Sec+ Practice Exam #ALPHA

Reed & Jamario Security Services has recommended your company use a port based system to prevent unauthorized users and devices. Which of the following are they recommending? A. 802.1X B. Fail-closed C. IDS D. Fail-open

A. 802.1X 802.1x is a standard developed by the IEEE to govern port-based network access. When used with a RADIUS based authentication server it provides authentication services, checking user credentials to ensure that the user is a legitimate part of the organization and granting access to only those areas of the system that the user is allowed to access. Fail-open refers to what happens when a network encounters errors and exceptions. Fail-open means that when errors occur or exceptions are encountered, the system continues allowing access rather than denying access. Fail-open allows a website to continue offering services even after an error has occurred. The emphasis is, therefore, keeping the website up while the error is addressed, hoping that the error is a minor issue. An intrusion detection system (IDS) monitors network traffic for malicious activities. It alerts to the potential activity but does not prevent it from passing through the network. In this way, it provides a layer of protection without slowing down network performance. Fail-close refers to what happens when a network encounters errors and exceptions. Fail-close means that when errors occur or exceptions are encountered, the system denies further access. This prevents any further network traffic until the error or exception are dealt with. While this provides greater security, it means that a website can't be accessed even if the error encountered is minor or doesn't pose a security threat.

Florence is the CEO of a company. She has the final say over all decisions made regarding the business, IT, accounting, and other departments. What type of governance does Florence's company have? A. Centralized governance B. Board governance C. Committee governance D. Decentralized governance

A. Centralized governance Centralized governance involves decision-making authority concentrated in a single authority or department within an organization. In this structure, key decisions are made at the top level and are then disseminated throughout the organization. Decentralized governance involves distributing decision-making power among different departments or units within the organization, rather than being concentrated in a single authority. Board governance typically refers to the governing body of an organization, composed of members who represent various stakeholders. The board's role is to oversee the organization's activities, but it may not always involve centralized decision-making power. Committee governance involves decision-making authority vested in committees, which are groups of individuals formed to address specific tasks or issues within the organization. It does not necessarily involve a single authority or department with centralized decision-making power.

Which of the following terms emphasizes the mathematical structure used to scramble data so that only a specific key can unscramble it? A. Encryption algorithm B. Cipher block C. Hash function D. Digital signature

A. Encryption algorithm An encryption algorithm provides a structured method for converting plaintext into ciphertext. A good algorithm ensures data remains confidential and secure from unauthorized access. Digital signatures validate the authenticity and integrity of a message or document, ensuring it hasn't been tampered with since being signed. A cipher block refers to a fixed-size portion of data that an encryption algorithm processes. It doesn't define the mathematical method itself. A hash function takes input and returns a fixed-size string, typically used for verifying data integrity, but it does not encrypt data for the purpose of confidentiality.

Kelly Innovations Corp, an IT company, is implementing a process in encryption where two parties establish a shared secret for communication purposes. Which of the following MOST describes this process? A. Key exchange B. Hashing C. Asymmetric encryption D. Symmetric encryption

A. Key exchange Key exchange is a process in which two communicating parties establish a shared secret key, typically used for symmetric encryption. This key is established in a manner so that eavesdroppers, even if they intercept the key exchange messages, cannot determine the shared key. The most common method for key exchange is the Diffie-Hellman protocol. Asymmetric encryption uses different keys for encryption and decryption, but it doesn't involve the exchange of cryptographic keys. Symmetric encryption the same key for both encryption and decryption, but it doesn't involve the exchange of cryptographic keys. Hashing involves converting input data (often called a message) into a fixed-length string of bytes. It's primarily used for data integrity checks and is not reversible, meaning you cannot retrieve the original input from its hash. Therefore, it isn't suitable for the purpose of exchanging cryptographic keys or establishing shared secrets for communication.

To improve security at their law firm, Norah, a security analyst wants to implement a system that will selectively block or allow traffic based on the nature of the communication. Which firewall type would be MOST effective for this purpose? A. Layer 7 Firewall B. Layer 4 Firewall C. 802.1x D. VPN

A. Layer 7 Firewall A Layer 7 firewall operates at the application layer and can make more granular decisions about the traffic based on the application-payload, which makes it the most effective choice in this scenario. 802.1x is a standard developed by the IEEE to govern port-based network access. When used with a RADIUS based authentication server it provides authentication services, checking user credentials to ensure that the user is a legitimate part of the organization and granting access to only those areas of the system that the user is allowed to access. A Layer 4 Firewall operates at the transport layer which provides less granularity for blocking or allowing traffic based on the application-payload. A VPN provides a secure method for remote operations by creating an encrypted connection over the internet. It establishes a secure tunnel so that data can be securely transferred even over insecure networks.

