Security+ B201

Which of the following is a characteristic of a potentially unwanted program (PUP)? a. A PUP gives access to the computer, program, or a service, circumventing the system's normal security protections. b. A PUP interferes and obstructs the user with web browsing and pop-up windows. c. A PUP pretends to perform natural activities while also performing malicious activities. d. A PUP gives the threat agent remote access to the user's device using specially configured communication protocols.

b. A PUP interferes and obstructs the user with web browsing and pop-up windows.

Social engineering is a means of eliciting information by relying on the weaknesses of individuals. How should you differentiate between the social engineering techniques of phishing and pharming? a. Phishing involves sending millions of generic email messages to a large volume of users, whereas pharming targets specific users by sending emails customized to the recipients, including their names and personal information. b. Phishing involves sending an email message or displaying a web announcement that falsely claims to be from a legitimate enterprise, whereas pharming is a redirection technique that attempts to exploit how a URL is converted into its corresponding IP. c. Phishing involves sending customized emails to recipients, including their names and personal information, to make the message appear legitimate, whereas pharming is a variant of phishing that specifically targets wealthy individuals or senior executives within a business. d. Phishing involves digging through trash receptacles to find information that can be useful in an attack, whereas pharming involves sending millions of unsolicited emails to a large volume of users.

b. Phishing involves sending an email message or displaying a web announcement that falsely claims to be from a legitimate enterprise, whereas pharming is a redirection technique that attempts to exploit how a URL is converted into its corresponding IP.

The files in James's computer were found spreading within the device without any human action. As an engineer, you were requested to identify the problem and help James resolve it. During file code inspection, you noticed that certain types of files in the computer have similar codes.You found that the problem is coming from a set of codes that are not part of the actual files, appended at the bottom of the file. You also noticed a transfer control code written at the beginning of the files giving control to the code at the bottom of the file.Which type of infection is this a characteristic of? a. This is a typical characteristic exhibited by files attacked by ransomware in the device. b. This is a typical characteristic of an endpoint device infected with a file-based virus attack. c. This is a typical characteristic of a spyware infection in the endpoint device. d. This is a typical characteristic of files infected by keystrokes in an endpoint.

b. This is a typical characteristic of an endpoint device infected with a file-based virus attack.

Which of the following sensors help generate security alerts to physicians regarding patient health? a. SoC b. BAN c. Accelerometer d. Proximity sensor

b. BAN

Which threat actors violate computer security for personal gain? a. Gray hat hackers b. Black hat hackers c. White hat hackers d. Red hat hackers

b. Black hat hackers

In which of the following mobile device connectivity methods are transmitters connected through a mobile telecommunication switching office (MTSO) that controls all of the transmitters in the cellular network and serves as the link between the cellular network and the wired telephone world? a. Bluetooth b. Cellular c. Infrared d. Wi-Fi

b. Cellular

In an interview, the interviewer introduced the following scenario:An enterprise is hosting all its computing resources on a cloud platform, and you need to identify which vulnerability is most likely to occur. Which of the following should you choose? a. Physical access vulnerability b. Configuration vulnerability c. Zero-day vulnerability d. Third-party vulnerability

b. Configuration vulnerability

Which of the following is a physical social engineering technique? a. Pharming b. Dumpster diving c. Watering hole d. Hoaxes

b. Dumpster diving

Which endpoint application runs on an endpoint device that only detects an attack in an endpoint device? a. Cookies b. HIDS c. EDR d. HIPS

b. HIDS

An unauthorized person recently accessed your enterprise network. The security team had received a call from the threat actor claiming to be a higher official. They followed the attacker's instructions to log them onto a specific webpage, leading to the exposure of enterprise network credentials. Which of the following social engineering techniques was used here? a. Hoaxes and spam b. Impersonation and phishing c. Hoaxes and impersonation d. Spam and phishing

b. Impersonation and phishing

Your enterprise has played fast and loose with customer information for years. While there has been no significant breach of information that could damage the organization and/or their customers, many in the enterprise feel it is only a matter of time before a major leak occurs.Which type of threat actor is an employee who wishes to personally ensure that the enterprise is exposed and blocked from accessing their customers' information until they ensure more secure protocols? a. Script kiddy b. Insider c. Hacktivist d. State actor

b. Insider

Kate decides to download an extension to her favorite browser to quickly store links on her spreadsheet software. While downloading the software, she ignores the opt-out check box that allows the extension to download a search toolbar.What has occurred here? a. Kate has installed a backdoor. b. Kate has installed a potentially unwanted program (PUP). c. Kate has installed an injection. d. Kate has installed a Trojan.

b. Kate has installed a potentially unwanted program (PUP).

