Introduction to Cybersecurity: Course Final Exam Answers

Explanation: Topic 4.1.3

A Network address translation (NAT) firewall is specifically designed to hide or masquerade the private addresses of network hosts, protecting internal network identities from the public internet.

Explanation: Topic 2.2.10
An Advanced Persistent Threat (APT) is defined as a multi-phase, long-term, and stealthy operation directed at a specific target. Its primary goal is to deploy customized malware and maintain unauthorized access to the target's systems while remaining undetected for an extended period.

Explanation: Topic 1.2.2
Confidentiality is a set of rules that prevents sensitive information from being disclosed to unauthorized people, resources and processes. Methods to ensure confidentiality include data encryption, identity proofing and two factor authentication.

Explanation: Topic 1.2.2
The objectives for data integrity include data not being altered during transit and not being changed by unauthorized entities. Authentication and encryption are methods to ensure confidentiality. Data being available all the time is the goal of availability.

Explanation: Topic 1.2.2

Adding web servers for load balancing and redundancy ensures that authorized users can consistently access systems and data when needed, even during periods of overwhelming traffic or hardware failure, which fulfills the Availability principle of the McCumber Cube.

Explanation: Topic 2.2.8

These four techniques are specific methods used to uncover or crack passwords: brute-force attacks try every possible character combination; dictionary attacks systematically test words from a list; spraying uses common passwords across many different accounts; and rainbow tables utilize a dictionary of precomputed hashes to identify passwords without calculating each hash individually.

Explanation: Topic 2.3.3
Access control involves managing who can access resources, ranging from physical access to equipment to dictating who can read or change a file. Improper management of these controls creates security vulnerabilities because an attacker with physical access can bypass standard operating system protections to read data directly from a disk.

Explanation: Topic 1.1.4
An email message is transmitted in plain text and can be read by anyone who has access to the data while it is en route to a destination. Patient records include confidential or sensitive information that should be transmitted in a secure manner.

Explanation: Topic 3.1.2
To prevent malicious software like spyware from being installed on a machine, the sources explicitly state that you should only ever download software from trusted websites. While using antivirus software and keeping your operating system and browser updated provide essential additional layers of protection against vulnerabilities, downloading from trusted sources is the primary method to avoid the initial infection.

Explanation: Topic 3.1.4
You should always verify that your device isn’t configured with file and media sharing and that it requires user authentication with encryption.

Explanation: Topic 4.3.1
The primary function of the Cisco Security Incident Response Team (CSIRT) is to receive, review, and respond to security incident reports. Beyond reactive measures, they perform proactive threat assessments and mitigation planning specifically to prevent incidents and ensure the preservation of the organization’s systems and data.

Explanation: Topic 4.1.3
Placed in front of web servers, reverse proxy servers protect, hide, offload and distribute access to web servers.

Explanation: Topic 5.2.2
This is an entry-level security certification that meets the U.S. Department of Defense Directive 8570.01-M requirements, which is an important item for anyone looking to work in IT security for the federal government.

Explanation: Topic 5.1.2
Lending an identification badge is unethical because it bypasses access control, which is the formal process of managing physical access to an organization's equipment and resources. While the intention to help a colleague is positive, cybersecurity ethics require professionals to act within the bounds of policy and the law to protect the organization's data and reputation. Such behavior creates a security vulnerability and does not comply with established security practices.

Explanation: Topic 5.2.2
This certification tests your understanding and knowledge of how to look for weaknesses and vulnerabilities in target systems using the same knowledge and tools as a malicious hacker but in a lawful and legitimate manner.

Explanation: Topic 1.5.2
The main reason for resorting to cyberwarfare is to gain advantage over adversaries, whether they are nations or competitors.

Explanation: Topic 2.3.3

A race condition is a software vulnerability that occurs when the output of an event is dependent on the specific ordering or timing of outputs. It becomes a security risk if the required events do not happen in the correct sequence or at the intended time.

