ISACA Cybersecurity Nexus (CSX) Fundamentals Certificate — Questions and Answers

Question 1: What does the concept of 'data at rest' protection primarily address?

Securing data stored on disk, databases, or backups (Correct answer)
Encrypting data transmitted over a network
Hashing data before it is processed in memory
Monitoring data accessed by users in real time

Correct answer: Securing data stored on disk, databases, or backups

Data at rest protection uses encryption and access controls to secure stored data on disks, databases, tape backups, and other storage media.

Question 2: What is the primary function of a Security Operations Center (SOC)?

Performing financial audits and compliance reviews
Continuously monitoring and analyzing an organization's security posture (Correct answer)
Developing new software applications
Managing human resources and employee onboarding

Correct answer: Continuously monitoring and analyzing an organization's security posture

A SOC's primary function is to continuously monitor, detect, analyze, and respond to cybersecurity threats and incidents around the clock.

Question 3: What is the PRIMARY purpose of a hardware security module (HSM) in a PKI environment?

To scan certificates for expiration
To distribute certificates to end users
To generate and securely store cryptographic keys (Correct answer)
To revoke compromised certificates automatically

Correct answer: To generate and securely store cryptographic keys

An HSM provides tamper-resistant hardware for generating, storing, and managing cryptographic keys, protecting the CA's root key from extraction.

Question 4: Which hashing algorithm is currently recommended by NIST for integrity verification of digital evidence?

SHA-1
CRC32
MD5
SHA-256 (Correct answer)

Correct answer: SHA-256

NIST recommends SHA-256 (part of the SHA-2 family) for evidence integrity verification as MD5 and SHA-1 have known collision vulnerabilities.

Question 5: A CISO needs to ensure that cloud-stored evidence is legally admissible. Which document should be obtained from the cloud provider?

Chain of custody affidavit (Correct answer)
Data processing addendum
Terms of Service agreement
Service Level Agreement (SLA)

Correct answer: Chain of custody affidavit

A chain of custody affidavit from the cloud provider documents who had access to the data, supporting its admissibility in court.

Question 6: Which containment strategy allows investigation to continue while limiting attacker movement?

Hard shutdown of affected systems
Network segmentation and isolation of compromised hosts (Correct answer)
Blocking all outbound traffic at the perimeter
Immediately reimaging all affected machines

Correct answer: Network segmentation and isolation of compromised hosts

Network segmentation isolates compromised systems to prevent spread while keeping them online for forensic investigation.

Question 7: Under the Fourth Amendment, which doctrine holds that evidence found in plain view during a lawful search is admissible even if not specified in the warrant?

Fruit of the poisonous tree
Inevitable discovery rule
Plain view doctrine (Correct answer)
Silver platter doctrine

Correct answer: Plain view doctrine

The plain view doctrine allows law enforcement to seize evidence not listed in a warrant if it is in plain sight during a lawful search.

Question 8: In threat modeling, what is the purpose of decomposing an application?

To uninstall unnecessary software components
To generate software documentation for compliance
To understand the application's structure, data flows, and entry points for identifying threats (Correct answer)
To measure application performance under load

Correct answer: To understand the application's structure, data flows, and entry points for identifying threats

Application decomposition in threat modeling breaks down the system into components, data flows, and trust boundaries to systematically identify where threats could arise.

Question 9: The California Consumer Privacy Act (CCPA) grants consumers the right to know what personal information is collected about them and the right to:

Request deletion of their personal information (Correct answer)
Access competitors' data held by businesses
Opt in before any data is collected
Sue for any privacy violation regardless of harm

Correct answer: Request deletion of their personal information

The CCPA grants California consumers the right to request deletion of personal information held by businesses, subject to certain exceptions.

Question 10: Which interview approach is most consistent with ethical standards and legally defensible practices in corporate cybersecurity investigations?

Promising the subject leniency in exchange for a confession
Conducting a non-coercive, fact-finding interview with proper documentation (Correct answer)
Using high-pressure tactics to obtain a rapid admission
Recording the interview covertly without the subject's knowledge

Correct answer: Conducting a non-coercive, fact-finding interview with proper documentation

Non-coercive, fact-finding interviews with transparent documentation are legally defensible and align with ethical investigative standards.

