SBOLC Security Fundamentals Practice Test

These questions are part of the practice quiz. Start practicing

• What is a limitation of quantitative risk assessment?
• What is the primary role of shimming in system processes?
• Which of the following is a component of data backup solutions?
• What does AUP stand for?
• What are the ports for FTPS?
• What does behavior-based detection rely on to identify security breaches?
• Which firewall type requires significant amounts of memory to track TCP connections?
• Job rotation is primarily used for which of the following purposes?
• What function do Backdoors serve in malware?
• What is the focus of system hardening?
• Which of the following is classified as a Detective Control?
• What is the function of a Key Escrow service?
• Which technique is associated with Obfuscation?
• Which traffic zone refers to network traffic that occurs within a data center's security area?
• Which technique is used for permanently destroying media so that it cannot be reconstructed?
• What type of controls includes security cameras and motion-sensitive alarms?
• Which classification of information deals specifically with proprietary matters?
• Which of the following is a characteristic of VPNs using TLS?
• What is a memory leak in software development?
• What is a characteristic of Compensating Controls?
• What type of cryptography does a Hybrid Cryptosystem utilize?
• Which environment serves as a final testing ground before production?
• What is bluebugging?
• Which of the following is an example of vertical privilege escalation?
• What is a primary function of a Network-based Intrusion Prevention System (NIPS)?
• Which of the following best characterizes the purpose of a computer virus?
• Which phase comes after "Processing" in the Information Lifecycle Model?
• Which statement accurately describes the "Full Tunnel" VPN method?
• Which type of information is categorized under Personally Identifiable Information (PII)?
• What does the term “Data at Rest” refer to?
• Which function is identified in Business Continuity Planning as crucial for operations?
• Which account type has permissions to make system changes?
• How does port security function in a network?
• What is the primary function of Internet Protocol Security (IPsec)?
• What does a Certificate Signing Request (CSR) entail?
• What is the primary purpose of Data Loss Prevention (DLP) systems?
• What characterizes the structure of a DNS database?
• What is a significant weakness of Pre-Shared Key (PSK) authentication?
• Why are honeynets considered effective in security strategies?
• What does Annualized Loss Expectancy (ALE) measure?
• Which VPN method allows only specific traffic destined for the corporate network to pass through the tunnel?
• What is the role of a protocol analyzer in network security?
• Which of the following describes Discretionary Access Control (DAC)?
• What type of hacker operates in a legal gray area?
• How can race conditions be exploited in an attack?
• What type of information can be found in an X.509 Digital Certificate?
• In network architecture, what does the North-South Traffic Zone indicate?
• Which principle of social engineering involves exploiting someone's perception of authority?
• What distinguishes spear phishing from regular phishing?
• What distinguishes MS-CHAP from standard CHAP?
• What is the maximum tolerable downtime (MTD) in business continuity planning?
• Which of the following is NOT a type of common site implementation?
• What security measure helps mitigate risks associated with humidity?
• What is a single purpose certificate commonly used for?
• What type of risk involves old systems posing potential security issues?
• What advantage does using honeyfiles provide in a network security context?
• What does a Virtual Private Network (VPN) primarily do?
• What is the primary aim of Organized Crime in the context of cybersecurity?
• What differentiates Worms from other types of malware?
• What are database stored procedures?
• What type of firewall is also known as a Personal Firewall?
• What motivates Hacktivists in their attacks?
• Which NAC type involves redirecting users to comply with authentication requirements?
• What is the main purpose of the Online Certificate Status Protocol (OCSP)?
• Which of the following is NOT a step in establishing a trusted operating system?
• Who is the primary target in a phishing attack?
• What purpose does Spyware serve in a system?
• Which RAID level offers redundancy with block-level striping and distributed parity?
• Which type of malware encrypts key files and folders and demands payment to unlock them?
• What does the Extensible Authentication Protocol (EAP) extend?
• What is the purpose of DHCP Snooping?
• Which method of data sanitization involves the use of an electromagnetic field?
• What is an Extended Validation Certificate primarily known for?
• What is meant by 'Attribute-Based Access Control' (ABAC)?
• What type of target does whaling primarily focus on?
• What is the primary purpose of an ESSID?
