type of social engineering tactic would describe this scenario?

  • urgency
  • intimidation
  • familiarity
  • trusted partners

Explanation: Social engineering uses several different tactics to gain information from victims.

14. What are the two most effective ways to defend against malware? (Choose two.)

  • Implement network firewalls.
  • Install and update antivirus software.
  • Implement RAID.
  • Update the operating system and other application software.
  • Implement strong passwords.
  • Implement a VPN.

Explanation: A cybersecurity specialist must be aware of the technologies and measures that are used as countermeasures to protect the organization from threats and vulnerabilities.

15. The employees in a company receive an email stating that the account password will expire immediately and requires a password reset within 5 minutes. Which statement would classify this email?

  • It is a piggy-back attack.
  • It is an impersonation attack.
  • It is a DDoS attack.
  • It is a hoax.

Explanation: Social engineering uses several different tactics to gain information from victims.

16. In which situation would a detective control be warranted?

  • when the organization needs to look for prohibited activity
  • after the organization has experienced a breach in order to restore everything back to a normal state
  • when the organization cannot use a guard dog, so it is necessary to consider an alternative
  • when the organization needs to repair damage

Explanation: Access control prevents an unauthorized user from gaining access to sensitive data and networked systems. There are several technologies used to implement effective access control strategies.

17. An organization has implemented antivirus software. What type of security control did the company implement?

  • recovery control
  • deterrent control
  • detective control
  • compensative control

Explanation: A cybersecurity specialist must be aware of the technologies and measures that are used as countermeasures to protect the organization from threats and vulnerabilities.

18. Alice and Bob are using public key encryption to exchange a message. Which key should Alice use to encrypt a message to Bob?

  • the private key of Alice
  • the public key of Bob
  • the private key of Bob
  • the public key of Alice

Explanation: Encryption is an important technology used to protect confidentiality. It is important to understand the characteristics of the various encryption methodologies.

19. Which statement describes a characteristics of block ciphers?

  • Block ciphers encrypt plaintext one bit at a time to form a block.
  • Block ciphers result in output data that is larger than the input data most of the time.
  • Block ciphers result in compressed output.
  • Block ciphers are faster than stream ciphers.

Explanation: Encryption is an important technology used to protect confidentiality. It is important to understand the characteristics of the various encryption methodologies.

20. The IT department is tasked to implement a system that controls what a user can and cannot do on the corporate network. Which process should be implemented to meet the requirement?

  • user login auditing
  • a set of attributes that describes user access rights
  • observations to be provided to all employees
  • a biometric fingerprint reader

Explanation: Access control prevents unauthorized user from gaining access to sensitive data and networked systems. There are several technologies used to implement effective access control strategies.

21. Alice and Bob use a pre-shared key to exchange a confidential message. If Bob wants to send a confidential message to Carol, what key should he use?

  • the same pre-shared key he used with Alice
  • the private key of Carol
  • a new pre-shared key
  • the public key of Bob

Explanation: Encryption is an important technology used to protect confidentiality. It is important to understand the characteristics of the various encryption methodologies.

22. Which access control strategy allows an object owner to determine whether to allow access to the object?

  • RBAC
  • DAC
  • MAC
  • ACL

Explanation: Access control prevents unauthorized user from gaining access to sensitive data and networked systems. There are several technologies used to implement effective access control strategies.

23. Which method is used by steganography to hide text in an image file?

  • data obfuscation
  • data masking
  • least significant bit
  • most significant bit

Explanation: Encryption is an important technology used to protect confidentiality. It is important to understand the characteristics of the various encryption methodologies.

24. The X.509 standards defines which security technology?

  • digital certificates
  • biometrics
  • strong passwords
  • security tokens

Explanation: Digital certificates protect the parties involved in a secure communication

25. Which hashing algorithm is recommended for the protection of sensitive, unclassified information?

  • MD5
  • AES-256
  • 3DES
  • SHA-256

Explanation: Data integrity is one of the three guiding security principles. A cybersecurity specialist should be familiar with the tools and technologies used to ensure data integrity.

26. Technicians are testing the security of an authentication system that uses passwords. When a technician examines the password tables, the technician discovers the passwords are stored as hash values. However, after comparing a simple password hash, the technician then discovers that the values are different from those on other systems. What are two causes of this situation? (Choose two.)

  • Both systems scramble the passwords before hashing.
  • The systems use different hashing algorithms.
  • One system uses hashing and the other uses hashing and salting.
  • Both systems use MD5.
  • One system uses symmetrical hashing and the other uses asymmetrical hashing.

Explanation: Hashing can be used in many different situations to ensure data integrity.

27. You have been asked to work with the data collection and entry staff in your organization in order to improve data integrity during initial data entry and data modification operations. Several staff members ask you to explain why the new data entry screens limit the types and size of data able to be entered in specific fields. What is an example of a new data integrity control?

  • data encryption operations that prevent any unauthorized users from accessing sensitive data
  • a limitation rule which has been implemented to prevent unauthorized staff from entering sensitive data
  • data entry controls which only allow entry staff to view current data
  • a validation rule which has been implemented to ensure completeness, accuracy, and consistency of data

Explanation: Data integrity deals with data validation.

28. What technology should be implemented to verify the identity of an organization, to authenticate its website, and to provide an encrypted connection between a client and the website?

  • digital signature
  • salting
  • digital certificate
  • asymmetric encryption

Explanation: Encryption is an important technology used to protect confidentiality. It is important to understand the characteristics of the various encryption methodologies.

29. Your organization will be handling market trades. You will be required to verify the identify of each customer who is executing a transaction. Which technology should be implemented to authenticate and verify customer electronic transactions?

  • data hashing
  • asymmetrical encryption
  • symmetrical encryption
  • digital certificates

Explanation: Digital certificates protect the parties involved in secure communications.

30. Alice and Bob are using a digital signature to sign a document. What key should Alice use to sign the document so that Bob can make sure that the document came from Alice?

  • public key from Bob
  • private key from Alice
  • username and password from Alice
  • private key from Bob

Explanation: Alice and Bob are used to explain asymmetric cryptography used in digital signatures. Alice uses a private key to encrypt the message digest. The message, encrypted message digest, and the public key are used to create the signed document and prepare it for transmission.

31. An organization has determined that an employee has been cracking passwords on administrative accounts in order to access very sensitive payroll information. Which tools would you look for on the system of the employee? (Choose three)

  • rainbow tables
  • lookup tables
  • algorithm tables
  • password digest
  • rouge access points
  • reverse lookup tables

Explanation: Tables that contain possible password combinations are used to crack passwords.

32. An organization wants to adopt a labeling system based on the value, sensitivity, and criticality of the information. What element of risk management is recommended?

  • asset classification
  • asset identification
  • asset availability
  • asset standardization

Explanation: One of the most important steps in risk management is asset classification.

33. An organization has recently adopted a five nines program for two critical database servers. What type of controls will this involve?

  • stronger encryption systems
  • improving reliability and uptime of the servers
  • remote access to thousands of external users
  • limiting access to the data on these systems

Explanation: System and data availability is a critical responsibility of a cybersecurity specialists. It is important to understand the technologies, process, and controls used to provide high availability.

34. Being able to maintain availability during disruptive events describes which of the principles of high availability?

  • single point of failure
  • system resiliency
  • fault tolerance
  • uninterruptible services

Explanation: High availability can be achieved by eliminating or reducing single points of failure, by implementing system resiliency, and by designing for fault tolerance.

35. Which risk mitigation strategies include outsourcing services and purchasing insurance?

  • avoidance
  • transfer
  • reduction
  • acceptance

Explanation: Risk mitigation lessens the exposure of an organization to threats and vulnerabilities by transferring, accepting, avoiding, or taking an action to reduce risk.

36. The awareness and identification of vulnerabilities is a critical function of a cybersecurity specialist. Which of the following resources can be used to identify specific details about vulnerabilities?

  • CVE national database
  • NIST/NICE framework
  • ISO/IEC 27000 model
  • Infragard

Explanation: A cybersecurity specialist needs to be familiar with the resources such as the CVE database, Infragard, and the NIST/NISE framework. All can be used to help plan and implement effective an information security management system.

