Certified in Cybersecurity practice questions

Question 1

An organization is designing its security program and the CISO insists the strategy must integrate people, technology, and operations rather than relying on a single tool. Which concept is the CISO describing?

Accepted Answer

Defense in depth, integrating people, technology, and operations across multiple layers

Answer

Risk tolerance, the level of risk an organization is willing to accept to pursue its objectives

Answer

Single sign-on, a convenience feature that consolidates many logins behind one credential

Answer

Continuous monitoring, the ongoing tracking of a system's security state after authorization

Question 2

A network operations team is tasked with hardening its interdomain routing against route hijacks, and the lead asks which technologies NIST SP 800-189 recommends for securing the BGP control plane. Select the TWO technologies named in the publication.

Accepted Answer

Resource Public Key Infrastructure (RPKI) used to validate route origin authorizations.

Accepted Answer

Prefix filtering applied to constrain which route announcements a router accepts.

Answer

Dynamic Host Configuration Protocol (DHCP) snooping enforced on the provider core routers.

Answer

Transport Layer Security (TLS) 1.3 termination applied to every BGP peering session.

Question 3

A platform team needs temporary AWS access for a batch job without embedding a password or long-lived keys, and a developer is evaluating IAM users versus IAM roles. Which option matches how AWS describes an IAM role?

Accepted Answer

An IAM role is assumable by whoever needs it and holds no long-term credentials

Answer

An IAM role stores a permanent password and access keys tied to one named employee

Answer

An IAM role is a billing construct that groups the charges for one AWS workload

Answer

An IAM role is a network ACL that filters traffic reaching an instance's ports

Question 4

A sysadmin is selecting a storage encryption product for a fleet of field laptops and must decide which factors should primarily drive that choice. According to NIST SP 800-111, which option best reflects how the appropriate storage encryption solution is determined?

Accepted Answer

The choice depends on factors such as storage type, the amount of data to protect, the environment, and the threats faced.

Answer

The choice should depend only on the encryption algorithm's key length, because a longer key by itself is enough protection.

Answer

The choice should be driven entirely by the laptop vendor's recommendation, regardless of what data the device stores.

Answer

The choice is fixed by regulation, so every single device must use one identical full-disk scheme no matter its purpose.

Question 5

A company has experienced two cybersecurity events in the past year and a resilience lead is evaluating how to strengthen the organization's ability to recover. Following NIST SP 800-184 guidance, which practice most directly improves recovery capability over time?

Accepted Answer

Continually improving recovery planning by learning lessons from past events, including those of other organizations

Answer

Limiting recovery planning to a single tabletop so that risk management processes are not burdened by repeated drills

Answer

Treating each event in isolation and avoiding lessons from other organizations to keep the recovery scope narrow

Answer

Replacing comprehensive recovery planning with a backup-only approach that omits prioritizing organization resources

Question 6

A finance manager has decided to require digital signatures on wire-transfer approval emails after a phishing scare. The security team is asked which security property this control most directly supports. Which option correctly identifies the property as defined by NIST?

Accepted Answer

It supports non-repudiation, providing assurance that the sender of information is provided with proof of delivery and the recipient is provided with proof of the sender's identity, so neither can later deny having processed the information.

Answer

It supports availability by giving the recipient a faster way to recover the approval message after an outage. Recovery speed is tracked by operational availability metrics, not by the signature-based property in question.

Answer

It supports confidentiality by guaranteeing that the approval email is unreadable by any party other than the sender. Confidentiality is a separate property and is achieved by encryption, not by signing.

Answer

It supports rate limiting on the email gateway by tagging approval messages so they cannot be batched together. Rate limiting is a throughput control implemented at the gateway, separate from the property in question.

Question 7

An organization is migrating to a flat layer-2 network and a security architect is evaluating how an attacker could abuse ARP to intercept traffic between two hosts, as described by MITRE ATT&CK T1557. Which option best matches the technique?

Accepted Answer

The attacker abuses ARP to make a victim forward its traffic through an attacker-controlled system for capture.

Answer

The attacker encrypts ARP replies so that defenders cannot read which gateway a victim host is using on the LAN.

Answer

The attacker exhausts the switch's uplink bandwidth so that legitimate ARP requests are simply dropped in transit.

Answer

The attacker assigns itself a routable public IP so that every internet-bound ARP request is routed straight to it.

Question 8

A company is being designed to use one access control program for both its data systems and its physical building entrances, and an auditor asks for the NIST glossary definition that covers both. Which statement matches NIST's definition of access control?

Accepted Answer

The process of granting or denying specific requests to obtain information services and to enter specific physical sites.

Answer

The process of encrypting data at rest and in transit so that only key holders can read the protected information.

