75 of 80 questions · Page 1/2 · Scor Security Concepts topic · Answers revealed
A web application accepts user input and directly includes it in SQL queries without sanitization. An attacker submits a single quote (') to cause a syntax error. What is this attack called?
The description matches SQL injection.
Why this answer
SQL injection occurs when user input is not sanitized and alters SQL query structure.
A security engineer is implementing a zero trust architecture. Which TWO principles are foundational to zero trust? (Choose two.)
Least privilege is a fundamental concept in zero trust.
Why this answer
Zero trust is based on 'never trust, always verify' and least privilege. Microsegmentation is a technique to enforce least privilege, but the core principles are never trust/always verify and least privilege.
An attacker injects a malicious SQL query into a web application's login form, bypassing authentication. Which type of exploitation is this?
SQL injection manipulates database queries through user input.
Why this answer
SQL injection is an attack where malicious SQL statements are inserted into an entry field for execution.
An organization is experiencing repeated SQL injection attacks. A security analyst is tasked with recommending mitigations. Which THREE actions are most effective in preventing SQL injection? (Choose three.)
This is the most effective defense against SQL injection.
Why this answer
Prepared statements/parameterized queries prevent SQL injection by separating code from data. Input validation and stored procedures (if properly parameterized) also help. WAFs can detect and block SQLi attempts.
Disabling error messages prevents information leakage.
An organization is experiencing a DDoS attack that floods the network with large volumes of traffic, overwhelming bandwidth. Which three types of DDoS attacks are primarily volumetric? (Choose three.)
UDP floods send many UDP packets to random ports.
Slowloris is an application-layer attack that sends incomplete HTTP headers to tie up connections.
Why this answer
Slowloris is an application-layer DDoS attack that sends partial HTTP requests to keep connections open, exhausting server resources.
What is the primary purpose of a digital signature?
Correct answer. Digital signatures verify identity and integrity.
Why this answer
Digital signatures provide authentication, integrity, and non-repudiation by signing data with a private key.
Which Cisco security product provides identity-based access control and policy enforcement for wired and wireless networks?
ISE provides authentication, authorization, and accounting (AAA).
Why this answer
Cisco Identity Services Engine (ISE) is a policy platform for secure access control.
During a penetration test, an attacker sends a malicious payload to a web application that causes the server to execute arbitrary SQL commands on the backend database. Which type of attack is being performed?
SQL injection directly targets the database layer via crafted input.
Why this answer
SQL injection occurs when user input is improperly sanitized and concatenated into SQL queries, allowing attackers to execute arbitrary SQL commands.
Which Cisco security product is primarily used for endpoint threat detection and retrospective security?
Correct answer. AMP for Endpoints provides endpoint threat detection.
Why this answer
Cisco AMP (Advanced Malware Protection) provides endpoint protection with retrospective analysis and threat detection.
Which authentication factor relies on something the user is, such as a fingerprint or retina scan?
Inherence factors are biometrics, such as fingerprints or iris patterns.
Why this answer
Inherence factors are biometric characteristics unique to the user.
An employee receives an email that appears to be from the company's IT department requesting their login credentials. This is an example of which type of attack?
Correct answer. Phishing is a social engineering attack using deceptive emails.
Why this answer
Social engineering attacks manipulate individuals into divulging confidential information. Phishing is a common form.
A security team implements a policy where users must provide a password and a one-time code from a mobile app. Which authentication factors are being used?
Password (knowledge) and mobile device (possession).
Why this answer
Something you know (password) and something you have (mobile app one-time code).
During an incident response, a forensic analyst finds that an attacker used a script to modify ARP tables, enabling them to intercept and modify traffic between two hosts. Which attack technique was used?
MITM attacks intercept and potentially alter communications.
Why this answer
Man-in-the-middle (MITM) attacks, such as ARP spoofing, allow interception and modification of traffic between two parties.
Which component of the CIA triad ensures that data is not altered by unauthorized entities during transmission?
Correct answer. Integrity ensures data has not been tampered with by unauthorized parties.