After remedying a previously identified vulnerability in their systems, Kelly Innovations LLC wants to ensure that the remediation steps were successful. Which of the following the the BEST method that involves examining related system and network logs to enhance the vulnerability report validation process? A. Reviewing event logs B. Rescanning C. Threat modeling D. Patch management

A. Reviewing event logs Event logs can provide insight into system and process behaviors. By examining these logs, an organization can validate whether a vulnerability has been adequately addressed or if it's still causing issues. Rescanning is about running the vulnerability scan again to identify remaining vulnerabilities but doesn't provide insights from system and network logs. While it's about keeping systems updated, patch management itself doesn't involve examining logs to validate vulnerability remediation. Threat modeling is a process of understanding and mapping potential threats but doesn't validate vulnerability remediation through logs.

Lexicon, an AI company, wants to implement a security measure to identify and evaluate potential threats to their systems and networks. Which of the following is an example of a managerial security control that the company could implement? A. Risk assessments B. Firewall C. Intrusion detection system D. Training programs

A. Risk assessments Periodic evaluations, like risk assessments, are a managerial security control that involves regularly evaluating the threats to systems and networks. This can help the company identify potential threats and take steps to mitigate them. Training programs are considered operational controls, not managerial controls. Firewall is a technical security control that monitors and controls incoming and outgoing network traffic based on predetermined security rules. Intrusion detection system is a technical security control that monitors network traffic for signs of security threats.

Dion Training Solutions is aiming to optimize their wide-area network (WAN) while ensuring advanced network management and performance optimization. They are considering a solution that can be deployed both on-premises and in the cloud. Which of the following technologies would BEST match their requirements? A. SD-WAN B. SASE C. AH D. TLS

A. SD-WAN SD-WAN (Software-defined wide area network) provides centralized network management, flexible routing, and traffic management capabilities. It can be hosted both on-premises and in the cloud, giving it an edge for comprehensive WAN optimization. TLS (Transport Layer Security) operates at the application layer and is primarily used for securing application-level communication. It doesn't offer WAN optimization or centralized network management. While SASE offers both network security and WAN capabilities, its primary selling point is as a cloud-based solution that integrates both. It doesn't focus solely on WAN performance optimization. AH (Authentication header) is a protocol component of IPSec which offers packet integrity but does not specifically cater to WAN optimization or management.

You are a security analyst at Dion Training and you discover that an unauthorized device has been connected to the company's network. As you investigate, you discover that the device was added so the employee could play video games during her breaks. What type of threat actor are you dealing with? A. Shadow IT B. Unskilled Actor C. Insider Threat D. Nation-state Actor

A. Shadow IT Shadow IT is a type of threat actor that is the result of unauthorized or unapproved IT systems or devices within an organization. In this case, the device may introduce security risks and compliance issues for an organization, but the employee wasn't intending any harm to the company. Nation-state actors are a type of threat actor that is sponsored by a government or a country's military. They normally have high resources/funding and high level of sophistication/capability, but they are not a part of the organization they attack. An insider threat is a type of threat actor that has authorized access to an organization's network, systems, or data and has variable resources/funding and level of sophistication/capability depending on their role and position. Insider threats can abuse their authorized access, leak information, sabotage operations, or collaborate with external actors. They intend to harm the company by their actions. An unskilled threat actor is one that lacks technical expertise or sophistication. Unskilled attackers often launch simple and opportunistic attacks using tools or scripts developed by others. The employee in this case may be unskilled but but the employee didn't attach the device to cause problems for the company.

Which of the following BEST describes the primary purpose of archiving as a method to bolster security monitoring? A. To provide historical insights into security incidents for future investigations. B. To provide an external backup in case of system crashes C. To analyze real-time threats and mitigate them instantly. D. To maintain compliance with regulations without needing long-term data storage.

A. To provide historical insights into security incidents for future investigations. Archiving in the context of security is essential for maintaining a record of all system logs. This not only ensures that historical data is available for audits or investigations but also provides valuable insights into past incidents, aiding in enhancing security measures. While real-time threat analysis is crucial in security, archiving is more focused on preserving past data for future reference and not immediate threat mitigation. Compliance with regulations often requires long-term data storage, so this statement is contradictory. While backups are essential for system recovery, archiving in the security context goes beyond this and is centered around preserving logs and alerts for investigative and compliance purposes.

