CTE Cybersecurity & Risk 2 — Questions and Answers
Question 1: A telecommunications carrier discovers that a BGP route hijacking attack has redirected customer traffic through a malicious autonomous system. What is the MOST effective technical countermeasure?
- Implement RPKI (Resource Public Key Infrastructure) to validate BGP route origins (Correct answer)
- Deploy additional firewall rules at the network perimeter
- Increase BGP timer intervals to slow route propagation
- Switch all customer traffic to MPLS private circuits
Correct answer: Implement RPKI (Resource Public Key Infrastructure) to validate BGP route origins
RPKI cryptographically validates BGP route origin announcements, preventing illegitimate ASes from hijacking IP prefixes.
Question 2: Under the NIST Cybersecurity Framework, which function encompasses activities to identify the occurrence of a cybersecurity event in a telecom network?
- Identify
- Protect
- Detect (Correct answer)
- Respond
Correct answer: Detect
The 'Detect' function includes continuous monitoring, anomaly detection, and security event identification processes.
Question 3: A CTE executive must assess the risk of a DDoS attack against the company's SS7 signaling infrastructure. Which risk formula is most commonly applied?
- Risk = Threat × Asset Value
- Risk = Likelihood × Impact (Correct answer)
- Risk = Vulnerability − Control Effectiveness
- Risk = Exposure Factor × Single Loss Expectancy
Correct answer: Risk = Likelihood × Impact
The standard risk formula multiplies the likelihood of a threat occurring by the potential impact it would cause.
Question 4: Which SS7 attack allows an adversary to intercept SMS-based two-factor authentication codes sent to telecom subscribers?
- IMSI catching
- SS7 MAP SRI-SM interception (Correct answer)
- DIAMETER AVP manipulation
- GTP tunneling attack
Correct answer: SS7 MAP SRI-SM interception
SS7 MAP Send Routing Info for Short Message (SRI-SM) queries allow attackers to redirect SMS messages to a controlled endpoint.
Question 5: A telecom company implements network segmentation to isolate its OSS/BSS systems from the core network. This is an example of which security principle?
- Defense in depth (Correct answer)
- Least privilege
- Zero trust
- Security by obscurity
Correct answer: Defense in depth
Defense in depth uses multiple layered security controls so that failure of one layer does not compromise the entire system.
Question 6: Which regulatory framework specifically requires US telecommunications carriers to implement lawful intercept capabilities and maintain network security standards?
- HIPAA
- CALEA (Correct answer)
- SOX
- PCI-DSS
Correct answer: CALEA
CALEA (Communications Assistance for Law Enforcement Act) mandates that telecom carriers build in lawful intercept capabilities for authorized law enforcement.
Question 7: During a security audit, an examiner finds that network engineers share a single privileged account for router configuration. Which control would BEST remediate this risk?
- Implement TACACS+ with individual user accounts and command authorization (Correct answer)
- Require engineers to use VPN before accessing routers
- Encrypt the shared password using AES-256
- Limit router access to a single dedicated workstation
Correct answer: Implement TACACS+ with individual user accounts and command authorization
TACACS+ provides per-user authentication, granular command authorization, and full accounting/audit trails for privileged network access.
CTE Cybersecurity & Risk 2
A telecommunications carrier discovers that a BGP route hijacking attack has redirected customer traffic through a malicious autonomous system.
What is the MOST effective technical countermeasure?