Which of the following is a subset of artificial intelligence? a. Artificial intelligence algorithm b. Machine learning c. Machine intelligence d. Data science

b. Machine learning

What type of attack occurs when the threat actor snoops and intercepts the digital data transmitted by the computer and resends that data, impersonating the user? a. Trojan b. Replay c. Buffer overflow d. Device driver manipulation

b. Replay

Over the last few days, several employees in your enterprise reported seeing strange messages containing links in their company's IM account. Even though no one has clicked on the messages, they are spreading throughout the network.Which type of malicious activity is this? a. Whaling b. Spimming c. Vishing d. Spear phishing

b. Spimming

Several websites use URLs similar to one of the most globally popular websites, attempting to attract traffic if a user misspells the popular website's URL. What is this social engineering technique called? a. Spam b. Typo squatting c. Pharming d. Tailgating

b. Typo squatting

Kelly is asked to choose a mobile management tool that provides a single management interface for all applications, content, and device management. Which of the following is the best one-step solution? a. Mobile device management (MDM) tool b. Unified environment management (UEM) tool c. Mobile content management (MCM) tool d. Mobile application management (MAM) tool

b. Unified environment management (UEM) tool

Juan, a cybersecurity expert, has been hired by an organization whose networks have been compromised by a malware attack. After analyzing the network systems, Juan submits a report to the company mentioning that the devices are infected with malware that uses a split infection technique on files.Which malware attack is Juan reporting? a. Spyware b. Virus c. RAT d. Cryptomalware

b. Virus

Which of the following statements correctly describes the disadvantage of a hardware-based keylogger? a. A hardware-based keylogger can easily be detected in a network by an antivirus. b. A hardware-based keylogger's data can be easily erased by the antimalware software installed in the device. c. A hardware-based keylogger must be physically installed and removed without detection. d. A hardware-based keylogger can be detected by an antivirus when it scans for ports.

c. A hardware-based keylogger must be physically installed and removed without detection.

What is the primary difference between credentialed and non-credentialed scans? a. Credentialed scans are legal, while non-credentialed scans are illegal. b. Credentialed scans use advanced scanning tools, while non-credentialed scans do not use tools. c. Credentialed scans use valid authentication credentials to mimic threat actors, while non-credentialed scans do not provide authentication credentials. d. Credentialed scans are performed by pen testers, while non-credentialed scans are performed by authorized officers.

c. Credentialed scans use valid authentication credentials to mimic threat actors, while non-credentialed scans do not provide authentication credentials.

Ian, a systems administrator, was checking systems on Monday morning when he noticed several alarms on his screen. He found many of the normal settings in his computer and programs changed, but he was sure no one had physically entered his room since Friday. If Ian did not make these changes, which of the events below is the most likely reason for the anomalies? a. A backdoor was installed previously and utilized over the weekend to access the computer and the programs. b. The security administrator ran a penetration test over the weekend and did not tell anyone. c. A firewall scan that was run over the weekend shut down the computer and the programs. d. The power went out over the weekend and caused the programs to move back to their default settings.

a. A backdoor was installed previously and utilized over the weekend to access the computer and the programs.

Zero-day vulnerabilities and configuration vulnerabilities can heavily impact a system if exploited. How should you differentiate between a zero-day vulnerability and a configuration vulnerability? a. A zero-day vulnerability is an unknown vulnerability in released software that is found and exploited by a threat actor, whereas a configuration vulnerability is caused by improper settings in hardware or software. b. A zero-day vulnerability results from users improperly configuring software, whereas a configuration vulnerability results from the developers improperly configuring the software. c. A zero-day vulnerability results from improper hardware configurations, whereas a configuration vulnerability results from improper software configuration. d. A zero-day vulnerability is an easily fixable vulnerability recognized by a software developer, whereas a configuration vulnerability is a major vulnerability present in a system exploited by a threat actor before the software developer can fix it.

a. A zero-day vulnerability is an unknown vulnerability in released software that is found and exploited by a threat actor, whereas a configuration vulnerability is caused by improper settings in hardware or software.

What is meant by "the chain of trust" in boot security? a. Each step in the boot sequence relies on the confirmation from the previous boot sequence step. b. Each step in the boot sequence relies on the confirmation of the hardware root of trust. c. Each step in the boot sequence follows its own process independently, trusting the previous sequence step. d. Each step in the boot sequence relies on the operating system logs of the previous boot sequence for boot security.

a. Each step in the boot sequence relies on the confirmation from the previous boot sequence step.

