IBM Cybersecurity Analyst Professional Certificate Assessment Exam Answers

IBM Cybersecurity Annotator Professional Certificate Assessment Exam Quiz Answers

Warning: Jo Answer Greenish hai wo correct hai merely

Jo Green Nahi hai. Usme se jo ek wrong selection tha usko hata diya hai

Question 1)

Implementing a Security Awareness training programme would be an example of which blazon of command?

  • Administrative control

Question 2)

Putting locks on a door is an instance of which type of control?

  • Preventative

Question 3)

How would you allocate a slice of malicious code that tin replicate itself and spread to new systems?

  • A worm

Question 4)

To engage in packet sniffing, you lot must implement promiscuous mode on which device ?

  • A network card
  • An Intrusion Detection Organisation (IDS)
  • A sniffing router

Question 5)

Which mechanism would help assure the integrity of a bulletin, just not do much to assure confidentiality or availability.

  • Hashing

Question vi)

An system wants to restrict employee after-hours access to its systems so information technology publishes a policy forbidding employees to work outside of their assigned hours, and so makes sure the office doors remain locked on weekends. What two (2) types of controls are they using? (Select 2)

  • Physical
  • Authoritative

Question 7)

Which two factors contribute to cryptographic strength? (Select two)

  • The use of cyphers that are based on complex mathematical algorithms
  • The use of cyphers that have undergone public scrutiny

Question 8)

Trying to break an encryption fundamental past trying every possible combination of characters is called what?

  • A brute force assail

Question 9)

Which of the post-obit describes the cadre goals of IT security?

  • The Open Web Application Security Project (OWASP) Framework
  • The Business organization Process Management Framework
  • The CIA Triad

Question 10)

Which iii (three) roles are typically found in an Information Security organization? (Select 3)

  • Vulnerability Assessor
  • Chief Data Security Officer (CISO)
  • Penetration Tester

Question 11)

Trouble Management, Modify Management, and Incident Direction are all key processes of which framework?

  • ITIL

Question 12)

Alice sends a message to Bob that is intercepted by Trudy. Which scenario describes an integrity violation?

  • Trudy changes the message and and then forwards it on
  • Trudy deletes the bulletin without forwarding it
  • Trudy reads the message
  • Trudy cannot read it because it is encrypted but allows information technology to be delivered to Bob in its original form

Question 13)

In cybersecurity, Accountability is divers as what?

  • Beingness able to map an action to an identity

Question fourteen)

Multifactor authentication (MFA) requires more than one authentication method to be used before identity is authenticated. Which three (3) are hallmark methods? (Select three)

  • Something a person is
  • Something a person has
  • Something a person knows

Question 15)

Which three (3) of the post-obit are Physical Access Controls? (Select 3)

  • Door locks
  • Security guards
  • Fences

Question xvi)

If yous are setting upward a Windows ten laptop with a 32Gb hard drive, which ii (2) file system could you select? (Select two)

  • NTFS
  • FAT32

Question 17)

Which three (3) permissions can be set on a file in Linux? (Select 3)

  • write
  • execute
  • read

Question xviii)

If cost is the master concern, which type of cloud should be considered first?

  • Public deject

Question xix)

Consolidating and virtualizing workloads should be done when?

  • Earlier moving the workloads to the cloud

Question 20)

Which of the following is a self-regulating standard set up up past the credit bill of fare industry in the United states of america?

  • PCI-DSS

Question 21)

Which 2 (2) of the post-obit assail types target endpoints?

  • Advertising Network
  • Spear Phishing

Question 22)

If an Endpoint Detection and Response (EDR) system detects that an endpoint does not accept a required patch installed, which statement best characterizes the actions it is able to take automatically?

  • The endpoint can exist quarantined from all network resources except those that let it to download and install the missing patch

Question 23)

Granting access to a user based upon how high up he is in an organization violates what basic security premise?

  • The principle of least privileges

Question 24)

The Windows Security App available in Windows 10 provides uses with which of the post-obit protections?

  • Firewall and network protection
  • Family options (parental controls)
  • All of the above

Question 25)

Hashing ensures which of the post-obit?

  • Integrity

Question 26)

Which of the post-obit practices helps assure the best results when implementing encryption?

