CSLB General Building (B) — All Questions

An attacker sends an email that appears to come from the company CEO, urgently asking the finance team to wire funds to a new vendor. What type of social engineering attack is this?

• a.Vishing
• b.Business email compromise✓
• c.Watering hole attack
• d.Tailgating

Business email compromise (BEC) impersonates a trusted executive or partner to trick employees into transferring money or sensitive data. It relies on authority and urgency rather than malware. Because it uses legitimate-looking email, it often bypasses technical filters and targets human judgment.

Which malware type encrypts a victim's files and demands payment for the decryption key?

• a.Ransomware✓
• b.Rootkit
• c.Keylogger
• d.Adware

Ransomware encrypts data and extorts the victim for a decryption key, often with a payment deadline. Modern variants also exfiltrate data first to enable double extortion. Reliable offline backups are the most effective recovery control.

A user reports that their credentials worked on a fake login page that looked identical to the corporate portal. Which attack most likely occurred?

• a.SQL injection
• b.Buffer overflow
• c.Phishing✓
• d.Privilege escalation

Phishing lures users to fraudulent pages that harvest credentials by mimicking legitimate sites. The cloned portal is the classic delivery mechanism. User training and multifactor authentication reduce the impact of harvested passwords.

Which term describes a previously unknown software vulnerability for which no patch yet exists?

• a.Legacy flaw
• b.Misconfiguration
• c.Race condition
• d.Zero-day✓

A zero-day is a vulnerability unknown to the vendor and defenders, giving zero days to prepare a fix. Attackers exploiting it face no available patch. Compensating controls like segmentation and behavior-based detection help mitigate the risk.

An attacker overwhelms a web server with traffic from thousands of compromised devices, making it unavailable. What is this called?

• a.Man-in-the-middle
• b.Distributed denial-of-service✓
• c.On-path replay
• d.DNS poisoning

A distributed denial-of-service (DDoS) attack floods a target from many compromised hosts, often a botnet, exhausting bandwidth or resources. The goal is to disrupt availability rather than steal data. Rate limiting, scrubbing services, and CDNs help absorb the load.

Which type of threat actor is typically well-funded, highly skilled, and motivated by espionage on behalf of a government?

• a.Nation-state actor✓
• b.Script kiddie
• c.Hacktivist
• d.Insider by accident

Nation-state actors, often labeled advanced persistent threats, have significant resources, patience, and sophisticated tooling. Their goals include espionage, sabotage, and strategic advantage. They frequently use zero-days and long-dwell stealthy campaigns.

A disgruntled employee copies confidential designs to a USB drive before resigning. This is an example of what threat?

• a.Supply chain attack
• b.Watering hole
• c.Insider threat✓
• d.Shadow IT

An insider threat comes from someone with authorized access who misuses it, whether maliciously or negligently. The employee here abuses legitimate access to steal data. Data loss prevention, least privilege, and monitoring help detect such activity.

Which attack injects malicious database commands through unvalidated user input fields?

• a.Cross-site scripting
• b.SQL injection✓
• c.Directory traversal
• d.Session hijacking

SQL injection inserts crafted database statements through input that the application fails to sanitize. It can expose, modify, or delete data. Parameterized queries and input validation are the primary defenses.

An attacker leaves infected USB drives in a company parking lot hoping employees will plug them in. This technique is known as:

• a.Pretexting
• b.Whaling
• c.Shoulder surfing
• d.Baiting✓

Baiting entices victims with something appealing, such as a found USB drive, to trigger a compromise. Curiosity leads the victim to introduce the malware themselves. Endpoint controls that block unknown removable media reduce this risk.

Which malware disguises itself as legitimate software but performs malicious actions once installed?

• a.Trojan✓
• b.Worm
• c.Logic bomb
• d.Botnet

A Trojan masquerades as a benign or useful program to trick users into running it. Unlike a worm, it does not self-replicate; it relies on deception. Once executed it may open backdoors, steal data, or download further payloads.

A malicious program spreads across a network automatically without any user interaction. What is it?

• a.Trojan
• b.Spyware
• c.Worm✓
• d.Rootkit

A worm self-replicates and propagates across networks by exploiting vulnerabilities, requiring no user action. This makes outbreaks spread rapidly. Timely patching and network segmentation slow worm propagation.

An attacker calls an employee pretending to be IT support to trick them into revealing a password. This voice-based social engineering is called:

• a.Smishing
• b.Vishing✓
• c.Phishing
• d.Spooling

Vishing uses voice calls to manipulate victims into disclosing information or performing actions. The attacker builds a plausible pretext, often posing as a trusted party. Verification callbacks and never sharing passwords by phone are effective countermeasures.