What additional measure should be enacted to increase the security on a computer network after secure boot, protective measures from attacks like antimalware, and intrusion detection systems are implemented in all the computers on the network? a. Implement hardening at endpoints with patch management and operating system safeguards b. Implement an antivirus solution in all systems and servers c. Disable operating system patch updates to prevent malicious attacks d. Disable connections on the Wi-Fi network

a. Implement hardening at endpoints with patch management and operating system safeguards

In cybersecurity, a threat actor is an individual or an entity responsible for cyber incidents against the technical equipment of enterprises and users. How should you differentiate an attack by a script kiddie from that of a gray hat hacker? a. Script kiddies use automated attack software created by other hackers for personal gain, whereas gray hat hackers create their own attack software to showcase vulnerabilities present in a system to the world. b. Script kiddies construct efficient scripts to perform attacks to fulfill their own needs, whereas gray hat hackers construct scripts for attacking organizational competitors. c. Script kiddies are hired to probe systems for weaknesses and then privately provide that information back to the organization, whereas gray hat hackers break into systems for ideological or political reasons. d. Script kiddies lack the technical knowledge to carry out attacks, so they hire a hacker to do it, whereas gray hat hackers violate computer security to fulfill their financial needs.

a. Script kiddies use automated attack software created by other hackers for personal gain, whereas gray hat hackers create their own attack software to showcase vulnerabilities present in a system to the world.

ABC Technologies had its computer network compromised through a cybersecurity breach. A cybersecurity expert was employed to analyze and identify what caused the attack and the damage caused by the attack. He checked an available database for this purpose and found the threat actor behind the attack. He also found out the cybercriminal has been attempting to sell the company's valuable data on the internet.Which are the most probable methods used by the cybersecurity expert to get to this stage of the investigation? a. The cybersecurity expert checked with CISCP and also investigated the dark web. b. The cybersecurity expert used STIX and checked with CISCP. c. The cybersecurity expert checked the threat maps and used the MAR report. d. The cybersecurity expert checked the threat maps and used TAXII.

a. The cybersecurity expert checked with CISCP and also investigated the dark web.

Which of the following devices is similar to Raspberry Pi? a. Arduino b. SoC c. Real-time operating system d. FPGA

a. Arduino

You have been assigned to decide the process used for software application development at your company. Since the products need to be developed and deployed as each module is completed, you chose to go with agile application development. Your manager has requested you consider SecDevOps.Which of the following is a significant and key feature of using SecDevOps that can be considered for selecting this project's development model? a. Automation b. Reuse of code c. Rigid process d. Quarantine

a. Automation

Which threat actors sell their knowledge to other attackers or governments? a. Brokers b. Criminal syndicates c. Competitors d. Cyberterrorists

a. Brokers

Shanise is an IT security professional for a large private bank. She got an alert that the bank website received a funds transfer request that was correctly credentialed but flagged as being out of the account owner's usual pattern. If the alert is correct, what type of attack has likely occurred? a. CSRF attack b. Replay attack c. SQL injection d. XSS attack

a. CSRF attack

Zyan works for ABC Technology. The enterprise wants to provide smartphones to all its employees. They can choose from a limited list of approved mobile devices. But they need to pay for the device themselves. The company will pay them a monthly stipend. Which deployment method should Zyan suggest to meet his company's needs? a. Choose your own device (CYOD) b. Corporate-owned personally enabled (COPE) c. Corporate-owned device (COD) d. Virtual desktop infrastructure (VDI)

a. Choose your own device (CYOD)

Which type of threat actor would benefit the most from accessing your enterprise's new machine learning algorithm research and development program? a. Competitors b. Shadow IT c. Criminal syndicates d. Brokers

a. Competitors

John has been appointed as a product manager at a large mobile device manufacturing company. He is designing the core features included in their flagship mobile device that will be launched during the holiday shopping season. Which of the following features should he primarily include? a. Data synchronization with a remote server or separate device b. Global positioning system (GPS) c. Digital camera d. Microphone

a. Data synchronization with a remote server or separate device

Which of the following is part of the OS security configuration? a. Disabling default passwords and unnecessary ports b. Giving all users administrator privileges c. Enabling the most secure OS platform d. Installing the latest version of OS

a. Disabling default passwords and unnecessary ports

Which of the following is an attack vector used by threat actors to penetrate a system? a. Email b. Intimidation c. Urgency d. Phishing

a. Email

Which of the following is the most secure encryption solution to adopt for a Google Android mobile device? a. File-based encryption b. Symmetric key encryption c. Asymmetric key encryption d. Full disk encryption

a. File-based encryption

While going through the network log, Sarah, a network security administrator, noticed substantial outbound network traffic. Which activity did Sarah perform? a. IOC b. STIX c. HTTP d. Telnet