Question 11: Which encryption mode is most appropriate for encrypting large amounts of data where each block must be independently decryptable?

ECB (Electronic Codebook) (Correct answer)
CTR (Counter Mode)
CBC (Cipher Block Chaining)
GCM (Galois/Counter Mode)

Correct answer: ECB (Electronic Codebook)

ECB mode encrypts each block independently, making individual blocks decryptable without the preceding ciphertext, though it is generally not recommended for sensitive data due to pattern leakage.

Question 12: A disgruntled employee uses their legitimate work credentials to copy confidential files before resigning. Under the CFAA, the most likely applicable provision is:

Unauthorized access to obtain national security information
Intentionally exceeding authorized access to obtain information from a protected computer (Correct answer)
Knowingly causing damage to a protected computer
Intentional access without authorization to obtain financial information

Correct answer: Intentionally exceeding authorized access to obtain information from a protected computer

Using valid credentials beyond their permitted scope to obtain confidential data typically falls under exceeding authorized access under 18 U.S.C. § 1030(a)(2).

Question 13: What is a common method to confirm a detected security incident?

Full disk wipe
Code refactoring
Running antivirus scans manually
Log correlation and validation (Correct answer)

Correct answer: Log correlation and validation

To confirm a detected security incident, security analysts often perform log correlation and validation. This involves examining logs from multiple sources (e.g., firewalls, IDS, servers) to find corroborating evidence, identify patterns, and verify that an alert represents a genuine threat rather than a false positive. This systematic approach ensures that resources are focused on actual incidents.

Question 14: Which framework specifically categorizes adversary behaviors observed during post-compromise activity, including collection and exfiltration?

MITRE ATT&CK (Correct answer)
ISO 27001
NIST CSF
CVE

Correct answer: MITRE ATT&CK

MITRE ATT&CK documents real-world adversary tactics, techniques, and procedures (TTPs) across the full attack lifecycle, including collection and exfiltration stages.

Question 15: Which tool is commonly used for network threat detection?

SIEM
Firewall
Packet sniffer
IDS (Correct answer)

Correct answer: IDS

An Intrusion Detection System (IDS) is specifically designed to monitor network traffic and/or system activities for malicious activity or policy violations. It analyzes patterns and signatures to detect potential threats, generating alerts when suspicious behavior is identified. This makes it a primary tool for actively identifying and signaling network threats.

Question 16: What is the correct order when documenting a crime scene under the 'order of volatility' principle?

CPU registers → RAM → Network state → Disk (Correct answer)
Network state → Disk → RAM → CPU registers
Disk → Network state → RAM → CPU registers
RAM → Disk → CPU registers → Network state

Correct answer: CPU registers → RAM → Network state → Disk

The order of volatility requires collecting the most ephemeral data first: CPU registers, then RAM, network state, and finally disk.

Question 17: A web server must serve only HTTPS traffic. Which firewall rule set BEST enforces this?

Allow all TCP inbound, deny UDP inbound
Allow TCP 443 inbound, deny TCP 80 inbound (Correct answer)
Allow TCP 80 inbound, deny all other inbound
Allow TCP 80 and 443 inbound, deny all other

Correct answer: Allow TCP 443 inbound, deny TCP 80 inbound

Allowing only TCP 443 (HTTPS) and blocking TCP 80 (HTTP) forces all web traffic through the encrypted channel, preventing unencrypted access.

Question 18: Which technique do attackers use to blend malicious traffic with legitimate communications and avoid detection?

Credential dumping
Living off the land (LotL) and using trusted protocols like HTTPS for C2 (Correct answer)
Pass-the-hash attacks
Privilege escalation

Correct answer: Living off the land (LotL) and using trusted protocols like HTTPS for C2

Living-off-the-land techniques use trusted tools and protocols (like HTTPS, DNS) for C2 communications, making malicious traffic difficult to distinguish from legitimate traffic.

Question 19: After fully recovering from a ransomware incident, what is the MOST important preventive control to implement to reduce recurrence risk?

Increase log retention to 5 years
Deploy an additional firewall at the perimeter
Switch all servers to Linux
Implement offline, tested, immutable backups and user security awareness training (Correct answer)

Correct answer: Implement offline, tested, immutable backups and user security awareness training

Offline immutable backups ensure recovery without paying ransom, while security awareness training addresses the phishing and social engineering vectors ransomware commonly exploits.