Why this answer
Integrity ensures that data remains accurate and unaltered during storage or transmission, preventing unauthorized modifications.
Which type of malware is characterized by encrypting files on a victim's system and demanding payment for the decryption key?
Ransomware encrypts files for ransom.
Why this answer
Ransomware encrypts data and demands ransom.
An attacker intercepts traffic between a client and a server and modifies the communication without either party knowing. Which type of attack is being performed?
MITM allows interception and modification.
Why this answer
A man-in-the-middle (MITM) attack involves interception and potential modification of communications.
A security analyst is reviewing logs and identifies numerous ICMP echo requests from an external IP address to multiple internal hosts. Which type of reconnaissance activity is this?
Active scanning involves sending probes (e.g., ICMP echo requests) to discover hosts and services.
Why this answer
ICMP echo requests (ping sweeps) are used in active scanning to identify live hosts.
A company wants to protect against DNS-based attacks by filtering malicious domains and providing secure DNS resolution. Which Cisco product should be deployed?
Umbrella provides DNS-layer security and threat intelligence.
A Cisco ESA administrator notices that a large number of emails with malicious attachments are being delivered to users. Which feature should be configured to inspect attachments in a sandbox environment before delivery?
ESA can leverage AMP to sandbox attachments.
Why this answer
Cisco ESA can integrate with AMP (Advanced Malware Protection) to sandbox and analyze attachments.
A company wants to implement a Zero Trust architecture. Which THREE principles should be included? (Choose three.)
Users and devices get only necessary permissions.
Why this answer
Zero Trust core principles: never trust, always verify; least privilege; microsegmentation. Defense in depth is a separate concept.
A company is implementing a Zero Trust architecture. Which THREE principles are core to the Zero Trust model? (Choose three.)
This is the fundamental principle of Zero Trust.
Why this answer
Zero Trust is built on the principles of never trust, always verify; least privilege; and microsegmentation to enforce granular access controls.
An organization wants to implement a security model where no user or device is trusted by default, regardless of whether they are inside or outside the network perimeter. Which concept does this describe?
Zero Trust enforces 'never trust, always verify'.
Why this answer
Zero Trust assumes no implicit trust and verifies every access request.
An attacker uses a tool to scan a target network for open ports and running services. Which type of reconnaissance does this represent?
Correct answer. Active scanning sends packets to the target to identify open ports and services.
Why this answer
Active reconnaissance involves direct interaction with the target, such as port scanning, to gather information.
A company is planning to deploy a Zero Trust architecture. Which two principles are fundamental to Zero Trust?
Every access request must be authenticated and authorized.
Why this answer
Zero Trust is based on 'never trust, always verify' and least privilege access.
Which Cisco product provides advanced malware protection for endpoints, including file analysis and retrospective security?
AMP provides endpoint protection and file analysis.
Why this answer
Cisco AMP for Endpoints provides endpoint protection with advanced malware analysis.
What is the primary purpose of a digital signature?
Signatures authenticate the sender and detect tampering.
Why this answer
A digital signature provides authentication, integrity, and non-repudiation.
An attacker performs a DNS cache poisoning attack on a recursive DNS server. What is the primary impact of this attack?
The injected records redirect traffic to attacker-controlled servers.
Why this answer
DNS cache poisoning injects false DNS records, causing users to be redirected to malicious sites when they attempt to access legitimate domains.
A security administrator is evaluating symmetric encryption algorithms for a new VPN deployment. Which algorithm uses a 128-bit block size and supports key sizes of 128, 192, and 256 bits?
Correct answer. AES meets the described parameters.
Why this answer
AES is a symmetric block cipher with a fixed block size of 128 bits and key sizes of 128, 192, or 256 bits.
Which cryptographic algorithm is a symmetric block cipher commonly used in modern VPNs and is considered secure?
AES is the standard symmetric cipher for secure communications.
Why this answer
AES (Advanced Encryption Standard) is a widely used symmetric block cipher with key sizes of 128, 192, or 256 bits.
Which of the following is a characteristic of a zero trust security model?
Correct answer. This is the core principle of zero trust.
