Which control is intended to discourage violations rather than detect them?

Which iptables table is responsible for Network Address Translation?

Which term describes an attack that goes undetected by an IDS?

Which document lists risks, controls, and treatment decisions?

Which port is used by Secure Shell (SSH)?

Which phase of audit formally communicates findings to management?

Which IDS type runs directly on the monitored host?

NAT is MOST effective in reducing exposure of:

Which command-line utility captures live network packets?

A firewall validates packets using session information stored dynamically. This firewall is:

Audit logs exist but are never reviewed. Which control weakness exists?

Which iptables chain handles packets generated by the local system?

Cyber insurance taken to cover ransomware loss is an example of:

An IDS generates alerts whenever legitimate traffic spikes during business hours. The issue is most likely:

Which IDS detection technique relies on deviation from normal behavior?

A DMZ is BEST described as:

Which audit evidence carries the HIGHEST reliability?

Which Snort component formats alerts and logs?

Firewall rules that allow only required services reflect which principle?

An IPS differs from IDS mainly because IPS:

Which audit phase focuses on testing controls?

Which firewall generation introduced application-layer inspection?

Multiple IDS alerts for normal activity indicate poor:

Which iptables target drops packets silently?

Selecting 60 systems from 3000 during audit introduces:

Which control provides traceability of user actions?

Which IDS placement cannot block traffic?

Traffic flooding using compromised machines worldwide is known as:

IDS effectiveness in anomaly detection depends MOST on:

Developers have write access to production systems. What is the PRIMARY audit concern?

An IDS misses a genuine attack because traffic is encrypted. This is a:

Firewall rules placed incorrectly cause later rules to never execute. This issue is called:

Auditor recommends separating dev, test, and production environments. This protects:

Organization knowingly accepts flood risk due to business location. This is:

Which control ensures recovery after ransomware attack?

Anomaly-based IDS generates excessive alerts. What should be corrected FIRST?

Which iptables chain processes packets routed through the system?

Which audit risk exists regardless of control effectiveness?

Auditor verifies antivirus on a subset of endpoints due to time constraints. Method used is: