Information Security Threats and Vulnerabilities CCT Practice Questions (Page 10)

Questions 46–47

1. 46application · medium

   A regional bank's security team notices a pattern of targeted phishing emails sent to its treasury department. The emails reference recent personal transactions and use the bank's internal terminology. The sender appears to be a known cybercriminal group. Which combination of actions should the team prioritize to reduce the risk from this specific threat?

   • ABlock all external email traffic to the treasury department
   • BImmediately rotate all treasury department passwords and enforce multi-factor authentication
   • CDeploy additional email filtering and conduct a targeted security awareness session for the treasury team
   • DIncrease the frequency of vulnerability scans on treasury workstations
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A company is planning to deploy a new web application. The security team wants to identify potential attack vectors before the application goes live. Which of the following is the most effective way to identify these attack vectors?

   • AConduct a threat modeling exercise that maps potential attackers to entry points and assets
   • BReview the application's source code for syntax errors
   • CInstall a web application firewall (WAF) in front of the application
   • DWait until the application is deployed and monitor for attacks
   Reveal Solution Discussion Select an answer first