Why this answer
Zero trust assumes no implicit trust; every request must be verified regardless of source.
An attacker sends a flood of SYN packets with spoofed IP addresses to a server, causing it to allocate resources for half-open connections until it can no longer accept legitimate traffic. This is which type of DDoS attack?
SYN flood targets protocol weaknesses (TCP handshake).
Why this answer
SYN flood is a protocol-based DDoS attack that exploits the TCP handshake.
Which of the following is an example of a passive reconnaissance technique?
OSINT uses publicly available information without direct engagement.
Why this answer
Passive reconnaissance involves gathering information without directly interacting with the target, such as through public sources.
A security engineer is evaluating Cisco solutions to detect and respond to network anomalies, including potential insider threats, by analyzing NetFlow data and behavioral patterns. Which Cisco product is best suited?
Stealthwatch provides network visibility and behavioral detection using NetFlow.
Why this answer
Cisco Stealthwatch uses NetFlow and behavioral analytics to detect network threats and anomalies.
A security engineer needs to choose a hashing algorithm for storing passwords. Which of the following should be avoided due to known collision vulnerabilities?
MD5 is vulnerable to collisions and should be avoided.
Why this answer
MD5 has known collision attacks and should not be used. SHA-256 and SHA-3 are secure. SHA-1 is also deprecated but not an option.
An attacker intercepts ARP packets on a local network and associates their MAC address with the IP address of a legitimate host. This is an example of which attack?
ARP spoofing involves sending forged ARP replies to link an attacker's MAC to a legitimate IP.
Why this answer
ARP spoofing (ARP poisoning) allows an attacker to intercept traffic by associating their MAC with the victim's IP.
A network engineer is tasked with securing email communications. Which TWO Cisco products are specifically designed for email security? (Choose two.)
ESA is an on-premises email security gateway.
Why this answer
Cisco Email Security Appliance (ESA) and Cisco Secure Email (formerly Cloud Email Security) are dedicated email security solutions.
What is the primary function of a Certificate Revocation List (CRL) in a PKI?
Correct answer. CRL provides a list of revoked certificates.
Why this answer
CRL lists certificates that have been revoked before their expiration date, allowing relying parties to verify validity.
Which three components are part of the CIA triad?
Ensures data is not tampered with.
Why this answer
The CIA triad consists of Confidentiality, Integrity, and Availability.
An attacker intercepts communication between a client and server by spoofing ARP messages to associate the attacker's MAC address with the server's IP. This is an example of which type of attack?
ARP spoofing enables MITM by intercepting traffic.
Why this answer
ARP spoofing allows an attacker to intercept traffic, a classic man-in-the-middle (MITM) technique.
Umbrella provides DNS-layer security to block malicious domains.
Why this answer
Cisco Umbrella is a cloud-delivered DNS security service that can block malicious domains and provide visibility into DNS queries.
Which security model requires that all subjects and devices are untrusted by default, and access is granted only after verification, regardless of the network location?
Zero Trust explicitly requires verification for every access attempt, regardless of location.
Why this answer
Zero Trust is a security model based on the principle of 'never trust, always verify', requiring continuous authentication and authorization.
Which Cisco product provides next-generation firewall (NGFW) capabilities, including application visibility and intrusion prevention?
A network administrator is configuring an ASA to enforce that traffic between two internal zones must be inspected by the firewall. Which security principle is being applied?
Microsegmentation enforces traffic inspection between segments, aligning with zero trust.
Why this answer
Microsegmentation is a zero trust principle that divides the network into small zones and enforces granular access controls between them.
An attacker uses Shodan to discover internet-facing ICS devices and then performs banner grabbing. This is an example of which type of attack?
Shodan is a search engine for internet-connected devices; using it without direct interaction is passive OSINT.
Why this answer
Passive OSINT involves collecting publicly available information without directly interacting with the target. Banner grabbing is active scanning, but the question emphasizes the initial passive phase. However, Shodan is a passive OSINT tool.
A network administrator wants to deploy security products that provide network-based intrusion prevention and advanced threat detection. Which TWO Cisco products are most suitable? (Choose two.)