  • Cull a reliable and proven published algorithm
  • Develop a unique cryptographic algorithm for your organization and keep them cloak-and-dagger

Question 27)

Which of these methods ensures the authentication, non-repudiation and integrity of a digital communication?

  • Use of digital signatures

Question 28)

Which of the following practices will assist assure the confidentiality of data in transit?

  • Disable certificate pinning
  • Accept self-signed certificates
  • Implement HTTP Strict Send Protocol (HSTS)

Question 29)

Which three (iii) of these are benefits you tin can realize from using a NAT (Network Accost Translation) router? (Select 3)

  • Allows static one-to-i mapping of local IP addresses to global IP addresses
  • Allows dynamic mapping of many local IP addresses to a smaller number of global IP accost only when they are needed
  • Allows internal IP addresses to exist hidden from outside observers

Question xxx)

Which argument best describes configuring a NAT router to utilise static mapping?

  • The organization will need as many registered IP addresses as it has computers that need Internet access

Question 31)

If a figurer needs to send a message to a system that is part of the local network, where does it send the message?

  • To the system's MAC accost

Question 32)

Which are properties of a highly available arrangement?

  • Redundancy, failover and monitoring

Question 33)

Which three (iii) of these statements nigh the UDP protocol are Truthful? (Select 3)

  • UDP is faster than TCP
  • UDP packets are reassembled by the receiving system in whatsoever order they are received
  • UDP is connectionless

Question 34)

What is one difference between a Stateful Firewall and a Next Generation Firewall?

  • A NGFW understand which application sent a given packet

Question 35)

You are concerned that your system is really not very experienced with securing information sources. Which hosting model would require yous to secure the fewest data sources?

  • SaaS

Question 36)

Hassan is an engineer who works a normal day shift from his visitor'southward headquarters in Austin, TX The states. Which two (2) of these activities raise the nearly cause for business organization? (Select 2)

  • Each night Hassan logs into his business relationship from an Isp in China
  • One evening, Hassan downloads all of the files associated with the new product he is working on

Question 37)

Which iii (3) of the post-obit are considered condom coding practices? (Select 3)

  • Use library functions in place of OS commands
  • Avert using OS commands whenever possible
  • Avoid running commands through a shell interpreter

Question 38)

Which three (3) items should be included in the Planning footstep of a penetration examination? (Select iii)

  • Informing Need-to-know employees
  • Establishing Boundaries
  • Setting Objectives

Question 39)

Which portion of the pentest report would cover the take chances ranking, recommendations and roadmap?

  • Executive Summary

Question twoscore)

Spare workstations and servers, blank removable media, bundle sniffers and protocol analyzers, all belong to which Incident Response resource category?

  • Incident Mail-Analysis Resources
  • Incident Analysis Hardware and Software

Question 41)

NIST recommends because a number of items, including a high level of testing and monitoring, during which stage of a comprehensive Containment, Eradication & Recovery strategy?

  • Recovery

Question 42)

True or False. Digital forensics is effective in solving cyber crimes but is not considered effective in solving violent crimes such as rape and murder.

  • False

Question 43)

Which iii (3) are common obstacles faced when trying to examine forensic data? (Select 3)

  • Selecting the right tools to help filter and exclude irrelevant data
  • Finding the relevant files among the hundreds of thousands found on virtually hard drives
  • Bypassing controls such as passwords

Question 44)

What scripting concept will repeatedly execute the same block of code while a specified condition remains true?

  • Loops

Question 45)

Which two (ii) statements about Python are true? (Select two)

  • Python lawmaking is considered easy to debug compared with other pop programming languages
  • Python code is considered very readable by novice programmers

Question 46)

In the Python statement

pi="3"

What data type is the data type of the variable pi?

  • str

Question 47)

What will be printed past the post-obit cake of Python code?

def Add5(in)

 out=in+5

 return out

 print(Add5(x))

  • 15

Question 48)

Which threat intelligence framework was developed by the Us Government to enable consistent characterization and categorization of cyberthreat events?

  • Cyber Threat Framework

Question 49)

True or Simulated. An organization'southward security allowed system should exist integrated with outside organizations, including vendors and other third-parties.