At Kelly Innovations Corp., Sarah noticed that their core business application, which tracks customer orders, was not updating inventory levels accurately. A recent update seemed to have introduced a bug. Which of the following would offer the BEST solution? A. Application restart B. Application rollback C. Dependency check D. Patch management

B. Application rollback Reverting an application to a previous state or version from a backup to correct issues caused by updates or changes. In this scenario, restoring the application from a backup taken two days earlier is an example of an application rollback and would be the most effective solution. Patch management is the process of managing updates for software applications. While the issue arose from an update, Jason is not suggesting another patch but is recommending reverting to a previous state. Application restart involves stopping and then starting an application, often to apply changes or ensure updates have taken effect. While it may be a part of many troubleshooting processes, it wouldn't address the bug introduced by the update. Dependency check refers to ensuring that all required components, libraries, or modules needed by an application are present. The scenario doesn't suggest any missing dependencies; rather, it's a problem with the application's function.

Which asymmetric encryption technique provides a comparable level of security with shorter key lengths, making it efficient for cryptographic operations? A. Diffie-Hellman B. Elliptic curve cryptography (ECC) C. DSA D. RSA

B. Elliptic curve cryptography (ECC) ECC is a type of trapdoor function that is efficient with shorter key lengths. For instance, ECC with a 256-bit key provides roughly the same security as RSA with a 2048-bit key. The primary advantage is that ECC has no known shortcuts to cracking it, making it particularly robust. Diffie-Hellman is an algorithm primarily for secure key exchange, not directly comparable to the encryption efficiency offered by ECC's shorter key lengths. Digital Signature Algorithm (DSA) is an algorithm used for digital signatures, but it doesn't inherently offer the same efficiency in terms of key length as ECC. While a foundational asymmetric algorithm, RSA generally requires longer key lengths than ECC to achieve comparable security levels.

Which of the following hardware issues that results from products that are no longer being made, but are still usable? A. Hardware cloning B. End-of-life vulnerability C. Legacy vulnerability D. Hardware tampering

B. End-of-life vulnerability End-of-life attack is a hardware attack that involves exploiting vulnerabilities in hardware devices that are no longer supported or updated by the manufacturer. It can allow an attacker to compromise the security or functionality of the device, or use it as a gateway to access other systems or networks. Legacy attack is a hardware attack that involves exploiting vulnerabilities in hardware devices that are outdated or obsolete, but still in use. It can allow an attacker to compromise the security or functionality of the device, or use it as a gateway to access other systems or networks. Hardware tampering is a hardware attack that involves physically altering or damaging hardware devices to compromise their functionality, performance, or security. It can allow an attacker to install malware, backdoors, spyware, or vulnerabilities on the device. Hardware cloning is a hardware attack that involves creating unauthorized copies of hardware devices to counterfeit their functionality, performance, or security. It can allow an attacker to sell fake products, steal intellectual property, or bypass authentication mechanisms.

While performing a digital investigation, which of the following statements BEST describes the role of preservation of evidence? A. It provides legal teams with a roadmap for case strategy. B. It maintains the integrity of digital evidence over time. C. It allows investigators to prioritize evidence collection. D. It allocates budgetary resources for the forensic investigation.

B. It maintains the integrity of digital evidence over time. Preserving evidence ensures that it remains unchanged and is kept in a state where its authenticity is intact for the duration of the investigation and any subsequent legal proceedings. While resources are necessary, preservation focuses on keeping evidence secure and unaltered. While prioritization is a part of investigation processes, preservation itself is about safeguarding evidence once collected. Preservation is about ensuring evidence remains unchanged, not about strategizing for a legal case.

Which of the following ports, if left open and unmonitored, might allow database queries from unauthorized external sources? A. Port 443 B. Port 1433 C. Port 21 D. Port 53

B. Port 1433 Port 1433 is the default for Microsoft SQL Server. Organizations typically restrict or monitor access to this port to prevent unauthorized database operations. Domain Name System (DNS) uses port 53 for resolving domain names into IP addresses. It isn't associated with database operations. Port 443 is used for secure web traffic through SSL/TLS. It's not directly related to database queries. File Transfer Protocol (FTP) uses port 21 for unencrypted data transfers, not for database operations.

Susan, a security analyst at Kelly Innovations LLC, is reviewing alerts from the IPS. She recognizes a pattern of false positives from signature-based detections. Which of the following is the MOST likely cause for false positives in signature-based detection systems? A. The system is only updated with old signatures. B. The signatures require tuning. C. Signature databases are stored in volatile memory. D. The IPS is scanning encrypted traffic only.