Stealthwatch provides network visibility and anomaly detection.
A security analyst is investigating a potential insider threat. Which TWO indicators are most commonly associated with malicious insider activity? (Choose two.)
This is a common indicator of anomalous behavior.
Why this answer
Insider threats often involve unusual access patterns (e.g., accessing sensitive data not needed for the role) and attempts to bypass security controls (e.g., disabling logging).
Which security model mandates that access decisions should be based on context, device posture, and user identity, and never trust any entity by default?
Zero Trust is based on 'never trust, always verify' and least privilege.
Why this answer
Zero Trust architecture requires continuous verification and least privilege access, never trusting any user or device automatically.
A PKI administrator needs to check the revocation status of a certificate without causing a heavy load on the CA. Which protocol should be used?
OCSP is a lightweight protocol that queries the CA for individual certificate status.
Why this answer
OCSP (Online Certificate Status Protocol) provides real-time revocation status without requiring clients to download a full CRL.
An attacker intercepts traffic between a client and server using ARP spoofing. Which type of attack is this?
Correct answer. ARP spoofing is a common MITM technique.
Why this answer
ARP spoofing allows an attacker to intercept traffic, enabling man-in-the-middle (MITM) attacks.
In a PKI hierarchy, which component is responsible for issuing and revoking certificates for end entities, and is directly subordinate to the root CA?
Intermediate CAs are subordinate to the root and issue certificates to end entities or other CAs.
Why this answer
An intermediate CA (subordinate CA) is a CA that is signed by the root CA and issues certificates to end entities, forming a chain of trust.
An organization is adopting Cisco's security portfolio. Which THREE products are correctly paired with their primary function? (Choose three.)
Umbrella provides DNS-layer security and cloud-based protection.
A company's server is infected with malware that encrypts files and demands payment for decryption. Which type of malware is this?
Ransomware specifically encrypts files and demands payment.
Why this answer
Ransomware encrypts files and demands a ransom for the decryption key.
Which authentication factor does a fingerprint scanner represent?
Biometrics are inherence factors.
Why this answer
Inherence factors are based on biological traits like fingerprints.
An organization implements a policy where every access request must be authenticated and authorized, even if it originates from within the internal network. Network segments are isolated, and lateral movement is restricted through microsegmentation. Which security model does this align with?
Zero Trust principles: never trust, always verify, least privilege, microsegmentation.
Why this answer
Zero Trust requires verification for every request regardless of network location, and uses microsegmentation to limit movement.
An organization wants to ensure that digital certificates issued by its internal CA are validated for revocation in real-time. Which protocol should be implemented to allow clients to check certificate status without downloading a full CRL?
OCSP provides real-time revocation status for individual certificates.
Why this answer
OCSP (Online Certificate Status Protocol) enables real-time checking of a certificate's revocation status by querying the CA's responder, avoiding the need to download the entire CRL.
A company deploys a solution that uses a root certificate authority (CA) and intermediate CAs to issue certificates. What is the term for the hierarchical structure of certificates from the root CA to the end entity?
The chain of trust from root to leaf.
Why this answer
Certificate chaining refers to the path from the root CA through intermediates to the end-entity certificate.
A security engineer is configuring a Cisco Firepower NGFW to detect a buffer overflow attack. Which attack vector is this?
Correct answer. Buffer overflow is a classic exploitation technique.
Why this answer
Buffer overflow is an exploitation technique where an attacker writes beyond the allocated buffer to execute arbitrary code.
Which Cisco security product provides DNS-layer security to block malicious domains and cloud-based threats?
Correct answer. Umbrella offers DNS-layer security.
Why this answer
Cisco Umbrella is a cloud-delivered security service that provides DNS-layer filtering to block malicious destinations.
A security team is investigating a breach where the attacker gained access to a server using stolen credentials. Later, the attacker moved laterally and exfiltrated data. Which three security controls would best help detect and prevent lateral movement? (Choose three.)
Microsegmentation divides the network into small zones, limiting lateral movement.
Why this answer
Microsegmentation, network behavioral analytics, and endpoint detection help limit and detect lateral movement.
