CCP Cybersecurity Fundamentals & Concepts 3 — Questions and Answers
Question 1: What is the primary function of a Security Information and Event Management (SIEM) system?
- To block malware at the endpoint
- To aggregate and correlate security logs for real-time analysis (Correct answer)
- To encrypt data in transit
- To manage firewall rules
Correct answer: To aggregate and correlate security logs for real-time analysis
A SIEM collects and analyzes log data from across an organization's infrastructure to detect threats and generate alerts.
Question 2: Which type of malware disguises itself as legitimate software to trick users into installing it?
- Worm
- Trojan Horse (Correct answer)
- Ransomware
- Rootkit
Correct answer: Trojan Horse
A Trojan Horse masquerades as legitimate software while secretly performing malicious actions.
Question 3: What is 'defense in depth' as a cybersecurity strategy?
- Using a single strong firewall to protect the network
- Layering multiple security controls so that failure of one does not compromise the system (Correct answer)
- Deeply inspecting all network packets
- Encrypting data at all storage depths
Correct answer: Layering multiple security controls so that failure of one does not compromise the system
Defense in depth uses multiple overlapping security controls so an attacker must defeat several layers to succeed.
Question 4: Which protocol is used to securely transfer files and provides encrypted channel over SSH?
- FTP
- TFTP
- SFTP (Correct answer)
- HTTP
Correct answer: SFTP
SFTP (SSH File Transfer Protocol) uses SSH to provide encrypted, secure file transfer capabilities.
Question 5: An attacker intercepts communications between two parties without their knowledge. This is an example of what attack?
- Denial of Service
- Phishing
- Man-in-the-Middle (MitM) (Correct answer)
- Brute Force
Correct answer: Man-in-the-Middle (MitM)
A Man-in-the-Middle attack involves secretly intercepting and potentially altering communications between two parties.
Question 6: What is the purpose of a Certificate Revocation List (CRL)?
- To list all valid certificates issued by a CA
- To identify certificates that have been revoked before their expiration date (Correct answer)
- To store private keys securely
- To register new certificate requests
Correct answer: To identify certificates that have been revoked before their expiration date
A CRL is a list published by a Certificate Authority that identifies digital certificates that have been revoked and should no longer be trusted.
Question 7: Which concept describes the process of verifying the integrity of software using cryptographic hashes?
- Code obfuscation
- File hashing (Correct answer)
- Code signing
- Fuzzing
Correct answer: File hashing
File hashing generates a fixed-length digest of a file; comparing hash values confirms whether a file has been altered.
CCP Cybersecurity Fundamentals & Concepts 3
What is the primary function of a Security Information and Event Management (SIEM) system?