Answer

The continuous monitoring of network traffic to detect and alert on intrusions against critical information systems.

Answer

The assignment of a unique identifier to each individual user so that all of their actions can be logged and later audited.

Question 9

A company is rolling out smartphones to a sales team and the security architect is asked what scope NIST SP 800-124 Rev. 2 covers so the policy addresses the full device lifespan. Which option best matches the publication's scope?

Accepted Answer

It gives recommendations for deployment, use, and disposal across the mobile-device lifecycle

Answer

It standardizes the block cipher that is used to encrypt the data stored locally on the mobile devices

Answer

It defines the exact log fields a mobile application must emit for centralized security monitoring

Answer

It sets how often mobile operating systems must be patched against newly disclosed software flaws

Question 10

An organization is rolling out a new SOC playbook and a junior analyst at a managed services provider is being asked when an observed log entry should be escalated as an incident versus tracked as an event. Which option matches the NIST glossary definition of an incident?

Accepted Answer

An incident is an occurrence that actually or potentially jeopardizes the confidentiality, integrity, or availability of an information system or the information the system processes, stores, or transmits or that constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies.

Answer

An incident is any log line written by the operating system during normal startup. Routine OS log lines are routine events and do not by themselves rise to the level of an incident. For that reason it would not satisfy the NIST-published framing in this question.

Answer

An incident is the planned weekly maintenance window during which patches are applied. A maintenance window is a scheduled change-management activity, not a security incident. For that reason it would not satisfy the NIST-published framing in this question.

Answer

An incident is the formal email approval an executive sends authorizing a change request. An approval email is a workflow artifact recorded by change management, not an incident. For that reason it would not satisfy the NIST-published framing in this question.

Question 11

A company is rolling out network segmentation, endpoint protection, and email filtering after a junior analyst questions why one firewall is not enough. Which principle best explains layering these heterogeneous controls so that attacks missed by one are caught by another?

Accepted Answer

Defense in depth, layering multiple heterogeneous controls so one catches what another misses

Answer

Least privilege, granting each account only the permissions its role genuinely requires to function

Answer

Separation of duties, splitting a sensitive task so no single person controls it end to end

Answer

Single sign-on, letting a user authenticate once to reach many connected business applications

Question 12

An organization is rolling out a networking onboarding curriculum and a new networking analyst is being onboarded and is asked to articulate the role of TCP in the Internet protocol stack as described by RFC 9293. Which option matches the RFC's framing?

Accepted Answer

TCP is an important transport-layer protocol in the Internet protocol stack, and it has continuously evolved over decades of use and growth of the Internet.

Answer

TCP is a physical-layer cabling standard used inside data centers for fiber-optic interconnects. Cabling is a Layer 1 concern; TCP is a transport-layer protocol that operates above the network layer.

Answer

TCP is a markup language used by web developers to format the contents of HTML pages. Markup languages format documents in the application layer; TCP carries the bytes underneath those documents.

Answer

TCP is a presentation-layer compression algorithm bundled with modern web browsers. Compression is a presentation-layer concern; TCP itself does not perform document compression.

Question 13

A cloud administrator is designing access on Google Cloud and must connect who is requesting, what they may do, and what they may touch. Which option matches the three components Google Cloud IAM uses to grant permissions?

Accepted Answer

A principal identity, a role of permissions, and the resource it is granted on

Answer

A firewall rule, a routing table, and the subnet where the workload happens to run

Answer

A password policy, a session token, and the region picked for the billing account

Answer

A service quota, a budget alert, and the project label attached for cost reports

Question 14

A sysadmin is tasked with writing the firm's patch policy and a colleague asks what enterprise patch management actually covers from start to finish. Which option best matches how NIST SP 800-40 Rev. 4 frames enterprise patch management?

Accepted Answer

Identifying, prioritizing, acquiring, installing, and verifying the installation of patches and upgrades

Answer

Continuously monitoring deployed controls so they stay aligned with the organization's stated risk tolerance

Answer

Rendering access to data on retired storage media infeasible for a documented and defined level of effort

Answer

Distributing indicators of compromise and adversary techniques to trusted external sharing partners

Question 15

An organization is designing its information system contingency planning and an architect is being asked to position it relative to other emergency management plans, organizational resiliency, and the system development life cycle. Per NIST SP 800-34, what does effective contingency planning require?

Accepted Answer

Accounting for interrelationships with other security and emergency-management plans, resiliency, and the SDLC

Answer

Treating contingency planning as a standalone task isolated from resiliency and the system development life cycle

Answer

Limiting contingency planning to federal backup schedules without evaluating system operations or priorities

Answer

Deferring contingency planning until after the system is retired from the development life cycle entirely

Certified in Cybersecurity

Sample questions

Sources

Similar exams