IBM Cybersecurity Analyst Professional Certificate Assessment Exam Answers

IBM Cybersecurity Annotator Professional person Certificate Assessment Exam Quiz Answers

Warning: Jo Reply Green hai wo correct hai but

Jo Dark-green Nahi hai. Usme se jo ek wrong option tha usko hata diya hai

Question ane)

Implementing a Security Awareness training plan would be an case of which blazon of control?

  • Administrative control

Question ii)

Putting locks on a door is an example of which type of command?

  • Preventative

Question 3)

How would you lot classify a piece of malicious code that can replicate itself and spread to new systems?

  • A worm

Question four)

To appoint in parcel sniffing, y'all must implement promiscuous fashion on which device ?

  • A network card
  • An Intrusion Detection Organisation (IDS)
  • A sniffing router

Question 5)

Which mechanism would assist assure the integrity of a bulletin, but not practice much to assure confidentiality or availability.

  • Hashing

Question 6)

An system wants to restrict employee after-hours admission to its systems so it publishes a policy forbidding employees to work outside of their assigned hours, and then makes sure the function doors remain locked on weekends. What two (2) types of controls are they using? (Select ii)

  • Physical
  • Administrative

Question 7)

Which two factors contribute to cryptographic strength? (Select two)

  • The use of cyphers that are based on complex mathematical algorithms
  • The use of cyphers that take undergone public scrutiny

Question 8)

Trying to break an encryption key by trying every possible combination of characters is called what?

  • A brute force set on

Question nine)

Which of the following describes the cadre goals of IT security?

  • The Open Web Awarding Security Project (OWASP) Framework
  • The Business Process Management Framework
  • The CIA Triad

Question 10)

Which three (3) roles are typically found in an Information Security organization? (Select three)

  • Vulnerability Assessor
  • Chief Information Security Officer (CISO)
  • Penetration Tester

Question xi)

Problem Direction, Change Direction, and Incident Management are all key processes of which framework?

  • ITIL

Question 12)

Alice sends a bulletin to Bob that is intercepted by Trudy. Which scenario describes an integrity violation?

  • Trudy changes the message and then forwards it on
  • Trudy deletes the message without forwarding information technology
  • Trudy reads the message
  • Trudy cannot read it considering it is encrypted but allows it to exist delivered to Bob in its original grade

Question 13)

In cybersecurity, Accountability is defined equally what?

  • Being able to map an activity to an identity

Question fourteen)

Multifactor hallmark (MFA) requires more than 1 authentication method to be used earlier identity is authenticated. Which three (iii) are authentication methods? (Select iii)

  • Something a person is
  • Something a person has
  • Something a person knows

Question 15)

Which iii (3) of the following are Physical Access Controls? (Select 3)

  • Door locks
  • Security guards
  • Fences

Question 16)

If you are setting upward a Windows ten laptop with a 32Gb difficult bulldoze, which two (2) file system could yous select? (Select 2)

  • NTFS
  • FAT32

Question 17)

Which three (iii) permissions tin be attack a file in Linux? (Select 3)

  • write
  • execute
  • read

Question 18)

If cost is the primary business concern, which blazon of cloud should be considered starting time?

  • Public cloud

Question 19)

Consolidating and virtualizing workloads should be done when?

  • Earlier moving the workloads to the deject

Question 20)

Which of the following is a self-regulating standard prepare by the credit carte du jour industry in the US?

  • PCI-DSS

Question 21)

Which two (two) of the following set on types target endpoints?

  • Ad Network
  • Spear Phishing

Question 22)

If an Endpoint Detection and Response (EDR) organization detects that an endpoint does not accept a required patch installed, which statement all-time characterizes the actions it is able to have automatically?

  • The endpoint tin can be quarantined from all network resources except those that allow it to download and install the missing patch

Question 23)

Granting access to a user based upon how loftier up he is in an organization violates what basic security premise?

  • The principle of to the lowest degree privileges

Question 24)

The Windows Security App bachelor in Windows 10 provides uses with which of the post-obit protections?

  • Firewall and network protection
  • Family unit options (parental controls)
  • All of the above

Question 25)

Hashing ensures which of the following?

  • Integrity

Question 26)

Which of the following practices helps clinch the best results when implementing encryption?

