Overview of Information Security and Defense Strategies EHE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company wants to proactively identify vulnerabilities in its network before attackers do. The company has obtained written authorization to perform simulated attacks. What is this practice called?

   • ASocial engineering
   • BEthical hacking
   • CHacktivism
   • DCyber espionage
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is a key principle of ethical hacking?

   • AUsing the same techniques as malicious hackers without any restrictions
   • BFocusing only on external threats
   • CKeeping discovered vulnerabilities secret from the organization
   • DObtaining proper authorization before testing
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company is evaluating risks to its customer database. The database contains sensitive personal information and is accessible from the internet. The company has decided to implement multi-factor authentication and restrict access to the database. Which risk management strategy is the company applying?

   • ARisk acceptance
   • BRisk mitigation
   • CRisk transfer
   • DRisk avoidance
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A user reports that they can no longer access the company's file server. The IT team discovers that a ransomware attack encrypted all files on the server, and the only backup is from six months ago. Which information security goal has been most directly violated?

   • AIntegrity, because the files were modified by the encryption process.
   • BAvailability, because authorized users cannot access the data they need.
   • CConfidentiality, because the attacker may have viewed the files before encrypting them.
   • DNon-repudiation, because the attacker cannot deny their actions.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company has implemented a firewall, antivirus on all endpoints, and a VPN for remote access. However, a recent phishing attack successfully tricked an employee into revealing their credentials, and the attacker accessed the corporate network. Which additional layer of defense would have been most effective in preventing this specific attack?

   • AA policy that requires employees to change passwords every 30 days.
   • BA more aggressive spam filter that quarantines all emails with links.
   • CMulti-factor authentication (MFA) for all remote access and email accounts.
   • DA network intrusion detection system (IDS) that monitors for unusual login patterns.
   Reveal Solution Discussion Select an answer first