What would be the primary objective of a whaling attack?
- Extract personal information from random individuals
- Gain access to sensitive company data
- Impersonate a specific individual
- Target a large number of individuals
The primary objective of a whaling attack is to impersonate a specific individual, usually a high-ranking executive or influential person within an organization. Attackers aim to deceive others into believing they are this individual to gain access to sensitive information or resources.
When an attacker introduces malicious code into a software system, causing it to behave in unintended ways, this is known as what?
- Code Injection
- Exploiting a Vulnerability
- Malware Injection
- Software Compromise
Code Injection occurs when an attacker inserts malicious code into a software system, leading to unintended and potentially harmful behavior.
When setting up a home wireless network, which feature allows devices to connect to the network without entering a password, but has potential security risks?
- MAC Address Filtering
- WEP (Wired Equivalent Privacy)
- WPA3
- WPS (Wi-Fi Protected Setup)
WPS allows easy device connection but poses security risks. Attackers can exploit it. Other methods like WPA3 are more secure for home networks.
Which header is used to define a Content Security Policy for a web application?
- Content-Security-Policy
- X-Content-Security-Policy
- X-Frame-Options
- X-XSS-Protection
The header used to define a Content Security Policy for a web application is "Content-Security-Policy." It specifies the policy rules for content sources, script execution, and other security directives for the web page.
When using web security assessment tools, what is the primary benefit of dynamic analysis over static analysis?
- Identifies vulnerabilities in the source code before deployment
- Identifies vulnerabilities that can be exploited in real-time
- Provides insights into network infrastructure weaknesses
- Scans for vulnerabilities without executing the application
Dynamic analysis is beneficial as it identifies vulnerabilities that can be exploited in real-time while the application is running. It helps to discover issues that might not be evident during static analysis, as it simulates real-world usage scenarios and interactions with the application.
Under HIPAA, 'covered entities' include health care providers, health plans, and _______.
- Business Associates
- Government Agencies
- Insurance Companies
- Pharmaceutical Manufacturers
Under HIPAA (Health Insurance Portability and Accountability Act), 'covered entities' include health care providers, health plans, and Business Associates. Business Associates are individuals or entities that perform functions or activities that involve the use or disclosure of protected health information on behalf of covered entities.
To ensure that the browser enforces the CSP but does not block or report any content, the _______ directive is used.
- allow-all
- default-src
- enforce
- report-only
To ensure that the browser enforces the Content Security Policy (CSP) but only reports violations without blocking content, the report-only directive is used. This is useful for monitoring policy violations without impacting user experience.
An organization's proactive approach to anticipate and respond to future security incidents is termed as _______ management.
- Incident
- Risk
- Security
- Vulnerability
The correct answer is "Risk Management." It encompasses identifying potential security threats, assessing their impact, and implementing strategies to mitigate them.
In which type of attack does an attacker trick a victim into submitting a malicious request on their behalf?
- Cross-Site Request Forgery (CSRF)
- Cross-Site Scripting (XSS)
- Distributed Denial of Service (DDoS)
- Man-in-the-Middle (MitM)
Cross-Site Request Forgery (CSRF) is an attack in which the attacker tricks a victim into submitting a malicious request, often without the victim's knowledge, on their behalf.
The process of converting data into a code to prevent unauthorized access is known as _______.
- Authentication
- Encryption
- Firewall
- Hacking
Encryption is the process of converting data into a code to prevent unauthorized access. It ensures that even if unauthorized users gain access to the data, they cannot read or use it without the decryption key. Encryption is crucial for data security and privacy.