ACI - Mod 7 Part 2

What is an exploit in the context of cybersecurity?

• A technique that enhances security measures

• A method to improve system performance

• An attack technique that takes advantage of a vulnerability

• A software update to fix bugs

Answer explanation

An exploit in the context of cybersecurity is an attack technique that takes advantage of a vulnerability, rather than enhancing security measures or improving system performance.

Which of the following is NOT a potential risk factor associated with exploits?

• Bypass security controls

• Gain unauthorized access

• Execute arbitrary code

• Improve system efficiency

Answer explanation

The correct choice is 'Improve system efficiency' because it is not a potential risk factor associated with exploits, unlike the other options which can lead to security vulnerabilities.

What can outdated cryptographic algorithms in a legacy banking application lead to?

• Enhanced data security

• Decryption of sensitive data by attackers

• Faster transaction processing

• Improved user experience

Answer explanation

Outdated cryptographic algorithms in a legacy banking application can lead to the decryption of sensitive data by attackers, compromising security.

How can exploits be executed?

• Only locally

• Only remotely

• Both locally and remotely

• Only through physical access

Answer explanation

Exploits can be executed both locally and remotely, allowing attackers to take advantage of vulnerabilities in a system from different locations.

What is a consequence of using a legacy banking application with outdated security patches?

• Increased system performance

• Enhanced user interface

• Vulnerability to exploits

• Improved encryption protocols

Answer explanation

Using a legacy banking application with outdated security patches leads to vulnerability to exploits due to the lack of protection against new threats.

What is the primary cause of the unusual network activity and unauthorized access to sensitive files in the given scenario?

• External hacker

• Internal threat actor

• Software bug

• Network malfunction

Answer explanation

The primary cause of the unusual network activity and unauthorized access to sensitive files is an internal threat actor, as indicated by the scenario.

What is the first step a network administrator should take in response to an internal threat actor?

• Preserve evidence

• Initiate an internal investigation

• Isolate the employee's access

• Notify the media

Answer explanation

The first step a network administrator should take in response to an internal threat actor is to isolate the employee's access to prevent further damage or unauthorized actions.

Why is it important to preserve evidence of the employee's activities?

• To alert the employee

• To ensure a thorough investigation

• To immediately terminate the employee

• To notify the media

Answer explanation

To ensure a thorough investigation

Who should collaborate to initiate an internal investigation?

• The network administrator alone

• The organization's security team, human resources, and legal department

• The employee's colleagues

• External consultants

Answer explanation

The organization's security team, human resources, and legal department should collaborate to initiate an internal investigation to ensure a comprehensive and thorough process involving different expertise and perspectives.

What is the purpose of assessing the impact of an employee's actions?

• To identify the employee's motives

• To determine the scope, extent of data exposure, and potential vulnerabilities

• To inform management and stakeholders

• To conduct a post-incident review

Answer explanation

To determine the scope, extent of data exposure, and potential vulnerabilities