37. Which technology would you implement to provide high availability for data storage?

  • N+1
  • software updates
  • RAID
  • hot standby

Explanation: System and data availability is a critical responsibility of a cybersecurity specialist. It is important to understand the technologies, process, and controls used to provide redundancy.

38. Which two values are required to calculate annual loss expectancy? (Choose two.)

  • annual rate of occurrence
  • asset value
  • frequency factor
  • exposure factor
  • single loss expectancy
  • quantitative loss value

Explanation: Single loss expectancy, annualized rate of occurrence, and annualized loss expectancy are used in a quantitative risk analysis

39. What is it called when an organization only installs applications that meet its guidelines, and administrators increase security by eliminating all other applications?

  • asset availability
  • asset identification
  • asset classification
  • asset standardization

Explanation: An organization needs to know what hardware and software are present as a prerequisite to knowing what the configuration parameters need to be. Asset management includes a complete inventory of hardware and software. Asset standards identify specific hardware and software products that the organization uses and supports. When a failure occurs, prompt action helps to maintain both access and security.

40. There are many environments that require five nines, but a five nines environment may be cost prohibitive. What is one example of where the five nines environment might be cost prohibitive?

  • department stores at the local mall
  • the front office of a major league sports team
  • the U.S. Department of Education
  • the New York Stock Exchange

Explanation: System and data availability is a critical responsibility of a cybersecurity specialist. It is important to understand the technologies, process, and controls used to protect provide high availability.

41. Which technology can be used to protect VoIP against eavesdropping?

  • ARP
  • encrypted voice messages
  • strong authentication
  • SSH

Explanation: Many advanced technologies such as VoIP, streaming video, and electronic conferencing require advanced countermeasures.

42. Mutual authentication can prevent which type of attack?

  • wireless poisoning
  • wireless IP spoofing
  • wireless sniffing
  • man-in-the-middle

Explanation: A cybersecurity specialist must be aware of the technologies and measures that are used as countermeasures to protect the organization from threats and vulnerabilities.

43. Which of the following products or technologies would you use to establish a baseline for an operating system?

  • SANS Baselining System (SBS)
  • Microsoft Security Baseline Analyzer
  • MS Baseliner
  • CVE Baseline Analyzer

Explanation: There are many tools that a cybersecurity specialist uses to evaluate the potential vulnerabilities of an organization.

44. What Windows utility should be used to configure password rules and account lockout policies on a system that is not part of a domain?

  • Active Directory Security tool
  • Computer Management
  • Local Security Policy tool
  • Event Viewer security log

Explanation: A cybersecurity specialist must be aware of the technologies and measures that are used as countermeasures to protect the organization from threats and vulnerabilities. Local Security Policy, Event Viewer, and Computer Management are Windows utilities that are all used in the security equation.

45. What describes the protection provided by a fence that is 1 meter in height?

  • It deters casual trespassers only.
  • It prevents casual trespassers because of its height.
  • The fence deters determined intruders.
  • It offers limited delay to a determined intruder.

Explanation: Security standards have been developed to assist organizations in implementing the proper controls to mitigate potential threats. The height of a fence determines the level of protection from intruders

46. Which wireless standard made AES and CCM mandatory?

  • WPA2
  • WEP
  • WEP2
  • WPA

Explanation: Wireless security depends on several industry standards and has progressed from WEP to WPA and finally WPA2.

47. Which three protocols can use Advanced Encryption Standard (AES)? (Choose three.)

  • WEP
  • WPA2
  • WPA
  • 802.11q
  • 802.11i
  • TKIP

Explanation: Various protocols can be used to provide secure communication systems. AES is the strongest encryption algorithm.

48. Which website offers guidance on putting together a checklist to provide guidance on configuring and hardening operating systems?

  • Internet Storm Center
  • The Advanced Cyber Security Center
  • The National Vulnerability Database website
  • CERT

Explanation: There are several cybersecurity information websites that a cybersecurity specialist uses to evaluate the potential vulnerabilities of an organization. Some of these websites are the National Vulnerability Database, CERT, the Internet Storm Center, and the Advanced Cyber Security Center.