Explanation: Topic 2.3.1
Google security researchers discovered Meltdown and Spectre, which are two hardware design flaws affecting nearly all CPUs released since 1995. These vulnerabilities allow attackers to perform side-channel attacks to read sensitive data from system memory or information handled by other applications.

Explanation: Topic 2.3.3
Systems and sensitive data can be protected through techniques such as authentication, authorization and encryption. Developers should stick to using security techniques and libraries that have already been created, tested and verified and should not attempt to create their own security algorithms. These will only likely introduce new vulnerabilities.

Explanation: Topic 3.4.2
Open Authorization is an open standard protocol that allows end users to access third party applications without exposing their user passwords.

Explanation: Topic 3.4.1
Biometrics verify identity using unique physical or behavioral characteristics. According to the sources, fingerprints and voice recognition (along with facial recognition) are specific examples of biometric scans, whereas devices like phones, credit cards, or fobs are classified as physical objects used for authentication.

Explanation: Topic 4.1.3
A Network layer firewall is designed to filter communications specifically based on source and destination IP addresses. Other firewalls use different criteria, such as data ports for the Transport layer or specific applications for the Application layer.

Explanation: Topic 4.1.3
A proxy server is a specific type of firewall that filters web content requests, such as URLs, domain names, and media types, to control what web traffic is allowed into or out of a network.

Explanation: Topic 4.1.5
A ‘dropped’ response (also referred to as ‘filtered’ or ‘blocked’) means that access to the port or service is blocked by a firewall. In this state, the firewall or security appliance discards the probing packet without sending a response, ensuring the port cannot be reached or exploited.

Explanation: Topic 5.1.2
Sharing information on a new product to the Marketing department of the same company is ethical behavior. It gives them ample lead time to begin development of a marketing plan for the new product.

Explanation: Topic 5.2.2
This is an entry-level certification for newcomers who are preparing to start their career in the cybersecurity field.

Explanation: Topic 5.2.2
The sources explicitly state that cybersecurity certifications serve as a "great way" to verify your skills and knowledge while simultaneously boosting your career. Various organizations like Cisco, CompTIA, and the SANS Institute offer these certifications to help professionals validate their expertise at different career stages.

Explanation: Topic 2.1.1
Malware can be classified as follows:
Virus (self-replicates by attaching to another program or file)
Worm (replicates independently of another program)
Trojan horse (masquerades as a legitimate file or program)
Rootkit (gains privileged access to a machine while concealing itself)
Spyware (collects information from a target system)
Adware (delivers advertisements with or without consent)
Bot (waits for commands from the hacker)
Ransomware (holds a computer system or data captive until payment isreceived)

Explanation: Topic 5.1.2

Sharing documents and product ideas from a previous employer is unethical because it violates the protection of intellectual property and trade secrets, which are critical for an organization's economic advantage. Professional ethics require employees to safeguard an organization’s data and reputation even after leaving, and using proprietary information to benefit a competitor is a breach of that responsibility.

Explanation: Topic 4.1.3
A Context aware application firewall (referred to as a context aware layer firewall in the sources) filters network communications by analyzing specific parameters such as the user, device, role, application type, and threat profile. This provides more sophisticated security than basic firewalls that only filter by IP addresses or ports.

Explanation: Topic 2.4.1
Cryptocurrency owners keep their money in encrypted, virtual ‘wallets.’ When a transaction takes place between the owners of two digital wallets, the details are recorded in a decentralized, electronic ledger or blockchain system. This means it is carried out with a degree of anonymity and is self-managed, with no interference from third parties such as central banks or government entities.

Explanation: Topic 1.2.2
Processing refers to data that is being used to perform an operation such as updating a database record (data in process).
Storage refers to data stored in memory or on a permanent storage device such as a hard drive, solid-state drive or USB drive (data at rest).
Transmission refers to data traveling between information systems (data in transit).

