CCP Governance, Compliance & Ethical Hacking 3

Question 1

An ethical hacker performs reconnaissance by analyzing publicly available DNS records, WHOIS data, and social media profiles without interacting with the target's systems. This technique is called:

Accepted Answer

Passive reconnaissance

Answer

Passive reconnaissance (also called OSINT gathering) collects information about a target using publicly available sources without directly interacting with or alerting the target.

Question 2

Which of the following BEST describes the concept of 'due diligence' in cybersecurity governance?

Accepted Answer

Proactively researching and understanding risks before making security decisions

Answer

Due diligence in cybersecurity means actively researching threats, assessing risks, and evaluating controls before making decisions, whereas due care is the implementation of those measures.

Question 3

A penetration tester uses a tool to automatically scan open ports and identify running services on target hosts. Which phase of the ethical hacking methodology does this represent?

Accepted Answer

Scanning and enumeration

Answer

Scanning and enumeration involves using tools like Nmap to discover open ports, running services, OS versions, and network topology to build an attack surface map.

Question 4

Under GDPR, what is the maximum timeframe within which a data breach affecting EU residents must be reported to the relevant supervisory authority?

Accepted Answer

72 hours

Answer

GDPR Article 33 requires organizations to notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach, where feasible.

Question 5

Which security governance model separates the duties of those who develop systems from those who deploy them to prevent fraud and errors?

Accepted Answer

Separation of duties

Answer

Separation of duties (SoD) ensures no single individual controls all steps of a critical process, reducing the risk of fraud, sabotage, or error.

(CCP) Certified Cyber Professional Practice Test

(CCP) Certified Cyber Professional Practice Test

CCP Governance, Compliance & Ethical Hacking 3