B. The signatures require tuning. When signatures are overly broad or not precisely defined, they might incorrectly match legitimate network traffic, leading to false positives. Signature-based detection works by inspecting traffic patterns, whether encrypted or not. However, the encrypted nature of traffic isn't the primary reason for false positives in signature-based detection. While outdated signatures might miss newer threats, they aren't typically the cause of false positives. Instead, they might lead to false negatives. Where the signature database is stored does not influence the accuracy of the detection. It's the quality and precision of the signatures that matter most.

When considering the RSA algorithm, which description BEST captures its underlying mathematical property used for public key cryptography? A. Hash function B. Trapdoor function C. Symmetric encryption D. Digital signature

B. Trapdoor function The RSA algorithm uses a trapdoor function, where encryption is easy to perform using the public key, but reversing the process (decryption) without the private key is challenging. RSA's principle is that certain mathematical operations are easy to perform, but their inverse operations are difficult without specific knowledge. Symmetric encryption is a type of encryption where the same key is used for both encryption and decryption, unlike RSA which uses a pair of public and private keys. A hash function is a process that converts an input (often a long string) into a fixed-size value, commonly used for verifying data integrity but not specifically tied to RSA's public key cryptography. A digital signature is a means to verify the authenticity of a digital message or document, using a combination of hashing and encryption, but it isn't the mathematical property of RSA.

Which of the following BEST explains the difference between an Agent-based and Agentless NAC? A. Both require additional software installed on network devices to monitor network traffic, but Agentless NACs collect more data. B. Agent based NACs use network level protocols to authenticate users, while Agentless NACs use additional software to authenticate users. C. Agent based NACs use additional software to authenticate users, while Agentless NACs use network level protocols to authenticate users. D. Both involve monitoring network traffic without the need for additional software, but Agent-based NACs collect more data.

C. Agent based NACs use additional software to authenticate users, while Agentless NACs use network level protocols to authenticate users. Both forms of NAC authenticate users and grant access. Agent-based NACs use a software component installed on a central server to monitor network traffic, while Agentless involves monitoring network devices directly through the use of network level protocols without the need for additional software. Agent-based NACs require additional software. There isn't a difference in the amount of data they collect. Both forms of NAC authenticate users and grant access. Agent-based NACs use a software component installed on a central server to monitor network traffic, while Agentless involves monitoring network devices directly through the use of network level protocols without the need for additional software. Agentless NACs don't require additional software. There isn't a difference in the amount of data they collect.

Which of the following terms BEST describes the validation of the accuracy and thoroughness of compliance-related reports? A. Independent third-party audit B. Regulatory examination C. Attestation D. Internal assessment

C. Attestation Attestation is the term that refers to the process of affirming the accuracy and completeness of compliance reports. It involves providing formal statements or declarations about the organization's compliance with specific regulations or standards. Attestation can be done internally by the organization's management or externally by a third-party auditor. An independent third-party audit involves an external and unbiased assessment conducted by an independent auditor or a third-party organization. The purpose of this audit is to provide an objective evaluation of the organization's compliance status. Independent third-party audits are often used to validate and verify compliance claims made by the organization and can offer more credibility to compliance reports. Internal assessment involves the organization's internal evaluation of its adherence to established compliance requirements. This process may include self-assessments, internal audits, and reviews conducted by the organization's compliance team to ensure that it meets the necessary regulatory and security standards. A regulatory examination is an external evaluation conducted by a government agency or a regulatory body to ensure that an organization is complying with specific regulations or industry standards. During a regulatory examination, the organization's compliance practices, controls, and processes are thoroughly reviewed to assess their alignment with the applicable rules and requirements.

A drone manufacturer employs a real-time operating system (RTOS) to ensure timely task executions. While optimizing for real-time performance, which of the following security concerns might arise? A. Uncontrolled cloud access. B. Lack of legacy protocol support. C. Inadequate buffer overflow protections. D. Overhead from virtualization.

C. Inadequate buffer overflow protections. RTOSs prioritize performance, sometimes at the expense of security features like buffer overflow protections, potentially leaving the system susceptible to certain attacks. RTOSs aren't primarily concerned with supporting legacy protocols, and this isn't a direct security risk associated with them. RTOSs are designed for efficiency and generally don't involve the overheads from virtualization layers. While cloud access can pose risks, it's not an inherent security implication of using an RTOS.

