Questions

Review Questions Ch1

1. Matt is updating the organization's threat assessment process.

What category of control is Matt implementing?

A. Operational

B. Technical

C. Corrective

D. Managerial

2. Jade's organization recently su ered a security breach that a ected stored

credit card data. Jade's primary concern is the fact that the organization is

subject to sanctions for violating the provisions of the Payment Card Industry

Data Security Standard.

What category of risk is concerning Jade?

A. Strategic

B. Compliance

C. Operational

D. Financial
3. Chris is responding to a security incident that compromised one of his

organization's web servers. He believes that the attackers defaced one or more

pages on the website. What cybersecurity objective did this attack violate?

A. Confidentiality

B. Nonrepudiation

C. Integrity

D. Availability

4. Gwen is exploring a customer transaction reporting system and discovers

the table shown here. What type of data minimization has most likely been

used on this table?

Technet24

A. Destruction

B. Masking
C. Tokenization

D. Hashing

5. Tonya is concerned about the risk that an attacker will attempt to gain access

to her organization's database server. She is searching for a control that would

discourage the attacker from attempting to gain access. What type of security

control is she seeking to implement?

A. Preventive

B. Detective

C. Corrective

D. Deterrent

6. Greg is implementing a data loss prevention system. He would like to ensure

that it protects against transmissions of sensitive information by guests on his

wireless network. What DLP technology would best meet this goal?

A. Watermarking

B. Pattern recognition
C. Host-based

D. Network-based

7. What term best describes data that is being sent between two systems over

a network connection?

A. Data at rest

B. Data in transit

C. Data in processing

D. Data in use

8. Tina is tuning her organization's intrusion prevention system to prevent false

positive alerts. What type of control is Tina implementing?

A. Technical control

B. Physical control

C. Managerial control

D. Operational control

Technet24
9. Which one of the following is not a common goal of a cybersecurity

attacker?

A. Disclosure

B. Denial

C. Alteration

D. Allocation

10. Tony is reviewing the status of his organization's defenses against a breach of

their file server. He believes that a compromise of the file server could reveal

information that would prevent the company from continuing to do business.

What term best describes the risk that Tony is considering?

A. Strategic

B. Reputational

C. Financial

D. Operational

11. Which one of the following data elements is not commonly associated with

identity theft? A. Social Security number

B. Driver's license number

C. Frequent flyer number

D. Passport number
12. What term best describes an organization's desired security state?

A. Control objectives

B. Security priorities

C. Strategic goals

D. Best practices

13. Lou mounted the sign below on the fence surrounding his organization's

datacenter. What control type best describes this control?

Source: Gabriel Cassan / Adobe Stock

A. Compensating

B. Detective
C. Physical

D. Deterrent

14. What technology uses mathematical algorithms to render information

unreadable to those lacking the required key?

A. Data loss prevention

B. Data obfuscation

C. Data minimization

D. Data encryption

15. Greg recently conducted an assessment of his organization's security

controls and discovered a potential gap: the organization Technet24 does not

use full-disk encryption on laptops. What type of control gap exists in this

case?

A. Detective

B. Corrective

C. Deterrent

D. Preventive
16. What compliance regulation most directly a ects the operations of a health-

care provider?

A. HIPAA

B. PCI DSS

C. GLBA

D. SOX

17. Nolan is writing an after action report on a security breach that took place

in his organization. The attackers stole thousands of customer records from

the organization's database. What cybersecurity principle was most impacted

in this breach?

A. Availability

B. Nonrepudiation

C. Confidentiality

D. Integrity

18. Which one of the following objectives is not one of the three main objectives

that information security professionals must achieve to protect their organizations

against cybersecurity threats?

A. Integrity

B. Nonrepudiation

C. Availability

D. Confidentiality
19. Which one of the following data protection techniques is reversible when

conducted properly?

A. Tokenization

B. Masking

C. Hashing

D. Shredding

20. Which one of the following statements is not true about compensating

controls under PCI DSS?

A. Controls used to fulfill one PCI DSS requirement may be usedto

compensate for the absence of a control needed to meet another

requirement.

