Cyber Foundations
An adversary calls Cedarmount's front desk pretending to be from the electronic-health-record vendor and says: "This is urgent — I need the admin password right now or your system will go down at noon." Which TWO social engineering tactics is the adversary using?
(A) Scarcity and pretexting.
(B) Authority and urgency.
(C) Consensus and familiarity.
(D) Reciprocity and intimidation
(B) Authority and urgency.
A vendor wearing a high-visibility vest and carrying a large crate stands at the staff door at 8:55 AM. An arriving employee opens the door and holds it for the vendor without asking who they are visiting or asking to see a badge. Which physical attack has the vendor just succeeded with?
(A) Card cloning.
(B) Piggybacking.
(C) Tailgating.
(D) Shoulder surfing.
(B) Piggybacking.
Which of the following is a MANAGERIAL control, not a physical one?
(A) A card reader on the server-room door.
(B) A surveillance camera at the staff entrance.
(C) A bollard at the front of the building.
(D) A written workstation-security policy.
(D) A written workstation-security policy.
Which of the following is NOT one of the four detection mechanisms for physical attacks?
(A) Motion sensors.
(B) Observant employees.
(C) Cyber insurance.
(D) Cameras.
(C) Cyber insurance.
Cedarmount fires a senior office manager who held shared access to the patient billing system. Two weeks later, several billing records are quietly altered to redirect payments. Which adversary class is MOST consistent with this pattern?
(A) Insider.
(B) Script kid.
(C) Cyberterrorist.
(D) Hacktivist
(A) Insider.
A coffee-shop patron rummages through the trash bins behind the building of a small accounting firm and recovers shredded-but-poorly-reassembled client tax forms. Which physical attack is this?
(A) Shoulder surfing.
(B) Card cloning.
(C) Port-attached device.
(D) Dumpster diving.
(D) Dumpster diving.
Which physical control specifically defeats both piggybacking AND tailgating at a funneled entry?
(A) Access vestibule.
(B) Card reader.
(C) Privacy screen filter.
(D) Surge protector.
(A) Access vestibule.
A school installs a motion sensor in a high-traffic corridor that students walk through every 5 minutes during the school day. After two weeks, the alerts are ignored. Which placement principle was violated?
(A) Cameras should be placed at ingress and egress.
(B) Motion sensors belong in UNEXPECTED areas.
(C) Stationary guards should cover funneled traffic.
(D) Locks should be placed on every sensitive entry.
(B) Motion sensors belong in UNEXPECTED areas.
A defender notices that an attacker has stayed in the network for three weeks, installing a remote access trojan that re-establishes a connection every time the attacker is kicked out. Which phase of a cyberattack is the attacker MOST CLEARLY in?
(A) Reconnaissance.
(B) Initial access.
(C) Persistence.
(D) Evading detection.
(C) Persistence.
A small clinic's vaccine fridge stops working overnight after the building's circuit breaker is tripped — not by accident, but by a passerby who reached through a side gate. Which compromise category BEST fits?
(A) Unauthorized modification of data.
(B) Theft of digital resources.
(C) Disruption of services.
(D) Card cloning.
(C) Disruption of services.
An adversary often plugs a malware-loaded USB into an unattended reception PC. Which security control DIRECTLY defeats this attack?
(A) Privacy screen filter.
(B) Generator.
(C) Bollard.
(D) Disable USB ports.
(D) Disable USB ports.
A coffee-roastery owner needs guard coverage at the main staff entrance during the morning rush AND wants someone walking the perimeter of the warehouse at unpredictable times. Best recommendation:
(A) Cameras instead of any guards.
(B) A stationary guard for both.
(C) A patrolling guard for both.
(D) Stationary inside + patrol outside.
(D) Stationary inside + patrol outside.
Cedarmount Family Clinic's draft risk register notes that the vaccine fridge (annual value ~$40,000) has no backup power supply and no temperature alarm. The fridge sits in an unlocked back room. A regional power outage occurs twice a year on average; in the most recent outage, the fridge was without power for 7 hours. Which CIA property is MOST clearly at risk for the vaccine fridge?
(A) Availability.
(B) Integrity.
(C) All three are equally at risk.
(D) Confidentiality.
(A) Availability.
Northlight Press's reception PC has exposed USB ports on the front of the tower. The PC is on the same network as the newsroom's CMS server (where draft articles live) and is unattended from 5:30 PM to 9 AM the next day. An overnight janitor with master-key building access cleans the office twice a week. The reception-PC setup BEST fits which risk level? (A) MODERATE — non-critical PC, but a possible foothold to newsroom systems.