  • True

Question l)

Which iii (3) of these are among the height 12 capabilities that a good data security and protection solution should provide? (Select 3)

  • Vulnerability assessment
  • Real-fourth dimension alerting
  • Tokenization

Question 51)

Truthful or False. For iOS and Android mobile devices, users must collaborate with the operating system only through a series of applications, but non straight.

  • True

Question 52)

All industries take their ain unique data security challenges. Which of these industries has a item business concern with PCI-DSS compliance while having a large number of access points staffed by depression-level employees who have admission to payment carte data?

  • Retail

Question 53)

True or False. WireShark has an impressive array of features and is distributed free of charge.

  • Truthful

Question 54)

In which component of a Common Vulnerability Score (CVSS) would privileges required be reflected?

  • Base of operations-Exploitability Subscore

Question 55)

The Decommission footstep in the DevSecOps Release, Deploy & Decommission phase contains which of these activities?

  • IAM controls to regulate authority

Question 56)

You lot calculate that there is a ii% probability that a cybercriminal volition be able to steal credit bill of fare numbers from your online storefront which will result in $10M in losses to your company. What have yous just determined?

  • A gamble

Question 57)

Which one of the OWASP Height x Application Security Risks would exist occur when an application'due south API exposes fiscal, healthcare or other PII information?

  • Sensitive data exposure

Question 58)

Which three (3) of these are Solution Building Blocks (SBBs)? (Select 3)

  • Virus Protection
  • Awarding Firewall
  • Spam Filter

Question 59)

A robust cybersecurity defense includes contributions from 3 areas, human expertise, security analytics and artificial intelligence. Rapidly analyzing large quantities of unstructured information lends itself best to which of these areas?

  • Artificial intelligence

Question 60)

The triad of a security operations centers (SOC) is People, Procedure and Technology. Which part of the triad would network monitoring belong?

  • Engineering science

Question 61)

Which of these is a good definition for cyber threat hunting?

  • The deed of proactively and aggressively identifying, intercepting, tracking, investigating and eliminating cyber adversaries every bit early every bit possible in the cyber impale chain

Question 62)

In that location is value brought past each of the IBM i2 EIA utilise cases. Which 1 of these provides immediate alerting on brand compromises and fraud on the dark web.

  • Threat Discovery

.

Question 63)

Which iii (3) soft skills are important to accept in an organization's incident response squad? (Select 3)

  • Communication
  • Teamwork
  • Problem solving and Critical thinking

Question 64)

Implementing stiff endpoint detection and mitigation strategies falls into which phase of the incident response lifecycle?

  • Detection & Assay

Question 65)

Which 3 (3) of these statistics nearly phishing attacks are real? (Select 3)

  • Around 15 million new phishing sites are created each month
  • Phishing accounts for nearly twenty% of data breaches
  • xxx% of phishing messages are opened by their targeted users

Question 66)

Which three (3) of these control processes are included in the PCI-DSS standard? (Select iii)

  • Implement strong admission control measures
  • Regularly monitor and test networks
  • Maintain an information security policy

Question 67)

Which 3 (3) are malware types commonly used in PoS attacks to steal credit card data? (Select 3)

  • Alina
  • BlackPOS
  • vSkimmer

Question 68)

Co-ordinate to a 2019 Ponemon report, what percent of consumers indicated they would be willing to pay more for a product or service from a provider with meliorate security?

  • 52%

Question 69)

You get a telephone call from a technician at the "Windows company" who tells you lot that they take detected a problem with your organisation and would like to help you resolve it. In club to help, they need you lot to go to a spider web site and download a simple utility that volition allow them to fix the settings on your computer. Since y'all only own an Apple tree Mac, you lot are suspicious of this caller and hang upwards. What would the assail vector have been if you lot had downloaded the "simple utility" as asked?

  • Remote Desktop Protocol (RDP)

Question 70)

What is an effective fully automated manner to prevent malware from entering your system as an e-mail zipper?

  • Anti-virus software

 Question 71)

True or False. The large bulk of stolen credit bill of fare numbers are used rapidly past the thief or a member of his/her family unit.

  • False

Question 72)

Which three (iii) of these are PCI-DSS requirements for any company handling, processing or transmitting credit carte du jour data? (Select 3)

  • Restrict access to cardholder data by business organization demand-to-know
  • Assign a unique ID to each person with computer access
  • Restrict physical admission to cardholder information

Question 73)

True or False. Communications of a data breach should be handled past a squad composed of members of the IR squad, legal personnel and public relations.

