To ensure that the browser enforces the CSP but does not block or report any content, the _______ directive is used.
- allow-all
- default-src
- enforce
- report-only
To ensure that the browser enforces the Content Security Policy (CSP) but only reports violations without blocking content, the report-only directive is used. This is useful for monitoring policy violations without impacting user experience.
An organization's proactive approach to anticipate and respond to future security incidents is termed as _______ management.
- Incident
- Risk
- Security
- Vulnerability
The correct answer is "Risk Management." It encompasses identifying potential security threats, assessing their impact, and implementing strategies to mitigate them.
In which type of attack does an attacker trick a victim into submitting a malicious request on their behalf?
- Cross-Site Request Forgery (CSRF)
- Cross-Site Scripting (XSS)
- Distributed Denial of Service (DDoS)
- Man-in-the-Middle (MitM)
Cross-Site Request Forgery (CSRF) is an attack in which the attacker tricks a victim into submitting a malicious request, often without the victim's knowledge, on their behalf.
A company hired an ethical hacker to assess its security posture. After the assessment, the hacker provided a detailed report showing several vulnerabilities but did not exploit any. Which type of test did the hacker most likely perform?
- Penetration Test
- Red Team Exercise
- Security Audit
- Vulnerability Assessment
The hacker likely performed a Vulnerability Assessment, which identifies vulnerabilities without exploiting them. A Penetration Test would involve exploiting vulnerabilities.
In an incident reporting procedure, a _______ is typically designated to coordinate the response and recovery efforts.
- CEO
- CISO
- CSIRT
- CTO
In an incident reporting procedure, a CSIRT (Computer Security Incident Response Team) is typically designated to coordinate the response and recovery efforts. A CSIRT is a team of experts responsible for the protection against and management of cybersecurity incidents.
Which of the following is a benefit of encrypting an individual file rather than an entire disk?
- Complete security
- Enhanced performance
- Selective protection
- Simplified management
Encrypting an individual file offers the benefit of selective protection. It allows you to choose specific files or folders to encrypt, offering security where it's needed most without affecting the performance or management of the entire disk. This is especially useful when you only need to protect certain sensitive files rather than an entire disk.
Charlie is developing a web application. He ensures that every form input is validated and sanitized before it's processed. Despite this, an attacker is able to inject a script that steals user session cookies. Which vulnerability in the application did the attacker most likely exploit?
- Cross-Site Request Forgery (CSRF)
- Cross-Site Scripting (XSS)
- Insecure Deserialization
- SQL Injection
The attacker likely exploited a Cross-Site Scripting (XSS) vulnerability, allowing them to inject malicious scripts into the web application despite input validation and sanitization.
The practice of deliberately leaving vulnerabilities open in a system as a trap to detect and monitor intruders is termed as what?
- Ethical Hacking
- Honeypot
- Penetration Testing
- Zero-Day Exploitation
A "Honeypot" is a cybersecurity mechanism that intentionally exposes vulnerabilities to lure and monitor potential intruders and threats.
Jane, an IT manager, receives an email detailing a potential security incident. However, the email does not contain enough specifics to act upon. To improve the quality and consistency of incident reports, Jane might consider implementing what?
- Incident Response Plan
- Regular Software Updates
- Security Awareness Training
- Security Incident Reporting Guidelines
Jane should consider implementing Security Incident Reporting Guidelines. These guidelines provide a structured format for reporting security incidents, including the specific details and information required. They help ensure that incident reports contain enough information for the IT team to act upon effectively.
In many operating systems, the _______ acts as a central policy that defines security-related computer settings.
- Antivirus
- Firewall
- Operating System
- Router
In many operating systems, the Operating System acts as a central policy that defines security-related computer settings. This includes user access controls, permissions, and various security configurations.