Font size
WorksheetsInformation Assurance and Security 2 - PreFinal and Final Exam
Total questions: 60
Worksheet time: 35mins
The security principle of Least Privilege (PoLP) is best defined as a requirement to:
Ensure that every single user is assigned the necessary administrator-level access to troubleshoot complex system failures.
Grant only the minimum level of access permissions and resources necessary for a user or process to perform its designated function.
Implement a comprehensive firewall and network monitoring solution at the primary network perimeter to mitigate external threats.
Standardize all operating system images and remove all proprietary applications across the entire organizational network.
Which strategy is an essential component of Defense in Depth when designing a secure system architecture?
Implementing security controls in a single, well-isolated network segment to prevent internal spread.
Deploying overlapping, redundant, and varied security controls across multiple layers of the system.
Centralizing all authentication and authorization to a single, highly-protected server instance.
Using proprietary, non-standard operating systems to ensure that external attackers cannot understand the environment.
What is the core, non-negotiable principle underlying the Zero Trust Architecture (ZTA)?
Trust all devices that are physically located on the corporate campus, but verify remote access sessions.
Always verify the identity and device posture explicitly before granting access to any resource, regardless of its location.
Implement strong physical security controls and assume that all logical network traffic is inherently trustworthy.
Use a complex array of intrusion detection systems (IDS) to monitor the internal network after initial user authentication.
System hardening primarily aims to achieve which of the following security objectives?
A. Simplifying the system administration process by consolidating all user roles into a single administrator group.
B. Maximizing the available computing resources by disabling all system logging and monitoring services.
C. Reducing the attack surface by disabling unnecessary services, closing unused ports, and removing default accounts.
D. Ensuring that all application code is scanned for vulnerabilities prior to every deployment or update cycle.
Which compliance framework focuses on the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS)?
The Payment Card Industry Data Security Standard (PCI DSS).
The International Organization for Standardization (ISO 27001).
The Health Insurance Portability and Accountability Act (HIPAA).
The National Institute of Standards and Technology (NIST) 800-53.
Under GDPR, the legal basis that requires obtaining a person's specific, informed, and unambiguous agreement for the processing of their personal data is known as:
Legitimate Interest
Necessity for Contract
Explicit Consent
Legal Obligation Compliance
The OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) risk assessment methodology is classified as:
A. A purely quantitative method that expresses risk only in terms of financial loss expectancy.
B. A qualitative method that uses a collaborative, team-based approach to identify and prioritize critical organizational assets.
C. A legal framework used to calculate fines levied by regulatory bodies after confirmed data exposure incidents.
D. A mandated set of technical security controls that must be implemented for all federal government cloud deployments.
Which of the following best describes the role of NIST 800-53 within an organization's GRC program?
A key difference between a Vulnerability Scan (using tools like Nessus) and a Penetration Test is that the scan generally cannot perform which action?
Generate an automated report listing all identified open network ports.
Confirm if a discovered vulnerability can be successfully exploited to gain access or privileges.
Catalog all running operating system services and installed application versions.
Provide a severity score (e.g., CVSS) for each identified security flaw.
An audit performed by an independent, third-party consulting firm to provide an unbiased assessment of the organization's security posture is known as a(n):
Internal Audit
Compliance Audit
External Audit
Forensic Audit
The Penetration Testing Execution Standard (PTES) and OSSTMM are examples of established frameworks that define:
The specific legal liability associated with carrying out unauthorized network access attempts.
The comprehensive methodology, phases, and scope requirements for executing formal security testing.
The required financial budget and team headcount needed to sustain an annual vulnerability management program.
The automatic remediation steps and workflow integration needed for various vulnerability types.
The most crucial section of a Penetration Test Report for executive leadership and management is typically the:
Comprehensive raw output log of every tool and command executed by the testing team.
Detailed technical description of all injection payloads used against web application endpoints.
What is the primary objective of a Business Impact Analysis (BIA)?
To determine the most cost-effective solution for providing remote access to all employees during an IT disaster.
To identify the organization's most critical business functions and determine their required Recovery Time Objectives (RTO) and RPOs.
