23 of 98 questions · Page 2/2 · Security Concepts · Answers revealed
Which element of the CIA triad ensures that data cannot be modified by unauthorized parties?
Integrity ensures data remains unaltered by unauthorized actors.
Why this answer
Integrity ensures that data is not altered by unauthorized individuals or processes.
A security analyst discovers that a server's configuration allows users to access files outside of their intended directory. In security terminology, what is this weakness called?
A vulnerability is a specific weakness in a system that can be exploited.
Why this answer
A vulnerability is a weakness that can be exploited.
Which of the following is an example of a symmetric encryption algorithm?
AES is a widely used symmetric cipher.
Why this answer
Symmetric encryption uses the same key for encryption and decryption. AES and 3DES are symmetric algorithms.
An organization wants to ensure that a user cannot deny having sent an email. Which security goal does this address?
Non-repudiation prevents denial of actions.
Why this answer
Non-repudiation ensures that a party cannot deny having performed a specific action, such as sending an email. This is typically achieved through digital signatures using asymmetric cryptography (e.g., RSA or ECDSA) and public key infrastructure (PKI), where the sender's private key creates a signature that can be verified by anyone with the sender's public key. The goal is to provide irrefutable proof of origin and integrity, preventing the sender from later claiming they did not send the message.
Exam trap
Cisco often tests the distinction between integrity and non-repudiation, where candidates mistakenly choose integrity because they associate hashing with proof of origin, but integrity alone does not link the data to a specific sender.
How to eliminate wrong answers
Option B (Availability) is wrong because availability ensures that systems and data are accessible when needed, often through redundancy and fault tolerance, not by preventing denial of actions. Option C (Integrity) is wrong because integrity guarantees that data has not been altered in transit or storage, typically via hashing (e.g., SHA-256) or checksums, but does not tie an action to a specific user. Option D (Confidentiality) is wrong because confidentiality protects data from unauthorized disclosure using encryption (e.g., AES or TLS), but does not provide proof of origin or prevent repudiation.
A company's security policy requires that sensitive data be encrypted at rest using AES-256. Which type of encryption does AES-256 represent?
AES is a symmetric block cipher.
Why this answer
AES is a symmetric encryption algorithm, meaning the same key is used for encryption and decryption.
A security analyst discovers that a malicious actor is using a technique to gather information about employees by searching social media sites. Which type of attack is being performed?
Passive reconnaissance collects information without directly engaging the target.
Why this answer
Reconnaissance attacks involve gathering information to identify vulnerabilities. Passive reconnaissance uses publicly available sources like social media.
An attacker intercepts communication between a client and a server, allowing the attacker to read, insert, and modify messages in both directions. Which type of network attack is this?
MitM allows interception, reading, and modification of communications between two parties.
Why this answer
A man-in-the-middle (MitM) attack places the attacker between two parties to intercept and manipulate traffic.
A security analyst is investigating an incident where an employee received an email that appeared to be from the company's IT department, requesting the employee to verify their account by clicking a link and entering their credentials. The employee complied, and later the attacker used those credentials to access the corporate VPN. Which combination of attack types best describes this incident?
Spear phishing is the targeted email; credential theft is the result.
Why this answer
The email is a social engineering technique known as phishing. Since it targeted a specific employee with a tailored message (IT department), it is spear phishing. The attacker then used the credentials to access the VPN, which is a direct use of the stolen information, not a separate attack like MitM.
A security analyst discovers that an attacker used a publicly available tool to scan a company's network for open ports and services. What type of attack is this?
Port scanning is active because it sends probes to the target.
Why this answer
Using a publicly available tool to scan a company's network for open ports and services involves directly interacting with the target systems by sending probes (e.g., TCP SYN packets, UDP datagrams) and analyzing responses. This constitutes active reconnaissance, as the attacker's actions generate traffic that can be detected by intrusion detection systems (IDS) or firewall logs, unlike passive methods that only observe existing traffic.
Exam trap
Cisco often tests the distinction between active and passive reconnaissance by presenting a scenario where a tool is used to 'scan' or 'probe' the network, and candidates mistakenly choose passive reconnaissance because they think 'scanning' is non-intrusive, but any direct interaction with the target (sending packets) is active.
