You are the Chief Information Security Officer (CISO), and have been invited to meet with the board of directors at their monthly meeting. In that meeting, the CEO states that someone called Joe Hopkins from the help desk has been calling him and some of the board members to help reset their passwords as the old passwords were too insecure. The financial director found this very strange as this Joe Hopkins is not on the payroll. Which of the following is the BEST answer for what has been discovered?
A. Social engineering.
B. Spear phishing.
C. Vishing attack.
D. Password cracking.
E. Phishing.
F. Replay.
A Social engineering.
Concept: This is a social engineering impersonation attack where Joe pretends to be from the help desk. The financial director confirms this.
You are the cybersecurity administrator for a large company that has offices in Stuttgart. The SIEM system alerts you that files are being deleted on file server FS001. The cyber administrator cannot find any remote connection to the file server. He then quarantines the file server from the network. The deletion of the files is still in progress. The forensics team discovers that a script was placed there by Dave Lloyd, who had left the company exactly four weeks ago. Which of the following BEST describes the actions of Dave Lloyd?
a. Dave Lloyd installed a RAT into the file server and is actively removing files.
b. Dave Lloyd placed a logic bomb on the file server to delete the files once he had gone so that he was not a suspect.
c. Dave Lloyd installed ransomware to encrypt the customers’ critical files.
d. Dave Lloyd connected through a VPN connection and remotely deleted files.
B
David Lloyd left exactly 4 weeks ago and logic bombs work on a trigger; here, it was the time of 4 weeks.
Following an annual penetration test, the chief information security officer notices in the final report that all of the company’s domain controllers are vulnerable to a pass‐the‐hash attack. Which of the following actions should the company take to mitigate the risk (choose TWO)?
a. Enable CHAP.
b. Disable CHAP.
c. Disable NTLM.
d. Disable MD5.
e. Enable Kerberos.
f. Disable PAP.
c, e
A pass‐the‐hash attack needs NTLM authentication, therefore, if you disable it or use Kerberos authentication, both will prevent the attack.
Q: Your new interns are debating the difference between Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF). They look to you, their manager, to settle the argument.
Which of the following statements is the MOST accurate?
A. An XSS attack’s primary goal is to forge a request, exploiting the trust a site has in a user’s browser.
B. A CSRF attack’s primary goal is to inject malicious script, exploiting the trust a user has in a site.
C. A successful XSS attack does not require the victim to be authenticated, though it can be more damaging if they are.
D. A successful CSRF attack does not require the victim to be authenticated, as it is forging a new session.
C. A successful XSS attack does not require the victim to be authenticated, though it can be more damaging if they are.
Explanation
A is Wrong: This is the definition of CSRF.
B is Wrong: This is the definition of XSS.
C is Correct: An XSS attack (like injecting a script to deface a webpage) works on any user, logged in or not. It’s just more dangerous if the user is authenticated because the script can then be used to steal their session cookie.
D is Wrong: This is the opposite of the truth. A CSRF attack absolutely requires the victim to have an active, authenticated session for the attack to work. The attack’s entire premise is based on exploiting that existing session.
A well‐known hacker called Mark Birch has been detained by the local police. When they searched his home, they found various pieces of information about your company on a large whiteboard. The information has been obtained from a social media website, such as Facebook and LinkedIn. It has details about the company’s hierarchy, the executives, administrators, and help-desk staff. Which of the following BEST describes the type of attack he has carried out?
a. White-box testing.
b. Passive reconnaissance.
c. Black-box testing.
d. Initial exploitation.
e. Gray-box testing.
g. Intrusive scanning.
b
Passive reconnaissance is where information is gathered about the company, but no real action has been taken.
A security analyst is leading a workshop for employees on “Securing Your Smart Home.” The goal is to protect the home network from compromised IoT devices (smart cameras, thermostats) and printers.
Which THREE recommendations are the most critical to include in the guide?
A. Use the device’s default password for the first 24 hours to ensure stability.
B. Change default usernames and passwords immediately upon setup.
C. Place IoT devices on a separate “Guest” Wi-Fi network or VLAN.
D. Enable UPnP to ensure devices can be reached from the internet.
E. Disable UPnP to prevent devices from automatically opening ports to the internet.
F. Connect printers directly to the modem to bypass the firewall.
B, C, E
Explanation:
1. B (Change Defaults): Default credentials are the #1 attack vector for IoT (e.g., the Mirai botnet).
2. C (Segmentation): Putting IoT devices on a Guest Network or VLAN isolates them. If your smart fridge gets hacked, the attacker cannot pivot from the fridge to your laptop to steal your banking info.
3. E (Disable UPnP): UPnP allows devices to punch holes in your firewall automatically. Disabling it ensures IoT devices are not “directly connected” (exposed) to the public internet without your knowledge.
(Note on MFDs/Printers: They are attacked via their Network Interface. The advice to secure them is the same as any other IoT device: change the password and don’t expose the admin page to the internet).
You are the chief information security officer for a large multinational corporation that has offices in Hong Kong, London, Paris, and New York. The New York office has 100 employees, The Hong Kong office has five employees, Paris has four employees, and London has the most, with 10,000 employees. You have purchased a small company based in Alaska that has four people. They have been using weak passwords. Which of the following is a compensating control that was adopted to BEST mitigate the risk of using weak passwords?
a. Use a password history with a value of 3.
b. Implement time‐based one-time passwords.
c. Increase the password history to a value of 20.
d. Set the account lockout to a value of 1.
e. Set the password expiry to three days.
e
We should never use weak passwords, however, if the exam says we are using them, then we need to accept it. The only way to mitigate the risk is to use a very short password expiry time.
What type of attack is a padding oracle on downgrading legacy encryption attack (Choose TWO)?
a. IV attack.
b. Replay attack.
c. Man‐in‐the-middle attack.
d. TLS 1.0 with electronic-code book.
e. SSL 3.0 with chain-block cipher.
c, e
A POODLE attack is a man in the middle that exploits a downgraded browser using SSL 3.0 with CBC.
The cybersecurity team have set up a honeypot to track the attack vector of a newly released malware. As they review the virus, they notice that the hash value of the malware changes from host to host. Which of the following types of malware has been detected?
a. Virus.
b. RAT.
c. Worm.
d. Logic bomb.
e. Polymorphic virus.
e
A polymorphic virus mutates as it replicates; that is why the hash is changing.
The cybersecurity team have looked at the latest trends and have identified that there has been an increase in brute-force attacks. Which of the following is a random value that can be appended to the stored password to make it more difficult for a brute-force password attack to be carried out (choose TWO)?
a. Obfuscation.
b. Nonce.
c. Key stretching.
d. Salting.
c, d
Both salting and key stretching increase the password length by appending random characters to the end of the password.
There has been a spate of DNS-poisoning attacks and your company wants to make itself resilient against these attacks. Your company wants to encrypt the DNS traffic by using DNSSEC. Once you have signed the zone, what record is created for each host?
a. CNAME.
b. SPF.
c. RRSIG.
d. MX.
e. PTR
c
DNSSEC encrypts DNS traffic preventing DNS poisoning and produces RRSIG records.
A security administrator discovers that an attacker used a compromised host as a platform for launching attacks deeper into a company’s network. What terminology BEST describes the use of the compromised host?
a. Brute force.
b. Active reconnaissance.
c. Pivoting.
d. Passing point.
c
Pivoting is where an attacker enters your network via a vulnerable host then attacks a secondary host.
At what stage of the SDLC are computer systems no longer supported by the original vendor?
a. Sandboxing.
b. End‐of‐life systems.
c. Resource exhaustion.
d. System sprawl.
b
End‐of‐life systems are no longer supported, updated, or patched by the vendor, making them vulnerable to attack.
Company A has just developed a bespoke system for booking airline tickets. What is it called if a freelance coding specialist tests it for security flaws?
a. Code review.
b. Static-code review.
c. Regression testing.
d. Dynamic-code review.
c
Regression testing is where a coding expert checks your code.
You are the security administrator for an airline company that suffered a loss of availability of their systems last month. Which of the following attacks would MOST LIKELY affect the availability of your IT systems?
a. Spear phishing.
b. Replay.
c. Man‐in‐the‐middle.
d. DoS.
d
Loss of availability means the system is down; DoS is where one host takes down another and is the most likely answer.