B. Controls must meet the intent of the original requirement.

C. Controls must meet the rigor of the original requirement.D. Compensating

controls must provide a similar level of defense as the original

requirement..

CH2

1. Which of the following measures is not commonly used to assess threat

intelligence?

A. Timeliness

B. Detail
C. Accuracy

D. Relevance

2. Which one of the following motivations is most commonly attributed to

hacktivists?

A. War

B. Financial gain

C. Political/philosophical beliefs

D. Ethical

3. Kolin is a penetration tester who works for a cybersecurity company. His

firm was hired to conduct a penetration test against a health-care system,

and Kolin is working to gain access to the systems belonging to a hospital in

that system. What term best describes Kolin's work? A. Authorized attacker

B. Unauthorized attacker

C. Unknown attacker

D. Semi-authorized attacker

4. Which one of the following attackers is most likely to be

associated with an APT? Technet24

A. Nation-state actor

B. Hacktivist

C. Unskilled

D. Insider

5. Which organization did the U.S. government help create to share knowledge

between organizations in specific verticals?

A. DHS

B. SANS

C. CERTS

D. ISACs

6. Which of the following threat actors typically has the greatest access to

resources?

A. Nation-state actors

B. Organized crime

C. Hacktivists

D. Insider threats
7. Of the threat vectors shown here, which one is most commonly exploited by

attackers who are at a distant location?

A. Email

B. Direct access

C. Wireless

D. Removable media

8. Which one of the following is the best example of a hacktivist group?

A. Chinese military

B. U.S. government

C. Russian mafia

D. Anonymous

9. What type of assessment is particularly useful for identifying insider

threats? A. Behavioral

B. Instinctual

C. Habitual

D. IoCs

10. Cindy is concerned that her organization may be targeted by a supply chain

attack and is conducting a review of all of her vendor and supplier partners.
Which one of the following organizations is least likely to be the conduit for a

supply chain attack?

A. Hardware provider

B. Software provider

C. Managed service provider

D. Talent provider

11. Greg believes that an attacker may have installed malicious firmware

in a network device before it was provided to his organization by the

supplier. What type of threat vector best describes this attack? A. Supply

chain

B. Removable media

C. Cloud

D. Direct access

12. Ken is conducting threat research on Transport Layer Security (TLS) and

would like to consult the authoritative reference for the protocol's technical

specification. What resource would best meet his needs?

A. Academic journal

B. Internet RFCs

Technet24
C. Subject matter experts

D. Textbooks

13. Wendy is scanning cloud-based repositories for sensitive information.

Which one of the following should concern her most, if discovered in a public

repository?

A. Product manuals

B. Source code

C. API keys

D. Open source data

14. Which one of the following threat research tools is used to visually display

information about the location of threat actors?

A. Threat map

B. Predictive analysis

C. Vulnerability feed

D. STIX

15. Vince recently received the hash values of malicious software that several

other firms in his industry found installed on their systems after a compromise.

What term best describes this information?

A. Vulnerability feed
B. IoC

C. TTP

D. RFC

16. Ursula recently discovered that a group of developers are sharing information

over a messaging tool provided by a cloud vendor but not sanctioned by her

organization. What term best describes this use of technology? A. Shadow IT

B. System integration

C. Vendor management

D. Data exfiltration

17. Tom's organization recently learned that the vendor is discontinuing

support for their customer relationship management (CRM) system. What

should concern Tom the most from a security perspective?

A. Unavailability of future patches

B. Lack of technical support

C. Theft of customer information

D. Increased costs

18. Which one of the following information sources would not be

considered an OSINT source? A. DNS lookup

B. Search engine research

C. Port scans

D. WHOIS queries

19. Edward Snowden was a government contractor who disclosed sensitive

government documents to journalists to uncover what he believed were

unethical activities. Which of the following terms best describe Snowden's

activities? (Choose two.)