• A Trojan Horse is primarily known for which of the following characteristics?
• What is Shadow IT?
• What does MAC stand for in the context of message authentication?
• Which of the following is NOT a goal of implementing honeypots?
• What is a key characteristic of Symmetric algorithms?
• What are "single points of failure" in the context of BCP?
• Which components are included in the Security Monitoring Architecture?
• Who are Script Kiddies in the context of cybersecurity?
• Which statement is true about certificate mapping?
• What is an Access Control Entry (ACE)?
• What vulnerability is common in PSK that leads to security risks?
• What does TPM stand for in the context of security?
• What is the primary focus of a Risk Management process?
• Which VPN tunneling method requires that the client uses a VPN tunnel whenever connecting to an untrusted network?
• What does the "High" classification denote in Generic Information Classifications?
• What method does pharming use to mislead users?
• What is a key feature of an in-band management interface?
• What does VDI stand for?
• Which type of agreement is less formal and focuses on mutual goals between two or more organizations?
• What is the key characteristic of Out-of-Band Exchange?
• What is the primary function of a Host-Based Firewall?
• What best describes how a NIDS operates?
• What is the output of a hashing algorithm?
• What does a horizontal privilege escalation attack involve?
• What role does a Root CA play in a PKI system?
• Which step is part of enforcing least privilege management?
• Who is responsible for collecting and verifying identities on behalf of the Certificate Authority?
• What does DHCP stand for?
• What is a Digital Signature?
• Which access control model uses preconfigured rules to grant access?
• Which of the following is true regarding the role of a Switch in networking?
• What layer of the OSI model does a Switch operate in?
• Which of the following risks involves compliance or licensing issues related to software?
• What effect can multiple Layer 2 paths have on a network?
• What is the characteristic of a cold site?
• What is the primary function of the Kerberos V5 protocol?
• What is the function of a Subject Alternative Name (SAN) extension in multi-domain certificates?
• What does the term 'Insider Threats' refer to?
• What best describes Zero Trusted Architecture?
• What is the primary focus of Business Continuity Planning (BCP)?
• Which term refers to the potential to cause harm to an asset?
• How can memory leaks affect software performance?
• What is described as a flaw or hole in the security posture?
• Which type of hacker is known as a White Hat?
• What is the primary function of Anomaly-Based Detection?
• Which of the following best describes spam in the context of Internet communication?
• Which term describes removing the activity that creates risk?
• Which access control model is considered the most restrictive?
• What does SSID stand for in networking?
• What is a root certificate?
• What does the acronym MOA stand for in the context of agreements?
• What is the purpose of an Initialization Vector (IV)?
• What type of attack involves pretending to be someone else to gain unauthorized access?
• System hardening should include all of the following EXCEPT:
• What does "In-Band Exchange" refer to?
• What is one characteristic of Malicious Scripts?
• What does RPO stand for in the context of recovery objectives?
• What is a key function of NAT in a networking environment?
• Which of the following is NOT a component of a digital signature?
• What does Deep Packet Inspection (DPI) involve?
• What equals the asset value multiplied by the exposure factor percentage?
• What is a common characteristic of script kiddies in the cybersecurity landscape?
• What best describes state actors in cybersecurity?
• Which advantage does quantitative risk assessment provide?
• What describes the "Secret" classification in military information?
• Which type of system is likely to employ file integrity checking?
• In the given scenario, what is the Single Loss Expectancy (SLE) if a building worth $1,000,000 is damaged by fire?
• What is a key feature of entry point security controls?
• Which type of attacker is focused on gaining competitive advantage?
• Shoulder surfing is primarily concerned with observing what type of information?
• What is a Disaster Recovery Plan (DRP)?
• What is a critical function of an Intermediate CA?
• What is a key feature of the Corporate Owned, Personally Enabled (COPE) model?
• Which type of authentication requires both ends to authenticate each other?
• Which of the following steps is NOT part of mitigating operational risk?
• What does COBO stand for in a corporate context?
• What does CYOD allow employees to do?
• Which of the following describes the staging environment?
• Which of these is a motivation for threat actors?
• What is the primary purpose of Database Tokenization?
• What does NIST stand for?
• In which environment are product concepts turned into written code?