Which attack compromises a website frequently visited by a target group to infect their systems?

• a.Rainbow table
• b.Pass-the-hash
• c.Typosquatting
• d.Watering hole✓

A watering hole attack infects a site the intended victims commonly use, so visiting it delivers malware. It targets a community indirectly through a trusted resource. Keeping browsers patched and using endpoint protection reduces exposure.

Which term describes a hidden vulnerability in a third-party component that compromises everyone who uses it?

• a.Supply chain risk✓
• b.Insider risk
• c.Physical risk
• d.Configuration drift

Supply chain risk arises when a trusted vendor, library, or hardware component is compromised, affecting downstream customers. A single tainted update can reach many organizations. Vendor assessments and software bill of materials help manage this risk.

Malware that records every keystroke a user types to capture passwords is a:

• a.Rootkit
• b.Keylogger✓
• c.Ransomware
• d.Backdoor

A keylogger captures keyboard input to steal credentials, messages, and other sensitive typed data. It can be software or hardware based. Multifactor authentication limits the damage from stolen static passwords.

An attacker registers a domain like 'goggle.com' hoping users mistype the real address. This is:

• a.Pharming
• b.DNS spoofing
• c.Typosquatting✓
• d.Session fixation

Typosquatting registers look-alike domains based on common misspellings to catch mistyped traffic. Victims may land on malicious or fraudulent pages. Users should verify URLs and organizations can defensively register close variants.

Which type of malware hides deep in the operating system to conceal its presence and maintain privileged access?

• a.Adware
• b.Trojan
• c.Worm
• d.Rootkit✓

A rootkit embeds itself at a low level, often the kernel, to hide processes and files while retaining elevated control. Its stealth makes detection and removal difficult. Secure boot and integrity monitoring help defend against rootkits.

A phishing attack that specifically targets a high-value executive is known as:

• a.Whaling✓
• b.Vishing
• c.Smishing
• d.Spear tailoring

Whaling is a form of spear phishing aimed at senior executives or high-profile targets. The lures are carefully crafted for that individual and their authority. Executive awareness training and verification procedures reduce success.

Which attack intercepts and possibly alters communication between two parties who believe they are talking directly?

• a.Denial-of-service
• b.On-path (man-in-the-middle)✓
• c.Brute force
• d.Cross-site request forgery

An on-path attack, historically called man-in-the-middle, positions the attacker between two endpoints to eavesdrop or tamper with traffic. Unencrypted channels are especially vulnerable. Strong encryption and certificate validation mitigate it.

A malicious script stored on a vulnerable web page runs in other users' browsers when they view it. This is:

• a.SQL injection
• b.CSRF
• c.Stored cross-site scripting✓
• d.Clickjacking

Stored cross-site scripting (XSS) persists malicious script on the server so it executes in every visitor's browser. It can steal session tokens or perform actions as the victim. Output encoding and input validation prevent XSS.

Which term describes exploiting a time gap between checking a resource and using it?

• a.Buffer overflow
• b.Replay attack
• c.Injection
• d.Race condition✓

A race condition, or time-of-check to time-of-use flaw, exploits the interval between validating and using a resource. An attacker changes state in that window to bypass controls. Proper locking and atomic operations prevent it.

An attacker follows an employee through a secured door without badging in. This physical attack is called:

• a.Tailgating✓
• b.Piggyback encryption
• c.Shoulder surfing
• d.Dumpster diving

Tailgating is entering a restricted area by closely following an authorized person through a controlled door. It exploits politeness and weak physical enforcement. Mantraps, turnstiles, and awareness reduce tailgating.

Which attack precomputes hashes to reverse password hashes quickly?

• a.Dictionary attack
• b.Rainbow table attack✓
• c.Credential stuffing
• d.Password spraying

A rainbow table uses precomputed hash chains to reverse unsalted password hashes efficiently. Adding a unique random salt to each password defeats this approach. Modern slow hashing functions further increase cracking cost.

An attacker tries a few very common passwords across many user accounts to avoid lockouts. This is:

• a.Brute force
• b.Rainbow table
• c.Password spraying✓
• d.Pass-the-hash

Password spraying tests a small set of common passwords across many accounts, staying under lockout thresholds. It exploits weak, reused passwords at scale. Strong password policies, MFA, and anomaly detection counter it.

Which security model assumes no user or device is trusted by default, even inside the network perimeter?

• a.Zero trust✓
• b.Defense in depth
• c.Perimeter security
• d.Implicit trust

Zero trust removes automatic trust based on network location and continuously verifies every request. Access is granted per session based on identity, device posture, and context. It reduces lateral movement after a breach.

Layering multiple independent security controls so that one failure does not cause a breach is called:

• a.Single sign-on
• b.Defense in depth✓
• c.Least privilege
• d.Air gapping

Defense in depth stacks overlapping controls across people, process, and technology so no single failure is catastrophic. If one layer is bypassed, others still protect the asset. It reflects the assumption that any one control can fail.

Dividing a network into isolated zones to limit the spread of an attack is known as:

• a.Load balancing
• b.Port forwarding
• c.Segmentation✓
• d.Tunneling

Network segmentation separates systems into zones so a compromise in one cannot freely reach others. It limits lateral movement and contains breaches. VLANs, firewalls, and microsegmentation implement this principle.

Which network area sits between the internet and the internal network to host public-facing services?

• a.Intranet
• b.VPN concentrator
• c.Air gap
• d.Screened subnet (DMZ)✓

A screened subnet, historically called a DMZ, isolates public-facing servers from the internal network. If a public host is compromised, the internal network remains protected by an additional boundary. Firewalls control traffic on both sides.

Which cloud model gives the customer the most control over the operating system and applications while the provider manages the physical hardware?

• a.Infrastructure as a Service✓
• b.Software as a Service
• c.Platform as a Service
• d.Function as a Service

Infrastructure as a Service (IaaS) provides virtualized compute, storage, and networking while the customer manages the OS and applications. This maximizes customer control and responsibility. SaaS, by contrast, hands nearly everything to the provider.

In cloud computing, which concept defines who is responsible for securing which layers of the stack?

• a.Elasticity
• b.Shared responsibility model✓
• c.Multitenancy
• d.Serverless

The shared responsibility model divides security duties between the cloud provider and the customer. The provider secures the underlying infrastructure while the customer secures data, identities, and configurations. Misunderstanding the split is a common source of cloud breaches.

Which technology allows multiple isolated operating systems to run on a single physical host?

• a.Containerization
• b.Clustering
• c.Virtualization✓
• d.Load balancing

Virtualization uses a hypervisor to run multiple guest operating systems on one physical machine, each isolated in a virtual machine. It improves resource use and isolation. Hardening the hypervisor is critical because it is a high-value target.

Which approach packages an application with its dependencies to run consistently across environments while sharing the host OS kernel?

• a.Full virtualization
• b.Bare-metal deployment
• c.Air gapping
• d.Containerization✓

Containerization bundles an application and its dependencies into a lightweight, portable unit that shares the host kernel. Containers start quickly and use fewer resources than full VMs. Isolation is weaker than VMs, so kernel and image security matter.

Which principle grants users only the minimum access needed to perform their job?

• a.Least privilege✓
• b.Separation of duties
• c.Defense in depth
• d.Implicit deny

Least privilege limits each user or process to only the permissions required for its role. This shrinks the attack surface and limits damage from compromised accounts. Regular access reviews keep privileges aligned with need.

A firewall rule set ends with a rule that blocks anything not explicitly permitted. This is called:

• a.Explicit allow
• b.Implicit deny✓
• c.Stateful inspection
• d.Failover

Implicit deny blocks all traffic that no earlier rule explicitly allows. It ensures only intended traffic passes and unknowns are rejected by default. This deny-by-default posture is a core secure design principle.

Which design ensures a system has no single point of failure by duplicating critical components?

• a.Least functionality
• b.Segmentation
• c.Redundancy✓
• d.Tokenization

Redundancy duplicates critical components, such as power supplies or servers, so failure of one does not cause an outage. It supports high availability and resilience. Combined with failover, it keeps services running through faults.

Which term describes an isolated environment where suspicious code can be executed and analyzed safely?

• a.Honeypot
• b.Bastion host
• c.Air gap
• d.Sandbox✓

A sandbox is a contained, isolated environment for running untrusted code without risking the host or network. It is used to analyze malware behavior or test software safely. Escapes from the sandbox are a key security concern.

Which decoy system is deployed to attract attackers and study their techniques?

• a.Honeypot✓
• b.Jump server
• c.Proxy server
• d.Load balancer

A honeypot is a deliberately vulnerable-looking decoy that lures attackers away from real assets and gathers intelligence on their methods. Any interaction with it is suspicious by design. Honeynets extend the concept to entire fake networks.