  • Choose a reliable and proven published algorithm
  • Develop a unique cryptographic algorithm for your arrangement and keep them hole-and-corner

Question 27)

Which of these methods ensures the authentication, non-repudiation and integrity of a digital communication?

  • Use of digital signatures

Question 28)

Which of the following practices will help clinch the confidentiality of data in transit?

  • Disable certificate pinning
  • Accept self-signed certificates
  • Implement HTTP Strict Transport Protocol (HSTS)

Question 29)

Which three (3) of these are benefits you tin can realize from using a NAT (Network Address Translation) router? (Select 3)

  • Allows static 1-to-1 mapping of local IP addresses to global IP addresses
  • Allows dynamic mapping of many local IP addresses to a smaller number of global IP address only when they are needed
  • Allows internal IP addresses to be subconscious from exterior observers

Question 30)

Which statement best describes configuring a NAT router to use static mapping?

  • The organisation will need as many registered IP addresses as information technology has computers that need Net admission

Question 31)

If a computer needs to ship a message to a system that is part of the local network, where does information technology send the bulletin?

  • To the system'due south MAC accost

Question 32)

Which are properties of a highly available system?

  • Back-up, failover and monitoring

Question 33)

Which three (3) of these statements about the UDP protocol are True? (Select three)

  • UDP is faster than TCP
  • UDP packets are reassembled by the receiving system in whatever order they are received
  • UDP is connectionless

Question 34)

What is i deviation between a Stateful Firewall and a Next Generation Firewall?

  • A NGFW understand which application sent a given parcel

Question 35)

You are concerned that your organisation is really not very experienced with securing data sources. Which hosting model would crave you to secure the fewest data sources?

  • SaaS

Question 36)

Hassan is an engineer who works a normal twenty-four hour period shift from his company'due south headquarters in Austin, TX Us. Which ii (2) of these activities heighten the most cause for business organization? (Select 2)

  • Each night Hassan logs into his business relationship from an Internet service provider in Cathay
  • One evening, Hassan downloads all of the files associated with the new product he is working on

Question 37)

Which iii (3) of the following are considered rubber coding practices? (Select 3)

  • Use library functions in place of Bone commands
  • Avoid using OS commands whenever possible
  • Avoid running commands through a beat interpreter

Question 38)

Which three (3) items should be included in the Planning step of a penetration exam? (Select three)

  • Informing Need-to-know employees
  • Establishing Boundaries
  • Setting Objectives

Question 39)

Which portion of the pentest report would embrace the run a risk ranking, recommendations and roadmap?

  • Executive Summary

Question 40)

Spare workstations and servers, blank removable media, packet sniffers and protocol analyzers, all belong to which Incident Response resource category?

  • Incident Mail-Analysis Resources
  • Incident Analysis Hardware and Software

Question 41)

NIST recommends because a number of items, including a loftier level of testing and monitoring, during which stage of a comprehensive Containment, Eradication & Recovery strategy?

  • Recovery

Question 42)

True or False. Digital forensics is effective in solving cyber crimes simply is not considered effective in solving violent crimes such as rape and murder.

  • False

Question 43)

Which 3 (three) are mutual obstacles faced when trying to examine forensic information? (Select iii)

  • Selecting the right tools to help filter and exclude irrelevant information
  • Finding the relevant files among the hundreds of thousands institute on most difficult drives
  • Bypassing controls such equally passwords

Question 44)

What scripting concept will repeatedly execute the aforementioned block of lawmaking while a specified condition remains true?

  • Loops

Question 45)

Which two (two) statements nearly Python are true? (Select 2)

  • Python code is considered easy to debug compared with other pop programming languages
  • Python lawmaking is considered very readable by novice programmers

Question 46)

In the Python statement

pi="3"

What data type is the information type of the variable pi?

  • str

Question 47)

What will exist printed by the following block of Python lawmaking?

def Add5(in)

 out=in+v

 return out

 print(Add5(ten))

  • 15

Question 48)

Which threat intelligence framework was developed by the US Government to enable consequent characterization and categorization of cyberthreat events?

  • Cyber Threat Framework

Question 49)

True or False. An organization's security allowed system should exist integrated with exterior organizations, including vendors and other 3rd-parties.