To create a detailed, technical network diagram outlining all disaster recovery site connectivity and failover procedures.
To analyze the current employee skills gap and recommend training programs necessary for effective disaster response.
In Business Continuity Planning, the Recovery Time Objective (RTO) specifies which critical metric?
The acceptable latency for data replication between the primary and disaster recovery sites.
The maximum tolerable period in which data might be lost due to an incident (measured in time).
The maximum tolerable duration of time a critical business function can be inoperative following a disruption.
The minimum number of employees required to staff the alternate processing facility during a declared disaster.
Which BCDR site option is the most expensive, as it involves a fully equipped, operational facility with mirrored hardware and data, allowing for recovery within minutes or hours?
Cold Site
Warm Site
Hot Site
Cloud Site
In the widely accepted 3-2-1 backup strategy, the number '1' specifically dictates that:
Only one copy of the backup data should be accessible over the public internet to prevent internal data theft.
The backup process must be completed using only one secure, encrypted storage device.
There must be at least one copy of the data stored at an off-site or geographically separate location.
Under the Shared Responsibility Model for an Infrastructure as a Service (IaaS) offering, the customer retains responsibility for:
Securing the physical hardware and managing the underlying data center facilities.
Maintaining and patching the security of the host operating system and any installed applications.
Securing the core virtualization layer, including the management of the hypervisor software.
Implementing the power, cooling, and environmental controls within the cloud provider's physical location.
Which scenario represents the most significant and frequent security risk associated with public cloud storage services (like S3 buckets or Azure Blob Storage)?
The cloud provider's physical data center being physically breached by an unauthorized third party.
Overly permissive Identity and Access Management (IAM) policies that expose sensitive data to the public internet.
A denial-of-service attack targeting the core cloud hypervisor platform used by the provider.
The complete loss of all data due to a failure in the cloud provider's proprietary data replication mechanism.
For securing containers and virtual machines, security experts strongly recommend using minimal, "hardened" base images primarily because this practice:
Enables developers to write code that is much faster and more efficient in a production environment.
Reduces the overall attack surface by limiting the number of unnecessary libraries, services, and configuration files.
Automatically migrates the data to a more secure region whenever suspicious network activity is detected by a monitor.
Allows the virtual machine to run without needing to establish a secure, encrypted connection to the main hypervisor.
The primary function of Continuous Security Posture Management (CSPM) tools (like AWS Config or Azure Security Center) is to address which challenge?
The primary security threat posed by the development of sufficiently powerful quantum computers is the potential to:
Rapidly brute-force and break all forms of modern symmetric encryption algorithms, such as AES-256.
Compromise most widely used asymmetric cryptography (e.g., RSA and ECC) due to their efficient factoring capabilities.
Automatically generate massive amounts of completely undetectable polymorphic malware through parallel processing.
Introduce an entirely new set of hardware vulnerabilities within the system memory of all existing server infrastructure.
The primary objective of using Cyber Threat Intelligence (CTI) in a proactive security program is to:
Reduce the overall cost of IT equipment by automating system vulnerability patching.
Gain knowledge about threat actors' motivations, targets, and Tactics, Techniques, and Procedures (TTPs).
Automatically generate new cryptographic key pairs to defend against quantum computing threats.
Provide real-time management and control over all installed Internet of Things (IoT) devices.
The primary functional role of AI and machine learning in cybersecurity today is to:
Predict the next major zero-day exploit before it is published by underground threat groups.
Automatically patch all system and application vulnerabilities without requiring any human oversight or intervention.
Analyze vast amounts of network and user data to identify and flag anomalies and behavioral deviations from the established baseline.
Manage the physical security of data centers and the biometric access controls used for server rooms.
A core security risk common to many IoT (Internet of Things) devices is the tendency to use hard-coded or weak default authentication credentials coupled with:
Overly robust encryption standards that are incompatible with legacy network infrastructure.
Infrequent or non-existent firmware updates, making them uncatchable against discovered vulnerabilities.