Question 20: Which of the following is used to detect unauthorized changes in files?

VPN
Firewall
FIM (Correct answer)
SIEM

Correct answer: FIM

File Integrity Monitoring (FIM) systems are designed to continuously monitor critical operating system, application, and configuration files for unauthorized or unexpected changes. By comparing current file states against a known baseline, FIM can detect modifications that might indicate a security breach, malware infection, or misconfiguration. This proactive detection helps maintain system integrity and security.

Question 21: What is the purpose of a Security Information and Event Management (SIEM) system?

Perform automated patching
Aggregate and analyze security logs (Correct answer)
Encrypt sensitive files
Block incoming emails

Correct answer: Aggregate and analyze security logs

A Security Information and Event Management (SIEM) system centralizes and correlates security event data from various sources across an organization's IT infrastructure. Its primary purpose is to aggregate these logs, analyze them for potential security incidents, and provide real-time alerts and reporting. This enables proactive threat detection, incident response, and compliance management by offering a holistic view of security events.

Question 22: Which of the following is an example of behavioral-based detection in a SIEM?

Matching a file hash against a known malware signature database
Blocking a known malicious IP address at the firewall
Scanning endpoints for missing operating system patches
Detecting an unusual spike in outbound data transfers from a single host at 2 AM (Correct answer)

Correct answer: Detecting an unusual spike in outbound data transfers from a single host at 2 AM

Behavioral detection identifies anomalies that deviate from an established baseline, such as abnormal data transfer volumes, rather than relying on known signatures.

Question 23: What does a 'beaconing' pattern in network traffic MOST likely indicate?

A misconfigured NTP server
Normal software update polling
Malware regularly checking in with a command-and-control server (Correct answer)
A port scan in progress

Correct answer: Malware regularly checking in with a command-and-control server

Beaconing refers to malware making periodic, regular outbound connections to a C2 server to receive instructions or exfiltrate data.

Question 24: Which type of firewall inspects traffic up to the application layer, including packet payload content?

Next-generation firewall (NGFW) (Correct answer)
Packet-filtering firewall
Stateless firewall
Circuit-level gateway

Correct answer: Next-generation firewall (NGFW)

Next-generation firewalls perform deep packet inspection at the application layer, enabling content-aware filtering.

Question 25: Which network scanning technique sends a SYN packet and waits for a SYN-ACK without completing the TCP handshake?

ICMP ping sweep
Full connect scan
SYN stealth scan (Correct answer)
UDP scan

Correct answer: SYN stealth scan

A SYN stealth scan (half-open scan) identifies open ports without completing the three-way handshake, leaving fewer log traces.

Question 26: Which attack exploits the lack of source validation in DNS to amplify traffic toward a victim?

SQL injection
ARP poisoning
Session hijacking
DNS amplification attack (Correct answer)

Correct answer: DNS amplification attack

DNS amplification attacks send forged DNS queries with the victim's IP as the source, causing large response floods.

Question 27: Which legal doctrine allows evidence obtained during an unlawful search to be excluded from trial?

Hearsay exception
Best evidence rule
Chain of custody
Fruit of the poisonous tree (Correct answer)

Correct answer: Fruit of the poisonous tree

The 'fruit of the poisonous tree' doctrine holds that evidence derived from an illegal search or seizure is inadmissible because it is tainted by the initial constitutional violation.

Question 28: A security analyst reviews logs and finds repeated failed login attempts from a single IP followed by one successful login. This pattern most likely indicates what type of threat?

Credential stuffing or brute-force attack (Correct answer)
Man-in-the-middle attack
SQL injection
DNS poisoning

Correct answer: Credential stuffing or brute-force attack

Repeated failed logins followed by a success is the hallmark pattern of brute-force or credential stuffing attacks targeting authentication systems.

Question 29: What is 'purple teaming' in the context of cyber incident detection?

A collaborative exercise where red team attackers and blue team defenders work together to improve detection capabilities (Correct answer)
A vendor-neutral certification program
A compliance framework for financial institutions
A government classification for top-secret cyber operations

Correct answer: A collaborative exercise where red team attackers and blue team defenders work together to improve detection capabilities

Purple teaming combines offensive (red team) and defensive (blue team) functions to maximize the feedback loop and measurably improve detection and response capabilities.