a. IOC

A company monitors the network activity of the organization and stores the logs in a database. You have been asked to identify whether there are any malicious activities in the network. Which of the following can denote the upper and lower bounds of their various network activities? a. KRI b. OSI model c. TTP d. Threat maps

a. KRI

Which of the following types of platforms is known for its vulnerabilities due to age? a. Legacy platform b. Cloud platform c. On-premises platform d. Online platform

a. Legacy platform

What is an officially released software security update intended to repair a vulnerability called? a. Patch b. Default c. Vector d. Firmware

a. Patch

You work for an enterprise that provides various cybersecurity services. You are assigned to examine an enterprise's network and suggest security measures modifications, if necessary. On examining the network, you find that the enterprise hosts most of its computing resources on a cloud platform and few resources on-premises, and both seem to have secure settings implemented. You also find that the enterprise computers use the Windows XP operating system. Which of the following vulnerabilities should you insist on fixing first? a. Platform vulnerability b. Third-party vulnerability c. Configuration vulnerability d. Zero-day vulnerability

a. Platform vulnerability

A web application with an SQL server database is found to be compromised by an attacker. On examination, the email IDs of the database have been found modified. This was due to improper validation in the input fields exploited by the attacker.What is the probable attack in the above scenario? a. SQL Injection b. XML Injection c. XSS d. SSRF

a. SQL Injection

What is a variation of a common social engineering attack targeting a specific user? a. Spear phishing b. Redirection c. Watering holes d. Spam

a. Spear phishing

Which of the following are categories of vulnerabilities in mobile device connections that can also be exploited by threat actors? a. Tethering, USB-on-the-go (OTG), malicious USB cable, hotspots b. Limited updates, USB-on-the-go (OTG), malicious USB cable, hotspots c. Tethering, USB-on-the-go (OTG), malicious USB cable, location tracking d. Tethering, USB-on-the-go (OTG), limited updates, hotspots

a. Tethering, USB-on-the-go (OTG), malicious USB cable, hotspots

Which of the following vulnerabilities involves connecting a flash drive infected with malware to a mobile device? a. USB-on-the-go (OTG) b. Malicious USB cable c. Tethering d. Hotspots

a. USB-on-the-go (OTG)

Your enterprise experienced several technical issues over the last few days. There were multiple instances of passwords needing to be changed and other issues causing downtime. Management has started receiving voicemails regarding fraudulent activities on their accounts. While the voicemails sound authentic, the help desk concludes that they are fake.What type of malicious activity will this be considered? a. Vishing b. Whaling c. Spimming d. Spamming

a. Vishing

Attackers have taken over a site commonly used by an enterprise's leadership team to order new raw materials. The site is also visited by leadership at several other enterprises, so infecting this site will allow for attacks on many organizations. Which type of malicious activity is this? a. Watering hole b. Vishing c. Spear phishing d. Hoax

a. Watering hole

Your company is considering updating several electronic devices used in the enterprise network. The third-party service provider that your company approached says that they require access to the enterprise network in order to implement the updates. As the chief information security officer, you are asked to analyze the requirement and submit a report on potential vulnerabilities when giving a third-party access to the network.Which of the following vulnerabilities should you list as the most likely to affect the enterprise network? a. Weakest link b. Weak encryption c. Zero day d. Default settings

a. Weakest link

Hacktivists and state actors are huge threats to government systems. What is the main difference between hacktivists and state actors? a. Hacktivists attack their own enterprise network for political revenge or personal gain, whereas state actors attack a nation's network and computer infrastructure to cause disruption and panic among citizens. b. Hacktivists are covertly sponsored by a government to attack its foes, whereas state actors misuse a computer system or network for personal, social, or political reasons. c. Hacktivists misuse a computer system or network for socially or politically motivated reasons, whereas state actors are covertly sponsored by a government to attack its foes. d. Hacktivists attack a nation's network and computer infrastructure to cause disruption and panic among citizens, whereas state actors attack their own enterprise network for political revenge or personal gain.

c. Hacktivists misuse a computer system or network for socially or politically motivated reasons, whereas state actors are covertly sponsored by a government to attack its foes.

Which of the following describes a memory leak attack? a. In a memory leak attack, an attacker changes the variable's value to something outside the range the programmer had intended. b. Memory leak attacks take advantage of the token generated and sent to the user's browser by the website as part of the authentication. c. In a memory leak attack, the threat actor takes advantage of the programming error of not freeing the memory after executing a process, taking advantage of the device's low memory conditions to attack. d. A memory leak occurs when a process attempts to store data beyond a fixed-length storage buffer's boundaries.

c. In a memory leak attack, the threat actor takes advantage of the programming error of not freeing the memory after executing a process, taking advantage of the device's low memory conditions to attack.