  • True

Question 74)

A Coordinating incident response squad model is characterized by which of the following?

  • Multiple incident response teams within an system all of whom coordinate their activities only within their country or department
  • Multiple incident response teams within an system simply one with authority to clinch consistent policies and practices are followed across all teams
  • This term refers to a structure that assures the incident response squad'due south activities are coordinated with senior management and all appropriate departments inside and system

Question 75)

The cyber hunting team and the SOC analysts are informally referred to as the ____ and ____ teams, respectively.

  • Blueish Cherry-red
  • Red, Blue

Question 76)

The partnership between security analysts and engineering science tin can be said to be grouped into 3 domains, human expertise, security analytics and artificial intelligence. The homo expertise domain would incorporate which three (3) of these topics?

  • Abstraction
  • Dilemmas
  • Morals

Question 77)

Solution architectures often incorporate diagrams like the one below. What does this diagram show?

<<Solution Architecture Data Period.png>>

  • Functional components and information flow

Question 78)

Port numbers 1024 through 49151 are known equally what?

  • Registered Ports

Question 79)

Which layer of the OSI model to package sniffers operate on?

  • Information Link

Question 80)

True or Simulated. Internal attacks from trusted employees represents every bit equally significant a threat as external attacks from professional cyber criminals.

  • True

Question 81)

According to the FireEye Mandiant's Security Effectiveness Report 2020, what fraction of security tools are deployed with default settings and thus underperform expectations?

  • eighty%

Question 82)

Which state had the highest boilerplate price per alienation in 2018 at $8.19M

  • The states

Question 83)

Which two (2) of these Python libraries provides useful statistical functions? (Select 2)

  • StatsModels
  • Scikit-learn

Question 84)

What will impress out when this cake of Python code is run?

i=1

#i=i+1

#i=i+2

#i=i+iii

print(i)

  • 1

Question 85)

Which three (3) statements about Python variables are truthful? (Select 3)

  • A variable name must offset with a letter or the underscore "_" grapheme
  • Variables can change type after they have been set
  • Variables practice non have to be declared in advance of their use

Question 86)

PowerShell is a configuration management framework for which operating organization?

  • Windows

Question 87)

In digital forensics documenting the chain of custody of show is critical. Which of these should be included in your chain of custody log?

  • All of the above

Question 88)

Forensic analysis should ever exist conducted on a copy of the original data. Which 2 (2) types of copying are advisable for getting information from a laptop caused from a terminated employee, if you suspect he has deleted incriminating files? (Select 2)

  • An incremental backup
  • A logical backup

Question 89)

Which of the following would exist considered an incident precursor?

  • An alert from your antivirus software indicating it had detected malware on your organisation
  • An appear threat confronting your organization by a hactivist group

Question 90)

If a penetration test calls for y'all to create a diagram of the target network including the identity of hosts and servers as well every bit a list of open ports and published services, which tool would be the best fit for this task?

  • Nmap

Question 91)

Which type of listing is considered best for safe coding practice?

  • Whitelist

Question 92)

In reviewing the security logs for a visitor'southward headquarters in New York City, which of these activities should not raise much of a security concern?

  • A recently hired information scientist in the Medical Analytics section has repeatedly attempted to access the corporate fiscal database
  • An employee has started logging in from home for an hour or and so during the last two weeks of each quarter

Question 93)

Information sources such as newspapers, books and spider web pages are considered which type of data?

  • Unstructured information
  • Semi-structured data
  • Structured data

Question 94)

Which three (3) of these statements about the TCP protocol are True? (Select iii)

  • TCP packets are reassembled by the receiving arrangement in the order in which they were sent
  • TCP is more reliable than UDP
  • TCP is connection-oriented

Question 95)

In IPv4, how many of the 4 octets are used to define the network portion of the accost in a Class B network?

  • 2

Question 96)

A small company with 25 computers wishes to connect them to the Internet using a NAT router. How many Public IP addresses will this visitor need to assure all 25 computers can communicate with each other and other systems on the Internet if they implement Port Accost Translations?

