IBM Cybersecurity Analyst Professional Certificate Assessment Exam Answers

IBM Cybersecurity Analyst Professional Certificate Assessment Exam Quiz Answers

Warning: Jo Answer Green hai wo correct hai but

Jo Dark-green Nahi hai. Usme se jo ek wrong choice tha usko hata diya hai

Question 1)

Implementing a Security Sensation preparation plan would be an example of which type of control?

  • Administrative command

Question ii)

Putting locks on a door is an instance of which type of control?

  • Preventative

Question three)

How would you classify a piece of malicious lawmaking that tin can replicate itself and spread to new systems?

  • A worm

Question 4)

To engage in packet sniffing, you must implement promiscuous mode on which device ?

  • A network carte
  • An Intrusion Detection System (IDS)
  • A sniffing router

Question 5)

Which machinery would help assure the integrity of a message, merely not practice much to assure confidentiality or availability.

  • Hashing

Question 6)

An organization wants to restrict employee after-hours access to its systems then it publishes a policy forbidding employees to work outside of their assigned hours, and then makes certain the part doors remain locked on weekends. What two (2) types of controls are they using? (Select 2)

  • Physical
  • Authoritative

Question 7)

Which 2 factors contribute to cryptographic strength? (Select 2)

  • The use of cyphers that are based on complex mathematical algorithms
  • The use of cyphers that have undergone public scrutiny

Question 8)

Trying to break an encryption key by trying every possible combination of characters is chosen what?

  • A creature forcefulness attack

Question 9)

Which of the following describes the core goals of IT security?

  • The Open Spider web Application Security Project (OWASP) Framework
  • The Business organization Process Management Framework
  • The CIA Triad

Question 10)

Which three (3) roles are typically establish in an Data Security organization? (Select iii)

  • Vulnerability Assessor
  • Chief Information Security Officer (CISO)
  • Penetration Tester

Question 11)

Problem Management, Change Management, and Incident Direction are all central processes of which framework?

  • ITIL

Question 12)

Alice sends a message to Bob that is intercepted by Trudy. Which scenario describes an integrity violation?

  • Trudy changes the bulletin and so forwards it on
  • Trudy deletes the message without forwarding it
  • Trudy reads the message
  • Trudy cannot read it because it is encrypted but allows it to be delivered to Bob in its original form

Question xiii)

In cybersecurity, Accountability is defined as what?

  • Existence able to map an activity to an identity

Question 14)

Multifactor hallmark (MFA) requires more than than one authentication method to exist used before identity is authenticated. Which 3 (three) are authentication methods? (Select 3)

  • Something a person is
  • Something a person has
  • Something a person knows

Question 15)

Which three (iii) of the post-obit are Concrete Admission Controls? (Select three)

  • Door locks
  • Security guards
  • Fences

Question sixteen)

If you are setting upwardly a Windows x laptop with a 32Gb hard drive, which ii (2) file system could you select? (Select ii)

  • NTFS
  • FAT32

Question 17)

Which three (3) permissions tin can exist fix on a file in Linux? (Select 3)

  • write
  • execute
  • read

Question 18)

If cost is the chief business concern, which type of deject should be considered commencement?

  • Public cloud

Question 19)

Consolidating and virtualizing workloads should be done when?

  • Before moving the workloads to the cloud

Question 20)

Which of the following is a self-regulating standard prepare past the credit card industry in the US?

  • PCI-DSS

Question 21)

Which two (2) of the following attack types target endpoints?

  • Ad Network
  • Spear Phishing

Question 22)

If an Endpoint Detection and Response (EDR) organisation detects that an endpoint does not take a required patch installed, which statement all-time characterizes the deportment it is able to take automatically?

  • The endpoint can exist quarantined from all network resources except those that permit information technology to download and install the missing patch

Question 23)

Granting access to a user based upon how high upwardly he is in an organization violates what bones security premise?

  • The principle of least privileges

Question 24)

The Windows Security App available in Windows 10 provides uses with which of the following protections?

  • Firewall and network protection
  • Family options (parental controls)
  • All of the to a higher place

Question 25)

Hashing ensures which of the post-obit?

  • Integrity

Question 26)

Which of the following practices helps assure the all-time results when implementing encryption?

