Introduction to Cybersecurity Fundamentals Module 5-6

Module 5 Question: What word is the currently accepted term that is used today to refer to network-connected hardware devices? a. host b. endpoint c. device d. client Answers: b Question: Which of the following is NOT a feature of blocking ransomware? a. A message on the user's screen appears pretending to be from a reputable third party. b. It prevents a user from using their computer in a normal fashion. c. It can be defeated by a double power cycle. d. It is the earliest form of ransomware. Answers: c Question: Cillian is explaining to an intern why ransomware is considered to be the most serious malware threat. Which of the follow reasons would Cillian NOT give? a. Once a device is infected with ransomware, it will never function normally. b. Launching a ransomware attack is relatively inexpensive and does not require a high degree of skill. c. Ransomware attacks occur with a very high frequency. d. Attacks from ransomware have a high impact on organizations. Answers: a Question: Finn's team leader has just texted him that an employee, who violated company policy by bringing in a file on a USB flash drive, has just reported that their computer is infected with locking ransomware. Why would Finn consider this a serious situation? a. It sets a precedent by encouraging other employees to violate company policy. b. It can encrypt all files on any network that is connected to the employee's computer. c. The organization may be forced to pay up to $500 for the ransom. d. The employee would have to wait at least an hour before their computer could be restored. Answers: b Question: What is the difference between a keylogger and spyware? a. A keylogger operates much faster than spyware. b. Spyware is illegal while a keylogger is not. c. Spyware typically secretly monitors users but unlike a keylogger makes no attempts to gather sensitive user keyboard input. d. Spyware can be installed using a hardware device while a keylogger cannot. Answers: c Question: Which of the following is NOT a technology used by spyware? a. tracking software b. system-modifying software c. active tracking technologies d. automatic download of software Answers: c Question: Which of the following is NOT true about RATs? a. A RAT gives the threat agent unauthorized remote access to the victim's computer by using specially configured communication protocols. b. A RAT and a worm have the same basic function. c. A RAT allows the attacker to not only monitor what the user is doing but also can change computer settings, browse and copy files, and even use the computer to access other computers connected on the network. d. A RAT creates an opening into the victim's computer, allowing the threat actor unrestricted access. Answers: b Question: Which of the following types of computer viruses is malicious computer code that becomes part of a file? a. file-based virus b. jump virus c. fileless virus d. RAM-Check virus Answers: a Question: Which of the following is NOT a Microsoft Windows common LOLBin? a. DLR b. .NET Framework c. Macro d. PowerShell Answers: a Question: Which of the following is sometimes called a "network virus" because it enters a computer to move through the network? a. fileless virus b. worm c. trojan d. file-based virus Answers: b Question: Which of these would NOT be considered the result of a logic bomb? a. Send an email to Rowan's inbox each Monday morning with the agenda of that week's department meeting. b. If the company's stock price drops below $50, then credit Oscar's retirement account with one additional year of retirement credit. c. Erase the hard drives of all the servers 90 days after Alfredo's name is removed from the list of current employees. d. Delete all human resource records regarding Augustine one month after he leaves the company. Answers: a Question: Which of the following attacks is based on a website accepting user input without sanitizing it? a. RSS b. XSS c. iSQL d. SSXRS Answers: b Question: Which of the following attacks is based on the principle that when a user is currently authenticated on a website and then loads another webpage, the new page inherits the identity and privileges of the first website? a. SSFR b. DLLS c. CSRF d. DRCR Answers: c (cross-site request forgery (CSRF)) Question: Which of the following manipulates the trusting relationship between web servers? a. SSRF b. CSRF c. EXMAL d. SCSI Answers: a server-side request forgery (SSRF) Question: Which type of memory vulnerability attack manipulates the "return address" of the memory location of a software program? a. pointer attack b. stuffing attack c. integer overwrite d. buffer overflow attack Answers: d Question: What race condition can result in a NULL pointer/object dereference? a. Conflict race condition b. Value-based race condition c. Thread race condition d. Time of check (TOC) to time of use (TOU) Answers: d Question: Which of the following would NOT be considered an IoA? a. resource manipulation b. out-of-cycle logging c. account lockout d. blocked content Answers: a Question: Nollaig is reviewing the steps that an attacker took when they compromised a web server and accessed confidential files. What type of attack was this? a. directory traversal b. account overflow c. race condition d. TOE Answers: a Question: Which of the following is NOT correct about a secure cookie? a. It is a means of protection of a web browser. b. A secure cookie is only sent to the server with an encrypted request. c. It uses the HTTPS protocol. d. It prevents an unauthorized person from intercepting a cookie that is being transmitted. Answers: a Question: Which statement regarding a keylogger is NOT true? a. Software keyloggers can be designed to send captured information automatically