Cybersecurity-Apprentice Cybersecurity Apprentice Practice Questions

Software as a Service (SaaS) is a cloud model where software is licensed on a subscription basis and is centrally hosted. The vendor manages the entire stack (infrastructure, OS, middleware, application), and the customer accesses it through a client, typically a web browser. This perfectly describes the scenario of using a ready-to-use accounting application online.

A false negative is a critical failure where a security system fails to detect an actual threat. In this case, the IDS missed the known malware, allowing it to enter the network undetected. False negatives are often more dangerous than false positives because they create a false sense of security while a real attack may be in progress.

Secure Shell (SSH) is a cryptographic network protocol for operating network services securely over an unsecured network. Its most notable application is for remote login to computer systems by users. It provides strong encryption for all transmitted data, including passwords, commands, and output, making it the standard for secure remote command-line administration. Telnet is an older protocol that transmits data in cleartext and is insecure.

Antivirus is a foundational component of endpoint security, designed to detect and remove malware from a host system.

Keeping the operating system and applications updated is critical for patching vulnerabilities that malware could exploit. This is a core practice of endpoint security.

A host-based firewall runs on an individual computer or device, controlling network traffic to and from that specific endpoint. It provides a layer of protection even within a trusted network.

Layer 3, the Network layer, is responsible for logical addressing (IP addresses) and routing packets across different networks. Layer 2 (Data Link) uses physical addresses (MAC addresses) for communication within the same local network. Layer 4 (Transport) handles end-to-end communication and data segmentation, while Layer 7 (Application) is where users interact with network services.

In traditional data centers, security focused heavily on north-south traffic (client-to-server) at the perimeter. In modern hybrid cloud and microservices architectures, east-west traffic (server-to-server or service-to-service) increases dramatically. Securing this internal traffic is crucial to prevent lateral movement of threats that breach the perimeter, making east-west traffic inspection a higher priority.

While stateful firewalls operate primarily at Layers 3 and 4 (IP addresses, ports, and connection states), NGFWs provide Layer 7 application visibility and user identification. This allows for the creation of granular security policies based on the actual application (e.g., 'Allow SharePoint-base' but 'Block SharePoint-upload') and the user's identity, rather than just relying on ambiguous port numbers.

One of the fundamental principles of Zero Trust is to 'never trust, always verify.' This means assuming that no network, whether internal or external, is secure. Every access request must be treated as if it originates from an open network.

The principle of least privilege is central to Zero Trust. Users, devices, and applications should only be given the minimum levels of access or permissions needed to perform their specific function. This minimizes the potential damage from a compromised account or device.

In the IaaS model, the cloud provider is responsible for the security of the cloud (physical infrastructure, virtualization layer). The customer is responsible for security in the cloud, which includes securing and patching the guest operating systems, applications, and data they deploy on the virtual machines.

A false positive occurs when a security system incorrectly identifies benign activity as malicious. Since the analyst confirmed the behavior was legitimate, the alert was a false alarm, which is the definition of a false positive. This is a crucial concept in security operations for tuning detection rules and reducing analyst fatigue.