Sorry, you are out of time.
ISC2 CC Practice Exam 6
Take your exam preparation to the next level with fully simulated online practice tests designed to replicate the real exam experience. These exams feature realistic questions, timed conditions, and detailed explanations to help you assess your knowledge, identify weak areas, and build confidence before test day.
1. An e-commerce platform wants to ensure that users cannot deny their orders once placed. Which technology would best ensure non-repudiation of these transactions?
Digital signatures on transaction records provide cryptographic proof that the user made a specific order, ensuring they cannot deny their actions. Biometric authentication (A) confirms identity at login but does not bind the user to a specific transaction. IP address logging (C) tracks where the order was placed from but does not confirm the user's intent. Encrypted communication channels (D) protect data integrity and confidentiality but do not provide non-repudiation.
2. An organization needs to provide external partners access to a database server for data exchange, ensuring that this does not compromise the security of their internal network. What should they implement?
Placing the database server in a DMZ with limited external access (B) isolates it from the internal network, allowing external partners to access it securely without exposing the internal network. Placing the server in a shared VLAN with the internal network (A) does not provide adequate isolation. IP filtering on the internal network (C) or opening the internal network to the internet (D) would expose internal systems to potential threats.
3. A financial institution has implemented a new policy requiring all employees to change their passwords every 60 days. The policy specifies the length and complexity requirements for passwords, as well as guidelines for password storage and transmission. How does this policy contribute to the organization’s security posture?
The primary purpose of the password change policy is to reduce the risk of unauthorized access due to compromised passwords (D). By requiring regular password changes, the organization limits the time window during which a stolen or guessed password can be used, thus improving overall security. Option A is partially correct as it promotes uniformity but does not directly enhance security. Option B is incorrect because it does not directly address password cracking through brute force but focuses more on reducing the lifespan of compromised passwords. Option C is misleading as while auditing can be facilitated, the main goal is to enhance security by ensuring passwords are not used for extended periods.
4. A hospital uses a digital log system to track access to patient records. It is crucial to ensure that only authorized personnel can view and edit these logs. What feature should be implemented to maintain the integrity and confidentiality of the access logs?
Implementing role-based access controls ensures that only authorized personnel can view or edit the logs, maintaining the integrity and confidentiality of the data (B). Allowing all staff to view the logs (A) could lead to potential data breaches. Open access (C) and storing logs in a publicly accessible location (D) compromise confidentiality and security.
5. A financial institution wants to ensure that their transaction records remain accurate and unaltered. What is the best approach to maintaining the integrity of these records?
A blockchain-based ledger provides a decentralized, immutable record of transactions, ensuring that once a transaction is recorded, it cannot be altered, thereby maintaining integrity. Role-based access control (A) helps limit who can access and modify records but does not inherently ensure integrity. Daily reconciliations and audits (B) help detect discrepancies but are not a real-time solution. Encrypting records (C) protects confidentiality, not integrity.
6. Which of the following is the primary reason for an organization to implement a password expiration policy that requires passwords to be changed every 90 days?
The correct answer is A. Implementing a password expiration policy helps reduce the likelihood of users reusing the same password across multiple accounts over a long period, thereby minimizing the risk if one password is compromised. Option B (To improve password memorability for users) is not correct, as frequent changes can actually make passwords harder to remember. Option C (To comply with user convenience requests) is incorrect because expiration policies can be inconvenient for users. Option D (To enforce two-factor authentication) is unrelated to password expiration; two-factor authentication is a separate security measure that enhances account security.
7. A logistics company’s BCP includes detailed instructions for the activation of an alternate operational site in the event of a major disruption. Which component of the business continuity plan does this pertain to?
The detailed instructions for activating an alternate operational site pertain to the continuity of operations plan (COOP) (D). This component ensures that the company can continue essential functions at an alternate location if the primary site becomes unavailable. Incident response (A) involves the immediate steps taken during a disruption but does not include long-term operational continuity. The business impact analysis (B) assesses the impact of disruptions but does not cover alternate sites. The disaster recovery plan (C) focuses on restoring IT systems and data, not on continuing operations at an alternate site.
8. During a routine audit, it was discovered that multiple user accounts have been accessing sensitive systems from various geographic locations within a short period. The accounts were also observed performing actions that are outside of their typical usage patterns. What type of threat does this scenario likely indicate?
The correct answer is C. Credential Compromise. The scenario describes user accounts accessing systems from different locations and performing unusual actions, which indicates that the accounts may have been compromised, and the attackers are using stolen credentials to gain unauthorized access. Option A (Insider Threat) is incorrect because while insider threats involve malicious actions by authorized users, the scenario suggests unusual geographic access, which is more indicative of external credential compromise. Option B (Malware Infection) is incorrect as it would typically involve malicious software causing damage or exfiltrating data, not specifically involving multiple geographic accesses. Option D (Ransomware Attack) is incorrect because ransomware involves encrypting files and demanding payment for decryption, not unusual access patterns.
9. A security professional is tasked with setting up a secure file transfer service on a server. Which port should be opened to allow SFTP (Secure File Transfer Protocol) traffic?
Port 22 (C) is used by SSH (Secure Shell) and also for SFTP, which is a secure file transfer protocol. Opening this port will allow SFTP traffic, ensuring secure file transfers. Port 20 (A) is used for FTP data transfer, and port 21 (B) is used for FTP control commands, both of which are not secure. Port 23 (D) is used for Telnet, which is not secure and unrelated to file transfers.
10. A small business owner manages both the payroll and financial reporting functions. To ensure proper segregation of duties, what action should be taken?
Option B is correct as it separates payroll and financial reporting responsibilities, ensuring that no single individual has control over both functions, which helps prevent fraud and errors and adheres to the segregation of duties principle. Option A (A) relies too heavily on external audits and does not address the need for role separation. Option C (C) does not segregate duties and may not mitigate risks effectively. Option D (D) provides a review mechanism but does not separate the duties, which is crucial for reducing risks and ensuring independent oversight.
11. A healthcare facility needs to ensure its data center is protected from potential fire hazards. What environmental control should they implement to address this risk effectively?
A gas-based fire suppression system (B) effectively extinguishes fires without damaging sensitive electronic equipment, unlike water-based systems (A) which can cause significant damage. Increasing humidity levels (C) can lead to equipment corrosion and does not address fire risks. Setting up open windows for natural ventilation (D) is not suitable for a data center environment where controlled conditions are necessary.
12. A company deploys antivirus software on all employee workstations. The antivirus alerts on a file containing a malicious script. Which action should the security team take to ensure the threat is neutralized and future infections are prevented?
The correct answer is A. Quarantine the file and perform a system-wide update. Quarantining the file isolates it from the rest of the system, preventing it from causing further harm. Performing a system-wide update ensures that the antivirus software has the latest signatures and patches to detect and prevent future infections. Option B (Delete the file and restart the system) is incorrect because it may not prevent similar future infections if the antivirus software is not updated. Option C (Disable the antivirus) is incorrect and risky, as it may allow the malware to execute. Option D (Log the incident and continue monitoring) is insufficient as it does not address the immediate threat or future prevention.
