Scenario practice questions

A company's endpoint protection solution alerts on a file that is digitally signed by a trusted software vendor but exhibits malicious behavior on execution. What type of threat does this scenario most likely depict?

Trap 1: A Trojan horse disguised as legitimate software.

Trojans are malware that appear legitimate but may not be signed; the distinguishing factor here is the valid signature.

Trap 2: A zero-day exploit targeting an unpatched vulnerability.

The file's behavior is malicious, but the key aspect is its legitimate digital signature; zero-day focuses on unknown vulnerabilities.

Trap 3: A fileless attack that never writes to disk.

Fileless attacks reside in memory; this scenario involves a file with a digital signature.

A
A Trojan horse disguised as legitimate software.
Why wrong: Trojans are malware that appear legitimate but may not be signed; the distinguishing factor here is the valid signature.
B
Signed malware, indicating the certificate may have been compromised.
The file has a trusted digital signature but performs malicious actions, suggesting the signing key was stolen or misused.
C
A zero-day exploit targeting an unpatched vulnerability.
Why wrong: The file's behavior is malicious, but the key aspect is its legitimate digital signature; zero-day focuses on unknown vulnerabilities.
D
A fileless attack that never writes to disk.
Why wrong: Fileless attacks reside in memory; this scenario involves a file with a digital signature.

Question 2mediummultiple choice

An organization is implementing a data classification policy and needs to assign ownership for sensitive data. Which of the following is the most appropriate role to assign as the data owner?

Trap 1: The chief information security officer (CISO)

The CISO is responsible for security strategy, not data ownership.

Trap 2: The system administrator of the database

System administrators manage systems, not data ownership.

Trap 3: The legal counsel responsible for compliance

Legal counsel advises on compliance but does not own data.

A
The chief information security officer (CISO)
Why wrong: The CISO is responsible for security strategy, not data ownership.
B
The system administrator of the database
Why wrong: System administrators manage systems, not data ownership.
C
The head of the business unit that creates and uses the data
The business unit head is accountable for the data's classification and protection.
D
The legal counsel responsible for compliance
Why wrong: Legal counsel advises on compliance but does not own data.

Question 3easymultiple choice

An IT auditor is reviewing the business continuity plan (BCP) testing schedule. The organization conducts a test where participants discuss their roles and responses to a scenario without any actual system activation. Which type of test is this?

Trap 1: Parallel test

Incorrect: Parallel tests run DR systems alongside production.

Trap 2: Walkthrough

Incorrect: A walkthrough involves reviewing the plan step by step, not necessarily discussion-based.

Trap 3: Simulation

Incorrect: Simulation tests specific scenarios with some operational elements.

A
Parallel test
Why wrong: Incorrect: Parallel tests run DR systems alongside production.
B
Walkthrough
Why wrong: Incorrect: A walkthrough involves reviewing the plan step by step, not necessarily discussion-based.
C
Simulation
Why wrong: Incorrect: Simulation tests specific scenarios with some operational elements.
D
Tabletop exercise
Correct: Tabletop exercises are discussion-only and focus on roles and procedures.

Question 4mediummultiple choice

During a change advisory board (CAB) meeting, a proposed change to the database server is discussed. The change involves implementing a security patch that requires a reboot. The change is categorized as 'normal' and has been risk-assessed as low impact. What is the most likely role of the CAB in this scenario?

Trap 1: Implement the change directly

Implementation is done by the change management team, not the CAB.

Trap 2: Reject the change as unnecessary

Rejection is rare for security patches; the CAB usually approves when risk is low.

Trap 3: Defer the change to the next release cycle

Deferring may not be necessary for a low-risk change.

A
Review and approve the change
The CAB is responsible for reviewing and approving changes, especially those categorized as normal.
B
Implement the change directly
Why wrong: Implementation is done by the change management team, not the CAB.
C
Reject the change as unnecessary
Why wrong: Rejection is rare for security patches; the CAB usually approves when risk is low.
D
Defer the change to the next release cycle
Why wrong: Deferring may not be necessary for a low-risk change.

Question 5hardmultiple choice

During a review of the incident management process, the IS auditor finds that the incident response (IR) team conducts tabletop exercises annually, but the scenarios are limited to malware outbreaks. Which of the following should be the auditor's GREATEST concern?

Trap 1: The IR team may not have adequate forensic capabilities

Forensic capabilities are important but not directly related to scenario diversity.

Trap 2: The exercises are not conducted quarterly

Annual exercises may be sufficient; the issue is the scope.

Trap 3: The IR team is not following the defined procedures

The finding does not indicate non-compliance with procedures.

