CCISO Core IT Security 5

Question 1

Which security concept requires that systems and processes be designed so that a failure defaults to a secure state rather than an insecure one?

Accepted Answer

Fail secure (fail closed)

Answer

Fail secure means that when a system fails, access is denied by default, preventing unauthorized access during system failures.

Question 2

A CISO discovers that an employee has been exfiltrating sensitive data using steganography embedded in image files. Which security tool would be MOST effective at detecting this activity?

Accepted Answer

Data Loss Prevention (DLP)

Answer

DLP solutions monitor and control data transfers, inspecting content leaving the organization to detect unauthorized exfiltration regardless of obfuscation method.

Question 3

Under the NIST Cybersecurity Framework, which core function involves developing and implementing activities to identify a cybersecurity incident?

Accepted Answer

Detect

Answer

The Detect function in the NIST CSF focuses on developing and implementing appropriate activities to identify the occurrence of a cybersecurity event.

Question 4

An attacker intercepts communication between two parties and secretly relays modified messages between them. Which attack type is this?

Accepted Answer

Man-in-the-middle (MITM) attack

Answer

A MITM attack positions the attacker between two communicating parties to intercept, read, and potentially modify messages in transit.

Question 5

A security team implements a honeypot on the network. What is the PRIMARY purpose of this deception technology?

Accepted Answer

Detecting and studying attacker behavior

Answer

Honeypots are decoy systems designed to attract attackers, allowing security teams to study their tactics and gather threat intelligence.

(CCISO) EC-Council Certified CISO Practice Test

(CCISO) EC-Council Certified CISO Practice Test

CCISO Core IT Security 5