Information Security Threats and Vulnerabilities CCT Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company has experienced multiple successful phishing attacks despite technical controls. The security team wants to reduce the likelihood of employees falling for these attacks. Which mitigation strategy would be most effective as a primary control?

   • ADeploy an email filtering solution to block malicious emails
   • BConduct regular security awareness training and simulated phishing exercises
   • CIncrease the frequency of vulnerability scans on email servers
   • DImplement multi-factor authentication (MFA) on all accounts
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is a common output of a vulnerability scan?

   • AA detailed plan for exploiting each vulnerability
   • BA real-time alert for every attempted intrusion
   • CA list of identified vulnerabilities with severity ratings
   • DA list of all employees' passwords
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A financial institution has detected a sophisticated attack that has been ongoing for six months. The attackers used zero-day exploits, custom malware, and compromised legitimate credentials to move laterally. They have been exfiltrating data slowly to avoid detection. Which threat actor type is most likely behind this attack?

   • AA cybercriminal gang focused on quick financial gain
   • BA hacktivist group with a political agenda
   • CA nation-state sponsored APT group
   • DAn insider threat employee with access to sensitive data
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A vulnerability assessment has been completed, and the report lists several vulnerabilities. The security team is reviewing the report and notices that some vulnerabilities are marked as 'false positives'. Which of the following is the most likely reason for a false positive?

   • AThe vulnerability scanner detected a configuration issue that is actually mitigated by a compensating control
   • BThe vulnerability scanner reported a vulnerability that exists in a different system
   • CThe vulnerability was patched after the scan was completed
   • DThe vulnerability scanner missed a real vulnerability
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company has a mix of Windows and Linux servers. The security team wants to implement a mitigation strategy to reduce the risk of malware infections. Which of the following strategies would be most effective across both operating systems?

   • AUse a single security solution that is designed for Windows only
   • BDisable all unnecessary services on Windows servers only
   • CInstall antivirus software on all Windows servers only
   • DImplement a robust patch management process that covers all operating systems and applications
   Reveal Solution Discussion Select an answer first