  • True

Question 50)

Which three (3) of these are among the pinnacle 12 capabilities that a adept data security and protection solution should provide? (Select 3)

  • Vulnerability assessment
  • Real-time alerting
  • Tokenization

Question 51)

True or False. For iOS and Android mobile devices, users must interact with the operating system but through a series of applications, only not direct.

  • True

Question 52)

All industries have their own unique information security challenges. Which of these industries has a particular business organization with PCI-DSS compliance while having a big number of admission points staffed by low-level employees who take access to payment card information?

  • Retail

Question 53)

True or False. WireShark has an impressive array of features and is distributed free of charge.

  • True

Question 54)

In which component of a Mutual Vulnerability Score (CVSS) would privileges required be reflected?

  • Base-Exploitability Subscore

Question 55)

The Decommission step in the DevSecOps Release, Deploy & Decommission phase contains which of these activities?

  • IAM controls to regulate dominance

Question 56)

Yous calculate that at that place is a 2% probability that a cybercriminal will be able to steal credit card numbers from your online storefront which volition effect in $10M in losses to your visitor. What take you but determined?

  • A gamble

Question 57)

Which one of the OWASP Top 10 Awarding Security Risks would be occur when an application'southward API exposes financial, healthcare or other PII information?

  • Sensitive data exposure

Question 58)

Which three (three) of these are Solution Building Blocks (SBBs)? (Select 3)

  • Virus Protection
  • Application Firewall
  • Spam Filter

Question 59)

A robust cybersecurity defense includes contributions from 3 areas, human expertise, security analytics and bogus intelligence. Rapidly analyzing large quantities of unstructured data lends itself best to which of these areas?

  • Artificial intelligence

Question threescore)

The triad of a security operations centers (SOC) is People, Process and Engineering. Which part of the triad would network monitoring belong?

  • Engineering

Question 61)

Which of these is a practiced definition for cyber threat hunting?

  • The act of proactively and aggressively identifying, intercepting, tracking, investigating and eliminating cyber adversaries equally early as possible in the cyber impale chain

Question 62)

At that place is value brought by each of the IBM i2 EIA use cases. Which one of these provides immediate alerting on brand compromises and fraud on the night web.

  • Threat Discovery

.

Question 63)

Which 3 (iii) soft skills are important to have in an organization's incident response team? (Select iii)

  • Communication
  • Teamwork
  • Problem solving and Critical thinking

Question 64)

Implementing strong endpoint detection and mitigation strategies falls into which stage of the incident response lifecycle?

  • Detection & Assay

Question 65)

Which three (three) of these statistics about phishing attacks are real? (Select 3)

  • Around 15 million new phishing sites are created each calendar month
  • Phishing accounts for most xx% of data breaches
  • xxx% of phishing messages are opened by their targeted users

Question 66)

Which three (3) of these control processes are included in the PCI-DSS standard? (Select 3)

  • Implement stiff access command measures
  • Regularly monitor and test networks
  • Maintain an information security policy

Question 67)

Which three (3) are malware types commonly used in PoS attacks to steal credit card data? (Select 3)

  • Alina
  • BlackPOS
  • vSkimmer

Question 68)

According to a 2019 Ponemon study, what percent of consumers indicated they would exist willing to pay more than for a product or service from a provider with better security?

  • 52%

Question 69)

Y'all get a phone call from a technician at the "Windows company" who tells you that they have detected a problem with your system and would like to aid yous resolve it. In order to help, they need you to become to a web site and download a simple utility that will allow them to set up the settings on your computer. Since you only ain an Apple Mac, you are suspicious of this caller and hang upward. What would the attack vector have been if you had downloaded the "simple utility" as asked?

  • Remote Desktop Protocol (RDP)

Question 70)

What is an effective fully automated manner to prevent malware from entering your arrangement as an email attachment?

  • Anti-virus software

 Question 71)

True or Imitation. The large majority of stolen credit carte du jour numbers are used quickly by the thief or a member of his/her family.

  • False

Question 72)

Which three (3) of these are PCI-DSS requirements for any visitor handling, processing or transmitting credit bill of fare data? (Select 3)

  • Restrict access to cardholder data by business need-to-know
  • Assign a unique ID to each person with calculator access
  • Restrict physical access to cardholder information

Question 73)

True or Fake. Communications of a information breach should be handled by a team equanimous of members of the IR team, legal personnel and public relations.