  • i

Question 97)

Why is symmetric key encryption the well-nigh mutual choice of methods to encryptic data at rest?

  • There are far more keys available for apply
  • Information technology is much faster than disproportionate key encryption

Question 98)

Which of the following statements about hashing is True?

  • Hashing uses algorithms that are known every bit "i-way" functions

Question 99)

Why is hashing not a mutual method used for encrypting data?

  • Hashing is a 1-fashion procedure and so the original data cannot be reconstructed from a hash value

Question 100)

Public key encryption incorporating digital signatures ensures which of the following?

  • Confidentiality and Integrity

Question 101)

What is the main authentication protocol used by Microsoft in Active Directory?

  • Kerberos

Question 102)

Granting admission to a user account merely those privileges necessary to perform its intended functions is known as what?

  • The principle of least privileges

Question 103)

What is the most common patch remediation frequency for nearly organizations?

  • Monthly
  • Annually

Question 104)

Island hopping is an attack method commonly used in which scenario?

  • Supply Chain Infiltration
  • Blocking access to a website for all users
  • Compromising a corporate VIP
  • Trojan Horse attacks

Question 105)

Security training for IT staff is what type of control?

  • Virtual
  • Operational
  • Physical

Question 106)

Which security concerns follow your workload even after it is successfully moved to the cloud?

  • All of the above

Question 107)

Which course of Cloud computing combines both public and private clouds?

  • Hybrid cloud

Question 108)

Which component of the Linux operating organization interacts with your computer's hardware?

  • The kernel

Question 109)

The encryption and protocols used to prevent unauthorized access to data are examples of which blazon of access command?

  • Technical

Question 110)

In cybersecurity, Actuality is divers every bit what?

  • The property of being genuine and verifiable

Question 111)

ITIL is best described every bit what?

  • A collection of Information technology Service Management best practices

Question 112)

Which position is in charge of testing the security and effectiveness of computer data systems?

  • Information Security Auditor

Question 113)

A company wants to prevent employees from wasting time on social media sites. To accomplish this, a certificate forbidding use of these sites while at work is written and circulated then the firewalls are updated to block access to Facebook, Twitter and other popular sites. Which two (two) types of security controls has the visitor just implemented? (Select 2)

  • Administrative
  • Technical

Question 114)

An email bulletin that is encrypted, uses a digital signature and carries a hash value would address which aspects of the CIA Triad?

Confidentiality and Integrity

Question 115)

What would a piece of malicious lawmaking that gets installed on a reckoner and reports dorsum to the controller your keystrokes and other information it tin get together from your system be called?

  • Spyware

Question 116)

Fancy Bears and Anonymous are examples of what?

  • Hacking organizations

Question 117)

Select the answer the fills in the blanks in the correct gild.

A weakness in a system is a/an ____. The potential danger associated with this is a/an ____ that becomes a/an ____ when attacked by a bad actor.

  • vulnerability, threat, exploit
  • threat, exposure, adventure
  • threat actor, vulnerability, exposure

Question 118)

Implement a filter to remove flooded packets before they reach the host is a countermeasure to which form of attack?

  • A Denial of Service (DoS) attack

Question 119)

Trudy intercepts a romantic plain-text message from Alice to her boyfriend Sam. The message upsets Trudy so she forward it to Bob, making information technology await like Alice intended it for Bob from the beginning. Which aspect of the CIA Triad has Trudy violated ?

  • All of the above

Question 120)

Which factor contributes most to the strength of an encryption system?

  • How many people have access to your public key
  • The length of the encryption key used
  • The number of private keys used by the system

Question 121)

What is an advantage disproportionate central encryption has over symmetric key encryption?

  • Asymmetric keys can be exchanged more securely than symmetric keys
  • Asymmetric primal encryption is harder to break than symmetric key encryption
  • Disproportionate fundamental encryption is faster than symmetric key encryption

Question 122)

Which position is responsible for the "ethical hacking" of an organizations computer systems?

  • A Penetration Tester

Question 123)

Which three (3) are considered best practices, baselines or frameworks? (Select 3)

  • ISO27000 serial
  • ITIL
  • COBIT

Question 124)

What does the "A" in the CIA Triad represent?

  • Availability

Question 125)

Which type of admission control is based upon the subject'south clearance level and the objects classification?