back to the attacker through the Internet. b. Hardware keyloggers are installed between the keyboard connector and computer keyboard USB port. c. Software keyloggers are generally easy to detect. d. Keyloggers can be used to capture passwords, credit card numbers, or personal information. Answers: c Module 6 Question: Ahmet is explaining to his team members the security constraints that have made it a challenge to protect a new embedded system. Which of the following would Ahmet NOT include as a constraint? a. authentication b. cost c. power d. ease of use Answers: d Ease of recovery instead Question: Yusuf has been asked to experiment with different hardware to create a controller for a new device on the factory floor. He needs a creditcard-sized motherboard that has a microcontroller instead of a microprocessor. Which would be the best solution? a. SoC b. Raspberry Pi c. Arduino d. FPGA Answers: c Question: Musa needs a tool with a single management interface that provides capabilities for managing and securing mobile devices, applications, and content. Which tool would be the best solution? a. UEM b. MDM c. MCCM d. MMAM Answers: a Question: In a job interview, Deniz asks about the company policy regarding smartphones. She is told that employees may choose from a limited list of approved devices but that she must pay for the device herself; however, the company will provide her with a monthly stipend. Which type of enterprise deployment model does this company support? a. BYOD b. DYOD c. CYOD d. Corporate-owned Answers: c Question: Eren has been asked to provide information regarding adding a new class of Android smartphones to a list of approved devices. One of the considerations is how frequently the smartphones receive firmware OTA updates. Which of the following reasons would Eren NOT list in their report as a factor in the frequency of Android firmware OTA updates? a. OEMs are hesitant to distribute Google updates because it limits their ability to differentiate themselves from competitors if all versions of Android start to look the same through updates. b. Because many of the OEMs have modified Android, they are reluctant to distribute updates that could potentially conflict with their changes. c. Wireless carriers are reluctant to provide firmware OTA updates because of the bandwidth it consumes on their wireless networks. d. Because OEMs want to sell as many devices as possible, they have no financial incentive to update mobile devices that users would then continue to use indefinitely. Answers: c Question: What is the process of identifying the geographical location of a mobile device? a. Geotracking b. Geolocation c. GeoID d. Geomonitoring Answers: b Question: Which of the following is NOT an advantage of COPE for an enterprise? a. simplified IT infrastructure b. cost savings c. flexibility in management d. more oversight Answers: d Question: Ceyhun received a request by a technician for a new portable computer. The technician noted that they wanted USB OTG support and asked Ceyhun's advice regarding it. Which of the following would Ceyhun NOT tell them is an advantage? a. A device connected via USB OTG can function as a peripheral for external media access. b. A device connected via USB OTG can function as a host. c. USB OTG is only available for connecting Android devices to a portable computer. d. Connecting a mobile device to an infected computer using USB OTG could allow malware to be sent to that device. Answers: c Question: Ozan has received a phone call from his supervisor that a new employee has attempted to download and install an unapproved app that allows her to circumvent the built-in limitations on her Android smartphone. What is this called? a. rooting b. sideloading c. jailbreaking d. ducking Answers: a Question: What is another name for runtime verification? a. static code analysis b. dynamic code analysis c. fuzzering d. weighted code analysis Answers: b Question: What is dead code? a. A block of code that does not run. b. Code that has been tagged to be removed from an application. c. A branch in a code that calls in a subroutine but always returns a null value. d. A section of an application that executes but performs no meaningful function. Answers: d Question: Cahill is writing an application using SecDevOps and wants to prevent XSS and CSRF attacks. What coding technique would he use? a. obfuscation b. code signing c. input validation d. normalization Answers: c Question: What does containerization do? a. It splits operating system functions only on specific brands of mobile devices. b. It places all keys in a special vault. c. It slows down a mobile device to half speed. d. It separates personal data from corporate data. Answers: d Question: What allows a device to be managed remotely? a. MDM b. MAM c. MRM d. MWM Answers: a Question: Which of these is NOT a security feature for locating a lost or stolen mobile device? a. Remote lockout b. Last known good configuration c. Alarm d. Thief picture Answers: b Question: What enforces the location in which an app can function by tracking the location of the mobile device? a. Location resource management b. Geofencing c. GPS tagging d. Graphical management tracking (GMT) Answers: b Question: Which of these is considered the strongest type of passcode to use on a mobile device? a. password b. PIN c. fingerprint swipe d. draw connecting-dots pattern Answers: a Question: Which of the following is NOT a means by which untrusted content can be sent to a mobile device? a. SMS b. MMS c. RCS d. XRX Answers: d Question: Which tool manages the distribution and control of apps? a. MAM b. MDM c. MCM d. MFM Answers: a Question: Which type of OS is typically found on an embedded system? a. SoC b. RTOS c. OTG d. COPE Answers: b