First_Test_Ver_A

Charlotte and David are on a mission to protect their critical business application running on a Windows Server 2012. What's the best strategy they should adopt?

• Isolation

• Segmentation

• Hardening

• Decommissioning

Answer explanation

Segmentation is the best approach for handling a critical business application on a legacy server, as it isolates the application from other network segments, reducing the risk of vulnerabilities and ensuring better security.

Oh no! A hurricane named Olivia just hit your data center while you were on a tropical vacation. Which of the following plans should Jackson use immediately after the disaster to ensure essential public services keep running smoothly?

• BCP

• Communication Plan

• DRP

• IRP

Answer explanation

A cyber security disaster recovery plan after a hurricane should prioritize data protection, system restoration, and secure access control by focusing on pre-storm data backups, offsite storage, secure remote access, damage assessment, and gradual system restoration, all while maintaining heightened vigilance against potential cyber threats that may arise during the recovery process.

Elijah and Noah are on a mission to boost the security defenses of their organization after discovering that sensitive data might be sneaking out of their network. What superhero tool could they use to thwart the data villains and save the day?

• XDR

• SPF

• DLP

• DMARC

Answer explanation

(XDR) Extended Detection and Response - gathers threat data from various security tools across an organization's technology stack, allowing for a more unified and efficient way to detect, investigate, and respond to cyber threats

(SPF) Sender Policy Framework - prevent email spoofing and phishing attacks.

(DMARC) Domain-based Message Authentication, Reporting, and Conformance - email security protocol that helps prevent malicious emails. DMARC works by verifying email senders and protecting domains from fraudulent email.

(DLP) Data Loss Prevention - set of tools and strategies designed to detect and prevent the unauthorized access, use, or transmission of sensitive data within an organization, essentially safeguarding against data breaches by monitoring and blocking the movement of critical information like personal details or confidential business data.

One day, Mason from the sales department decided to set up his own product management software without asking for permission first. What would you call this sneaky move?

• Shadow IT

• Insider Threat

• Data Exfiltration

• Service Disruption

Answer explanation

Shadow IT is the use of IT systems, software, or devices without the approval of the IT department. It can include cloud services, hardware, and applications.

Insider Threat is someone with authorized access to the network, who, intentionally or unintentionally uses that access to harm the organization by stealing data, disrupting operations, or compromising sensitive information.

Data Exfiltration is the unauthorized copying, transfer, or retrieval of data from a device or server. It's a type of security breach that can involve personal data, financial records, and intellectual property.

Service Disruption is an event that causes a significant interruption or unavailability of a digital service, preventing users from accessing or utilizing it normally, often due to a cyber attack that overwhelms the system with traffic or compromises its functionality.

Elijah and Mia are diving into the world of network analysis! While examining a PCAP file, they stumble upon protocols like SIP, RTP, and SRTP. What exciting field are these protocols associated with?

• RTOS

• VoIP

• SOC

• HVAC

Answer explanation

Voice over Internet Protocol (VoIP) uses a variety of protocols, including Session Initiation Protocol (SIP), Real-time Transport Protocol (RTP), and Secure Real-time Transport Protocol (SRTP)

The most commonly used protocol in HVAC systems is BACnet (Building Automation and Control Network)

(RTOS) Real Time OS and (SOC) Security Operations Center don't really use any specific protocols.

Abigail, your SOC analyst, just informed you about a sneaky new tactic hackers are using to infiltrate networks.

Unfortunately, SIEM alerts haven't been set up yet. What adventurous step will you take to uncover if these tactics have been used against your network?

• Digital Forensics

• E-Discovery

• IR

• Threat Hunting

Answer explanation

Digital forensics is the practice of collecting, analyzing, and preserving digital evidence

E-Discovery is a legal process that involves gathering and reviewing electronic information to use as evidence in a legal case

Incident Response is the organized process an organization takes to detect, analyze, contain, and remediate cyber threats or security breaches once they occur, aiming to minimize damage and recover quickly

Threat Hunting is a proactive approach where security professionals actively search through an organization's network and systems to identify potential cyber threats that might have evaded traditional security measures

Imagine you're launching a new web product called "Luna's Galactic Adventure". Your Chief Information Security Space Officer (CISSO), Michael, has tasked you with ensuring that the product is shielded from cosmic attackers using malformed packets or invalid inputs to destabilize the system. How would you test that Michael's request has been satisfied?

• Fuzzing

• Continuous Deployment

• Static Code Analysis

• Manual Peer Review

Answer explanation

Fuzzing is an automated software testing technique where a program is bombarded with random, invalid, or unexpected data inputs to intentionally trigger errors or crashes, thereby identifying potential security vulnerabilities in the software that malicious actors could exploit

Continuous Deployment refers to a software development practice where code changes are automatically pushed to a live production environment after passing automated tests

Static code analysis, also known as static application security testing (SAST), is a method for analyzing code without running it to find security vulnerabilities

Manual Peer Review is the process where a security professional manually examines another colleague's security work, like a penetration test report, security configuration, or code, to identify potential vulnerabilities or weaknesses by carefully reviewing details that might be missed by automated tools

During a thrilling red team exercise, Zoe discovered that your network is vulnerable to a sneaky MAC flooding attack! How would you heroically defend against this digital deluge?

• Load Balancer

• Port Security

• NGFW

• IPS

Answer explanation

A Load Balancer is a device or software that distributes network traffic across multiple servers

Port Security is a network security feature that restricts access to a specific physical port on a network switch by only allowing devices with pre-defined MAC addresses to connect

(NGFW) Next-Generation Firewall is a network security device that protects networks from cyber threats

(IPS) Intrusion Protection System is a network security tool that actively monitors network traffic for malicious activity and takes immediate action to block or mitigate potential threats, such as by terminating connections or removing harmful content, to protect the network's integrity and security

***MAC flooding is a Layer 2 attack where a switch's MAC address table is overwhelmed with fake MAC addresses. This forces the switch to flood traffic out all ports, potentially exposing sensitive data.

***An IPS operates at Layers 3-7, analyzing and inspecting traffic for malicious patterns and anomalies such as known exploits, signature-based attacks, or unusual traffic behaviors.

***NGFWs operate primarily at Layers 3 and above, focusing on advanced traffic filtering, application control, intrusion prevention, and malware detection.

Arjun and Priya are security administrators on a mission to save their server from vulnerabilities! What is the biggest challenge they face when trying to tackle CVEs identified on their server?

• Rescanning Requirements

• Patch Availability

• Organizational Impact

• Risk Tolerance

Answer explanation

Explanation:Patching vulnerabilities can disrupt critical business operations, especially in environments where uptime is prioritized (e.g., hospitals, financial institutions). Organizations may delay patching to avoid potential service outages or compatibility issues with existing systems.

• Example: A patch might require a server reboot, which could cause downtime for a critical application that the business relies on.

• Why It’s the Biggest Holdback: Even when patches are available and risks are understood, business needs often override the urgency of applying updates. Change management processes, testing requirements, and fear of unintended consequences can significantly delay addressing CVEs.

Imagine you're the captain of a team of tech-savvy adventurers, including Anika, Olivia, and Benjamin, on a quest to deploy a magical load balancer in your kingdom's cloud realm. What is the most likely security enchantment that this magical project provides?

• Privacy

• Integrity

• Confidentiality

• Availability

Answer explanation

Privacy is the protection of personal information from unauthorized access

Integrity the assurance that data remains accurate, complete, and unaltered

Confidentiality is the practice of protecting sensitive information from unauthorized access or disclosure

Availability is the ability to access information and systems when needed, even in the face of a disaster or cyberattack