Download Cybersecurity Management II - Tactical - C795 ACTUAL FINAL ASSESSMENT EXAM 2025 and more Exams Nursing in PDF only on Docsity!
Cybersecurity Management II - Tactical - C795 ACTUAL
FINAL ASSESSMENT EXAM 2025 300 QUESTIONS AND
COMPLETE REVISED SOLUTIONS ALREADY GRADED A+
What are the 3 major components of a security assessment program? **- CORRECT ANSWER
** Security tests, security assessments, and security audits. What are security tests? - CORRECT ANSWER >>> Security tests verify that a control is functioning properly. What kind of security tests are performed? - CORRECT ANSWER >>> Automated scans, tool- assisted penetration tests, and manual attempts to undermine security What are security assessments? - CORRECT ANSWER >>> Security assessments are comprehensive reviews of the security of a system, application, or other tested environment. What kind of information do you get from security assessments? **- CORRECT ANSWER ** Review of the threat environment, current and future risks, and the value of the targeted environment. Who performs security assessments? - CORRECT ANSWER >>> Assessments maybe conducted by an internal team, or they maybe outsourced to a third-party assessment team with specific expertise in the areas being assessed. What does NIST SP 800-53A describe? - CORRECT ANSWER >>> Best practices in conducting security and privacy assessments.
What are the 4 assessments under NIST 800-53A? - CORRECT ANSWER >>> Specifications, Mechanisms, Activities, and Individuals. What are security audits? - CORRECT ANSWER >>> Security audits use many of the same techniques followed during security assessments but must be performed by independent auditors. What are 3 types of audits? - CORRECT ANSWER >>> Internal audits, external audits, and third-party audits What are internal audits? - CORRECT ANSWER >>> Internal audits are performed by an organization's internal audit staff and are typically intended for internal audiences. What are external audits? - CORRECT ANSWER >>> External audits are performed by an outside auditing firm. What are the big 4 audit firms? - CORRECT ANSWER >>> Ernst & Young, Deloitte, PricewaterhouseCoopers, and KPMG. What are third-party audits? - CORRECT ANSWER >>> Third-party audits are conducted by, or on behalf of, another organization What does SOC stand for? - CORRECT ANSWER >>> Service Organization Controls. What is SOC 1 Engagements? - CORRECT ANSWER >>> Assess the organization's controls that might impact the accuracy of financial reporting. What is SOC 2 Engagements? - CORRECT ANSWER >>> Assess the organization's controls that affect the security (confidentiality, integrity, and availability) and privacy of information stored in
What does SCAP stand for? - CORRECT ANSWER >>> Security Content Automation Protocol. What is Security Content Automation Protocol (SCAP)? - CORRECT ANSWER >>> SCAP provides this common framework for discussing and also facilitates the automation of interactions between different security systems. What is Common Vulnerabilities and Exposures (CVE)? - CORRECT ANSWER >>> Provides a naming system for describing security vulnerabilities. Common Vulnerability Scoring System (CVSS)? - CORRECT ANSWER >>> Provides a standardized scoring system for describing the severity of security vulnerabilities. What is Common Configuration Enumeration (CCE)? - CORRECT ANSWER >>> Provides a naming system for system configuration system issues. What is Common Platform Enumeration (CPE)? - CORRECT ANSWER >>> Provides a naming system for operating systems, applications, and devices. What is Extensible Configuration Checklist Description Format (XCCDF)? **- CORRECT ANSWER
** Provides a language for specifying security checklists. What is Open Vulnerability and Assessment Language (OVAL)? **- CORRECT ANSWER ** Provides a language for describing security testing procedures. What do vulnerability scans do? - CORRECT ANSWER >>> Vulnerability scans automatically probe systems, applications, and networks, looking for weaknesses that maybe exploited by an attacker
What are the four main categories of vulnerability scans? - CORRECT ANSWER >>> Network discovery scans, network vulnerability scans, web application vulnerability scans, and database vulnerability scans What is TCP SYN Scanning? - CORRECT ANSWER >>> Sends a single packet to each scanned port with the SYN flag set. What is another name for TCP SYN Scanning? - CORRECT ANSWER >>> Half-open scan. What is TCP Connect Scanning? - CORRECT ANSWER >>> Opens a full connection to the remote system on the specified port. What is TCP ACK Scanning? - CORRECT ANSWER >>> Sending a packet with the ACK flag set, indicating that it is part of an open connection. What is UDP Scanning? - CORRECT ANSWER >>> Performs a scan of the remote system using the UDP protocol, checking for active UDP services What is XMAS Scanning? - CORRECT ANSWER >>> Sends a packet with the FIN, PSH, and URG flags set. What does "Open" mean in Nmap? - CORRECT ANSWER >>> The port is open on the remote system and there is an application that is actively accepting connections on that port. What is "Closed" in Nmap? - CORRECT ANSWER >>> The port is accessible on the remote system, meaning that the firewall is allowing access, but there is no application accepting connections on that port.
