Font size
WorksheetsDECEMBER CMA CISCO CYBERSECURITY ESSENTIALS EXAM
Total questions: 60
Worksheet time: 30mins
Which type of malware is designed to replicate itself and spread to other computers without requiring a host program or human interaction?
Virus
Worm
Trojan horse
Spyware
What is the primary difference between a vulnerability and an exploit?
A vulnerability is a weakness in a system, while an exploit is code or technique that takes advantage of that weakness
A vulnerability is software-based, while an exploit is hardware-based
A vulnerability affects networks, while an exploit affects individual computers
A vulnerability is intentional, while an exploit is accidental
An organization discovers that an attacker has been monitoring their network traffic to capture sensitive information such as login credentials and financial data. What type of attack is being described?
Sniffing attack
DoS attack
Phishing attack
Buffer overflow attack
Which type of social engineering attack involves an attacker observing someone entering confidential information such as a password or PIN code?
Tailgating
Shoulder surfing
Pretexting
Baiting
Which security principle ensures that only authorized individuals can access specific resources or information?
Accountability
Confidentiality
Integrity
Availability
An organization implements multiple layers of security controls including firewalls, intrusion detection systems, antivirus software, and access controls. What security strategy is being employed?
Perimeter security
Defense in depth
Least privilege
Security through obscurity
Which type of threat actor is typically motivated by personal beliefs, ideologies, or causes and uses cyberattacks to promote their agenda?
Script kiddies
Hacktivists
Insider threats
Cybercriminals
A company evaluates a security risk and determines that the cost of implementing controls exceeds the potential loss from the threat. Management decides to acknowledge the risk and take no action. Which risk management strategy is this?
Risk avoidance
Risk transfer
Risk reduction
Risk acceptance
What information does the protocol field in an IPv4 header identify?
The destination port number
The upper-layer protocol such as TCP or UDP
The type of service requested
The total length of the packet
Which protocol is commonly exploited in amplification and reflection DDoS attacks because it operates without requiring a connection establishment?
TCP
ICMP
UDP
ARP
What is the purpose of the sequence number field in a TCP segment header?
To identify the source port
To ensure data is reassembled in the correct order
To specify the window size
To indicate the type of TCP connection
An attacker sends a gratuitous ARP message on the local network associating their MAC address with the IP address of the default gateway. What type of attack is the threat actor launching?
DNS poisoning
ARP spoofing
DHCP starvation
MAC flooding
What is the purpose of implementing DHCP snooping on a network switch?
To encrypt all DHCP traffic
To prevent rogue DHCP servers from providing IP configuration to clients
To increase the speed of DHCP assignments
To allow multiple DHCP servers on the same subnet
Which type of malware is designed to hide its existence and provide privileged access to a computer while masking its presence from security tools?
Worm
Virus
Rootkit
Adware
What is the primary goal of a SQL injection attack?
To overwhelm a database server with requests
To manipulate database queries to gain unauthorized access to data
To encrypt database files and demand ransom
To replicate the attack across multiple database servers
An attacker floods a switch's MAC address table with thousands of fake MAC addresses, causing the switch to behave like a hub and broadcast traffic to all ports. What type of attack is this?
MAC address spoofing
CAM table overflow
VLAN hopping
STP manipulation
An attacker sets up a fake wireless access point with the same SSID as a legitimate corporate network to intercept user credentials and data. What type of attack is this?
Evil twin attack
Jamming attack
Wardriving
Bluejacking
What is the purpose of disabling SSID broadcasting on a wireless access point?
To encrypt all wireless traffic
To make the network slightly less visible to casual users
To prevent all unauthorized access
To increase wireless signal strength
Which wireless security protocol introduced the use of TKIP (Temporal Key Integrity Protocol) to improve security over WEP?
WPA
WPA2
WPA3
WEP2
What is the primary function of a site survey when deploying a wireless network?