  • Choose a reliable and proven published algorithm
  • Develop a unique cryptographic algorithm for your organization and proceed them secret

Question 27)

Which of these methods ensures the authentication, non-repudiation and integrity of a digital communication?

  • Use of digital signatures

Question 28)

Which of the following practices will assist assure the confidentiality of data in transit?

  • Disable certificate pinning
  • Take self-signed certificates
  • Implement HTTP Strict Transport Protocol (HSTS)

Question 29)

Which three (3) of these are benefits you tin realize from using a NAT (Network Address Translation) router? (Select 3)

  • Allows static 1-to-1 mapping of local IP addresses to global IP addresses
  • Allows dynamic mapping of many local IP addresses to a smaller number of global IP address simply when they are needed
  • Allows internal IP addresses to be hidden from exterior observers

Question thirty)

Which statement best describes configuring a NAT router to use static mapping?

  • The organization will need as many registered IP addresses equally it has computers that need Internet admission

Question 31)

If a calculator needs to send a bulletin to a system that is part of the local network, where does it ship the message?

  • To the system's MAC accost

Question 32)

Which are properties of a highly available organization?

  • Redundancy, failover and monitoring

Question 33)

Which 3 (3) of these statements about the UDP protocol are True? (Select 3)

  • UDP is faster than TCP
  • UDP packets are reassembled by the receiving system in any order they are received
  • UDP is connectionless

Question 34)

What is one difference betwixt a Stateful Firewall and a Next Generation Firewall?

  • A NGFW understand which application sent a given packet

Question 35)

You are concerned that your organization is really not very experienced with securing data sources. Which hosting model would require you lot to secure the fewest data sources?

  • SaaS

Question 36)

Hassan is an engineer who works a normal day shift from his visitor's headquarters in Austin, TX United states of america. Which two (2) of these activities raise the most cause for concern? (Select 2)

  • Each night Hassan logs into his account from an ISP in China
  • One evening, Hassan downloads all of the files associated with the new product he is working on

Question 37)

Which three (three) of the following are considered safe coding practices? (Select 3)

  • Use library functions in place of Os commands
  • Avoid using OS commands whenever possible
  • Avoid running commands through a crush interpreter

Question 38)

Which three (three) items should be included in the Planning footstep of a penetration examination? (Select 3)

  • Informing Need-to-know employees
  • Establishing Boundaries
  • Setting Objectives

Question 39)

Which portion of the pentest study would encompass the risk ranking, recommendations and roadmap?

  • Executive Summary

Question 40)

Spare workstations and servers, blank removable media, parcel sniffers and protocol analyzers, all belong to which Incident Response resource category?

  • Incident Postal service-Analysis Resources
  • Incident Analysis Hardware and Software

Question 41)

NIST recommends because a number of items, including a high level of testing and monitoring, during which phase of a comprehensive Containment, Eradication & Recovery strategy?

  • Recovery

Question 42)

True or Fake. Digital forensics is effective in solving cyber crimes but is non considered effective in solving violent crimes such equally rape and murder.

  • False

Question 43)

Which 3 (iii) are common obstacles faced when trying to examine forensic data? (Select 3)

  • Selecting the right tools to help filter and exclude irrelevant data
  • Finding the relevant files amidst the hundreds of thousands found on virtually hard drives
  • Bypassing controls such as passwords

Question 44)

What scripting concept will repeatedly execute the same block of code while a specified status remains true?

  • Loops

Question 45)

Which two (2) statements about Python are truthful? (Select 2)

  • Python code is considered piece of cake to debug compared with other popular programming languages
  • Python code is considered very readable by novice programmers

Question 46)

In the Python statement

pi="3"

What data type is the information blazon of the variable pi?

  • str

Question 47)

What volition be printed past the following block of Python code?

def Add5(in)

 out=in+v

 return out

 print(Add5(x))

  • xv

Question 48)

Which threat intelligence framework was developed by the United states Government to enable consistent characterization and categorization of cyberthreat events?

  • Cyber Threat Framework

Question 49)

True or False. An arrangement's security allowed organisation should exist integrated with outside organizations, including vendors and other third-parties.

