Hard Difficulty Questions

Password hashing

Why wrong: Password hashing uses hash functions, not PKI.

Symmetric key exchange

Why wrong: Symmetric key exchange is often done via algorithms like Diffie-Hellman, not directly PKI.

WPA2-Enterprise with RADIUS

Why wrong: Legacy devices may not support 802.1X authentication.

WPA3-SAE only

Why wrong: Legacy devices do not support WPA3.

WPA2-PSK with TKIP

Why wrong: TKIP is deprecated and less secure than AES.

AH in tunnel mode

Why wrong: AH provides authentication but no encryption, failing the encryption requirement.

AH in transport mode

Why wrong: AH lacks encryption and transport mode is inappropriate for site-to-site.

ESP in transport mode

Why wrong: Transport mode is for end-to-end communication, not for gateway-to-gateway VPNs.

$800,000

Why wrong: This might result from miscalculating SLE as AV × ARO.

$2,000,000

Why wrong: This is the SLE, not the ALE.

$2,500,000

Why wrong: This might be AV × ARO.

Penetration testing

Why wrong: Penetration testing identifies vulnerabilities, not risks in a broad sense; it's a later step.

Quantitative risk analysis

Why wrong: Quantitative analysis assesses already identified risks; it's not an identification technique.

Technical vulnerability indicator

Why wrong: A technical vulnerability would be a weakness in software or hardware, not user activity.

Error log indicator

Why wrong: Error logs record system errors; this is a user activity log.

Configuration drift indicator

Why wrong: Configuration drift refers to changes in system settings, not user actions.

Port scan of the internal network

Why wrong: Port scan would show connections to multiple ports, not same port.

Data exfiltration to an external server

Why wrong: Data exfiltration typically involves outbound traffic to external IPs.

Normal administrative remote access

Why wrong: Normal access would not generate rapid connections.

To change the MAC address of the switch

Why wrong: The attack does not change switch MAC addresses.

To cause a denial of service on the network

Why wrong: While flooding may cause performance issues, the primary goal is traffic interception.

To bypass 802.1X authentication

Why wrong: MAC flooding does not bypass authentication mechanisms.

Session hijacking

Why wrong: Session hijacking assumes an authenticated session, not bypassing MFA.

Man-in-the-middle (MITM) attack

Why wrong: MITM can intercept credentials but MFA typically requires a second factor.

Token theft from the endpoint

Why wrong: Token theft may allow reuse but does not bypass MFA challenge.

Pharming

Why wrong: Often considered an application-layer attack, though it manipulates DNS.

SQL injection

Why wrong: An application-layer attack on databases.

Hash passwords with SHA-256

Why wrong: SHA-256 is too fast and does not include a salt by default.

Encode passwords with Base64

Why wrong: Base64 is encoding, not hashing; it provides no security.

Encrypt passwords using AES-256 and store the key separately

Why wrong: Encryption is reversible; if the key is compromised, all passwords are exposed.

The application uses unsanitized input in SQL queries.

Why wrong: SQL injection leads to database access, not command execution.

The application reflects user input in HTTP responses without escaping.

Why wrong: XSS vulnerability, but does not directly execute commands on server.

The application uses hidden form fields to store session tokens.

Why wrong: CSRF vulnerability, not command execution.

No hosts can connect to the database

Why wrong: Hosts in the 10.0.0.0/8 range can connect on port 3306.

Both internet hosts and internal hosts

Why wrong: Internet hosts cannot access port 3306; they are only allowed on port 443.

Any host on the internet

Why wrong: Only hosts in the 10.0.0.0/8 range are allowed on port 3306; internet hosts are allowed only on port 443.

Vendor management process

Why wrong: Vendor management is not a core element of incident response.

Restoring all systems from backup

Why wrong: This is a specific recovery activity, not a plan element.

Unusual cookie values or multiple cookies

Why wrong: May indicate session fixation or hijacking, not specifically XSS.

Unusual network traffic to external IP addresses

Why wrong: May be caused by other malware, not specifically XSS.

It ensures that the private key d is small

Why wrong: e does not influence d size; d is computed from e and φ(n).

It prevents side-channel attacks

Why wrong: Side-channel attacks are mitigated by constant-time algorithms, not exponent choice.

It provides the highest security level

Why wrong: Security depends on key size, not exponent value within reason.

Publish symmetric keys on the company website for transparency

Why wrong: Symmetric keys must be kept secret.

Store keys with the encrypted data for convenience

Why wrong: Keys must be stored separately from data.

Bob is not the owner of the directory

Why wrong: While owner has rwx, group and other can be restrictive; not being owner does not automatically deny write if group permissions allow it.

Bob's effective permissions are limited by the user:alice entry

Why wrong: The user:alice entry applies only to user alice; bob does not have that specific ACL entry.

The 'other' permission is '---', blocking all access for users not in the file's user or group

Why wrong: Bob is in the group projectdev, so he is not 'other'; he is covered by the group entry.

Increased complexity of password policies

Why wrong: Complexity is manageable; the core issue is the blast radius.

Lack of detailed audit logs for each application

Why wrong: SSO can still produce logs; focus is on access control.

User inconvenience due to multiple logins

Why wrong: SSO improves convenience, that's not a security concern.

Retina scan and facial recognition

Why wrong: Both are biometric (something you are), not MFA.

Password and security question

Why wrong: Both are knowledge factors, not true MFA.