Cybersecurity-Practitioner Cybersecurity Fundamentals Practice Test 5 — 15 Questions

Question 1

A security analyst is reviewing network traffic and notices a high volume of DNS queries for randomly generated domain names, followed by a small number of successful resolutions. The queries originate from a single internal host. Which type of attack is most likely occurring?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Domain generation algorithm (DGA) activity. Domain generation algorithm (DGA) activity is the most likely explanation because malware uses DGAs to generate many random domain names and attempt to contact a command-and-control server. The pattern of numerous failed resolutions with occasional successes from a single host is a strong indicator of DGA-based malware communication, distinguishing it from other DNS-related attacks.

Answer

DNS amplification attack

Answer

DNS cache poisoning

Answer

DNS tunneling

Question 2

A small accounting firm stores client tax returns on a file server. The partners ask which control most directly enforces the principle of least privilege for employees accessing those returns. Which control should be implemented?

Accepted Answer

Enforce role-based access control so each employee receives only the permissions their job function requires.. Least privilege is an authorization principle: users should hold only the permissions their duties require. Role-based access control operationalizes this by binding permissions to job functions, so access to client tax returns is scoped to need. Encryption, antivirus, and multifactor authentication improve security but do not limit the scope of authorized access for a logged-in employee.

Answer

Enable weekly antivirus scans on all workstations and the file server.

Answer

Deploy full-disk encryption on the file server volumes that store the tax returns.

Answer

Require multifactor authentication for all employees logging into the domain.

Question 3

A retail company is migrating its customer-facing web application to a public cloud provider. The security team must ensure that data stored in the cloud remains confidential and that the cloud provider cannot access plaintext data. Which approach best meets this requirement?

Accepted Answer

Use client-side encryption with customer-managed keys stored outside the cloud provider's infrastructure. Client-side encryption with customer-managed keys stored outside the provider's infrastructure ensures that the cloud provider only ever handles ciphertext, so it cannot access plaintext data. Provider-managed encryption, TLS, and CASB solutions do not prevent the provider from accessing plaintext, failing the scenario's requirement.

Answer

Enable TLS 1.3 for all connections and store data in an encrypted database managed by the provider

Answer

Rely on the cloud provider's default encryption at rest and in transit

Answer

Implement a cloud access security broker (CASB) to monitor and control data flows to the cloud

Question 4

A security administrator is configuring a next-generation firewall to inspect encrypted traffic. The organization uses a internal certificate authority (CA) to issue certificates for all internal servers. The administrator wants to ensure that the firewall can decrypt and inspect TLS traffic to these internal servers without generating certificate errors on client devices. What should the administrator do?

Accepted Answer

Configure SSL decryption with the internal CA and distribute the internal CA certificate to client devices.. Configuring SSL decryption with the internal CA and distributing the internal CA certificate to client devices is correct because the firewall must present a trusted certificate to clients during decryption. By using the internal CA to issue the firewall's decryption certificate and ensuring clients trust that CA, the firewall can decrypt and inspect TLS traffic without causing certificate errors.

Answer

Enable SSL decryption without any certificate configuration and rely on clients to ignore certificate warnings.

Answer

Import the internal CA certificate into the firewall's trusted certificate store.

Answer

Generate a new certificate on the firewall and install it on all internal servers.

Question 5

A financial services company is updating its incident response plan. The security manager wants to ensure the plan covers activities that occur during the containment, eradication, and recovery phases. Which two activities belong to those phases? (Choose two.)

Accepted Answer

Isolating an infected workstation from the network by disabling its switch port.. Containment stops the spread, eradication removes the threat and its root cause, and recovery restores normal operations. Isolating an infected host is containment, and removing malware plus patching the exploited flaw is eradication. Detection activities and post-incident reviews occur in other phases, so they fall outside the span the manager is mapping.

Answer

Documenting the initial alert that triggered the investigation and assigning a severity level.