  • True

Question l)

Which three (3) of these are among the top 12 capabilities that a skilful data security and protection solution should provide? (Select iii)

  • Vulnerability assessment
  • Real-time alerting
  • Tokenization

Question 51)

True or Simulated. For iOS and Android mobile devices, users must interact with the operating organization simply through a series of applications, just not directly.

  • Truthful

Question 52)

All industries have their own unique information security challenges. Which of these industries has a item business organisation with PCI-DSS compliance while having a big number of admission points staffed by depression-level employees who accept access to payment bill of fare data?

  • Retail

Question 53)

True or False. WireShark has an impressive array of features and is distributed free of accuse.

  • Truthful

Question 54)

In which component of a Common Vulnerability Score (CVSS) would privileges required be reflected?

  • Base of operations-Exploitability Subscore

Question 55)

The Decommission step in the DevSecOps Release, Deploy & Decommission stage contains which of these activities?

  • IAM controls to regulate potency

Question 56)

You calculate that there is a 2% probability that a cybercriminal will be able to steal credit card numbers from your online storefront which will result in $10M in losses to your company. What have you just determined?

  • A hazard

Question 57)

Which i of the OWASP Top 10 Application Security Risks would exist occur when an awarding's API exposes financial, healthcare or other PII data?

  • Sensitive data exposure

Question 58)

Which three (3) of these are Solution Building Blocks (SBBs)? (Select 3)

  • Virus Protection
  • Application Firewall
  • Spam Filter

Question 59)

A robust cybersecurity defence includes contributions from 3 areas, human expertise, security analytics and bogus intelligence. Quickly analyzing large quantities of unstructured data lends itself best to which of these areas?

  • Artificial intelligence

Question sixty)

The triad of a security operations centers (SOC) is People, Process and Technology. Which part of the triad would network monitoring vest?

  • Technology

Question 61)

Which of these is a good definition for cyber threat hunting?

  • The deed of proactively and aggressively identifying, intercepting, tracking, investigating and eliminating cyber adversaries as early as possible in the cyber impale chain

Question 62)

There is value brought by each of the IBM i2 Environmental impact assessment apply cases. Which one of these provides firsthand alerting on brand compromises and fraud on the dark spider web.

  • Threat Discovery

.

Question 63)

Which three (3) soft skills are important to take in an system's incident response team? (Select 3)

  • Communication
  • Teamwork
  • Problem solving and Critical thinking

Question 64)

Implementing strong endpoint detection and mitigation strategies falls into which phase of the incident response lifecycle?

  • Detection & Analysis

Question 65)

Which three (three) of these statistics about phishing attacks are real? (Select 3)

  • Effectually fifteen one thousand thousand new phishing sites are created each month
  • Phishing accounts for almost 20% of data breaches
  • thirty% of phishing messages are opened by their targeted users

Question 66)

Which three (3) of these command processes are included in the PCI-DSS standard? (Select 3)

  • Implement stiff admission control measures
  • Regularly monitor and examination networks
  • Maintain an data security policy

Question 67)

Which three (3) are malware types usually used in PoS attacks to steal credit card information? (Select three)

  • Alina
  • BlackPOS
  • vSkimmer

Question 68)

According to a 2019 Ponemon report, what per centum of consumers indicated they would be willing to pay more for a production or service from a provider with improve security?

  • 52%

Question 69)

You lot get a phone phone call from a technician at the "Windows company" who tells you that they have detected a trouble with your system and would like to assistance you resolve it. In social club to help, they need you lot to go to a web site and download a uncomplicated utility that will allow them to fix the settings on your computer. Since yous only ain an Apple tree Mac, yous are suspicious of this caller and hang up. What would the attack vector accept been if you had downloaded the "simple utility" as asked?

  • Remote Desktop Protocol (RDP)

Question seventy)

What is an constructive fully automated mode to prevent malware from inbound your system every bit an email attachment?

  • Anti-virus software

 Question 71)

True or False. The large bulk of stolen credit card numbers are used quickly by the thief or a member of his/her family unit.

  • False

Question 72)

Which three (3) of these are PCI-DSS requirements for whatsoever visitor handling, processing or transmitting credit bill of fare information? (Select iii)

  • Restrict access to cardholder data past business concern need-to-know
  • Assign a unique ID to each person with computer admission
  • Restrict physical access to cardholder data

Question 73)

True or False. Communications of a information breach should exist handled by a team composed of members of the IR squad, legal personnel and public relations.

