CC – Certified in Cybersecurity Back to exams page. Take our Certified in Cybersecurity course here. 1. Which of the following is an example of a corrective security control?a) Antivirus softwareb) Firewallc) Encryptiond) Intrusion Detection System (IDS)Question 1 of 50 2. A company is about to start a new project and needs to determine the potential risks it might face. What type of risk assessment tool would be the most appropriate to use in this scenario?a) Quantitative Risk Assessmentb) Qualitative Risk Assessmentc) Both Quantitative and Qualitative Risk Assessmentd) Digital Risk AssessmentQuestion 2 of 50 3. What is the purpose of having a disaster recovery plan in an organization?a) To ensure the integrity of information b) To ensure the security of informationc) To ensure the availability of informationd) To ensure the confidentiality of information Question 3 of 50 4. What is the process of protecting confidential information called?a) Data encryptionb) Data recovery c) Data backupd) Data protectionQuestion 4 of 50 5. What are the rights of individuals under the General Data Protection Regulation (GDPR)?a) All of the belowb) Right to Accessc) Right to Data Portabilityd) Right to be ForgottenQuestion 5 of 50 6. What are the key components of a non-repudiation system?a) Network address translation, virtual private networks, and proxy serversb) Digital signatures, message authentication codes, and public key infrastructurec) Firewalls, intrusion detection systems, and antivirus softwared) Encryption, compression, and error correctionQuestion 6 of 50 7. How does separation of duties enhance cybersecurity? a) By reducing the risk of data breachesb) By reducing the risk of external attacksc) By reducing the risk of human errord) By reducing the risk of insider threatsQuestion 7 of 50 8. What is the first step in the risk management process?a) Controlling risksb) Evaluating risksc) Identifying risksd) Assessing risksQuestion 8 of 50 9. What are some advantages of using a quantitative risk assessment tool?a) Improved accuracy in determining the likelihood and impact of risksb) Improved ability to allocate resources effectivelyc) Improved efficiency in prioritizing risksd) All of the aboveQuestion 9 of 50 10. What is the definition of integrity in the context of information security?a) The accuracy and consistency of data over timeb) The ability of a system to prevent unauthorized access to datac) The availability of data for authorized usersd) The protection of sensitive information from unauthorized disclosureQuestion 10 of 50 11. What is the primary difference between a hot site and a warm site?a) A hot site is used for short-term recovery while a warm site is used for long-term recoveryb) A hot site is located close to the main facility while a warm site is located farther awayc) A hot site is fully functional while a warm site is partially functionald) A hot site is more expensive than a warm siteQuestion 11 of 50 12. What is the purpose of the containment step in incident response?a) To implement a solution to the incidentb) To stop the incident from spreadingc) To identify the root cause of the incidentd) To analyse the incidentQuestion 12 of 50 13. What is a containment plan in the context of incident response?a) A plan for containing the spread of an incidentb) A plan for containing the spread of a firec) A plan for containing the spread of an environmental hazardd) A plan for containing the spread of a virusQuestion 13 of 50 14. What is the role of a risk assessment in an IT disaster recovery plan?a) To prioritize the critical business processes that must be protectedb) To develop a strategy for mitigating the risks and threats identified in the assessmentc) To identify the potential risks and threats to the organisation's operationsd) All of the aboveQuestion 14 of 50 15. What is the difference between a hot site, warm site, and cold site?a) A hot site has limited functionality, a warm site is a fully functional backup facility, and a cold site is an unused facility with no equipmentb) A hot site is a fully functional backup facility, a warm site has limited functionality, and a cold site is an unused facility with no equipmentc) A hot site is a fully functional backup facility, a warm site is an unused facility with no equipment, and a cold site has limited functionalityd) A hot site is an unused facility with no equipment, a warm site has limited functionality, and a cold site is a fully functional backup facilityQuestion 15 of 50 16. What is a supply chain disruption disaster?a) A disaster caused by a disruption in the flow of goods and materialsb) A disaster caused by a widespread outbreak of a diseasec) A disaster caused by a natural event such as a hurricaned) A disaster caused by a nuclear explosionQuestion 16 of 50 17. What is the purpose of testing a BCP?a) To ensure that the plan is foolproof and cannot failb) To assess the financial