Explanation: Topic 1.2.5

Internet-based cameras and gaming gear are highly susceptible to security breaches. For example, in 2017, the Persirai botnet hijacked over 122,000 IP cameras from various manufacturers to perform distributed denial-of-service (DDoS) attacks. Similarly, the elite gaming brand Razer experienced a data breach in 2020 that exposed the personal information of roughly 100,000 customers. These IoT devices often pose a greater risk than traditional computing devices because they frequently run original, unpatched software that contains vulnerabilities.

Explanation: Topic 2.3.3
A buffer overflow occurs when data is written beyond the limits of a buffer, which is a memory area specifically allocated to an application. This vulnerability allows an application to access or overwrite memory reserved for other processes, potentially leading to system crashes, data compromise, or unauthorized escalation of privileges.

Explanation: Topic 2.2.3

A Distributed Denial-of-Service (DDoS) attack occurs when multiple, coordinated sources simultaneously flood the resources of a targeted system, such as a web server. By sending an overwhelming quantity of traffic that the server cannot handle, the attacker causes a slowdown or a complete crash of the service.

Explanation: Topic 4.1.5
Two popular network discovery and port scanning applications are Network Mapper (Nmap) and Zenmap.

Explanation: Topic 4.1.7
An IDS, or intrusion detection system, is a device that can scan packets and compare them to a set of rules or attack signatures. If the packets match attack signatures, then the IDS can create an alert and log the detection.

Explanation: Topic 1.1.1

Cybersecurity is defined as the ongoing effort to protect individuals, organizations, and governments from digital attacks by safeguarding networked (Internet-connected) systems and data from unauthorized use or harm. It is a continuous process rather than a single application or fixed framework.

Explanation: Topic 4.2.5

One of the key actions an organization should take after identifying a security breach is to raise awareness, train, and educate employees, partners, and clients on how to prevent future breaches. This step is part of a comprehensive impact reduction strategy to ensure that lessons learned from the incident are applied to improve the organization's future security posture.

Explanation: Topic 5.1.2
This behavior is ethical because at an organizational level, it is everyone’s responsibility to protect the organization’s reputation, data and customers. Pointing out a design flaw is a proactive action that allows the organization to address potential vulnerabilities before they can be exploited, thereby preserving the organization’s systems and data.

Explanation: Topic 2.3.3
Non-validated input is a software vulnerability that occurs when data entering a program is not properly sanitized, allowing it to contain malicious content designed to force the program to behave in an unintended way. An example of this exploit is a user providing a file with invalid dimensions to force a program to allocate buffers of incorrect and unexpected sizes.

Explanation: Topic 2.2.5
An on-path attack is a method of infiltration where an attacker intercepts or modifies communications between two devices to collect sensitive information or impersonate one of the devices. The sources explicitly state that this type of attack is also referred to as a Man-in-the-Middle (MitM) or a Man-in-the-Mobile (MitMo) attack.

Explanation: Topic 4.1.3
An Application layer firewall filters network communications based on the specific application, program, or service attempting to transmit data. While other firewalls might look at IP addresses or data ports, this type focuses on the actual software or service level to determine if traffic should be allowed.

Explanation: Topic 4.1.5

A ‘closed’ response (which the sources also group with ‘denied’ or ‘not listening’) indicates that the specific port or service is not running on the target computer. Because the service is not active, any attempt to connect to that port is rejected, and the port cannot be exploited by an attacker.

Explanation: Topic 2.4.1

Cryptocurrency is defined as digital money used to buy goods and services through secured online transactions. These transactions occur between digital wallets and are recorded in a decentralized electronic ledger known as a blockchain, which is updated and disseminated electronically worldwide.

Explanation: Topic 2.4.1

Cryptocurrency is defined as digital money designed to act as a medium of exchange for goods and services. It utilizes strong encryption techniques to secure financial transactions, which are recorded in a decentralized electronic ledger known as a blockchain.

Explanation: Topic 4.3.2
Although each of these tools is useful for securing networks and detecting vulnerabilities, only an IDS and NetFlow logging can be used to detect anomalous behavior, command and control traffic, and infected hosts.

