CCISO Core IT Security 3 — Questions and Answers
Question 1: Which network security device inspects traffic at the application layer and can make forwarding decisions based on the content of HTTP requests?
- Stateful firewall
- Packet-filtering router
- Web Application Firewall (WAF) (Correct answer)
- Network Address Translator (NAT)
Correct answer: Web Application Firewall (WAF)
A WAF operates at Layer 7 and inspects HTTP/HTTPS content to detect and block application-layer attacks like SQL injection and XSS.
Question 2: An IDS generates an alert for traffic that is actually legitimate business activity. This is an example of which type of IDS error?
- True positive
- False negative
- True negative
- False positive (Correct answer)
Correct answer: False positive
A false positive occurs when an IDS incorrectly identifies benign traffic as malicious, triggering an unnecessary alert.
Question 3: A CISO wants to test the organization's security posture by simulating a real-world attack with full knowledge of internal systems. Which assessment type should be used?
- Black-box penetration test
- White-box penetration test (Correct answer)
- Vulnerability scan
- Red team exercise
Correct answer: White-box penetration test
A white-box test gives the tester full knowledge of internal architecture, source code, and configurations to conduct a thorough assessment.
Question 4: Which secure network architecture places public-facing servers in an isolated segment that is separate from both the internal network and the internet?
- VLAN
- DMZ (Demilitarized Zone) (Correct answer)
- VPN tunnel
- Zero-trust network
Correct answer: DMZ (Demilitarized Zone)
A DMZ isolates public-facing servers so that if compromised, attackers cannot directly reach the internal corporate network.
Question 5: An organization implements PKI to manage digital certificates. Which entity is responsible for issuing and revoking certificates within the PKI hierarchy?
- Registration Authority (RA)
- Certificate Authority (CA) (Correct answer)
- Certificate Revocation List (CRL)
- Online Certificate Status Protocol (OCSP)
Correct answer: Certificate Authority (CA)
The CA is the trusted entity that issues digital certificates and maintains revocation records within the PKI trust hierarchy.
Question 6: A security team wants to identify unauthorized devices connecting to the corporate network. Which technology provides real-time visibility into connected endpoints?
- Network Access Control (NAC) (Correct answer)
- Data Loss Prevention (DLP)
- Security Information and Event Management (SIEM)
- Identity and Access Management (IAM)
Correct answer: Network Access Control (NAC)
NAC enforces endpoint compliance and controls which devices are permitted to access the network, providing visibility into all connected assets.
Question 7: Which type of malware conceals its presence by modifying operating system functions or kernel components, making it extremely difficult to detect?
- Worm
- Ransomware
- Rootkit (Correct answer)
- Adware
Correct answer: Rootkit
Rootkits embed themselves in the OS kernel or bootloader, hiding their presence by intercepting and modifying system calls.
CCISO Core IT Security 3
Which network security device inspects traffic at the application layer and can make forwarding decisions based on the content of HTTP requests?