Question 1

Which of the following is an example of a Denial-of-Service internal control?

Accepted Answer

A)  Manage capacity, bandwidth, or other redundancy to limit the effects of an attack. 
B)  Employ malicious code protection mechanisms at information system entry and exit points. 
C)  Configure malicious code detection to perform periodic scans of the information system, block malicious code, quarantine malicious code, and notify the administrator. 
D)  Monitor the information systems to detect attacks and indicators of potential attacks, including unauthorized local, network, and remote connections. 
A)  Manage capacity, bandwidth, or other redundancy to limit the effects of an attack. 
B)  Employ malicious code protection mechanisms at information system entry and exit points. 
C)  Configure malicious code detection to perform periodic scans of the information system, block malicious code, quarantine malicious code, and notify the administrator. 
D)  Monitor the information systems to detect attacks and indicators of potential attacks, including unauthorized local, network, and remote connections.

Question 2

Which of the physical reconnaissance attacks is a deceptive request designed to trick victims into sharing private information?

Accepted Answer

A)  Email phishing 
B)  Dumpster diving 
C)  Eavesdropping 
D)  Malware 
A)  Email phishing 
B)  Dumpster diving 
C)  Eavesdropping 
D)  Malware

Question 3

Which of the following is an example of Malware internal controls?

Accepted Answer

A)  Employ monitoring to detect indicators of attacks against, or launched from, the system. 
B)  Configure malicious code detection to perform periodic scans of the information system, block malicious code, quarantine malicious code, and notify the administrator. 
C)  Manage capacity, bandwidth, or other redundancy to limit the effects of an attack. 
D)  Monitor system resources to determine if sufficient resources exist to prevent effective attacks. 
A)  Employ monitoring to detect indicators of attacks against, or launched from, the system. 
B)  Configure malicious code detection to perform periodic scans of the information system, block malicious code, quarantine malicious code, and notify the administrator. 
C)  Manage capacity, bandwidth, or other redundancy to limit the effects of an attack. 
D)  Monitor system resources to determine if sufficient resources exist to prevent effective attacks.

Question 4

RAM Manufacturing LLC is a rapidly growing manufacturer of parts for the automotive industry. Maeve, an accountant at RAM Manufacturing recently received an email from Justin, the VP of Human Resources, asking her to click on a link and re-enter her login credentials and social security number. Suspicious of the email, Maeve forwarded the email to the Cybersecurity department. After talking with the cybersecurity department, Maeve decided to review her inbox to check for any other suspicious emails. Below is a list of what Maeve found:
a. An email reminder from the Human Resources department to enter her time for the month.
b. An email addressed to "Dear Accountant at RAM Manufacturing".
c. An email from a plant manager to escalate payment of an invoice, as the vendor won't ship needed steel until this invoice is paid.
d. A request from the CFO to transfer a large sum of money to an account that Maeve hadn't worked with before.
e. A request from a product manager to run a report on the costs involved in launching a new product the prior year.
Required: Do you think any of the emails are suspicious and why? Justify your answer by identifying the nature of the red flag or why it can be dismissed as suspicious.

Accepted Answer

b and d are suspicious. Email b is suspi

Question 5

An attacker force access to the network by attempting many passwords or phrases until finding the correct one. What type of attack is being described?

Accepted Answer

A)  Brute-force attack 
B)  On-path attack 
C)  IP spoofing 
D)  Tailgating 
A)  Brute-force attack 
B)  On-path attack 
C)  IP spoofing 
D)  Tailgating

Question 6

NIST provides explicit guidelines that companies can require for password strength. What is the NIST recommended length?

Accepted Answer

A)  2 - 6 characters 
B)  18 - 32 characters 
C)  4 - 8 characters 
D)  8 - 64 characters 
A)  2 - 6 characters 
B)  18 - 32 characters 
C)  4 - 8 characters 
D)  8 - 64 characters

Question 7

The National Institute of Standards and Technology (NIST) has published Security and Privacy Controls for Federal Information Systems and Organizations (NIST-800-53). The NIST-800-53 document is divided into 18 control families. One of the control families is System and Information Integrity. What ID does System and Information Integrity family use?

Accepted Answer

A)  SY 
B)  SS 
C)  SI 
D)  SN 
A)  SY 
B)  SS 
C)  SI 
D)  SN

Question 8

The National Institute of Standards and Technology (NIST) Cybersecurity Framework is displayed below.
  What is function C?

Accepted Answer

A)  Recover 
B)  Identify 
C)  Protect 
D)  Detect 
A)  Recover 
B)  Identify 
C)  Protect 
D)  Detect

Question 9

The National Institute of Standards and Technology (NIST) Cybersecurity Framework is displayed below.
  What is function E?