  • True

Question 74)

A Coordinating incident response team model is characterized by which of the following?

  • Multiple incident response teams within an organization all of whom coordinate their activities only within their state or department
  • Multiple incident response teams within an system but one with authority to assure consistent policies and practices are followed across all teams
  • This term refers to a structure that assures the incident response team's activities are coordinated with senior management and all appropriate departments within and system

Question 75)

The cyber hunting team and the SOC analysts are informally referred to as the ____ and ____ teams, respectively.

  • Blue Ruby
  • Blood-red, Blue

Question 76)

The partnership betwixt security analysts and technology can be said to be grouped into iii domains, human being expertise, security analytics and artificial intelligence. The human expertise domain would incorporate which iii (3) of these topics?

  • Brainchild
  • Dilemmas
  • Morals

Question 77)

Solution architectures often contain diagrams like the one below. What does this diagram evidence?

<<Solution Compages Data Flow.png>>

  • Functional components and data flow

Question 78)

Port numbers 1024 through 49151 are known equally what?

  • Registered Ports

Question 79)

Which layer of the OSI model to packet sniffers operate on?

  • Data Link

Question 80)

True or False. Internal attacks from trusted employees represents equally every bit significant a threat as external attacks from professional person cyber criminals.

  • True

Question 81)

According to the FireEye Mandiant'southward Security Effectiveness Report 2020, what fraction of security tools are deployed with default settings and thus underperform expectations?

  • 80%

Question 82)

Which country had the highest average price per breach in 2018 at $8.19M

  • U.s.a.

Question 83)

Which 2 (two) of these Python libraries provides useful statistical functions? (Select 2)

  • StatsModels
  • Scikit-larn

Question 84)

What will print out when this block of Python code is run?

i=1

#i=i+1

#i=i+ii

#i=i+3

print(i)

  • one

Question 85)

Which 3 (3) statements almost Python variables are true? (Select iii)

  • A variable proper noun must start with a letter or the underscore "_" grapheme
  • Variables can change type afterward they take been set
  • Variables exercise not have to be alleged in advance of their employ

Question 86)

PowerShell is a configuration management framework for which operating system?

  • Windows

Question 87)

In digital forensics documenting the chain of custody of evidence is critical. Which of these should exist included in your chain of custody log?

  • All of the higher up

Question 88)

Forensic analysis should always exist conducted on a re-create of the original data. Which two (2) types of copying are appropriate for getting data from a laptop acquired from a terminated employee, if y'all doubtable he has deleted incriminating files? (Select 2)

  • An incremental backup
  • A logical fill-in

Question 89)

Which of the post-obit would be considered an incident precursor?

  • An warning from your antivirus software indicating information technology had detected malware on your system
  • An announced threat against your organization by a hactivist group

Question xc)

If a penetration test calls for you to create a diagram of the target network including the identity of hosts and servers as well every bit a listing of open ports and published services, which tool would be the best fit for this chore?

  • Nmap

Question 91)

Which type of list is considered best for prophylactic coding practice?

  • Whitelist

Question 92)

In reviewing the security logs for a company'due south headquarters in New York City, which of these activities should non heighten much of a security business organization?

  • A recently hired data scientist in the Medical Analytics department has repeatedly attempted to access the corporate financial database
  • An employee has started logging in from home for an hour or so during the last ii weeks of each quarter

Question 93)

Information sources such every bit newspapers, books and web pages are considered which type of information?

  • Unstructured data
  • Semi-structured data
  • Structured data

Question 94)

Which 3 (3) of these statements about the TCP protocol are True? (Select 3)

  • TCP packets are reassembled by the receiving arrangement in the order in which they were sent
  • TCP is more than reliable than UDP
  • TCP is connection-oriented

Question 95)

In IPv4, how many of the four octets are used to define the network portion of the address in a Class B network?

  • two

Question 96)

A modest company with 25 computers wishes to connect them to the Internet using a NAT router. How many Public IP addresses will this company need to assure all 25 computers can communicate with each other and other systems on the Internet if they implement Port Accost Translations?

  • one

Question 97)

Why is symmetric key encryption the most common option of methods to encryptic information at residual?