13. A financial institution’s main data center is located in an area prone to natural disasters. What is the most critical reason for this institution to have a robust disaster recovery plan?
The most critical reason for a financial institution to have a robust disaster recovery plan (D) is to ensure uninterrupted access to financial services, which is vital for maintaining the institution's operations and trust with its clients. The ability to continue providing financial services during and after a disaster helps preserve customer confidence and prevents significant operational disruptions. While compliance with regulations (A), preventing data loss (B), and maintaining trust (C) are important, the foremost reason is to guarantee continuous service availability, which directly supports the institution’s core functions.
14. An organization suffers from a data exfiltration incident involving proprietary information. Why is the importance of a timely and effective incident response critical in this case?
The importance of a timely and effective incident response is critical to limit the damage to the organization's reputation and intellectual property (B). Addressing the incident quickly helps mitigate further losses and maintain stakeholder trust. Leaking details to the media (A) is not a recommended practice and can exacerbate reputational damage. Permanently disabling systems (C) is an extreme measure that does not necessarily prevent future incidents. Developing a new security policy (D) is important for long-term prevention but does not address the immediate need to respond to the incident effectively.
15. A university wants to ensure that network traffic between different academic departments is isolated to prevent unauthorized access and data breaches. What is the best approach to achieve this using micro-segmentation?
Using micro-segmentation to create policies based on department and application (B) allows the university to enforce detailed security rules that isolate network traffic and prevent unauthorized access between departments, enhancing data security. Creating departmental VLANs with static IP addressing (A) provides basic isolation but lacks the fine-grained control of micro-segmentation. Configuring a single security policy for the entire campus network (C) does not provide the necessary isolation. Allowing unrestricted communication between departments (D) increases the risk of unauthorized access and data breaches.
16. A company needs to secure its server room and protect it from potential physical theft. Which physical control is most effective for this purpose?
Setting up a mantrap at the server room entrance (A) is a physical control that provides a secure entry mechanism, where individuals must pass through two sets of doors with security verification between them. This prevents unauthorized access and reduces the risk of physical theft. Implementing a firewall (B) is a technical control that protects network traffic but does not secure physical access to the server room. Encrypting data (C) is a technical control that protects data but does not prevent physical theft of hardware. Using secure communication channels (D) is also a technical measure focused on data security rather than physical security.
17. A company wants to develop a security awareness program focusing on password security. Which of the following actions would be the most effective outcome of this training?
Security awareness training aims to ensure employees actively apply the knowledge gained, such as creating and remembering strong passwords (C), which is crucial for maintaining security. While understanding complexity requirements (A) and becoming aware of the company's policies (D) are necessary, they do not necessarily translate into practical application without the training focus on creating and remembering passwords. Configuring two-factor authentication (B) is more of a technical task, not typically covered in basic awareness training.
18. A university is considering hiring an MSP to handle its network security. What should be included in the MSP’s responsibilities to ensure comprehensive security management?
The MSP’s responsibilities should include policy development and enforcement, threat monitoring, and incident response (B) to ensure comprehensive security management. These tasks cover the creation and implementation of security policies, continuous monitoring for threats, and responding to security incidents effectively. Network device procurement and budget management (A) are typically handled by the university’s IT department. Teaching cybersecurity courses (C) and student data management (D) fall outside the scope of an MSP’s security management duties.
19. An e-commerce company uses a hybrid cloud to handle peak traffic during holiday sales. To ensure secure integration between their on-premises infrastructure and the cloud, what is a critical aspect they should focus on?
Implementing secure APIs and encrypted connections (B) is critical for ensuring secure integration between on-premises infrastructure and the cloud, protecting data and communications from unauthorized access and interception. Using a single network protocol (A) simplifies communication but does not ensure security. Allowing unrestricted access (C) poses significant security risks. Disabling firewall rules (D) compromises security by removing essential protective measures.
20. An organization is required to retain financial records for a specified period due to regulatory obligations. What is a key consideration in their data retention strategy?
A key consideration in the data retention strategy for financial records is ensuring data is stored in a format that remains accessible and readable (B), which is critical for compliance with regulations and for auditing purposes. Keeping data only on local hard drives (A) risks data loss and does not support robust data management practices. Allowing any employee to modify the data (C) poses risks to data integrity and security. Ignoring updates to retention regulations (D) could lead to non-compliance and legal issues.
21. A company wants to ensure that unauthorized individuals cannot remove equipment or data storage devices from a restricted area. Which physical control would best address this concern?
Implementing RFID tracking for all equipment (A) is a physical control that allows the company to track and monitor the movement of equipment, ensuring that unauthorized removal of devices can be detected and prevented. Setting up a VPN (B) and requiring complex passwords (C) are technical controls focused on data access and security, not physical equipment security. Encrypting sensitive data (D) protects the data but does not prevent the unauthorized removal of physical devices.
22. An organization has identified a potential threat that could significantly disrupt its operations. As part of its business continuity plan, the organization implements strategies to reduce the likelihood and impact of this threat. Which component of business continuity does this activity exemplify?
Implementing strategies to reduce the likelihood and impact of a potential threat exemplifies risk mitigation, a key component of business continuity planning (A). Risk mitigation involves proactive measures to minimize the effects of disruptions and ensure that critical operations can continue. Data recovery (B) focuses on retrieving data following a loss, which is a part of the recovery process, not prevention. Compliance auditing (C) is about verifying adherence to regulations and standards, unrelated to threat mitigation. Performance monitoring (D) tracks the effectiveness of business processes but does not directly address threat reduction.
23. A company’s AUP mandates that all employees must lock their workstations when leaving their desks. What is the main security benefit of this policy?
The correct answer is A. Requiring employees to lock their workstations when leaving their desks helps prevent unauthorized individuals from accessing sensitive information or systems, thereby enhancing physical security and protecting data. Option B (It reduces energy consumption by turning off the monitor) is not the main focus of this policy, which is security-related. Option C (It ensures compliance with ergonomic standards) is irrelevant to the policy’s intent. Option D (It improves the efficiency of the IT support team) is not related to the purpose of preventing unauthorized access.
24. An application developer needs to secure data at rest on a mobile device using symmetric encryption. What is an essential factor to consider for ensuring the data remains secure?
Ensuring the encryption key is stored securely (B) is essential for maintaining the security of data at rest on a mobile device because if the key is exposed, an attacker can decrypt the data. Encrypting data with a different key for each user (A) is not as relevant to data at rest security as the primary concern is protecting the key itself. Using asymmetric encryption (C) for data at rest is less common and typically not necessary due to the additional computational overhead. Implementing digital certificates (D) is more relevant to ensuring data authenticity and integrity, not directly for encrypting data at rest.
25. A technology company needs to comply with the California Consumer Privacy Act (CCPA) regarding data collected from California residents. Which of the following actions must the company take to comply with CCPA?