49. Which law was enacted to prevent corporate accounting-related crimes?

  • The Federal Information Security Management Act
  • Gramm-Leach-Bliley Act
  • Import/Export Encryption Act
  • Sarbanes-Oxley Act

Explanation: New laws and regulations have come about to protect organizations, citizens, and nations from cybersecurity attacks.

50. Which cybersecurity weapon scans for use of default passwords, missing patches, open ports, misconfigurations, and active IP addresses?

  • packet analyzers
  • vulnerability scanners
  • packet sniffers
  • password crackers

Explanation: There are many tools that a cybersecurity specialist uses to evaluate the potential vulnerabilities of an organization.

51. A cybersecurity specialist is asked to identify the potential criminals known to attack the organization. Which type of hackers would the cybersecurity specialist be least concerned with?

  • black hat hackers
  • gray hat hackers
  • script kiddies
  • white hat hackers

Explanation: Hackers are classified by colors to help define the purpose of their break-in activities.

52. What is an example of early warning systems that can be used to thwart cybercriminals?

  • Infragard
  • ISO/IEC 27000 program
  • Honeynet project
  • CVE database

Explanation: Early warning systems help identify attacks and can be used by cybersecurity specialists to protect systems.

53. Which technology should be used to enforce the security policy that a computing device must be checked against the latest antivirus update before the device is allowed to connect to the campus network?

  • SAN
  • VPN
  • NAC
  • NAS

Explanation: A cybersecurity specialist must be aware of the technologies available to enforce its organization’s security policy.

54. Which data state is maintained in NAS and SAN services?

  • stored data
  • data in-transit
  • encrypted data
  • data in-process

Explanation: A cybersecurity specialist must be familiar with the types of technologies used to store, transmit, and process data.

55. Which technology can be used to ensure data confidentiality?

  • hashing
  • identity management
  • encryption
  • RAID

Explanation: A cybersecurity specialist must be aware of the technologies available which support the CIA triad.

56. What is an impersonation attack that takes advantage of a trusted relationship between two systems?

  • man-in-the-middle
  • spoofing
  • spamming
  • sniffing

Explanation: A cybersecurity specialist needs to be familiar with the characteristics of the different types of malware and attacks that threaten an organization.

57. Users report that the network access is slow. After questioning the employees, the network administrator learned that one employee downloaded a third-party scanning program for the printer. What type of malware might be introduced that causes slow performance of the network?

  • virus
  • worm
  • spam
  • phishing

Explanation: A cybersecurity specialist needs to be familiar with the characteristics of the different types of malware and attacks that threaten an organization.

58. What type of application attack occurs when data goes beyond the memory areas allocated to the application?

  • buffer overflow
  • RAM Injection
  • SQL injection
  • RAM spoofing

Explanation: A cybersecurity specialist needs to be familiar with the characteristics of the different types of malware and attacks that threaten an organization.

59. What type of attack has an organization experienced when an employee installs an unauthorized device on the network to view network traffic?

  • sniffing
  • spoofing
  • phishing
  • spamming

Explanation: A cybersecurity specialist needs to be familiar with the characteristics of the different types of malware and attacks that threaten an organization.

60. A penetration testing service hired by the company has reported that a backdoor was identified on the network. What action should the organization take to find out if systems have been compromised?

  • Look for policy changes in Event Viewer.
  • Scan the systems for viruses.
  • Look for unauthorized accounts.
  • Look for usernames that do not have passwords.

Explanation: A cybersecurity specialist needs to be familiar with the characteristics of the different types of malware and attacks that threaten an organization.

61. Smart cards and biometrics are considered to be what type of access control?

  • administrative
  • technological
  • logical
  • physical

Explanation: Access control prevents an unauthorized user from gaining access to sensitive data and networked systems. There are several technologies used to implement effective access control strategies.

62. Which access control should the IT department use to restore a system back to its normal state?

  • compensative
  • preventive
  • corrective
  • detective

Explanation: Access control prevents an unauthorized user from gaining access to sensitive data and networked systems. There are several technologies used to implement effective access control strategies.