A financial firm decides to use Micro segmentation within its data center. If an attacker successfully compromises a server that processes public website traffic, which action should the micro segmentation policy specifically prevent, assuming all rules are correctly configured?
The attacker gaining root access to the compromised public web server.
The attacker moving laterally from the public web server to the internal payroll database server.
The web server sending logs to the central Security Information and Event Management (SIEM) system.
The compromised web server receiving legitimate inbound HTTP traffic from external users.
A Zero Trust Architecture (ZTA) is being deployed. When a user who is already authenticated logs into their system, they attempt to access a new sensitive internal document share. What action is most consistent with the principle of ZTA at this specific moment?
The user is automatically granted access, as their initial login established trust for the entire internal session.
The user's device health and current network location are re-checked, and explicit authorization is required for access to the new resource.
The request is immediately denied, as ZTA assumes all internal resource sharing is forbidden by default.
The system asks the user to physically connect to the network using a corporate VPN before access can be considered.
A developer needs to configure an application to connect to a backend database. According to the principle of Least Privilege, how should the developer configure the service account used by the application?
Grant the account full administrative access (DBA role) to simplify future troubleshooting.
Grant the account only the permissions necessary for the application to read and write data in the specific tables it needs.
Grant the account read-only access to all tables to prevent any unauthorized data modification.
Require the account to use a daily-rotating password, but still grant it administrative access to all databases.
An organization requires users accessing highly sensitive files to use a physical smart card in addition to their password. Which authentication method is being enforced, and what security principle does it primarily satisfy?
Single Sign-On (SSO); Convenience
Multi-Factor Authentication (MFA); Defense in Depth
Kerberos; Centralized Authorization
Time-based One-Time Password (TOTP); Non-repudiation
A compliance team mandates that access to HR records should be based strictly on a user's job title (e.g., 'Only users with the title HR Manager can view employee salaries'). Which access control model should be implemented to enforce this specific rule efficiently?
Discretionary Access Control (DAC)
Mandatory Access Control (MAC)
Role-Based Access Control (RBAC)
Attribute-Based Access Control (ABAC)
A small startup decides to use its Google Workspace credentials to automatically log into three other SaaS applications (CRM, HR, and project management tools). What technology or service makes this seamless process possible?
Hardware Security Module (HSM)
Directory Services (LDAP/AD)
Security Assertion Markup Language (SAML)
Public Key Infrastructure (PKI)
A security analyst is hardening the perimeter firewall. The policy needs to allow users to establish an encrypted tunnel to the corporate VPN. Which firewall rule is the minimum required to allow only the standard IPsec Virtual Private Network traffic?
Allow TCP port 443 (HTTPS) outbound.
Allow UDP port 500 (IKE) and UDP port 4500 (NAT Traversal) outbound.
Allow all inbound traffic for known VPN clients.
Allow TCP port 22 (SSH) outbound and inbound.
During a security audit, an administrator notices that a known malicious packet signature (Signature X) is repeatedly appearing in the network logs, but the attack is never successful in compromising a host. The security team has deployed a network security solution that detects the traffic but does not block it. What type of system is most likely deployed?
A. A Next-Generation Firewall (NGFW) operating in bridge mode.
B. An Intrusion Detection System (IDS) operating in passive/promiscuous mode.
A hospital needs to ensure that patient monitoring devices cannot communicate with the public Wi-Fi network, even though all devices share the same physical switches. Which fundamental network control should the administrator implement to achieve this logical separation and isolation?
Network Address Translation (NAT)
Virtual Local Area Networks (VLANs)
Stateful Packet Inspection (SPI) Firewall
Network Access Control (NAC)
A web application's login form fails to properly filter user input before querying the database. An attacker enters ``OR '1'='1'`` into the password field. If this attack is successful, what type of vulnerability has been exploited?
Cross-Site Scripting (XSS)
Buffer Overflow
SQL Injection (SQLi)
Denial of Service (DoS)
A DevOps team is adopting a 'shift left' security model in their SDLC. At which stage of the development process would they introduce Static Application Security Testing (SAST)?
In the Deployment stage, to scan the compiled code running in production.
In the Design/Requirements phase, before any code is written.
In the Coding/Building phase, integrated into the developer’s Integrated Development Environment (IDE) or build pipeline.
In the Testing phase, running against the application while it is active (Dynamic Analysis).
When developing an application that handles sensitive customer passwords, a developer must choose between storing the passwords as plaintext, encrypting them with a reversible cipher (like AES), or using a cryptographic hash function (like SHA-256 with a salt). Which option aligns best with secure coding best practices and why?
Plaintext, because it's the fastest method for retrieval.
AES encryption, because the original password can be recovered if needed.
SHA-256 hashing with salt, because the hash is non-reversible and the salt prevents rainbow table attacks.
SHA-256 hashing without salt, because the hash is unique and fast.
The security team is performing a risk assessment on a data center failure. They determine the likelihood is 'Medium' and the impact is 'High.' This result is an example of which type of risk assessment approach?
Quantitative Risk Assessment
Asset Valuation Assessment
Qualitative Risk Assessment
Vulnerability Assessment
Following a disaster that destroyed the main office, a company needs to continue essential payroll processing within 24 hours to avoid legal penalties. What is the critical metric that defines this 24-hour target?
Annualized Loss Expectancy (ALE)
Recovery Time Objective (RTO)
Recovery Point Objective (RPO)
Mean Time To Recover (MTTR)
A critical system requires an RTO of less than 30 minutes, meaning downtime must be minimal. Which disaster recovery site strategy would be the most appropriate choice to meet this stringent requirement?
Cold Site
Warm Site
Hot Site/Active-Active Clustering
Mutual Assistance Agreement
A development team wants to deploy a new web application using managed databases and load balancing, but they want to maintain full control over the operating system and installed software. Which Cloud Service Model best fits this requirement, and who is responsible for the OS patching?
SaaS; Vendor is responsible for OS patching.
PaaS; Vendor is responsible for OS patching.
IaaS; Customer is responsible for OS patching.
Serverless; Customer is responsible for OS patching.
In a virtualized environment, an attacker attempts a VM escape to gain unauthorized access to the underlying hardware and control the hypervisor. This specific type of attack targets which crucial component of the virtualization stack?
The Guest Operating System's kernel.
The Host's Network Interface Card (NIC).
The Hypervisor (Virtual Machine Manager).
The VM's virtual hard disk (VHD) file.
Under the cloud Shared Responsibility Model for a SaaS application (like Office 365), who is ultimately responsible for ensuring that the users' login credentials are not stolen through a phishing attack?
The Cloud Provider (Vendor), because they control the underlying network infrastructure.
Both the Provider and the Customer share this responsibility equally.
The Customer, because they are responsible for their users' data, endpoints, and identity management policies.
The Customer's firewall administrator, as they control the perimeter.
A company decides to implement both Defense in Depth (DiD) and Zero Trust Architecture (ZTA). Which statement best captures the fundamental philosophical difference between these two strategies?
DiD assumes external attacks are the only risk, while ZTA assumes all attacks originate from inside the network perimeter.
DiD focuses on securing the network perimeter with multiple firewalls, while ZTA focuses only on user authentication.
DiD relies on layered security controls that assume a breach is possible, while ZTA relies on the philosophy of never granting implicit trust based on location.
DiD is a physical security strategy, whereas ZTA is a purely logical and software-based control framework.
A system architect is designing a new cloud environment containing highly sensitive Personal Health Information (PHI). If the primary concern is preventing a compromised web server from accessing the internal PHI database, which architectural pattern provides the most granular and effective isolation?
Placing the web server and the database server on separate Virtual Local Area Networks (VLANs).
Implementing strong Least Privilege controls on the database user account used by the web server.
Implementing Microsegmentation to enforce strict network policy rules that prevent the web server from initiating communication with the database on any port other than the required database port.
Deploying a traditional perimeter firewall to block all external traffic destined for the PHI database.
During the initial design phase of a new application, why is it critical to enforce the Principle of Least Privilege (PoLP) before configuring security tools and system hardening scripts?
