CYB125 - Ch3

Adam is evaluating the security of a web server before it goes live. He believes that an issue in the code allows a cross-site scripting attack against the server. What term describes the issue that Adam discovered?

• Threat

• Vulnerability

• Risk

• Impact

Which term describes an action that can damage or compromise an asset?

• Risk

• Vulnerability

• Countermeasure

• Threat

Purchasing an insurance policy is an example of the ____________ risk management strategy.

Aditya is the security manager for a mid-sized business. The company has suffered several serious data losses when laptops were stolen. Aditya decides to implement full disk encryption on all laptops. What risk response did Aditya take?

• Reduce

• Transfer

• Accept

• Avoid

Residual Risk describes the risk that exists after an organization has performed all planned countermeasures and controls?

• True

• False

Violet deploys an intrusion prevention system (IPS) on her network as a security control. What type of control has Violet deployed?

• Detective

• Preventive

• Corrective

• Deterrent

What is an example of an alteration threat?

• Espionage

• System or data modification

• Intentional information leak

• Denial of service

What type of attack against a web application uses a newly discovered vulnerability that is not patchable?

• Structured Query Language (SQL) injection

• Cross-site scripting (XSS)

• Cross-site request forgery (CSRF)

• Zero-day attack

Which type of attack involves eavesdropping on transmissions and redirecting them for unauthorized use?

• Interception

• Interruption

• Fabrication

• Modification

A hacker has stolen logon IDs and passwords. The hacker is now attempting to gain unauthorized access to a public-facing web application by using the stolen credentials one by one. What type of attack is taking place?

• Birthday attack

• Replay attack

• Phreaking

• Credential harvesting