Which hardened intermediary host is used to securely administer devices in a sensitive network segment?

• a.Honeypot
• b.Jump server (bastion host)✓
• c.Web proxy
• d.DNS resolver

A jump server, or bastion host, is a tightly controlled system that administrators connect through to reach protected segments. It centralizes and monitors administrative access. Hardening and logging on this host are essential because it is a gateway to sensitive systems.

Which control physically separates a highly sensitive network from all other networks and the internet?

• a.VPN
• b.Screened subnet
• c.Air gap✓
• d.NAT

An air gap isolates a system or network so it has no physical or logical connection to untrusted networks. It is used for critical systems like industrial controls. Data transfer requires manual, controlled processes, which reduces remote attack surface.

Which concept keeps availability high by automatically shifting workloads to a standby system when the primary fails?

• a.Load balancing
• b.Segmentation
• c.Snapshotting
• d.Failover✓

Failover automatically transfers operations to a redundant standby when the active component fails, minimizing downtime. It is a cornerstone of high-availability design. Regular testing ensures the standby will actually take over when needed.

Embedded systems in industrial equipment that monitor and control physical processes are collectively known as:

• a.ICS/SCADA✓
• b.IoT hubs
• c.Thin clients
• d.Edge routers

Industrial control systems (ICS), including SCADA, manage physical processes in utilities and manufacturing. They often run legacy software and prioritize availability over patching. Segmentation and strict access control are key because downtime and safety are critical.

Which design principle removes unnecessary services, ports, and software to reduce a system's attack surface?

• a.Redundancy
• b.Least functionality✓
• c.Elasticity
• d.Multitenancy

Least functionality configures a system to run only the services and features required for its purpose. Disabling unneeded components shrinks the attack surface. It complements least privilege by hardening the system itself, not just user access.

Which type of encryption uses the same key to encrypt and decrypt data?

• a.Asymmetric
• b.Hashing
• c.Symmetric✓
• d.Steganographic

Symmetric encryption uses a single shared secret key for both encryption and decryption, such as AES. It is fast and suited to bulk data. The main challenge is securely distributing the shared key.

Which cryptographic method uses a public and private key pair?

• a.Asymmetric encryption✓
• b.Symmetric encryption
• c.Hashing
• d.Salting

Asymmetric encryption uses a mathematically linked key pair: a public key to encrypt and a private key to decrypt, or the reverse for signatures. It solves the key distribution problem of symmetric systems. RSA and elliptic curve are common examples.

Which one-way function produces a fixed-length value that cannot be reversed to the original input?

• a.Symmetric cipher
• b.Hashing✓
• c.Tokenization
• d.Steganography

Hashing transforms input into a fixed-length digest that cannot be feasibly reversed. It verifies integrity because any change to the input changes the hash. SHA-256 is a widely used secure hashing algorithm.

Adding a unique random value to each password before hashing to defeat precomputed attacks is called:

• a.Peppering
• b.Stretching
• c.Encoding
• d.Salting✓

Salting prepends or appends a unique random value to each password before hashing. This ensures identical passwords produce different hashes and defeats rainbow tables. Each salt must be unique and stored alongside the hash.

Which entity in a PKI issues and signs digital certificates?

• a.Certificate authority✓
• b.Registration authority
• c.Key escrow agent
• d.Certificate holder

A certificate authority (CA) issues, signs, and vouches for digital certificates, binding a public key to an identity. Trust in the CA underpins the entire PKI. A compromised CA can undermine trust for all certificates it issued.

Which mechanism lets a client quickly check whether a single certificate has been revoked?

• a.Certificate signing request
• b.Online Certificate Status Protocol✓
• c.Key stretching
• d.Certificate pinning

The Online Certificate Status Protocol (OCSP) queries a responder in real time to check a certificate's revocation status. It is faster and more current than downloading a full certificate revocation list. OCSP stapling improves performance and privacy.

What does a digital signature primarily provide?

• a.Confidentiality only
• b.Availability
• c.Integrity and non-repudiation✓
• d.Faster encryption

A digital signature proves the message came from the holder of the private key and was not altered, giving integrity, authentication, and non-repudiation. It does not by itself keep the content secret. It is created by encrypting a hash with the signer's private key.

Which authentication factor category does a fingerprint belong to?

• a.Something you know
• b.Something you have
• c.Somewhere you are
• d.Something you are✓

A fingerprint is a biometric, which is the 'something you are' factor based on physical characteristics. Combining it with a different factor, such as a password, creates multifactor authentication. Biometrics resist sharing but raise privacy and revocation concerns.