63. A user has a large amount of data that needs to be kept confidential. Which algorithm would best meet this requirement?

  • 3DES
  • ECC
  • RSA
  • Diffie-Hellman

Explanation: Encryption is an important technology used to protect confidentiality. It is important to understand the characteristics of the various encryption methodologies.

64. What happens as the key length increases in an encryption application?

  • Keyspace increases proportionally.
  • Keyspace decreases exponentially.
  • Keyspace decreases proportionally.
  • Keyspace increases exponentially.

Explanation: Encryption is an important technology used to protect confidentiality. It is important to understand the characteristics of the various encryption methodologies.

65. You have been asked to describe data validation to the data entry clerks in accounts receivable. Which of the following are good examples of strings, integers, and decimals?

  • 800-900-4560, 4040-2020-8978-0090, 01/21/2013
  • male, $25.25, veteran
  • female, 9866, $125.50
  • yes/no 345-60-8745, TRF562

Explanation: A string is a group of letters, numbers and special characters. An integer is whole number. A decimal is a number that is not a fraction.

66. Which hashing technology requires keys to be exchanged?

  • salting
  • AES
  • HMAC
  • MD5

Explanation: The difference between HMAC and hashing is the use of keys.

67. What is a feature of a cryptographic hash function?

  • Hashing requires a public and a private key.
  • The hash function is a one-way mathematical function.
  • The output has a variable length.
  • The hash input can be calculated given the output value.

Explanation: Data integrity is one of the three guiding security principles. A cybersecurity specialist should be familiar with the tools and technologies used ensure data integrity.

68. A VPN will be used within the organization to give remote users secure access to the corporate network. What does IPsec use to authenticate the origin of every packet to provide data integrity checking?

  • salting
  • HMAC
  • CRC
  • password

Explanation: HMAC is an algorithm used to authenticate. The sender and receiver have a secret key that is used along with the data to ensure the message origin as well as the authenticity of the data.

69. Your risk manager just distributed a chart that uses three colors to identify the level of threat to key assets in the information security systems. Red represents high level of risk, yellow represents average level of threat and green represents low level of threat. What type of risk analysis does this chart represent?

  • quantitative analysis
  • exposure factor analysis
  • loss analysis
  • qualitative analysis

Explanation: A qualitative or quantitative risk analysis is used to identify and prioritize threats to the organization.

70. Keeping data backups offsite is an example of which type of disaster recovery control?

  • management
  • preventive
  • detective
  • corrective

Explanation: A disaster recovery plan enables an organization to prepare for potential disasters and minimize the resulting downtime.

71. What are two incident response phases? (Choose two.)

  • detection and analysis
  • confidentiality and eradication
  • prevention and containment
  • mitigation and acceptance
  • containment and recovery
  • risk analysis and high availability

Explanation: When an incident occurs, the organization must know how to respond. An organization needs to develop an incident response plan that includes several phases.

72. The team is in the process of performing a risk analysis on the database services. The information collected includes the initial value of these assets, the threats to the assets and the impact of the threats. What type of risk analysis is the team performing by calculating the annual loss expectancy?

  • quantitative analysis
  • qualitative analysis
  • loss analysis
  • protection analysis

Explanation: A qualitative or quantitative risk analysis is used to identify and prioritize threats to the organization.

73. What approach to availability provides the most comprehensive protection because multiple defenses coordinate together to prevent attacks?

  • obscurity
  • limiting
  • layering
  • diversity

Explanation: Defense in depth utilizes multiple layers of security controls.

74. Which utility uses the Internet Control Messaging Protocol (ICMP)?

  • NTP
  • ping
  • RIP
  • DNS

Explanation: ICMP is used by network devices to send error messages.

75. In a comparison of biometric systems, what is the crossover error rate?

  • rate of false positives and rate of acceptability
  • rate of false negatives and rate of false positives
  • rate of rejection and rate of false negatives
  • rate of acceptability and rate of false negatives

Explanation: In comparing biometric systems, there are several important factors to consider including accuracy, speed or throughput rate, and acceptability to users.

