Cybersecurity Essentials 1.13 Chapter 8 Quiz Answers 100% 2024

Cybersecurity Essentials 1.13 – Chapter 8: Becoming a Cybersecurity Specialist Quiz Answers Full 100% 2023 2024

An auditor is asked to assess the LAN of a company for potential threats. What are three potential threats the auditor may point out? (Choose three.)
- a misconfigured firewall
- unauthorized port scanning and network probing
- unlocked access to network equipment
- complex passwords
- locked systems
- the acceptable use policy
  
  Explanation:
  
  The LAN can have many endpoint devices connected. Analyzing both the network devices and the endpoints connected is important in determining threats.
As part of HR policy in a company, an individual may opt-out of having information shared with any third party other than the employer. Which law protects the privacy of personal shared information?
- GLBA
- PCI
- SOX
- FIRPA
  
  Explanation:
  
  The Gramm-Leach-Bliley Act (GLBA) includes privacy provisions for individuals and provides opt-out methods to restrict information sharing with third-party firms.

As a security professional, there is a possibility to have access to sensitive data and assets. What is one item a security professional should understand in order to make informed ethical decisions?

partnerships
potential gain
laws governing the data
cloud providers

potential bonus

Explanation:

Ethics in the security profession are extremely important because of the sensitivity of the data and assets. Compliance to government and state requirements is needed in order to make good judgments.

A security professional is asked to perform an analysis of the current state of a company network. What tool would the security professional use to scan the network only for security risks?

vulnerability scanner
malware
packet analyzer

pentest

Explanation:

Vulnerability scanners are commonly used to scan for the following vulnerabilities:

Use of default passwords or common passwords
Missing patches
Open ports
Misconfiguration of operating systems and software
Active IP addresses

A consultant is hired to make recommendations on managing device threats in a company. What are three general recommendations that can be made? (Choose three.)
- Enforce strict HR policies.
- Disable administrative rights for users.
- Remove content filtering.
- Enable media devices.
- Enable automated antivirus scans.
- Enable screen lockout.
  
  Explanation:
  
  Workstations can be hardened by removing unnecessary permissions, automating processes, and turning on security features.

What three services does CERT provide? (Choose three.)

enforce software standards
develop tools, products, and methods to analyze vulnerabilities
develop tools, products, and methods to conduct forensic examinations
create malware tools
resolve software vulnerabilities

develop attack tools

Explanation:

CERT provides multiple services, including:

helps to resolve software vulnerabilities
develops tools, products, and methods to conduct forensic examinations
develops tools, products, and methods to analyze vulnerabilities
develops tools, products, and methods to monitor large networks
helps organizations determine how effective their security-related practices are

What are two items that can be found on the Internet Storm Center website? (Choose two.)
- InfoSec reports
- historical information
- InfoSec job postings
- current laws
  
  Explanation:
  
  The Internet Storm Center website has a daily InfoSec blog, InfoSec tools, and news among other InfoSec information.

What can be used to rate threats by an impact score to emphasize important vulnerabilities?

CERT
ACSC
NVD

ISC

Explanation:

The National Vulnerability Database (NVD) is used to assess the impact of vulnerabilities and can assist an organization in ranking the severity of vulnerabilities found within a network.

A breach occurs in a company that processes credit card information. Which industry specific law governs credit card data protection?
- PCI DSS
- ECPA
- SOX
- GLBA
  
  Explanation:
  
  The Payment Card Industry Data Security Standard (PCI DSS) governs how to protect credit card data as merchants and banks exchange transactions.
Why is Kali Linux a popular choice in testing the network security of an organization?
- It is a network scanning tool that prioritizes security risks.
- It can be used to intercept and log network traffic.
- It can be used to test weaknesses by using only malicious software.
- It is an open source Linux security distribution and contains over 300 tools.
  
  Explanation:
  
  Kali is an open source Linux security distribution that is commonly used by IT professionals to test the security of networks.
A company is attempting to lower the cost in deploying commercial software and is considering a cloud based service. Which cloud based service would be best to host the software?
- RaaS
- SaaS
- PaaS
- IaaS
  
  Explanation:
  
  Software as a service (SaaS) provides access to software that is centrally hosted and accessed by users via a web browser on the cloud.

An organization has implemented a private cloud infrastructure. The security administrator is asked to secure the infrastructure from potential threats. What three tactics can be implemented to protect the private cloud? (Choose three.)

Update devices with security fixes and patches.
Hire a consultant.
Disable firewalls.
Test inbound and outbound traffic.
Disable ping, probing, and port scanning.

Grant administrative rights.

Explanation:

Organizations can manage threats to the private cloud using the following methods:

Disable ping, probing, and port scanning.
Implement intrusion detection and prevention systems.
Monitor inbound IP traffic anomalies.
Update devices with security fixes and patches.
Conduct penetration tests post configuration.
Test inbound and outbound traffic.
Implement a data classification standard.
Implement file transfer monitoring and scanning for unknown file type.