What are database vulnerability scanners? - CORRECT ANSWER >>> Database vulnerability scanners are tools that allow security professionals to scan both databases and web applications for vulnerabilities that may affect database security. What is Sqlmap? - CORRECT ANSWER >>> Is a commonly used open source database vulnerability scanner that allows security administrators to probe web applications for database vulnerabilities. What are the 3 steps in the vulnerability management workflow? **- CORRECT ANSWER
** Detection, Validation, and Remediation? What is Detection? - CORRECT ANSWER >>> The initial identification of a vulnerability normally takes place as the result of a vulnerability scan. What is Validation? - CORRECT ANSWER >>> Once a scanner detects a vulnerability, administrators should confirm the vulnerability to determine that it is not a false positive report. What is Remediation? - CORRECT ANSWER >>> Validated vulnerabilities should then be remediated. This may include applying a vendor-supplied security patch, modifying a device configuration, implementing a workaround to avoid the vulnerability, or installing a web application firewall or other control that prevents the exploitation of the vulnerability. What are the 4 phases of penetration testing? - CORRECT ANSWER >>> Planning, information gathering and discovery, Attack, and reporting. ** Database vulnerability scanners are tools that allow security professionals to scan both databases and web applications for vulnerabilities that may affect database security. What is Sqlmap? - CORRECT ANSWER >>> Is a commonly used open source database vulnerability scanner that allows security administrators to probe web applications for database vulnerabilities. What are the 3 steps in the vulnerability management workflow? - CORRECT ANSWER >>> Detection, Validation, and Remediation? What is Detection? - CORRECT ANSWER >>> The initial identification of a vulnerability normally takes place as the result of a vulnerability scan. What is Validation? - CORRECT ANSWER >>> Once a scanner detects a vulnerability, administrators should confirm the vulnerability to determine that it is not a false positive report. What is Remediation? - CORRECT ANSWER >>> Validated vulnerabilities should then be remediated. This may include applying a vendor-supplied security patch, modifying a device configuration, implementing a workaround to avoid the vulnerability, or installing a web application firewall or other control that prevents the exploitation of the vulnerability. What are the 4 phases of penetration testing? - CORRECT ANSWER >>> Planning, information gathering and discovery, Attack, and reporting. What is Planning? - CORRECT ANSWER >>> Includes agreement on the scope of the test and the rules of engagement. This is an extremely important phase because it ensures that both the testing team and management are in agreement about the nature of the test and that the test is explicitly authorized.