Question 30: In a threat assessment, 'threat exposure' refers to:

The time window in which a vulnerability was publicly known
The degree to which an organization's assets are accessible to identified threat actors (Correct answer)
The number of employees aware of a threat
The annual cost of a potential security breach

Correct answer: The degree to which an organization's assets are accessible to identified threat actors

Threat exposure measures how accessible an organization's valuable assets are to potential threat actors, considering factors like attack surface and existing controls.

Question 31: Which NIST framework function is most directly associated with identifying cybersecurity threats before they cause harm?

Recover
Identify (Correct answer)
Respond
Protect

Correct answer: Identify

The NIST 'Identify' function focuses on developing organizational understanding to manage cybersecurity risk, including asset management and risk assessment.

Question 32: What is 'statement analysis' used for in cybersecurity investigative interviews?

Examining the content and structure of a subject's verbal or written statement for indicators of deception (Correct answer)
Summarizing interview findings for legal counsel
Analyzing network traffic logs for anomalies
Reviewing an employee's performance statements in HR records

Correct answer: Examining the content and structure of a subject's verbal or written statement for indicators of deception

Statement analysis examines language patterns, word choice, and structural inconsistencies in a subject's account to identify potential areas of deception or omission.

Question 33: In CSX risk assessment, what does threat vulnerability analysis involve?

Reviewing parking lot lighting
Identifying potential threats, evaluating vulnerabilities, and determining the likelihood and impact of incidents (Correct answer)
Counting the number of security cameras
Testing employee computer passwords only

Correct answer: Identifying potential threats, evaluating vulnerabilities, and determining the likelihood and impact of incidents

Threat vulnerability analysis systematically identifies potential threats (natural, human, technological), evaluates existing vulnerabilities, assesses the probability and potential impact of each threat, and prioritizes mitigation measures.

Question 34: A subject being interviewed about a ransomware attack asks whether they need a lawyer present. How should a corporate cybersecurity investigator respond?

Continue the interview but note the request in documentation
Inform the subject that requesting a lawyer implies guilt
Acknowledge the request and immediately pause the interview to allow the subject to obtain legal counsel if desired (Correct answer)
Tell the subject they do not need a lawyer since this is an internal matter

Correct answer: Acknowledge the request and immediately pause the interview to allow the subject to obtain legal counsel if desired

Respecting a subject's right to legal counsel is ethically required and protects the admissibility of any information gathered in subsequent proceedings.

Question 35: In a cybersecurity interview, a witness suddenly recalls a critical detail about the attacker's email address. What should the investigator do first?

End the interview and send the email address to the incident response team
Encourage the witness to fully describe the recollection using open-ended prompts before taking any action on the detail (Correct answer)
Ask the witness to write down only the email address and nothing else
Immediately search for the email address in the organization's mail logs

Correct answer: Encourage the witness to fully describe the recollection using open-ended prompts before taking any action on the detail

Allowing the witness to fully elaborate their recollection first prevents interrupting their memory retrieval process and may surface additional corroborating details.

Question 36: In the context of a phishing investigation, why should an interviewer use open-ended questions when speaking to potential victims?

To allow witnesses to provide a full, uncontaminated account without leading their memory (Correct answer)
To limit the amount of time spent on each witness
To ensure the witness cannot retract their statements later
To legally protect the organization from liability

Correct answer: To allow witnesses to provide a full, uncontaminated account without leading their memory

Open-ended questions allow witnesses to share their full recollection without the interviewer's questions introducing bias or contaminating their memory.

Question 37: In a post-breach interview program, why should investigators interview uninvolved employees in addition to suspects and victims?

Interviewing all employees is required under US federal cybersecurity law
To ensure all employees are aware the investigation is underway
Uninvolved employees may have observed behaviors or anomalies that serve as corroborating or contradictory evidence (Correct answer)
To legally establish which employees cannot be held liable

Correct answer: Uninvolved employees may have observed behaviors or anomalies that serve as corroborating or contradictory evidence

Peripheral witnesses often possess valuable contextual information or have noticed unusual behaviors they did not initially connect to the incident.

