Sec+ Study Quiz 13

Which of the following documents specifies what to do in the event of catastrophic loss of a physical or virtual system?

• Data retention plan

• Incident response plan

• Disaster recovery plan

• Communication plan

Answer explanation

The correct choice is the Disaster recovery plan, which specifies what to do in the event of catastrophic loss of a physical or virtual system.

Which of the following roles is responsible for defining the protection type and classification type for a given set of files?

• General counsel

• Data owner

• Risk manager

• Chief Information Officer

Answer explanation

The data owner is responsible for defining the protection type and classification type for a given set of files.

An employee's company email is configured with conditional access and requires that MFA is enabled and used. An example of MFA is a phone call and:

• a push notification

• a password

• an SMS message

• an authentication application

Answer explanation

The correct choice for MFA in the scenario described is an authentication application, which is an example of a method used for multi-factor authentication.

Which of the following is a security implication of newer ICS devices that are becoming more common in corporations?

• Devices with cellular communication capabilities bypass traditional network security controls

• Many devices do not support elliptic-curve encryption algorithms due to the overhead they require

• These devices often lack privacy controls and do not meet newer compliance regulations

• Unauthorized voice and audio recording can cause loss of intellectual property

Answer explanation

Devices with cellular communication capabilities bypass traditional network security controls, posing a security risk in corporations.

Which of the following is required in order for an IDS and a WAF to be effective on HTTPS traffic?

• Hashing

• DNS sinkhole

• TLS inspection

• Data masking

Answer explanation

TLS inspection is required for an IDS and a WAF to be effective on HTTPS traffic as it allows for the decryption and analysis of encrypted traffic.

A company policy requires third-party suppliers to self-report data breaches within a specific time frame. Which of the following third-party risk management policies is the company complying with?

• MOU

• SLA

• EOL

• NDA

Answer explanation

The company is complying with the SLA policy by requiring third-party suppliers to self-report data breaches within a specific time frame.

While troubleshooting service disruption on a mission-critical server, a technician discovered the user account that was configured to run automated processes was disabled because the user's password failed to meet password complexity requirements. Which of the following would be the best solution to securely prevent future issues?

• Using an administrator account to run the processes and disabling the account when it is not in use

• Implementing a shared account the team can use to run automated processes

• Configuring a service account to run the processes

• Removing the password complexity requirements for the user account

Answer explanation

Configuring a service account to run the processes is the best solution as it ensures secure automation without relying on individual user accounts.

A security analyst is assessing a newly developed web application by testing SQL injection, CSRF, and XML injection. Which of the following frameworks should the analyst consider?

• ISO

• MITRE ATT&CK

• OWASP

• NIST

Answer explanation

The analyst should consider OWASP as it provides guidelines and tools for web application security testing, including SQL injection, CSRF, and XML injection.

A user's laptop constantly disconnects from the Wi-Fi network. Once the laptop reconnects, the user can reach the internet but cannot access shared folders or other network resources. Which of the following types of attacks is the user most likely experiencing?

• Bluejacking

• Jamming

• Rogue access point

• Evil twin

Answer explanation

The user is likely experiencing an Evil Twin attack, where a malicious access point impersonates a legitimate one to intercept network traffic and access sensitive information.

Which of the following procedures would be performed after the root cause of a security incident has been identified to help avoid future incidents from occurring?

• Walk-throughs

• Lessons learned

• Attack framework alignment

• Containment

Answer explanation

Lessons learned would be performed after the root cause of a security incident has been identified to help avoid future incidents from occurring by applying knowledge gained from the incident.