Explain Cybersecurity DATA-PROTECTION-MANAGEMENT-FOUNDATIONS Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A backup administrator is verifying the integrity of restored data after a ransomware attack. The administrator compares file hashes from the backup against the original production data and finds that 5% of files have different hashes. The backup software reports the restore as 'successful.' Which conclusion is most appropriate?

   • AThe restore is successful because the backup software reported it as such
   • BThe ransomware is still active and has re-encrypted the restored data
   • CThe backup software is faulty and should be replaced immediately
   • DThe restore may have been corrupted, or the original data was already modified before the backup was taken
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A healthcare provider's backup environment was breached. The investigation reveals that the attacker gained access through a phishing email that compromised a backup administrator's credentials. The attacker then used those credentials to access the backup console and delete several backup sets. The provider had MFA enabled on the console, but the attacker bypassed it using a session token. Which combination of controls would have been most effective in preventing this attack?

   • ASecurity awareness training, session token expiration, and immutable backup storage
   • BStronger password policy, antivirus software, and more frequent backups
   • CDisabling MFA, using a jump server, and manual backup verification
   • DNetwork segmentation, firewall rules, and a VPN
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A financial services firm is designing a backup strategy that must protect against both ransomware encryption and insider deletion. The firm has a limited budget and must choose between two options: (A) immutable backup storage that prevents modification for 30 days, or (B) a comprehensive audit logging system with real-time alerts. The firm's risk assessment shows that ransomware is the most likely threat, but insider deletion is considered the highest-impact threat. Which approach best addresses both threats within the budget?

   • AImplement the audit logging system and rely on existing backup retention policies to protect against ransomware
   • BImplement both options by reducing backup frequency to every 48 hours
   • CImplement immutable storage and use the existing audit logs, accepting that insider deletion may not be detected in real time
   • DImplement neither option and rely on the existing backup solution's built-in security
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which type of security control is designed to stop an attack from occurring in the first place?

   • APreventive control
   • BCompensating control
   • CDetective control
   • DCorrective control
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A bank's backup administrator is implementing a new backup solution. The bank requires that backup data be encrypted in transit and at rest, that access to backups be logged, and that backups be stored in a separate network segment from production systems. Which cybersecurity principle is the administrator applying to the backup environment?

   • ALeast privilege — granting minimal access to backup data
   • BDefense in depth — applying multiple layers of protection to backup data
   • CFailover — providing redundant backup systems
   • DSeparation of duties — dividing backup responsibilities among staff
   Reveal Solution Discussion Select an answer first