Information Security Threats and Vulnerabilities CCT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   When assessing risk, what does the 'impact' component refer to?

   • AThe time it takes to patch a vulnerability
   • BThe likelihood that a vulnerability will be discovered by an attacker
   • CThe extent of damage or loss that would occur if a threat exploits a vulnerability
   • DThe number of security controls in place
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst is profiling a threat actor who has been conducting espionage against a defense contractor for several months. The actor uses sophisticated custom malware and carefully targets specific individuals with highly personalized phishing emails. The motivation appears to be gathering classified information. How should the analyst classify this threat actor?

   • AHacktivist
   • BCybercriminal
   • CInsider threat
   • DNation-state actor
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company's security team discovers that an attacker gained access to the corporate network by sending a phishing email to an employee, which led to the installation of a remote access Trojan. The RAT then used the employee's VPN credentials to move laterally to a file server. Which of the following best describes the initial attack vector in this scenario?

   • AThe file server
   • BThe VPN gateway
   • CThe phishing email
   • DThe remote access Trojan
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which type of malware is specifically designed to encrypt a victim's files and then demand payment for the decryption key?

   • ARansomware
   • BWorm
   • CSpyware
   • DTrojan
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is meant by the term 'attack surface'?

   • AThe physical area of a data center that is accessible to the public
   • BThe total set of all possible points where an unauthorized user can try to enter data into or extract data from an environment
   • CThe list of all known vulnerabilities in a software product
   • DThe network bandwidth available for an attack to occur
   Reveal Solution Discussion Select an answer first