  • Hierarchical Access Control (HAC)
  • Discretionary Admission Control (DAC)
  • Mandatory Admission Control (MAC)
  • Role Based Access Control (RBAC)

Question 126)

Windows x stores 64-bit applications in which directory?

  • \Program Files

Question 127)

To build a virtual computing environment, where is the hypervisor installed?

  • Between the applications and the data sources
  • On the cloud's supervisory system
  • Between the hardware and operating system
  • Between the operating system and applications

Question 128)

An identical e-mail sent to millions of addresses at random would be classified as which type of attack?

  • A Shark set on
  • A Phishing assault

Question 129)

Which argument about drivers running in Windows kernel mode is true?

  • Only critical processes are permitted to run in kernel mode since there is nothing to prevent a

Question 130)

Symmetric key encryption by itself ensures which of the following?

  • Confidentiality and Integrity
  • Confidentiality only
  • Confidentiality and Availability

Question 131)

Which statement best describes configuring a NAT router to use dynamic mapping?

  • The organization will demand as many registered IP addresses as it has computers that need Internet access
  • Many registered IP addresses are mapped to a single registered IP accost using different port numbers
  • Unregistered IP addresses are mapped to registered IP addresses as they are needed
  • The NAT router uses each computer'due south IP address for both internal and external communication

Question 132)

Which address type does a reckoner use to get a new IP address when information technology boots upwards?

  • The network's DHCP server accost

Question 133)

What is the primary deviation betwixt the IPv4 and IPv6 addressing schema?

  • IPv6 is significantly faster than IPv4
  • IPv6 is used but for IOT devices
  • IPv6 allows for billions of times as many possible IP addresses

Question 134)

Which type of firewall understands which session a packet belongs to and analyzes it appropriately?

  • A Next Generation Firewall (NGFW)

Question 135)

An employee calls the IT Helpdesk and admits that maybe, just possibly, the links in the email he clicked on this morning time were not from the real Lottery Commission. What is the offset affair you should tell the employee to do?

  • Run a Port scan
  • Run an antivirus scan

Question 136)

A penetration tester involved in a "Black box" attack would be doing what?

  • Attempting to penetrate a client'due south systems every bit if she were an external hacker with no inside knowled

Question 137)

Which Postal service Incident activity would be concerned with maintaining the proper chain-of-custody?

  • Lessons learned coming together
  • Bear witness retentivity
  • Documentation review & update
  • Utilizing collected information

Question 138)

In digital forensics, which 3 (3) steps are involved in the drove of information? (Select 3)

  • Develop a plan to acquire the data
  • Verify the integrity of the data
  • Acquire the data

Question 139)

Which three (3) of the post-obit are considered scripting languages? (Select 3)

  • Perl
  • Fustigate
  • Python

Question 140)

What is the largest number that will be printed during the execution of this Python while loop?

i=0

while (i<x):

 print(i)

 i=i+ane

  • nine

Question 141)

Activities performed as a role of security intelligence tin be divided into pre-exploit and postal service-exploit activities. Which two (2) of these are post-exploit activities? (Select 2)

  • Gather full situational awareness through avant-garde security analytics
  • Perform forensic investigation

Question 142)

There are many skillful reasons for maintaining comprehensive backups of critical data. Which aspect of the CIA Triad is most impacted by an organization'southward backup practices?

  • Availability
  • Integrity
  • Authorisation

Question 143)

Which phase of DevSecOps would contain the activities Internal/External testing, Continuous balls, and Compliance checking?

  • Test
  • Code & build
  • Operate & monitor
  • Programme

Question 144)

Which i of the OWASP Top ten Awarding Security Risks would be occur when in that location are no safeguards against a user beingness allowed to execute HTML or JavaScript in the user'south browser that can hijack sessions.

  • Cross-site scripting

Question 145)

SIEM license costs are typically calculated based upon which two (2) factors? (Select ii)

  • Flows per minute (FPM)
  • Events per second (EPS)

Question 146)

Truthful or False. If yous have no ameliorate place to offset hunting threats, starting time with a view of the global threat landscape then drill downwardly to a regional view, industry view and finally a view of the threats specific to your own organization.