Requiring a password plus a one-time code from a phone app is an example of:

• a.Multifactor authentication✓
• b.Single sign-on
• c.Federation
• d.Role-based access

Multifactor authentication combines two or more independent factor categories, here something you know and something you have. This greatly reduces the risk from a stolen password alone. An attacker would need to defeat both factors.

Which access control model grants permissions based on a user's assigned job function?

• a.Discretionary access control
• b.Role-based access control✓
• c.Mandatory access control
• d.Rule-based access control

Role-based access control (RBAC) assigns permissions to roles, and users inherit access by being placed in a role. It simplifies administration and enforces consistency. Changing a role updates access for everyone assigned to it.

Which model uses security labels and clearances, common in government, where the system enforces access centrally?

• a.Discretionary access control
• b.Role-based access control
• c.Mandatory access control✓
• d.Attribute-based access control

Mandatory access control (MAC) enforces access based on classification labels and clearances set by a central authority. Users cannot change permissions on resources they own. It is used where strict, non-discretionary control is required.

Which secure protocol replaces Telnet for encrypted remote command-line access?

• a.FTP
• b.HTTP
• c.SNMPv1
• d.SSH✓

Secure Shell (SSH) provides encrypted remote administration, replacing the plaintext Telnet protocol. It protects credentials and session data in transit. SSH also underpins secure file transfer and tunneling.

Which protocol secures web traffic by encrypting HTTP with TLS?

• a.HTTPS✓
• b.SFTP
• c.LDAP
• d.SMTP

HTTPS layers HTTP over TLS to encrypt web traffic, protecting confidentiality and integrity between browser and server. It also authenticates the server through its certificate. Modern sites should use TLS 1.2 or 1.3 with strong ciphers.

Which protocol provides secure file transfer by running over an SSH connection?

• a.FTPS
• b.SFTP✓
• c.TFTP
• d.HTTP

SFTP transfers files over an SSH channel, encrypting both credentials and data. It differs from FTPS, which is FTP secured with TLS. SFTP uses a single connection, simplifying firewall configuration.

Which technology creates an encrypted tunnel for remote users to access a private network over the internet?

• a.DMZ
• b.Proxy
• c.VPN✓
• d.NAT

A virtual private network (VPN) establishes an encrypted tunnel over an untrusted network, protecting traffic between the remote user and the corporate network. It preserves confidentiality and integrity in transit. IPsec and TLS are common VPN foundations.

Which single sign-on standard is widely used to exchange authentication data between identity providers and web applications?

• a.RADIUS
• b.TACACS+
• c.Kerberos
• d.SAML✓

Security Assertion Markup Language (SAML) exchanges authentication and authorization assertions between an identity provider and service providers, enabling web single sign-on. The identity provider vouches for the user so each application does not manage passwords. It is common in enterprise federation.

Replacing sensitive data such as a credit card number with a non-sensitive substitute value is called:

• a.Tokenization✓
• b.Hashing
• c.Salting
• d.Compression

Tokenization swaps sensitive data for a meaningless token, keeping the real value in a secure vault. The token has no exploitable value if stolen. It is widely used to reduce the scope of payment card data handling.

A dedicated hardware device that securely generates and stores cryptographic keys is a:

• a.TPM
• b.Hardware security module✓
• c.Smart card
• d.Proximity token

A hardware security module (HSM) is a tamper-resistant device that generates, stores, and manages cryptographic keys and performs crypto operations. It keeps keys isolated from general-purpose systems. HSMs are common in PKI and high-assurance environments.

Which chip on a motherboard stores keys and supports features like full-disk encryption and secure boot?

• a.HSM
• b.Smart card
• c.Trusted Platform Module✓
• d.CPU cache

The Trusted Platform Module (TPM) is a chip integrated into a device that securely stores keys and measurements for boot integrity and disk encryption. It binds encryption to specific hardware. It underpins features like BitLocker and secure boot.

Which property ensures a sender cannot later deny having sent a signed message?

• a.Confidentiality
• b.Availability
• c.Anonymity
• d.Non-repudiation✓

Non-repudiation prevents a party from convincingly denying an action, such as sending a digitally signed message. It relies on the private key being unique to the signer. Digital signatures and reliable logs provide non-repudiation.

Which is the correct order of the incident response process?

• a.Preparation, detection, containment, eradication, recovery, lessons learned✓
• b.Detection, preparation, recovery, containment, eradication
• c.Containment, detection, recovery, preparation, eradication
• d.Recovery, containment, detection, preparation, lessons learned

A standard incident response lifecycle proceeds through preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Preparation comes first so the team is ready before an incident. Lessons learned closes the loop to improve future response.