Explanation: Topic 2.2.4

A botnet is a group of bots (infected computers) connected via the Internet that are controlled by a malicious individual or group, typically through a command and control server. While individual infected hosts are called zombies, the entire group functioning together is known as a botnet.

Explanation: Topic 3.1.2
The best approach to protect a data network from a possibly compromised IoT device is to place all IoT devices on an isolated network that only has access to the Internet.

Explanation: Topic 2.4.2

Cryptojacking is defined as an emerging threat that hides on various devices—including computers, mobile phones, and servers—and uses that machine’s resources to 'mine’ cryptocurrencies without the user's consent or knowledge. This type of attack is on the rise because it allows cybercriminals to profit from hijacked hardware while often remaining undetected by the victim.

Explanation: Topic 4.1.5

An ‘open’ or ‘accepted’ response from a port scan indicates that a port or service is running on the computer and can be accessed by other network devices. This confirms that a specific service is actively listening on that port for incoming communications.

Explanation: Topic 5.1.2

Sharing information about a product under development with unauthorized individuals is unethical because it risks disclosing intellectual property and trade secrets, which are essential for an organization to maintain its economic advantage. Every employee has a fundamental responsibility to protect the organization’s data, reputation, and product plans from unauthorized disclosure.

Explanation: Topic 2.2.10

An Advanced Persistent Threat (APT) is described as a multi-phase, long-term, and stealthy operation against a specific target. Due to the high level of complexity and specialized skill required to remain undetected on a target's systems for long periods, an APT is usually well-funded and typically targets organizations or nations for business or political reasons.

Explanation: Topic 4.1.5
In networking, every application running on a device is assigned a specific port number. This identifier is used at both ends of a transmission to ensure that data is passed to the intended application rather than another process on the same device.

Explanation: Topic 5.1.1

Organizations are required to abide by cybersecurity laws in the countries where they operate. If an employee breaks these laws while performing their duties as a representative of the organization, the company can be held legally responsible and may be punished.

Explanation: Topic 4.2.1
Administrators can use a tool called a honeypot to lure an attacker so that their behavior can be analyzed.

Explanation: Topic 1.2.6

A data breach can have a severe and negative long-term impact on an organization’s reputation that took years to build. Such incidents often lead to a loss of trust from customers, who may seek compensation or switch to more secure competitors, and can even cause employees to leave the organization.

Explanation: Topic 5.2.2

The sources explicitly state that the Cisco Certified Support Technician (CCST) Cybersecurity certification is an entry-level credential aimed at high school and early college students, as well as anyone interested in a career change. Although this specific certification was not included in your list, it is the one that matches your description according to the provided material.

Explanation: Topic 4.1.3

A Transport layer firewall is specifically designed to filter communications based on source and destination data ports, as well as the connection states of the network traffic. Other firewalls, like the Network layer firewall, focus instead on source and destination IP addresses.

Explanation: Topic 1.2.2

According to the McCumber Cube model, there are three primary categories of security measures used to protect data: Awareness, training and education (ensuring users can recognize and respond to threats), Technology (software and hardware solutions like firewalls), and Policy and procedure (administrative controls and established guidelines). While firewalls are a security measure, they are classified under the broader category of Technology.

Explanation: Topic 2.2.4

A botnet consists of a group of internet-connected "bots" controlled by a malicious individual or group. These networks are highly scalable and can indeed contain tens of thousands, or even hundreds of thousands, of infected hosts. A real-world example is the Persirai botnet, which hijacked over 122,000 IP cameras to carry out large-scale attacks.

Explanation: Topic 4.1.5
Nmap allows an administrator to perform port scanning to probe computers and the network for open ports. This helps the administrator verify that network security policies are in place.

Explanation: Topic 5.2.2

The Cisco Certified Support Technician (CCST) Cybersecurity is the entry-level certification that does not expire or require periodic recertification. It is specifically geared towards newcomers, including high school students, early college students, and those interested in a career change. While other certifications like CompTIA Security+ or EC Council CEH are mentioned, the sources do not attribute these specific non-expiring characteristics to them.

