Cybersecurity-Apprentice Cybersecurity Fundamentals Practice Test 5 — 15 Questions

Question 1

A junior security analyst receives an alert that a user's account was accessed from two geographically distant locations within a few minutes. The organization has no travel policy exceptions for this user. Which cybersecurity principle is MOST directly relevant to investigating whether this is a genuine compromise?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Authentication. Authentication is the process of confirming a user's claimed identity. The impossible travel alert suggests credentials may have been used by someone other than the legitimate user, so the analyst must first validate whether the authentication event is authentic. This involves reviewing MFA results, session details, and source IP reputation before concluding that confidentiality, integrity, or availability have been affected.

Answer

Confidentiality

Answer

Integrity

Answer

Availability

Question 2

A small business owner wants to protect customer payment data. The owner asks a security consultant which control best reduces the impact if an attacker compromises a web server that stores payment records. The consultant recommends encrypting the payment records at rest with keys managed separately from the server. Which security principle does this recommendation primarily support?

Accepted Answer

Data confidentiality through cryptographic protection. Encrypting payment records at rest with keys stored separately protects confidentiality even if the web server is compromised. An attacker who exfiltrates the database or files obtains ciphertext that is useless without the key. Keeping key management separate prevents the attacker from retrieving the key from the same compromised host, which directly reduces the impact of the breach.

Answer

Non-repudiation

Answer

Least privilege

Answer

Defense in depth

Question 3

A junior security analyst at a healthcare company receives a phone call from someone claiming to be the IT help desk. The caller says the analyst's VPN certificate is about to expire and asks the analyst to read back the six-digit code that just appeared in the analyst's authenticator app so the certificate can be renewed remotely. The analyst notices the caller ID shows an internal extension. What should the analyst do first?

Accepted Answer

End the call and verify the request through an independent, known-good channel such as the official help desk number directory.. The scenario is a voice phishing attempt targeting a one-time passcode that functions as a second authentication factor. No legitimate renewal process requires the user to read that code aloud, and caller ID can be spoofed. The safe response is to terminate the interaction and confirm the request through an independently verified help desk contact before taking any action.

Answer

Provide the code but only after asking the caller to state their employee ID and department name.

Answer

Transfer the caller to the security operations center while keeping the line open so the SOC can trace the call.

Answer

Read the six-digit code to the caller because the request came from an internal extension that appears trustworthy.

Question 4

A hospital's security team must protect patient records stored on a file server. The compliance officer asks which control ensures that data remains unaltered and trustworthy while it is stored and while it travels between the server and clinical workstations. Which security objective is the officer asking about?

Accepted Answer

Integrity. Integrity guarantees that data is not changed in unauthorized ways, whether it sits on a file server or crosses the network to a workstation. Hashing and digital signatures let the hospital detect tampering. Availability concerns uptime, confidentiality concerns disclosure, and non-repudiation concerns proving actions, so integrity is the objective that matches the compliance officer's requirement.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 5

A company wants to protect its web application from attackers who try to inject malicious scripts that would execute in the browsers of other users viewing the application. Which security control should be implemented to mitigate this risk?

Accepted Answer

Input validation and output encoding. Cross-site scripting is mitigated primarily by properly validating input and encoding output so that user data is not interpreted as code. A WAF can help but is not sufficient alone. Encryption and MFA address different security concerns and do not prevent script injection.

Answer

Secure Sockets Layer (SSL) certificate

Answer

Multi-factor authentication (MFA)

Answer

Web application firewall (WAF) in blocking mode

Question 6

A security team is reviewing an incident where an attacker gained initial access by sending an email with a malicious macro-enabled spreadsheet to a finance employee. The employee opened the file and enabled macros. Which control would have been MOST effective at preventing the macro from executing while still allowing legitimate business documents to open?

Accepted Answer

Disabling macros by default and requiring signed macros from trusted publishers. Disabling macros by default and only allowing signed macros from trusted publishers directly stops the execution of unsigned malicious macros. This preserves the ability to open legitimate documents while preventing the specific attack vector. Email filtering and network IPS add defense in depth, but the most effective control for macro execution is at the application policy level.

Answer

Deploying an intrusion prevention system (IPS) at the network perimeter

Answer

Enforcing full-disk encryption on all finance laptops

Answer

Blocking all .xlsm file extensions at the email gateway

Question 7

A retail company stores customer payment card numbers in a database. A compliance auditor asks the security team to reduce the impact if the database is compromised. The team proposes replacing the stored card numbers with surrogate values that can be mapped back only through a separately protected lookup table. Which data protection technique are they proposing?

Accepted Answer

Tokenization. The proposed design replaces sensitive card numbers with surrogate values and keeps the reversible mapping in a separately protected lookup table. That is the definition of tokenization. Because the vault is isolated from the database that holds the tokens, a breach of the database alone does not expose usable card data, which satisfies the auditor's goal of reducing impact.

Answer

Data masking with static character substitution

Answer

Hashing with a salted one-way function

Answer

Asymmetric encryption using a public and private key pair

Question 8

A security administrator is reviewing logs and sees repeated failed login attempts against several user accounts from a single external IP address over a short period. The attempts use common usernames such as admin, root, and test. No account has been successfully accessed. Which type of attack is most likely occurring?

Accepted Answer

Brute-force or password-guessing attack against default and common accounts. The pattern of many failed logins from one external IP using generic account names such as admin, root, and test is a classic brute-force or password-guessing attempt against default accounts. Since no login succeeded, the immediate priorities are to block or rate-limit the source, disable or rename default accounts, enforce strong authentication, and monitor for changes in the pattern.

Answer

Credential stuffing using leaked username and password pairs

Answer

Pass-the-hash attack using captured NTLM hashes

Answer

Kerberoasting against service accounts

Question 9

An employee at a logistics firm plugs an unfamiliar USB drive found in the parking lot into a corporate laptop. Shortly afterward, the endpoint protection console reports that a process is attempting to encrypt files in the user's documents folder and rename them with a new extension. Which type of malware is MOST likely responsible?

Accepted Answer

Ransomware. Mass encryption of user files with renamed extensions is the hallmark of ransomware, and the removable-media delivery vector is a well-known initial infection path. Rootkits focus on stealth, keyloggers capture input, and worms focus on self-propagation, so none of those labels fits the file-encryption evidence seen in the console.

Answer

Worm

Answer

Rootkit

Answer

Keylogger

Question 10

A security administrator is configuring a web application firewall (WAF) in front of a public-facing login portal. The administrator wants to protect against automated credential stuffing attacks that use large lists of username and password combinations. Which WAF feature is MOST appropriate to detect and block this behavior?

Accepted Answer

Bot detection and behavioral analysis. Credential stuffing uses automated tools and often distributed IPs, so bot detection and behavioral analysis is the most appropriate WAF feature. It can identify non-human interaction patterns and challenge or block them. Rate limiting and signature rules provide some value but are less effective against distributed, low-volume automated login attempts.

Answer

Cross-site scripting (XSS) filtering

Answer

Signature-based SQL injection rules

Answer

Rate limiting based on source IP address

Question 11

An employee receives an email that appears to be from the IT department, asking them to click a link and reset their password immediately or their account will be locked. The link leads to a website that looks identical to the company's login page. Which type of attack is this?

Accepted Answer

Phishing. The scenario describes a fraudulent email impersonating IT and directing the user to a fake login page, which is a classic phishing attack. Other variants like spear phishing, whaling, and vishing involve different targeting or mediums. The broad category of phishing best fits the described situation.

Answer

Vishing

Answer

Whaling

Answer

Spear phishing

Question 12

A financial services firm wants to confirm that its backup copies of a critical trading application can actually be restored after a ransomware incident. The backups are stored on immutable storage and replicated to an offsite location. Which activity best validates that the recovery capability will work when needed?

Accepted Answer

Perform a full restoration of the application and its data into an isolated environment and verify it functions correctly.. Backup success logs, retention settings, and replication lag all describe the backup pipeline's operation, not its recoverability. The only way to prove that the trading application can be brought back after ransomware is to restore it into an isolated environment and confirm it runs correctly with its data intact. That exercise exposes hidden gaps such as missing dependencies or corrupted backup sets.

Answer

Verify that the immutable storage retention policy is configured to the required number of days.

Answer

Review the backup job success logs and confirm that every scheduled job completed without error.

Answer

Confirm that replication to the offsite location is current by checking the replication lag metric.

Question 13

A company is preparing an incident response plan. The security team wants to ensure that when a critical server is compromised, they can determine what happened, contain the threat, and restore normal operations. The team is defining the phases of the incident response lifecycle. Which sequence correctly represents the standard incident response phases?

Accepted Answer

Preparation, Detection and Analysis, Containment Eradication and Recovery, Post-Incident Activity. The standard incident response lifecycle begins with preparation, then detection and analysis, followed by containment, eradication, and recovery, and ends with post-incident activity. Preparation ensures tools and plans are ready, analysis confirms and scopes the incident, containment limits damage, eradication removes the threat, recovery restores service, and the post-incident review improves future response.

Answer

Preparation, Containment, Detection and Analysis, Post-Incident Activity, Recovery

Answer

Containment, Preparation, Detection and Analysis, Recovery, Post-Incident Activity

Answer

Detection and Analysis, Preparation, Recovery, Containment, Post-Incident Activity

Question 14

A financial services company is reviewing its identity and access management practices after an audit finding. The auditors noted that several former contractors still had active accounts and that some current employees retained access to systems they no longer used. The security team must recommend changes that directly address these findings. (Choose two.)

Accepted Answer

Enforce the principle of least privilege by granting users only the access required for their current job duties and reviewing entitlements regularly.. The audit findings are about accounts that should not exist and permissions that should not persist, so the fixes must govern identity lifecycle and entitlement scope. A joiner, mover, and leaver process ensures timely provisioning and revocation, while least privilege with regular reviews trims standing access. Network, password, and disk-encryption controls are valuable but do not remediate stale or excessive accounts.

Answer

Deploy an intrusion prevention system at the network perimeter to block exploit traffic targeting public-facing web servers.

Answer

Increase the minimum password length from eight to twelve characters for all domain accounts.

Answer

Enable full-disk encryption on all employee laptops to protect data if a device is lost or stolen.

Question 15

A security analyst is reviewing a suspicious PowerShell script that was executed on a workstation. The script downloads a file from a remote URL, saves it to a temporary directory, and then executes it. Which TWO indicators should the analyst prioritize to determine whether this activity is malicious? (Choose two.)

Accepted Answer

The PowerShell process was spawned by a Microsoft Office application.. The two strongest indicators are Office spawning PowerShell and the use of an encoded command. The parent-child relationship suggests a macro or exploit launched the script, while Base64 encoding indicates an attempt to hide the payload. Together they form a high-confidence pattern of malicious script execution, unlike location or timing, which are too common to be reliable.

Answer

The downloaded file was saved to the user's Downloads folder.

Answer

The PowerShell execution policy was set to RemoteSigned.

Answer

The script ran during normal business hours.