Intro to Cyber Mock Exam 02

Which network device is used to direct traffic to individual endpoints in a LAN using MAC addresses?
1. Switch
2. Bridge
3. Router
4. Hub
Which of the following factors independently contributes the most to creating a positive security culture?
1. Departmental managers monitoring staff actions
2. Regular training and awareness sessions
3. A robust disciplinary policy
4. Lack of procedures for whistleblowing
Which of the following presents a risk relating to analysing future trends?
1. Doesn’t provide enough benefits given the time involved in undertaking the task
2. Adds additional work to the cyber team who are already too busy
3. Can lead to a false sense of security if the trends are misinterpreted
4. Decreased staff motivation due to changing policies
Security requirements for a new product or system are GENERALLY driven by which of the following?
1. Security functions.
2. Security objectives.
3. Security guidelines
4. Security solutions.
What is the best definition of an information asset?
1. An organisation's central database server
2. All hardware and software owned by an organisation
3. A technical subject matter expert
4. Any data or device that supports business processes or operations
Which of the following does NOT provide a detective control?
1. Inventory checks
2. Patching
3. IDS
4. SIEM
Which of the following standards would be most suitable to refer to when attempting to improve information security in a business?
1. ISATAP
2. PCI-DSS
3. ISO 27001
4. ISO 22301
Which source of threat is the most common problem for SME businesses?
1. Nation state
2. Script kiddies
3. Criminal groups
4. Insiders
Which model allows relative prioritisation of security objectives?
1. ISO 22301
2. IASME Governance
3. SMART
4. MoSCoW
Which of the following is true regarding environmental hazards such as fire and flood?
1. These are considered less important that external attacks
2. They are only the result of negligence
3. These hazards can result in the same impact as an attack
4. They cause less damage than an external attack
What is the primary security concern relating to increased usage of IoT devices?
1. Increased monitoring requirements
2. Compatibility across multiple vendors
3. Increased attack surface
4. Compatibility with existing security provisions
In Cyber Security, what is the relationship between risk, threat and vulnerability?
1. Threat is the potential for loss, damage or destruction of an asset as a result of
  a vulnerability exploiting a risk
2. Vulnerability is the destruction or damage to an asset after a risk calculation has been taken to mitigate against such a threat
3. Risk is the potential for loss, damage or destruction of an asset as a result of a threat exploiting a vulnerability
4. Risk is the potential for loss, damage or destruction of an asset as a result of
  a vulnerability exploiting a threat
Which category of defence does CCTV fall under?
1. Physical directive
2. Physical deterrent
3. Physical administrative
4. Physical preventative
Which of the following would NOT be considered a breach of criminal law?
1. Selling customer details to a competitor
2. Failing to meet designated SLA’s when supporting external customers
3. Accessing a company database which you are not authorised to access
4. Failing to provide appropriate security for staff data
What is meant by “defending assets and related systems is asymmetric”?
1. b. Every risk needs treating but attackers only need to exploit one
2. a. Organisations spend less money on providing security than attackers spend on breaching it
3. It requires more technical knowledge to defend systems than to attack them
4. There are more people trying to breach security systems than there are trying to protect them
What is the main concern resulting from poor software maintenance practices?
1. User experience declines
2. Subsequent poor performance of the product
3. Resultant exposure to vulnerabilities
4. Increased maintenance costs
What is the main security concern regarding storage of personal data in multiple locations across the globe?
1. The staff in the locations may not fully understand the data being stored as it is in a different language
2. There may be legal ramifications and issues resulting from data protection legislation in the country of origin
3. Data held in other countries may be at greater risk of breach
4. It may be difficult to maintain access to data distributed across the world
What is the best description of a XSS attack?
1. A type of website exploit carried out by issuing unauthorized commands from a trusted website user, exploiting the websites trust for the user’s browser
2. A threat actor exploits weak web-based protocols to insert themselves between entities in a communication channel to steal data
3. An attempt to issue commands to a database via a website interface
4. A threat actor inserts data, such as a malicious script, into content from trusted websites which is then included with dynamic content delivered to a victim's browser
Which term refers to providing proof of origin, authenticity, and integrity of data?
1. Non-repudiation
2. Integrity
3. Confidentiality
4. Authentication
How is risk calculated?
1. Probability x importance
2. Impact x damage done
3. Likelihood x impact
4. Risk factor x enumeration