You are a lecturer in a college and you need to deliver a session on salting passwords. What are the two main reasons you would salt passwords?
a. To slow down brute-force attacks.
b. To make access to the password slower.
c. To prevent duplicate passwords from being stored.
d. To stop simple passwords from being used.
a,c
Salting appends random characters to a password; therefore, it makes the password longer and more difficult to crack. If two people use the same password, the random characters appended to them make them unique.
- An auditor is carrying out an annual inspection of a SCADA network and finds that the programmable logic controllers (PLCs) have not been updated since last year. Upon further investigation, it is discovered that the company manufacturing these PLCs has gone into liquidation, making these controls end-of-life systems. The manufacturer is currently looking for another company to make an upgraded PLC. Which of the following recommendations should the auditor make to the management team to mitigate the risk in the short term?
a. Remove the PLCs from the manufacturing infrastructure.
b. Produce their own updated PLCs for the firmware.
c. Set up a SIEM system for real-time monitoring of the SCADA system.
d. Place the PLCs in a VLAN.
d
If a system or a printer is vulnerable and it cannot be replaced, we can segment it from the rest of the network by placing it in a VLAN.
- The security administrator has identified an unknown vulnerability on an application that is used infrequently. They have isolated the application and gathered information to send to the vendor so that a patch can be produced. Once the company receives a patch for the application, what is the best way for the company to test the application before rolling it out into production?
a. Obfuscation.
b. VLAN.
c. Regression testing.
d. Sandboxing.
d
Sandboxing can be used to isolate an application for testing or patching or because it is dangerous. The Linux version is called chroot jail.
What is it called when a user has exploited an IT system so that he has obtained access to all files on the file server?
a. Remote exploit.
b. Zero‐day exploit.
c. Privilege escalation.
d. Pivoting.
c
It takes someone with admin right to access all files, therefore the user would need to have privilege escalation to do so
Which of the following is an email‐based attack on all members of the sales team?
a. Phishing.
b. Vishing.
c. Spear phishing.
d. Pharming.
c
An email attack on a group of users is called spear phishing. Watch out in the exam for plural words. Phishing is attacking one person by email.
An attacker tries to target a high‐level executive, but unfortunately has to leave a voicemail as they did not answer the telephone. What was the intended attack and what attack was eventually was used (choose all that apply)?
a. Whaling.
b. Vishing.
c. Phishing.
d. Spear phishing.
b
The attack method, first of all, uses a telephone, but the attacker has to leave a voicemail; this is known as vishing. For whaling to take place, the CEO would have to take some sort of action.
You are carrying out annual training for your company and need to put a PowerPoint slide together for the symptoms of a backdoor virus. Which three bullet points will you include in the slide? Each provides part of the explanation of a backdoor virus.
a. Passwords may have been there a long time.
b. You must click on several items.
c. Can be included in an email attachment.
d. Files open quicker than before.
e. You can only get infected through a link on a webpage.
a, b, c
A backdoor password is written by the application developer to be used at a later stage should the user lock themselves out. Another form is when you have to click several times to execute it.
Which of the following commands can be used to create a buffer overflow (choose all that apply)?
a. var char.
b. strcpy.
c. var data.
d. strcat.
b. d
Buffer overflow happens when an application receives more data than it can deal with. Both strcpy and strcat can collect strings of data that would cause a buffer overflow.
You are the security administrator for a multinational corporation and the development team have asked your advice as to how BEST to prevent SQL injection, integer overflow, and buffer overflow attacks. Which of the following should you advise them to use?
a. Input validation.
b. A host‐based firewall with advanced security.
c. strcpy.
d. Hashing.
a
Input validation only accepts data in a certain format within a certain length and will prevent buffer overflow, integer overflow, and injection types attacks such as SQL injection.
-
Categories & Types of security controls50
-
Chapter 1 - Types of security controls11
-
Threats, Attacks, and Vulnerabilities60
-
Threats, Attacks, and Vulnerabilities 250
-
Threats, Attacks, and Vulnerabilities 325
-
Mock Exam151
-
Cheat Sheet80
-
Chapter 2: Technologies and Tools Practice Tests50
-
Chapter 2: Technologies and Tools20
-
Chap2: Technologies and Tools 224
-
Mock Exam 249
-
Chap3 - Architecture and Design52
-
Chapter 3: Architecture and Design265
-
Mock Exam 350
-
Chapter 4: Identity and Access Management55
-
Monitoring and Incident Response20
