CIW CIW Security Analyst 2 — Questions and Answers
Question 1: What is SQL injection?
- A method of speeding up SQL queries
- An attack that inserts malicious SQL code into input fields to manipulate a database (Correct answer)
- A database backup technique
- A type of stored procedure
Correct answer: An attack that inserts malicious SQL code into input fields to manipulate a database
SQL injection exploits insufficient input validation by inserting malicious SQL statements into fields, potentially exposing or corrupting database data.
Question 2: What does XSS (Cross-Site Scripting) allow an attacker to do?
- Break server encryption keys
- Inject malicious scripts into web pages viewed by other users (Correct answer)
- Perform brute-force password cracking
- Intercept DNS requests
Correct answer: Inject malicious scripts into web pages viewed by other users
XSS attacks inject client-side scripts into pages viewed by other users, potentially stealing session cookies or redirecting users.
Question 3: What is a VPN (Virtual Private Network) used for?
- Host websites from a home computer
- Create an encrypted tunnel over the internet to secure data transmission and mask IP addresses (Correct answer)
- Speed up web browsing
- Block pop-up advertisements
Correct answer: Create an encrypted tunnel over the internet to secure data transmission and mask IP addresses
A VPN encrypts internet traffic and routes it through a secure server, protecting privacy and securing data on public networks.
Question 4: What is the principle of least privilege in security?
- Give all users administrator rights to improve productivity
- Grant users only the minimum permissions necessary to perform their job functions (Correct answer)
- Allow privileged users to bypass security controls
- Restrict access only to executives
Correct answer: Grant users only the minimum permissions necessary to perform their job functions
The principle of least privilege limits user and system access rights to the bare minimum needed, reducing the attack surface and damage from breaches.
Question 5: What is multi-factor authentication (MFA)?
- Using multiple passwords for one account
- Requiring two or more verification factors (something you know, have, or are) to authenticate (Correct answer)
- Logging in from multiple devices simultaneously
- Using the same password across multiple sites
Correct answer: Requiring two or more verification factors (something you know, have, or are) to authenticate
MFA requires at least two independent authentication factors — such as a password plus a one-time code — dramatically reducing account compromise risk.
Question 6: What is a brute-force attack in the context of cybersecurity?
- Physically breaking into a server room
- Systematically trying all possible password combinations until the correct one is found (Correct answer)
- Overloading a server with network requests
- Social engineering via phone calls
Correct answer: Systematically trying all possible password combinations until the correct one is found
A brute-force attack methodically attempts every possible combination of credentials to gain unauthorized access to an account or system.
CIW CIW Security Analyst 2
What is SQL injection?