  • There are far more than keys available for utilize
  • It is much faster than asymmetric key encryption

Question 98)

Which of the following statements well-nigh hashing is Truthful?

  • Hashing uses algorithms that are known as "one-way" functions

Question 99)

Why is hashing not a common method used for encrypting data?

  • Hashing is a 1-fashion process so the original data cannot be reconstructed from a hash value

Question 100)

Public central encryption incorporating digital signatures ensures which of the post-obit?

  • Confidentiality and Integrity

Question 101)

What is the chief hallmark protocol used by Microsoft in Active Directory?

  • Kerberos

Question 102)

Granting access to a user business relationship only those privileges necessary to perform its intended functions is known as what?

  • The principle of least privileges

Question 103)

What is the almost common patch remediation frequency for most organizations?

  • Monthly
  • Annually

Question 104)

Island hopping is an attack method normally used in which scenario?

  • Supply Chain Infiltration
  • Blocking access to a website for all users
  • Compromising a corporate VIP
  • Trojan Horse attacks

Question 105)

Security training for Information technology staff is what type of control?

  • Virtual
  • Operational
  • Physical

Question 106)

Which security concerns follow your workload even later information technology is successfully moved to the cloud?

  • All of the in a higher place

Question 107)

Which form of Deject computing combines both public and individual clouds?

  • Hybrid cloud

Question 108)

Which component of the Linux operating organization interacts with your estimator's hardware?

  • The kernel

Question 109)

The encryption and protocols used to foreclose unauthorized admission to data are examples of which type of access control?

  • Technical

Question 110)

In cybersecurity, Authenticity is divers as what?

  • The property of being 18-carat and verifiable

Question 111)

ITIL is best described as what?

  • A collection of IT Service Management best practices

Question 112)

Which position is in charge of testing the security and effectiveness of calculator information systems?

  • Information Security Auditor

Question 113)

A company wants to prevent employees from wasting fourth dimension on social media sites. To accomplish this, a document forbidding use of these sites while at work is written and circulated and and so the firewalls are updated to block admission to Facebook, Twitter and other popular sites. Which two (2) types of security controls has the company just implemented? (Select 2)

  • Authoritative
  • Technical

Question 114)

An email message that is encrypted, uses a digital signature and carries a hash value would accost which aspects of the CIA Triad?

Confidentiality and Integrity

Question 115)

What would a piece of malicious code that gets installed on a computer and reports back to the controller your keystrokes and other data it can gather from your organisation be chosen?

  • Spyware

Question 116)

Fancy Bears and Bearding are examples of what?

  • Hacking organizations

Question 117)

Select the answer the fills in the blanks in the right order.

A weakness in a system is a/an ____. The potential danger associated with this is a/an ____ that becomes a/an ____ when attacked by a bad actor.

  • vulnerability, threat, exploit
  • threat, exposure, hazard
  • threat player, vulnerability, exposure

Question 118)

Implement a filter to remove flooded packets before they attain the host is a countermeasure to which class of assail?

  • A Deprival of Service (DoS) attack

Question 119)

Trudy intercepts a romantic plain-text message from Alice to her young man Sam. The message upsets Trudy and then she forwards it to Bob, making information technology look like Alice intended information technology for Bob from the beginning. Which aspect of the CIA Triad has Trudy violated ?

  • All of the above

Question 120)

Which factor contributes most to the strength of an encryption system?

  • How many people take access to your public key
  • The length of the encryption key used
  • The number of private keys used by the organisation

Question 121)

What is an advantage asymmetric key encryption has over symmetric key encryption?

  • Asymmetric keys tin can be exchanged more securely than symmetric keys
  • Asymmetric key encryption is harder to break than symmetric key encryption
  • Disproportionate central encryption is faster than symmetric key encryption

Question 122)

Which position is responsible for the "ethical hacking" of an organizations computer systems?

  • A Penetration Tester

Question 123)

Which iii (3) are considered all-time practices, baselines or frameworks? (Select 3)

  • ISO27000 series
  • ITIL
  • COBIT

Question 124)

What does the "A" in the CIA Triad stand up for?

  • Availability

Question 125)

Which type of admission control is based upon the subject'southward clearance level and the objects classification?