  • True

Question 74)

A Coordinating incident response team model is characterized past which of the following?

  • Multiple incident response teams inside an organization all of whom coordinate their activities only within their land or section
  • Multiple incident response teams within an arrangement just one with authorisation to assure consistent policies and practices are followed across all teams
  • This term refers to a structure that assures the incident response team's activities are coordinated with senior management and all appropriate departments within and organization

Question 75)

The cyber hunting squad and the SOC analysts are informally referred to as the ____ and ____ teams, respectively.

  • Blueish Ruby
  • Red, Blue

Question 76)

The partnership between security analysts and technology tin be said to be grouped into iii domains, human expertise, security analytics and artificial intelligence. The human expertise domain would contain which three (iii) of these topics?

  • Brainchild
  • Dilemmas
  • Morals

Question 77)

Solution architectures often comprise diagrams like the one below. What does this diagram testify?

<<Solution Architecture Data Flow.png>>

  • Functional components and data flow

Question 78)

Port numbers 1024 through 49151 are known every bit what?

  • Registered Ports

Question 79)

Which layer of the OSI model to packet sniffers operate on?

  • Data Link

Question 80)

True or False. Internal attacks from trusted employees represents every bit every bit significant a threat as external attacks from professional cyber criminals.

  • Truthful

Question 81)

Co-ordinate to the FireEye Mandiant's Security Effectiveness Report 2020, what fraction of security tools are deployed with default settings and thus underperform expectations?

  • 80%

Question 82)

Which country had the highest average toll per breach in 2018 at $8.19M

  • United states of america

Question 83)

Which two (ii) of these Python libraries provides useful statistical functions? (Select 2)

  • StatsModels
  • Scikit-learn

Question 84)

What will impress out when this cake of Python code is run?

i=one

#i=i+ane

#i=i+2

#i=i+3

print(i)

  • i

Question 85)

Which iii (3) statements most Python variables are true? (Select 3)

  • A variable name must start with a letter or the underscore "_" character
  • Variables can change type afterwards they have been set
  • Variables do not have to exist declared in accelerate of their employ

Question 86)

PowerShell is a configuration management framework for which operating arrangement?

  • Windows

Question 87)

In digital forensics documenting the chain of custody of evidence is critical. Which of these should be included in your concatenation of custody log?

  • All of the in a higher place

Question 88)

Forensic analysis should always exist conducted on a copy of the original information. Which two (two) types of copying are appropriate for getting information from a laptop acquired from a terminated employee, if y'all doubtable he has deleted incriminating files? (Select two)

  • An incremental fill-in
  • A logical backup

Question 89)

Which of the post-obit would exist considered an incident precursor?

  • An warning from your antivirus software indicating it had detected malware on your system
  • An announced threat against your organisation past a hactivist group

Question ninety)

If a penetration test calls for y'all to create a diagram of the target network including the identity of hosts and servers too every bit a list of open up ports and published services, which tool would be the best fit for this task?

  • Nmap

Question 91)

Which type of listing is considered best for safe coding practice?

  • Whitelist

Question 92)

In reviewing the security logs for a company's headquarters in New York Urban center, which of these activities should not raise much of a security concern?

  • A recently hired data scientist in the Medical Analytics section has repeatedly attempted to access the corporate fiscal database
  • An employee has started logging in from dwelling for an hour or and then during the last two weeks of each quarter

Question 93)

Data sources such as newspapers, books and web pages are considered which type of data?

  • Unstructured information
  • Semi-structured data
  • Structured data

Question 94)

Which three (3) of these statements about the TCP protocol are True? (Select 3)

  • TCP packets are reassembled past the receiving arrangement in the order in which they were sent
  • TCP is more reliable than UDP
  • TCP is connection-oriented

Question 95)

In IPv4, how many of the 4 octets are used to define the network portion of the address in a Class B network?

  • 2

Question 96)

A small visitor with 25 computers wishes to connect them to the Internet using a NAT router. How many Public IP addresses will this company need to assure all 25 computers tin communicate with each other and other systems on the Net if they implement Port Accost Translations?

  • 1

Question 97)

Why is symmetric key encryption the well-nigh mutual choice of methods to encryptic data at rest?