What is Information Gathering & Discovery? - CORRECT ANSWER >>> Uses manual and automated tools to collect information about the target environment. This includes performing basic reconnaissance to determine system function (such as visiting websites hosted on the system) and conducting network discovery scans to identify open ports. Testers also use automated tools during this phase to probe for system weaknesses using network vulnerability scans, web vulnerability scans, and database vulnerability scans. What is Attack? - CORRECT ANSWER >>> Seeks to use manual and automated exploit tools to attempt to defeat system security. This step is where penetration testing goes beyond vulnerability scanning, as vulnerability scans do not attempt to actually exploit detected vulnerabilities. What is Reporting? - CORRECT ANSWER >>> Summarizes the results of the penetration testing and makes recommendations for improvements to system security. What is Metasploit used for? - CORRECT ANSWER >>> To automatically execute exploits against targeted systems What is a White-Box Penetration Test? - CORRECT ANSWER >>> Provides the attackers with the detailed information about the systems they target. What is Gray-Box Penetration Test? - CORRECT ANSWER >>> Also known as partial knowledge tests, these are sometimes chosen to balance the advantages and disadvantages of white- and black-box penetration tests. What is a Black-Box Penetration Test? - CORRECT ANSWER >>> Does not provide attackers with any information prior to the attack. What is another name for Black-Box Test? - CORRECT ANSWER >>> Unknown environment test.
What is Interactive Application Security Testing (IAST)? - CORRECT ANSWER >>> Performs real-time analysis of runtime behavior, application performance, HTTP/HTTPS traffic, frameworks, components, and backend connections. What is Runtime Application Self Protection (RASP)? - CORRECT ANSWER >>> Is a tool that runs on a server and intercepts calls to and from an application and validates data requests. What is ethical disclosure? - CORRECT ANSWER >>> This principle says that security professionals who detect a vulnerability have a responsibility to report that vulnerability to the vendor, providing them with an opportunity to develop a patch or other remediation to protect their customers. What is Fuzz Testing? - CORRECT ANSWER >>> Fuzz testing is a specialized dynamic testing technique that provides many different types of input to software to stress it's limits and find previously undetected flaws. What are the two main categories of fuzz testing? - CORRECT ANSWER >>> Mutation (Dumb) Fuzzing. What is Mutation (Dumb) Fuzzing? - CORRECT ANSWER >>> Takes previous input values from actual operation of the software and manipulates (or mutates) it to create fuzzed input. What is Generational (Intelligent) Fuzzing? - CORRECT ANSWER >>> Develops data models and creates new fuzzed input based on an understanding of the types of data used by the program. What is the zzuf tool? - CORRECT ANSWER >>> The zzuf tool automates the process of mutation fuzzing by manipulating input according to user specifications. What is bit flipping? - CORRECT ANSWER >>> This process of slightly manipulating the input.
What is Interface Testing? - CORRECT ANSWER >>> Interface testing assesses the performance of modules against the interface specifications to ensure that they will work together properly when all the development efforts are complete. What are the 3 types of interfaces? - CORRECT ANSWER >>> Application Programming Interfaces (API), User Intefaces (UI), and Physical Interfaces. What is Application Programming Interfaces? - CORRECT ANSWER >>> Offer a standardized way for code modules to interact and may be exposed to the outside world through web services. Developers must test API's to ensure that they enforce all security requirements. What are User Interfaces (UI's)? - CORRECT ANSWER >>> Examples include graphical user interfaces (GUIs) and command-line interfaces. UIs provide end users with the ability to interact with the software. Interface tests should include reviews of all user interfaces to verify that they function properly. What are Physical Interfaces? - CORRECT ANSWER >>> Exist in some applications that manipulate machinery, logic controllers, or other objects in the physical world. Software testers should pay careful attention to physical interfaces because of the potential sequences if they fail. What is misuse case testing? - CORRECT ANSWER >>> Software testers use a process known as misuse case testing or abuse case testing to evaluate the vulnerability of their software to these known risks. What is Test Coverage Analysis? - CORRECT ANSWER >>> To estimate the degree of testing conducted against the new software. What is Passive Monitoring? - CORRECT ANSWER >>> analyzes actual network traffic sent to a website by capturing it as it travels over the network or reaches the server.
