Scenario practice questions

A security analyst detects unusual outbound network traffic from a database server to an unknown IP address. The traffic uses encrypted connections on port 443. Which type of attack is MOST likely occurring?

Trap 1: SQL injection

SQL injection is typically used to extract data via web application, not encrypted outbound traffic.

Trap 2: Ransomware

Ransomware usually encrypts files locally and demands ransom, not necessarily exfiltrating data.

Trap 3: Denial of service

DoS attacks generate high traffic to overwhelm resources, not stealthy encrypted outbound.

A
Data exfiltration
Encrypted outbound traffic to an unknown IP is a classic sign of data exfiltration.
B
SQL injection
Why wrong: SQL injection is typically used to extract data via web application, not encrypted outbound traffic.
C
Ransomware
Why wrong: Ransomware usually encrypts files locally and demands ransom, not necessarily exfiltrating data.
D
Denial of service
Why wrong: DoS attacks generate high traffic to overwhelm resources, not stealthy encrypted outbound.

Question 2mediummultiple choice

An organization has implemented a new web application that processes sensitive customer data. The risk assessment identified a high likelihood of SQL injection attacks due to insufficient input validation. Which of the following is the BEST risk treatment strategy?

Trap 1: Transfer the risk by purchasing cyber insurance

Transfer does not reduce the likelihood; it only shifts financial impact.

Trap 2: Avoid the risk by discontinuing the web application

Avoidance is too drastic and not necessary when remediation is possible.

Trap 3: Accept the risk because the likelihood is low after compensating…

Acceptance is not appropriate for a high-risk vulnerability that can be remediated.

A
Transfer the risk by purchasing cyber insurance
Why wrong: Transfer does not reduce the likelihood; it only shifts financial impact.
B
Avoid the risk by discontinuing the web application
Why wrong: Avoidance is too drastic and not necessary when remediation is possible.
C
Remediate the risk by implementing parameterized queries and input validation
This directly addresses the vulnerability and reduces the risk to an acceptable level.
D
Accept the risk because the likelihood is low after compensating controls
Why wrong: Acceptance is not appropriate for a high-risk vulnerability that can be remediated.

Question 3mediummultiple choice

Based on the exhibit, what is the MOST likely scenario?

Exhibit

Refer to the exhibit.

Exhibit:

Event Log Entry:
Time: 2023-10-05 14:23:17
Event ID: 4625
Source: Security
User: SYSTEM
Logon Type: 3
Account Name: jdoe
Account Domain: CORP
Failure Reason: Unknown user name or bad password.
Workstation Name: WS-001
IP Address: 192.168.1.50

Event Log Entry:
Time: 2023-10-05 14:24:05
Event ID: 4624
Source: Security
User: SYSTEM
Logon Type: 3
Account Name: jdoe
Account Domain: CORP
Workstation Name: WS-001
IP Address: 192.168.1.50

Event Log Entry:
Time: 2023-10-05 14:25:10
Event ID: 4648
Source: Security
User: jdoe
Logon Type: 2
Account Name: jdoe
Account Domain: CORP
Target Server: FILE-SRV-01
Additional Info: A logon was attempted using explicit credentials.
Workstation Name: WS-001
IP Address: 192.168.1.50

Trap 1: A user is performing a scheduled task that requires authentication.

Scheduled tasks typically run under system accounts, not with explicit credentials.

Trap 2: A user forgot their password and successfully logged in after…

The pattern shows a failed attempt followed by success, but the explicit credential use to a file server suggests more than a simple mistake.

Trap 3: A system administrator is testing password policies.

There is no indication of administrative intent; it appears malicious.

A
A user is performing a scheduled task that requires authentication.
Why wrong: Scheduled tasks typically run under system accounts, not with explicit credentials.
B
A user forgot their password and successfully logged in after retrying.
Why wrong: The pattern shows a failed attempt followed by success, but the explicit credential use to a file server suggests more than a simple mistake.
C
An attacker brute-forced the password and then used the credentials to access a file server.
The sequence indicates successful guess followed by lateral movement.
D
A system administrator is testing password policies.
Why wrong: There is no indication of administrative intent; it appears malicious.

Question 4mediummulti select

Which TWO of the following are key components of a risk assessment report according to best practices? (Choose two.)

Trap 1: Vendor security assessment ratings

Vendor ratings may be used but are not a required component of a general risk assessment report.

Trap 2: Detailed results of control testing

Control testing results are typically in a separate audit or control assessment report.

Trap 3: Complete asset inventory

Asset inventory is a prerequisite but not part of the risk assessment report itself.

A
Vendor security assessment ratings
Why wrong: Vendor ratings may be used but are not a required component of a general risk assessment report.
B
Risk scenarios with likelihood and impact ratings
Risk scenarios with assessments are central to a risk assessment report.
C
Detailed results of control testing
Why wrong: Control testing results are typically in a separate audit or control assessment report.
D
Risk treatment recommendations
The report should propose actions to manage identified risks.
E
Complete asset inventory
Why wrong: Asset inventory is a prerequisite but not part of the risk assessment report itself.

Question 5hardmultiple choice

During a merger, the acquiring company's board insists on integrating the target company's information security governance into its own within 90 days. However, the target has a significantly different risk culture and lacks documented policies. What is the most critical governance risk in this scenario?