  • There are far more keys available for use
  • It is much faster than asymmetric key encryption

Question 98)

Which of the following statements most hashing is Truthful?

  • Hashing uses algorithms that are known as "one-way" functions

Question 99)

Why is hashing non a common method used for encrypting data?

  • Hashing is a one-way process so the original data cannot be reconstructed from a hash value

Question 100)

Public key encryption incorporating digital signatures ensures which of the following?

  • Confidentiality and Integrity

Question 101)

What is the main authentication protocol used by Microsoft in Active Directory?

  • Kerberos

Question 102)

Granting access to a user account only those privileges necessary to perform its intended functions is known equally what?

  • The principle of to the lowest degree privileges

Question 103)

What is the most common patch remediation frequency for near organizations?

  • Monthly
  • Annually

Question 104)

Island hopping is an assault method commonly used in which scenario?

  • Supply Chain Infiltration
  • Blocking access to a website for all users
  • Compromising a corporate VIP
  • Trojan Horse attacks

Question 105)

Security training for IT staff is what type of command?

  • Virtual
  • Operational
  • Physical

Question 106)

Which security concerns follow your workload even after it is successfully moved to the cloud?

  • All of the above

Question 107)

Which grade of Cloud calculating combines both public and individual clouds?

  • Hybrid cloud

Question 108)

Which component of the Linux operating system interacts with your computer's hardware?

  • The kernel

Question 109)

The encryption and protocols used to forbid unauthorized access to data are examples of which type of access control?

  • Technical

Question 110)

In cybersecurity, Actuality is defined as what?

  • The property of existence genuine and verifiable

Question 111)

ITIL is best described as what?

  • A collection of IT Service Management best practices

Question 112)

Which position is in charge of testing the security and effectiveness of computer information systems?

  • Information Security Accountant

Question 113)

A visitor wants to forestall employees from wasting time on social media sites. To accomplish this, a document forbidding utilise of these sites while at work is written and circulated and so the firewalls are updated to block access to Facebook, Twitter and other popular sites. Which two (2) types of security controls has the company just implemented? (Select 2)

  • Authoritative
  • Technical

Question 114)

An email bulletin that is encrypted, uses a digital signature and carries a hash value would address which aspects of the CIA Triad?

Confidentiality and Integrity

Question 115)

What would a piece of malicious code that gets installed on a computer and reports back to the controller your keystrokes and other information it can gather from your system be called?

  • Spyware

Question 116)

Fancy Bears and Anonymous are examples of what?

  • Hacking organizations

Question 117)

Select the respond the fills in the blanks in the correct order.

A weakness in a system is a/an ____. The potential danger associated with this is a/an ____ that becomes a/an ____ when attacked by a bad actor.

  • vulnerability, threat, exploit
  • threat, exposure, hazard
  • threat actor, vulnerability, exposure

Question 118)

Implement a filter to remove flooded packets earlier they reach the host is a countermeasure to which form of attack?

  • A Deprival of Service (DoS) attack

Question 119)

Trudy intercepts a romantic plain-text message from Alice to her boyfriend Sam. The message upsets Trudy so she forward it to Bob, making it wait like Alice intended it for Bob from the beginning. Which aspect of the CIA Triad has Trudy violated ?

  • All of the above

Question 120)

Which factor contributes most to the force of an encryption organization?

  • How many people have admission to your public key
  • The length of the encryption key used
  • The number of individual keys used by the system

Question 121)

What is an advantage asymmetric key encryption has over symmetric cardinal encryption?

  • Asymmetric keys can be exchanged more securely than symmetric keys
  • Asymmetric key encryption is harder to suspension than symmetric primal encryption
  • Asymmetric primal encryption is faster than symmetric fundamental encryption

Question 122)

Which position is responsible for the "ethical hacking" of an organizations calculator systems?

  • A Penetration Tester

Question 123)

Which three (iii) are considered all-time practices, baselines or frameworks? (Select 3)

  • ISO27000 series
  • ITIL
  • COBIT

Question 124)

What does the "A" in the CIA Triad stand for?

  • Availability

Question 125)

Which type of access control is based upon the discipline's clearance level and the objects nomenclature?

