Sec Review 4

A business conducts a test where they intentionally leave USB drives in the parking lot to see if employees will pick them up and plug them into company computers. This test is primarily to raise awareness about:

• Password management

• Insider threats

• Social engineering

• Phishing

An organization decides not to do business in a country due to the high risk of data breaches and cyber threats. This is an example of which risk management strategy?

• Avoid

• Transfer

• Accept

• Mitigate

A vendor is subjected to a simulated cyber-attack to evaluate their security posture. What method is being used?

• Penetration testing

• Due diligence

• Vendor monitoring

• Supply chain analysis

Which of the following is an example of an operational control?

• Access badge

• Incident response plan

• Firewall

• Security policy

Which of the following is NOT a component of the Zero Trust model?

• Policy Administrator

• Policy Engine

• Policy Enforcement Point

• Policy Execution Point

What is the primary purpose of salting in cryptographic solutions?

• To securely store a copy of cryptographic keys.

• To replace sensitive data with non-sensitive placeholders.

• To add randomness to a password before hashing it.

• To verify the integrity and authenticity of a digital message or document.

An organization’s decision to implement multi-factor authentication (MFA) after identifying potential authentication vulnerabilities is an example of which risk management strategy?

• Avoid

• Mitigate

• Accept

• Transfer

Which of the following best describes the motivations of a threat actor involved in data exfiltration?

• Philosophical/political beliefs

• Espionage

• Ethical

• Service disruption

Which of the following is NOT typically an advantage of automation in security operations?

• Workforce multiplier

• Reaction time

• Efficiency/time saving

• Ongoing supportability

An attacker who gains access by leveraging a gap between when a vulnerability is found and when it’s fixed is exploiting:

• Zero-day

• Legacy vulnerability

• End-of-life vulnerability

• Misconfiguration