  • True

Question 147)

Truthful or Fake. Cloud-based storage or hosting providers are among the top sources of third-party breaches

  • True

Question 148)

You lot are looking very hard on the web for the lowest mortgage interest load you can find and you see a charge per unit that is so depression it could not possibly be truthful. You check out the site to see that the terms are and chop-chop find you are the victim of a ransomware set on. What was the likely assault vector used by the bad actors?

  • Phishing
  • Malicious Links
  • Software Vulnerabilities

Question 149)

Very provocative manufactures that come up in news feeds or Google searches are sometimes called "click-bait". These articles oft tempt you lot to link to other sites that can be infected with malware. What assault vector is used by these click-bait sites to go you to become to the actually bad sites?

  • Malicious Links

More New Questions

Question 150)

Which of the following defines a security threat?

  • Any potential danger capable of exploiting a weakness in a system
  • The likelihood that the weakness in a organization will be exploited
  • 1 instance of a weakness existence exploited
  • A weakness in a organisation that could exist exploited by a bad histrion

Question 151)

Suspicious action, like IP addresses or ports existence scanned sequentially, is a sign of which type of set on?

  • A mapping assail
  • A deprival of service (DoS) assault
  • A phishing set on
  • An IP spoofing attack

Question 152)

Alice sends a message to Bob that is intercepted by Trudy. Which scenario describes a confidentiality violation?

  • Trudy deletes the message without forwarding it
  • Trudy cannot read it because it is encrypted but allows information technology to exist delivered to Bob in its original grade
  • Trudy changes the message and then forwards it on
  • Trudy reads the bulletin

Question 153)

Which regulation contains the security rule that requires all covered entities to maintain reasonable and appropriate administrative, technical, and physical safeguards for protecting electronic protected health information (e-PHI)?

  • PCI-DSS
  • ISO27000 serial
  • HIPAA
  • GDPR
  • NIST 800-53A

Question 154)

A expert Endpoint Detection and Response organization (EDR) should accept which three (3) of these capabilities? (Select iii)

  • Automatically quarantine noncompliant endpoints
  • Manage encryption keys for each endpoint
  • Manage thousands of devices at once
  • Deploying devices with network configurations

Question 155)

Which statement almost encryption is True about data in use.

  • Data should ever be kept encrypted since modern CPUs are fully capable of operating directly on encrypted information
  • It is vulnerable to theft and should be decrypted only for the briefest possible fourth dimension while it is beingness operated on
  • Curt of orchestrating a memory dump from a organisation crash, there is no practical way for malware to get at the information being processed, then dump logs are your simply real business concern
  • Data in active memory registers are not at risk of existence stolen

Question 156)

For added security y'all make up one's mind to protect your network past conducting both a stateless and stateful inspection of incoming packets. How tin this be done?

  • This cannot be done The network ambassador must choose to run a given network segment in either stateful or stateless manner, and so select the corresponding firewall blazon
  • Install a single firewall that is capable of conducting both stateless and stateful inspections
  • Install a stateful firewall only These advanced devices inspect everything a stateless firewall inspects in improver to state related factors
  • You must install 2 firewalls in series, and so all packets pass through the stateless firewall first and then the stateless firewall

Question 157)

In IPv4, how many of the four octets are used to define the network portion of the accost in a Form A network?

  • ii
  • i
  • 4
  • iii

Question 158)

If you lot have to rely upon metadata to work with the data at manus, you are probably working with which blazon of data?

  • Meta-structured data
  • Semi-structured data
  • Structured information
  • Unstructured data

Question 159)

Which two (2) forms of discovery must be conducted online? (Select ii)

  • Port scanning
  • Shoulder surfing
  • Social engineering science
  • Package sniffing

Question 160)

Which Incident Response Squad model describes a squad that runs all incident response activities for a company?

  • Distributed
  • Primal
  • Coordinating
  • Command

Question 161)

Which is the data protection process that prevents a suspicious data request from existence completed?

  • Information risk analysis
  • Data classification
  • Data discovery
  • Blocking, masking and quarantining

Question 162)

Which form of penetration testing allows the testers partial knowledge of the systems they are trying to penetrate in accelerate of their attack to streamline costs and focus efforts?

  • Red Box Testing
  • Grey Box Testing
  • White Box testing
  • Black Box Testing

Question 163)

Which type of awarding attack would include User denies performing an operation, attacker exploits an awarding without trace, and assaulter covers her tracks?

