Information Security Threats and Vulnerabilities CCT Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is an example of an attack vector?

   • AA vulnerability scanner
   • BA security policy
   • CA phishing email
   • DA firewall rule
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A small business wants to identify weaknesses in its network before attackers do. They have a limited budget and no dedicated security staff. Which approach should they take to perform a basic vulnerability assessment?

   • AReview firewall logs and disable any unused services
   • BRun an automated vulnerability scanner against all internet-facing systems and internal servers
   • CInstall antivirus software on all endpoints
   • DHire a penetration testing firm to perform a full manual assessment
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company is planning to deploy a new customer-facing web application. The security team must choose between two architectures: one that places the application directly on the internet with a web application firewall (WAF), and another that places it behind a VPN that requires customers to authenticate. The application must be accessible to a broad customer base. Which architecture is more appropriate?

   • AVPN-only, because it provides the strongest security and limits exposure
   • BInternet-facing with a WAF, because it provides broad accessibility while mitigating common web attacks
   • CInternet-facing without a WAF, because the application is new and unlikely to be attacked
   • DVPN-only with a WAF, because it combines strong authentication and web filtering
   Reveal Solution Discussion Select an answer first
5. 19expert · hard · select all that apply

   A security analyst is reviewing a series of security incidents. Which of the following are characteristics of an advanced persistent threat (APT)? (Select all that apply.)

   • AThe attack is conducted over a long period with sustained access
   • BThe attacker uses sophisticated, custom-developed malware
   • CThe attack is usually financially motivated and short-term
   • DThe attacker is often well-funded and may be state-sponsored
   • EThe attack relies on publicly available exploit tools
   Check answers Discussion Select an answer first
6. 20foundation · easy

   What is the primary purpose of a vulnerability assessment?

   • ATo enforce security policies across the organization
   • BTo actively exploit vulnerabilities to test security controls
   • CTo monitor network traffic for malicious activity
   • DTo identify and prioritize weaknesses in systems before they can be exploited
   Reveal Solution Discussion Select an answer first