Clumsy Contraptions Engineering is seeking to change its security footing. In the past, they have found that too many pieces of malicious software have gotten past the system. Their Chief Security Officer believes they need a device which will actively evaluate traffic and reject or modify packets according to policies the company sets. What type of device is the CSO suggesting? A. Fail-close B. SASE C. Inline D. Remote Access

C. Inline Inline devices are designed to interact with network traffic actively and can take actions such as accepting, rejecting, or modifying packets, making them the optimal choice for this scenario. Secure Access Service Edge (SASE) is a form of cloud architecture that combines a number of services as a single service. By providing services like Software-defined wide are network (SD-WAN), firewalls as a service, secure web gateways, and zero-trust network access, SASE will reduce cost and simplify management while improving security. The integrated nature of the architecture means the technologies used will work together efficiently. It may include a packet analyzer, but that isn't the focus of the architecture. Fail-close refers to what happens when a network encounters errors and exceptions. Fail-close means that when errors occur or exceptions are encountered, the system denies further access. This prevents any further network traffic until the error or exception are dealt with. While this provides greater security, it means that a website can't be accessed even if the error encountered is minor or doesn't pose a security threat. This is a response to errors and exceptions, it doesn't read and interact with packets. Remote access allows users to connect to a network or a device from a distant location, but it does not pertain to actively interacting with network traffic to reject or modify packets.

Kelly Innovations LLC wants to implement a network appliance that focuses on filtering traffic based on source and destination IP addresses, and port numbers. Which layer of the OSI model is this appliance primarily operating at? A. Layer 5 B. Layer 2 C. Layer 4 D. Layer 3

C. Layer 4 Layer 4, or the transport layer, deals with protocols like TCP and UDP and is concerned with port numbers and connection-oriented communication. Network appliances operating at this layer filter and manage traffic based on source and destination IP addresses, as well as port numbers. Layer 3, or the network layer, is primarily focused on routing data and IP addressing. Devices at this layer, like routers, aren't primarily concerned with port numbers. Layer 5, the session layer, establishes, maintains, and terminates connections between applications on different devices. It doesn't handle filtering based on IP addresses and port numbers. Layer 2, the data link layer, deals with frames and MAC addresses. Switches typically operate at this layer.

Dion Training Solutions needs a network appliance capable of filtering traffic based on URL, HTTP headers, and specific web application functionalities. At which layer of the OSI model would this appliance primarily operate? A. Layer 5 B. Layer 6 C. Layer 7 D. Layer 3

C. Layer 7 Layer 7, or the application layer, deals with end-user services, and appliances at this layer can make filtering decisions based on specifics like URLs, HTTP headers, and specific application functions. Layer 6, the presentation layer, is responsible for translating data between the application and transport layers. Layer 5, the session layer, manages connections between applications. It isn't focused on the content-specific criteria like URLs and HTTP headers. Layer 3 devices are concerned with IP addressing and routing.

A power plant utilizes a specialized system to manage and monitor its daily operations, including machinery and sensor feedback. While these systems offer centralized control, what security concern is most associated with them? A. Runtime efficiency constraints. B. Optimization for containerized deployments. C. Limited security update capabilities. D. Constrained memory use.

C. Limited security update capabilities SCADA systems are often engineered for specific tasks and might not receive regular security updates, making them susceptible to vulnerabilities over time. While important for real-time systems, runtime efficiency is not a primary security concern for SCADA systems. Memory constraints are more pertinent to embedded or real-time systems, not inherently a SCADA security concern. SCADA systems are not typically deployed in containers; thus, this isn't a relevant security implication.

Which of the following terms refers to the specific laws and regulations set by a country's government that dictate how the personal data of its citizens should be collected, stored, and processed? A. Consent management B. General Data Protection Regulation (GDPR) C. National legal implications D. Data encryption

C. National legal implications National legal implications are laws and regulations set at the country level that outline the requirements and boundaries for data protection and privacy. Consent management is a process that ensures organizations obtain and manage the consent of individuals before collecting or processing their personal data. Data encryption is a method used to protect data from unauthorized access by converting it into a code. The GDPR is a regulation enacted by the European Union to ensure data protection and privacy for all its citizens.