• In the OSI model, what layer does a Router operate in?
• What occurs during an integer overflow?
• What does MTBF measure?
• What resource allocation distinguishes advanced persistent threats?
• What is domain hijacking associated with?
• What is a key characteristic of an Appliance Firewall?
• Which authentication method uses a combination of something you know and something you have?
• What does BSSID refer to in a wireless network?
• Which of the following best describes the process of key recovery?
• Which of the following is NOT a type of Protected Information?
• Honeypots primarily serve what type of purpose in cybersecurity?
• Which category does Managerial Controls fall under?
• Which method involves a planned action for accepting risks?
• Which protocol is designed to be used with Wired Equivalent Privacy (WEP)?
• Which term describes a digital signature's ability to confirm a sender's authenticity?
• What does the production environment refer to?
• What is an example of a Corrective Control?
• What does FQDN stand for in the context of DNS?
• What defines a Self-Encrypting Drive (SED)?
• What outcome can a well-configured honeynet provide for an organization?
• Which type of certificate is created and mapped to a specific user account?
• What is a key characteristic of a Logic Bomb?
• Which best describes a hardware-based WAF?
• What does a successful Business Impact Analysis consider?
• Which policy ensures that sensitive items are not accessible when not in use?
• What is an active countermeasure against race conditions?
• What is one common characteristic of RFID systems?
• What is the function of APIPA?
• Which Bluetooth attack involves sending unsolicited messages?
• What type of controls are designed to discourage attacks?
• What type of data is referred to as “Data in Use”?
• How does a honeynet enhance traditional security measures?
• What is the main function of a honeypot?
• Which system is referred to as a Host-based Intrusion Detection System (HIDS)?
• Which type of malware is designed to hide itself from security software and utilities?
• What is the main goal of file integrity checks?
• Which type of lock is typically considered a biometric lock?
• Which entity is responsible for creating, signing, and revoking asymmetric keys?
• What is the main purpose of NFC technology?
• What do Network-based Intrusion Detection Systems (NIDS) monitor?
• What does system hardening involve regarding default settings?
• What is the primary purpose of a De-militarized Zone (DMZ) in a network?
• What is the purpose of mandatory vacations in a workplace?
• What is a typical characteristic of a host-based Web Application Firewall (WAF)?
• What key feature differentiates X.509 certificates?
• What is the main purpose of identifying control gaps in risk management?
• What type of information is considered Protected Health Information (PHI)?
• What is Steganography primarily used for?
• What is the first phase outlined in the Information Lifecycle Model?
• Which component of a digital certificate indicates the period during which it is valid?
• What distinguishes dynamic tokens from static tokens?
• What is the role of the private key in asymmetric cryptography?
• In a network context, which statement about IP addressing is true for DHCP?
• What is the main function of HMAC?
• Which method of authentication is the most vulnerable to being compromised?
• Which authentication protocol is known for its three-way handshake process?
• What does the Certificate Revocation List (CRL) contain?
• What type of cryptography uses a single key for both encryption and decryption?
• What is one of the key elements of an onboarding procedure?
• Which RAID level uses data striping with a dedicated parity drive?
• What does the term 'Data in Transit' refer to?
• What characteristic is essential for a honeypot?
• What is the primary function of RADIUS?
• What is the purpose of RAID technology?
• What does Layer 2 Tunneling Protocol (L2TP) combine?
• Which port is associated with the Kerberos V5 authentication protocol?
• Which VPN topology example connects two branches of a corporate network?
• What does SAE stand for in the context of wireless security?
• What does a Host-based Intrusion Prevention System (HIPS) primarily do?
• What protocol is referred to by the acronym DHE?
• Which classification best describes customer data in Business Information Classifications?
• What risk management strategy involves offloading risk to an external party?
• What is the primary purpose of patch management?
• Which type of malware can propagate on its own without a host application?
• What refers to the risk remaining after risk mitigation measures have been implemented?
• What is a method of updating known bugs or flaws in security applications?
• What is an Extranet primarily used for?
• What defines a machine certificate?
• In a privilege escalation attack, what does an attacker achieve?
• Which ports are associated with the Simple Network Management Protocol (SNMP)?