What is job rotation? - CORRECT ANSWER >>> Job rotation (sometimes called rotation of duties) means that employees rotate through jobs or rotate job responsibilities with other employees What is mandatory vacation? - CORRECT ANSWER >>> This provides a form of peer review and helps detect fraud and collusion. What is Privileged Account Management (PAM)? - CORRECT ANSWER >>> Privileged account management (PAM) solutions restrict access to privileged accounts or detect when accounts use any elevated privileges. What is Service Level Agreement? - CORRECT ANSWER >>> A service level agreement (SLA) is an agreement between an organization and an outside entity, such as a vendor. What are duress systems? - CORRECT ANSWER >>> A simple duress system is just a button that sends a distress call. What are the 4 risks associated with electronic devices? - CORRECT ANSWER >>> Sensitive data, malware and monitoring devices, Free Wi-Fi, and VPN's. What is the another name for main-in-the-middle attack? - CORRECT ANSWER >>> On-path attack. What are emergency management plans? - CORRECT ANSWER >>> Emergency management plans and practices help an organization address personnel safety and security after a disaster. What is asset management? - CORRECT ANSWER >>> Asset management refers to managing both tangible and intangible assets.
What are tangible assets? - CORRECT ANSWER >>> Include hardware and software assets owned by the company. What are intangible assets? - CORRECT ANSWER >>> Intangible assets include patents, copyrights, a company's reputation, and other assets representing potential revenue What is media management? - CORRECT ANSWER >>> Media management refers to the steps taken to protect media and data stored on media. What is Mean Time To Failure (MTTF)? - CORRECT ANSWER >>> Reusable media is subject to a mean time to failure (MTTF) that is sometimes represented in the number of times it can be reused or the number of years you can expect to keep it. What is Mean Time Between Failure (MTBF)? - CORRECT ANSWER >>> MTBF refers to the amount of time expected to elapse between failures of an item that personnel will repair, such as a computer server. What is Software as a Service (SaaS)? - CORRECT ANSWER >>> Software as a service (SaaS) models provide fully functional applications typically accessible via a web browser. What is Platform as a Service? - CORRECT ANSWER >>> Platform as a service (PaaS) models provide consumers with a computing platform, including hardware, operating systems, and runtime environment. What is Infrastructure as a Service (IaaS)? - CORRECT ANSWER >>> Infrastructure as a service (IaaS) models provide basic computing resources to customers. This includes servers, storage, and networking resources What is a public cloud? - CORRECT ANSWER >>> A public cloud model includes assets available for any consumers to rent or lease and is hosted by an external CSP.
What is change management? - CORRECT ANSWER >>> A change management process ensures that personnel can perform a security impact analysis What are the 6 tasks in a change management process? - CORRECT ANSWER >>> Request the change, Review the change, approve/reject the change, test the change, schedule and implement the change, and document the change. What is Versioning? - CORRECT ANSWER >>> Versioning typically refers to version control used in software configuration management. What is configuration documentation? - CORRECT ANSWER >>> Configuration documentation identifies the current configuration of systems. What is a patch? - CORRECT ANSWER >>> A patch is a blanket term for any type of code written to correct a bug or vulnerability or to improve existing software performance. What are the 5 steps of patch management? - CORRECT ANSWER >>> Evaluate patches, test patches, approve the patches, deploy the patches, and verify that patches are deployed, What is vulnerability management? - CORRECT ANSWER >>> Vulnerability management refers to regularly identifying vulnerabilities,, evaluating them, and taking steps to mitigate risks associated with them. What are vulnerability scanners? - CORRECT ANSWER >>> Vulnerability scanners are software tools used to test systems and networks for known security issues. What is a residual risk? - CORRECT ANSWER >>> Any risk that remains after applying a control is residual risk.
What is Common Vulnerabilities and Exposures Dictionary? - CORRECT ANSWER >>> The CVE dictionary provides a standard convention used to identify and describe vulnerabilities. MITRE maintains the CVE database. What is an incident? - CORRECT ANSWER >>> An incident is any event that has a negative effect on the confidentiality, integrity, or availability of an organization's assets. What is a computer security incident? - CORRECT ANSWER >>> Refers to an incident that is the result of an attack or the result of malicious or intentional actions on the part of users. What are the 4 steps of the incident response life cycle? - CORRECT ANSWER >>> 1. Preparation. 2. Detection and analysis. 3. Containment, eradication, and recovery. 4. Post- incident recovery. What are the 7 steps of Incident Management? - CORRECT ANSWER >>> Detection, Response, Mitigation, Reporting, Recovery, Remediation, Lessons Learned. What does CIRT stand for? - CORRECT ANSWER >>> Computer Incident Response Team. What does CSIRT stand for? - CORRECT ANSWER >>> Computer Security Incident Response Team. What is mitigation? - CORRECT ANSWER >>> Attempt to contain an incident. What is a root cause analysis? - CORRECT ANSWER >>> A root cause analysis examines the incident to determine what allowed it to happen. What is a Preventive Control? - CORRECT ANSWER >>> A preventive control attempts to thwart or stop unwanted or unauthorized activity from occurring.
What is a Distributed Reflective Denial of Service (DRDoS) attack? - CORRECT ANSWER >>> It uses a reflected approach to an attack. What are examples of Distributed Reflective Denial of Service (DRDoS) attacks? - CORRECT ANSWER >>> DNS poisoning, smurf attacks, and fraggle attacks. What is SYN flood attack? - CORRECT ANSWER >>> It disrupts the standard three-way handshake used by Transmission Control Protocol (TCP) to initiate communication sessions. What is a smurf attack? - CORRECT ANSWER >>> It floods the victim with Internet Control Message Protocol (ICMP) echo packets instead of with TCP SYN packets. What is a fraggle attack? - CORRECT ANSWER >>> The fraggle attack will broadcast a UDP packet using the spoofed IP address of the victim. What is a ping flood? - CORRECT ANSWER >>> A ping flood attack floods a victim with ping requests. What is Ping of Death? - CORRECT ANSWER >>> It uses oversized ping packets to cause a buffer overflow error. What is Teardrop? - CORRECT ANSWER >>> A teardrop attack fragments data packets, making them difficult or impossible to be put back together by the receiving system. This often caused systems to crash. What is Land? - CORRECT ANSWER >>> In a land attack, the attack sends spoofed SYN packets to a victim using the victim's IP address as both the source and destination IP address. What is an example of a Land attack? - CORRECT ANSWER >>> Banana attack.
What does a Banana attack do? - CORRECT ANSWER >>> Redirects outgoing messages from a system back to the system, shutting down all external communication. What is a Zero-Day Exploit? - CORRECT ANSWER >>> A zero-day exploit refers to an attack on a system exploiting a vulnerability that is unknown to others What is a Man-in-the-middle attack? - CORRECT ANSWER >>> A man-in-the-middle (MiTM) attack (sometimes called an on-path attack) occurs when a malicious user establishes a position between two endpoints of an on-going communication. What is Sabotage? - CORRECT ANSWER >>> Employee Sabotage is a criminal act of destruction or disruption committed against an organization by an employee. What is intrusion detection? - CORRECT ANSWER >>> Intrusion detection is a specific form of monitoring that monitors events (Often in real time ) to detect abnormal activity indicating a potential incident or intrusion. What is an intrusion detection system? - CORRECT ANSWER >>> An intrusion detection system (IDS) automates the inspection of logs and real-time system events to detect intrusion attempts and system failures. What is Knowledge-Based Detection? - CORRECT ANSWER >>> It uses a database of known attacks developed by the IDS vendor. What is Behavior-Based Detection? - CORRECT ANSWER >>> Behavior-based detection starts by creating a baseline of normal activities and events on the system. Once it has accumulated enough baseline data to determine normal activity, it can detect abnormal activity that may indicate a malicious intrusion or event.