During incident response, which step focuses on limiting the damage and preventing the threat from spreading?

• a.Eradication
• b.Containment✓
• c.Recovery
• d.Preparation

Containment isolates affected systems to stop the incident from spreading while preserving evidence. It buys time to plan eradication without further loss. Short-term and long-term containment strategies balance disruption and safety.

Which system aggregates and correlates log data from many sources to detect security events in near real time?

• a.IDS
• b.DLP
• c.SIEM✓
• d.VPN

A security information and event management (SIEM) system centralizes logs from across the environment and correlates them to surface incidents. It supports alerting, dashboards, and investigation. Effective tuning reduces alert fatigue and false positives.

Which control monitors network traffic and actively blocks detected malicious activity inline?

• a.IDS
• b.SIEM
• c.Honeypot
• d.IPS✓

An intrusion prevention system (IPS) sits inline and can automatically block or drop malicious traffic it detects. Unlike an IDS, which only alerts, an IPS takes preventive action. Tuning is important to avoid blocking legitimate traffic.

Which technology inspects data in motion and at rest to prevent unauthorized exfiltration of sensitive information?

• a.Data loss prevention✓
• b.Firewall
• c.VPN
• d.Load balancer

Data loss prevention (DLP) detects and blocks sensitive data from leaving the organization through email, uploads, or removable media. It uses content inspection and policy rules. DLP helps enforce compliance and protect intellectual property.

Which process applies vendor updates to fix known software vulnerabilities?

• a.Hardening
• b.Patch management✓
• c.Baselining
• d.Tokenization

Patch management is the disciplined process of testing and deploying vendor updates to remediate vulnerabilities. Timely patching closes known exploit paths. A formal cycle balances speed with stability testing.

Reducing a system's attack surface by disabling unneeded services and applying secure configurations is called:

• a.Segmentation
• b.Failover
• c.Hardening✓
• d.Federation

Hardening strengthens a system by removing unnecessary services, closing ports, and applying secure settings and baselines. It reduces the attack surface before deployment. Configuration benchmarks guide consistent hardening.

Which practice ensures evidence remains admissible by documenting who handled it and when?

• a.Data retention
• b.Legal hold
• c.Nondisclosure
• d.Chain of custody✓

Chain of custody documents every person who handled evidence and each transfer, preserving integrity for legal proceedings. Gaps can render evidence inadmissible. It is essential in digital forensics and investigations.

During forensic acquisition, why is a cryptographic hash taken of a disk image?

• a.To prove the copy was not altered✓
• b.To compress the image
• c.To encrypt the evidence
• d.To speed up analysis

Hashing the original and the forensic image proves they are identical and that the evidence was not modified. Matching hashes demonstrate integrity throughout the investigation. Any change to the data would produce a different hash.

Which type of backup captures only the data changed since the last full backup and does not clear the archive bit each time?

• a.Incremental
• b.Differential✓
• c.Snapshot
• d.Full

A differential backup copies all data changed since the last full backup, growing larger each day until the next full. Restores require the last full plus the latest differential. Incremental backups, by contrast, capture changes since the last backup of any type.

Which metric defines the maximum acceptable amount of data loss measured in time?

• a.MTTR
• b.RTO
• c.RPO✓
• d.MTBF

The recovery point objective (RPO) is the maximum tolerable data loss expressed as a time window, guiding backup frequency. An RPO of one hour means backups must occur at least hourly. It differs from RTO, which addresses restoration time.

Which metric defines the maximum acceptable time to restore a service after an outage?

• a.RPO
• b.MTBF
• c.MTTF
• d.RTO✓

The recovery time objective (RTO) is the target duration within which a service must be restored after disruption. It drives decisions about redundancy and recovery capability. Meeting the RTO limits business impact from downtime.

Which recovery site is fully equipped and can take over operations almost immediately?

• a.Hot site✓
• b.Warm site
• c.Cold site
• d.Mobile site

A hot site is fully provisioned with hardware, data, and connectivity so it can assume operations quickly. It offers the fastest recovery but the highest cost. Cold sites are cheaper but require significant setup time.

Which scan identifies known weaknesses in systems without actively exploiting them?

• a.Penetration test
• b.Vulnerability scan✓
• c.Fuzzing
• d.Red team exercise

A vulnerability scan enumerates known weaknesses using signatures and checks without exploiting them. It is broad and repeatable for routine assessment. A penetration test goes further by attempting actual exploitation.