Horizon Security, a cybersecurity training company, experienced a data breach due to a vendor's negligence. This breach led to a significant loss of sensitive customer information and damage to the company's reputation. What type of consequence is Horizon MOST likely to face? A. Loss of license B. Sanctions C. Reputational damage D. Fines

C. Reputational damage Reputational damage refers to the potential harm or negative impact on Horizon's reputation due to its failure to comply with data protection regulations. As a result of the data breach, customers may come to believe that Horizon doesn't know enough about cybersecurity to prevent the breach. Its reputation in the cybersecurity training industry may be tarnished. Fines are penalties imposed by regulatory authorities for non-compliance with data protection regulations. However, in this scenario, Horizon did not commit the negligence, so they are not likely to face fines unless they are located in a country that has laws regarding fines for any data breach regardless of responsibility. Sanctions are also potential penalties for non-compliance, but they are typically more severe and may include restrictions or limitations on the company's operations. However, in this scenario, Horizon did not commit the negligence, so they are not likely to face sanctions unless they are located in a country that has laws regarding sanctions for any data breach regardless of responsibility. Loss of license could be a consequence of non-compliance in certain industries. However, in this scenario, Horizon did not commit the negligence, so they are not likely to lose any licenses they may have.

Which of the following characteristics of a cloud architecture model describes a model that can quickly recover from failures due to adverse conditions? A. Ease of Deployment B. Availability C. Resilience D. Scalability

C. Resilience Resilience in cloud architecture refers to the ability of the system to quickly recover from failures and maintain operational performance, crucial for ensuring availability during adverse conditions. Ease of Deployment means that new instances and the entire cloud environment can be easily created. Resilience is the ability to maintain operational performance and recover quickly from failures. Availability refers to guaranteeing a system will continue to operate so that the system can be used regardless of conditions. Resilience, like availability, refers to keeping a system functioning, but also directly addresses how quickly a system can recover after adverse conditions have led to a failure. Scalability means that the system can expand when more resources are needed without creating lags or problems for users. This expansion isn't consider an adverse condition. Increased business is seen as a positive attribute. Resilience is the ability of a system to quickly recover after failures due to adverse conditions.

What term refers to an organization's predetermined level of acceptable risk exposure? A. Exposure factor B. Conservative C. Risk tolerance D. Risk appetite

C. Risk tolerance Risk tolerance refers to an organization's predetermined level of acceptable risk exposure. It represents the extent to which an organization is willing to tolerate potential risks before taking action to mitigate or avoid them. The exposure factor is a calculation that determines the amount of value that is lost if an event takes place. It doesn't measure an organization's level of acceptable risk exposure. The term "conservative" is not directly related to risk management. In financial contexts, it may refer to a risk-averse approach or cautious decision-making. While similar to risk tolerance, risk appetite refers to the amount of risk an organization is willing to take on to achieve its strategic objectives. It represents the organization's overall attitude toward risk-taking.

When considering user interactions with a web service, which of the following are the security measures that involve the secure creation and transfer of identifiers as well as enforcing inactivity limits to prevent unauthorized access? A. Session cookies B. Timeout policies C. Session management D. Token handling

C. Session management These refer to the protocols that maintain the security of user interactions on the web, including the secure creation and transfer of unique identifiers or "cookies," and setting inactivity limits to automatically terminate the session if the user is inactive for a certain period. Timeout policies contribute to these practices by defining when an inactive session should end, but they do not include the secure transmission and generation of identifiers. Token handling involves managing security tokens within a system, but on its own, it doesn't cover all aspects of what is required to maintain the security of user interactions, including setting inactivity limits. While session cookies are a part of what is managed, this term alone does not encompass the full scope of practices like setting inactivity limits.

Which of the following threats is MOST likely to accidentally cause harm to the system? A. Hacktivist B. Nation-state actors C. Shadow IT D. Unskilled attackers

C. Shadow IT Shadow IT is a type of threat actor that is the result of unauthorized or unapproved IT systems or devices within an organization. Shadow IT can introduce security risks and compliance issues for an organization, but the damage is usually unintentional. It results from employees or insiders who bring in equipment or alter systems for their own convenience and without getting permission. Nation-state actors are a type of threat actor that is sponsored by a government or a country's military. They normally have high resources/funding and high level of sophistication/capability. Nation-state actors can launch advanced and persistent attacks against other countries, organizations, or individuals. They create harm on purpose. A hacktivist is a threat actor that is motivated by philosophical or political beliefs and often targets organizations or governments that they disagree with. Hacktivists may use unauthorized or unapproved IT systems or devices but the harm they cause is done on purpose An unskilled attacker is a type of threat actor that has little or no technical skills and has low resources/funding and low level of sophistication/capability. Unskilled attackers often launch simple and opportunistic attacks using tools or scripts developed by others. The damage they do might be minor, but they do intend to do damage.

