Free Cybersecurity-Apprentice sample questions

Correct answer: Inspection of east-west traffic becomes more critical due to increased inter-service communication and micro-segmentation within the cloud.

In traditional data centers, security focused heavily on north-south traffic (client-to-server) at the perimeter. In modern hybrid cloud and microservices architectures, east-west traffic (server-to-server or service-to-service) increases dramatically. Securing this internal traffic is crucial to prevent lateral movement of threats that breach the perimeter, making east-west traffic inspection a higher priority.

Correct answer: Specific applications and user identities, regardless of port

While stateful firewalls operate primarily at Layers 3 and 4 (IP addresses, ports, and connection states), NGFWs provide Layer 7 application visibility and user identification. This allows for the creation of granular security policies based on the actual application (e.g., 'Allow SharePoint-base' but 'Block SharePoint-upload') and the user's identity, rather than just relying on ambiguous port numbers.

Correct answers: Assume the network is always hostile and external.; Enforce least-privilege access for every user and device.

One of the fundamental principles of Zero Trust is to 'never trust, always verify.' This means assuming that no network, whether internal or external, is secure. Every access request must be treated as if it originates from an open network.

The principle of least privilege is central to Zero Trust. Users, devices, and applications should only be given the minimum levels of access or permissions needed to perform their specific function. This minimizes the potential damage from a compromised account or device.

Correct answer: False

In the IaaS model, the cloud provider is responsible for the security *of* the cloud (physical infrastructure, virtualization layer). The customer is responsible for security *in* the cloud, which includes securing and patching the guest operating systems, applications, and data they deploy on the virtual machines.

Correct answer: False Positive

A false positive occurs when a security system incorrectly identifies benign activity as malicious. Since the analyst confirmed the behavior was legitimate, the alert was a false alarm, which is the definition of a false positive. This is a crucial concept in security operations for tuning detection rules and reducing analyst fatigue.

Correct answer: VPN

A Virtual Private Network (VPN) creates a secure, encrypted tunnel over a public network like the internet. This allows remote users to securely connect to a private corporate network as if they were physically present, protecting the confidentiality and integrity of the data in transit.

Correct answer: Data Loss Prevention (DLP)

Data Loss Prevention (DLP) systems are designed to detect and prevent data breaches and data exfiltration. They use mechanisms like deep packet inspection and content analysis to identify sensitive data patterns (like credit card numbers) within network traffic and enforce policies to block or alert on unauthorized transmission.

Correct answer: Exploitation

The Exploitation stage is where the attacker actively triggers a vulnerability to gain unauthorized access or execute code. Using a known software flaw to gain initial access is the definitive action of this stage. Reconnaissance (Step 1) preceded it, and Installation (Step 3) followed it.

Correct answer: MFA requires credentials from two or more different categories of factors, while SFA requires only one.

The core principle of MFA is the use of multiple, independent categories of credentials. The main categories are: something you know (password, PIN), something you have (token, phone), and something you are (biometrics). SFA relies on only one of these categories (typically a password), whereas true MFA requires proof from at least two.

Correct answer: It identifies and remediates security issues earlier in the development lifecycle, reducing costs and risk.

The core concept of DevSecOps, or 'shifting left,' is to integrate automated security testing and validation early in the CI/CD pipeline. Finding and fixing vulnerabilities during development is significantly cheaper and less risky than discovering them in production. This approach makes security a shared responsibility and builds it into the development process, rather than treating it as a final gate before release.