  • Auditing and logging
  • Hallmark
  • Authorization
  • Input validation

Question 164)

True or False. Thorough reconnaissance is an important step in developing an constructive cyber kill concatenation.

  • True
  • False

Question 165)

True or False. One of the primary challenges in cyber threat hunting is a lack of useful tools sold by as well few vendors.

  • True
  • False

Question 166)

True or False. A large company has a information alienation involving the theft of employee personnel records but no customer data of whatsoever kind. Since no external data was involved, the company does not have to report the alienation to police force enforcement.

  • True
  • False

Question 167)

You are the CEO of a large tech company and have just received an angry email that looks like it came from ane of your biggest customers. The email says your company is overbilling the client and asks that you examine the attached invoice. You do but observe it bare, so you answer politely to the sender asking for more details. Y'all never hear dorsum, just a week later your security team tells you that your credentials accept been used to access and exfiltrate large amounts of company financial data. What kind of assault did you lot fall victim to?

  • As a phishing attack
  • As a whale attack
  • A shark assail
  • A wing phishing attack

Question 168)

Which of these statements virtually the PCI-DSS requirements for any company handling, processing or transmitting credit card data is truthful?

  • Muti-factor authentication is required for all new card holders
  • Some form of mobile device direction (MDM) must be used on all mobile credit carte processing devices
  • All employees with direct access to cardholder data must be bonded
  • Cardholder information must be encrypted if it is sent beyond open or public networks

Which Incident Response Squad model describes a team that acts as consulting experts to advise local IR teams?

  • Control
  • Coordinating
  • Distributed
  • O Central

In a Linux file organization, which files are contained in the \bin binder?

  • All user binary files, their libraries and headers
  • Executable files such equally grep and ping
  • Configuration files such as fstab and inittab
  • Directories such every bit /abode and /usr

If a computer needs to send a bulletin to a system that is not part of the local network, where does it send the message?

  • To the system's domain name
  • To the system'southward IP address
  • The network's DNS server address
  • To the system'southward MAC address
  • The network'due south default gateway address
  • The network's DHCP server address

Which iii (3) of these statements about the TCP protocol are Truthful? (Select iii)

  • TCP is faster than UDP
  • TCP is connexion-oriented
  • TCP packets are reassembled by the receiving system in the social club in which they were sent
  • TCP is more than reliable than UDP

A professor is not immune to change a pupil's final grade after she submits it without completing a special form to explicate the circumstances that necessitated the alter. This additional step supports which aspect of the CIA Triad?

  • Authorization
  • Integrity
  • Confidentiality
  • Availability

Which of these is the best definition of a security risk?

  • An instance of existence exposed to losses
  • Whatever potential danger that is associated with the exploitation of a vulnerability
  • A weakness in a system
  • The likelihood of a threat source exploiting a vulnerability

Trudy intercepts a plain text message sent by Alice to Bob, but in no mode interferes with its delivery. Which aspect of the CIA Triad was violated?

  • Confidentiality
  • Integrity
  • Availability
  • All of the above

What is an advantage symmetric key encryption has over disproportionate cardinal encryption?

  • Symmetric central encryption provides meliorate security against Man-in-the-center attacks than is possible with asymmetric key encryption
  • Symmetric primal encryption is faster than asymmetric primal encryption
  • Symmetric keys can be exchanged more securely than disproportionate keys
  • Symmetric cardinal encryption is harder to pause than asymmetric key encryption

Which type of application assail would include network eavesdropping, dictionary attacks and cookie replays?

  • Configuration management
  • Authentication
  • Authorization
  • Exception management

Why should you always look for mutual patterns before starting a new security architecture design?

  • They can assist identify best practices
  • They tin can shorten the development lifecycle
  • Some document consummate tested solutions
  • All of the to a higher place

Last Update: 09/12/2021

Alert: Jo Reply Light-green hai wo right hai but

Jo Light-green Nahi hai. Usme se jo ek wrong selection tha usko hata diya hai

PLEASE WAIT I Will Add together MORE NEW QUETIONS..

Too if you have Questions with right answer  Transport me on my Email i volition update on my blog..

niyander111@gmail.com

Thanks...