Trap 1: The acquiring company's security team may lack the capacity to…

Training is important but not the most critical governance risk at this stage.

Trap 2: The target's employees may resist the new security culture.

Culture is a concern but the most critical risk is accepting unknown risks.

Trap 3: There will be insufficient time to develop new security policies…

Policies can be adapted later; the immediate risk is unknown risks.

A
The acquiring company's security team may lack the capacity to train the target's staff.
Why wrong: Training is important but not the most critical governance risk at this stage.
B
The target's employees may resist the new security culture.
Why wrong: Culture is a concern but the most critical risk is accepting unknown risks.
C
The acquiring company may inadvertently accept unknown high-risk exposures.
Rushing integration without understanding the target's risk posture can lead to severe exposure.
D
There will be insufficient time to develop new security policies for the combined entity.
Why wrong: Policies can be adapted later; the immediate risk is unknown risks.

Question 6hardmultiple choice

During an internal audit, it is discovered that business units frequently purchase cloud services without involving the IT security department. Which governance deficiency does this scenario most clearly demonstrate?

Trap 1: Inadequate security awareness training

Training might help but does not address the process gap.

Trap 2: Lack of an incident response plan

Incident response is separate from the procurement process.

Trap 3: Weak access control over cloud resources

Access controls may be weak, but the fundamental issue is the governance process.

A
Inadequate security awareness training
Why wrong: Training might help but does not address the process gap.
B
Lack of an incident response plan
Why wrong: Incident response is separate from the procurement process.
C
Absence of a procurement security policy
A procurement policy should require security review before purchasing cloud services.
D
Weak access control over cloud resources
Why wrong: Access controls may be weak, but the fundamental issue is the governance process.

Question 7hardmultiple choice

You are the CISM for a mid-sized e-commerce company that processes credit card transactions. The company recently experienced a security incident where an attacker exploited a vulnerability in the web application to gain access to the customer database containing payment card information. The incident response team contained the breach, but the root cause analysis revealed that the vulnerability had been identified in a penetration test six months ago but was not remediated due to competing priorities. The company's risk management framework defines risk appetite as 'moderate' for information security risks. The board is concerned and has asked you to recommend improvements to prevent recurrence. The company has a limited budget and cannot implement all possible controls. Current environment: web application developed in-house, hosted on-premises, with a mix of virtual and physical servers. The security team consists of three people responsible for monitoring, incident response, and vulnerability management. The development team follows an agile methodology with bi-weekly sprints. The company has cyber liability insurance that covers breach response costs up to $2 million. Based on this scenario, what is the most effective course of action?

Trap 1: Hire two additional security analysts to improve monitoring and…

More staff can help but does not ensure vulnerabilities are remediated.

Trap 2: Increase cyber liability insurance coverage to $5 million to cover…

Insurance does not prevent breaches; it only provides financial compensation.

Trap 3: Rewrite the web application using a secure development framework to…

While beneficial, it is not the most immediate or cost-effective fix for the process gap.

A
Hire two additional security analysts to improve monitoring and incident response.
Why wrong: More staff can help but does not ensure vulnerabilities are remediated.
B
Implement a formal vulnerability management program with defined remediation SLAs based on risk severity.
This directly addresses the failure to remediate known vulnerabilities, ensuring timely fixes.
C
Increase cyber liability insurance coverage to $5 million to cover potential breach costs.
Why wrong: Insurance does not prevent breaches; it only provides financial compensation.
D
Rewrite the web application using a secure development framework to eliminate vulnerabilities.
Why wrong: While beneficial, it is not the most immediate or cost-effective fix for the process gap.

Question 8hardmultiple choice

Based on the log entries, what is the most likely scenario?

Exhibit

Refer to the exhibit.
Exhibit:
```
2024-11-20T15:23:45Z [SRV-DB01] [sshd] Failed password for root from 192.168.1.105 port 22 ssh2
2024-11-20T15:23:47Z [SRV-DB01] [sshd] Failed password for root from 192.168.1.105 port 22 ssh2
2024-11-20T15:23:49Z [SRV-DB01] [sshd] Failed password for root from 192.168.1.105 port 22 ssh2
2024-11-20T15:23:51Z [SRV-DB01] [sshd] Failed password for root from 192.168.1.105 port 22 ssh2
2024-11-20T15:23:53Z [SRV-DB01] [sshd] Failed password for root from 192.168.1.105 port 22 ssh2
```

Trap 1: A remote code execution attempt

The logs show authentication failures, not signs of code execution.

Trap 2: A legitimate user repeatedly mistyping their password

The rapid 2-second intervals are more consistent with automated guessing than a human error.

Trap 3: A misconfiguration causing duplicate log entries

Duplicate entries would show identical timestamps, not a pattern of repeated attempts.

A
A brute-force attack against the root account
Multiple failed attempts in quick succession for the same account and IP is classic brute-force behavior.
B
A remote code execution attempt
Why wrong: The logs show authentication failures, not signs of code execution.
C
A legitimate user repeatedly mistyping their password
Why wrong: The rapid 2-second intervals are more consistent with automated guessing than a human error.
D
A misconfiguration causing duplicate log entries
Why wrong: Duplicate entries would show identical timestamps, not a pattern of repeated attempts.