A security analyst notices traffic from an internal host to an external IP address on port 4444, and the host's CPU is high. The host has been running unknown processes. Which type of malware is most likely involved?
A RAT provides remote control and often uses ports like 4444 for C2 communication.
Why this answer
Port 4444 is commonly associated with Blaster worm and remote access tools. A Remote Access Trojan (RAT) allows remote control and often communicates on such ports.
A security analyst detects a DDoS attack targeting the company's web server. Which three attack types are classified as application layer attacks? (Choose three.)
Correct. DNS query flood targets the DNS application.
Which Cisco product provides DNS-layer security to block malicious domains and prevent connections to malware command-and-control servers?
Umbrella provides DNS-layer security for threat protection.
Why this answer
Cisco Umbrella is a cloud-based DNS security solution that blocks requests to malicious destinations.
Which encryption algorithm is classified as symmetric?
AES is symmetric.
Why this answer
AES is a symmetric encryption algorithm, using the same key for encryption and decryption.
A security analyst is investigating a potential ARP spoofing attack. Which two symptoms would indicate this type of attack?
ARP spoofing can cause multiple MACs for one IP.
Why this answer
ARP spoofing involves sending fake ARP messages to associate the attacker's MAC with the IP of another host, causing traffic to be misdirected.
Which three cryptographic algorithms are considered secure for use in modern systems? (Choose three.)
Correct. ECDSA is a secure elliptic curve signature algorithm.
Why this answer
AES (symmetric), RSA (asymmetric), and ECDSA (asymmetric) are widely accepted secure algorithms.
A security analyst notices unusual outbound traffic from an internal host to a known malicious IP address on TCP port 4444. The host is also exhibiting high CPU usage and running an unknown process. Which type of malware is most likely present?
RATs commonly use ports like 4444 for C2 communication, allowing remote control and data exfiltration.
Why this answer
A RAT (Remote Access Trojan) often uses a command-and-control (C2) channel on high-numbered ports like 4444, allowing attackers to control the host remotely.
A security analyst is reviewing logs and sees multiple failed login attempts from a single IP address, followed by a successful login. Which type of attack does this represent?
Multiple failed logins followed by success indicates password guessing.
Why this answer
A brute-force attack involves repeated attempts to guess credentials, often automated, until successful.
A security administrator is implementing a zero-trust architecture. Which two principles are core to the zero-trust model? (Choose two.)
This is a foundational principle of zero trust.
Why this answer
Zero trust is based on 'never trust, always verify' and least privilege access.
A network administrator is configuring PKI for secure communications. Which TWO components are essential for a public key infrastructure? (Choose two.)
CA is the trusted entity that issues digital certificates.
Why this answer
PKI relies on a Certificate Authority (CA) to issue certificates and a CRL or OCSP to check revocation. Private keys are part of the key pair, but the PKI components are CA and revocation mechanism.
An organization is implementing a zero trust architecture. Which two principles are foundational to this model? (Choose two.)
Correct. This is a core tenet of zero trust.
Why this answer
Zero trust is built on 'never trust, always verify' and 'least privilege' to minimize access.
A security analyst observes a sustained increase in traffic from many different IP addresses to a single web application, causing CPU spikes. The traffic consists of legitimate-looking HTTP GET requests for the same resource. Which TWO types of attack could this be? (Choose two.)
Multiple sources indicate a distributed attack.
An organization implements multi-factor authentication requiring a password and a fingerprint scan. Which two authentication factors are being used?
Correct answer. Password (knowledge) and fingerprint (inherence).
Why this answer
Password is a knowledge factor, fingerprint is an inherence (biometric) factor.
Which Cisco security product is primarily designed to provide DNS-layer security by blocking requests to malicious domains?
Umbrella provides DNS-layer security as a key feature.
Why this answer
Cisco Umbrella is a cloud-based security solution that provides DNS-layer protection to block malicious domains before a connection is established.
SSL stripping downgrades secure connections to plaintext.
Ready to test yourself?
Try a timed practice session using only Scor Security Concepts questions.