Cyber Security Final Exam
Which of the following policies would cover what you should do in case of a data breach?
Sensitive data handling policy
Any attack involving human interaction of some kind is referred to as:
Social engineering
A goal-based penetration test needs to have specific goals. Using SMART goals is extremely useful for this. What does SMART stand for?
Specific/measurable/attainable/relevant/timely
Which of the following best describes a non-disclosure agreement?
A common legal contract outlining confidential material that will be shared during the assessment
Which of the following best describes a supply chain?
A company that provides materials to another company to manufacture a product
Which of the following best describes a script kiddie?
A hacker who uses scripts written by much more talented individuals
Heather is working for a cybersecurity firm based in Florida. She will be conducting a remote penetration test for her client, who is based in Utah. Which state's laws and regulations will she need to adhere to?
A lawyer should be consulted on which laws to adhere to and both parties agree
Heather has been hired to work in a firm's cybersecurity division. Her role will include performing both offensive and defensive tasks. Which of the following roles applies to Heather?
A member of the purple team
Hannah is working on the scope of work with her client. During the planning, she discovers that some of the servers are cloud-based servers. Which of the following should she do?
Add the cloud host to the scope of work
During a risk assessment, the organization determines that the risk of collecting personal data from its customers is not acceptable and stops. What method of dealing with risk is the organization using?
Avoidance
Yesenia was recently terminated from her position, where she was using her personal cell phone for business purposes. Upon termination, her phone was remotely wiped. Which of the following corporate policies allows this action?
BYOD policy
Which type of penetration test is required to ensure an organization is following federal laws and regulations?
Compliance-based
Which of the following best describes the rules of engagement document?
Defines if the test will be a white box, gray box, or black box test and how to handle sensitive data
Penetration testing is the practice of finding vulnerabilities and risks with the purpose of securing a computer or network. Penetration testing falls under which all-encompassing term?
Ethical hacking
Miguel is performing a penetration test on a web server. Miguel was given only the server's IP address and name. Which of the following best describes the type of penetration test Miguel is performing?
External (i think)
Which of the following best describes a goal-based penetration test?
Focuses on the end results. The hacker determines the methods
Which of the following is the third step in the ethical hacking methodology?
Gain Access
Which of the following elements is generally considered the weakest link in an organization's security?
Human
During an authorized penetration test, Michael discovered his client's financial records. Which of the following should he do?
Ignore the records and move on
You are performing a penetration test of a local area network (LAN). Refer to the circled area on the network diagram. network. Which of the following types of penetration tests is being performed? (has picture)
Internal
Which of the following is considered a mission-critical application?
Medical database
Which of the following is a common corporate policy that would be reviewed during a penetration test?
Password policy
Which type of attack involves changing the boot order on a PC so that the hacker can gain access to the computer by bypassing the install operating system?
Physical attack
During a penetration test, Heidi runs into an ethical situation she's never faced before and is unsure how to proceed. Which of the following should she do?
Reach out to an attorney for legal advice
A client asking for small deviations from the scope of work is called?
Scope Creep
Which of the following best describes social engineering?
The art of deceiving and manipulating others into doing what you want
Which of the following best describes a gray box penetration test?
The ethical hacker has partial information about the target or network
Which of the following is a limitation of relying on regulations?
They rely heavily on password policies
You have implemented a regular backup schedule for a Windows system, backing up data files every night and creating a system image backup once per week. For security reasons, your company has decided not to store a redundant copy of the backup media at an off- site location. Which of the following would be the best backup and storage option?
Use incremental backups and store them in a locket fireproof safe
Which type of threat actor only uses skills and knowledge for defensive purposes?
White hat