How to eliminate wrong answers
Option A is wrong because passive reconnaissance involves gathering information without directly interacting with the target network, such as sniffing traffic or using public records (e.g., WHOIS, DNS lookups), not sending probes to identify open ports. Option B is wrong because a Denial of Service (DoS) attack aims to disrupt or degrade service availability by overwhelming resources (e.g., SYN flood, ICMP flood), not to enumerate open ports and services for later exploitation. Option C is wrong because social engineering exploits human psychology to manipulate individuals into divulging confidential information or performing actions, not technical scanning of network ports and services.
An organization implements encryption for all sensitive data at rest and in transit to prevent unauthorized access. Which element of the CIA triad is being primarily addressed?
Encryption directly supports confidentiality by preventing unauthorized access.
Why this answer
Confidentiality ensures that data is not disclosed to unauthorized individuals or systems.
A network analyst notices a high volume of traffic from a single external IP address to multiple internal hosts on port 443. The traffic includes incomplete TCP handshakes. Which type of reconnaissance is being performed?
Port scanning sends probes to identify open ports, generating traffic and incomplete connections.
Why this answer
Active reconnaissance involves direct interaction with the target, such as port scanning, which generates traffic. Passive recon uses public data.
An attacker sends an email posing as the company's IT department, asking employees to click a link and enter their credentials. Which type of social engineering attack is this?
Phishing is a mass email attack impersonating a legitimate entity.
Why this answer
B is correct because the attack uses email as the delivery vector to trick recipients into revealing credentials, which is the classic definition of phishing. Phishing is a broad category of social engineering that employs deceptive electronic communications (typically email) to steal sensitive information.
Exam trap
Cisco often tests the distinction between phishing (mass, untargeted) and spear phishing (targeted), so the trap here is that candidates may confuse the generic email to all employees with a targeted attack, leading them to incorrectly choose spear phishing.
How to eliminate wrong answers
Option A is wrong because vishing (voice phishing) uses telephone calls or voice messages, not email. Option C is wrong because pretexting involves fabricating a scenario or identity to gain trust and extract information, but it does not specifically require an email with a link to harvest credentials. Option D is wrong because spear phishing is a targeted version of phishing aimed at a specific individual or organization, whereas the question describes a generic email sent to all employees, which is a mass phishing campaign.
Which component of the NIST Cybersecurity Framework involves taking action to stop an ongoing attack?
Respond includes actions to address and mitigate attacks.
Why this answer
The Respond function includes activities to contain and mitigate incidents.
An organization must comply with a regulation that requires protecting the privacy of EU citizens' personal data. Which compliance framework applies?
GDPR protects personal data of EU citizens.
Why this answer
The General Data Protection Regulation (GDPR) is the EU regulation specifically designed to protect the privacy and personal data of EU citizens. It applies to any organization that processes or controls the personal data of individuals in the EU, regardless of where the organization is based. This makes GDPR the correct compliance framework for the scenario described.
Exam trap
Cisco often tests the distinction between data privacy regulations (like GDPR) and data security standards (like PCI DSS or HIPAA), where candidates mistakenly apply a US-centric regulation to an EU privacy requirement.
How to eliminate wrong answers
Option A is wrong because HIPAA (Health Insurance Portability and Accountability Act) applies only to protected health information (PHI) in the United States, not to EU citizens' personal data. Option B is wrong because ISO 27001 is an international standard for information security management systems (ISMS), not a regulation that specifically addresses EU privacy requirements. Option C is wrong because PCI DSS (Payment Card Industry Data Security Standard) governs the security of credit card data, not the privacy of EU citizens' personal data.
In a PKI, what is the role of a Certificate Authority (CA)?
CA issues certificates and validates their authenticity.
Why this answer
A CA issues, revokes, and manages digital certificates, establishing trust in the public key's ownership.
Which THREE of the following are common types of malware?
A virus attaches to files and spreads.
Why this answer
A virus is a type of malware that replicates by attaching itself to legitimate executable files or scripts, requiring user action (e.g., opening an infected attachment) to spread. It is one of the classic and most common forms of malicious software, making option B correct.