To identify the number of users who will connect
To determine optimal access point placement and identify sources of interference
To configure encryption settings on all devices
To establish MAC address filtering rules
What is the main difference between the implementation of IDS and IPS devices?
An IDS needs to be deployed with a firewall device, whereas an IPS can replace a firewall.
An IDS can negatively impact the packet flow, whereas IPS cannot.
An IDS uses signature-based technology to detect malicious packets, whereas an IPS uses profile-based technology.
An IDS would allow malicious traffic to pass before it is addressed, whereas an IPS stops it immediately.
What protocol provides authentication, integrity, and confidentiality services and is a type of VPN?
IPsec
ESP
MD5
AES
Which firewall feature is used to ensure that packets coming into a network are legitimate responses to requests initiated from internal hosts?
Stateful packet inspection
Packet filtering
URL filtering
Application filtering
What networking monitoring technology enables a switch to copy and forward traffic sent and received on multiple interfaces out another interface towards a network analysis device?
Network tap
Port Mirroring
SNMP
NetFlow
When a user makes changes to the settings of a Windows system, where are these changes stored?
Control Panel
Boot.ini
Win.ini
Registry
What technology was created to replace the BIOS program on modern personal computer motherboards?
RAM
UEFI
MBR
CMOS
Which command is used to manually query a DNS server to resolve a specific host name?
nslookup
ping
ipconfig
tracert
How much RAM is addressable by a 32-bit version of Windows?
8 GB
4 GB
32 GB
16 GB
A system administrator issues the command ps on a server that is running the Linux operating system. What is the purpose of this command?
To change file permissions
To display the contents of the current directory
To process a new task
To list the processes currently running in the system
What type of tool is used by a Linux administrator to attack a computer or network to find vulnerabilities?
Intrusion detection system
Firewall
Malware analysis
PenTesting
What is a benefit of Linux being an open source operating system?
Linux distributions must include free support without cost.
Linux distributions are simpler operating systems since they are not designed to be connected to a network.
Linux distributions are maintained by a single organization.
Linux distribution source code can be modified and then recompiled.
Which method can be used to harden a device?
Force periodic password changes.
Allow users to re-use old passwords.
Allow default services to remain enabled.
Allow USB auto-detection.
Which technology might increase the security challenge to the implementation of IoT in an enterprise environment?
Cloud computing
Network bandwidth
CPU processing speed
Data storage
What is a host-based intrusion detection system (HIDS)?
It identifies potential attacks and sends alerts but does not stop the traffic.
It combines the functionalities of antimalware applications with firewall protection.
It detects and stops potential direct attacks but does not scan for malware.
It is an agentless system that scans files on a host for potential malware.
Which statement describes the term attack surface?
It is the total sum of vulnerabilities in a system that is accessible to an attacker.
It is the network interface where attacks originate.
It is the total number of attacks towards an organization within a day.
It is the group of hosts that experiences the same attack.
What type of lock is recommended to secure an office door?
Cable lock
Keyed entry lock
Cipher lock
Security cage
What type of cybersecurity laws protect you from an organization that might want to share your sensitive data?
Privacy laws
Intellectual property laws
Cybercrime laws
E-discovery laws
An organization allows employees to work from home two days a week. Which technology should be implemented to ensure data confidentiality as data is transmitted?
SHS
VPN
VLAN
RAID
Which of the following are foundational principles of the cybersecurity domain? (choose three)
Integrity
Availability
Confidentiality
Encryption
Policy
Which two methods help to ensure data integrity? (choose two)
Data consistency checks
Hashing
Repudiation
Authorization
Privacy
Which device is usually the first line of defense in a layered defense-in-depth approach?
Access layer switch
Edge router
Internal router
Firewall
What is the benefit of a defense-in-depth approach?
Only a single layer of security at the network core is required.
All network vulnerabilities are mitigated.
The need for firewalls is eliminated.
The effectiveness of other security measures is not impacted when a security mechanism fails.
What component of a security policy explicitly defines the type of traffic allowed on a network and what users are allowed and not allowed to do?