76. Which protocol would be used to provide security for employees that access systems remotely from home?

  • WPA
  • SSH
  • SCP
  • Telnet

Explanation: Various application layer protocols are used to for communications between systems. A secure protocol provides a secure channel over an unsecured network.

77. Which threat is mitigated through user awareness training and tying security awareness to performance reviews?

  • user-related threats
  • device-related threats
  • cloud-related threats
  • physical threats

Explanation: Cybersecurity domains provide a framework for evaluating and implementing controls to protect the assets of an organization. Each domain has various countermeasures available to manage threats.

78. HVAC, water system, and fire systems fall under which of the cybersecurity domains?

  • device
  • network
  • physical facilities
  • user

Explanation: Cybersecurity domains provide a framework for evaluating and implementing controls to protect the assets of an organization.

79. Technologies like GIS and IoE contribute to the growth of large data stores. What are two reasons that these technologies increase the need for cybersecurity specialists? (Choose two.)

  • They require 24-hour monitoring.
  • They collect sensitive information.
  • They contain personal information.
  • They increase processing requirements.
  • They require more equipment.
  • They make systems more complicated.

Explanation: The types of information collected by these technologies have increased the need for data protection.

80. Which two groups of people are considered internal attackers? (Choose two.)

  • ex-employees
  • amateurs
  • black hat hackers
  • hacktivists
  • trusted partners

Explanation: Threats are classified as being from an internal source or external source. A cybersecurity specialist needs to be aware of the source of various threats.

81. Which methods can be used to implement multifactor authentication?

  • IDS and IPS
  • tokens and hashes
  • VPNs and VLANs
  • passwords and fingerprints

Explanation: A cybersecurity specialist must be aware of the technologies available that support the CIA triad.

82. A security specialist is asked for advice on a security measure to prevent unauthorized hosts from accessing the home network of employees. Which measure would be most effective?

  • Implement a firewall.
  • Implement intrusion detection systems.
  • Implement a VLAN.
  • Implement RAID.

Explanation: Protecting data confidentiality requires an understanding of the technologies used to protect data in all three data states.

83. What type of attack will make illegitimate websites higher in a web search result list?

  • DNS poisoning
  • browser hijacker
  • spam
  • SEO poisoning

Explanation: A cybersecurity specialist needs to be familiar with the characteristics of the different types of malware and attacks that threaten an organization.

84. What is a nontechnical method that a cybercriminal would use to gather sensitive information from an organization?

  • man-in-the-middle
  • social engineering
  • pharming
  • ransomeware

Explanation: A cybersecurity specialist needs to be familiar with the characteristics of the different types of malware and attacks that threaten an organization.

85. Which algorithm will Windows use by default when a user intends to encrypt files and folders in an NTFS volume?

  • RSA
  • DES
  • AES
  • 3DES

Explanation: Encryption is an important technology used to protect confidentiality. It is important to understand the characteristics of the various encryption methodologies.

86. Before data is sent out for analysis, which technique can be used to replace sensitive data in nonproduction environments to protect the underlying information?

  • data masking substitution
  • steganography
  • software obfuscation
  • steganalysis

Explanation: Technologies exist to confuse attackers by changing data and using techniques to hide the original data.

87. An organization plans to implement security training to educate employees about security policies. What type of access control is the organization trying to implement?

  • administrative
  • technological
  • physical
  • logical

Explanation: Access control prevents an unauthorized user from gaining access to sensitive data and networked systems. There are several technologies used to implement effective access control strategies.

88. Passwords, passphrases, and PINs are examples of which security term?

  • authorization
  • access
  • authentication
  • identification

Explanation: Authentication methods are used to strengthen access control systems. It is important to understand the available authentication methods.

89. What technique creates different hashes for the same password?

  • SHA-256
  • HMAC
  • CRC
  • salting

Explanation: Data integrity is one of the three guiding security principles. A cybersecurity specialist should be familiar with the tools and technologies used to ensure data integrity.

90. You have been asked to implement a data integrity program to protect data files that need to be electronically downloaded by the sales staff. You have decided to use the strongest hashing algorithm available on your systems. Which hash algorithm would you select?

