CCP Cybersecurity Fundamentals & Concepts 2 — Questions and Answers
Question 1: Which cryptographic concept ensures that a sender cannot deny having sent a message?
- Confidentiality
- Non-repudiation (Correct answer)
- Integrity
- Availability
Correct answer: Non-repudiation
Non-repudiation ensures that a party cannot deny the authenticity of their signature or the sending of a message.
Question 2: A company stores sensitive data encrypted at rest. Which security property is being protected?
- Availability
- Non-repudiation
- Confidentiality (Correct answer)
- Authentication
Correct answer: Confidentiality
Encrypting data at rest protects confidentiality by preventing unauthorized access to stored information.
Question 3: What is the primary purpose of a Public Key Infrastructure (PKI)?
- To encrypt network traffic using symmetric keys
- To manage digital certificates and public-key encryption (Correct answer)
- To authenticate users via passwords
- To firewall network perimeters
Correct answer: To manage digital certificates and public-key encryption
PKI manages the creation, distribution, and revocation of digital certificates that bind public keys to identities.
Question 4: Which attack type exploits trust relationships between a user's browser and a website to perform unauthorized actions?
- SQL Injection
- Cross-Site Request Forgery (CSRF) (Correct answer)
- Man-in-the-Middle
- Buffer Overflow
Correct answer: Cross-Site Request Forgery (CSRF)
CSRF exploits the trust a web application has in an authenticated user's browser to perform unintended actions.
Question 5: In the context of access control, what does 'least privilege' mean?
- Users have no access by default
- Users receive only the minimum permissions needed to perform their job (Correct answer)
- Administrators have unrestricted access
- Access is granted based on seniority
Correct answer: Users receive only the minimum permissions needed to perform their job
Least privilege limits user access rights to only what is necessary to perform authorized tasks, reducing attack surface.
Question 6: What is the difference between a vulnerability and an exploit?
- A vulnerability is an attack; an exploit is a weakness
- A vulnerability is a weakness; an exploit is code or technique that takes advantage of it (Correct answer)
- They are the same thing
- A vulnerability is hardware-based; an exploit is software-based
Correct answer: A vulnerability is a weakness; an exploit is code or technique that takes advantage of it
A vulnerability is a weakness in a system, while an exploit is a method or code that leverages that vulnerability to cause harm.
Question 7: Which security model enforces access based on classification labels and user clearance levels?
- Discretionary Access Control (DAC)
- Role-Based Access Control (RBAC)
- Mandatory Access Control (MAC) (Correct answer)
- Attribute-Based Access Control (ABAC)
Correct answer: Mandatory Access Control (MAC)
MAC uses system-enforced labels (e.g., Top Secret, Secret) and user clearances to control access, common in government systems.
CCP Cybersecurity Fundamentals & Concepts 2
Which cryptographic concept ensures that a sender cannot deny having sent a message?