Identification and authentication policies
Password policies
Acceptable use policies
Remote access policies
An administrator discovers that a user is accessing a newly established website that may be detrimental to company security. What action should the administrator take first in terms of the security policy?
Revise the AUP immediately and get all users to sign the updated AUP.
Create a firewall rule blocking the respective website.
Immediately suspend the network privileges of the user.
Ask the user to stop immediately and inform the user that this constitutes grounds for dismissal.
Which service will resolve a specific web address into an IP address of the destination web server?
DHCP
NTP
ICMP
DNS
Mutual authentication can prevent which type of attack?
Man-in-the-middle
Wireless sniffing
Wireless IP spoofing
Wireless poisoning
Which utility uses the Internet Control Messaging Protocol?
RIP
DNS
Ping
NTP
What is the purpose of a DMZ?
It analyzes traffic for intrusion attempts and sends reports to management stations.
It creates an encrypted and authenticated tunnel for remote hosts to access the internal network.
It provides secure connectivity for clients that connect to the internal network through the wireless LAN.
It allows external hosts to access specific company servers while maintaining the security restrictions for the internal network.
Which component is a pillar of the zero trust security approach that focuses on the secure access of devices, such as servers, printers, and other endpoints, including devices attached to IoT?
Workforce
Workflows
Workloads
Workplace
What Windows utility should be used to configure password rules and account lockout policies on a system that is not part of a domain?
Event Viewer security log
Local Security Policy tool
Active Directory Security tool
Computer Management
What is the purpose of the network security accounting function?
To require users to prove who they are
To determine which resource a user can access
To keep track of the actions of a user
To provide challenge and response questions
Which AAA component can be established using token cards?
Accounting
Authorization
Auditing
Authentication
In applying an ACL to a router interface, which traffic is designated as outbound?
Traffic that is leaving the router and going towards the destination host
Traffic for which the router can find no routing table entry
Traffic that is going from the destination IP address into the router
Traffic that is coming from the source IP address into the router
What wild card mask will match network 172.16.0.0 through 172.19.0.0?
0.0.3.225
0.252.255.255
0.0.255.255
0.3.255.255
What is the quickest way to remove a single ACE from a named ACL?
Create a new ACL with a different number and apply the new ACL to the router interface
Use the no keyword and the sequence number of the ACE to be removed
Use the no access-list command to remove the entire ACL, then recreate it without the ACE.
Copy the ACL into a text editor, remove the ACE, then copy the ACL back into the router.
Which scenario would cause an ACL misconfiguration and deny all traffic?
Apply a named ACL to a VTY line.
Apply an ACL that has all deny ACE statements.
Apply a standard ACL in the inbound direction.
Apply a standard ACL using the ip access-group out command.
What is one benefit of using a next-generation firewall rather than a stateful firewall?
Support of logging
Reactive protection against internet threats
Support of TCP-based packet filtering
Integrated use of an intrusion prevention system (IPS)
What are two characteristics of an application gateway firewall (Choose two.)
Uses a simple policy table look-up to filter traffic based on Layer 3 and Layer 4 information.
Analyzes traffic at Layers 3, 4, 5, and 7 of the OSI model.
Provides an integrated intrusion prevention and detection feature.
Uses connection information maintained in a state table and analyzes traffic at OSI Layers 3, 4, and 5.
Performs most filtering and firewall control in software.
Which type of traffic is usually blocked when implementing a demilitarized zone?
Traffic that is returning from the DMZ network and traveling to the private network
Traffic originating from the private network and traveling to the DMZ network
Traffic originating from the DMZ network and traveling to the private network
Traffic that is returning from the public network and traveling to the DMZ network
When implementing a ZPF, which statement describes a zone?
A zone is a group of hardened computers known as bastion hosts.
A zone is a group of administrative devices that protect against rogue access point installations.
A zone is a group of one or more devices that provide backup and disaster recovery mechanisms.
A zone is a group of one or more interfaces that have similar functions or features.