Explanation: Topic 2.2.3
A Distributed DoS (DDoS) attack is similar to a DoS attack but originates from multiple, coordinated sources. For example:

• An attacker builds a network (botnet) of infected hosts called zombies, which are controlled by handler systems.
• The zombie computers will constantly scan and infect more hosts, creating more and more zombies.
• When ready, the hacker will instruct the handler systems to make the botnet of zombies carry out a DDoS attack.

Explanation: Topic 2.1.1
A backdoor is a type of malware designed to bypass a system's standard security measures. Its primary purpose is to allow hackers to gain unauthorized remote access to resources and issue system commands while working undetected in the background.

Explanation: Topic 4.1.3
A host-based firewall is specifically designed to run on a single computer with the purpose of protecting that one device by filtering ports and system service calls on its operating system. Other firewall types, such as network layer or transport layer firewalls, typically focus on filtering external network traffic based on IP addresses or connection states.

Explanation: Topic 2.2.3
DDoS, or distributed denial of service, attacks are used to disrupt service by overwhelming network devices with bogus traffic.

Explanation: Topic 2.4.1
Cryptocurrency transactions are recorded in a decentralized electronic ledger known as a blockchain. This system is self-managed and operates with no interference from third parties such as central banks or government entities, meaning it does not rely on a centralized exchange.

Explanation: Topic 2.1.1
Worms are malicious code that replicates by independently exploiting vulnerabilities in networks. Worms usually slow down networks. Whereas a virus requires a host program to run, worms can run by themselves. Other than the initial infection, worms no longer require user participation. After a worm affects a host, it is able to spread very quickly over the network. Worms share similar patterns. They all have an enabling vulnerability, a way to propagate themselves, and they all contain a payload.

Explanation: Topic 2.2.10

A cyber kill chain identifies the various stages of a cyber attack. According to the sources, an Advanced Persistent Threat (APT) is a prime example of this planned process, as it is a multi-phase, long-term, and stealthy operation directed at a specific target. These highly organized attacks move through specific steps to deploy customized malware and remain undetected on a system for business or political gain.

Explanation: Topic 4.2.6

Risk management is the formal and continuous process of identifying and assessing risks to an organization. Its primary goal is to reduce the impact of threats and vulnerabilities to an acceptable level by weighing the impact of a threat against the cost of implementing security controls.

Explanation: Topic 1.2.1
Sharing documents and product ideas from a previous employer is unethical because it violates the protection of intellectual property and trade secrets, which are critical for an organization’s economic advantage. Professional ethics require employees to safeguard an organization’s data and reputation even after leaving, and using proprietary information to benefit a competitor is a breach of that responsibility.

Explanation: Topic 4.2.3
It is the first stage, reconnaissance, of the the kill chain that focuses on the identification and selection of targets.

Explanation: Topic 5.1.1

According to the source material, organizations must abide by the cybersecurity laws of the countries where they operate. If an employee breaks these laws while performing their job as a representative of the organization, the company itself can be held legally responsible and may face punishment. Although you indicated the answer should be False, the provided text explicitly states that the organization may be punished for illegal actions taken by an employee during their work.

Explanation: Topic 3.4.5

Each major web browser has a specific name for its private browsing mode. According to the sources, Google Chrome uses the term Incognito. When this mode is enabled, the browser disables cookies and deletes your browsing history and temporary internet files once the window or program is closed.

Explanation: Topic 2.2.5
A Man-in-the-Mobile (MITMO) attack is a specific variation of an On-Path attack. This infiltration method allows attackers to compromise a user's mobile device to intercept and exfiltrate sensitive data, including two-step verification SMS messages.

Explanation: Topic 1.2.2
Confidentiality ensures that data is accessed only by authorized individuals. Authentication will help verify the identity of the individuals.