An authorized simulated attack that attempts to exploit vulnerabilities to test defenses is a:

• a.Vulnerability scan
• b.Compliance audit
• c.Penetration test✓
• d.Tabletop exercise

A penetration test authorizes ethical hackers to actively exploit weaknesses to demonstrate real-world risk. It validates whether vulnerabilities are truly exploitable and how far an attacker could get. Rules of engagement define scope and limits.

Which detection method flags activity that deviates from an established normal pattern?

• a.Signature-based
• b.Rule-based
• c.Whitelist-based
• d.Anomaly-based✓

Anomaly-based detection builds a baseline of normal behavior and alerts on deviations, enabling detection of novel attacks. It can catch previously unseen threats but may produce more false positives. Signature-based detection, by contrast, matches known patterns.

Which endpoint solution continuously records activity and enables investigation and automated response to threats on hosts?

• a.EDR✓
• b.Antivirus signature file
• c.Host firewall
• d.Screen lock policy

Endpoint detection and response (EDR) continuously monitors endpoint behavior, records telemetry, and supports rapid investigation and automated containment. It goes beyond signature antivirus by detecting suspicious behavior. It is central to modern threat hunting and response.

Which practice ensures logs cannot be tampered with by centralizing them on a protected, write-once server?

• a.Log rotation
• b.Log integrity and centralization✓
• c.Log compression
• d.Log sampling

Centralizing logs on a hardened, tamper-resistant server preserves their integrity for investigations. Attackers often try to delete local logs to hide activity, so protected central storage defeats this. Techniques like write-once media and hashing further ensure integrity.

A discussion-based session where a team walks through their response to a hypothetical incident is called a:

• a.Penetration test
• b.Full interruption test
• c.Tabletop exercise✓
• d.Vulnerability assessment

A tabletop exercise is a discussion-based walkthrough of a scenario to validate plans and roles without touching production. It reveals gaps in the incident response or continuity plan at low cost. It complements more disruptive technical tests.

Which automation approach uses playbooks to coordinate tools and streamline security operations tasks?

• a.EDR
• b.SIEM
• c.DLP
• d.SOAR✓

Security orchestration, automation, and response (SOAR) uses playbooks to automate and coordinate actions across security tools. It accelerates repetitive response tasks and reduces analyst workload. It often works alongside a SIEM to act on alerts.

Which principle requires that two people perform a sensitive action together to prevent fraud?

• a.Separation of duties✓
• b.Least privilege
• c.Job rotation
• d.Mandatory vacation

Separation of duties splits a critical task so no single person controls it end to end, reducing fraud and error. For example, one person requests a payment and another approves it. It is a key internal control in security and finance.

Rotating employees through different roles helps detect fraud and reduce dependence on any one person. This control is:

• a.Least privilege
• b.Job rotation✓
• c.Separation of duties
• d.Onboarding

Job rotation moves staff through different duties, which can expose irregularities hidden by a single long-tenured employee. It also reduces single points of knowledge. Mandatory vacations serve a similar detective purpose.

Which secure disposal method makes data on a drive unrecoverable by destroying the media physically?

• a.Formatting
• b.Deletion
• c.Physical destruction✓
• d.Defragmentation

Physical destruction, such as shredding or degaussing, renders storage media and its data unrecoverable. Simple formatting or deletion can leave data recoverable. Destruction is preferred for highly sensitive media at end of life.

Which threat intelligence source consists of shared indicators of compromise that defenders can ingest to detect attacks?

• a.Marketing feed
• b.Firmware feed
• c.Social media feed
• d.Threat feed✓

A threat intelligence feed supplies indicators of compromise such as malicious IPs, domains, and file hashes. Ingesting these into detection tools helps identify known threats quickly. Feeds should be evaluated for relevance and timeliness to be useful.

Which document outlines acceptable and prohibited uses of an organization's IT systems by employees?

• a.Acceptable use policy✓
• b.Business impact analysis
• c.Service level agreement
• d.Memorandum of understanding

An acceptable use policy (AUP) defines how employees may and may not use company systems and data. It sets expectations and provides grounds for enforcement. Users typically acknowledge it as a condition of access.

Which risk response involves purchasing insurance to shift financial impact to a third party?

• a.Risk avoidance
• b.Risk transference✓
• c.Risk acceptance
• d.Risk mitigation

Risk transference shifts the financial consequences of a risk to another party, commonly through insurance or contracts. The risk still exists, but its impact is borne elsewhere. It is chosen when handling the risk directly is impractical or costly.

