Security Principles
A school stores student grades in an online system. Which security principle is most directly concerned with preventing an unauthorized person from viewing those grades?
Confidentiality
A company's primary office becomes unavailable because of a major flood. The organization has a plan describing how employees will continue performing critical business functions. What type of plan is this?
Business Continuity plan
An employee enters a username and password to sign into the company's payroll system. Which process is responsible for verifying that the employee is really the person associated with the account?
Authentication
A school's network needs a device that connects computers within the same local network and forwards traffic to the appropriate device. Which device is most appropriate?
Switch
A security analyst wants to determine which user logged into a server at 2:00 AM. Which source would be most useful?
A. Security logs
B. Business continuity plan
C. Password policy
D. Network diagram
Security logs
A company wants to prevent employees from connecting unauthorized USB drives to company computers. Which type of control would a software setting that blocks USB devices represent?
Technical control
Before developing a disaster recovery strategy, a company identifies its most important business functions and determines how much downtime each function can tolerate. What activity is the company performing?
Business Impact Analysis
A new accounting employee needs access to the payroll application but does not need access to the company's network administration tools. Which principle should guide the employee's permissions?
Least Privilege
A student needs to remotely administer a server while ensuring the administrative session is encrypted. Which protocol would be the best choice?
SSH
A company wants to verify that a downloaded software file has not been modified since it was originally published. Which technology would be most appropriate?
A. Hashing
B. Firewall
C. Authentication
D. Network segmentation
Hashing
A small business identifies a cybersecurity risk that would be extremely expensive to eliminate. Instead, the company purchases insurance to help cover potential financial losses. Which risk treatment strategy is being used?
Transfer
An online store determines that its ordering system must be operational again no more than two hours after a major outage. Which measurement does this represent?
RTO
A company automatically gives employees access based on their job titles. Employees in the HR role receive one set of permissions, while employees in Accounting receive another. Which access control model is being used?
RBAC
An attacker sends a large number of malicious requests to a web server in an attempt to make the service unavailable to legitimate users. What type of attack is this?
Denial-of-service attack
A security team uses a vulnerability scanner and discovers that several company computers are running software with known security vulnerabilities. What should the organization generally do next?
A. Ignore the vulnerabilities because no attack has occurred
B. Evaluate the vulnerabilities and prioritize appropriate remediation
C. Publish the vulnerability information publicly
D. Give users administrator privileges
Evaluate the vulnerabilities and prioritize appropriate remediation
A company discovers that an employee accidentally changed thousands of customer records. The records are still accessible, but many of them now contain incorrect information. Which part of the CIA Triad was primarily affected?
Integrity
A company backs up its customer database every 15 minutes. Management says that losing more than 15 minutes of customer information would be unacceptable. Which measurement is most directly being addressed?
RPO
A company's system considers a user's department, device type, physical location, and the current time before deciding whether to allow access. Which access control model best describes this approach?
ABAC
A company deploys a security device that analyzes network traffic and alerts the security team when it detects suspicious activity. The device does not automatically block the traffic. What technology is being described?
IDS
A company's security team discovers that ransomware has infected one employee's computer and is attempting to spread to other systems. What action would BEST represent containment?
A. Disconnect the infected computer from the network
B. Write the final lessons-learned report
C. Restore all systems from backup
D. Conduct employee security awareness training
Disconnect the infected computer from the network
A security analyst discovers that an employee's computer has an unpatched vulnerability. The analyst knows how to exploit the vulnerability to determine whether it is actually dangerous, but the analyst has not been authorized to perform penetration testing. What should the analyst do FIRST?
A. Exploit the vulnerability to determine its severity
B. Report the vulnerability according to organizational procedures
C. Publish the vulnerability so the vendor will fix it
D. Disable the employee's account
Report the vulnerability according to organizational procedures
A company performs a Business Impact Analysis and determines that its payment-processing system is the organization's most critical application. Management wants to determine which system should receive the highest restoration priority after a disaster. What should the disaster recovery team use to make this decision?
A. Which application is easiest to restore
B. Which application has the newest software
C. The results of the Business Impact Analysis
D. Which application has the largest number of users
The results of the Business Impact Analysis
A former employee left the company yesterday. The employee's account is still active and can access several internal applications. What should the security team be most concerned about?
A. The employee needs additional permissions
B. The organization failed to complete deprovisioning
C. The employee needs stronger authentication
D. The organization needs to create another account
The organization failed to complete deprovisioning
A company discovers that its employee network and internet-connected security cameras are currently on the same network. The security team is concerned that compromising a camera could provide an attacker with access to employee computers. Which security measure would BEST reduce this risk?
A. Increase the internet connection speed
B. Segment the networks
C. Give every employee administrator privileges
D. Disable all security logs
Segment the networks
A SIEM generates an alert showing 25 failed login attempts against an employee account from an unfamiliar location. The employee normally works from the company's local office. What should the security analyst do FIRST?
A. Immediately shut down the entire company network
B. Delete the alert because failed logins are harmless
C. Investigate the activity and gather additional information according to procedure
D. Publicly announce that the employee's account has been hacked
Investigate the activity and gather additional information according to procedure