Which one of the following is the most appropriate explanation of photoplethysmography? a. Measuring blood pressure by tracking changes in green light absorption, since human blood absorbs green light b. Measuring heart rate by tracking changes in UV light absorption, since human blood absorbs UV light c. Measuring heart rate by tracking changes in green light absorption, since human blood absorbs green light d. Measuring blood pressure by tracking changes in infrared light absorption, since human blood absorbs infrared light

c. Measuring heart rate by tracking changes in green light absorption, since human blood absorbs green light

What does ransomware do to an endpoint device? a. Ransomware infects the endpoint devices and launches attacks on the infected endpoint and other devices connected to the network. b. Ransomware attacks the endpoint device without the consent of the user or the device, discreetly collecting and transmitting information, causing harm to the end user. c. Ransomware attacks the endpoint device holding it hostage by preventing it from functioning unless the user fulfills the ransom payment demanded. d. Ransomware gets accidentally installed in the endpoint device as software along with other programs during the installation process. This happens when the user's installation and download options are overlooked, thus affecting the user application adversely.

c. Ransomware attacks the endpoint device holding it hostage by preventing it from functioning unless the user fulfills the ransom payment demanded.

Which type of malware can hide its agenda inside other processes, making it undetectable, and what is it usually used for? a. RAT, an executable program that gives unauthorized remote access to a user's computer b. Backdoor, which gives access to a computer, program, or service that overrides any normal security protections c. Rootkit, a malware that uses the lower layers of the operating system or undocumented functions to make alterations to the operating system's processes d. Trojan, an executable program that pretends to perform a harmless activity while doing something malicious

c. Rootkit, a malware that uses the lower layers of the operating system or undocumented functions to make alterations to the operating system's processes

Which of the following sets consists of only the core features of a mobile or computing device? a. Small form factor, mobile operating system, wireless data network interface for internet access, global positioning system (GPS), local non-removable data storage b. Small form factor, mobile operating system, microphone and/or digital camera, app stores, local non-removable data storage c. Small form factor, mobile operating system, wireless data network interface for internet access, app stores, local nonremovable data storage d. Small form factor, mobile operating system, wireless data network interface internet access, app stores, removable storage media

c. Small form factor, mobile operating system, wireless data network interface for internet access, app stores, local nonremovable data storage

Natasha, a network security administrator for an online travel portal, noticed that her website was the victim of an SQL injection. She decided to study the SQL queries to find which one made this vulnerability in the database, and she noticed the following SQL code piece executed on the database :'whatever' AND email IS NULL; What has been accessed by the attacker running this SQL injection? a. The attacker has used the SQL injection to delete the table in the database. b. The attacker accessed the entirety of email address data from all users in the database. c. The attacker has determined the names of different types of fields in the database. d. The attacker accessed the data of specific users.

c. The attacker has determined the names of different types of fields in the database.

There is often confusion between vulnerability scanning and penetration testing. What is the best explanation of the difference between vulnerability scanning and penetration testing? a. Vulnerability scanning checks a network for open ports and services. Penetration testing is attempting to manually scan a network for known vulnerability signatures using an advanced scanning tool. b. Vulnerability scanning checks a network for outdated versions of services. Penetration testing is attempting to manually uncover deep vulnerabilities just as a threat actor would, and then exploiting them. c. Vulnerability scanning is performed using an automated tool to scan a network for known vulnerability signatures. Penetration testing involves attempting to manually uncover deep vulnerabilities just as a threat actor would, and then exploiting them. d. Vulnerability scanning is performed by manually scanning a network for known vulnerabilities. Penetration testing is attempting to manually scan a network for known vulnerability signatures using an advanced scanning tool.

c. Vulnerability scanning is performed using an automated tool to scan a network for known vulnerability signatures. Penetration testing involves attempting to manually uncover deep vulnerabilities just as a threat actor would, and then exploiting them.

Which of the following is a characteristic of a vulnerability scan that is not a characteristic of a penetration test? a. A vulnerability scan identifies deep vulnerabilities. b. A vulnerability scan is usually a manual process. c. A vulnerability scan is usually automated. d. A vulnerability scan can be done when a regulatory body requires it or on a pre-determined schedule.

c. A vulnerability scan is usually automated.