A school administrator is concerned with the disclosure of student information due to a breach. Under which act is student information protected?
- FERPA
- HIPPA
- CIPA
- COPPA
  
  Explanation:
  
  The Family Education Records and Privacy Act (FERPA) prohibits the improper disclosure of personal education records.
What are the three broad categories for information security positions? (Choose three.)
- definers
- doers
- seekers
- monitors
- builders
- creators
  Explanation:
  
  Information security positions can be categorized as::
  
  definers
  
  builders
  
  monitors

What are two potential threats to applications? (Choose two.)

data loss
social engineering
power interruptions

unauthorized access

Explanation:

Threats to applications can include the following:

Unauthorized access to data centers, computer rooms, and wiring closets
Server downtime for maintenance purposes
Network operating system software vulnerability
Unauthorized access to systems
Data loss
Downtime of IT systems for an extended period
Client/server or web application development vulnerabilities

If a person knowingly accesses a government computer without permission, what federal act laws would the person be subject to?
- GLBA
- ECPA
- SOX
- CFAA
  
  Explanation:
  
  The Computer Fraud and Abuse Act (CFAA) provides the foundation for US laws criminalizing unauthorized access to computer systems.

A company has had several incidents involving users downloading unauthorized software, using unauthorized websites, and using personal USB devices. The CIO wants to put in place a scheme to manage the user threats. What three things might be put in place to manage the threats? (Choose three.)

Disable CD and USB access.
Monitor all activity by the users.
Provide security awareness training.
Use content filtering.
Change to thin clients.

Implement disciplinary action.

Explanation:

Users may be unaware of their actions if not educated in the reasons why their actions can cause a problem with the computer. By implementing several technical and nontechnical practices, the threat can be reduced.

What are three disclosure exemptions that pertain to the FOIA? (Choose three.)

public information from financial institutions
confidential business information
non-geological information regarding wells
information specifically non-exempt by statue
national security and foreign policy information

law enforcement records that implicate one of a set of enumerated concerns

Explanation:

The nine Freedom of Information Act (FOIA) exemptions include the following:

National security and foreign policy information
Internal personnel rules and practices of an agency
Information specifically exempted by statute
Confidential business information
Inter- or intra-agency communication subject to deliberative process, litigation, and other privileges
Information that, if disclosed, would constitute a clearly unwarranted invasion of personal privacy
Law enforcement records that implicate one of a set of enumerated concerns
Agency information from financial institutions
Geological and geophysical information concerning wells

Unauthorized visitors have entered a company office and are walking around the building. What two measures can be implemented to prevent unauthorized visitor access to the building? (Choose two.)

Establish policies and procedures for guests visiting the building.
Conduct security awareness training regularly.
Lock cabinets.

Prohibit exiting the building during working hours.

Explanation:

Any unauthorized individual that accesses a facility may pose a potential threat. Common measures to increase physical security include the following:

Implement access control and closed-circuit TV (CCTV) coverage at all entrances.
Establish policies and procedures for guests visiting the facility.
Test building security using physical means to covertly gain access.
Implement badge encryption for entry access.
Conduct security awareness training regularly.
Implement an asset tagging system.

Cybersecurity Essentials 1.13 – Chapter 8: Becoming a Cybersecurity Specialist Quiz Answers Full 100% 2023 2024

An auditor is asked to assess the LAN of a company for potential threats. What are three potential threats the auditor may point out? (Choose three.)

As part of HR policy in a company, an individual may opt-out of having information shared with any third party other than the employer. Which law protects the privacy of personal shared information?

As a security professional, there is a possibility to have access to sensitive data and assets. What is one item a security professional should understand in order to make informed ethical decisions?

A security professional is asked to perform an analysis of the current state of a company network. What tool would the security professional use to scan the network only for security risks?

A consultant is hired to make recommendations on managing device threats in a company. What are three general recommendations that can be made? (Choose three.)

What three services does CERT provide? (Choose three.)

What are two items that can be found on the Internet Storm Center website? (Choose two.)

What can be used to rate threats by an impact score to emphasize important vulnerabilities?

A breach occurs in a company that processes credit card information. Which industry specific law governs credit card data protection?

Why is Kali Linux a popular choice in testing the network security of an organization?

A company is attempting to lower the cost in deploying commercial software and is considering a cloud based service. Which cloud based service would be best to host the software?

An organization has implemented a private cloud infrastructure. The security administrator is asked to secure the infrastructure from potential threats. What three tactics can be implemented to protect the private cloud? (Choose three.)

A school administrator is concerned with the disclosure of student information due to a breach. Under which act is student information protected?

What are the three broad categories for information security positions? (Choose three.)

What are two potential threats to applications? (Choose two.)

If a person knowingly accesses a government computer without permission, what federal act laws would the person be subject to?

A company has had several incidents involving users downloading unauthorized software, using unauthorized websites, and using personal USB devices. The CIO wants to put in place a scheme to manage the user threats. What three things might be put in place to manage the threats? (Choose three.)

What are three disclosure exemptions that pertain to the FOIA? (Choose three.)

Unauthorized visitors have entered a company office and are walking around the building. What two measures can be implemented to prevent unauthorized visitor access to the building? (Choose two.)