A. Insider

B. State actor

C. Hacktivist

D. APT

E. Organized crime

20. Renee is a cybersecurity hobbyist. She receives an email about a new web-

based grading system being used by her son's school and she visits the site. She

notices that the URL for the site looks like this:

Technet24 www.myschool.edu/grades.php&studentID=1023425

She realizes that 1023425 is her son's student ID number and she then

attempts to access the following similar URLs:

www.myschool.edu/grades.php&studentID=1023423

www.myschool.edu/grades.php&studentID=1023424

www.myschool.edu/grades.php&studentID=1023426

www.myschool.edu/grades.php&studentID=1023427

When she does so, she accesses the records of other students. She closes the

records and immediately informs the school principal of the vulnerability.

What term best describes Renee's work?

A. Authorized hacking

B. Unknown hacking

C. Semi-authorized hacking

D. Unauthorized hacking

Ch3

1. Ryan wants to prevent logic bombs created by insider threats from

impacting his organization. What technique will most e ectively limit the

likelihood of logic bombs being put in place?

A. Deploying antivirus software

B. Using a code review process

C. Deploying endpoint detection and response (EDR) software

D. Disabling autorun for USB drives

2. Yasmine believes that her organization may be dealing with an advanced

rootkit and wants to write IoC definitions for it. Which of the following is not

likely to be a useful IoC for a rootkit?

A. File hashes

B. Command and control domains

C. Pop-ups demanding a ransom

D. Behavior-based identifiers

3. Nathan works at a school and notices that one of his sta appears to have

logged in and changed grades for a single student to higher grades, even in

classes that sta member is not responsible for. When asked, the sta member

says that they did not perform the action. Which of the following is the most

likely way that a student could have gotten access to the sta member's

password?

A. A keylogger
B. A rootkit

C. Spyware

D. A logic bomb

4. Amanda notices tra c between her systems and a known malicious host on

TCP port 6667. What type of tra c is she most likely detecting?

A. Command and control

B. Spyware

C. A worm

D. A hijacked web browser

5. Mike discovers that attackers have left software that allows them to have

remote access to systems on a computer in his company's Technet24 network.

How should he describe or classify this malware?

A. A worm

B. Crypto malware

C. A trojan

D. A backdoor
6. What is the primary impact of bloatware?

A. Consuming resources

B. Logging keystrokes

C. Providing information about users and devices to third

parties

D. Allowing unauthorized remote access

7. What type of malware is used to gather information about a user's browsing

habits and system?

A. A Trojan

B. Bloatware

C. Spyware

D. A rootkit

8. Matt uploads a malware sample to a third-party malware scanning site

that uses multiple antimalware and antivirus engines to scan the sample.

He receives multiple di erent answers for what the malware package is.

What has occurred? A. The package contains more than one piece of

malware.

B. The service is misconfigured.

C. The malware is polymorphic and changed while being tested.D. Di erent

vendors use di erent names for malware packages.

9. Nancy is concerned that there is a software keylogger on the system she's

investigating. What best describes data that may have been stolen?

A. All files on the system

B. All keyboard input

C. All files the user accessed while the keylogger was active

D. Keyboard and other input from the user

10. A system in Elaine's company has suddenly displayed a message demanding

payment in Bitcoin and claiming that the data from the system has been

encrypted. What type of malware has Elaine likely encountered?

A. Worms

B. A virus

C. Ransomware

D. Rootkit

11. Rick believes that a system he is responsible for has been compromised

with malware that uses a rootkit to obtain and retain access to the system.

When he runs an antimalware tool's scanner, the system doesn't show any

malware. If he has other data that indicates the system is infected, what
should his next step be if he wants to determine what malware may be on the

system?

A. Rerun the antimalware scan.

B. Mount the drive on another system and scan it that way.

C. Disable the systems antivirus because it may be causing afalse negative.

D. The system is not infected and he should move on.

12. A recently terminated developer from Jaya's organization has contacted

the organization claiming that they left code in an application that they wrote

that will delete files and bring the application down if they are not employed

by the company. What type of malware is this?

A. Ransomware

Technet24

B. Extortionware

C. A logic bomb

D. A Trojan

13. Selah wants to ensure that malware is completely removed from a system.

What should she do to ensure this?