Question 38: An analyst finds a scheduled task on a compromised Windows host that runs a Base64-encoded PowerShell command at 3 AM daily. This MOST likely represents which attacker technique?

Persistence via scheduled task with obfuscated payload (Correct answer)
Privilege escalation via token impersonation
Defense evasion via log clearing
Discovery via Active Directory enumeration

Correct answer: Persistence via scheduled task with obfuscated payload

Scheduled tasks with Base64-encoded PowerShell are a common persistence mechanism that allows attackers to maintain access and execute code periodically.

Question 39: In the PEACE model of investigative interviewing, what does the 'E' stand for?

Evidence collection
Engage and Explain (Correct answer)
Elimination of suspects
Explanation of rights

Correct answer: Engage and Explain

In the PEACE model, 'E' stands for Engage and Explain, which involves building rapport with the subject and explaining the interview process.

Question 40: What is the primary purpose of an incident report in CSX operations?

To satisfy media inquiries
To assign blame to individuals
To create an official record of events for investigation, legal proceedings, and organizational learning (Correct answer)
To process insurance claims only

Correct answer: To create an official record of events for investigation, legal proceedings, and organizational learning

Incident reports serve as official, factual records of events that support investigations, legal proceedings, and organizational learning. They must be accurate, objective, timely, and thorough.

Question 41: What is the primary difference between a logical acquisition and a physical acquisition of a mobile device?

Physical acquisition only captures call logs, while logical captures all data
Logical acquisition requires rooting the device, while physical does not
Logical acquisition is faster and captures only file system data, while physical acquisition captures a bit-for-bit image of the full storage (Correct answer)
Physical acquisition is less forensically sound than logical acquisition

Correct answer: Logical acquisition is faster and captures only file system data, while physical acquisition captures a bit-for-bit image of the full storage

Logical acquisition extracts data through the OS file system layer, while physical acquisition creates a complete bit-for-bit copy of the storage chip including deleted data and unallocated space.

Question 42: Which of the following best describes a man-in-the-middle (MitM) attack?

An attacker gains physical access to a server room
An attacker intercepts and potentially alters communication between two parties (Correct answer)
An attacker floods a server with traffic to cause downtime
An attacker exploits a buffer overflow to execute code

Correct answer: An attacker intercepts and potentially alters communication between two parties

In a MitM attack, the adversary secretly intercepts and can modify communications between two parties who believe they are communicating directly.

Question 43: Why is containment important during incident response?

To slow down the internet
To reinstall the operating system
To delete compromised files immediately
To prevent further damage and spread (Correct answer)

Correct answer: To prevent further damage and spread

Containment is a critical phase in incident response aimed at limiting the scope and impact of a security incident. By isolating compromised systems or segments of the network, organizations can prevent the attack from spreading further, minimizing damage and preserving evidence for later analysis. This step is essential to prevent a localized incident from escalating into a widespread disaster.

Question 44: Which SOC staffing model involves outsourcing security monitoring to a third-party provider?

Managed Security Service Provider (MSSP) (Correct answer)
Dedicated internal SOC
Co-managed hybrid SOC
Virtual SOC with part-time staff

Correct answer: Managed Security Service Provider (MSSP)

An MSSP is an external vendor that provides outsourced SOC services, including 24/7 monitoring, alerting, and incident response support.

Question 45: A company's threat intelligence team identifies that their industry sector is being actively targeted by a nation-state group. What type of threat intelligence is this?

Strategic intelligence (Correct answer)
Tactical intelligence
Operational intelligence
Technical intelligence

Correct answer: Strategic intelligence

Strategic intelligence provides high-level information about threat actors, their motivations, and targeting trends to inform executive decision-making and long-term planning.

Question 46: Which phase of the NIST incident response lifecycle focuses on implementing lessons learned and improving defenses?

Post-Incident Activity (Correct answer)
Containment, Eradication, and Recovery
Detection and Analysis
Preparation

Correct answer: Post-Incident Activity

The Post-Incident Activity phase involves conducting a lessons-learned meeting and updating policies, procedures, and controls based on the incident.

Question 47: What does the Fourth Amendment protect against in CSX operations?