  • Hierarchical Access Control (HAC)
  • Discretionary Access Control (DAC)
  • Mandatory Admission Control (MAC)
  • Role Based Admission Control (RBAC)

Question 126)

Windows x stores 64-bit applications in which directory?

  • \Program Files

Question 127)

To build a virtual calculating environment, where is the hypervisor installed?

  • Betwixt the applications and the data sources
  • On the deject'south supervisory organisation
  • Between the hardware and operating organisation
  • Between the operating arrangement and applications

Question 128)

An identical email sent to millions of addresses at random would be classified as which type of assault?

  • A Shark attack
  • A Phishing set on

Question 129)

Which statement about drivers running in Windows kernel mode is truthful?

  • Merely critical processes are permitted to run in kernel mode since at that place is nothing to prevent a

Question 130)

Symmetric key encryption by itself ensures which of the following?

  • Confidentiality and Integrity
  • Confidentiality just
  • Confidentiality and Availability

Question 131)

Which statement best describes configuring a NAT router to use dynamic mapping?

  • The organization will need every bit many registered IP addresses equally it has computers that need Internet access
  • Many registered IP addresses are mapped to a single registered IP accost using dissimilar port numbers
  • Unregistered IP addresses are mapped to registered IP addresses as they are needed
  • The NAT router uses each computer's IP accost for both internal and external communication

Question 132)

Which address type does a computer apply to go a new IP address when it boots upward?

  • The network's DHCP server address

Question 133)

What is the primary divergence betwixt the IPv4 and IPv6 addressing schema?

  • IPv6 is significantly faster than IPv4
  • IPv6 is used only for IOT devices
  • IPv6 allows for billions of times as many possible IP addresses

Question 134)

Which type of firewall understands which session a bundle belongs to and analyzes it accordingly?

  • A Side by side Generation Firewall (NGFW)

Question 135)

An employee calls the Information technology Helpdesk and admits that mayhap, just mayhap, the links in the email he clicked on this morning were not from the real Lottery Commission. What is the first thing you lot should tell the employee to do?

  • Run a Port scan
  • Run an antivirus scan

Question 136)

A penetration tester involved in a "Black box" assault would be doing what?

  • Attempting to penetrate a client's systems as if she were an external hacker with no within knowled

Question 137)

Which Post Incident action would be concerned with maintaining the proper concatenation-of-custody?

  • Lessons learned meeting
  • Evidence retentiveness
  • Documentation review & update
  • Utilizing collected data

Question 138)

In digital forensics, which three (3) steps are involved in the collection of data? (Select three)

  • Develop a plan to acquire the data
  • Verify the integrity of the data
  • Learn the data

Question 139)

Which iii (3) of the following are considered scripting languages? (Select 3)

  • Perl
  • Bash
  • Python

Question 140)

What is the largest number that volition exist printed during the execution of this Python while loop?

i=0

while (i<10):

 print(i)

 i=i+1

  • ix

Question 141)

Activities performed as a part of security intelligence can be divided into pre-exploit and mail service-exploit activities. Which ii (ii) of these are post-exploit activities? (Select two)

  • Get together full situational awareness through avant-garde security analytics
  • Perform forensic investigation

Question 142)

At that place are many skillful reasons for maintaining comprehensive backups of critical data. Which aspect of the CIA Triad is most impacted by an organization'southward backup practices?

  • Availability
  • Integrity
  • Authorization

Question 143)

Which phase of DevSecOps would contain the activities Internal/External testing, Continuous assurance, and Compliance checking?

  • Examination
  • Code & build
  • Operate & monitor
  • Plan

Question 144)

Which one of the OWASP Acme ten Awarding Security Risks would be occur when there are no safeguards against a user being immune to execute HTML or JavaScript in the user's browser that can hijack sessions.

  • Cross-site scripting

Question 145)

SIEM license costs are typically calculated based upon which 2 (2) factors? (Select 2)

  • Flows per minute (FPM)
  • Events per second (EPS)

Question 146)

Truthful or Imitation. If yous have no ameliorate place to commencement hunting threats, start with a view of the global threat landscape then drill downwardly to a regional view, manufacture view and finally a view of the threats specific to your ain organization.