A. Run multiple antimalware tools and use them to remove alldetections.

B. Wipe the drive and reinstall from known good media.

C. Use the delete setting in her antimalware software ratherthan the

quarantine setting.

D. There is no way to ensure the system is safe and it should bedestroyed.

14. What is the key di erence between a worm and a virus?

A. What operating system they run on

B. How they spread

C. What their potential impact is

D. The number of infections

15. Ben wants to analyze Python code that he believes may be malicious code

written by an employee of his organization. What can he do to determine if

the code is malicious?

A. Run a decompiler against it to allow him to read the code

B. Open the file using a text editor to review the code

C. Test the code using an antivirus tool

D. Submit the Python code to a malware testing website

16. Which of the following defenses is most likely to prevent Trojan

installation?

A. Installing patches for known vulnerabilities

B. Preventing downloads from application stores

C. Preventing the use of USB drives

D. Disabling autorun from USB drives

17. Jason's security team reports that a recent WordPress vulnerability seems

to have been exploited by malware and that their organization's entire

WordPress service cluster has been infected. What type of malware is most

likely involved if a vulnerability in the software was exploited over the

network?

A. A logic bomb

B. A Trojan

C. A worm

D. A rootkit

18. Hui's organization recently purchased new Windows computers from an o

ce supply store. The systems have a number of unwanted programs on them

that load at startup that were installed by the manufacturer. What type of

software is this?

A. Viruses

B. Trojans

C. Spyware

D. Bloatware

19. What type of malware connects to a command and control system,

allowing attackers to manage, control, and update it remotely? A. A bot

B. A drone

C. A vampire
D. A worm

20. Randy believes that a system that he is responsible for was infected after a

user picked up a USB drive and plugged it in. The user claims that they only

opened one file on the drive to see who might own it. What type of malware is

most likely involved?

Technet24

A. A virus

B. A worm

C. A trojan

D. A spyware tool
Ch4

1. Joseph receives an email notifying him that he needs to change his

password due to a recent account issue. He notices that the email links him to

a website using the domain amaz0n.com. What type of attack should he

describe this as?

A. Typosquatting

B. Phishing

C. Smishing

D. A watering hole attack

2. When you combine phishing with voicemail, it is known as:

A. Whaling

B. Spoofing

C. Spooning

D. Vishing

3. While reviewing her logs, Michele notices that a remote system has

attempted to log into her server via SSH using the username admin and a

variety of passwords like “password” and “ninja.”

What type of attack has Michele noticed?

A. A brute-force attack

B. Shoulder surfing
C. An on-path attack

D. Pretexting

4. Joanna wants to detect password spraying attacks. What type of rule should

she deploy through her security systems?

A. Match attempts to log into many systems with the sameusername and

password.

B. Match multiple attempts to log into the same user accountusing di

erent passwords.

C. Match repeated use of the same password during failed loginattempts

for multiple usernames.

D. Match all attempts to use passwords with slight changes forTechnet24

the same account.

5. One of the sta at Susan's organization has reported that a critical vendor has

contacted them about an unpaid invoice. After Susan investigates, she discovers

that the invoice was sent from an email account that was not typically a contact

and that the invoice requested payment to a PayPal account. What type of social

engineering attack has Susan most likely discovered?

A. Smishing

B. Business email compromise

C. Disinformation

D. Typosquatting
6. Selah infects the ads on a website that users from her target company

frequently visit with malware as part of her penetration test. What technique

has she used?

A. A watering hole attack

B. Vishing

C. Whaling

D. Typosquatting

7. Ben wants to determine if brute-force password attacks are being used

against his company. What log information is least likely to be useful when

working to detect brute-force attacks?

A. Source IP address or hostname

B. Failed login logs

C. The password that was used for each attempt

D. The geographic location of system being logged into

8. Melissa receives a call and the caller informs her a senior manager in her

organization needs her to buy gift cards for an event that starts in an hour. The

caller says that the senior leader forgot to get the cards, and that the event is

critical to her organization. Melissa buys the cards and sends them to the Gmail

address the caller says that the senior leader needs them sent to. What type of

attack has Melissa fallen for?

