Objective 3.1 Protect Data. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A web developer has installed phpMyAdmin on a server that is accessible from the internet. The developer has set a strong password for the phpMyAdmin admin account and enabled SSL. However, the security team is concerned about brute-force attacks. Which additional measure would be most effective in mitigating brute-force attacks?

   • AImplement rate limiting on the phpMyAdmin login page.
   • BUse a longer password for the admin account.
   • CDisable the phpMyAdmin setup script.
   • DChange the phpMyAdmin URL to a non-standard path.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A financial services company must back up its customer database, email archives, and internal documents. The compliance team requires that customer data be recoverable within 4 hours, while email archives can take up to 24 hours. The IT team is designing the backup strategy. What is the most effective approach to meet these recovery time objectives (RTOs)?

   • AUse the same backup schedule for all data but store backups on tape to reduce costs.
   • BBack up all data types together in a single nightly backup job to simplify management.
   • CIncrease the backup frequency for email archives to ensure they are always current.
   • DPartition backups by data type, with customer data backed up more frequently and stored on faster recovery media, while email archives are backed up less frequently.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security engineer is designing a system where multiple users need to encrypt data that only a central server can decrypt. The users are in different locations and cannot share a common secret. Which encryption approach should be used?

   • AUse symmetric encryption with a shared key distributed to all users.
   • BUse a combination of symmetric and asymmetric encryption where each user generates a symmetric key and encrypts it with the server's public key.
   • CUse a hash function to encrypt the data.
   • DUse asymmetric encryption where each user has the server's public key to encrypt data, and the server uses its private key to decrypt.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A web application uses a MySQL database to store user profiles. The application connects to the database over the internal network. The security team wants to ensure that database connections are encrypted and that only the application server can access the database. What should be configured?

   • AUse a strong password for the MySQL root account and disable remote access entirely.
   • BPlace the database on a public subnet and rely on a firewall to restrict access.
   • CEnable TLS for MySQL connections and configure the MySQL user account to be accessible only from the application server's IP address.
   • DUse MySQL's default authentication plugin and allow connections from any host.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is an example of an access control measure for backup systems?

   • AStoring backups on a public cloud without restrictions
   • BEncrypting backups with AES-256
   • CUsing role-based access control (RBAC) to limit backup access to specific administrators
   • DScheduling backups to run at midnight
   Reveal Solution Discussion Select an answer first