Japan's cybercrime control center noticed that around 200,000 Tokyo computers are infected by bots, and all these bots are remotely controlled by a single attacker. What is this attacker referred to as? a. Botnet b. Payload c. Bot herder d. Zombie

c. Bot herder

Which of the following is an example of a request forgery malware? a. SQL injection b. Ransomware c. CSRF d. DLL injection

c. CSRF

A company has its network compromised. As an expert professional, the organization has hired you to identify the probable cause of the attack and fix it. As a security professional, you have noticed the pattern of compromise is unlike anything previously seen. You are looking to find new information on vulnerabilities like the attack that occurred.Which of the following actions would help achieve this objective? a. Checking the surface web b. Checking the green web c. Checking the dark web d. Implementing TCP/IP protocol across the network

c. Checking the dark web

Your company recently purchased routers with new and updated features and deployed them in the highly secure enterprise network without changing the default settings. A few days later, the enterprise network suffered a data breach, and you are assigned to prepare a report on the data breach. Which of the following vulnerabilities should you identify as the source of the breach? a. Platform vulnerability b. Zero-day vulnerability c. Configuration vulnerability d. Third-party vulnerability

c. Configuration vulnerability

Marcus is an information security architect at a product-based IT firm. He is responsible for developing policies for the most-secure mobile device enterprise-deploying model. The company will decide the level of choice and freedom for employees. Employees are supplied company-chosen and paid-for devices that they can use for both professional and personal activities. This action is performed under which enterprise deployment model? a. Bring your own device (BYOD) b. Corporate-owned device (COD) c. Corporate-owned, personally enabled (COPE) d. Choose your own device (CYOD)

c. Corporate-owned, personally enabled (COPE)

Amaya is looking for a hardware chip or integrated circuit (IC) that can be programmed by the user to carry out one or more logical operations, can be reprogrammed when needed, and can be configured by either the user or designer. Which option should Amaya select? a. Raspberry Pi b. Arduino c. Field-programmable gate array (FPGA) d. 8051 microcontroller

c. Field-programmable gate array (FPGA)

A federal appeals court recently made a judgment that caused significant public outrage. Soon after the ruling, the court's website was hacked, and the content was replaced with the text "Equal justice for all." Which of the following type of threat actors attacked the court's site? a. Insiders b. Cyberterrorists c. Hacktivists d. State actors

c. Hacktivists

Terrence, an executive VP of IT at Sigma Bank, noticed that yesterday, there was a major attack on several thousands of bank employees' computers located at geographically different locations where files and data from the computers got deleted. It was also noticed that several confidential files containing customer data were deleted from the bank's server in multiple locations, and the CEO's emails were deleted from the mail server. Since the bank was compliant with cybersecurity measures, Terrence suspects an internal hand in this activity. While going through the records of all employees working in the IT security of the bank, both past and present, he notices that there is an employee, Chris, who has enough experience to launch this attack, was unhappy with his annual review last year, and had left the bank three months ago.If Terrence were able to single Chris out as the one responsible for the attack, what kind of an attack would this be? a. Spyware b. Backdoor c. Logic bomb d. Keylogger

c. Logic bomb

Dan uses his personal laptop for writing the script for an upcoming high-budget, highly anticipated movie. To keep the script private, he decided not to connect his laptop to any network and updated his system with the latest virus definitions and security patches. Which of the following is Dan's laptop still vulnerable to? a. DNS poisoning b. DDoS c. Malicious USB d. Cross-site scripting

c. Malicious USB

John is a project manager with an IT firm, and his current project of developing an ERP application is in the development stage. Currently, the application is not yet mature or stable enough to be placed in a test environment. Which of the following secure coding review techniques is applicable for his project? a. Perform a static binary code analysis b. Perform dynamic code analysis c. Perform static code analysis d. Perform a structured manual analysis of code

c. Perform static code analysis

Which of the following is a form of malware attack that uses specialized communication protocols? a. Spyware b. Keylogger c. RAT d. Bot

c. RAT

Which attack embeds malware-distributing links in instant messages? a. Tailgating b. Spam c. Spim d. Phishing

c. Spim

Zeda Corporation provides online training solutions to global customers. To provide e-learning solutions, it integrates with multiple vendor platforms. This ensures seamless transfer to multiple operators' solutions through sign on. Joe, an IT security administrator, noticed that a threat actor has attacked the platform and stolen the user data. The source of this vulnerability was identified as one of the integrated external applications.What type of attack is this? a. This is a backdoor attack. b. This is an AI attack. c. This is an API attack. d. This is a device driver manipulation attack.

c. This is an API attack.

