Security 5

Which of the following threat vectors is most commonly utilized by insider threat actors attempting data exfiltration?

• Unidentified removable devices

• Default network device credentials

• Spear phishing emails

• Impersonation of business units through typosquatting

Which of the following methods to secure credit card data is best to use when a requirement is to see only the last four numbers on a credit card?

• Encryption

• Hashing

• Masking

• Tokenization

Answer explanation

Masking involves hiding sensitive information by replacing it with a specific character, such as an asterisk (*). In the case of credit card numbers, masking would typically involve displaying only the last four digits, while the rest of the numbers are replaced with asterisks. This allows for partial visibility of the card number while protecting the sensitive information.

The Chief Information Security Officer (CISO) has determined the company is non-compliant with local data privacy regulations. The CISO needs to justify the budget request for more resources. Which of the following should the CISO present to the board as the direct consequence of non-compliance?

• Fines

• Reputational damage

• Sanctions

• Contractual implications

Which of the following alert types is the most likely to be ignored over time?

• True positive

• True negative

• False positive

• False negative

Answer explanation

C. False Positive - triggered when an event is NOT actually a threat. True Positive - an actual threat True Negative - no threat False Negative - an actual threat isn't detected, dangerous type since threats go unnoticed.

A security analyst is investigating an application server and discovers that software on the server is behaving abnormally. The software normally runs batch jobs locally and does not generate traffic, but the process is now generating outbound traffic over random high ports. Which of the following vulnerabilities has likely been exploited in this software?

• Memory injection

• Race condition

• Side loading

• SQL injection

Answer explanation

A is correct. Memory injection allows the attackers to inject malicious code directly into the memory of a running process which can then be used to execute arbitrary commands or generate unauthorized network traffic. Race Condition refers to two processes competing to modify the same resource which can lead to unpredictable behavior but is less likely to cause abnormal outbound traffic. Side Loading refers to loading a malicious DLL into a legitimate process. SQL injection involves injecting malicious SQL code into a database and is primarily concerned with database manipulation rather than generating outbound network traffic.

An important patch for a critical application has just been released, and a systems administrator is identifying all of the systems requiring the patch. Which of the following must be maintained in order to ensure that all systems requiring the patch are updated?

• Asset inventory

• Network enumeration

• Data certification

• Procurement process

Answer explanation

The best answer is: A. Asset inventory An asset inventory is essential for ensuring that all systems requiring the patch are updated. By maintaining a comprehensive inventory of all systems, the administrator can identify which devices have the critical application installed and require the patch. An accurate asset inventory helps ensure that no systems are overlooked during the patching process. - Network enumeration focuses on identifying devices on the network but does not necessarily provide information about the applications running on those devices. - Data certification relates to validating the integrity and accuracy of data, which is unrelated to identifying systems needing patches. - Procurement process involves acquiring hardware or software but does not help track existing systems for patching needs. Therefore, an asset inventory is the best choice for maintaining awareness of all systems that require patching.

Which of the following should a security operations center use to improve its incident response procedure?

• Playbooks

• Frameworks

• Baselines

• Benchmarks

Answer explanation

A. Playbooks Its a step by step procedure outlining how to respond to specific types of incidents.

Which of the following describes an executive team that is meeting in a board room and testing the company's incident response plan?

• Continuity of operations

• Capacity planning

• Tabletop exercise

• Parallel processing

A healthcare organization wants to provide a web application that allows individuals to digitally report health emergencies. Which of the following is the most important consideration during development?

• Scalability

• Availability

• Cost

• Ease of deployment

Which of the following agreement types defines the time frame in which a vendor needs to respond?

• SOW

• SLA

• MOA

• MOU

Answer explanation

SOW - Statement of Work

SLA - Service Level Agreement

MOA - Memorandum of Agreement

MOU - Memorandum of Understanding

A Service Level Agreement (SLA) defines the specific levels of service that a vendor is expected to provide, including: Response time frames: The time within which the vendor must respond to issues, requests, or incidents. Uptime guarantees: Commitments to service availability. Performance metrics: Quantifiable goals for the service. An SLA ensures accountability and sets clear expectations for the relationship between the organization and the vendor.