CSOC Cybersecurity Fundamentals 2 — Questions and Answers
Question 1: What is social engineering in the context of cybersecurity?
- Manipulating people through psychological techniques to divulge confidential information or perform actions that compromise security (Correct answer)
- Engineering social media platforms to prevent cyber harassment
- Training employees to use social tools safely in the workplace
- Using social networks to gather open-source intelligence for security assessments
Correct answer: Manipulating people through psychological techniques to divulge confidential information or perform actions that compromise security
Social engineering exploits human psychology rather than technical vulnerabilities. Attackers manipulate targets into revealing credentials, clicking malicious links, or granting access by exploiting trust, fear, authority, or urgency.
Question 2: What is the purpose of multi-factor authentication (MFA) in securing systems?
- MFA requires users to verify their identity using two or more independent factors, making account compromise significantly harder (Correct answer)
- MFA allows multiple users to share a single account securely without sharing passwords
- MFA is a method of encrypting data using multiple authentication keys simultaneously
- MFA prevents all forms of credential theft by eliminating the need for passwords
Correct answer: MFA requires users to verify their identity using two or more independent factors, making account compromise significantly harder
MFA requires users to provide at least two independent verification factors — such as a password (something you know) plus a one-time code (something you have). Even if one factor is compromised, the attacker cannot access the account without the second factor.
Question 3: What is a 'denial of service' (DoS) attack?
- An attack that overwhelms a system or network with traffic to make it unavailable to legitimate users (Correct answer)
- An attack that denies a specific user access to their account
- An attack that destroys data on a system to deny the owner access to their files
- An attack where the attacker denies any involvement in a cybersecurity incident
Correct answer: An attack that overwhelms a system or network with traffic to make it unavailable to legitimate users
A denial of service attack floods a target system or network with excessive traffic or requests, exhausting resources and making the system unavailable to legitimate users. A Distributed DoS (DDoS) uses multiple sources to increase the attack volume.
Question 4: What is end-to-end encryption and what does it protect against?
- Encryption where data is encrypted at the sender's end and decrypted only by the recipient, protecting it from interception in transit (Correct answer)
- Encryption applied to both endpoints of a network connection but not to data in transit
- A type of encryption that covers all data from user creation to server deletion
- Encryption that protects only data stored at the end user's device
Correct answer: Encryption where data is encrypted at the sender's end and decrypted only by the recipient, protecting it from interception in transit
End-to-end encryption ensures that data is encrypted before it leaves the sender and can only be decrypted by the intended recipient. Intermediaries including service providers cannot read the content, protecting it from MITM attacks and data breaches in transit.
Question 5: What is 'patch management' and why is it critical in cybersecurity?
- The process of systematically identifying, testing, and applying software updates to fix known vulnerabilities before attackers can exploit them (Correct answer)
- A method of managing multiple security patches from different vendors simultaneously
- The process of documenting all software vulnerabilities without necessarily fixing them
- An emergency process activated only after a known vulnerability has been exploited
Correct answer: The process of systematically identifying, testing, and applying software updates to fix known vulnerabilities before attackers can exploit them
Patch management is the systematic process of keeping software up to date with security fixes. Unpatched systems are among the most common targets for attackers because known vulnerabilities are documented and exploit code is often publicly available.
Question 6: In cybersecurity risk management, what is the relationship between an asset, a threat, and a vulnerability?
- A threat exploits a vulnerability in an asset to cause harm — all three must be present for a security risk to exist (Correct answer)
- A vulnerability is created by a threat, and together they protect an asset from harm
- An asset is a type of threat that targets vulnerable systems
- Vulnerabilities and threats are the same concept applied to different types of assets
Correct answer: A threat exploits a vulnerability in an asset to cause harm — all three must be present for a security risk to exist
A security risk exists when a threat (an entity or event with potential to cause harm) can exploit a vulnerability (a weakness) in an asset (something of value). Removing any one of the three elements reduces or eliminates the risk.
CSOC Cybersecurity Fundamentals 2
What is social engineering in the context of cybersecurity?