A. Phishing

B. Pretexting
C. Business email compromise

D. Carding

9. Alaina wants to determine if a password spraying attack was used against her

organization. Which of the following indicators would

be most useful as part of her investigation? A. The

time the login attempts happened

B. The passwords used for failed attempts

C. The source IP address of the attempts

D. The number of failed attempts for each user

10. Which of the following human vectors is primarily associated with nation-state

actors?

A. Misinformation campaigns

B. Watering hole attacks

C. Business email compromise

D. Password spraying
11. Nicole accidentally types www.smazon.com into her browser and discovers

that she is directed to a di erent site loaded with ads and pop-ups. Which of the

following is the most accurate description of the attack she has experienced?

A. DNS hijacking

B. Pharming

C. Typosquatting

D. Hosts file compromise

12. Devon is a penetration tester and sets up malicious tools on his Technet24

target organization's primary internal website. What type of attack is he

conducting?

A. A misinformation campaign

B. A watering hole attack

C. A typosquatting attack

D. A disinformation campaign

13. Phishing emails sent pretending to be from a company that recipients are

familiar with and likely to respond to is what type of attack?

A. Phishing

B. Pharming

C. Brand impersonation

D. Pretexting
14. When a caller was recently directed to Amanda, who is a junior IT employee

at her company, the caller informed her that they were the head of IT for her

organization and that she needed to immediately disable the organization's

firewall. After Amanda made the change, she discovered that the caller was not

the head of IT, and that they were actually a penetration tester hired by her

company. What social engineering attack best describes this?

A. Smishing

B. Pretexting

C. Impersonation

D. Vishing

15. Fred is concerned about text message–based attacks. Which of the following

attacks relies on text messages as its primary focus?

A. Impersonation

B. Watering hole attacks

C. Smishing

D. Business email compromise

16. Sharif notices that his authentication logs have many di erent usernames

showing failed logins with the same password. What type of attack has he

discovered?

A. Credential harvesting

B. Impersonation
C. BEC

D. Spraying

17. Naomi receives a report of smishing. What type of attack should she be

looking for?

A. Compressed files in phishing

B. Text message–based phishing

C. Voicemail-based phishing

D. Server-based phishing

18. Jack's organization wants to prevent typosquatting. What option should he

select to address this issue?

A. Copyright the domain name

B. Purchase the most common typos for his organization'sdomain

C. Trademark the domain name

D. Disable typo resolution for the domain

19. Gwyne's company has been contacted by customers asking about a new

social media account operating under the company's brand. The social media

account is advertising cryptocurrency, which Gwyne's organization does not sell

or work with. What type of attack best describes what Gwyne's organization has

encountered?

A. Impersonation

B. Brand impersonation

Technet24
C. Mis-branding

D. Crypto-phishing

20. Nation-state-driven social media campaigns about the trustworthiness of

the U.S. election in 2016 are an example of what type of social engineering?

A. Smishing

B. Pretexting

C. Disinformation

D. Spraying

Ch5

1. Which one of the following security assessment techniques assumes that an

organization has already been compromised and searches for evidence of that

compromise?

A. Vulnerability scanning

B. Penetration testing

C. Threat hunting

D. War driving
2. Renee is configuring her vulnerability management solution to perform

credentialed scans of servers on her network. What type of account should she

provide to the scanner?

A. Domain administrator

B. Local administrator

C. Root

D. Read-only

3. Ryan is planning to conduct a vulnerability scan of a businesscritical system using

dangerous plug-ins. What would be the best approach for the initial scan?

A. Run the scan against production systems to achieve the mostrealistic

results possible.

B. Run the scan during business hours.

C. Run the scan in a test environment.

D. Do not run the scan to avoid disrupting the business.

4. Which one of the following values for the CVSS attack complexity metric would

indicate that the specified attack is simplest to exploit? A. High

B. Medium

C. Low

D. Severe
5. Tara recently analyzed the results of a vulnerability scan report and found

that a vulnerability reported by the scanner did not exist because the system

was actually patched as specified. What type of error occurred?