Which of the following is the best description of extrinsic assurance?
1. Independent verification using external evaluation
2. Confidence in the process used by the supplier during development by following a recognised standard
3. Designing and implementing to a recognised standard
4. Operating and maintaining to a recognised standard
Which set of regulations specifies the requirements for securing data in payment card systems?
1. PCI-DSS
2. NIST Cybersecurity Framework
3. ISO 27001
4. Cyber Essentials
What is the primary limitation of security testing as an extrinsic assurance method?
1. Tests cannot be automated
2. Systems are tested against known vulnerabilities only
3. It follows an outdated standard
4. It provides paper-based testing and does not flag real-world issues
When migrating from an on-premises solution to a cloud solution, what should you ensure is provided to ensure users are always able to access the data?
1. Availability zones
2. Offline Backups
3. Security groups
4. Elasticity
In cyber assurance, which of the following actions would result in a system being considered “trusted”?
1. PKI digital certificates are used to provide proof of origin
2. The software developer follows the trustworthy software framework in developing the application
3. A well-known company produces a website using secure coding techniques
4. The system has bene developed to comply with ISO27001 requirements
What is the primary reason for obtaining Cyber Essentials certification?
1. Reduce cyber threat
2. Ensuring the system is 100% secure
3. To put a logo on the company website
4. To give staff confidence in the company’s organisation skills
Which of the following are NOT likely to mandatory actions for all staff to assist in maintaining organisational security?
1. Participate in training and awareness measures
2. Comply with the acceptable use policy
3. Follow the company security procedures
4. Obtain basic cyber security certification
Which of the following is true regarding thin clients
1. Most of the processing occurs on the server
2. They have higher hardware specifications than standard user devices
3. They perform most of the processing on the client
4. They provide more streamlined operating systems than thick clients, requiring less processing power
Outsourcing equipment maintenance falls under which category of risk treatment?
1. Transfer
2. Reduce
3. Avoid
4. Accept
A member of the IT department is fired. Before leaving, the staff member changes the administrator password and doesn’t tell anyone. What type of insider threat does this represent?
1. Malicious insider
2. Unmanaged 3rd party staff
3. Negligent insider
4. Inadequately trained employee
What are the primary components of a threat?
1. Technical ability, determination and finances
2. Motivation, opportunity and objective
3. Attack technique, motivation and money
4. Attack technique, motive and opportunity
Which type of malware is uses an action or other function as a trigger to begin the attack?
1. Worm
2. Trojan
3. Logic bomb
4. Ransomware
Which of the following is NOT a benefit of using the MITRE Att&ck Model?
1. It can be used to build behavioural analytics for detecting the behaviour of the adversary
2. It provides a path for assessing the value of information, the definition of targets and prioritising actions
3. It removes the need for a fully independent cyber security department
4. It can be used to assess monitoring and mitigation tools for defences already deployed within an enterprise
What is the most important thing to consider when determining if an information asset should be protected?
1. Legal compliance
2. Effort needed to provide security
3. Cost of protection
4. If you have been attacked before
In penetration testing, which team would be responsible for defending the system?
1. Blue Team
2. White Team
3. Purple Team
4. Red Team
Which of the following is a US copyright law that criminalises the production and dissemination of technologies, devices or services intended to circumvent access control measures on copyrighted works?
1. Digital Millennium Act
2. Patriot Act
3. ITAR
4. EU-US Privacy Shield
Membership of a cyber security professional body such as ISACA requires you to adhere to what?
1. Approved suppliers of managed services
2. Prescribed cryptographic tools for emails exchange
3. Code of professional ethics
4. Choice of cyber security tools
Which GDPR principle dictates that organisations must protect personal data?
1. Security and integrity principle
2. Data minimisation
3. Accountability
4. Lawfulness, fairness and transparency
Your organisation processes a lot of personally identifiable information (PII) as part of their day-to-day function. There is a significant data breach that compromises several company databases. What is the most likely form of impact to the business?
1. Regulatory
2. Financial
3. Motivational
4. Operational
What is the Delphi method?
1. Four-step problem-solving iterative technique used to improve business processes
2. An executive coaching method using a four-step framework to help individuals and groups to solve problems
3. A forecasting process based on the results of multiple rounds of questionnaires sent to a panel of experts
4. A continuous development process ensuring development of the security posture of enterprise organisations

Intro to Cyber Mock Exam 02

Quiz