Right to bear arms
Freedom of speech
Unreasonable searches and seizures by requiring probable cause or warrants (Correct answer)
Right to legal counsel

Correct answer: Unreasonable searches and seizures by requiring probable cause or warrants

The Fourth Amendment protects individuals from unreasonable searches and seizures by the government, generally requiring probable cause and a warrant issued by a neutral judge before searches can be conducted.

Question 48: What is the first step in an incident response process?

Identification (Correct answer)
Recovery
Eradication
Containment

Correct answer: Identification

The first step in the incident response process is identification, where an organization detects and confirms that a security incident has occurred. This phase involves monitoring systems, analyzing alerts, and validating suspicious activities to determine the scope and nature of the potential breach. Accurate and timely identification is crucial for initiating an effective response.

Question 49: A security analyst writes: 'The server is vulnerable.' What is the key documentation deficiency in this statement?

It lacks specificity about which server, which vulnerability, and evidence (Correct answer)
It uses passive voice
It does not include a CVE number
It is too short

Correct answer: It lacks specificity about which server, which vulnerability, and evidence

Effective documentation requires specificity: which system is affected, what the vulnerability is, and evidence supporting the finding.

Question 50: Under the EU General Data Protection Regulation (GDPR), what is the maximum fine for the most serious violations (Tier 2)?

€50 million or 5% of global annual turnover, whichever is higher
€5 million or 1% of global annual turnover, whichever is higher
€20 million or 4% of global annual turnover, whichever is higher (Correct answer)
€10 million or 2% of global annual turnover, whichever is higher

Correct answer: €20 million or 4% of global annual turnover, whichever is higher

GDPR Tier 2 penalties for violations of core principles and data subject rights can reach €20 million or 4% of total worldwide annual turnover, whichever is higher.

Question 51: What does the principle of network segmentation primarily help prevent?

Lateral movement by attackers within the network (Correct answer)
Password brute-forcing
Denial-of-service amplification
Phishing attacks

Correct answer: Lateral movement by attackers within the network

Network segmentation limits an attacker's ability to move laterally between systems after an initial breach.

Question 52: During a forensic investigation, an analyst wants to ensure a disk image is an exact copy of the original evidence. Which method is used to verify this?

Running antivirus scans on both drives
Generating and comparing cryptographic hash values (MD5/SHA-256) of the original and copy (Correct answer)
Visually inspecting both drives for physical damage
Comparing file counts between source and destination

Correct answer: Generating and comparing cryptographic hash values (MD5/SHA-256) of the original and copy

Cryptographic hashing (MD5, SHA-1, or SHA-256) produces a unique fingerprint of the data; matching hashes on original and copy confirm bit-for-bit integrity of the forensic image.

Question 53: In CSX risk assessment, what does threat vulnerability analysis involve?

Identifying potential threats, evaluating vulnerabilities, and determining the likelihood and impact of incidents (Correct answer)
Reviewing parking lot lighting
Testing employee computer passwords only
Counting the number of security cameras

Correct answer: Identifying potential threats, evaluating vulnerabilities, and determining the likelihood and impact of incidents

Question 54: An investigator wants to obtain subscriber information from an ISP without a full search warrant. Which legal instrument is most appropriate?

Grand jury subpoena (Correct answer)
Title III wiretap order
Pen register order
Section 215 order

Correct answer: Grand jury subpoena

A grand jury subpoena (or administrative subpoena in some contexts) can compel ISPs to produce basic subscriber records such as name, address, and account information without a full search warrant.

Question 55: Which port number is associated with HTTPS traffic by default?

443 (Correct answer)
80
21
8080

Correct answer: 443

HTTPS uses port 443 by default for encrypted web traffic secured by TLS/SSL.

Question 56: What does the term 'network baseline' mean in the context of cybersecurity monitoring?

A documented record of normal network behavior used to identify anomalies (Correct answer)
The minimum password complexity requirement
The lowest acceptable firewall rule count
The default subnet mask for a Class C network

Correct answer: A documented record of normal network behavior used to identify anomalies

A network baseline captures normal traffic patterns and behavior, enabling analysts to detect deviations that may indicate an incident.

Question 57: What does the Fourth Amendment protect against in CSX operations?

