Who are individuals or groups who pose a risk to cybersecurity, categorized by their motivations and skills?

Which type of hacker uses their skills for defensive purposes, with permission?

Which type of hacker operates without permission but often does not have malicious intent and may expose vulnerabilities to push for a fix?

Which type of hacker hacks without permission for personal gain, criminal activity, or other harmful purposes?

Who are individuals who discover and sell information about zero-day vulnerabilities?

Who are individuals or groups motivated by financial gain in the context of hacking?

Who are hacking teams sponsored by a government to conduct cyber warfare, espionage, or intelligence gathering?

What are technologies and processes used to prevent sensitive data from leaving a company's network called?

What are ways data can be lost, such as physical theft of devices, accidental deletion, malicious insider activity, or external cyberattacks, called?

What is the process of identifying, assessing, and mitigating risks to an organization's assets called?

What is the process of identifying and analyzing potential risks called?

What are measures put in place to reduce risk, such as firewalls, policies, or locks, called?

What are forensically identifiable artifacts of a cyberattack, such as malicious file hashes or IP addresses, called?

Which U.S. federal agency is involved in cybersecurity and is abbreviated as CISA?

Which non-profit organization is focused on promoting cybersecurity awareness and is abbreviated as NCSA?

What term describes the path or method used by a threat actor to gain access to a system?

An individual who uses their hacking skills with permission to find vulnerabilities in a company's system is a:

Which of the following is a primary goal of a state-sponsored hacker?

What is the main purpose of Data Loss Prevention (DLP) solutions?

Which of the following is an example of an administrative security control?

A malicious IP address found in system logs after a network breach is an example of a(n):

The phase of the cyber kill chain where the attacker establishes a command-and-control channel is known as:

Which model for intrusion analysis includes the four core elements of Adversary, Capability, Infrastructure, and Victim?

Which social engineering tactic involves creating a false scenario to gain a victim's trust and information?

The process of an organization resuming its business operations after a significant disruptive event is called:

Which phase of reconnaissance involves an attacker using tools to identify open ports and services on a target's network?

A type of cyberattack that involves injecting malicious code into an application's database query is known as:

What is the primary function of digital forensics?

Which type of threat actor is primarily motivated by a political or social cause?

A rogue access point is a common threat associated with which threat domain?

The process of identifying, assessing, and mitigating risks to an organization's assets is called:

An organization's formal plan for dealing with a security breach is called a(n):

What is a common data loss vector that involves the physical theft of a device containing sensitive information?

A denial of service (DoS) attack aims to:

Which U.S. federal agency is responsible for protecting the nation's critical infrastructure from cyber threats?

The term for an individual who uses pre-packaged hacking tools without a deep understanding of what they are doing is:

In the Diamond Model of Intrusion Analysis, which element refers to the tools and exploits used by the attacker?

Which of the following is a type of application attack?

The final phase of the Cyber Kill Chain, where the attacker achieves their ultimate goal, is known as:

Which of the following is NOT a phase of reconnaissance in the context of a cyberattack?

The process of identifying and analyzing potential risks to an organization's assets is known as:

Which type of hacker is a security researcher who discovers a zero-day vulnerability and sells it to a government agency or another party?

A user receiving a text message that seems to be from their bank asking them to click a link and verify their account information is an example of:

The primary purpose of antivirus software is to:

A company's IT department notices unusual outbound network traffic from a server. Upon investigation, they discover a malware program has been installed and is sending sensitive customer data to an external IP address. The IT team immediately isolates the infected server from the network and begins to analyze the malicious file to understand how it got there. The unusual outbound traffic and the external IP address are examples of:

A company's IT department notices unusual outbound network traffic from a server. Upon investigation, they discover a malware program has been installed and is sending sensitive customer data to an external IP address. The IT team immediately isolates the infected server from the network and begins to analyze the malicious file to understand how it got there. The action taken by the IT team to disconnect the infected server from the network is part of which phase of the incident response process?

Scenario: A company's IT department notices unusual outbound network traffic from a server. Upon investigation, they discover a malware program has been installed and is sending sensitive customer data to an external IP address. The IT team immediately isolates the infected server from the network and begins to analyze the malicious file to understand how it got there. To determine how the malware was installed, the IT team would likely perform a(n):

This entire scenario, from the initial compromise to the data exfiltration, can be mapped to which model?

The discovery of the malware being installed and sending data out of the network corresponds to which phases of the Cyber Kill Chain?