General Sec Concepts
This type of encryption only affects a section of a storage device.
File-level Encryption
Database Encryption
Full-disk Encryption
Partition Encryption
Partition Encryption
Which mitigation technique involves shutting off specific entry and exit points in a system to prevent potential vulnerabilities or unauthorized access?
Disabling ports
Segmentation
Encryption
Monitoring
Disabling ports
Jensen Innovations LLC is redesigning its network infrastructure to support its expanding R&D team. Which of the following strategies will MOST effectively less then attack surface?
Allowing most inbound and outbound traffic
Disabling unnecessary services and protocols
Implementing a single-layered security approach
Using the same password for all devices
Disabling unnecessary services and protocols
Which of the following BEST describes the initial step to ensure a secure procurement process at Dion Training?
Collaborate with the IT department for installation.
Determine the software's compatibility with existing systems.
Check for discounts or bulk pricing.
Verify the legitimacy of the software vendor.
Verify the legitimacy of the software vendor.
Which of the following terms is used to describe the specific level of risk an organization is prepared to accept in pursuit of its objectives?
Risk appetite
Risk tolerance
Risk acceptance
Risk capacity
Risk acceptance
Chris, a lawyer, needs to send a contract to their client for signature. She wants to ensure that
their client cannot later deny signing the contract. Which of the following methods can they use to prevent them from denying that they have signed contracts?
Encryption
A cryptographic primitive
Firewalls
Digital Signature
Digital Signature
Which of the following are hardware issues that result from products that are no longer being made or supported, but are still usable?
Legacy vulnerability
End-of-life vulnerability
Hardware cloning
Hardware tampering
End-of-life vulnerability
Kelly Innovations LLC wants to implement a network appliance that focuses on filtering traffic based on source and destination IP addresses, and port numbers. Which layer of the OSI model is this appliance primarily operating at?
Layer 4
Layer 2
Layer 3
Layer 5
Layer 4
Which of the following BEST describes how automation and orchestration in cybersecurity operations influence employee satisfaction and retention?
Decreases the demand for cybersecurity professionals.
Reduces repetitive and mundane tasks.
Directly increases salary packages.
Facilitates frequent role rotation among teams.
Reduces repetitive and mundane tasks.
In a meeting with the CEO, Burton has asked for guidance on developing the rules of engagement for an upcoming penetration test. The CEO doesn't think they need to create rules of engagement since they are hiring an experienced, well respected company to do the penetration testing. Why is it important for the company to still establish rules of engagement?
They need to know the total costs of the penetration test.
They need the names of all personnel who will be involved in the penetration test.
They need to set boundaries and limitations during the penetration test.
They need to set the timeline for later penetration tests.
They need to set boundaries and limitations during the penetration test.
MDR Innovations Corp, an IT company, is implementing a process of encryption where two parties establish a shared secret for communication purposes. Which of the following MOST accurately describes this process?
Symmetric encryption
Asymmetric encryption
Key exchange
Hashing
Key Exchange
A tech company discovers that the firmware in some of their devices contains a hidden backdoor. Upon investigation, it's determined that the compromised firmware came from an overseas supplier they contracted with. The backdoor gave attackers remote access to devices without user knowledge. What type of attack vector has the company fallen victim to?
Supply Chain
Blue Snarfing
Drive by download
On- path attack
Supply Chain
Kellen & Boevi Security Services has recommended your company use a port based system to prevent unauthorized users and devices. Which of the following are they recommending?
Fail-open
802.1X
Fail-closed
IDS
802.1X
While performing a digital investigation, which of the following statements BEST describes the role of preservation of evidence?
It maintains the integrity of digital evidence over time.
It allocates budgetary resources for the forensic investigation.
It allows investigators to prioritize evidence collection.
It provides legal teams with a roadmap for case strategy.
It maintains the integrity of digital evidence over time.
Which of the following BEST describes the Software Development Life Cycle (SDLC) in application security?
It replaces the need for regular software updates and patches.
It emphasizes the integration of security in software creation and maintenance.
It only considers security during the testing and creation phases of software development.
It primarily focuses on the speed of software delivery over security.
It emphasizes the integration of security in software creation and maintenance.
Which of the following terms emphasizes the mathematical structure used to scramble data so that only a specific key can unscramble it?
Digital signature
Encryption algorithm
Hash function
Cipher block
Encryption algorithm
Which of the following mitigation techniques can help enforce compliance with security standards and policies on a system or network by designating programs that are allowed to run and blocking all other programs from being run?
Least Privilege
Patching
Application allow list
Configuration Enforcement
Application allow list
Which of the following hardening techniques can help protect systems or devices from attacks by installing software like a firewall or antivirus directly on user devices to report and block potential attacks?
Patching
Changing Default Passwords
Least Privilege
Installation of endpoint protection
Installation of endpoint protection
When a legal organization routinely communicates with clients via email containing sensitive case details, which strategy would be the MOST effective to secure the communications?
Conducting regular user cybersecurity training
Implementation of end-to-end encrypted email
Utilization of VPNs for email transmission
Deployment of regular data backups to secure cloud storage
Implementation of end-to-end encrypted email
If a company's server has an estimated Single Loss Expectancy (SLE) of $15,000 due to an operational failure, and the Annual Rate of Occurrence (ARO) of these failures is expected to be 0.1 times per year, what is the Annual Loss Expectancy (ALE)?
$1,500
When considering the RSA algorithm, which description BEST captures its underlying mathematical property used for public key cryptography?
Trapdoor function
Symmetric encryption
Hash function
Digital signature
Trapdoor function
Which of the following vulnerabilities BEST describes a situation where a threat actor can manipulate data after it has been verified by an application, but before the application uses it for a specific operation?
Resource exhaustion
Memory leaks
Race conditions
Time-of-check (TOC)
Time-of-check (TOC)
A power plant utilizes a specialized system to manage and monitor its daily operations, including machinery and sensor feedback. While these systems offer centralized control, what security concern is most associated with them?
Runtime efficiency constraints.
Constrained memory use.
Optimization for containerized deployments.
Limited security update capabilities.
Limited security update capabilities.
Reed, a cybersecurity specialist at Dion Training Solutions, is optimizing the company's IPS. He notes that while signature-based detection is highly effective against known threats, it has some limitations. Which of the following BEST describes a limitation of signature-based detection in an IPS?
It requires substantial network bandwidth to operate.
It encrypts network traffic to hide malicious signatures.
It might not detect zero-day exploits.
It automatically updates with behavioral patterns of users.
It might not detect zero-day exploits.
Florence is the CEO of a company. She has the final say over all decisions made regarding the business, IT, accounting, and other departments. What type of governance does Florence's company have?
Committee governance
Decentralized governance
Board governance
Centralized governance
Centralized governance