Anola is the security administrator in XYZ consulting. She is asked to suggest a deployment method where the data is stored in a completely secure, centralized server and accessed by authorized employees using their own devices. Which deployment should Anola choose? a. Choose your own device (CYOD) b. Corporate-owned device (COD) c. Virtual desktop infrastructure (VDI) d. Corporate-owned personally-enabled (COPE)

c. Virtual desktop infrastructure (VDI)

Which of the following is a configuration vulnerability? a. Direct access b. Weakest link c. Weak encryption d. Zero day

c. Weak encryption

What is the inbuild application available to prevent threat actors from modifying the registry in a Windows 10 operating system? a. Window 10 user interface b. Windows 10 registry editor c. Windows 10 tamper protection d. Windows 10 command prompt

c. Windows 10 tamper protection

Makayla has created software for automating the accounting process at ABL Manufacturing. She completed the software development, with testing done during development at individual stages. Before putting the software into production, Mary, who is in charge of the testing software, ran the application using tools and generated a report giving the various inputs and corresponding exceptions generated by the application. What process did Mary use? a. Dead coding b. Camouflaged coding c. Code signing d. Fuzzing

d. Fuzzing

An organization is planning a revamp of the existing computer hardware with new ones. The IT manager has informed department heads that some computers have faced BIOS attacks in the past. He has requested help in preventing future BIOS attacks.As an expert, which of these solutions can you use to effectively improve boot security when the new computers are implemented in the network? a. Use computers with flash memory for booting instead of BIOS b. Implement BIOS supplemented with CMOS c. Implement a Norton Antivirus solution d. Implement measured boot with UEFI

d. Implement measured boot with UEFI

Jordan has been asked by his organization to help them choose a mobile device communication channel for their new mobile device build. Which of the following mobile device communication channels should Jordan NOT suggest to his company? a. USB b. Cellular c. Wi-Fi d. Infrared

d. Infrared

An organization has decided to switch security responsibilities from a third party to internal security personnel due to the recent hike in demand for a provided service. As a result, you have been hired by the organization as a cybersecurity specialist. Which of the following will be your initial action for achieving enhanced security in the organization? a. Announce a bounty for identifying bugs. b. Consult a third party for penetration testing. c. Penetration test the entire network with no third-party involvement. d. Perform an automated scan on the entire network.

d. Perform an automated scan on the entire network.

What is the name of the process where a website validates user input before the application uses the input? a. Tokening b. Eliminating c. Authorizing d. Sanitizing

d. Sanitizing

Which of the following sets only lists additional features of a mobile device or a computing device? a. App stores microphone and/or digital camera, wireless cellular connection for voice communications, wireless personal area network interfaces such as Bluetooth or near-field-communications (NFC), removable storage media b. Global positioning system (GPS), microphone and/or digital camera, wireless cellular connection for voice communications, wireless personal area network interfaces such as Bluetooth or near-field-communications (NFC), small form factor c. Global positioning system (GPS), microphone and/or digital camera, wireless cellular connection for voice communications, wireless personal area network interfaces such as Bluetooth or near-field-communications (NFC), removable storage media d. Local non-removable data storage, microphone and/or digital camera, wireless cellular connection for voice communications, wireless personal area network interfaces such as Bluetooth or near-field-communications (NFC), removable storage media

c. Global positioning system (GPS), microphone and/or digital camera, wireless cellular connection for voice communications, wireless personal area network interfaces such as Bluetooth or near-field-communications (NFC), removable storage media

Smitha, an employee working in the accounts department, reported to the information security officer that she could not access her computer. James, the security officer, noticed the following on Smitha's system:On booting the computer, the following message was flashing on the computer screen with the IRS logo:"This computer is locked by the Internal Revenue Service. It has come to our attention that you are transferring funds to other agencies using this computer without compliance with the local income tax laws. As per section 22 of the U.S. Income Tax Act, the transmission of funds without applicable taxes is prohibited. Your IP address is identified in this fraudulent transaction and is locked to prevent further unlawful activities. This offense attracts a penalty of $400.00 for the first offense. You are hereby given 16 hours to resolve this issue, failing which you shall be prosecuted to the full extent of the law. You may make a secure payment by clicking on the following link. If you face any issues, you may reach out to us at [email protected]."The message will not close, nor is there access to applications or files on the computer; however, James can open shared files and f

d. Smitha's computer is compromised by ransomware.