As a security analyst, you are reviewing application logs while investigating a suspected breach. Which of the following pieces of information is NOT typically documented in the application log data? A. User IDs related to specific application transactions. B. Server IP address where the application is hosted. C. The physical location of the user accessing the application. D. Timestamps of application activity.

C. The physical location of the user accessing the application. Application logs do NOT typically capture the physical location of the user accessing the application. While IP addresses can give a rough estimate of geographic location, accurate physical location (e.g., GPS coordinates or exact address) is not recorded in standard application logs. Timestamps of application activity are crucial for investigations. They enable the analysis of event occurrence sequence, making it possible to identify patterns and reconstruct the timeline of events. User IDs related to specific transactions do appear in application logs. This piece of information can help to identify the user who performed a specific action in the application, useful for incident response. The IP address of the server hosting the application frequently shows up in application logs. This information can be useful for understanding network-level behaviors associated with the application.

Which of the following statements BEST explains the importance of environmental variables in regard to vulnerability management? A. Environmental variables are parameters used in vulnerability scanning tools to assess the security posture of an organization's network and infrastructure B. Environmental variables are specific conditions that trigger an automated response when a vulnerability is detected in an organization's systems C. Environmental variables are factors that impact the physical security of an organization's premises D. Environmental variables refer to the unique characteristics of an organization's infrastructure that can affect vulnerability assessments and risk analysis

D. Environmental variables refer to the unique characteristics of an organization's infrastructure that can affect vulnerability assessments and risk analysis Environmental variables refer to the unique characteristics of an organization's infrastructure, business environment, and operational context that can impact vulnerability assessments and risk analysis. Understanding these variables is crucial to conducting effective vulnerability management and developing appropriate risk mitigation strategies. These variables are not specific conditions triggering automated responses; rather, they are factors related to an organization's infrastructure and business environment that impact vulnerability management processes. While vulnerability scanning tools may use various parameters, environmental variables refer to different aspects related to an organization's infrastructure and business environment. While physical security factors are important, environmental variables in this context have a different focus.

Reed, a cybersecurity specialist at Dion Training Solutions, is optimizing the company's IPS. He notes that while signature-based detection is highly effective against known threats, it has some limitations. Which of the following BEST describes a limitation of signature-based detection in an IPS? A. It encrypts network traffic to hide malicious signatures. B. It requires substantial network bandwidth to operate. C. It automatically updates with behavioral patterns of users. D. It might not detect zero-day exploits.

D. It might not detect zero-day exploits. Signature-based detection relies on a database of known threat patterns. Therefore, it might not recognize or stop new threats or zero-day exploits because their signatures aren't in the database yet. Automatically updating with behavioral patterns of users describes behavior-based or heuristic detection, not signature-based detection. Signature-based detection relies on predefined patterns of known threats. Signature-based detection doesn't encrypt traffic. Instead, it matches traffic patterns against known threat signatures. While an IPS does process traffic, the bandwidth consumption is not a direct limitation of signature-based detection. The bandwidth concern is more about the throughput of the IPS device itself.

When sending an encrypted message to Dion Training, a client would use which of the following to ensure only Dion Training can decrypt and read the message? A. Key escrow B. Wildcard certificate C. Public key D. Private key

C. Public key The client would use the company's public key to encrypt the message. Only Dion Training, with the corresponding private key, can decrypt and read the message, ensuring confidentiality and demonstrating the importance of public-key cryptography. Key escrow refers to the secure storage of cryptographic keys, ensuring they can be accessed under specific conditions, but it's not directly used to encrypt or decrypt messages. A private key is kept secret by its holder and is used to decrypt messages that are encrypted with its corresponding public key. It's not used by external entities to encrypt messages to the key holder. A wildcard certificate secures multiple subdomains under a main domain but doesn't directly involve message encryption or decryption.

As part of a new building initiative, Dion Training Solutions plans to connect two office buildings via a direct physical link. Which measure will BEST protect the physical infrastructure connectivity? A. Running the connection on overhead poles. B. Using wireless bridges without encryption. C. Placing the cable on the ground between buildings. D. Installing the cable in a conduit buried underground.

D. Installing the cable in a conduit buried underground Burying the connection underground within a protective conduit offers protection from environmental factors and unauthorized tampering. Laying cables on the ground without protection can expose them to damage and unauthorized access. Unencrypted wireless bridges can be susceptible to eavesdropping and interception. Overhead poles expose the connection to environmental factors and potential tampering, making it less secure.