• What distinguishes a Next Generation Firewall (NGFW) from traditional firewalls?
• What is a Hardware Security Module (HSM)?
• What does DDoS stand for?
• What is the primary function of Mobile Device Management (MDM)?
• What is the purpose of the Information Lifecycle Model?
• What is the function of temperature sensors within environmental security controls?
• What does Separation of Duties aim to achieve in an organization?
• What does ISAKMP stand for?
• In the AAA security model, what does 'Authentication' refer to?
• What issue does a broadcast storm typically cause in a network?
• Which of the following is NOT a type of account listed in the content?
• What is a key feature of Automatic Private Internet Protocol Addressing (APIPA)?
• What role does a Preventative Control serve in security?
• What does GAN stand for in cybersecurity?
• What does Database Normalization aim to achieve?
• Which of the following is a method or technique used to manipulate a flaw?
• What type of malicious code requires the host's interpreter to process its instructions?
• What purpose does the serial number in a digital certificate serve?
• What does NAC stand for in a network security context?
• What is a common function of a Remote Access Trojan (RAT)?
• Which of the following is a major advantage of asymmetric cryptography?
• What is the role of a Reverse Proxy?
• Which term describes a network designed to lure attackers?
• What is a key feature of a honeynet?
• What does APT stand for in the context of cybersecurity?
• What type of technology does RFID utilize?
• What does the acronym ECGHE stand for in the context of security protocols?
• What is the main advantage of a Virtual Desktop Infrastructure (VDI)?
• What does TACACS+ stand for?
• How can honeyfiles benefit system security?
• What benefit does implementing a VLAN offer to a network?
• Which of the following is a physical perimeter security control?
• What ports are used by Secure Shell (SSH)?
• What is a key characteristic of signature-based detection systems?
• What is indicated by the term SPIT?
• Which firewall analyzes traffic at layers 3 and 4 of the OSI model?
• What does “Integrity” in the CIA Triad focus on?
• What does a Functional Recovery Plan (FRP) provide for a business?
• What is Network Address Translation (NAT) primarily used for?
• What is the main purpose of Secure Sockets Layer (SSL)?
• Which of the following is a classification of military information?
• In the context of encryption ciphers, what is a Steam Cipher?
• What type of authentication mechanism allows multiple different types of methods for access?
• What approach uses numerical values to assess risk?
• What does a honeynet consist of?
• What does PFS stand for in the context of cryptography?
• What are roving security controls primarily composed of?
• System hardening is mainly focused on?
• Which of the following best describes a hashing function?
• Which of the following is NOT considered a technique for media destruction?
• Which component of a digital signature creates the hash?
• Which of the following is a disadvantage of qualitative risk assessment?
• What does the term 'multi-homed' refer to in hardware-based WAF?
• Which of the following is a key component of the NIST Risk Management Framework?
• What is an example of a Host-to-Site VPN topology?
• Which of the following is an example of Type 2 authentication?
• What does RSA stand for in cryptographic protocols?
• What is the nature of an Intranet?
• Which sensor type detects environmental changes such as temperature?
• What type of messages does the control part of L2TP handle?
• What does PRNG stand for in cryptography?
• What does SNMP stand for?
• In the COPE model, how does the company manage devices?
• What does the Object Identifiers (OID) in an X.509 Digital Certificate signify?
• What does Business Impact Analysis (BIA) help determine?
• What characterizes a test environment?
• What is a sandbox environment primarily designed to do?
• What protocol is used for secure remote access and terminal communications?
• What does EOL refer to in a business context?
• What does a False Positive indicate?
• Which of the following is NOT considered a Cryptographic Principle?
• Which evaluation correctly identifies a situation where an attacker was recognized by an IDS?
• Which policy is designed to mitigate risks associated with disclosing sensitive company information?
• What is the primary role of a Proxy Server?
• Which network technique separates broadcast domains?
• What is the role of the Extended Service Set ID (ESSID)?
• Which of the following is a countermeasure against malware?
• What type of risk is characterized by factors originating outside an organization?
• What is a primary characteristic of switching loops in a network?
• What does RAT stand for in the context of cybersecurity?
• Which of the following is included in the hiring and termination policy elements?
• Which of the following is a characteristic of shared or generic accounts?
