CCP Governance, Compliance & Ethical Hacking 3 — Questions and Answers
Question 1: An ethical hacker performs reconnaissance by analyzing publicly available DNS records, WHOIS data, and social media profiles without interacting with the target's systems. This technique is called:
- Active reconnaissance
- Passive reconnaissance (Correct answer)
- War driving
- Fingerprinting
Correct answer: Passive reconnaissance
Passive reconnaissance (also called OSINT gathering) collects information about a target using publicly available sources without directly interacting with or alerting the target.
Question 2: Which of the following BEST describes the concept of 'due diligence' in cybersecurity governance?
- Installing the latest antivirus software
- Proactively researching and understanding risks before making security decisions (Correct answer)
- Responding quickly after a breach is detected
- Delegating security responsibilities to a MSSP
Correct answer: Proactively researching and understanding risks before making security decisions
Due diligence in cybersecurity means actively researching threats, assessing risks, and evaluating controls before making decisions, whereas due care is the implementation of those measures.
Question 3: A penetration tester uses a tool to automatically scan open ports and identify running services on target hosts. Which phase of the ethical hacking methodology does this represent?
- Exploitation
- Post-exploitation
- Scanning and enumeration (Correct answer)
- Reporting
Correct answer: Scanning and enumeration
Scanning and enumeration involves using tools like Nmap to discover open ports, running services, OS versions, and network topology to build an attack surface map.
Question 4: Under GDPR, what is the maximum timeframe within which a data breach affecting EU residents must be reported to the relevant supervisory authority?
- 24 hours
- 48 hours
- 72 hours (Correct answer)
- 7 days
Correct answer: 72 hours
GDPR Article 33 requires organizations to notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach, where feasible.
Question 5: Which security governance model separates the duties of those who develop systems from those who deploy them to prevent fraud and errors?
- Defense in depth
- Separation of duties (Correct answer)
- Least privilege
- Need to know
Correct answer: Separation of duties
Separation of duties (SoD) ensures no single individual controls all steps of a critical process, reducing the risk of fraud, sabotage, or error.
Question 6: A company hires a third-party firm to perform a red team exercise. Unlike a standard penetration test, red team exercises are BEST characterized by:
- Testing all systems in scope simultaneously
- Simulating realistic adversary tactics, techniques, and procedures (TTPs) to test detection and response (Correct answer)
- Focusing exclusively on web application vulnerabilities
- Providing results within 48 hours
Correct answer: Simulating realistic adversary tactics, techniques, and procedures (TTPs) to test detection and response
Red team exercises simulate real-world adversaries using actual TTPs to evaluate the effectiveness of an organization's detection, response, and defensive capabilities holistically.
Question 7: ISO/IEC 27001 is an international standard that specifies requirements for establishing, implementing, maintaining, and continually improving a(n):
- Incident Response Plan (IRP)
- Information Security Management System (ISMS) (Correct answer)
- Business Continuity Plan (BCP)
- Vulnerability Management Program
Correct answer: Information Security Management System (ISMS)
ISO/IEC 27001 defines requirements for an Information Security Management System (ISMS), a systematic approach to managing sensitive information using risk management processes.
CCP Governance, Compliance & Ethical Hacking 3
An ethical hacker performs reconnaissance by analyzing publicly available DNS records, WHOIS data, and social media profiles without interacting with the target's systems.
This technique is called: