Sec Review 3

Which type of security control aims to limit the damage of an attack after it has occurred?

• Preventive

• Detective

• Corrective

• Deterrent

What is non-repudiation primarily concerned with?

• Ensuring system uptime

• Proving the origin of a message

• Ensuring data is not tampered with

• Ensuring only authorized personnel access data

Which of the following is an asymmetric encryption algorithm?

• AES

• RSA

• Blowfish

• Triple DES

Indicators of malicious activity might include all of the following EXCEPT:

• Impossible travel

• Concurrent session usage

• Blocked content

• Patching frequency

Which of the following threat actors is most likely to be motivated by financial gain?

• Nation-state

• Hacktivist

• Organized crime

• Insider threat

What data classification would be most appropriate for a company’s press releases that get shared openly?

• Public

• Restricted

• Sensitive

• Confidential

In the context of a network’s attack surface, what does device placement primarily influence?

• Device power consumption.

• Scalability of the network.

• Exposure to potential threats.

• Responsiveness of microservices.

Which data source is best suited to provide information on potential malicious activity across an organization’s network traffic?

• Vulnerability scans

• IPS/IDS logs

• Endpoint logs

• OS-specific security logs

To control access to resources based on an employee’s job role, an organization should implement:

• Role-based access controls

• Attribute-based access controls

• Discretionary access controls

• Mandatory access controls

Which factor directly measures the maximum potential loss from a vulnerability?

• Common Vulnerability Scoring System (CVSS).

• Vulnerability classification.

• Exposure factor.

• Risk tolerance.