  • Hierarchical Access Control (HAC)
  • Discretionary Admission Control (DAC)
  • Mandatory Access Control (MAC)
  • Office Based Access Command (RBAC)

Question 126)

Windows 10 stores 64-bit applications in which directory?

  • \Program Files

Question 127)

To build a virtual computing surroundings, where is the hypervisor installed?

  • Between the applications and the information sources
  • On the cloud's supervisory organization
  • Between the hardware and operating organization
  • Between the operating system and applications

Question 128)

An identical email sent to millions of addresses at random would be classified as which blazon of attack?

  • A Shark set on
  • A Phishing assault

Question 129)

Which argument about drivers running in Windows kernel way is true?

  • But critical processes are permitted to run in kernel mode since there is nothing to prevent a

Question 130)

Symmetric key encryption past itself ensures which of the post-obit?

  • Confidentiality and Integrity
  • Confidentiality only
  • Confidentiality and Availability

Question 131)

Which argument best describes configuring a NAT router to use dynamic mapping?

  • The organisation will demand as many registered IP addresses as it has computers that demand Cyberspace access
  • Many registered IP addresses are mapped to a single registered IP address using different port numbers
  • Unregistered IP addresses are mapped to registered IP addresses as they are needed
  • The NAT router uses each computer's IP address for both internal and external communication

Question 132)

Which address type does a estimator apply to get a new IP accost when information technology boots up?

  • The network'due south DHCP server accost

Question 133)

What is the master difference between the IPv4 and IPv6 addressing schema?

  • IPv6 is significantly faster than IPv4
  • IPv6 is used only for IOT devices
  • IPv6 allows for billions of times every bit many possible IP addresses

Question 134)

Which type of firewall understands which session a bundle belongs to and analyzes it appropriately?

  • A Next Generation Firewall (NGFW)

Question 135)

An employee calls the It Helpdesk and admits that maybe, merely maybe, the links in the email he clicked on this morning were not from the real Lottery Commission. What is the first matter y'all should tell the employee to do?

  • Run a Port scan
  • Run an antivirus browse

Question 136)

A penetration tester involved in a "Black box" attack would exist doing what?

  • Attempting to penetrate a client'southward systems as if she were an external hacker with no inside knowled

Question 137)

Which Postal service Incident activity would be concerned with maintaining the proper chain-of-custody?

  • Lessons learned meeting
  • Evidence retentiveness
  • Documentation review & update
  • Utilizing collected data

Question 138)

In digital forensics, which iii (3) steps are involved in the collection of data? (Select 3)

  • Develop a program to acquire the information
  • Verify the integrity of the data
  • Acquire the data

Question 139)

Which iii (3) of the post-obit are considered scripting languages? (Select three)

  • Perl
  • Fustigate
  • Python

Question 140)

What is the largest number that volition be printed during the execution of this Python while loop?

i=0

while (i<x):

 print(i)

 i=i+1

  • 9

Question 141)

Activities performed as a office of security intelligence tin can be divided into pre-exploit and post-exploit activities. Which two (2) of these are post-exploit activities? (Select 2)

  • Gather total situational sensation through advanced security analytics
  • Perform forensic investigation

Question 142)

There are many good reasons for maintaining comprehensive backups of disquisitional data. Which aspect of the CIA Triad is most impacted past an organisation'southward backup practices?

  • Availability
  • Integrity
  • Dominance

Question 143)

Which stage of DevSecOps would contain the activities Internal/External testing, Continuous assurance, and Compliance checking?

  • Exam
  • Code & build
  • Operate & monitor
  • Program

Question 144)

Which one of the OWASP Superlative ten Application Security Risks would be occur when there are no safeguards confronting a user being allowed to execute HTML or JavaScript in the user'due south browser that can hijack sessions.

  • Cross-site scripting

Question 145)

SIEM license costs are typically calculated based upon which ii (2) factors? (Select two)

  • Flows per minute (FPM)
  • Events per second (EPS)

Question 146)

True or False. If you lot have no better place to start hunting threats, start with a view of the global threat landscape and then drill downwardly to a regional view, industry view and finally a view of the threats specific to your ain organization.