  • True

Question 147)

Truthful or False. Cloud-based storage or hosting providers are amidst the pinnacle sources of third-political party breaches

  • True

Question 148)

You are looking very hard on the spider web for the lowest mortgage interest load yous can find and you come beyond a rate that is so depression it could non mayhap exist true. You bank check out the site to encounter that the terms are and quickly observe you are the victim of a ransomware set on. What was the likely set on vector used past the bad actors?

  • Phishing
  • Malicious Links
  • Software Vulnerabilities

Question 149)

Very provocative articles that come upwards in news feeds or Google searches are sometimes called "click-bait". These articles often tempt yous to link to other sites that tin can be infected with malware. What assault vector is used by these click-bait sites to get you to become to the actually bad sites?

  • Malicious Links

More than New Questions

Question 150)

Which of the following defines a security threat?

  • Any potential danger capable of exploiting a weakness in a system
  • The likelihood that the weakness in a system volition be exploited
  • Ane instance of a weakness being exploited
  • A weakness in a system that could be exploited by a bad thespian

Question 151)

Suspicious activeness, like IP addresses or ports beingness scanned sequentially, is a sign of which type of attack?

  • A mapping assail
  • A deprival of service (DoS) assault
  • A phishing assail
  • An IP spoofing assault

Question 152)

Alice sends a message to Bob that is intercepted past Trudy. Which scenario describes a confidentiality violation?

  • Trudy deletes the bulletin without forwarding it
  • Trudy cannot read it considering it is encrypted but allows it to exist delivered to Bob in its original form
  • Trudy changes the bulletin and then forwards information technology on
  • Trudy reads the message

Question 153)

Which regulation contains the security rule that requires all covered entities to maintain reasonable and appropriate administrative, technical, and concrete safeguards for protecting electronic protected wellness information (e-PHI)?

  • PCI-DSS
  • ISO27000 series
  • HIPAA
  • GDPR
  • NIST 800-53A

Question 154)

A good Endpoint Detection and Response system (EDR) should take which three (3) of these capabilities? (Select 3)

  • Automatically quarantine noncompliant endpoints
  • Manage encryption keys for each endpoint
  • Manage thousands of devices at once
  • Deploying devices with network configurations

Question 155)

Which statement about encryption is True about data in use.

  • Data should always be kept encrypted since modern CPUs are fully capable of operating directly on encrypted information
  • It is vulnerable to theft and should exist decrypted only for the briefest possible time while it is being operated on
  • Curt of orchestrating a memory dump from a system crash, there is no practical way for malware to get at the data beingness processed, and so dump logs are your only real concern
  • Data in active retention registers are non at risk of being stolen

Question 156)

For added security you decide to protect your network by conducting both a stateless and stateful inspection of incoming packets. How can this be done?

  • This cannot be washed The network administrator must cull to run a given network segment in either stateful or stateless mode, and and so select the corresponding firewall type
  • Install a single firewall that is capable of conducting both stateless and stateful inspections
  • Install a stateful firewall only These advanced devices inspect everything a stateless firewall inspects in addition to state related factors
  • You must install 2 firewalls in series, so all packets laissez passer through the stateless firewall first and then the stateless firewall

Question 157)

In IPv4, how many of the 4 octets are used to define the network portion of the address in a Course A network?

  • 2
  • 1
  • 4
  • three

Question 158)

If you have to rely upon metadata to work with the data at hand, you are probably working with which type of data?

  • Meta-structured data
  • Semi-structured information
  • Structured data
  • Unstructured data

Question 159)

Which two (2) forms of discovery must be conducted online? (Select 2)

  • Port scanning
  • Shoulder surfing
  • Social engineering
  • Package sniffing

Question 160)

Which Incident Response Squad model describes a squad that runs all incident response activities for a company?

  • Distributed
  • Central
  • Coordinating
  • Command

Question 161)

Which is the data protection process that prevents a suspicious data request from being completed?

  • Data risk assay
  • Data nomenclature
  • Data discovery
  • Blocking, masking and quarantining

Question 162)

Which form of penetration testing allows the testers partial knowledge of the systems they are trying to penetrate in advance of their attack to streamline costs and focus efforts?

  • Red Box Testing
  • Gray Box Testing
  • White Box testing
  • Black Box Testing

Question 163)

Which blazon of application attack would include User denies performing an functioning, aggressor exploits an awarding without trace, and attacker covers her tracks?