A. False positive

B. False negative

C. True positive

D. True negative

6. Brian ran a penetration test against a school's grading system and discovered

a flaw that would allow students to alter their grades by exploiting a SQL

injection vulnerability. What type of control should he recommend to the

school's cybersecurity team to prevent students from engaging in this type of

activity?

A. Confidentiality

B. Integrity

C. Alteration

D. Availability

7. Which one of the following security assessment tools is least likely to be used

during the reconnaissance phase of a penetration test?

A. Nmap

B. Nessus

C. Metasploit

D. Nslookup
8. During a vulnerability scan, Brian discovered that a system on his network

contained this vulnerability:

What security control, if deployed, would likely have addressed this issue?

A. Patch management

B. File integrity monitoring

C. Intrusion detection

D. Threat hunting

9. Which one of the following tools is most likely to detect an XSS

vulnerability?

A. Static application test

B. Web application vulnerability scanner

C. Intrusion detection system

D. Network vulnerability scanner

10. During a penetration test, Patrick deploys a toolkit on a compromised

system and uses it to gain access to other systems on the same network. What

term best describes this activity?

A. Lateral movement

B. Privilege escalation

C. Footprinting

D. OSINT

11. Zian is a cybersecurity leader who is coordinating the activities of a security

audit. The audit is being done to validate the organization's financial statements

to investors and involves a review of cybersecurity controls. What term best

describes this audit?

A. External audit

B. Penetration test

C. Internal audit

D. Informal audit

12. Which one of the following assessment techniques is designed to solicit

participation from external security experts and reward them for discovering

vulnerabilities?

A. Threat hunting

B. Penetration testing

Technet24

C. Bug bounty
D. Vulnerability scanning

13. Kyle is conducting a penetration test. After gaining access to an

organization's database server, he installs a backdoor on the

server to grant himself access in the future. What term best describes this

action?

A. Privilege escalation

B. Lateral movement

C. Maneuver

D. Persistence

14. Which one of the following techniques would be considered passive

reconnaissance? A. Port scans

B. Vulnerability scans

C. WHOIS lookups

D. Footprinting

15. Which element of the SCAP framework can be used to consistently

describe vulnerabilities?

A. CPE
B. CVE

C. CVSS

D. CCE

16. Bruce is conducting a penetration test for a client. The client provided him

with full details of their systems in advance. What type of test is Bruce

conducting?

A. Partially known environment test

B. Detailed environment test

C. Known environment test

D. Unknown environment test

17. Lila is working on a penetration testing team and she is unsure whether she

is allowed to conduct social engineering as part of the test. What document

should she consult to find this information?

A. Contract

B. Statement of work

C. Rules of engagement

D. Lessons learned report

18. Grace would like to determine the operating system running on a system that

she is targeting in a penetration test. Which one of the following techniques will

most directly provide her with this information?

A. Port scanning

B. Footprinting

C. Vulnerability scanning

D. Packet capture

19. Kevin recently identified a new security vulnerability and computed its

CVSS base score as 6.5. Which risk category would this vulnerability fall into?

A. Low

B. Medium

C. High

D. Critical

20. Which one of the CVSS metrics would contain information about the type of

account access that an attacker must have to execute an attack?

A. AV B.

C. PR
D. AC

Ch6

1. Adam is conducting software testing by reviewing the source code of the

application. What type of code testing is Adam conducting?

A. Mutation testing

B. Static code analysis

C. Dynamic code analysis

D. Fuzzing

2. Charles is worried about users conducting SQL injection attacks.

Which of the following solutions will best address his concerns?

A. Using secure session management

B. Enabling logging on the database

C. Performing user input validation

D. Implementing TLS

3. Precompiled SQL statements that only require variables to be input are an

example of what type of application security control?

A. Parameterized queries

B. Encoding data

Technet24
C. Input validation

D. Appropriate access controls

4. During a web application test, Ben discovers that the application shows SQL

code as part of an error provided to application users.

What should he note in his report?

