Security Plus-øveprøve

• A. Corrective
• B. Deterrent
• C. Compensating
• D. Detective

Svar: B. Deterrent

A deterrent control tries to discourage an action before it starts, and a sign works only by changing what a would-be intruder decides to do. The camera behind it would be a detective control, because it records what happens. A corrective control fixes damage afterward, and a compensating control stands in when the preferred control cannot be used.

Hashing a file lets you detect whether it changed, which supports _____. A digital signature adds _____, because only the holder of the private key could have produced it.

Muligheder for felt 1: confidentiality, integrity, availability

Muligheder for felt 2: non-repudiation, availability, obfuscation

Svar: integrity, non-repudiation

A hash is a fixed-length fingerprint of the data, and any change to the file produces a different one, so comparing hashes checks integrity. A hash does not hide the contents, so it is not confidentiality. A digital signature is made with the signer's private key and checked with the public key, which ties the message to the signer. That makes it hard for the signer to deny sending it later, which is non-repudiation.

• A. An insider threat seeking financial gain
• B. A hacktivist seeking publicity
• C. A nation-state seeking espionage
• D. An unskilled attacker seeking notoriety

Svar: A. An insider threat seeking financial gain

The actor already has legitimate access and is taking data for personal or competitive advantage, which is an insider threat. Perimeter defenses do not stop someone who is already inside. The controls that help are least privilege, data loss prevention, activity monitoring, and removing access promptly when someone leaves.

Vælg alle, der passer.

• A. A phishing email that imitates the payroll department
• B. SQL injection against a login form
• C. Calling the help desk and pretending to be a senior executive to get a password reset
• D. Following an employee through a badge-controlled door without a badge
• E. A buffer overflow in a network service
• F. A distributed denial-of-service flood

Svar: A. A phishing email that imitates the payroll department, C. Calling the help desk and pretending to be a senior executive to get a password reset, D. Following an employee through a badge-controlled door without a badge

Social engineering manipulates people, not software. Phishing tricks the reader, pretexting invents a believable story to get information or access, and tailgating uses courtesy to slip past a physical control. SQL injection, buffer overflows and denial-of-service floods attack systems directly, so they are application or network attacks. Technical controls alone will not stop the human kind, and security awareness training is the main defense.

• A. Forcing users to choose longer passwords
• B. Requiring a VPN to reach the web server
• C. Enabling full-disk encryption on the database server
• D. Using parameterized queries and validating input

Svar: D. Using parameterized queries and validating input

This is SQL injection. The application pastes user input into a database command, so the attacker's text becomes part of the command. Parameterized queries keep the input as data, never as code, and input validation adds a second layer. Longer passwords do not matter when the check is bypassed, a VPN does not stop an authorized user from sending bad input, and disk encryption protects data at rest, not queries.

• A. It is allowed, because the user is already inside the trusted network
• B. It is allowed once the user passes the firewall at the network edge
• C. It is evaluated on its own, checking identity, device health and context before access is granted
• D. It is blocked unless the user is physically in the office

Svar: C. It is evaluated on its own, checking identity, device health and context before access is granted

Zero trust drops the idea that being inside the network earns trust. Every request is verified explicitly, using identity, device posture, location and other signals, and access is limited to what the request needs. That limits how far an attacker or a compromised account can move once inside. Location can be one input, but it is never the only one.

• A. Recovery time objective (RTO)
• B. Recovery point objective (RPO)
• C. Mean time between failures (MTBF)
• D. Mean time to repair (MTTR)

Svar: B. Recovery point objective (RPO)

The recovery point objective is the most data loss the business accepts, measured as time back from the incident. A four-hour RPO means backups or replication must run at least every four hours. The recovery time objective is how fast a service must be back, which is a different question. MTBF and MTTR describe how reliable and how repairable a component is.

Vælg alle, der passer.

