Information Security Careers and Certifications - Module 1

Question lists and answers Module 1 Question: Vittoria is working on her computer information systems degree at a local college and has started researching information security positions. Because she has no prior experience, which of the following positions would Vittoria most likely be offered? a. security administrator b. security technician c. security officer d. security manager Answers: b Question: Which of the following is false about the CompTIA Security+ certification? a. Security+ is one of the most widely acclaimed security certifications. b. Security+ is internationally recognized as validating a foundation level of security skills and knowledge. c. The Security+ certification is a vendor-neutral credential. d. Professionals who hold the Security+ certification earn about the same or slightly less than security professionals who have not achieved this certification. Answers: d Question: Ginevra is explaining to her roommate the relationship between security and convenience. Which statement most accurately indicates this relationship? a. Security and convenience are directly proportional. b. Security and convenience have no relationship. c. Any proportions between security and convenience depends on the type of attack. d. Security and convenience are inversely proportional. Answers: d Question: Serafina is studying to take the Security+ certification exam. Which of the following of the CIA elements ensures that only authorized parties can view protected information? a. confidentiality b. integrity c. availability d. credentiality Answers: a Question: Which of the following AAA elements is applied immediately after a user has logged into a computer with their username and password? a. authentication b. authorization c. identification d. recording Answers: b Question: Gia has been asked to enhance the security awareness training workshop for new hires. Which category of security control would Gia be using? a. managerial b. technical c. operational d. physical Answers: c Question: Which specific type of control is intended to mitigate (lessen) damage caused by an attack? a. corrective control b. compensating control c. preventive control d. restrictive control Answers: a (A control that is intended to mitigate or lessen the damage caused by the incident is called a corrective control.) Question: Which control is designed to ensure that a particular outcome is achieved by providing incentives? a. deterrent control b. incentive control c. detective control d. directive control Answers: d (A directive control is designed to ensure that a particular outcome is achieved. One type of directive control is an incentive, which is the "carrot" instead of the "stick." Incentives are often overlooked as a control, but they can be very powerful.) Question: Which of the following controls is NOT implemented before an attack occurs? a. detective control b. deterrent control c. preventive control d. directive control Answers: a (A detective control is used to identify an attack and occurs during an attack.) Question: Complete this definition of information security: That which protects the integrity, confidentiality, and availability of information _____. a. on electronic digital devices and limited analog devices that can connect via the Internet or through a local area network b. through a long-term process that results in ultimate security c. using both open-sourced as well as supplier-sourced hardware and software that interacts appropriately with limited resources d. through products, people, and procedures on the devices that store, manipulate, and transmit the information Answers: d Question: Which of the following groups have the lowest level of technical knowledge for carrying out cyberattacks? a. unskilled attackers b. hacktivists c. nation-state actors d. organized crime Answers: a Question: Ilaria is explaining to her parents why information security is the preferred term when talking about security in the enterprise. Which of the following would Ilaria NOT say? a. Cybersecurity usually involves a range of practices, processes, and technologies intended to protect devices, networks, and programs that process and store data in an electronic form. b. In a business information may be in any format, from electronic files to paper documents. c. Cybersecurity is a subset of information security. d. Information security protects "processed data" or information. Answers: c Question: Which of the following is not considered an attribute of threat actors? a. level of sophistication/capability b. educated/uneducated c. resources/funding d. internal/external Answers: b Question: What is considered the motivation of an employee who practices shadow IT? a. deception b. ignorance c. ethical d. malicious Answers: c Question: Which tool is most commonly associated with nation-state actors? a. Closed-Source Resistant and Recurrent Malware (CSRRM) b. Advanced Persistent Threat (APT) c. Unlimited Harvest and Secure Attack (UHSA) d. Network Spider and Worm Threat (NSAWT) Answers: b Question: Flavia is reading about insider threats. Which of the following is NOT true about insider threats? a. Attacks from an insider threat are hard to recognize. b. Insider threats are usually dismissed as not being a serious risk. c. Insider threats often occur because the enterprise is watching for outsiders. d. Government insiders have stolen large volumes of sensitive information. Answers: b Question: What is the primary motivation of hacktivists? a. disruption/chaos b. financial gain c. data exfiltration d. war Answers: a Question: What is another name for "attack surface"? a. vulnerability exposure b. threat vector c. legacy platform d. attack floor Answers: b Question: Which of the following is NOT a message-based attack surface? a. voice calls b. instant messages c. texts d. network protocols Answers: d Question: Which of the following is NOT true about supply chains? a. A supply chain is a network that moves a product from its creation to the end-user. b. Vendors are the first step in a supply chain. c. Each link in a supply chain can be a potential attack surface. d. Hardware providers and software providers are types of supply chains. Answers: b Question: Which of the following best describes the possible impact of an attack where credit card data is stolen from a company and the breach is eventually reported in the news? Select two. a. Availability loss b. Loss of reputation c. Income generating loss d. Possible prison time for IT personnel Answers: b, d Question: Which of the following best describes what Della could do to prevent unauthorized parties from viewing sensitive customer information at her retail store? a. software to encrypt data in a secure database. b. Verify the ID of the party requesting access to the data. c. Limit access to certain areas once access is granted. d. Ensure the data cannot be manipulated or changed. Answers: a Question: What type of entity would a threat actor most likely attack to steal design documents for a relatively recently announced government-issued contract to design and build a missile defense system? a. Individual b. Government c. Enterprise d. For-profit organization Answers: c Question: To bypass institutional overhead, a well-intentioned networking instructor purchases a wireless router and connects it to the network. The goal is to allow students to establish connectivity with each other by connecting through the wireless router. In what activity did the instructor participate? a. APT b. Shadow IT c. Insider threat d. Ethical Hacking Answers: b Question: A visitor is trying to access a military base. The visitor needs to supply their license and enter other personal information via a kiosk. The visitor is eventually allowed to enter the base but is limited to certain areas only. What security principles are being employed? Select two. Authentication Authorization Confidentiality Accounting Availability Answers: Authentication and Authorization Question: You have excellent technical acumen. Part of your responsibilities where you work include overlooking daily operations as well as analyzing and designing security solutions in a specific area. You encounter a situation that needs to be escalated. Which of the following are you most likely to approach with the situation? a. CIO b. CISO c. Security manager d. Security administrator Answers: c Question: A broker launches a variety of attacks to find a weakness that will lead to financial gain. What activity is the broker most likely to engage in? a. Steal classified information against a competitor b. Sell information about a discovered vulnerability c. Create and sell malicious software to the highest bidder d. Obtain, repackage, and sell pirated software Answers: b Question: A malicious actor lacking technical knowledge uses an attack tool to perform a sophisticated attack. If the attacker is successful penetrating the defenses of the targeted organization, what type of activity are they most likely to perform? Select two. Blackmail Copy data Corrupt data Disrupt service Manipulate data Answers: copy data and disrupt service Question: Which of the following best describes the differences or similarities between cybersecurity and information security? Select three. a. Cybersecurity primarily protects devices. b. Information security falls under the cybersecurity umbrella. c. Cybersecurity guarantees more safety than information security. d. Information security protects using products, people, and procedures. e. Cybersecurity induces a lot more inconvenience than information security. Answers: a, b, d Question: When analyzing a security breach, Acer determines the attacker was able to change the price of an item from $200 to $20. What security protection was compromised? a. b. c. d. Answers: b Confidentiality Integrity Authorization Authentication