CSOC Cybersecurity Fundamentals — Questions and Answers
Question 1: What is the CIA triad in cybersecurity and what do the three components represent?
- Confidentiality, Integrity, and Availability — the three core properties that security controls aim to protect (Correct answer)
- Cyber Intelligence Agency — a Singapore government body overseeing national cybersecurity
- Classification, Identification, and Authentication — steps in the identity verification process
- Control, Inspect, and Audit — the three phases of a cybersecurity review cycle
Correct answer: Confidentiality, Integrity, and Availability — the three core properties that security controls aim to protect
The CIA triad is the foundational model for information security. Confidentiality ensures data is accessible only to authorised parties; Integrity ensures data is accurate and unaltered; Availability ensures systems and data are accessible when needed.
Question 2: What is the difference between a vulnerability and an exploit in cybersecurity?
- A vulnerability is a weakness in a system; an exploit is the code or technique used to take advantage of that vulnerability (Correct answer)
- A vulnerability is a successful attack; an exploit is the tool used to prevent it
- A vulnerability is a type of malware; an exploit is the damage it causes
- There is no meaningful distinction — the terms are interchangeable in cybersecurity
Correct answer: A vulnerability is a weakness in a system; an exploit is the code or technique used to take advantage of that vulnerability
A vulnerability is a weakness or flaw in a system, software, or process. An exploit is the specific code, technique, or method that an attacker uses to take advantage of that vulnerability to compromise a system.
Question 3: What is a 'zero-day vulnerability'?
- A vulnerability that is unknown to the software vendor and for which no patch is yet available (Correct answer)
- A vulnerability that was discovered on the first day of a software release
- A vulnerability that takes zero days to exploit once discovered
- A vulnerability that only affects systems with zero days of uptime
Correct answer: A vulnerability that is unknown to the software vendor and for which no patch is yet available
A zero-day vulnerability is one that is unknown to the software developer or vendor, meaning there is no available patch or fix. Attackers who discover or purchase zero-days can exploit them before any defence is possible.
Question 4: What is the purpose of network segmentation in cybersecurity?
- To divide a network into isolated segments so that a breach in one segment does not automatically compromise the entire network (Correct answer)
- To increase network speed by distributing traffic across multiple segments
- To reduce hardware costs by sharing resources across multiple departments
- To create backup networks that activate when the primary network fails
Correct answer: To divide a network into isolated segments so that a breach in one segment does not automatically compromise the entire network
Network segmentation limits lateral movement by attackers within a compromised network. By isolating segments, a breach in one area is contained, preventing attackers from easily accessing all systems and data.
Question 5: What is a 'man-in-the-middle' (MITM) attack?
- An attack where the attacker secretly intercepts and potentially alters communications between two parties who believe they are communicating directly (Correct answer)
- An attack where a malicious insider intercepts communications between external users and the company
- An attack launched from a server physically located between two target systems
- An attack that exploits middleware software to access a database
Correct answer: An attack where the attacker secretly intercepts and potentially alters communications between two parties who believe they are communicating directly
In a MITM attack, the attacker inserts themselves between two communicating parties, intercepting and potentially altering the data without the knowledge of either party. This can be used to steal credentials, session tokens, or sensitive data.
Question 6: What is the principle of 'least privilege' in cybersecurity?
- Users and systems should be granted only the minimum access rights required to perform their legitimate functions (Correct answer)
- Users should receive the lowest possible security clearance by default
- Privileged user accounts should have fewer security controls to avoid disrupting their work
- Only the least experienced staff should be given access to sensitive systems to limit insider threats
Correct answer: Users and systems should be granted only the minimum access rights required to perform their legitimate functions
The principle of least privilege limits access rights to only what is necessary for a user or system to perform its specific role. This reduces the attack surface and limits the potential damage from compromised accounts.
CSOC Cybersecurity Fundamentals
What is the CIA triad in cybersecurity and what do the three components represent?