To comply with the CCPA, the company must provide consumers with the option to opt-out of the sale of their personal data (A). The CCPA grants California residents rights to their personal data, including the right to opt-out of having their data sold. Option B, while recommended for data protection, is not specifically mandated by CCPA. Option C is incorrect as the CCPA does not require an annual audit or reporting to the state. Option D is also incorrect because the CCPA does not mandate that data be stored within California, only that residents' data rights are respected.
26. An online contract management system needs to ensure that signers cannot dispute their agreement to a contract after signing. Which feature is crucial for achieving non-repudiation in this context?
Public key infrastructure (PKI) combined with digital signatures ensures non-repudiation by providing a cryptographic proof that a specific individual signed the contract, making it difficult for them to deny their agreement. Multi-factor authentication (A) secures access but does not provide a verifiable proof of signing. Time-stamping (B) adds a time element but does not confirm identity. Encrypting documents (D) protects confidentiality but does not provide proof of signing.
27. An organization has established a security baseline that includes mandatory encryption for sensitive data. What is the primary benefit of including this requirement in the baseline?
The correct answer is C. Standardizing data protection practices ensures that sensitive data is consistently protected according to the organization's security policies, thereby reducing the risk of data breaches. Option A (Ensures compliance with all international data protection regulations) is overly broad and may not cover all regulations comprehensively. Option B (Simplifies the process of data recovery) is related to data recovery rather than baseline configuration. Option D (Eliminates the need for other security measures) is incorrect, as encryption is one aspect of a multi-layered security approach and does not replace other necessary security measures.
28. A financial institution must comply with the Sarbanes-Oxley Act (SOX) regarding its financial reporting practices. What is one of the main cybersecurity requirements under SOX that the institution must adhere to?
One of the main cybersecurity requirements under SOX is ensuring that there are controls in place to maintain the integrity of financial data (B). SOX mandates internal controls to ensure the accuracy and reliability of financial reporting, which includes maintaining data integrity through proper access controls and audit trails. Option A, while enhancing data security, is not specifically mandated by SOX. Option C is not a SOX requirement; the act focuses more on internal controls and reporting. Option D is beneficial for security but not specifically required by SOX.
29. A healthcare organization needs to ensure that sensitive patient data is protected even if the data is accessed on unauthorized devices. Which technical control should they implement?
Implementing a Mobile Device Management (MDM) solution (C) provides the ability to control, secure, and enforce policies on mobile devices, ensuring that sensitive patient data is protected even if accessed on unauthorized devices by enforcing encryption and remote wipe capabilities. Full disk encryption (A) protects data on devices, but it does not address data accessed on unauthorized devices unless those devices are managed under MDM. Data encryption in transit using SSL (B) ensures data is secure during transmission, but does not protect data on unauthorized devices. Using secure email gateways (D) protects email communication, but is not specific to controlling and securing devices that access patient data.
30. An organization uses a data labeling system to classify emails based on their sensitivity. How should an email containing proprietary business information be labeled?
An email containing proprietary business information should be labeled "Confidential" (C) to indicate that it contains sensitive information that should not be disclosed outside the organization and needs protection from unauthorized access. Unclassified (A) is for data that does not require any special handling or protection. Public (B) is for data intended for general distribution. Open Access (D) suggests that data is freely accessible, which is not suitable for sensitive proprietary information.
31. A hospital's network is compromised by malware, disrupting access to patient records. Why is it crucial to have an incident response plan specifically tailored for such environments?
It is crucial to have an incident response plan tailored for healthcare environments to minimize potential health risks to patients due to data unavailability (A). Quick access to patient records is vital for ensuring continuous and effective medical care. Replacing hardware (B) is not an immediate priority and may not address the malware issue. Allowing staff to take leave (C) would further disrupt operations. Avoiding communication with external vendors (D) can hinder efforts to restore systems and mitigate the incident. The primary importance of incident response in this context is to ensure patient safety by quickly addressing data access issues.
32. A software company’s BCP outlines procedures for quickly restoring critical software services to meet service level agreements (SLAs) with clients. Which component of the business continuity plan is this describing?
The procedures for quickly restoring critical software services to meet SLAs with clients are part of the disaster recovery plan (B). This component of the BCP focuses on restoring IT services and systems to ensure that the company can continue to meet its contractual obligations with clients. The crisis communication plan (A) deals with communication strategies during a disruption. The business impact analysis (C) assesses the potential impact of disruptions but does not include specific recovery procedures. The incident response plan (D) addresses the immediate response to incidents, not the detailed restoration of services.
33. A technology company is assessing the risk of a new software vulnerability being exploited. To accurately assess the risk, which factors should the company consider in its risk assessment?
Considering the popularity of the software and current exploitation trends (A) is crucial for accurately assessing the risk of vulnerability exploitation, as widely used software with known vulnerabilities is more likely to be targeted by attackers. The aesthetic design and user experience (B) do not impact risk assessment. The software's purchase price and maintenance costs (C) are financial considerations unrelated to security risks. The number of employees involved in development (D) is irrelevant unless it directly impacts security practices.
34. A retail company has a procedure requiring all employees to undergo annual cybersecurity training. What is the primary purpose of this procedure?
The primary purpose of annual cybersecurity training is to ensure that employees are aware of the latest cybersecurity threats and best practices (A). This knowledge helps them to recognize and respond to potential security incidents effectively. Option B is incorrect as meeting industry standards requires more than just training. Option C is misleading as training does not automate security updates but improves awareness. Option D is incorrect because training complements other security controls rather than replacing them.
35. A company wants to enhance its data security by ensuring that only authorized applications can access sensitive data. Which technical control should be implemented to achieve this?
Application whitelisting (B) allows only authorized applications to run or access sensitive data, ensuring that unauthorized applications cannot gain access. This directly addresses the need to control application access to sensitive data. Data Loss Prevention (DLP) software (A) is used to monitor and control the movement of sensitive data, which is important for preventing data breaches but not specifically for controlling application access. Role-Based Access Control (RBAC) (C) is used to assign permissions based on user roles, which controls user access rather than application access. Network Access Control (NAC) (D) regulates who or what devices can access the network, which is broader than the specific requirement to control application access to data.
36. An organization is developing a disaster recovery plan that includes detailed steps for resuming operations at a different location after a disaster. What is the primary focus of this component of the plan?
The primary focus of the component that includes detailed steps for resuming operations at a different location (B) is business continuity and resumption. This component ensures that the organization can quickly and effectively restore its operations at an alternate site, maintaining essential functions and minimizing downtime. Training and awareness programs (A) are crucial for preparedness but not directly related to the resumption of operations. Threat detection and mitigation (C) focus on identifying and managing threats, while network security enhancements (D) are about improving security measures, both of which are important but not the primary focus when it comes to resuming operations after a disaster.
37. A financial institution is assessing the risk of fraudulent transactions. It needs to prioritize its response to this risk. Which approach should it take?
Assessing the impact on customer trust and financial stability (B) ensures that the institution prioritizes responses that safeguard its reputation and operational viability. Implementing controls regardless of cost (A) may not be sustainable or efficient. Waiting for more data (C) delays necessary actions, potentially worsening the risk. Focusing only on historical fraud areas (D) overlooks emerging threats and new patterns of fraudulent activities.
38. A web application is experiencing delays in response times due to high latency in the data transmission process. Which OSI layer should be examined to address issues related to data segmentation and flow control to improve the web application’s performance?
The Transport layer (C) is responsible for data segmentation, flow control, and error handling in data transmission, which directly impacts latency and performance of applications. Improving flow control mechanisms at this layer can help reduce delays and enhance response times. The Data Link layer (A) handles frame transfer and error detection at the physical network level, not addressing application performance issues. The Network layer (B) manages routing and logical addressing, which does not directly influence application-level latency. The Application layer (D) provides services and protocols for application data, but does not handle flow control or data segmentation.
39. An IT department notices that unauthorized software is frequently being installed on company computers. To prevent this, which technical control should they implement?
Implementing Group Policy to restrict software installation (C) is a technical control that directly prevents unauthorized software from being installed on company computers by enforcing policy-based restrictions. File Integrity Monitoring (FIM) (A) is used to detect changes to critical files and system configurations, which is useful for monitoring integrity but not specifically for preventing software installation. Antivirus software (B) helps detect and remove malicious software but does not prevent the installation of unauthorized software. Regular software audits (D) are important for compliance and identifying unauthorized software after the fact but do not prevent installation.
40. An organization is looking to upgrade its physical security for a high-security area containing sensitive information. They currently use standard key locks. What is the best physical security upgrade they should consider to enhance security?
Electronic locks with audit trail capability not only enhance security by controlling access but also provide detailed logs of who accessed the area and when, aiding in monitoring and forensic investigations (A). Window bars (B) and increased lighting (C) are supplementary measures that do not address internal access controls. Additional security personnel (D) add a layer of security but do not replace the need for robust access control systems.
41. A retail company identifies a risk related to a potential data breach of customer payment information. The company decides to outsource its payment processing to a third-party service that specializes in secure transactions. Which risk treatment strategy is the company employing?
The company is employing a risk transference strategy (B) by outsourcing its payment processing to a third-party service. This approach transfers the responsibility for managing the security of payment information to the third party. Risk avoidance (A) would involve eliminating the activity that introduces the risk, such as ceasing online sales. Risk mitigation (C) involves taking steps to reduce the risk, not transferring it. Risk acceptance (D) means acknowledging the risk without taking action to avoid, transfer, or mitigate it.
42. A healthcare organization needs to ensure that patient records have not been tampered with while in storage. Which hashing function characteristic is most important for this purpose?
The most important characteristic of a hashing function for ensuring that patient records have not been tampered with is producing a unique hash for each unique input (B). This allows any changes in the records to be detected by comparing the original and current hash values. Hashing does not encrypt data for confidentiality (A); it ensures integrity. Using a key for additional security (C) is not a characteristic of typical hash functions. Hash values require relatively small storage space (D), which is not a major consideration for their effectiveness.
43. A cybersecurity professional is tasked with creating a new security policy for their organization. What is the most ethical approach to ensure the policy aligns with the (ISC)² Code of Ethics?
Consulting with all relevant stakeholders and incorporating their input (B) ensures that the policy is comprehensive, fair, and aligns with the ethical principle of considering the broader impact. Developing the policy based on personal experience (A) may lack necessary insights and broader applicability. Copying a policy from another organization (C) may not address specific needs and can lead to ethical and legal issues. Creating a policy that strictly favors the organization (D) may overlook the interests of other stakeholders and conflict with ethical principles of fairness and integrity.
44. A company is decommissioning several servers and wants to ensure that sensitive data stored on their hard drives is irrecoverable. Which practice should they follow to securely destroy this data?
Using a degausser to erase magnetic fields on the hard drives (A) is an effective method for securely destroying data as it disrupts the magnetic domains on the drive, rendering the data unreadable. Deleting all files and reinstalling the operating system (B) does not remove data completely, as it can still be recovered. Transferring data to a new server and discarding the old drives (C) without securely erasing or destroying them leaves the data vulnerable. Storing the old drives in a locked cabinet (D) does not ensure data destruction and risks future unauthorized access.
45. During a social engineering awareness training, employees learn about the risks of sharing personal information. If an employee is approached by someone requesting their date of birth for “verification purposes,” what is the most appropriate response?
The most appropriate response is to decline the request and direct the requester to a formal verification process (B), maintaining security and preventing social engineering attacks. Providing the information (A) can compromise personal data. Sharing partial information (C) still risks revealing sensitive details. Asking for an email (D) might provide a record but does not verify the requester’s legitimacy and could still lead to social engineering attacks.
46. An IT team finds that a recent patch causes conflicts with existing software on some systems. What should be the immediate response to this situation?
The correct answer is B. Rolling back the patch on affected systems and investigating the issue ensures that the conflict does not compromise system functionality or security, and allows the team to identify a solution before reapplying the patch. Option A (Continue applying the patch) can exacerbate the conflict and lead to more significant problems. Option C (Disable the conflicting software) is a temporary and potentially disruptive fix. Option D (Ignore the conflict) is not responsible as it could lead to critical failures and security issues.
47. A financial institution is identifying risks to its data integrity and confidentiality. Which method would be most effective in identifying potential risks related to insider threats?
Conducting employee interviews and surveys (B) is effective for identifying insider threats as it helps uncover potential issues related to employee behavior, awareness, and attitudes toward data integrity and confidentiality. Reviewing network traffic logs (A) is more relevant for detecting external threats. Analyzing third-party security assessments (C) provides insights into external vulnerabilities. Reviewing historical data breach reports (D) focuses on past incidents and may not reveal current insider risks.
48. A company has multiple branch offices that need to securely communicate with each other over the internet. Which VPN solution is most suitable for establishing secure inter-branch connectivity?
A Site-to-Site VPN (B) is suitable for securely connecting multiple branch offices over the internet, enabling seamless communication between networks while protecting data in transit. A Remote Access VPN (A) is designed for individual users connecting to the corporate network. SSL VPN (C) is typically used for secure access to web-based applications by individual users. MPLS VPN (D) is a service provider-managed VPN, not a direct site-to-site solution.
49. A research facility needs to ensure that only authorized personnel can access sensitive areas at specific times of the day. How should the badge system be configured to meet this requirement?
Time-based access controls restrict entry to authorized personnel only during specified times, effectively protecting sensitive areas outside of these periods (A). Issuing temporary badges (B) does not address the need for time-specific access. Unrestricted access (C) fails to prevent unauthorized entry. A color-coded badge system (D) might indicate levels of access but does not control the time of access.
50. An e-commerce company has established a procedure for regular audits of user access privileges. How does this procedure enhance the organization's security?
The procedure for regular audits of user access privileges enhances security by identifying and removing unnecessary or outdated access rights (B), thereby reducing the risk of unauthorized access to sensitive systems and data. Option A is not correct as the procedure focuses on access rights, not password strength. Option C, while beneficial for compliance, is not the main security enhancement provided by the audits. Option D is incorrect as the procedure focuses on auditing rather than automating updates, which may still require manual intervention.
51. A university needs to ensure that student records are handled in a way that respects their privacy. Which of the following practices would be most effective in maintaining student privacy?
Limiting access to student records to authorized personnel ensures that only those with a legitimate need can view or handle sensitive student information, thus protecting privacy. Storing records on an encrypted server (A) secures data but does not control access. Providing students with update access (C) is beneficial but does not address overall privacy controls. A data retention policy (D) helps manage data over time but does not ensure day-to-day access control.
52. A healthcare organization needs to ensure that patient records are protected from unauthorized modifications. Which of the following strategies would most effectively maintain the integrity of these records?
Digital signatures provide a way to verify that changes to patient records are made by authorized individuals and have not been tampered with, thus maintaining the integrity of the records. Read-only access (A) prevents modifications but does not allow necessary updates by authorized personnel. Backups (C) ensure data availability and recovery but do not directly protect integrity. An IDS (D) helps detect unauthorized access but does not specifically address data integrity.
53. An organization assesses the risk of unauthorized access to its confidential files and decides to implement strict access controls and encryption to protect the data. Which risk treatment approach is this an example of?
The organization is using risk mitigation (C) by implementing strict access controls and encryption to reduce the likelihood and impact of unauthorized access to its confidential files. Risk transference (A) would involve shifting the risk to another party, such as through insurance. Risk avoidance (B) would mean eliminating the risky activity altogether, such as not storing confidential files electronically. Risk acceptance (D) would be taking no action and accepting the potential impact of the risk.
54. A nonprofit organization and a tech company want to collaborate on a project to improve cybersecurity awareness. They aim to outline the roles, responsibilities, and resource contributions without entering a formal legal commitment. What document should they use?
A Memorandum of Agreement (MOA) (B) is suitable for outlining roles, responsibilities, and resource contributions between the nonprofit organization and the tech company for a cybersecurity awareness project, without creating a formal legal commitment. A Service Level Agreement (SLA) (A) involves legally binding service performance criteria. A Non-Compete Agreement (NCA) (C) restricts business competition and is not relevant to project collaboration. An Employment Contract (D) pertains to hiring employees and does not fit the context of a collaborative project.
55. During a system audit, it was discovered that several configurations were not aligned with the organization's baseline security policies. Which configuration management practice should be employed to ensure compliance?
The correct answer is C. Automated configuration management tools ensure consistent application of configurations across all systems, reducing the risk of human error and ensuring compliance with baseline policies. These tools can automatically enforce policies and detect deviations. Option A (Perform regular vulnerability scanning) identifies vulnerabilities but does not enforce configurations. Option B (Implement a CMDB) helps in tracking configurations but does not directly enforce compliance. Option D (Conduct routine manual configuration reviews) is important but is time-consuming and prone to oversight compared to automated solutions.
56. A healthcare organization needs to ensure that only authorized personnel can access patient records. Which authentication method would best protect against unauthorized access while ensuring compliance with regulations?
Two-factor authentication (2FA) using a password and biometric verification provides a high level of security by combining something the user knows (password) with something they are (biometrics), ensuring compliance with regulations. Password authentication (A) alone does not offer sufficient protection. Single sign-on (SSO) (C) simplifies access but may not meet regulatory requirements for high-security environments. Firewalls (D) restrict access but do not authenticate users.
57. An organization conducts a regular security assessment to identify potential vulnerabilities in its network infrastructure. They use tools that scan the network for common weaknesses, such as missing patches or insecure configurations. What type of scan is being performed?
The correct answer is C. Vulnerability Scan. Vulnerability scanning involves assessing systems for known weaknesses, such as unpatched software, insecure configurations, or outdated services. This helps the organization proactively identify and address potential security risks. Option A (Port Scan) is incorrect because it focuses on identifying open ports and services, not specific vulnerabilities. Option B (Network Mapping) is incorrect as it involves identifying the structure and devices on a network but not assessing for weaknesses. Option D (Packet Sniffing) is incorrect because it involves capturing and analyzing network traffic, not identifying vulnerabilities.
58. A company’s change management policy includes a requirement for a risk assessment before any change is implemented. What is the primary goal of this requirement?
The correct answer is A. Performing a risk assessment helps identify potential impacts and risks associated with a change, allowing the organization to develop strategies to mitigate those risks and avoid negative consequences. Option B (To determine the cost-effectiveness of the change) might be considered during the assessment, but it is not the primary goal. Option C (To accelerate the change implementation process) is incorrect because risk assessment ensures safety and thoroughness, which may take additional time. Option D (To document the skills required for the change) is not relevant to the primary purpose of risk assessment.
59. An e-commerce company is in the process of identifying risks that could impact its operations. Which activity would best help in identifying external threats?
Conducting an environmental scan (B) is effective in identifying external threats as it involves analyzing factors outside the organization that could impact operations, such as market trends, regulatory changes, and technological advancements. Analyzing internal audit reports (A) focuses on internal controls and processes. Reviewing employee performance (C) is related to internal human resources issues. Evaluating customer feedback (D) is useful for understanding customer satisfaction but not for identifying external threats.
60. A healthcare provider in the United States needs to ensure compliance with the Health Insurance Portability and Accountability Act (HIPAA) when handling patient information. Which of the following is a key requirement under HIPAA for safeguarding patient information?
A key requirement under HIPAA is implementing technical safeguards to protect electronic protected health information (ePHI) (A). This includes measures such as access control, audit controls, and data encryption to protect the confidentiality, integrity, and availability of ePHI. Option B, while beneficial, is not a specific HIPAA requirement. Option C is important for overall security but is not mandated specifically by HIPAA. Option D is incorrect because HIPAA does not specify a universal retention period for patient records; retention requirements vary by state and other regulations.
61. A large enterprise must ensure the availability of its critical business applications in case of a network disruption. Which measure should they implement to maintain continuous access?
Redundant network paths with automatic failover ensure that if one network path fails, traffic is automatically rerouted to another path, maintaining continuous access and availability. Strong password policies (B) enhance security but do not prevent network disruption. A VPN (C) secures remote access but does not address network redundancy. Daily data synchronization (D) is important for data recovery but does not ensure immediate network availability.
62. During a risk assessment, you identify that your organization's email system could be susceptible to phishing attacks, which might lead to data breaches. What is the best way to mitigate this specific risk?
Conducting employee training on recognizing phishing emails (C) is the most effective way to mitigate the risk of phishing attacks as it directly addresses the human factor, which is often the weakest link. Installing antivirus software (A) is useful for detecting malware but does not prevent phishing. Implementing strong access controls (B) enhances security but is not directly targeted at phishing. Applying encryption to email communications (D) protects the data but does not prevent phishing attempts.
63. A cybersecurity analyst is responding to a security incident where unauthorized access to sensitive data was detected. The analyst must first determine the scope of the incident before proceeding with containment. What is the primary purpose of incident response in this context?
The primary purpose of incident response is to identify and mitigate the root cause of the incident (B). This ensures that the source of the breach is understood and addressed, preventing future occurrences. While restoring normal operations quickly (A) is important, it is a subsequent goal after understanding and mitigating the cause. Preventing further breaches (C) is part of incident response but comes after understanding the root cause. Compliance with regulatory requirements (D) is a necessity, but not the primary purpose in this context. Focusing on identifying and mitigating the root cause is essential for effective incident response.
64. A company wants to separate its network traffic into different segments to enhance security and management. Which class of IPv4 address range should be used to create subnets for this purpose?
Class C (C) IPv4 address range is typically used for small to medium-sized networks and is suitable for creating multiple subnets due to its ability to support up to 254 hosts per subnet. Class A (A) is generally used for very large networks and supports a significantly larger number of hosts, making it less efficient for smaller subnets. Class B (B) is used for medium to large-sized networks and supports more hosts per subnet than Class C but is still larger than necessary for most subnetting needs. Class D (D) is used for multicast groups, not for standard subnetting.
65. An organization is concerned about the risk of environmental hazards, such as fire, damaging its critical infrastructure. Which physical control should be implemented to mitigate this risk?
Installing a fire suppression system in the server room (A) is a physical control that helps prevent fire damage by detecting and extinguishing fires quickly, thus protecting critical infrastructure from environmental hazards. Multifactor authentication (B) is a technical control that enhances access security but does not address fire hazards. Encrypting network communications (C) and deploying endpoint protection software (D) are technical controls that focus on data and device security, respectively, but do not mitigate physical risks like fire.
66. An organization must prioritize risks to its supply chain operations. It identifies a risk of a supplier defaulting, which would have a critical impact. Which factor should most influence the prioritization of this risk?
The criticality of the supplier's products to the organization's operations (D) should most influence the risk prioritization because it directly impacts the organization's ability to deliver its own products and services. The number of alternative suppliers (A) is relevant for contingency planning but secondary. The past performance (B) and financial stability (C) of the supplier provide context but are less critical than the impact on operations if the supplier defaults.
67. In a high-security data center, security guards are responsible for verifying identities and granting access to authorized personnel. What is the best practice to enhance the effectiveness of the security guards in this role?
Training guards to recognize and respond to social engineering attempts improves their ability to detect and prevent unauthorized access by individuals who may try to manipulate them (B). Providing a list for manual verification (A) is less efficient and prone to human error. Allowing guards to use their judgment based on familiarity (C) compromises security as it relies on subjective assessment. Equipping guards with communication devices (D) is useful for incident response but does not enhance access verification.
68. A company experiences a sudden network slowdown and discovers that the cause is a worm that is sending massive amounts of data to random IP addresses. The worm exploited an outdated software vulnerability. Which strategy is most effective in preventing future worm attacks of this nature?
The correct answer is A. Regularly updating software and applying patches. Ensuring that all software is up to date and vulnerabilities are patched is the most effective way to prevent worms from exploiting security flaws. Option B (Implementing multi-factor authentication) enhances account security but does not directly prevent worms from exploiting software vulnerabilities. Option C (Disabling unused network ports) helps reduce attack vectors but does not address the need to patch vulnerabilities in active software. Option D (Increasing physical security measures) is important for overall security but does not mitigate software-based threats like worms.
69. An employee opens an email attachment that appears to be an invoice, which causes their computer to crash repeatedly. The IT department finds that the attachment installed a program that infects other executable files on the system. What type of network threat does this describe?
The correct answer is B. Virus. This scenario describes a virus that infects executable files on the system and causes the computer to crash repeatedly, which is a common behavior of file-infecting viruses. Option A (Ransomware) is incorrect because ransomware encrypts files and demands payment to decrypt them, which does not align with the description of infecting other executables. Option C (Adware) is incorrect as adware is designed to display unwanted advertisements and does not typically cause system crashes or spread by infecting files. Option D (Phishing) is incorrect because phishing involves tricking users into revealing sensitive information, often through deceptive emails, and does not involve malware that infects files or causes crashes.
70. A network administrator is configuring a WiFi network and needs to ensure that only authorized devices can connect to it. Which security protocol should be used to provide the highest level of security for the WiFi network?
WPA3 (D) is the latest and most secure WiFi security protocol, offering robust protection through stronger encryption and key management practices. It provides enhanced protection against brute-force attacks and improves security for both personal and enterprise WiFi networks. WEP (A) is outdated and highly vulnerable to attacks. WPA (B) is an improvement over WEP but is still considered insecure compared to newer protocols. WPA2 (C) is widely used and provides strong security, but WPA3 offers further advancements in encryption and protection against emerging threats.
71. An enterprise is implementing a secure authentication system for its employees working remotely. Which method would best ensure that only legitimate employees can access the company network?
Two-factor authentication with a hardware token and biometric scan combines something the user has (token) and something the user is (biometrics), providing robust security and ensuring that only legitimate employees can access the network. IP whitelisting (A) is easily bypassed and not secure for remote access. Strong passwords and security questions (B) are susceptible to phishing. VPNs (D) encrypt data but do not ensure the identity of the user.
72. A government agency implements MAC to manage access to sensitive documents. An analyst with a "Confidential" clearance attempts to access a document labeled "Secret." According to MAC principles, what should happen?
Option A is correct because under MAC, access is strictly controlled based on clearance levels and document classifications. If the analyst's clearance level does not match or exceed the document's classification, the system will automatically deny access. Option B (B) and C (C) suggest exceptions that are not consistent with MAC's non-discretionary enforcement of access rules. Option D (D) suggests a manual review process, which is not part of the automatic enforcement characteristic of MAC.
73. A NIDS alert indicates a significant amount of traffic on the network from an internal IP address that is attempting to communicate with multiple external IP addresses using a wide range of ports. The activity is unusual for the internal device identified. What type of network activity does this most likely represent?
The correct answer is A. Network Scanning. The NIDS alert indicating significant traffic from an internal IP attempting to communicate with multiple external addresses over a wide range of ports is typical of network scanning. Scanning involves probing various systems to find open ports and potential vulnerabilities. Option B (Phishing) is incorrect because phishing involves tricking individuals into revealing sensitive information through deceptive communications, not scanning networks. Option C (DNS Spoofing) is incorrect as it involves redirecting traffic by corrupting DNS entries, not probing multiple ports and IP addresses. Option D (Social Engineering) is incorrect because it involves manipulating individuals to gain unauthorized access, not generating unusual network traffic.
74. An organization is concerned about the physical security of its facility, particularly from external threats. Which of the following environmental design strategies is most effective for controlling access and improving security?
High fences and gates create a significant physical barrier that controls access and deters potential intruders, effectively improving the security of the facility (A). Non-reflective glass (B) reduces glare but does not enhance physical security. Trees close to the building (C) can obscure views but may also provide cover for intruders. Bright colors (D) do not contribute to physical security measures.
75. During a security incident, a company’s incident response team prioritizes activities such as isolating affected systems, identifying compromised data, and preserving evidence. Why are these actions critical to the purpose of incident response?
These actions are critical because they support a thorough investigation and recovery process (B). Isolating systems and preserving evidence are key to understanding the incident's impact and scope, which are necessary for effective mitigation and recovery. Meeting legal obligations (A) is important but secondary to the investigation process. Minimizing public relations impact (C) is a consideration, but not the main focus during initial incident response. Ensuring business continuity (D) is crucial but requires understanding the incident first. Thus, supporting a thorough investigation is central to incident response.
76. A university wants to control access to its network based on user roles and device compliance. Which NAC technology best supports this requirement?
Using a RADIUS server with 802.1X (C) enables role-based access control and device compliance checks, allowing the university to manage network access based on user roles and ensure that devices meet security requirements. IPsec VPN (A) provides secure remote access but does not manage internal network access based on roles. Port-based access control (B) provides basic access control but does not support role-based policies. Network segmentation (D) separates network traffic but does not enforce access control or compliance checks.
77. An IT department needs to ensure that the integrity of system logs is maintained to detect any unauthorized changes. Which of the following actions should they implement?
Generating hash values allows the IT department to detect any unauthorized changes to the log files by comparing the current hash values with the previously recorded ones. Storing logs on a NAS device (A) does not inherently protect integrity. Encrypting log files (B) helps protect confidentiality, not integrity. Daily backups (D) ensure data recovery but do not address the integrity of the logs in real-time.
78. A healthcare organization needs to identify potential risks associated with its electronic health record (EHR) system. Which of the following sources of information would be most useful for identifying these risks?
Industry threat intelligence reports (C) are most useful for identifying risks associated with the EHR system, as they provide current information on threats and vulnerabilities specific to the healthcare sector. Vendor marketing materials (A) are biased and may not highlight potential risks. Regulatory compliance reports (B) ensure legal adherence but do not provide detailed threat insights. Patient satisfaction surveys (D) are more focused on service quality than identifying technical risks.
79. A company is planning to implement a new customer relationship management (CRM) system. The security team is tasked with identifying potential threats that could impact the system and assessing the associated risks. Which of the following steps should the security team perform first to ensure a comprehensive risk management process?
Identifying and evaluating assets that need protection (C) is the first step in the risk management process, as it allows the team to understand what is valuable and needs safeguarding. Implementing controls (A) is premature without first identifying and evaluating risks. Conducting a Business Impact Analysis (B) is essential but typically follows asset identification. Performing a qualitative risk analysis (D) comes after assets and threats have been identified and evaluated.
80. During a security audit, it is found that an employee in the marketing department has full administrative access to the HR database. What should be done to comply with the principle of least privilege?
Option A is correct because it aligns with the principle of least privilege by completely removing access to data that the marketing employee should not have. There is no justifiable reason for a marketing employee to have any access to HR data, thus eliminating the risk entirely. Option B (B) still allows unnecessary access, which does not comply with the principle of least privilege. Option C (C) assumes there is a legitimate need, which is not the case here; therefore, it is not applicable. Option D (D) is a temporary measure and still violates the principle since the employee does not need access to the HR database at any point.
81. An organization relies on a single data center for all its operations. To enhance redundancy and reduce the risk of downtime, which strategy should they adopt?
Establishing a geographically separate, mirrored data center (C) provides redundancy by replicating critical data and services, ensuring continuity in the event of a failure at the primary data center. A cold site (A) provides a location for recovery but lacks the immediate availability of data and services. RAID 0 (B) offers improved performance but no redundancy as it lacks data mirroring or parity. Installing additional air conditioning units (D) helps with cooling but does not contribute to data or service redundancy.
82. A hospital's IT infrastructure suffers a ransomware attack, leading to the encryption of patient records. Why is having a disaster recovery plan crucial in this scenario?
Having a disaster recovery plan is crucial for a hospital (B) to quickly restore access to critical healthcare systems following a ransomware attack. This rapid recovery is essential for ensuring that patient care is not interrupted and that vital medical services continue without disruption. While meeting legal obligations (A) and enhancing cybersecurity (C) are important, the primary goal in this context is to maintain the functionality of healthcare systems. Providing evidence for investigations (D) is a secondary concern and not the main reason for disaster recovery planning in this critical environment.
83. A healthcare organization needs to implement an authentication system for its electronic medical records (EMR) system. The system must comply with strict regulatory requirements for user authentication. Which of the following is the most appropriate solution?
Requiring a smart card in addition to a password provides two-factor authentication, which is necessary for compliance with stringent regulatory requirements in healthcare. Username and password (A) alone are not sufficient for high-security applications. Biometric authentication (B) provides strong security but may not meet all regulatory requirements alone. CAPTCHA verification (D) helps prevent automated access but is not suitable for verifying legitimate users in a regulated environment.
84. An e-commerce business is utilizing an IaaS provider to scale its web services. What is a critical security measure they should implement to protect their online transactions?
Implementing robust access control policies and multi-factor authentication (B) is critical for protecting online transactions in an IaaS environment by ensuring that only authorized users have access to sensitive systems and data. Regularly updating web application themes (A) may improve aesthetics but does not enhance security. Using the same password for all administrative accounts (C) is a significant security risk. Allowing unrestricted public access to all virtual machines (D) exposes the system to potential threats.
85. A healthcare organization is evaluating a cloud service provider to host sensitive patient data. Which aspect of the Cloud Service-Level Agreement (SLA) should they focus on to ensure data security and compliance with regulations?
Data residency and sovereignty (B) in the Cloud Service-Level Agreement (SLA) are crucial for ensuring that the cloud provider complies with regulations related to where sensitive patient data can be stored and processed, which is vital for data security and regulatory compliance. Service cancellation terms (A) are important for contract termination but do not address data security. Downtime compensation (C) pertains to financial reimbursement, not security. Service upgrade options (D) relate to the availability of enhanced services rather than security compliance.
86. An organization regularly tests its business continuity plan to ensure that all employees are familiar with their roles during a disruption. What component of the BCP does this activity support?
Regularly testing the business continuity plan to ensure employees are familiar with their roles supports the training and awareness component (B). This ensures that all staff know their responsibilities during a disruption, which helps in executing the BCP effectively. Risk management (A) involves identifying and mitigating risks but does not focus on employee training. The business impact analysis (C) identifies critical functions and impacts but does not address training. The data protection plan (D) is concerned with safeguarding data, not training employees.
87. A retail company experiences a significant data breach, leading to a temporary shutdown of its online operations. How does having a robust business continuity plan (BCP) help the company in such a situation?
Having a robust business continuity plan (BCP) is crucial as it helps the company quickly resume critical business functions after a disruption, such as a significant data breach (B). This enables the company to maintain operations, reduce downtime, and minimize the impact on customers and revenue. Immediate legal compliance and reduction of fines (A) are important but are more related to compliance and legal aspects rather than business continuity. Preventing future security breaches (C) falls under security measures rather than continuity planning. Eliminating the need for insurance coverage (D) is incorrect, as insurance is a complementary measure to a BCP and not a replacement.
88. An employee unknowingly installed a piece of software that began logging their keystrokes and sending this information to a remote server. This compromised the employee's login credentials for several critical systems. Which type of threat does this situation exemplify?
The correct answer is C. Keylogger. This scenario describes a threat where software logs keystrokes and sends them to a remote server, which is characteristic of a keylogger, a type of malicious software specifically designed to capture and relay users' keystrokes. Option A (Rootkit) is incorrect because a rootkit is designed to hide malicious activity on a system and often provides root-level access to an attacker, not specifically to log keystrokes. Option B (Spyware) is incorrect as it is a broader category of software that gathers information without the user's knowledge, and while keyloggers can be considered a type of spyware, the keylogging function is the specific threat in this scenario. Option D (Adware) is incorrect because adware is designed to display unwanted advertisements to the user, not to log keystrokes or capture sensitive information.
89. A company has established a policy mandating the use of encryption for all sensitive data transmitted over external networks. Which of the following best describes the benefit of this policy?
The policy's primary benefit is that it protects data confidentiality during transmission over untrusted networks (D). By encrypting sensitive data, the organization ensures that even if the data is intercepted, it cannot be read by unauthorized parties. Option A is incorrect because the policy alone does not guarantee compliance with all regulations, as compliance requires more comprehensive measures. Option B is irrelevant since it pertains to data at rest, not data in transit. Option C focuses on data integrity, which while important, is not the primary objective of encryption during transmission, which is mainly to protect confidentiality.
90. A multinational corporation wants to secure access to its internal systems by ensuring that only authorized employees can log in from any location. Which authentication method would best meet this requirement?
Multi-factor authentication (MFA) combines two or more independent credentials—what the user knows (password) and what the user has (token)—to verify identity, making it much more secure than single-factor authentication (A). IP-based restrictions (C) can limit access locations but do not verify the user’s identity. Biometrics (D) are effective but not always feasible for remote access from various locations. MFA provides a balance of security and flexibility, ensuring that even if one factor is compromised, unauthorized access is still prevented.
91. A university campus uses CCTV to monitor entrances and exits. It has been reported that the system's footage quality is poor, making it difficult to identify individuals. What is the best approach to improve the effectiveness of the CCTV system?
Upgrading to higher resolution cameras improves the quality of the footage, making it easier to identify individuals and enhancing the effectiveness of the CCTV system (B). Increasing the number of cameras (A) does not address the issue of poor image quality. Assigning more personnel to monitor footage (C) is useful but does not solve the quality issue. Stricter access control policies (D) are important but do not directly improve CCTV effectiveness.
92. During a network security audit, it is discovered that a key device is not applying Network Address Translation (NAT). The device is acting as a gateway for internal users accessing external resources. Which issue could arise from this configuration?
Without NAT, internal IP addresses are exposed to external networks (B), making them more susceptible to attacks and reducing network security. NAT hides internal IP addresses, translating them to a different external address. Increased bandwidth usage (A) is unrelated to NAT configuration. Slower network speeds (C) could occur for various reasons, but are not directly related to NAT being disabled. Reduced internal network traffic (D) is irrelevant to the presence or absence of NAT.
93. A financial institution needs to ensure that only authorized personnel can access its secure vault. The vault is located in a remote area of the building with limited visibility. Which physical security control is the most suitable to prevent unauthorized access?
A robust door with multi-factor authentication provides a strong physical barrier and requires multiple credentials for access, significantly enhancing security (B). Security guards (A) are useful but can be bypassed or compromised. A sign-in sheet (C) is not a preventive measure and offers no physical barrier. Motion sensors and alarms (D) are effective in detecting intrusions but do not physically prevent access.
94. A company is implementing a secure email system that ensures senders cannot deny sending an email. Which method should they use to achieve non-repudiation of sent emails?
Signing emails with a private key using digital certificates ensures non-repudiation by proving that the sender is the rightful originator of the email. This method binds the sender to the email in a way that cannot be easily denied. A strong password policy (A) enhances security but does not prevent denial of sending an email. Symmetric encryption (C) secures content but does not provide proof of authorship. Logging email activity (D) provides evidence of sending but can be disputed and does not offer cryptographic proof.
95. You are tasked with securing the physical access to a server room that contains critical data. The server room is located in a shared office building with multiple tenants. Which of the following access controls is most effective in preventing unauthorized physical access to the server room?
A layered access control system combining key cards and biometric scanners provides a high level of security by requiring multiple forms of authentication, reducing the risk of unauthorized access (C). A badge system (A) is effective but can be compromised if badges are lost or stolen. A combination lock (B) is less secure due to the risk of code sharing. A single key for all tenants (D) poses a significant security risk as it allows broad access and compromises individual tenant security.
96. During a risk assessment, an organization identifies multiple risks that could affect its data integrity. Which of the following criteria is most important when prioritizing these risks for mitigation?
The potential impact on business operations (C) is most critical when prioritizing risks, as it directly affects the organization's ability to function and maintain data integrity. The cost of potential damages (A) is significant but should be weighed against operational impact. The feasibility of mitigation (B) is a practical consideration but secondary to the risk's impact. The frequency of past incidents (D) informs risk likelihood but is less critical than the current and future operational impact.
97. A manufacturing company relies heavily on automated systems and real-time data processing. What is the primary importance of having a disaster recovery plan for this company?
For a manufacturing company, the primary importance of a disaster recovery plan (B) is to ensure the continuity of production and avoid downtime, which is crucial for maintaining operational efficiency and meeting production targets. The ability to quickly recover from disruptions ensures that the manufacturing processes remain uninterrupted, which is vital for the company's bottom line. Protecting intellectual property (A) and complying with data protection standards (C) are important but secondary to the need to maintain production. Reducing the risk of cyberattacks (D) is related but not the primary focus of disaster recovery, which centers on operational continuity.
98. A financial firm is concerned about potential power failures disrupting critical operations in their on-premises network. What power management strategy should they use to minimize the impact of a sudden power loss?
Using dual power supplies for critical systems (B) ensures redundancy, so if one power supply fails, the other can immediately take over, minimizing disruption. Power Factor Correction (PFC) (A) improves energy efficiency but does not address redundancy. Voltage regulators (C) stabilize voltage levels but do not provide redundancy for power supplies. Load Shedding (D) involves reducing power usage by turning off non-critical systems during peak demand, which does not ensure continuous power supply for critical systems.
99. During a cyber attack, a company's incident response team quickly moves to isolate affected systems and collect forensic evidence. What is the significance of these actions in the context of incident response?
The significance of these actions is to preserve critical evidence and prevent the spread of the attack (B). Isolating affected systems and collecting forensic evidence are essential for understanding the attack and taking steps to mitigate it. Ensuring insurance coverage (A) is not the primary focus of immediate incident response. Restarting operations (C) prematurely can lead to further issues if the attack is not fully contained. Avoiding legal liabilities (D) is a concern, but preserving evidence and containment are more directly related to the effectiveness of the incident response.
100. An organization integrates security awareness training into its onboarding process for new employees. Why is this practice beneficial?
Integrating security awareness training into onboarding helps new employees understand the importance of following security protocols from the start (B), ensuring they adopt secure practices early. While knowing job responsibilities (A) is important, it is separate from security awareness. Regular audits (C) are still necessary for ongoing security assessment. Skipping security clearance (D) is not appropriate, as it is a separate critical process.
Your score is
Restart quiz