• What is the function of File Transfer Protocol Secure (FTPS)?
• In cyber security, who typically uses honeypots?
• What is the primary method used in vishing?
• What does the Spanning Tree Protocol primarily prevent?
• What does DNS stand for in networking?
• Type squatting involves the registration of what type of domain?
• What is the significance of OCSP Stapling?
• What is the primary focus of the NIST Risk Management Framework (RMF)?
• What occurs when a Rootkit successfully embeds itself in an operating system?
• What does MTTR indicate?
• Which of the following options represents a warm site?
• What is a key feature of Agent-Based NAC?
• What is the primary purpose of a honeyfile?
• Which type of messages encapsulates PPP frames in L2TP?
• What does tailgating or piggybacking refer to in security terms?
• Which of the following is NOT a responsibility of a Certificate Authority?
• What is the primary function of a user certificate?
• What is a primary goal of a virus in computer systems?
• What is the primary role of a Certificate Authority (CA)?
• What is the primary purpose of air gapping in network security?
• What does a Trusted Platform Module (TPM) primarily store?
• Which of the following is a countermeasure for vertical privilege escalation?
• What is NOT one of the four security goals of Cryptography?
• In Tunnel Mode of IPsec, what is encapsulated?
• What type of account is characterized by temporary usage?
• Which principle of social engineering uses a sense of urgency to manipulate behavior?
• In what context is a recovery agent used?
• What does BPA stand for in a business context?
• Which of the following is a type of Drive Encryption Solution?
• What is a key characteristic of Shadow IT?
• What does SPIM refer to in cybersecurity terminology?
• Which of the following best describes the impact of a broadcast storm on a switch's processing?
• Which of the following is a feature of antivirus software?
• What happens to a digital certificate once it is added to a CRL?
• Which protocol uses ports TCP 20 and TCP 21?
• What is a defining feature of Ransomware?
• What advantage does an out-of-band management interface provide?
• How does simultaneous Authentication of Equals (SAE) enhance wireless security?
• What is the primary purpose of Public Key Infrastructure (PKI)?
• Which mode of IPsec is designed for end-to-end encryption of data?
• What does BYOD stand for in a corporate environment?
• How can NIPS adjust its security posture?
• What is the primary focus of RTO?
• What is the primary function of the IEEE 802.1D Spanning Tree Protocol (STP)?
• Which statement is true about the digital certificate's CA's Distinguished Name (DN)?
• What is refactoring primarily concerned with in code development?
• What is the principle of least privilege management?
• What does FQDN stand for?
• Which type of certificate is specifically used for S/MIME or PGP email cryptosystems?
• What type of data does a honeyfile typically contain?
• Which of the following is true about Asymmetric Cryptography?
• What does the Clean Desk Policy require employees to do?
• What type of network segmentation does Logical Separation often involve?
• Which of the following is a method used in physical security controls to prevent unauthorized access?
• What does VLAN Trunking Protocol (VTP) allow switches to do?
• What type of portal places a prospective system in a restricted area until compliance is met?
• What does malware aim to achieve in a system?
• In which scenario is symmetric cryptography typically preferred?
• What does HSM stand for regarding security technologies?
• What is a VLAN?
• What is spam commonly defined as?
• Which type of encryption commonly uses a single key to encrypt and decrypt messages securely?
• What is the primary function of a Block Cipher?
• What often motivates unethical actors to engage in domain hijacking?
• Vishing is often used in conjunction with which technique to enhance its effectiveness?
• What type of protocol is Secure File Transfer Protocol (SFTP)?
• What type of threat does a Web Application Firewall (WAF) specifically protect against?
• What is the primary function of a Keystroke Logger?
• Which of the following is NOT a common attribute of threat actors?
• What is the purpose of using conduits to protect sensitive cables?
• Which of the following best describes Geofencing?
• What does the term "wiping" refer to in data sanitization?
• What does the term "prepending" refer to in cybersecurity?
• What does Key Pinning involve?
• What does the term 'Key Stretching' refer to in cryptography?
• What is a buffer overflow?
• What is the purpose of a Honeypot in security?
• In the context of physical separation, what separates collision domains?
• What is Port Address Translation (PAT) used for?