A
The IR team may not have adequate forensic capabilities
Why wrong: Forensic capabilities are important but not directly related to scenario diversity.
B
The exercises are not conducted quarterly
Why wrong: Annual exercises may be sufficient; the issue is the scope.
C
The IR team is not following the defined procedures
Why wrong: The finding does not indicate non-compliance with procedures.
D
The IR plan may not address all relevant incident types
If exercises only cover malware, other incident types may not be tested, leaving gaps in preparedness.

Question 6easymulti select

Which of the following are effective controls to protect sensitive data in use? (Choose TWO.)

Trap 1: Transport Layer Security (TLS)

TLS protects data in transit, not in use.

Trap 2: Access control lists (ACLs)

ACLs control access to stored data, not data in use.

Trap 3: Hashing

Hashing is typically used for integrity verification, not for protecting data in use.

A
Transport Layer Security (TLS)
Why wrong: TLS protects data in transit, not in use.
B
Access control lists (ACLs)
Why wrong: ACLs control access to stored data, not data in use.
C
Homomorphic encryption
Homomorphic encryption allows computations on ciphertext without decrypting.
D
Data masking
Data masking obscures data while in use in non-production environments.
E
Hashing
Why wrong: Hashing is typically used for integrity verification, not for protecting data in use.

Question 7easymultiple choice

During a security audit, it was found that users in the finance department have unnecessary access to HR payroll data. Which access control principle has been violated?

Trap 1: Mandatory access control

MAC is a model based on labels, not a principle violated by unnecessary access.

Trap 2: Separation of duties

Separation of duties prevents fraud by dividing tasks, but does not address unnecessary access.

Trap 3: Need to know

Need-to-know is a part of least privilege; the core violation is excessive privileges beyond job functions.

A
Mandatory access control
Why wrong: MAC is a model based on labels, not a principle violated by unnecessary access.
B
Least privilege
Least privilege requires that users have only the minimum access necessary to perform their job functions.
C
Separation of duties
Why wrong: Separation of duties prevents fraud by dividing tasks, but does not address unnecessary access.
D
Need to know
Why wrong: Need-to-know is a part of least privilege; the core violation is excessive privileges beyond job functions.

Review the full subnetting walkthrough →

Question 8hardmultiple choice

Refer to the exhibit. During a security audit, an IS analyst identifies that a critical business application hosted on 192.168.1.100:443 is unreachable from the 10.0.1.0/24 subnet. Which of the following is the MOST likely cause?

Exhibit

access-list extended BLOCK-MALICIOUS
deny ip 10.0.1.0 0.0.0.255 any
deny tcp any host 192.168.1.100 eq 443
permit ip 10.0.0.0 0.0.255.255 any

Trap 1: The second rule blocks HTTPS traffic from any source to the host

Second rule blocks HTTPS from any source, but first rule already blocks all traffic from 10.0.1.0/24.

Trap 2: The third rule permits all traffic from the 10.0.0.0/16 subnet

The permit rule applies to a larger subnet, but the first rule is more specific and blocks the 10.0.1.0/24 range.

Trap 3: The firewall is misconfigured for TCP traffic

Configuration is explicit; no general misconfiguration.

A
The first rule blocks all traffic from 10.0.1.0/24
Correct: The deny rule for the subnet overrides any permit.
B
The second rule blocks HTTPS traffic from any source to the host
Why wrong: Second rule blocks HTTPS from any source, but first rule already blocks all traffic from 10.0.1.0/24.
C
The third rule permits all traffic from the 10.0.0.0/16 subnet
Why wrong: The permit rule applies to a larger subnet, but the first rule is more specific and blocks the 10.0.1.0/24 range.
D
The firewall is misconfigured for TCP traffic
Why wrong: Configuration is explicit; no general misconfiguration.

Question 9mediummultiple choice

An organization is implementing a new identity management system. Which testing approach is MOST effective for verifying access controls?

Trap 1: Regression testing

Regression testing ensures new changes don't break existing functionality, but does not specifically target access controls.

Trap 2: Unit testing

Unit testing focuses on individual code units, not end-to-end access controls.

Trap 3: System integration testing

Integration testing verifies interfaces but may not cover all access control scenarios.

A
Regression testing
Why wrong: Regression testing ensures new changes don't break existing functionality, but does not specifically target access controls.
B
Unit testing
Why wrong: Unit testing focuses on individual code units, not end-to-end access controls.
C
User acceptance testing including role-based test cases
Role-based UAT scenarios simulate real user tasks and validate that access controls are correctly implemented.
D
System integration testing
Why wrong: Integration testing verifies interfaces but may not cover all access control scenarios.