impact of disaster on the organizationc) To identify weaknesses and improve the pland) To verify that the plan conforms to legal and regulatory requirementsQuestion 17 of 50 18. What is the first step in incident response?a) Containmentb) Identificationc) Analysisd) RemediationQuestion 18 of 50 19. What is a communication plan in the context of incident response?a) All of the belowb) A plan for communicating with employees during an incidentc) A plan for communicating with customers and stakeholders during an incidentd) A plan for communicating with government agencies during an incidentQuestion 19 of 50 20. What is the primary purpose of an IT business continuity plan?a) To ensure the survival of a business in the event of a disaster b) To minimize the impact of a disaster on a businessc) To provide a means of recovering data in the event of a disasterd) To provide a plan for restoring normal business operations in the event of a disasterQuestion 20 of 50 21. What should be considered when developing a physical security control plan?a) The location of the assetsb) The potential threat sourcesc) The type of assets being protectedd) All of the aboveQuestion 21 of 50 22. What is the main purpose of using a badge system in a cybersecurity setting?a) To enforce dress code regulationsb) To monitor employee attendancec) To track inventory levelsd) To prevent unauthorized access to secure areasQuestion 22 of 50 23. What is the main difference between fail-safe and fail-secure mechanisms?a) Fail-safe systems lock down in case of a failure, while fail-secure systems operate in a safe state in case of a failureb) Neither fail-safe nor fail-secure systems are used in security applicationsc) Fail-safe systems operate in a safe state in case of a failure, while fail-secure systems lock down in case of a failured) Fail-safe and fail-secure systems are the same thingQuestion 23 of 50 24. How does the use of surveillance cameras improve physical security?a) All of the belowb) By recording events for future usec) By deterring potential attackersd) By providing real-time monitoringQuestion 24 of 50 25. Company XYZ is concerned about the potential for fraud or errors in their accounting department. Which security control should be implemented to reduce this risk?a) Segregation of dutiesb) Segregation of duties and the principle of least privilegec) Principle of least privileged) None of the aboveQuestion 25 of 50 26. What is the purpose of Crime Prevention Through Environmental Design (CPTED)?a) To increase crime through law enforcement practicesb) To decrease crime through physical design and management of the built environmentc) To increase crime through physical design and management of the built environmentd) To have no impact on crime through physical design and management of the built environment Question 26 of 50 27. In a DAC system, who has control over the access permissions of a resource?a) The owner of the resourceb) The system administratorc) Owner and system admin d) None of the aboveQuestion 27 of 50 28. Which of the following is a limitation of MAC?a) It can be easily circumvented by malicious usersb) It can result in users having too much access to resourcesc) It can be difficult to implement and managed) It can be too rigid and inflexibleQuestion 28 of 50 29. In an organization that uses Role-based access control (RBAC), a user has been promoted to a new position. Which action should be taken to adjust the user's access permissions?a) The user’s access permissions should remain the sameb) The user should be given unrestricted access to all resourcesc) The user should be required to reapply for access to all resourcesd) The user’s access permissions should be modified based on their new job dutiesQuestion 29 of 50 30. What are the 4 principles of CPTED (Crime Prevention Through Environmental Design)?a) Surveillance, access control, lighting and maintenanceb) Access control, territoriality, lighting and maintenancec) Surveillance, territoriality, lighting and maintenanced) Surveillance, access control, territoriality and maintenanceQuestion 30 of 50 31. What type of firewall is typically used to protect an entire network?a) Application layer firewallb) Network layer firewallc) Stateful firewalld) Packet filtering firewallQuestion 31 of 50 32. Which of the following is a key element of an effective SLA?a) A lack of clear responsibilities for the service provider and the clientb) Vague, non-specific languagec) Ambiguous service availability guaranteesd) Clear, measurable performance metricsQuestion 32 of 50 33. What is a region in cloud computing?a) A collection of databases that share resourcesb) A set of data centers located in different geographical locationsc) A group of virtual machines with similar configurationsd) A set of tools for managing cloud resourcesQuestion 33 of 50 34. What is WPA2, a common security protocol used for Wi-Fi networks?a) Wireless