Accepted Answer

A)  Respond 
B)  Identify 
C)  Protect 
D)  Detect 
A)  Respond 
B)  Identify 
C)  Protect 
D)  Detect

Question 10

Match the cybersecurity threat to the following control activity:
-Ensure that the information system enforces minimum password complexity of specified case sensitivity, character numbers, and mix of uppercase and lowercase letters, including minimum requirements for each type.

Accepted Answer

A)  Brute-force attack 
B)  On-path attack 
C)  IP spoofing 
D)  Tailgating 
A)  Brute-force attack 
B)  On-path attack 
C)  IP spoofing 
D)  Tailgating

Question 11

What is a type of malicious code used by hackers that is programmed into a system and remains dormant until certain conditions are met?

Accepted Answer

A)  Virus 
B)  Worms 
C)  Logic bombs 
D)  Trojan horses 
A)  Virus 
B)  Worms 
C)  Logic bombs 
D)  Trojan horses

Question 12

For hackers to narrow their results, they use ________, which indicates which ports are open and sending or receiving data on the network.

Accepted Answer

A)  ping sweep 
B)  port scans 
C)  computer scan 
D)  network sweep 
A)  ping sweep 
B)  port scans 
C)  computer scan 
D)  network sweep

Question 13

NIST provides explicit guidelines that companies can require for password strength. What does NIST recommend for character types?

Accepted Answer

A)  Mixture of letters, numbers, and special characters 
B)  Numbers only 
C)  Mixture of numbers and letters 
D)  Letters only 
A)  Mixture of letters, numbers, and special characters 
B)  Numbers only 
C)  Mixture of numbers and letters 
D)  Letters only

Question 14

RAM Manufacturing LLC is a rapidly growing manufacturer of parts for the automotive industry. Justin, a newly hired Network Administrator, arrives at one of RAM Manufacturing's remote manufacturing facilities to perform a network upgrade. Justin approaches the main entrance and encounters Alison, a courier delivery person, waiting. Alison tells Justin that she delivers to the facility often and knows where the package goes. She asks if she could follow Justin in because she is behind schedule on her deliveries. Justin has never met Alison before. What should Justin do?

Accepted Answer

Justin should not let Alison f

Question 15

Which of the following describes an on-path attack?

Accepted Answer

A)  An on-path attack is when the attacker forces access to the network by attempting many passwords or phrases until finding the correct one. 
B)  An on-path attack is when the attacker attempts to gain access to an on-going communication between two endpoints by pretending to be each of the parties. 
C)  An on-path attack is when the attacker disguises their identity and impersonates a legitimate computer on the network. 
D)  An on-path attack is when the attacker follows an authorized user into the system. 
A)  An on-path attack is when the attacker forces access to the network by attempting many passwords or phrases until finding the correct one. 
B)  An on-path attack is when the attacker attempts to gain access to an on-going communication between two endpoints by pretending to be each of the parties. 
C)  An on-path attack is when the attacker disguises their identity and impersonates a legitimate computer on the network. 
D)  An on-path attack is when the attacker follows an authorized user into the system.

Question 16

At larger companies, the cybersecurity program is usually the responsibility of a dedicated executive leader. This could include the

Accepted Answer

A)  Chief Executive Officer. 
B)  Chief Information Officer. 
C)  Chief Marketing Officer. 
D)  Chief Operating Officer. 
A)  Chief Executive Officer. 
B)  Chief Information Officer. 
C)  Chief Marketing Officer. 
D)  Chief Operating Officer.

Question 17

Attackers us these three types of attacks to plan, enter, and damage a victim's network:
  What type of attack is B?

Accepted Answer

A)  Reconnaissance attack 
B)  Access attack 
C)  Disruptive attack 
D)  Translucent attack 
A)  Reconnaissance attack 
B)  Access attack 
C)  Disruptive attack 
D)  Translucent attack

Question 18

What is file transfer protocol (FTP)?

Accepted Answer

A)  Sending from obscure domains that are designed to look similar to legitimate domains 
B)  A standard network protocol that allows users to transfer files between the company network and outside parties 
C)  The process of using an algorithm to encode a plaintext message and converting it to something that is seemingly meaningless 
D)  Asking for personal information in a survey instead of taking you to a company portal to input information directly in the corporate system 
A)  Sending from obscure domains that are designed to look similar to legitimate domains 
B)  A standard network protocol that allows users to transfer files between the company network and outside parties 
C)  The process of using an algorithm to encode a plaintext message and converting it to something that is seemingly meaningless 
D)  Asking for personal information in a survey instead of taking you to a company portal to input information directly in the corporate system

Question 19

NIST provides explicit guidelines that companies can require for password strength. What is the NIST recommendation for resetting a password?

