Q51: You experienced a power outage that disrupted access to your data center. What type of security concern occurred?
A. Availability
B. Confidentiality
C. Non-Repudiation
D. Integrity
Q52: What federal law requires the use of vulnerability scanning on information systems operated by federal government agencies?
A. FISMA
B. HIPAA
C. GLBA
D. FERPA
Q53: What is multi-factor authentication (MFA)?
A. A type of authentication that uses only one method
B. A type of authentication that uses only two methods
C. A type of authentication that uses more than two methods
D. A type of authentication that uses only one factor
Q54: Natalia is concerned that users on her network may be storing sensitive information, such as social security numbers, on their hard drives without proper authorization or security controls. What 3rd-party security service can she implement to best detect this activity?
A. IDS - Intrusion Detection System
B. IPS - Intrusion Prevention System
C. DLP - Data Loss Protection
D. TLS - Transport Layer Security
Q55: Duke would like to restrict users from accessing a list of prohibited websites while connected to his network. Which one of the following controls would BEST achieve his objective?
A. URL Filter
B. IP Address Block
C. DLP Solution
D. IPS Solution
Q56: What is privacy in the context of Information Security?
A. Protecting data from unauthorized access
B. Ensuring data is accurate and unchanged
C. Making sure data is always accessible when needed.
D. Disclosed without their consent
Q57: Some Employees of his organization launched a privilege escalation attack to gain root access to one of the organization’s database servers. The employee does have an authorized user account on the server. What log file would be MOST likely to contain relevant information?
A. Database application log
B. Firewall log
C. Operating system log
D. IDS log
Q58: Which of the following best describes a zero-day vulnerability?
A. A vulnerability that has been identified and patched by software vendors.
B. A vulnerability that has not yet been discovered or publicly disclosed.
C. A vulnerability that can only be exploited by experienced hackers.
D. A vulnerability that affects only legacy systems.
Q59: Mark is configuring an automated data transfer between two hosts and is choosing an authentication technique for one host to connect to the other host. What approach would be best- suited for this scenario?
A. Biometric
B. Smart Card
C. SSH Key
D. Hard Coded Password
Q60: Natalia is concerned about the security of his organization’s domain name records and would like to adopt a technology that ensures their authenticity by adding digital signatures. Select the MOST appropriate technology to use.
A. DNSSIGN
B. DNSSEC
C. CERTDNS
D. DNS2
Q61: What cybersecurity principle focuses on granting users only the privileges necessary to perform their job functions?
A) Least privilege
B) defense in dexterity
C) separation of duties
D) need-to-know basis
Q62: What is the primary purpose of a firewall in network security?
A. Encrypt data transmissions
B. Prevent unauthorized access
C. Monitor network traffic
D. Backup critical data
Q63: What is the primary goal of a risk management process in cybersecurity?
A) to eliminate all cybersecurity risks
B) to transfer all cybersecurity risks to a third-party
C) to identify, assess, and mitigate cybersecurity risks to an acceptable level
D) to ignore cybersecurity risks and focus on incident response
Q64: What is the main purpose of using digital signatures in communication security?
A) To encrypt sensitive data during transmission
B) To verify the identity of the sender and ensure the integrity of the message
C) To prevent unauthorized access to a network
D) To compress data to reduce bandwidth usage
Q65: What is the primary goal of implementing input validation in application security?
A) To ensure all inputs are stored in a secure database
B) To prevent unauthorized access to the application
C) To validate and sanitize user inputs to prevent code injection attacks
D) To encrypt sensitive data transmitted between the client and server
Q66: Which of the following is a common security measure to prevent Cross- Site Scripting (XSS) attacks
in web applications?
A) implementing strong password policies
B) using a firewall to block incoming traffic
C) validating and sanitizing user input
D) encrypting data during transmission
Q67: Which of the following attacks can TLS help mitigate?
A) Cross-site Scripting (XSS) Attacks
B) Social Engineering Attacks
C) Man-in-the-middle (MITM) Attacks
D) SQL Injection Attacks
Q68: Which version of TLS is considered to be the most secure and recommended for use?
A) TLS 1.0
B) TLS 1.1
C) TLS 1.2
D) TLS 1.3
Q69: What is the main purpose of using multi-factor authentication (MFA) in a security system?
a) To prevent data breaches
b) To protect against malware
c) To ensure data integrity
d) To add an extra layer of security to user authentication
Q70: Which one of the following regulations provides strict, detailed procedures for the use of compensating controls?
A. PCI DSS
B. HIPAA
C. GLBA
D. FERPA
Q71: Mrs. Casendra is installing a new Data Loss Protection (DLP) solution for her organization. What category of control is she installing?
A. Technical
B. Operational
C. Managerial
D. Detective
Q72. Sasa is configuring her organization’s firewall to support the secure remote retrieval of email using the IMAPS protocol. What port should she allow?
A. TCP Port 993
B. TCP Port 143
C. UDP Port 993
D. UDP Port 143
Q73. Tom would like to amend his organization’s exit interview process to protect against former employees leaking sensitive information. Which one of the following approaches would best meet his needs?
A. Asking employees to sign an NDA before departure
B. Threatening employees with legal action if they violate the NDA
C. Reminding employees of the NDA that they signed upon employment
D. No action is appropriate
Q74. Fred would like to implement a new security platform that can coordinate access policies across the many cloud providers used by his organization. What technology would best meet his needs?
A. CASB
B. SIEM
C. NGEP
D. NGFW
Q75. In the context of the CIA triad, which aspect ensures that data is accurate and reliable?
A) Confidentiality
B) Integrity
C) Availability
D) Authentication
Q76. Which encryption algorithm is commonly used to secure web communication (HTTPS)?
A) RSA
B) DES
C) AES
D) HMAC
Q77. What security mechanism verifies the identity of a user or system attempting to access a network?
A) Firewall
B) Intrusion Detection System (IDS)
C) Authentication
D) Encryption
Q78. What type of address uniquely identifies a network interface card (NIC) on a TCP/IP network?
A) MAC address
B) IP address
C) DNS address
D) Port address
Q79. Which HTTP request method is considered safe and should only be used for retrieving data, not modifying it?
A) GET
B) POST
C) PUT
D) DELETE
Q80. What does the "Same-Origin Policy" help protect against in web security?
A) Unauthorized access to a user’s data
B) SQL Injection attacks
C) Clickjacking attacks
D) Cross-site scripting (XSS) attacks
| Answer Sheet | |
| Question Number | Answer |
| 51 | A |
| 52 | A |
| 53 | C |
| 54 | C |
| 55 | A |
| 56 | A |
| 57 | C |
| 58 | B |
| 59 | C |
| 60 | B |
| 61 | A |
| 62 | B |
| 63 | C |
| 64 | B |
| 65 | C |
| 66 | C |
| 67 | C |
| 68 | D |
| 69 | D |
| 70 | A |
| 71 | A |
| 72 | A |
| 73 | C |
| 74 | A |
| 75 | B |
| 76 | C |
| 77 | C |
| 78 | A |
| 79 | A |
| 80 | A |