A. Improper error handling

B. Code exposure

C. SQL injection

D. A default configuration issue

5. The application that Scott is writing has a flaw that occurs when two

operations are attempted at the same time, resulting in unexpected results

when the two actions do not occur in the expected order. What type of flaw

does the application have?

A. Dereferencing

B. A race condition

C. An insecure function

D. Improper error handling

6. Every time Susan checks code into her organization's code repository, it is

tested and validated, and then if accepted, it is immediately put into

production. What is the term for this?

A. Continuous integration

B. Continuous delivery

C. A security nightmare

D. Agile development

7. Tim is working on a change to a web application used by his organization

to fix a known bug. What environment should he be working in? A. Test

B. Development

C. Staging

D. Production

8. Ricky is concerned that developers in his organization make use of third-

party code in their applications, which may introduce unknown

vulnerabilities. He is concerned about the risk of the organization running

code that it is not aware it is using. Which one of the following activities

would best address this risk?

A. Web application firewalls

B. Package monitoring

C. Static analysis

D. Dynamic analysis
9. Which one of the following is not an advantage of automation in

cybersecurity operations?

A. Enforcing baselines

B. Technical debt

C. Employee retention

D. Standardizing infrastructure configurations

10. Chris is creating a script that will automatically screen any user requests

and flag those that exceed normal thresholds for manual review. What term

best describes this automation use case?

A. User provisioning

B. Guard rails

C. Ticket creation

D. Escalation

11. Which one of the following is not a common drawback of

automating cybersecurity operations? A. Reducing employee

satisfaction

B. Creating single points of failure

Technet24

C. Costs

D. Complexity
12. Frank is investigating a security incident where the attacker entered a very

long string into an input field, which was followed by a system command.

What type of attack likely took place?

A. Cross-site request forgery

B. Server-side request forgery

C. Command injection

D. Bu er overflow

13. What type of attack places an attacker in the position to eavesdrop on

communications between a user and a web server?

A. On-path attack

B. Session hijacking

C. Bu er overflow

D. Meet-in-the-middle

14. Tom is a software developer who creates code for sale to the public. He

would like to assure his users that the code they receive actually came from

him. What technique can he use to best provide this assurance?

A. Code signing

B. Code endorsement

C. Code encryption

D. Code obfuscation
15. Chris is reviewing evidence of a cross-site scripting attack where the

attacker embedded JavaScript in a URL that a user clicked. The web page then

sent the JavaScript to the user in the displayed page. What term best describes

this attack?

A. Reflected XSS

B. Stored XSS

C. Persistent XSS

D. DOM-based XSS

16. Joe checks his web server logs and sees that someone sent the following

query string to an application running on the server:

www.mycompany.com/servicestatus.php?

serviceID=892&serviceID=892’%20;DROP%20TABLE%20Services;--

What type of attack was most likely attempted?

A. Cross-site scripting

B. Session hijacking

C. Parameter pollution

D. On-path

17. Upon further inspection, Joe finds a series of thousands of requests to the

same URL coming from a single IP address. Here are a few examples:

www.mycompany.com/servicestatus.php?serviceID=1

www.mycompany.com/servicestatus.php?serviceID=2
www.mycompany.com/servicestatus.php?serviceID=3

www.mycompany.com/servicestatus.php?serviceID=4

www.mycompany.com/servicestatus.php?serviceID=5

www.mycompany.com/servicestatus.php?serviceID=6

What type of vulnerability was the attacker likely trying to exploit?

A. Insecure direct object reference

B. File upload

C. Unvalidated redirect

D. Session hijacking

18. Joe's adventures in web server log analysis are not yet complete.

As he continues to review the logs, he finds the request:

www.mycompany.com/../../../etc/passwd

What type of attack was most likely attempted?

A. SQL injection

B. Session hijacking

C. Directory traversal

D. File upload
19. Wendy is a penetration tester who wishes to engage in a session hijacking

attack. What information is crucial for Wendy to obtain if her attack will be

successful?

A. Session ticket

B. Session cookie

C. Username

D. User password

20. Joe is examining the logs for his web server and discovers that a user sent input

to a web application that contained the string

WAITFOR. What type of attack was the user likely attempting?