Choosing to take no action and knowingly bear a low-level risk is called:

• a.Risk avoidance
• b.Risk transference
• c.Risk acceptance✓
• d.Risk mitigation

Risk acceptance is a conscious decision to tolerate a risk, usually when the cost of controls exceeds the potential loss. It should be formally documented and approved. Acceptance is appropriate for low-impact or low-likelihood risks.

Eliminating a risky activity entirely so the risk no longer applies is known as:

• a.Risk acceptance
• b.Risk transference
• c.Risk mitigation
• d.Risk avoidance✓

Risk avoidance removes the risk by discontinuing the activity that causes it. For example, not deploying a feature that would expose sensitive data. It fully eliminates that risk but may sacrifice a business opportunity.

Which regulation governs the protection of personal data for individuals in the European Union?

• a.GDPR✓
• b.HIPAA
• c.PCI DSS
• d.SOX

The General Data Protection Regulation (GDPR) sets strict requirements for handling the personal data of EU residents. It mandates consent, breach notification, and data subject rights. Non-compliance can result in substantial fines.

Which standard governs the secure handling of payment card data?

• a.HIPAA
• b.PCI DSS✓
• c.GDPR
• d.FERPA

The Payment Card Industry Data Security Standard (PCI DSS) defines controls for organizations that store, process, or transmit cardholder data. It is a contractual requirement rather than a law. Compliance reduces the risk of payment data breaches.

Which US regulation protects the privacy and security of health information?

• a.GDPR
• b.PCI DSS
• c.HIPAA✓
• d.GLBA

The Health Insurance Portability and Accountability Act (HIPAA) sets requirements for safeguarding protected health information. It applies to healthcare providers, plans, and their business associates. Violations can lead to significant penalties.

A calculation of expected yearly loss from a risk, found by multiplying single loss expectancy by annual rate of occurrence, is the:

• a.Residual risk
• b.Risk appetite
• c.Exposure factor
• d.Annualized loss expectancy✓

Annualized loss expectancy (ALE) estimates the expected yearly cost of a risk by multiplying single loss expectancy (SLE) by the annualized rate of occurrence (ARO). It supports cost-benefit decisions about controls. Spending more than the ALE on mitigation is usually not justified.

Which assessment identifies the critical processes and the impact of their disruption to guide continuity planning?

• a.Business impact analysis✓
• b.Penetration test
• c.Vulnerability scan
• d.Gap analysis

A business impact analysis (BIA) identifies critical business functions and quantifies the effect of their disruption over time. It informs RTO and RPO targets and prioritizes recovery. It is a foundation of business continuity planning.

Which agreement defines the measurable service levels a provider must meet, such as uptime guarantees?

• a.MOU
• b.Service level agreement✓
• c.NDA
• d.BPA

A service level agreement (SLA) specifies measurable commitments like availability and response times, with consequences for missing them. It sets clear expectations between provider and customer. Monitoring against the SLA holds the provider accountable.

Which legal agreement prohibits parties from disclosing confidential information they receive?

• a.SLA
• b.MOU
• c.Non-disclosure agreement✓
• d.AUP

A non-disclosure agreement (NDA) legally binds parties to keep shared confidential information secret. It is common when sharing sensitive data with vendors, partners, or employees. Breaching it can result in legal liability.

The residual risk that remains after all controls have been applied should be:

• a.Ignored entirely
• b.Transferred automatically
• c.Eliminated completely
• d.Accepted by management✓

Residual risk is what remains after mitigations are in place, and it cannot usually be reduced to zero. Senior management should formally acknowledge and accept it. This ensures leadership is aware of and owns the remaining exposure.

Which framework provides a widely used structure for managing cybersecurity risk through functions like Identify, Protect, Detect, Respond, and Recover?

• a.NIST Cybersecurity Framework✓
• b.OWASP Top Ten
• c.MITRE ATT&CK
• d.PCI DSS

The NIST Cybersecurity Framework organizes security activities into core functions: Identify, Protect, Detect, Respond, and Recover. It offers a flexible, risk-based approach adaptable to any organization. It helps align security programs with business goals.

Regular training that teaches employees to recognize phishing and follow security policies is called:

• a.Penetration testing
• b.Security awareness training✓
• c.Change management
• d.Vulnerability management

Security awareness training educates users to recognize threats like phishing and to follow safe practices. Because people are a common attack vector, this reduces human-related risk. Ongoing and simulated exercises reinforce the behavior over time.