Answer

Monitoring network traffic to detect the first signs of malicious activity.

Answer

Conducting a post-incident lessons-learned meeting with stakeholders.

Question 6

A security engineer is configuring a Palo Alto Networks firewall to decrypt outbound SSL traffic for inspection. The organization has a internal certificate authority (CA) and wants to ensure that users do not receive certificate warnings. Which action must the engineer take?

Accepted Answer

Install the forward trust certificate on the firewall and its CA certificate on user devices.. The forward trust certificate is used by the firewall to impersonate servers during decryption. For users to trust these impersonated certificates, the CA that signed the forward trust certificate must be installed as a trusted root on their devices. The forward untrust certificate is for sites that cannot be decrypted and is not relevant for user trust.

Answer

Install the forward trust certificate on the firewall and the forward untrust certificate on user devices.

Answer

Install the forward trust certificate on user devices and the forward untrust certificate on the firewall.

Answer

Install the forward untrust certificate on the firewall and its CA certificate on user devices.

Question 7

A retail company wants to reduce the risk that a terminated employee's account is still usable hours after departure. Which identity and access management practice best addresses this specific risk?

Accepted Answer

Automate account deprovisioning so the identity management system disables the account immediately upon HR termination processing.. The core risk is an active credential after employment ends. Automating deprovisioning from the authoritative HR system minimizes the delay between termination and account disablement. Password policies affect credential strength or rotation but do not revoke access, so they leave the terminated account usable until someone manually disables it.

Answer

Shorten the password expiration interval for all employees to thirty days.

Answer

Increase password complexity requirements to sixteen characters with symbols.

Answer

Enable self-service password reset so users can recover access without contacting the help desk.

Question 8

A security operations center (SOC) analyst receives an alert about an endpoint that is repeatedly contacting a command-and-control (C2) server. The analyst wants to classify this activity according to the Cyber Kill Chain framework. Which phase of the Cyber Kill Chain does this activity represent?

Accepted Answer

Command and Control. The repeated contacts from an endpoint to a known C2 server indicate that the attacker has established a communication channel to control the compromised system. This is the Command and Control phase of the Cyber Kill Chain, which follows installation and precedes actions on objectives. The other phases occur earlier in the attack lifecycle and do not involve active C2 traffic.

Answer

Reconnaissance

Answer

Actions on Objectives

Answer

Weaponization

Question 9

A security administrator is configuring a Palo Alto Networks firewall to block malicious downloads. They want to ensure that when a user attempts to download a file that is identified as malicious by WildFire, the download is blocked and the user is notified. Which two actions must the administrator take? (Choose two.)

Accepted Answer

Configure a file blocking profile to block files with a WildFire verdict of malicious.. To block malicious downloads using WildFire, the administrator must attach a WildFire analysis profile to the security policy to submit files for analysis, and a file blocking profile to block files based on WildFire verdicts. These two profiles work together to inspect and enforce policy. Other options like SSL decryption or URL filtering do not directly achieve the goal.

Answer

Set up a URL filtering profile to block malicious sites.

Answer

Configure a decryption profile to block sessions with untrusted certificates.

Answer

Enable SSL decryption for all traffic.

Question 10

A software company wants to verify that its internally developed payment module does not introduce exploitable weaknesses before release. The security team will perform a review that examines the compiled application's behavior while it runs, without access to the original source code. Which activity matches this requirement?

Accepted Answer

Dynamic application security testing of the running payment module.. The requirement is to examine a running, compiled application without source access, which is the defining characteristic of dynamic application security testing. Static analysis needs source or bytecode, composition analysis targets dependencies, and threat modeling is a design-time exercise. Only dynamic testing observes real execution to uncover exploitable runtime weaknesses.

Answer

Threat modeling workshops with the development team before coding begins.

Answer

Software composition analysis of third-party libraries bundled with the module.

Answer

Static application security testing of the payment module's source repository.

