Security Concepts GFACT Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which legal concept is most directly violated when a security researcher tests a system without the owner's permission?

   • AData protection regulations
   • BExport control regulations
   • CCopyright law
   • DComputer fraud and abuse laws
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security engineer is designing a system to ensure that software updates are authentic and have not been tampered with. The system will distribute updates to many clients. Which approach provides the best combination of authenticity and integrity?

   • AEncrypt each update with a symmetric key shared with all clients.
   • BDigitally sign each update with the vendor's private key and have clients verify with the vendor's public key.
   • CPublish a hash of each update on a public website.
   • DUse a message authentication code (MAC) with a shared secret.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A penetration tester is hired by a company to test its external web application. The contract includes a detailed scope and rules of engagement. During the test, the tester discovers a critical vulnerability that could allow access to customer data. What is the most appropriate action for the tester?

   • ADocument the vulnerability and report it to the client immediately, avoiding any further exploitation beyond the agreed scope.
   • BSell the vulnerability information to a third party for profit.
   • CExploit the vulnerability to demonstrate the full impact, even if it goes beyond the agreed scope.
   • DKeep the vulnerability secret until the tester can publish a public advisory.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard · select all that apply

   A security analyst is reviewing a recent breach. The attacker used a phishing email to obtain credentials, then used those credentials to access a file server, and finally encrypted files for ransom. Which of the following are stages of the attack lifecycle that the analyst can identify in this scenario? Select all that apply.

   • ACommand and control
   • BReconnaissance
   • CPost-exploitation
   • DExploitation
   • EDelivery
   Check answers Discussion Select an answer first
6. 5application · medium

   During a penetration test, an analyst notices that the target organization's employee names and email addresses are publicly listed on the company website. The analyst uses this information to craft personalized phishing emails. Which attack stage does this activity represent?

   • AReconnaissance
   • BExploitation
   • CDelivery
   • DWeaponization
   Reveal Solution Discussion Select an answer first