In the context of regulations, what does GDPR stand for?
- General Data Privacy Requirement
- General Data Protection Requirement
- Global Data Privacy Regulation
- Global Data Protection Regulation
GDPR stands for the General Data Protection Regulation, which is a European Union regulation designed to protect the privacy and data of EU citizens. It has global implications for organizations dealing with EU citizens' data.
What common practice involves creating a duplicate copy of data to ensure its availability in case of data loss?
- Data Archiving
- Data Compression
- Data Encryption
- Data Mirroring
Data Mirroring is the practice of creating a duplicate copy of data on another storage device. This is done in real-time or near-real-time to ensure data availability in case of data loss or hardware failure. It provides redundancy and high availability.
Why might an organization choose to implement a split-tunneling VPN configuration?
- To achieve better compatibility with legacy systems
- To ensure end-to-end encryption
- To improve security
- To reduce network bandwidth usage
An organization may choose split-tunneling to conserve bandwidth by not routing all traffic through the VPN. It's a trade-off between security and efficiency.
In the context of web application security, what is the primary difference between "encoding" and "escaping"?
- Encoding ensures data integrity, while escaping prevents SQL injection.
- Encoding is a method for securing APIs, while escaping is used to secure session cookies.
- Encoding protects against HTML injection, while escaping is used to secure JavaScript.
- Encoding transforms data into a different format, while escaping makes data safe for use in specific contexts.
Encoding involves changing data into a different format so that it's safe for a particular context, such as converting special characters to HTML entities. Escaping, on the other hand, ensures data is safe for use in specific situations, like preventing SQL injection or cross-site scripting (XSS). The main difference is in their purpose and target use cases.
In an out-of-band SQL injection attack, data is retrieved using:
- A separate channel
- API endpoints
- HTTP GET requests
- The same channel with UNION statements
In an out-of-band SQL injection, attackers retrieve data via a separate channel, such as a DNS request, rather than through the same channel as the main application.
Which of the following best describes the primary purpose of a certificate authority (CA) in the SSL/TLS handshake process?
- Authenticating users
- Handling encryption keys
- Issuing digital certificates
- Providing web hosting
A Certificate Authority (CA) in the SSL/TLS handshake process primarily issues digital certificates. These certificates are used to verify the authenticity of a website, ensuring that the connection is secure and that data is encrypted.
Under GDPR, individuals have the right to access their personal data and the right to _______ it.
- Alter the Data
- Correct the Data
- Delete the Data
- Share the Data
Under the General Data Protection Regulation (GDPR), individuals have the right to access their personal data held by organizations. This means they can request to correct or update the data if it's inaccurate. This helps individuals maintain the accuracy of their personal information.
Insider threats can be particularly challenging to detect because they often exploit legitimate _______ rather than external vulnerabilities.
- Permissions
- Software Bugs
- System Flaws
- Weak Passwords
Insider threats often exploit legitimate "Permissions" granted to them as part of their job. This can make it challenging to distinguish malicious behavior from regular activities, increasing the risk of data breaches.
In penetration testing, what is the significance of a "red team" versus a "blue team"?
- Red team consists of internal employees, blue team is external
- Red team defends, blue team simulates attackers
- Red team simulates attackers, blue team defends
- Red team tests for software vulnerabilities
In penetration testing, the "red team" simulates attackers, often from an external perspective, while the "blue team" defends, typically from an internal perspective, helping to identify security weaknesses and prepare for real-world threats.
_______ is a type of malware that encrypts the user's files and demands payment in exchange for the decryption key.
- Adware
- Ransomware
- Trojan
- Worm
Ransomware is a type of malware that encrypts the user's files and demands payment in exchange for the decryption key. It is a significant threat to data security and has been responsible for many high-profile cyberattacks.