Exam trap
Cisco often tests the distinction between security tools (like patches and firewalls) and actual malware types, leading candidates to mistakenly classify protective measures as malicious software.
A security analyst needs to verify that a downloaded software update has not been tampered with. The update's publisher provides a file containing a hash value. Which process should the analyst use to verify integrity?
Hash comparison verifies that the file has not been altered.
Why this answer
Verifying file integrity involves computing a cryptographic hash (e.g., SHA-256) of the downloaded file and comparing it to the hash provided by the publisher. If the hashes match, the file has not been altered; any tampering would produce a different hash value. This is a standard integrity check, not a confidentiality or authentication mechanism.
Exam trap
Cisco often tests the distinction between integrity (hash comparison) and authenticity (digital signatures), leading candidates to mistakenly choose digital signature verification when the question only asks about integrity.
How to eliminate wrong answers
Option A is wrong because decrypting a file with the publisher's public key would only work if the file were encrypted with the publisher's private key, which is used for confidentiality or non-repudiation, not for integrity verification of a hash. Option B is wrong because signing the file with a digital signature is a process the publisher performs to provide authenticity and integrity, but the analyst does not sign the file; the analyst verifies the signature using the publisher's public key. Option D is wrong because encrypting the file with the publisher's private key is not a standard integrity check; private key encryption is used for digital signatures or to prove origin, and the analyst would not have access to the publisher's private key.
A security analyst is investigating a network breach. Which TWO activities are examples of passive reconnaissance? (Choose two.)
Social media review is a passive information gathering technique.
Why this answer
Passive reconnaissance involves gathering information without directly interacting with the target, such as searching public records and social media.
An organization is required to protect cardholder data. Which compliance framework applies to this requirement?
PCI DSS is the standard for protecting payment card data.
Why this answer
PCI DSS is the Payment Card Industry Data Security Standard, which applies to organizations that handle credit card data.
An organization wants to protect sensitive data at rest and in transit. Which THREE cryptographic methods can provide confidentiality? (Choose three.)
TLS encrypts data in transit using symmetric and asymmetric methods.
Why this answer
Symmetric encryption, asymmetric encryption, and TLS (which uses both) provide confidentiality. Hashing does not.
An attacker sends a fraudulent email that appears to come from the company's IT department, requesting that the recipient click a link and enter their login credentials. Which type of social engineering attack is this?
Phishing is a broad term for fraudulent emails asking for credentials.
Why this answer
This is a phishing attack because the attacker uses a fraudulent email that impersonates a trusted entity (the IT department) to trick the recipient into clicking a malicious link and entering sensitive login credentials. Phishing is a broad category of social engineering that relies on deceptive electronic communications, typically email, to harvest credentials or deliver malware.
Exam trap
Cisco often tests the distinction between generic phishing and spear phishing, where the trap is that candidates confuse a broad phishing email with a targeted one, but the question lacks any indication of personalization or specific targeting, making 'Phishing' the correct choice over 'Spear phishing'.
How to eliminate wrong answers
Option A (Vishing) is wrong because vishing (voice phishing) uses voice calls or VoIP systems, not email, to deceive victims. Option C (Pretexting) is wrong because pretexting involves fabricating a scenario or false identity to obtain information, but it does not necessarily use a fraudulent email with a link to harvest credentials; it often relies on direct interaction or impersonation over phone or in person. Option D (Spear phishing) is wrong because spear phishing is a targeted form of phishing aimed at a specific individual or organization, often using personalized details; the question describes a generic email sent to a recipient without indicating targeting, so it fits the broader phishing category.
Which compliance standard specifically applies to organizations that handle credit card information?
PCI DSS governs credit card data security.
Why this answer
PCI DSS is the Payment Card Industry Data Security Standard for credit card data.
A security engineer is analyzing a recent data breach. Which TWO are examples of active reconnaissance techniques? (Select two.)
Port scanning directly probes open ports on a target system.
Why this answer
Active reconnaissance involves direct interaction with the target. Port scanning and ping sweeps are active; WHOIS and Google searches are passive.
Ready to test yourself?
Try a timed practice session using only Security Concepts questions.