  • Truthful

Question 147)

True or False. Deject-based storage or hosting providers are among the meridian sources of 3rd-party breaches

  • True

Question 148)

You are looking very hard on the web for the lowest mortgage involvement load you tin find and you come across a charge per unit that is so low it could not perhaps be true. You lot bank check out the site to encounter that the terms are and quickly observe you are the victim of a ransomware attack. What was the probable attack vector used past the bad actors?

  • Phishing
  • Malicious Links
  • Software Vulnerabilities

Question 149)

Very provocative articles that come up in news feeds or Google searches are sometimes called "click-bait". These articles ofttimes tempt y'all to link to other sites that tin be infected with malware. What assault vector is used by these click-bait sites to get you to go to the actually bad sites?

  • Malicious Links

More than New Questions

Question 150)

Which of the post-obit defines a security threat?

  • Whatever potential danger capable of exploiting a weakness in a system
  • The likelihood that the weakness in a system will exist exploited
  • Ane example of a weakness being exploited
  • A weakness in a system that could be exploited by a bad role player

Question 151)

Suspicious activity, like IP addresses or ports being scanned sequentially, is a sign of which blazon of set on?

  • A mapping attack
  • A denial of service (DoS) assail
  • A phishing set on
  • An IP spoofing attack

Question 152)

Alice sends a message to Bob that is intercepted by Trudy. Which scenario describes a confidentiality violation?

  • Trudy deletes the bulletin without forwarding it
  • Trudy cannot read it because it is encrypted but allows information technology to be delivered to Bob in its original class
  • Trudy changes the message so frontwards it on
  • Trudy reads the bulletin

Question 153)

Which regulation contains the security rule that requires all covered entities to maintain reasonable and appropriate authoritative, technical, and physical safeguards for protecting electronic protected wellness information (e-PHI)?

  • PCI-DSS
  • ISO27000 series
  • HIPAA
  • GDPR
  • NIST 800-53A

Question 154)

A good Endpoint Detection and Response system (EDR) should have which three (3) of these capabilities? (Select 3)

  • Automatically quarantine noncompliant endpoints
  • Manage encryption keys for each endpoint
  • Manage thousands of devices at once
  • Deploying devices with network configurations

Question 155)

Which statement about encryption is True most information in use.

  • Data should always be kept encrypted since modernistic CPUs are fully capable of operating directly on encrypted data
  • It is vulnerable to theft and should be decrypted only for the briefest possible fourth dimension while it is being operated on
  • Short of orchestrating a memory dump from a system crash, there is no practical style for malware to get at the information being processed, and then dump logs are your only existent concern
  • Data in active memory registers are non at risk of being stolen

Question 156)

For added security you make up one's mind to protect your network by conducting both a stateless and stateful inspection of incoming packets. How can this be washed?

  • This cannot be done The network ambassador must cull to run a given network segment in either stateful or stateless style, then select the respective firewall type
  • Install a single firewall that is capable of conducting both stateless and stateful inspections
  • Install a stateful firewall only These avant-garde devices inspect everything a stateless firewall inspects in addition to land related factors
  • You must install 2 firewalls in series, so all packets pass through the stateless firewall outset and so the stateless firewall

Question 157)

In IPv4, how many of the 4 octets are used to define the network portion of the address in a Class A network?

  • two
  • ane
  • 4
  • 3

Question 158)

If you have to rely upon metadata to work with the information at hand, you are probably working with which blazon of information?

  • Meta-structured data
  • Semi-structured data
  • Structured data
  • Unstructured data

Question 159)

Which 2 (2) forms of discovery must exist conducted online? (Select two)

  • Port scanning
  • Shoulder surfing
  • Social applied science
  • Packet sniffing

Question 160)

Which Incident Response Team model describes a team that runs all incident response activities for a company?

  • Distributed
  • Central
  • Analogous
  • Control

Question 161)

Which is the data protection process that prevents a suspicious data request from beingness completed?

  • Data take chances assay
  • Data classification
  • Data discovery
  • Blocking, masking and quarantining

Question 162)

Which form of penetration testing allows the testers partial knowledge of the systems they are trying to penetrate in accelerate of their set on to streamline costs and focus efforts?

  • Crimson Box Testing
  • Gray Box Testing
  • White Box testing
  • Black Box Testing

Question 163)

Which type of awarding attack would include User denies performing an performance, attacker exploits an application without trace, and attacker covers her tracks?