PoLP is easier to implement using automated scripts, which must run first.
Defining minimal necessary permissions (PoLP) provides the baseline for the application's required functionality and informs all subsequent configuration and security controls.
Hardening scripts automatically enforce PoLP, so the design team doesn't need to consider it separately.
PoLP is only required for administrative accounts and is irrelevant to service accounts.
A company that handles patient data achieves ISO 27001 certification (a management system standard) but subsequently receives a large fine for failing to properly log access to patient records, as required by HIPAA (a specific law). What does this scenario illustrate regarding the relationship between the two frameworks?
ISO 27001 certification automatically guarantees full compliance with all vertical industry laws like HIPAA.
ISO 27001 is too focused on technical controls and ignores governance requirements like HIPAA.
ISO 27001 provides the framework for managing security, but compliance with specific regulatory laws (like HIPAA) must be addressed separately and explicitly within that framework.
ISO 27001 and HIPAA are fundamentally incompatible frameworks, forcing organizations to choose one or the other.
When evaluating whether to purchase cyber insurance or invest in a new security control, a Chief Financial Officer (CFO) requires the risk exposure to be calculated in explicit financial terms (e.g., Annual Loss Expectancy). Which risk assessment methodology is best suited for providing this specific type of quantitative result?
OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation)
NIST 800-53 (Security and Privacy Controls)
FAIR (Factor Analysis of Information Risk)
PTES (Penetration Testing Execution Standard)
The Chief Executive Officer (CEO) issues a new, high-level Security Policy stating, "All corporate data must be protected from unauthorized external access." What is the immediate and necessary subsequent GRC step required to make this policy operational and auditable?
Conducting a final, external compliance audit against the new policy statement.
Creating detailed Security Standards and Procedures (e.g., "All data at rest must be encrypted with AES-256") that mandate specific controls supporting the policy goal.
Immediately purchasing a new next-generation firewall to enforce the policy.
Determining the Maximum Tolerable Downtime (MTD) for the policy implementation project.
A system administrator runs an automated vulnerability scan (Nessus) and receives a report identifying 50 high-severity vulnerabilities. A week later, a penetration test is performed, and the final report indicates only 5 vulnerabilities were successfully exploited. Why is the penetration test report considered more valuable for immediate remediation priority?
The vulnerability scan includes too many false positives and is therefore unreliable.
The penetration test provides definitive proof of exploitability and demonstrates the true business impact of the flaws.
The penetration test provides a list of common coding errors which the scanner cannot detect.
Penetration tests are always performed by external, third-party companies, ensuring greater objectivity.
A CISO must choose between two activities to assess security on a limited budget: 1) a comprehensive vulnerability scan or 2) a Grey Box penetration test. The CISO’s goal is to simulate a realistic attack by an internal disgruntled employee and measure the actual time the attacker could spend within the network (dwell time). Which option should be chosen?
The comprehensive vulnerability scan, because it is cheaper and covers more systems automatically.
The Grey Box penetration test, because it simulates the human intelligence required to exploit flaws and measures the lateral movement and dwell time.
Neither, because only an external Black Box test can provide realistic results.
Both, because vulnerability scanning and penetration testing are functionally the same thing.
In the lifecycle of a security engagement, what is the primary overlap between a Compliance Audit and the Pre-engagement phase of the PTES (Penetration Testing Execution Standard)?
Both activities culminate in a final report detailing all exploited vulnerabilities.
Both are focused on running the same automated vulnerability scanning tools (e.g., OpenVAS).
Both require defining and agreeing upon the scope and specific constraints of the target systems based on legal or regulatory requirements.
Both activities are solely conducted by external consultants to maintain impartiality.
After a major natural disaster, which plan should take immediate priority for restoring the core ERP system to process payroll, given limited resources, and why?
The Business Continuity Plan (BCP), because it prioritizes critical business functions like payroll.
The Disaster Recovery Plan (DRP), because it details technical server restoration.
The Incident Response Plan, because it manages security breaches.
The Change Management Plan, because it handles system updates.