  • Auditing and logging
  • Hallmark
  • Authorization
  • Input validation

Question 164)

True or False. Thorough reconnaissance is an of import pace in developing an effective cyber kill chain.

  • True
  • False

Question 165)

True or False. One of the principal challenges in cyber threat hunting is a lack of useful tools sold by besides few vendors.

  • Truthful
  • Imitation

Question 166)

True or Imitation. A large visitor has a data breach involving the theft of employee personnel records but no customer data of whatsoever kind. Since no external data was involved, the company does not accept to report the breach to law enforcement.

  • True
  • False

Question 167)

You are the CEO of a large tech visitor and take just received an angry email that looks similar it came from one of your biggest customers. The e-mail says your company is overbilling the customer and asks that you examine the attached invoice. Yous practice but find information technology blank, so you lot reply politely to the sender request for more than details. You never hear back, but a week later on your security team tells you that your credentials accept been used to access and exfiltrate large amounts of company financial data. What kind of attack did yous autumn victim to?

  • Equally a phishing assault
  • As a whale attack
  • A shark attack
  • A fly phishing attack

Question 168)

Which of these statements about the PCI-DSS requirements for whatsoever visitor handling, processing or transmitting credit card data is true?

  • Muti-factor authentication is required for all new menu holders
  • Some course of mobile device direction (MDM) must be used on all mobile credit card processing devices
  • All employees with direct access to cardholder data must exist bonded
  • Cardholder data must exist encrypted if it is sent beyond open or public networks

Which Incident Response Team model describes a team that acts as consulting experts to advise local IR teams?

  • Command
  • Analogous
  • Distributed
  • O Central

In a Linux file organization, which files are contained in the \bin folder?

  • All user binary files, their libraries and headers
  • Executable files such every bit grep and ping
  • Configuration files such as fstab and inittab
  • Directories such as /home and /usr

If a figurer needs to send a message to a organization that is not part of the local network, where does it send the message?

  • To the system's domain proper name
  • To the system'southward IP address
  • The network's DNS server address
  • To the system'southward MAC address
  • The network's default gateway accost
  • The network'south DHCP server address

Which three (three) of these statements about the TCP protocol are Truthful? (Select 3)

  • TCP is faster than UDP
  • TCP is connection-oriented
  • TCP packets are reassembled past the receiving organization in the order in which they were sent
  • TCP is more than reliable than UDP

A professor is not immune to change a student'southward last grade after she submits information technology without completing a special form to explain the circumstances that necessitated the change. This additional step supports which aspect of the CIA Triad?

  • Dominance
  • Integrity
  • Confidentiality
  • Availability

Which of these is the best definition of a security risk?

  • An instance of existence exposed to losses
  • Any potential danger that is associated with the exploitation of a vulnerability
  • A weakness in a system
  • The likelihood of a threat source exploiting a vulnerability

Trudy intercepts a plain text message sent by Alice to Bob, merely in no way interferes with its delivery. Which aspect of the CIA Triad was violated?

  • Confidentiality
  • Integrity
  • Availability
  • All of the above

What is an advantage symmetric central encryption has over disproportionate central encryption?

  • Symmetric key encryption provides better security against Man-in-the-centre attacks than is possible with disproportionate key encryption
  • Symmetric key encryption is faster than asymmetric key encryption
  • Symmetric keys can be exchanged more than securely than disproportionate keys
  • Symmetric key encryption is harder to intermission than disproportionate key encryption

Which blazon of application attack would include network eavesdropping, lexicon attacks and cookie replays?

  • Configuration direction
  • Authentication
  • Authorization
  • Exception management

Why should you always await for common patterns before starting a new security architecture design?

  • They can assist identify best practices
  • They tin shorten the development lifecycle
  • Some document complete tested solutions
  • All of the above

Last Update: 09/12/2021

Alarm: Jo Respond Green hai wo correct hai simply

Jo Green Nahi hai. Usme se jo ek wrong selection tha usko hata diya hai

PLEASE Expect I WILL Add MORE NEW QUETIONS..

Also if you have Questions with correct answer  Send me on my Email i volition update on my blog..

niyander111@gmail.com

Thanks...