Which of the following attacks involves the injection of malicious scripts into web pages viewed by other users?
- Cross-Site Scripting (XSS)
- Distributed Denial of Service (DDoS)
- Phishing
- SQL Injection
Cross-Site Scripting (XSS) is an attack where an attacker injects malicious scripts into web pages, which are then viewed by other users, potentially leading to data theft or manipulation.
The process of hiding a wireless network by not broadcasting its SSID is known as _______.
- MAC Filtering
- Network Masking
- SSID Concealing
- SSID Encryption
SSID Concealing, also known as SSID hiding, is a security measure where the network name (SSID) is not broadcast, making it less visible to potential attackers.
Regular _______ sessions are essential to ensure that employees are up-to-date with the latest security policies and practices.
- Evaluation
- Maintenance
- Reporting
- Training
Regular training sessions are essential to ensure that employees are up-to-date with the latest security policies and practices. Security training helps employees recognize and respond to security threats effectively.
Insider threats can be particularly challenging to detect because they often exploit legitimate _______ rather than external vulnerabilities.
- Permissions
- Software Bugs
- System Flaws
- Weak Passwords
Insider threats often exploit legitimate "Permissions" granted to them as part of their job. This can make it challenging to distinguish malicious behavior from regular activities, increasing the risk of data breaches.
In penetration testing, what is the significance of a "red team" versus a "blue team"?
- Red team consists of internal employees, blue team is external
- Red team defends, blue team simulates attackers
- Red team simulates attackers, blue team defends
- Red team tests for software vulnerabilities
In penetration testing, the "red team" simulates attackers, often from an external perspective, while the "blue team" defends, typically from an internal perspective, helping to identify security weaknesses and prepare for real-world threats.
_______ is a type of malware that encrypts the user's files and demands payment in exchange for the decryption key.
- Adware
- Ransomware
- Trojan
- Worm
Ransomware is a type of malware that encrypts the user's files and demands payment in exchange for the decryption key. It is a significant threat to data security and has been responsible for many high-profile cyberattacks.
In public-key cryptography, the decryption key is kept private and is known as the _______ key.
- Cipher
- Private
- Public
- Secret
In public-key cryptography, the decryption key is kept private, known as the "Private Key." This key is kept secret by the owner and is used to decrypt data that has been encrypted with the corresponding public key.
Digital certificates are issued by trusted third parties called what?
- Certificate Authorities
- Domain Registrars
- Internet Service Providers
- Social Media Companies
Digital certificates are issued by trusted third parties known as Certificate Authorities (CAs). These entities validate the identity of individuals, organizations, or websites and issue digital certificates, which are used to establish trust and enable secure communication on the internet.
What encryption technique involves two interdependent cryptographic keys, one public and one private?
- AES
- DES
- RSA
- SSL
RSA (Rivest-Shamir-Adleman) is an encryption technique that uses two interdependent cryptographic keys, a public key for encryption and a private key for decryption. This method ensures secure communication and data protection.
An organization's IT department wants to enforce a policy where all software installations and updates can only be performed by administrators. This is an example of which type of security policy mechanism?
- Administrative Access Control
- Discretionary Access Control (DAC)
- Mandatory Access Control (MAC)
- Role-Based Access Control (RBAC)
This policy is an example of Role-Based Access Control (RBAC). RBAC is a security mechanism that restricts system access to authorized users or processes based on their roles and responsibilities within the organization. It is commonly used to delegate software installations and updates to administrators.