Free Cybersecurity-Fundamentals sample questions

Correct answer: Data Loss Prevention (DLP)

Data Loss Prevention (DLP) systems are specifically designed to enforce policies based on data classification and content analysis. They can inspect data in motion (like email attachments), at rest (on storage), and in use (on endpoints) to prevent unauthorized exfiltration of sensitive information, such as blocking 'Restricted' files from being sent externally.

Correct answer: Containment

After detection and analysis, the immediate priority in the incident response lifecycle is containment. This involves isolating the affected system (e.g., disconnecting it from the network) to prevent the ransomware from spreading to other systems. Eradication (removing the malware) and Recovery (restoring from backups) follow the containment phase.

Correct answer: It simplifies permission management by assigning permissions to roles rather than individual users.

The primary benefit of RBAC is administrative scalability and simplified management. Instead of assigning permissions directly to hundreds or thousands of individual users, administrators assign permissions to a smaller number of roles. Users are then assigned to these roles, inheriting the associated permissions. This greatly reduces the complexity of managing user access, especially during onboarding, offboarding, and role changes.

Correct answer: Implement a DNS security solution that uses machine learning to identify and block algorithmically generated domains.

DGA malware is designed to evade static blocklists by generating a vast number of potential C2 domains, with only a few being active at any time. The most effective defense is a dynamic one. Modern DNS security solutions use machine learning and statistical analysis to identify the patterns of algorithmically generated domains (e.g., high entropy, unusual character distribution) and block them proactively, without needing to know the specific domains in advance.

Correct answers: The Recovery Time Objective (RTO) is 4 hours.; The Recovery Point Objective (RPO) is 1 hour.

The Recovery Time Objective (RTO) defines the maximum acceptable duration of an outage for a system. In this case, the business can tolerate the CRM being down for a maximum of 4 hours, making this the RTO.

The Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss, measured in time. The business has determined that losing more than 1 hour of transaction data is unacceptable, which directly corresponds to an RPO of 1 hour.

Correct answer: False

This statement is false. The defining characteristic of symmetric encryption (also known as secret-key or shared-key encryption) is that the same key is used for both the encryption and decryption processes. Asymmetric encryption, in contrast, uses a key pair consisting of a public key for encryption and a different, private key for decryption.

Correct answer: Implement a Demilitarized Zone (DMZ) between the IT and OT networks, placing a data historian server and a proxy server in the DMZ. All traffic must be terminated and inspected at the proxy.

This is the best approach based on industry best practices like the Purdue Model for ICS security. A DMZ creates a buffer zone that strictly controls communication between the IT and OT networks. Placing a data historian in the DMZ allows OT systems to send data to a single, controlled point without allowing direct access from the IT network into the OT environment. A proxy adds another layer of security by terminating connections and inspecting traffic, preventing direct protocol communication. This architecture meets all requirements: it prevents unauthorized access, allows specific data flows, and minimizes impact on the real-time OT network.

Correct answer: Brute-Force Attack

The pattern described—many failed login attempts against a single account from various sources, culminating in a success—is a classic indicator of a distributed brute-force attack. Attackers use a botnet or multiple compromised machines to try a large number of passwords against one username, eventually guessing the correct one. Password spraying involves trying one or a few common passwords against many different usernames, which would present a different log pattern.

Correct answers: Security awareness training; Acceptable use policy; Background checks for new employees

Security awareness training is an administrative control that aims to influence user behavior and enforce security policies through education.

An acceptable use policy is a document (a policy) that governs how employees can use company assets, making it a classic administrative control.

Conducting background checks is a procedural control (an administrative control) designed to mitigate risks associated with personnel.

Correct answer: DevSecOps

DevSecOps is a methodology that integrates security practices within the DevOps process. A key principle of DevSecOps is 'shifting left,' which means incorporating security considerations and automated testing (like SAST and DAST scans) as early as possible in the development lifecycle, often directly within the CI/CD pipeline. This contrasts with traditional models where security testing is a separate phase at the end of development.