Cybersecurity-Fundamentals Practice Questions

This statement is true. A zero-day vulnerability refers to a security flaw that is known to attackers (and possibly the public) before the software vendor has released a patch to fix it. This creates a critical window of opportunity for attackers to exploit the vulnerability, as there are 'zero days' of protection available for users.

This option comprehensively addresses all three audit findings with appropriate, modern solutions. A secrets management tool directly solves the problem of hardcoded credentials. Implementing RBAC via the cloud provider's IAM service is the standard way to enforce the principle of least privilege. Deploying a SIEM provides the necessary centralized logging and monitoring capabilities. These tools are designed to work in cloud environments and integrate with CI/CD pipelines.

Dynamic Application Security Testing (DAST) analyzes a running application from the outside in, similar to how an attacker would. It sends various malicious and unexpected inputs to the application to identify vulnerabilities like SQL injection, XSS, and other common web flaws without needing access to the source code. This is distinct from SAST, which analyzes the static source code.

This attack is a specific form of phishing known as whaling (or CEO fraud). Whaling targets high-profile individuals within an organization, such as executives (like the CEO), and often involves social engineering tactics like impersonation and urgency to trick employees into performing actions like transferring funds or revealing sensitive information.

Virtual Local Area Networks (VLANs) are used to logically segment a network. Devices on one VLAN are isolated from devices on another VLAN as if they were on physically separate networks. This is the standard method for creating separate broadcast domains for different purposes (like guest vs. corporate) on the same switches, with a router or Layer 3 switch controlling traffic between them.

This option represents multiple layers of technical controls: the firewall at the network perimeter, the IDS for network traffic analysis, and antivirus at the individual host (endpoint) level. If one layer is breached, the others still provide protection.

This option represents multiple layers of administrative controls. Background checks are a pre-employment control, training is an ongoing behavioral control, and data classification is a policy-based control that dictates handling procedures. These work together to reduce risk from the human element.

Azure uses specific, non-spaced string identifiers for its regions. 'EastUS' is the correct identifier for the East US region. Other cloud providers use different naming conventions (e.g., 'us-east-1' in AWS), and formats like 'USA-Central-1' are not valid Azure region names.

Data Loss Prevention (DLP) systems are specifically designed to enforce policies based on data classification and content analysis. They can inspect data in motion (like email attachments), at rest (on storage), and in use (on endpoints) to prevent unauthorized exfiltration of sensitive information, such as blocking 'Restricted' files from being sent externally.

After detection and analysis, the immediate priority in the incident response lifecycle is containment. This involves isolating the affected system (e.g., disconnecting it from the network) to prevent the ransomware from spreading to other systems. Eradication (removing the malware) and Recovery (restoring from backups) follow the containment phase.

The primary benefit of RBAC is administrative scalability and simplified management. Instead of assigning permissions directly to hundreds or thousands of individual users, administrators assign permissions to a smaller number of roles. Users are then assigned to these roles, inheriting the associated permissions. This greatly reduces the complexity of managing user access, especially during onboarding, offboarding, and role changes.