SEC+ Mod 6 Part 2

What is an example of data exposure?

• Using encrypted HTTP instead of HTTPS

• Failing to set up event logs for system activities

• Accidentally making a database accessible to the public

• Implementing proper logging and monitoring

Answer explanation

Accidentally making a database accessible to the public is an example of data exposure.

What is inadequate logging and monitoring?

• Failing to implement encryption for data in transit

• Not configuring proper logging and monitoring

• Making a database accessible to unauthorized users

• Using HTTPS for transmitting sensitive data

Answer explanation

Not configuring proper logging and monitoring refers to the lack of setting up systems to track and analyze activities, making it difficult to detect and respond to security incidents effectively.

What is a consequence of unencrypted data transmission?

• Data exposure

• Eavesdropping

• Proper logging and monitoring

• Secure data transmission

Answer explanation

Eavesdropping is a consequence of unencrypted data transmission as it allows unauthorized parties to intercept and listen to the data being transmitted.

What is a zero-day vulnerability?

• A vulnerability known to the software vendor

• A vulnerability with public disclosure

• A vulnerability unknown to the software vendor or the general public

• A vulnerability with low risk

Answer explanation

A zero-day vulnerability is a vulnerability unknown to the software vendor or the general public, making it potentially dangerous due to the lack of available patches or defenses.

Which of the following is NOT a characteristic of a zero-day vulnerability?

• Unknown to vendor

• No public disclosure

• Low risk

• High risk

Answer explanation

The correct choice is 'Low risk' because zero-day vulnerabilities are typically considered high risk due to their unknown nature and lack of public disclosure.

What is a zero-day vulnerability?

• A vulnerability that has been patched by the software vendor.

• A vulnerability that is known to the public and has a fix available.

• A vulnerability that is unknown to the software vendor and has no patches or updates available.

• A vulnerability that is only found in hardware systems.

Answer explanation

A zero-day vulnerability is a vulnerability that is unknown to the software vendor and has no patches or updates available.

Which of the following is NOT a characteristic of zero-day vulnerabilities?

• Unknown to vendor

• No public disclosure

• Low risk

• Time window

Answer explanation

The correct choice is 'Low risk' because zero-day vulnerabilities are typically considered high risk due to their unknown nature and lack of public disclosure.

Why are zero-day vulnerabilities considered high risk?

• Because they have known fixes.

• Because they are easy to detect.

• Because they can be exploited for cyberattacks and have no known fixes.

• Because they are always disclosed to the public.

Answer explanation

Because they can be exploited for cyberattacks and have no known fixes.

What is the typical response of security researchers or ethical hackers when they discover a zero-day vulnerability?

• They keep it secret to exploit it later.

• They inform the software vendor to address the issue.

• They sell it on the black market.

• They ignore it.

Answer explanation

They inform the software vendor to address the issue.

Which of the following is a recommended practice to defend against zero-day vulnerabilities?

• Ignoring software updates.

• Using outdated security systems.

• Employing security best practices and regularly updating software.

• Disabling intrusion detection systems.

Answer explanation

Employing security best practices and regularly updating software is a recommended practice to defend against zero-day vulnerabilities.