Accepted Answer

A)  Reset your password every month. 
B)  Only reset your password if you know it has been compromised. 
C)  Reset your password every six months. 
D)  Never reset your password. 
A)  Reset your password every month. 
B)  Only reset your password if you know it has been compromised. 
C)  Reset your password every six months. 
D)  Never reset your password.

Question 20

Which of the following is an example of Malware internal controls?

Accepted Answer

A)  Employ malicious code protection mechanisms at information system entry and exit points. 
B)  Employ monitoring to detect indicators of attacks launched from the system. 
C)  Manage capacity, bandwidth, or other redundancy to limit the effects of an attack. 
D)  Increase system resources to prevent an effective attack. 
A)  Employ malicious code protection mechanisms at information system entry and exit points. 
B)  Employ monitoring to detect indicators of attacks launched from the system. 
C)  Manage capacity, bandwidth, or other redundancy to limit the effects of an attack. 
D)  Increase system resources to prevent an effective attack.

Which of the following is an example of a Denial-of-Service internal control?

Which of the physical reconnaissance attacks is a deceptive request designed to trick victims into sharing private information?

Which of the following is an example of Malware internal controls?

An attacker force access to the network by attempting many passwords or phrases until finding the correct one. What type of attack is being described?

NIST provides explicit guidelines that companies can require for password strength. What is the NIST recommended length?

The National Institute of Standards and Technology (NIST) Cybersecurity Framework is displayed below. What is function C?

The National Institute of Standards and Technology (NIST) Cybersecurity Framework is displayed below. What is function E?

Match the cybersecurity threat to the following control activity: -Ensure that the information system enforces minimum password complexity of specified case sensitivity, character numbers, and mix of uppercase and lowercase letters, including minimum requirements for each type.

What is a type of malicious code used by hackers that is programmed into a system and remains dormant until certain conditions are met?

For hackers to narrow their results, they use ________, which indicates which ports are open and sending or receiving data on the network.

NIST provides explicit guidelines that companies can require for password strength. What does NIST recommend for character types?

Which of the following describes an on-path attack?

At larger companies, the cybersecurity program is usually the responsibility of a dedicated executive leader. This could include the

Attackers us these three types of attacks to plan, enter, and damage a victim's network: What type of attack is B?

What is file transfer protocol (FTP)?

NIST provides explicit guidelines that companies can require for password strength. What is the NIST recommendation for resetting a password?

Which of the following is an example of Malware internal controls?

Accounting As Information

Risks and Risk Assessments

Risk Management and Internal Controls

Software and Systems

Data Storage and Analysis

Systems and Database Design

Emerging and Disruptive Technologies

Documenting Systems and Processes

Human Resources and Payroll Processes

Purchasing and Payments Process

Conversion Processes

Marketing, Sales, and Collection Processes

Financial Reporting Processes

Information Systems and Controls

Fraud

Data Analytics

Data Visualization

Audit Assurance

Filters

Exam 16: Cybersecurity

Which of the following is an example of a Denial-of-Service internal control?

Which of the physical reconnaissance attacks is a deceptive request designed to trick victims into sharing private information?

Which of the following is an example of Malware internal controls?

An attacker force access to the network by attempting many passwords or phrases until finding the correct one. What type of attack is being described?

NIST provides explicit guidelines that companies can require for password strength. What is the NIST recommended length?

The National Institute of Standards and Technology (NIST) Cybersecurity Framework is displayed below. What is function C?

The National Institute of Standards and Technology (NIST) Cybersecurity Framework is displayed below. What is function E?

Match the cybersecurity threat to the following control activity: -Ensure that the information system enforces minimum password complexity of specified case sensitivity, character numbers, and mix of uppercase and lowercase letters, including minimum requirements for each type.

What is a type of malicious code used by hackers that is programmed into a system and remains dormant until certain conditions are met?

For hackers to narrow their results, they use ________, which indicates which ports are open and sending or receiving data on the network.

NIST provides explicit guidelines that companies can require for password strength. What does NIST recommend for character types?

Which of the following describes an on-path attack?

At larger companies, the cybersecurity program is usually the responsibility of a dedicated executive leader. This could include the

Attackers us these three types of attacks to plan, enter, and damage a victim's network: What type of attack is B?

What is file transfer protocol (FTP)?

NIST provides explicit guidelines that companies can require for password strength. What is the NIST recommendation for resetting a password?

Which of the following is an example of Malware internal controls?

Accounting As Information

Risks and Risk Assessments

Risk Management and Internal Controls

Software and Systems

Data Storage and Analysis

Systems and Database Design

Emerging and Disruptive Technologies

Documenting Systems and Processes

Human Resources and Payroll Processes

Purchasing and Payments Process

Conversion Processes

Marketing, Sales, and Collection Processes

Financial Reporting Processes

Information Systems and Controls

Fraud

Data Analytics

Data Visualization

Audit Assurance

Filters