During a Business Impact Analysis (BIA), a security analyst determines that a key sales system has a Recovery Point Objective (RPO) of 1 hour and a Recovery Time Objective (RTO) of 4 hours. Which backup strategy is strictly required to meet the RPO?
A. Daily full backups at midnight, stored off-site.
B. Weekly incremental backups stored locally.
C. Continuous data replication or near-real-time backups that capture changes every 60 minutes or less.
D. A simple RAID 5 configuration on the production server.
A company needs to analyze the potential financial loss of its e-commerce website going down during the peak holiday season. They calculate the Single Loss Expectancy (SLE) and the Annualized Rate of Occurrence (ARO). Combining these values yields the Annualized Loss Expectancy (ALE). Under which phase of the Business Continuity and Disaster Recovery (BCDR) lifecycle are these financial calculations performed?
Disaster Recovery Strategy Development
Continuity Plan Testing and Exercising
Business Impact Analysis (BIA)
Risk Acceptance and Compliance Auditing
A security team is comparing Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) models. If the team's primary security goal is to maintain maximum control over the operating system hardening, patching schedule, and installed antivirus software, which model should they choose, and why?
PaaS, because the vendor handles the OS, simplifying security management.
PaaS, because the customer retains control of the OS and data.
IaaS, because the customer owns and is fully responsible for managing, patching, and hardening the entire guest OS.
IaaS, because the cloud vendor manages the entire stack, including the application code.
According to the Shared Responsibility Model, who is primarily responsible for a data breach involving a publicly accessible, unencrypted cloud storage bucket containing millions of customer records, and what did they fail to secure?
The customer is responsible for failing to secure the data in the storage bucket.
The cloud vendor is responsible for failing to secure the hypervisor.
The cloud vendor is responsible for failing to maintain infrastructure uptime.
The customer is responsible for failing to secure the hypervisor.
Why are Cloud Security Posture Management (CSPM) tools (like AWS Config or Azure Security Center) considered essential for modern cloud security, even if a company has robust perimeter firewalls?
CSPM tools replace traditional perimeter firewalls entirely.
The most common cloud breaches result from misconfigurations of internal services (like public S3 buckets or overly permissive IAM roles), which CSPM tools continuously monitor and flag.
CSPM tools are required by law for all IaaS deployments globally.
CSPM tools automatically generate and sign digital certificates for all cloud resources.
A Chief Information Security Officer (CISO) is budgeting for long-term cryptographic resilience, anticipating the threat of powerful quantum computers breaking current asymmetric encryption standards in 10-15 years. What is the most strategic and proactive security investment they should prioritize today?
Massively increasing the key size for current RSA and ECC algorithms.
Immediate research, development, and migration planning toward Post-Quantum Cryptography (PQC) algorithms.
Eliminating all forms of symmetric encryption (like AES-256), as it will be immediately compromised by quantum computers.
Investing solely in behavioral biometrics to replace all cryptographic methods.
How does Cyber Threat Intelligence (CTI) provide a critical feedback loop that strengthens and enhances the enforcement policies of a Zero Trust Architecture (ZTA)?
CTI replaces the need for user authentication, relying only on IP reputation.
CTI provides real-time, actionable context (e.g., known malicious IP addresses, command-and-control domains, or file hashes) that the ZTA policy engine can use to immediately deny access requests.
CTI is only useful after a major incident has occurred and has no preventative role in ZTA.
CTI automatically patches and hardens user endpoints before they attempt to connect.
The biggest widespread security risk posed by consumer-grade IoT devices is the combination of weak, hard-coded default credentials and infrequent/non-existent patching. From an enterprise network perspective, which solution provides the best defense-in-depth strategy for mitigating these risks once an IoT device is compromised?
Completely banning all IoT devices from the network, regardless of business need.
Enforcing mandatory bi-weekly password changes for all device administrative accounts.
Using Network Access Control (NAC) and Microsegmentation to automatically isolate and quarantine all IoT devices into a non-routable network segment, preventing lateral movement.
Implementing a strong perimeter firewall at the Internet gateway.