Which of the following BEST describes the Software Development Life Cycle (SDLC) in application security? A. It emphasizes the integration of security in software creation and maintenance. B. It only considers security during the testing and creation phases of software development. C. It replaces the need for regular software updates and patches. D. It primarily focuses on the speed of software delivery over security.

A. It emphasizes the integration of security in software creation and maintenance. An SDLC ensures that security is a focal point in all stages of software development, from design to maintenance. While certain SDLC models, like Agile, prioritize quick deliveries, they don't overlook security. SDLC integrates security throughout its phases, not just during testing. Even with a robust SDLC, software may still require updates and patches post-deployment.

Which of the following BEST describes an organizational structure that allows for autonomous decision-making in separate departments or sectors within the company? A. Flat organization B. Decentralized governance C. Hierarchical management D. Matrix structure

B. Decentralized governance In decentralized governance, decision-making is distributed among various departments or sectors, promoting responsiveness and specialization. Hierarchical management implies a top-down approach to decision-making and does not necessarily allow for autonomy in separate departments. Flat organization refers to an organization with few or no levels of middle management between staff and executives, which affects management layers but not necessarily decision-making distribution. While matrix structure involves multiple reporting lines, it does not solely define the decision-making autonomy of departments.

At Kelly Innovations LLC, Susan has been entrusted with determining the purposes and means of processing personal data for the organization's new marketing campaign. She decides what data to collect, how long it will be retained, and with whom it will be shared. Which of the following BEST describes the role Susan is playing? A. Data Subject B. Data Custodian C. Data Processor D. Data Controller

D. Data Controller A Data Controller is an individual or entity that determines the purposes and means of processing personal data. They have primary responsibility for ensuring the data's protection and compliance with privacy regulations. An identifiable person whose personal data is being processed by a data controller or processor. A Data Processor is an individual or entity that processes personal data on behalf of the data controller, without deciding the purposes or means of the processing. The Data Custodian typically responsible for ensuring the safety and maintenance of data assets through its various stages of storage, but doesn't decide on processing methods.

Which of the following vulnerabilities BEST describes a situation where a threat actor can manipulate data after it has been verified by an application, but before the application uses it for a specific operation? A. Resource exhaustion B. Memory leaks C. Race conditions D. Time-of-check (TOC)

D. Time-of-check (TOC) A TOC vulnerability occurs when an attacker exploits the time gap between the verification of data and its use, potentially leading to unauthorized or malicious activities. Memory leaks are when a program doesn't release memory that it no longer needs, leading to potential system slowdowns or crashes. This does not involve data manipulation after verification. Race conditions relate to the unexpected order and timing of events in software execution but are not specifically about the gap between data verification and use. Resource exhaustion refers to the overuse of system resources, be it CPU time, memory, or others, which can lead to denial of service. It's not specific to data manipulation after its verification.

Which method accurately demonstrates the authentication process used in WPA2 Personal mode? A. Password Authenticated Key Exchange (PAKE). B. Dragonfly handshake with a MAC address hash. C. QR codes for client device configuration. D. Using a passphrase to generate a pairwise master key (PMK).

D. Using a passphrase to generate a pairwise master key (PMK). WPA2-PSK leverages a passphrase to create a key, called the PMK, to encrypt communications. This is a distinguishing feature of WPA2's personal authentication. The Dragonfly handshake is a key feature of the WPA3's Simultaneous Authentication of Equals (SAE) method. This does not pertain to the WPA2 authentication mechanism. PAKE is specifically a method associated with WPA3's SAE protocol. It's not the method employed by WPA2 for authentication. QR codes for configuration relate to the newer Easy Connect method. It is not a characteristic of WPA2 Personal authentication.

For ensuring the security of an HTTP application like WordPress or Magento against threats like SQL injection or cross-site scripting, which monitoring tool or method would be MOST appropriate? A. Antivirus software B. Host-based intrusion detection system (HIDS) C. NetFlow D. Web application firewall (WAF)

D. Web application firewall (WAF) A WAF specifically protects web applications by filtering and monitoring HTTP traffic, providing defenses against web-specific attacks such as SQL injection. While HIDS monitors the internals of a computing system, it isn't explicitly designed to combat web application-specific threats. While antivirus software can detect malware and malicious files, it isn't particularly tailored to protect against web application-specific threats like SQL injection. NetFlow collects IP traffic information and monitors network flow data but doesn't specifically target web application vulnerabilities.