  • Auditing and logging
  • Authentication
  • Potency
  • Input validation

Question 164)

True or Faux. Thorough reconnaissance is an of import step in developing an effective cyber kill chain.

  • Truthful
  • False

Question 165)

True or False. I of the main challenges in cyber threat hunting is a lack of useful tools sold past too few vendors.

  • True
  • False

Question 166)

Truthful or False. A large company has a data breach involving the theft of employee personnel records but no customer data of any kind. Since no external data was involved, the visitor does non have to study the breach to police force enforcement.

  • Truthful
  • Imitation

Question 167)

You are the CEO of a large tech company and take just received an angry electronic mail that looks like it came from one of your biggest customers. The email says your company is overbilling the customer and asks that you lot examine the attached invoice. Y'all do just detect it blank, so y'all reply politely to the sender request for more details. Yous never hear back, but a week subsequently your security team tells you that your credentials have been used to admission and exfiltrate large amounts of company financial data. What kind of attack did you fall victim to?

  • As a phishing assault
  • As a whale assault
  • A shark assail
  • A wing phishing attack

Question 168)

Which of these statements about the PCI-DSS requirements for any company handling, processing or transmitting credit card information is true?

  • Muti-factor authentication is required for all new card holders
  • Some form of mobile device direction (MDM) must exist used on all mobile credit card processing devices
  • All employees with direct admission to cardholder data must be bonded
  • Cardholder information must be encrypted if information technology is sent across open or public networks

Which Incident Response Team model describes a team that acts every bit consulting experts to advise local IR teams?

  • Command
  • Coordinating
  • Distributed
  • O Central

In a Linux file arrangement, which files are independent in the \bin folder?

  • All user binary files, their libraries and headers
  • Executable files such as grep and ping
  • Configuration files such equally fstab and inittab
  • Directories such every bit /dwelling house and /usr

If a computer needs to send a message to a system that is not office of the local network, where does it send the message?

  • To the system'south domain proper noun
  • To the system's IP address
  • The network's DNS server accost
  • To the arrangement's MAC address
  • The network's default gateway accost
  • The network'south DHCP server address

Which iii (three) of these statements about the TCP protocol are True? (Select 3)

  • TCP is faster than UDP
  • TCP is connection-oriented
  • TCP packets are reassembled by the receiving organisation in the order in which they were sent
  • TCP is more reliable than UDP

A professor is not allowed to change a student'south final form after she submits it without completing a special form to explain the circumstances that necessitated the change. This additional pace supports which aspect of the CIA Triad?

  • Authorization
  • Integrity
  • Confidentiality
  • Availability

Which of these is the all-time definition of a security risk?

  • An example of being exposed to losses
  • Any potential danger that is associated with the exploitation of a vulnerability
  • A weakness in a organisation
  • The likelihood of a threat source exploiting a vulnerability

Trudy intercepts a plain text message sent by Alice to Bob, but in no style interferes with its commitment. Which aspect of the CIA Triad was violated?

  • Confidentiality
  • Integrity
  • Availability
  • All of the to a higher place

What is an reward symmetric primal encryption has over asymmetric fundamental encryption?

  • Symmetric central encryption provides better security against Homo-in-the-center attacks than is possible with asymmetric key encryption
  • Symmetric key encryption is faster than asymmetric key encryption
  • Symmetric keys tin can be exchanged more securely than asymmetric keys
  • Symmetric key encryption is harder to suspension than disproportionate cardinal encryption

Which type of application attack would include network eavesdropping, dictionary attacks and cookie replays?

  • Configuration management
  • Authentication
  • Authority
  • Exception direction

Why should you always look for common patterns earlier starting a new security architecture design?

  • They can aid identify best practices
  • They tin can shorten the development lifecycle
  • Some document complete tested solutions
  • All of the higher up

Last Update: 09/12/2021

Warning: Jo Answer Green hai wo correct hai but

Jo Greenish Nahi hai. Usme se jo ek wrong selection tha usko hata diya hai

Delight WAIT I Will ADD More than NEW QUETIONS..

Also if you have Questions with right respond  Send me on my E-mail i will update on my web log..

niyander111@gmail.com

Thank you...