CPA Cybersecurity & Risk 3 — Questions and Answers
Question 1: What is the main goal of penetration testing?
- Installing security patches on all systems
- Simulating attacks to identify exploitable vulnerabilities (Correct answer)
- Monitoring network traffic for anomalies
- Creating user awareness training programs
Correct answer: Simulating attacks to identify exploitable vulnerabilities
Penetration testing involves authorized simulated attacks on a system to uncover security weaknesses before malicious actors can exploit them.
Question 2: Which security principle ensures that users can only access resources necessary for their job function?
- Defense in Depth
- Least Privilege (Correct answer)
- Non-Repudiation
- Separation of Duties
Correct answer: Least Privilege
The Least Privilege principle limits user access rights to only what is strictly required to perform their duties.
Question 3: What does 'phishing' typically rely on to compromise a victim?
- Exploiting unpatched software
- Tricking users into revealing credentials via deceptive messages (Correct answer)
- Brute-forcing passwords automatically
- Scanning open network ports
Correct answer: Tricking users into revealing credentials via deceptive messages
Phishing uses deceptive emails or messages that impersonate trusted entities to manipulate users into disclosing sensitive information.
Question 4: Which CIA Triad component is directly threatened when a database is altered without authorization?
- Confidentiality
- Availability
- Integrity (Correct answer)
- Authentication
Correct answer: Integrity
Integrity ensures data accuracy and trustworthiness; unauthorized modifications directly violate this principle.
Question 5: What is the purpose of network segmentation in cybersecurity?
- Speed up data transfer rates
- Limit lateral movement by containing breaches within smaller zones (Correct answer)
- Reduce the number of IP addresses needed
- Encrypt all internal traffic automatically
Correct answer: Limit lateral movement by containing breaches within smaller zones
Network segmentation divides a network into smaller isolated zones so that a breach in one segment cannot easily spread to others.
Question 6: Which attack floods a target server with traffic to make it unavailable to legitimate users?
- Replay Attack
- Denial of Service (DoS) (Correct answer)
- Eavesdropping
- Cross-Site Request Forgery
Correct answer: Denial of Service (DoS)
A Denial of Service attack overwhelms a server with excessive requests, exhausting resources and preventing legitimate access.
Question 7: In risk assessment, what does 'likelihood' refer to?
- The financial cost of a security incident
- The probability that a threat will successfully exploit a vulnerability (Correct answer)
- The speed at which an attack can spread
- The number of systems affected by a breach
Correct answer: The probability that a threat will successfully exploit a vulnerability
Likelihood in risk assessment measures how probable it is that a given threat will actually exploit a vulnerability and cause harm.
CPA Cybersecurity & Risk 3
What is the main goal of penetration testing?