  • SHA-1
  • AES
  • MD5
  • SHA-256

Explanation: MD5 and SHA are the two most popular hashing algorithms. SHA-256 uses a 256-bit hash, whereas MD5 produces a 128-bit hash value.

91. What kind of integrity does a database have when all its rows have a unique identifier called a primary key?

  • entity integrity
  • referential integrity
  • domain integrity
  • user-defined integrity

Explanation: Data integrity is one of the three guiding security principles. A cybersecurity specialist should be familiar with the tools and technologies that are used to ensure data integrity.

92. What approach to availability involves using file permissions?

  • layering
  • simplicity
  • obscurity
  • limiting

Explanation: System and data availability is a critical responsibility of a cybersecurity specialist. It is important to understand the technologies, process, and controls used to protect provide high availability.

93. Which national resource was developed as a result of a U.S. Executive Order after a ten-month collaborative study involving over 3,000 security professionals?

  • ISO OSI model
  • NIST Framework
  • ISO/IEC 27000
  • the National Vulnerability Database (NVD)

Explanation: There are many tools that a cybersecurity specialist uses to evaluate the potential vulnerabilities of an organization.

94. Which two protocols pose switching threats? (Choose two.)

  • RIP
  • IP
  • ICMP
  • WPA2
  • STP
  • ARP

Explanation: Network switches are the heart of the modern data communication network. The main threats to network switches are theft, hacking and remote access, and attacks against network protocols.

95. What is the most difficult part of designing a cryptosystem?

  • encryption algorithm
  • reverse engineering
  • key length
  • key management

Explanation: Encryption is an important technology used to protect confidentiality. It is important to understand the characteristics of the various encryption methodologies.

96. What technology should you implement to ensure that an individual cannot later claim that he or she did not sign a given document?

  • asymmetric encryption
  • digital certificate
  • digital signature
  • HMAC

Explanation: A digital signature is used to establish authenticity, integrity, and nonrepudiation.

97. Which type of cybercriminal attack would interfere with established network communication through the use of constructed packets so that the packets look like they are part of the normal communication?

  • packet sniffing
  • DNS spoofing
  • packet forgery
  • rogue Wi-Fi AP

98. An organization just completed a security audit. Your division was cited for not conforming to X.509 requirements. What is the first security control you need to examine?

  • VPNs and encryption services
  • hashing operations
  • data validation rules
  • digital certificates

99. What technology can be implemented as part of an authentication system to verify the identification of employees?

  • a virtual fingerprint
  • a smart card reader
  • SHA-1 hash
  • a Mantrap

100. Which technology can be used to prevent a cracker from launching a dictionary or brute-force attack of a hash?
Which technology could be used to prevent a cracker from launching a dictionary or brute-force attack off a hash?

  • AES
  • MD5
  • HMAC
  • rainbow tables

Explanation: HMACs use an additional secret key as input to the hash function. This adds another layer of security to the hash in order to defeat man-in-the-middle attacks and provide authentication of the data source.

101. Which technology can be implemented as part of an authentication system to verify the identification of employees?

  • a smart card reader
  • SHA-1 hash
  • a virtual fingerprint
  • a Mantrap

Explanation: A cybersecurity specialist must be aware of the technologies available that support the CIA triad.


guest

2 Comments
Inline Feedbacks
View all comments
hackerstein
hackerstein
5 months ago

Which type of cybercriminal attack would interfere with established network communication through the use of constructed packets so that the packets look like they are part of the normal communication?

  1. packet sniffing
  2. DNS spoofing
  3. packet forgery (correct)
  4. rogue Wi-Fi AP

An organization just completed a security audit. Your division was cited for not conforming to X.509 requirements. What is the first security control you need to examine?

  1. VPNs and encryption services
  2. hashing operations
  3. data validation rules
  4. digital certificates (correct)

What technology can be implemented as part of an authentication system to verify the identification of employees?

  1. a virtual fingerprint
  2. a smart card reader (correct)
  3. SHA-1 hash
  4. a Mantrap

Which technology can be used to prevent a cracker from launching a dictionary or brute-force attack of a hash?

  1. AES
  2. MD5
  3. HMAC (correct)
  4. rainbow tables
2
0
Would love your thoughts, please comment.x