Power Amplification 2b) Wi-Fi Packet Analyzer 2c) Wireless Policy Authentication 2d) Wi-Fi Protected Access 2Question 34 of 50 35. What is the primary disadvantage of a packet filtering firewall?a) They are unable to filter traffic based on application layer protocolsb) They are unable to maintain state information about connectionsc) They are unable to block traffic based on IP addressesd) They are vulnerable to attacks that exploit network-layer protocolsQuestion 35 of 50 36. What is the main difference between signature-based detection and anomaly-based detection in IDS?a) Signature-based detection is more accurate than anomaly-based detectionb) Anomaly-based detection relies on pre-configured rules, while signature-based detection is based on machine learningc) Signature-based detection looks for known patterns of malicious behavior, while anomaly-based detection looks for abnormal behavior patternsd) Signature-based detection is faster than anomaly-based detectionQuestion 36 of 50 37. What is the Open Systems Interconnection (OSI) model?a) A network protocol used for wireless communicationb) A network architecture model that defines the communications protocol used by the internetc) A model for network communications that defines a five-layer architectured) A model for network communications that defines a sever-layer architectureQuestion 37 of 50 38. Which of the following is a common technique used in DDoS attacks?a) Cross-site scripting (XSS)b) DNS spoofingc) SQL injection d) BotnetsQuestion 38 of 50 39. Which of the following ports is typically used for secure communication?a) Port 80b) Port 110c) Port 443d) Port 25Question 39 of 50 40. Which of the following is a defense strategy against zero-day attacks?a) Implementing perimeter-based network security controlsb) Regularly updating software and systemsc) Using strong passwords and multifactor authenticationd) Disabling all unnecessary services and portsQuestion 40 of 50 41. Which of the following is NOT a component of a digital signature?a) An encryption keyb) A message or documentc) A digital certificated) A hash functionQuestion 41 of 50 42. How can data classification and labelling help with data governance and compliance?a) By providing a way to easily identify and track data based on its regulatory requirementsb) By reducing the risk of data breaches and loss of intellectual propertyc) By demonstrating that the organization is handling data in a responsible and compliant mannerd) All of the aboveQuestion 42 of 50 43. What is the main purpose of an Acceptable Use Policy (AUP)?a) To provide guidelines for the appropriate use of company resourcesb) To allow employees to use company resources as they see fitc) To restrict access to company resourcesd) To delegate responsibility for resource management to a third-party providerQuestion 43 of 50 44. Which of the following is an important consideration when implementing system hardening measures?a) System hardening measures should be tested and evaluated to ensure that they are effectiveb) Password policies should be relaxed to make it easier for users to access the systemc) All security measures should be disabled when performing software updatesd) System performance should always be prioritized over security Question 44 of 50 45. Which of the following is an example of an asymmetric encryption algorithm?a) RC4b) DESc) RSAd) BlowfishQuestion 45 of 50 46. What are the six main phases of the data lifecycle?a) Data creation, data analysis, data storage, data use, data destruction, data miningb) Data creation, data analysis, data storage, data modification, data destructionc) Data creation, data analysis, data use, data modification, data archiving, data miningd) Data creation, data storing, data using, data sharing, data archiving, data destroyingQuestion 46 of 50 47. Which of the following is an example of a key exchange algorithm used in symmetric encryption?a) SHA-256b) Deffie-Hellmanc) AESd) RSAQuestion 47 of 50 48. What is the purpose of software updates and patches in configuration management?a) To upgrade the operating system of a serverb) To fix security vulnerabilities and bugs in software applicationsc) To add new features to software applicationsd) To optimize the performance of hardware devicesQuestion 48 of 50 49. Which of the following is NOT a benefit of maintaining an accurate information asset inventory?a) Improved risk managementb) Improved incident response and recoveryc) Improved compliance with regulations and standardsd) Improved employe productivityQuestion 49 of 50 50. What is the difference between a log and an event?a) A log is a specific occurrence, while an event is a record of eventsb) A log is a record of security-related events, while an event is a record of all types of eventsc) A log and an event are the same thingd) A log is a record of events while an event is a specific occurrenceQuestion 50 of 50 Loading...