A. Timing-based SQL injection

B. HTML injection

C. Cross-site scripting

D. Content-based SQL injection

Ch7
1. Mike is sending David an encrypted message using a symmetric encryption

algorithm. What key should he use to encrypt the message?

A. Mike's public key

B. Mike's private key

C. David's public key

D. Shared secret key

2. Shahla recently discovered an attack where the attacker managed to force a

network user to use weak encryption and was then able to decrypt that content.

What term best describes this attack?

A. Downgrade

B. Collision

C. Homomorphic encryption

D. Birthday attack

3. Norm is using full-disk encryption technology to protect the contents of

laptops against theft. What goal of cryptography is he attempting to achieve?

A. Integrity

B. Non-repudiation

C. Authentication

D. Confidentiality

4. Brian discovers that a user suspected of stealing sensitive information is

posting many image files to a message board. What technique might the

individual be using to hide sensitive information in those images? A.

Steganography

B. Homomorphic encryption
C. Replay attack

D. Birthday attack

5. Which one of the following statements about cryptographic keys is

incorrect?

A. All cryptographic keys should be kept secret.

B. Longer keys are better than shorter keys when the samealgorithm is used.

C. Asymmetric algorithms generally use longer keys thansymmetric

algorithms.

D. Digital certificates are designed to share public keys.

6. What type of cipher operates on one character of text at a time?

A. Block cipher

B. Bit cipher

C. Stream cipher

D. Balanced cipher

7. Vince is choosing a symmetric encryption algorithm for use in his

organization. He would like to choose the strongest algorithm from these

choices. What algorithm should he choose?

A. DES

B. 3DES

C. RSA

D. AES
8. Kevin is configuring a web server to use digital certificates. What technology

can he use to allow clients to quickly verify the status of those certificates

without contacting a remote server?

A. CRL

B. OCSP

C. Certificate stapling

D. Certificate pinning

9. Acme Widgets has 10 employees and they all need the ability to

communicate with one another using a symmetric encryption system. The

system should allow any two employees to securely communicate without

other employees eavesdropping. If an 11th employee is added to the

organization, how many new keys must be added to the system?

A. 1

B. 2

C. 10

D. 11

10. Referring to the scenario in question 9, if Acme Widgets switched to an

asymmetric encryption algorithm, how many keys would be required to add the

11th employee?

A. 1

B. 2

C. 10

D. 11
11. What type of digital certificate provides the greatest level of assurance that

the certificate owner is who they claim to be?

A. DV

B. OV

C. UV

D. EV

12. Glenn recently obtained a wildcard certificate for *.mydomain.com. Which one

of the following domains would not be covered by this certificate?

A. mydomain.com

B. core.mydomain.com

C. dev. www.mydomain.com

D. mail.mydomain.com

13. Which one of the following servers is almost always an o line CA in a large PKI

deployment?

A. Root CA

B. Intermediate CA

C. RA

D. Internal CA
14. Which one of the following certificate formats is closely associated with

Windows binary certificate files?

A. DER

B. PEM

C. PFX

D. P7B

15. What type of security solution provides a hardware platform for the

storage and management of encryption keys?

A. HSM

B. IPS

C. SIEM

D. SOAR

16. What type of cryptographic attack attempts to force a user to reduce the

level of encryption that they use to communicate with a remote server? A.

Birthday

B. Frequency

C. Downgrade

D. Collision
17. David would like to send Mike a message using an asymmetric encryption

algorithm. What key should he use to encrypt the message?

A. David's public key

B. David's private key

C. Mike's public key

D. Mike's private key

18. When Mike receives the message that David encrypted for him, what key

should he use to decrypt the message?

A. David's public key

B. David's private key

C. Mike's public key

D. Mike's private key

19. If David wishes to digitally sign the message that he is sending

Mike, what key would he use to create the digital signature?

A. David's public key

B. David's private key

C. Mike's public key

D. Mike's private key

20. When Mike receives the digitally signed message from David, what key

should he use to verify the digital signature?

A. David's public key

B. David's private key

C. Mike's public key

D. Mike's private key