(B) HIGH — sensitive information is exposed in a space without sufficiently restricted access.
(C) There is no risk — the door auto-locks at 7 PM. (D) LOW — the PC contains no sensitive information.
(A) MODERATE — non-critical PC, but a possible foothold to newsroom systems.
Wexford Community Playhouse is allocating its $18,000 renovation security budget. The committee's draft plan: $14,000 for a single full-height turnstile at the main staff entrance, $1,800 for a lockable cabinet around the box-office POS, $2,000 for staff-wide training and signage, and $200 for a USB-port lock kit. The plan deferred outdoor bollards, ceiling cameras, and a UPS for the server.
Which of the following BEST describes the strongest weakness in the committee's draft plan?
(A) The plan spent too much on training and not enough on cameras.
(B) The plan over-budgeted on training because policies are free.
(C) Spending 78% on one control leaves multiple HIGH-risk gaps.
(D) The plan is perfect because it includes a turnstile
(C) Spending 78% on one control leaves multiple HIGH-risk gaps.
Foundry Collective Coworking's side-door badge log shows that badge M-0612 (marked LAPSED 6 weeks ago) successfully unlocked the door five times in two weeks, all between 2:04 AM and 2:14 AM, with door-open durations of 7.8 to 9.4 seconds. Normal active-member entries on the same log show 1.3 to 1.7 second openings. The only camera at this door points OUTWARD at the parking lot and is recorded but not monitored in real time.
Which TWO log anomalies BEST suggest an attack rather than normal use?
(A) Late-hour timing AND repeated swipes by the same badge.
(B) Door-open duration AND outdoor camera angle.
(C) Long door-open durations AND an active-but-lapsed credential.
(D) Number of total swipes AND identical timestamps.
(C) Long door-open durations AND an active-but-lapsed credential.
Cedarmount Family Clinic's draft risk register notes that the vaccine fridge (annual value ~$40,000) has no backup power supply and no temperature alarm. The fridge sits in an unlocked back room. A regional power outage occurs twice a year on average; in the most recent outage, the fridge was without power for 7 hours.
Which CONTROL would be classified as both PHYSICAL (type) AND DETECTIVE (function)?
(A) A written incident-response plan listing whom to call.
(B) Adding an uninterruptible power supply (UPS) to the fridge.
(C) Cyber-insurance covering vaccine spoilage.
(D) A surveillance camera aimed at the back-office door.
(D) A surveillance camera aimed at the back-office door.
Northlight Press's reception PC has exposed USB ports on the front of the tower. The PC is on the same network as the newsroom's CMS server (where draft articles live) and is unattended from 5:30 PM to 9 AM the next day. An overnight janitor with master-key building access cleans the office twice a week.
which control would BEST mitigate the risk identified in the previous question?
(A) Buy cyber-insurance for the reception PC.
(B) Disable USB ports + put it on a guest-isolated VLAN, away from the CMS.
(C) Move the reception PC to a different desk.
(D) Replace the reception PC's monitor with a privacy screen filter.
(B) Disable USB ports + put it on a guest-isolated VLAN, away from the CMS.
Wexford Community Playhouse is allocating its $18,000 renovation security budget. The committee's draft plan: $14,000 for a single full-height turnstile at the main staff entrance, $1,800 for a lockable cabinet around the box-office POS, $2,000 for staff-wide training and signage, and $200 for a USB-port lock kit. The plan deferred outdoor bollards, ceiling cameras, and a UPS for the server.
Which single substitution would MOST improve the plan?
(A) Replace the lockable POS cabinet with a privacy screen filter to save money.
(B) Replace the $14K turnstile with card readers; spend the rest on cameras and UPS.
(C) Remove the USB-port lock to free up $200 for more signage.
(D) Remove the staff-wide training to free up $2,000 for an additional camera.
(B) Replace the $14K turnstile with card readers; spend the rest on cameras and UPS.
Foundry Collective Coworking's side-door badge log shows that badge M-0612 (marked LAPSED 6 weeks ago) successfully unlocked the door five times in two weeks, all between 2:04 AM and 2:14 AM, with door-open durations of 7.8 to 9.4 seconds. Normal active-member entries on the same log show 1.3 to 1.7 second openings. The only camera at this door points OUTWARD at the parking lot and is recorded but not monitored in real time.
Which placement change BEST addresses the gap that allowed the attack to go un-investigated?
(A) Re-aim to cover INSIDE the door + add a face-shot camera.
(B) Remove the side-door camera entirely.
(C) Add a second camera with the same outside-facing view.
(D) Replace the badge reader with a regular key.
(A) Re-aim to cover INSIDE the door + add a face-shot camera.