What is a risk to data when training a machine learning (ML) application? a. Improper exception handling in the ML program b. ML algorithm security c. API attack on the device d. Tainted training data for machine learning

d. Tainted training data for machine learning

Sean is an information security architect at a financial firm. As his first project, he must design and build an efficient, sure-shot, yet cost-effective solution to detect and prevent bank credit card fraud. How should Sean proceed? a. Design a solution that is confined to and hardcoded with a specific place and specific time. If the user makes a transaction at a different place or time, it will be considered an outlier and trigger an alert. b. Design advanced credit card fraud detection solutions using data science and machine learning models trained with millions of historical credit card and debit card transaction data to better detect financial fraud. c. Design a security awareness training program to educate bank customers on phishing and vishing attacks and teach them how to avoid sharing sensitive debit and credit card information via unsolicited telephone calls or emails. d. Design a solution that keeps track of dates, times, locations of transactions, and geolocation of the authorized cell phone. When a user makes a purchase at a store, the bank can immediately check that the cell phone and the bank card are in the same place. If they are, the purchase is considered legitimate

d. Design a solution that keeps track of dates, times, locations of transactions, and geolocation of the authorized cell phone. When a user makes a purchase at a store, the bank can immediately check that the cell phone and the bank card are in the same place. If they are, the purchase is considered legitimate. But if they are not, then the payment is rejected.

Ronald is a software architect at MindSpace Software. He has been approached to develop a critical application for a finance company. The company has asked him to ensure that the employed coding process is secure. They have also requested that the project be completed in a few months, with a minimum version of the identified functionalities provided. The other functionalities can be developed later and added to the software while the application is live.Which development process would be ideal for Ronald to employ to achieve this objective? a. Ronald can employ an agile development model to meet the requirements with penetration testing done on the modules. b. Ronald can employ a waterfall model to meet the requirements by testing the code at every phase of development. c. Ronald can employ the rapid development model to meet the requirements of the client. d. Ronald can employ the SecDevOps model to meet the requirements of the client.

d. Ronald can employ the SecDevOps model to meet the requirements of the client.

Which of the following describes the action of an SQL injection into a database server? a. The SQL injection inserts specially created extensible markup language to manipulate the database taking control of the database giving control to the attacker to manipulate the database. b. The SQL injection inserts code into the DLL running process, causing the program to function differently than intended. c. The SQL injection is specially created code inserted into a legitimate program, which then lies dormant unless a special logical event triggers it. d. The SQL injection inserts specially created structured query language statements to manipulate the database server, giving control of the database to the attacker, who can then manipulate the database.

d. The SQL injection inserts specially created structured query language statements to manipulate the database server, giving control of the database to the attacker, who can then manipulate the database.

A few computers at a high-security software firm location have been compromised. The threat actor took user videos, confidential information like bank account IDs and passwords, email IDs and passwords, and computer screenshots. These confidential data have been shared every three hours from the computers to the threat actor. Which of the following is correct, based on the evaluation of the above observation? a. This is a hardware keylogger attack, as video capture functionality and periodic transfer of data are not possible with a software keylogger. b. This is a software keylogger attack, as it is sharing the information every three hours to the attacker. c. This is a hardware keylogger attack; it is only periodically sharing the information and is a manual transfer of information by a human agent. d. This is a software keylogger attack, as screenshots, video captures, and keystrokes have been routinely monitored and periodically shared.

d. This is a software keylogger attack, as screenshots, video captures, and keystrokes have been routinely monitored and periodically shared.

William downloaded some free software to help him with photo editing. A few days later, William noticed several personal photographs were modified and posted to various social media pages with obscene comments. He also noticed that there were videos of him that were morphed and circulated on adult websites. The videos were obviously taken using his webcam.What should William do to fix his problem and prevent it from happening again in the future? a. William should run an antivirus program and scan for all known worms, then download a worm-removal program to ensure all infected files are fully removed from his system. To prevent this in the future, he should run the backdoor check every time he installs a new program. b. William should disable his network devices, then run an antimalware program to scan for keyloggers while his computer is not connected to the internet and delete all infected files. To prevent this in the future, William should never download free software off the internet. c. William should run an antivirus program and scan for all known backdoor viruses, then remove the infected file(s). To prevent this in the future, he should run the backdoor check every time he inst

d. William should run an antimalware program and scan for all known RATs, then quarantine and remove the infected file(s). To prevent this in the future, he should only download software from trusted websites.

Which of the following types of malware allows the attacker to launch attacks from the infected computer to other computers? a. Backdoor b. Cryptomalware c. Keylogger d. Bot

d. Bot

While Andel is logging into his email through a browser, the login window disappears. Andel attempts to log in again and is successful. Days later, he goes to log into his email, and his attempt fails. He receives a message indicating that his username and/or password are invalid.What is Andel likely a victim of? a. Keyloggers b. Spyware c. RAT d. CSRF

d. CSRF

What is another term commonly used to define cross-site request forgery (CSRF): a. Client-server request forgery b. Server-side request forgery c. Cross-server request forgery d. Client-side request forgery

d. Client-side request forgery

Which of the following is the most common method for delivering malware? a. Social media b. Identity theft c. Removable media d. Email

d. Email