Overview of Information Security and Defense Strategies EHE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A small retail company stores customer payment data in a database that is directly accessible from the internet. The database has a strong password and is patched, but the security team wants to add another layer of protection so that a single misconfiguration does not expose the data. Which control best addresses this need?

   • AMove the database behind a firewall and restrict access to internal networks only.
   • BEnable database auditing to log all queries.
   • CTrain employees on secure database configuration.
   • DApply a database patch that fixes a known vulnerability.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An organization wants to test its incident response procedures by simulating a ransomware attack. They have hired an ethical hacker to conduct the simulation. What is the most important step before the simulation begins?

   • AEnsure the ethical hacker has signed a non-disclosure agreement (NDA) and a detailed rules of engagement document.
   • BRequire the ethical hacker to report all findings directly to the CEO, bypassing the IT team.
   • CProvide the ethical hacker with the credentials to all production systems so they can test everything.
   • DAsk the ethical hacker to avoid any disruption to production systems, even if it limits the test's effectiveness.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company suspects that its web application has a vulnerability that could allow attackers to access other users' data. The company hires an ethical hacker to test the application. What is the primary benefit of this engagement?

   • AIdentifying and fixing the vulnerability before a malicious attacker exploits it.
   • BCreating a public report of all vulnerabilities.
   • CPunishing employees who wrote insecure code.
   • DProving that the application is completely secure.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company wants to proactively identify vulnerabilities in its web application before attackers do. They have hired an ethical hacker to perform a security assessment. Which activity is most consistent with the ethical hacker's role?

   • ATesting the application without any prior authorization to simulate a real attack.
   • BDeleting the application's logs to avoid detection during the test.
   • CExploiting a discovered SQL injection vulnerability to extract the entire customer database and publish it.
   • DScanning the application for vulnerabilities and providing a detailed report with remediation recommendations.
   Reveal Solution Discussion Select an answer first
6. 15expert · medium

   A company has a single firewall at the network perimeter, and all internal traffic is trusted. A recent attack originated from an internal compromised workstation and spread to the entire network. The company wants to implement defense-in-depth to prevent similar incidents. Which combination of controls would be most effective?

   • ADeploy internal firewalls to segment the network and implement host-based intrusion prevention on all endpoints.
   • BIncrease the frequency of antivirus scans on all endpoints to daily.
   • CUpgrade the perimeter firewall to a next-generation firewall with application control.
   • DImplement a VPN for all remote access and require MFA.
   Reveal Solution Discussion Select an answer first