• A. Patching the guest operating system
• B. Physical security of the provider's data centers
• C. Configuring user access and protecting the data stored in the virtual machines
• D. Maintaining the hypervisor and host hardware
• E. Hardening and patching the applications the customer installs

Svar: A. Patching the guest operating system, C. Configuring user access and protecting the data stored in the virtual machines, E. Hardening and patching the applications the customer installs

In the shared responsibility model, the provider secures the facilities, hardware and virtualization layer. In IaaS the customer owns everything above that: the guest operating system, applications, identities, access settings and data. The split moves with the service model. In software as a service the provider takes on much more, but the customer still owns user access and data.

• A. A password and a security question
• B. A PIN and a password
• C. A password and a fingerprint scan
• D. Two different passwords

Svar: C. A password and a fingerprint scan

Multifactor authentication combines different factor types: something you know, something you have, something you are, and sometimes somewhere you are. A password is knowledge and a fingerprint is something you are, so that pair counts. A security question, a PIN and a second password are all knowledge, so each of those pairs is still a single factor used twice.

Vælg alle, der passer.

• A. Disconnect the workstation from the network to contain the spread
• B. Wait a week to see whether the alerts repeat before taking action
• C. Restore the affected systems from clean, tested backups after the malware is removed
• D. Delete the logs on the workstation to save disk space
• E. Hold a lessons-learned review and update the response plan afterward

Svar: A. Disconnect the workstation from the network to contain the spread, C. Restore the affected systems from clean, tested backups after the malware is removed, E. Hold a lessons-learned review and update the response plan afterward

Incident response moves through preparation, detection and analysis, containment, eradication, recovery and a review afterward. Isolating the machine contains the damage, restoring from clean backups recovers, and the lessons-learned review improves the plan. Waiting lets the malware spread, and deleting logs destroys evidence that the investigation and any legal process may need.

• A. A false negative
• B. A false positive
• C. A true negative
• D. A true positive

Svar: A. A false negative

A false negative is a real problem that the tool failed to report, and it is the dangerous kind because nobody looks for something that was never flagged. A false positive is the reverse, a finding that turns out not to exist. Credentialed scans and a second tool or manual check are common ways to cut down on false negatives.

An intrusion detection system _____ suspicious traffic and raises an alert, while an intrusion prevention system placed inline can also _____ it.

Muligheder for felt 1: encrypts, detects, routes

Muligheder for felt 2: archive, replicate, block

Svar: detects, block

A detection system watches a copy of the traffic and tells people about problems. A prevention system sits in the path of the traffic, so it can drop the packets or reset the connection as well. The tradeoff is that an inline system can interrupt legitimate traffic if it is wrong, so it needs careful tuning.

A single loss event is expected to cost $20,000 and to happen about once every two years. The annualized loss expectancy is $_____.

Muligheder for felt 1: 5,000, 10,000, 20,000, 40,000

Svar: 10,000

Annualized loss expectancy is the single loss expectancy times the annualized rate of occurrence. One event every two years is a rate of 0.5 per year, so 20,000 x 0.5 = 10,000. The 40,000 option multiplies by two instead of halving. The figure helps decide whether a control that costs less than the expected annual loss is worth buying.

• A. Avoid
• B. Accept
• C. Mitigate
• D. Transfer

Svar: D. Transfer

Transfer moves the financial impact to another party, such as an insurer. It does not lower the likelihood of a breach, and other harm like lost trust stays with the company. Avoid means dropping the risky activity, mitigate means reducing likelihood or impact with controls, and accept means knowingly living with the risk.

• A. Business impact analysis
• B. Rules of engagement
• C. Acceptable use policy
• D. Incident response plan

Svar: B. Rules of engagement

The rules of engagement set the scope, the schedule, the permitted techniques, who to contact and how to stop if something breaks. Written authorization is what separates a penetration test from an attack. A business impact analysis ranks business functions by how bad their loss would be, an acceptable use policy governs everyday use of company systems, and an incident response plan covers real incidents.