Network Security Fundamentals ECSS Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A company's network was hit by a ransomware attack that encrypted several file servers. The incident response team restored the data from backups. Which type of security control did the backup and restore process primarily represent?

   • ACorrective control
   • BDeterrent control
   • CPreventive control
   • DDetective control
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A company discovered that a user's password was reused across multiple systems and was found in a public breach database. To reduce the risk of credential-stuffing attacks, which best practice should be implemented?

   • ADisable password expiration and rely on user awareness training
   • BAllow users to keep the same password but require a longer password
   • CEnforce multi-factor authentication (MFA) for all user accounts
   • DRemove all network monitoring to reduce false positives
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A network administrator notices that a server has not received security updates for over a year. Which vulnerability does this represent?

   • AWeak password
   • BUnpatched software
   • CMisconfiguration
   • DPhishing
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A hospital's electronic health record (EHR) system must remain available during a regional power outage. The hospital has a backup generator, but the network team is concerned about a prolonged outage. They need to ensure that patient data is not lost and that the system can be restored quickly. Which combination of controls BEST addresses availability and recoverability?

   • ARedundant power supplies, regular off-site backups, and a tested disaster recovery plan
   • BEncryption of all data and multi-factor authentication
   • CA single backup generator and a UPS for each server
   • DA strong firewall and intrusion detection system
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A company's website is flooded with traffic from many compromised devices, causing the site to crash. Which type of threat is this?

   • ADistributed denial-of-service (DDoS)
   • BPhishing
   • CMan-in-the-middle
   • DMalware
   Reveal Solution Discussion Select an answer first