Information Security Careers and Certifications - Module 2

Module 2 Question: What is the attack surface of social engineering? a. manipulation b. human vectors c. persuasion d. deception Answers: b Question: Bjorn just received a phone call in which the person claimed to be a senior vice president demanding that his password be reset, or else Bjorn's supervisor would be contacted about his lack of cooperation. Bjorn was convinced that this was a social engineering attack. Which principle of human manipulation did the attacker attempt on Bjorn? a. authority b. fright c. intimidation d. urgency Answers: c Question: Which of the following is NOT a personal technique used by social engineering attackers to gain the trust of the victim? a. Provide a reason. b. Project confidence. c. Demand compliance. d. Use evasion and diversion. Answers: c Question: Albrecht received a call from a senior vice president of finance who had received a phishing email and had deleted it. What type of phishing attack was this? a. dolphining b. harpooning c. phishing spear d. whaling Answers: d Question: Tobias received an SMS text that falsely said his bank account was overdrawn and to avoid a $45 fee, he should contact the bank immediately with an explanation. What type of social engineering attack is this? a. texting attack b. SMS phishing c. smishing d. IM vectoring Answers: c Question: Which of the following is NOT true about BEC? a. It is decreasing in popularity among threat actors. b. It takes advantage of electronically making payments or transferring funds. c. It takes advantage of the size and complexity of large enterprises. d. It is not limited to businesses. Answers: a Question: Which social engineering attack is masquerading as a real or fictitious character and then playing out the role of that person on a target? a. pretending b. pretexting c. impersonation d. acting Answers: c Question: Wolfgang-Cashman is a new intern at the online company WebHighSchoolStore.com. He has been assigned the task of researching all of the similar domain names to theirs in order to counteract attacks. What is Wolfgang-Cashman combating? a. mistranslations b. spimming c. typo squatting d. redactioning Answers: c Question: What is false or inaccurate information that comes from a malicious intent? a. misinformation b. half-truths c. disinformation d. varication Answers: c Question: Which of the following is NOT a type of data reconnaissance? a. purchasing used technology equipment b. excel dorking c. dumpster diving d. shoulder surfing Answers: b (Google dorking uses advanced Google search techniques to look for information that unsuspecting victims have carelessly posted on the web.) Question: Which type of sensor is most appropriate for monitoring a large warehouse for intruders? a. microwave sensor b. IR sensor c. XG sensor d. passive RGP sensor Answers: a Question: Which of the following statements is NOT true about a pressure sensor? a. A pressure sensor can differentiate between a car and a person. b. Modern pressure sensors can differentiate between what has entered and where they are headed. c. A pressor sensor is a type of management control. d. A pressure sensor can be used to detect if a person has entered a restricted area. Answers: c Question: Arndt is on a team that is increasing the security in an office. They want to allow anyone to pass by a door but have an alarm sound whenever someone gets too close to the door. Which sensor would Arndt recommend using? a. IR sensor b. microwave sensor c. ultrasonic sensor d. pressure sensor Answers: c Question: Which type of buffer is automated and has two interlocking doors, only one of which can be opened at a time? a. access control vestibule b. reception area c. waiting room d. vestibule office Answers: a Question: Milan is on a design team that needs to run a hardened carrier PDS underground between two buildings. What requirement would Milan add to the specifications? a. It must be buried at least 25 feet below surface level. b. It can only be used for fiber-optic cables. c. It must be visually inspected on a weekly basis. d. It must be encased in concrete. Answers: d Question: Which data classification has the highest level of data sensitivity? a. "eyes-only" b. sensitive c. private d. confidential Answers: d Question: Jan is working on classifying data. Some data has been identified that if compromised, the function and mission of the enterprise would be severely impacted. Which data classification should Jan give this data? a. secret b. top secret c. critical d. classified Answers: c Question: Which type of data is hospital patient information protected by HIPAA? a. restricted data b. regulated data c. secure data d. private data Answers: b Question: JSON and XML would be classified as which type of data? a. compiled data b. lightweight data c. schematic data d. non-human-readable data Answers: d Question: Which of the following data security methods creates a copy of the original data but uses obfuscation on any sensitive elements? a. data masking b. data protecting c. data tokening d. data covering Answers: a Question: Which of the following can be included under the physical security controls umbrella? Select three. a. b. c. d. e. Industrial camouflage Perimeter defenses Regular chain-link fencing Data leakage Gel-based paint Answers: date leakage, gel-based paint, perimeter defenses Question: G enters websiteA.com in the address bar of a browser but is redirected to websiteB.com due to an infected DNS. What type of exploit did G experience? a. b. c. d. A A A A redirection redirection redirection redirection technique technique technique technique due to a single-bit error in G’s computer due to a single bit squatting called pharming due to a single bit error in a DNS server Answers: c Question: Which of the following technologies is most likely to be used in a system that is able to detect when a vehicle enters a restricted area and the direction in which it is headed? a. b. c. d. Motion sensors Barometric vestibule Ultrasonic sensors Pressure sensors Answers: d Question: You receive a call from someone pretending to be a government agent. They claim there is an issue with your taxes and you need to provide certain information to clear up the problem. However, the caller's true goal is to obtain private information. Which of the following best describes this behavior? a. b. c. d. Smishing Pretexting Vectoring Vishing Answers: b Question: Which of the following most accurately describes the differences or similarities between misinformation and disinformation? Select two. a. b. c. d. e. A false warning is an example of disinformation One is false and the other is inaccurate Misinformation comes with a malicious intent Misinformation is a hoax Disinformation is a type of misinformation Answers: a, e Question: Which of the following most accurately describes the differences or similarities between typo squatting and cybersquatting? Select two. a. Cybersquatting is registering a domain that contains trademarks and then selling it. b. Cybersquatting changes a letter in a domain hoping to capitalize on a single-bit error. c. Typo squatting will very likely render an "HTTP Error 4 0 4 Not Found" message in a browser. d. A domain name with a one-letter change relative to an authentic site is an example of typo squatting. Answers: a, d Question: Vika is asked to do research on the types of locks available to secure entry into a controlled access area. What type of lock should Vika recommend? Select two. a. A lock that can be opened with a code sent from a cell phone via Bluetooth. b. A programmable electronic lock with a fixed keypad and logging mechanism. c. One that requires two physical keys: one for ingress and another for egress. d. One with a keyed cylinder in both the outside and inside requiring one key. e. One capable of displaying a virtual keypad where the numbers are not fixed. Answers: a, e Question: Which of the following lists the data type in order from the type that needs the highest level of protection to the lowest level? a. b. c. d. Private, internal, regulated Confidential, private, sensitive Critical, trade secret, secret Restricted, critical, intellectual property Answers: b Question: A company uses a fence to deter physical access. An audit report concluded that since the fence can be easily scaled, additional measures should be implemented. What additional fencing-deterrent measure could the company implement to gain an added layer of protection? Select three. a. b. c. d. e. Anticlimb collar Roller barrier Rotating spikes Barricades in front of the fence Chain-link fence Answers: a, b, c Question: Karlo installs an alarm system that is capable of emitting and detecting a signal in the light spectrum. The capability serves the purpose of detecting motion and how close an object is in a limited space. Which of the following best describes the type of signal the emitter can transmit? a. Light-emitting b. 802.11 c. Microwave d. Infrared Answers: d