Question 11

A security operations center analyst is reviewing an alert about an internal workstation that resolved a domain name belonging to a known malware command-and-control (C2) server. The analyst wants to confirm whether the workstation actually established a connection to that C2 server, rather than just performing a DNS lookup. Which data source should the analyst correlate with the DNS logs to make this determination?

Accepted Answer

Network flow or firewall session logs. Determining whether a suspicious DNS resolution led to real command-and-control traffic requires evidence of an actual network session. Firewall session tables and network flow records capture the source, destination, port, and volume of connections, so they can confirm or refute an established session to the resolved address. DNS logs alone only prove a name lookup occurred, not that the workstation contacted the C2 infrastructure.

Answer

Email gateway message tracking logs

Answer

Authentication logs from the identity provider

Answer

Endpoint file integrity monitoring logs

Question 12

A security administrator is configuring a Palo Alto Networks firewall to inspect traffic between two internal zones. They want to ensure that all traffic is logged at session start and session end for auditing purposes. Which setting should they configure in the security policy?

Accepted Answer

Enable both Log at Session Start and Log at Session End.. To log both session start and end, the security policy must have both Log at Session Start and Log at Session End enabled. These settings are found in the Actions tab of the security policy rule. Enabling both ensures that the firewall generates logs at the beginning and end of each session, providing a complete audit trail.

Answer

Set the Log at Session Start option to enabled.

Answer

Configure a syslog server profile to send logs to an external server.

Answer

Set the Log at Session End option to enabled.

Question 13

A security administrator is implementing the principle of least privilege for a group of developers who need to deploy code to a production server. Currently, they have full administrative rights. The administrator wants to restrict their access to only what is necessary for deployment. Which of the following best describes the principle of least privilege?

Accepted Answer

Granting users the minimum levels of access or permissions needed to perform their job functions.. The principle of least privilege dictates that users should be granted only the minimum access necessary to perform their job functions. In this case, developers should receive deployment-specific permissions instead of full administrative rights. This minimizes the potential impact of a compromised account and reduces the risk of accidental misconfigurations. The other options describe different security controls that do not directly address limiting permissions.

Answer

Implementing multi-factor authentication for all administrative accounts to add an extra layer of security.

Answer

Rotating user passwords frequently to prevent credential theft and unauthorized access.

Answer

Ensuring that all users have the same level of access to simplify management and reduce complexity.

Question 14

An employee receives a phone call from someone claiming to be an IT support technician who asks the employee to read back the one-time passcode just sent to their phone. The caller says the code is needed to fix a mailbox synchronization problem. Which social engineering technique is being used against this employee?

Accepted Answer

Vishing. The scenario involves a telephone-based deception in which an attacker impersonates IT support to obtain a one-time passcode. Voice phishing, or vishing, is the correct classification because the manipulation occurs through a live phone call. Recognizing the delivery channel is essential, since email phishing, SMS phishing, and physical intrusion techniques each have distinct indicators that do not match this situation.

Answer

Smishing

Answer

Watering hole attack

Answer

Tailgating

Question 15

A security analyst is investigating a potential data breach and needs to determine the integrity of a critical file that may have been tampered with. The analyst has a known-good hash of the file from a trusted backup. Which of the following should the analyst do to verify the file's integrity?

Accepted Answer

Compare the file's current hash with the known-good hash using a cryptographic hash function like SHA-256.. To verify file integrity, the analyst should compute the current cryptographic hash of the file and compare it to the known-good hash. Cryptographic hash functions like SHA-256 are designed to detect any alteration, making them the most reliable method. Timestamps, antivirus scans, and file size comparisons do not provide the same level of assurance and can be bypassed or misinterpreted.

Answer

Check the file's last modified timestamp and compare it to the backup date.

Answer

Run an antivirus scan on the file to detect any malicious modifications.

Answer

Use file compression to create a checksum and compare it to the original file size.