Unreasonable searches and seizures by requiring probable cause or warrants (Correct answer)
Right to legal counsel
Right to bear arms
Freedom of speech

Correct answer: Unreasonable searches and seizures by requiring probable cause or warrants

Question 58: Which threat assessment methodology assigns numeric scores to threats based on damage potential, reproducibility, exploitability, affected users, and discoverability?

PASTA
DREAD (Correct answer)
OCTAVE
STRIDE

Correct answer: DREAD

DREAD is a risk-scoring model where each letter represents a rating category: Damage, Reproducibility, Exploitability, Affected users, and Discoverability.

Question 59: Why is asset classification important in threat assessment?

It speeds up network traffic
It identifies critical systems to secure first (Correct answer)
It limits user access automatically
It reduces cloud costs

Correct answer: It identifies critical systems to secure first

Asset classification involves categorizing an organization's assets based on their value, sensitivity, and criticality to business operations. This process is crucial in threat assessment because it allows security teams to prioritize protection efforts. By identifying critical systems first, resources can be allocated effectively to secure the most vital components, maximizing security posture.

Question 60: In CSX risk assessment, what does threat vulnerability analysis involve?

Counting the number of security cameras
Reviewing parking lot lighting
Identifying potential threats, evaluating vulnerabilities, and determining the likelihood and impact of incidents (Correct answer)
Testing employee computer passwords only

Correct answer: Identifying potential threats, evaluating vulnerabilities, and determining the likelihood and impact of incidents

Question 61: What is the primary purpose of a 'cognitive interview' technique in cybersecurity investigations?

To challenge the suspect's alibi with contradictory evidence
To legally compel testimony from an uncooperative witness
To enhance memory recall by reinstating the mental context of an event (Correct answer)
To detect deception through physiological monitoring

Correct answer: To enhance memory recall by reinstating the mental context of an event

The cognitive interview technique uses mental reinstatement of context and other memory-enhancing strategies to improve the accuracy and completeness of witness recall.

Question 62: During a forensic investigation, an examiner finds the Windows Registry key 'HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR'. What artifact does this reveal?

Scheduled tasks executed on the system
Installed software history
Recently accessed network shares
USB storage devices that have been connected to the system (Correct answer)

Correct answer: USB storage devices that have been connected to the system

The USBSTOR registry key records information about USB storage devices that have been connected, including device type, serial number, and timestamps.

Question 63: In Van Buren v. United States (2021), how did the Supreme Court interpret 'exceeds authorized access' under the CFAA?

It covers any access that results in financial harm to the owner
It includes any use of a computer that violates an employer's acceptable use policy
It applies whenever a user circumvents technical access controls
It is limited to accessing areas of a computer that are off-limits, not misusing access to permissible areas (Correct answer)

Correct answer: It is limited to accessing areas of a computer that are off-limits, not misusing access to permissible areas

Van Buren narrowed 'exceeds authorized access' to mean accessing parts of a system one is not permitted to access, not misusing access to areas one is already allowed to view.

Question 64: When performing a threat assessment, an analyst categorizes threats by their potential impact and likelihood. This process is best described as:

Vulnerability scanning
Penetration testing
Risk prioritization (Correct answer)
Security auditing

Correct answer: Risk prioritization

Risk prioritization involves ranking threats based on the combination of their likelihood of occurrence and the potential impact they would have if realized.

Question 65: Which of the following best describes 'minimization' as an interrogation technique?

Reducing the number of questions asked to minimize interview time
Reducing environmental distractions to improve the subject's focus
Downplaying the seriousness of the offense or offering moral justifications to make it easier for a subject to admit wrongdoing (Correct answer)
Minimizing the subject's legal rights by conducting rapid-fire questioning

Correct answer: Downplaying the seriousness of the offense or offering moral justifications to make it easier for a subject to admit wrongdoing

Minimization involves making the subject feel the offense is understandable or less serious, which can lower psychological barriers to admitting involvement.

Question 66: What is the primary purpose of a demilitarized zone (DMZ) in network security architecture?

To run antivirus scans on traffic
To monitor user authentication logs
To store encrypted backups
To isolate public-facing services from the internal network (Correct answer)

Correct answer: To isolate public-facing services from the internal network

A DMZ is a perimeter network segment that hosts public-facing services, preventing direct access to the internal network.

Question 67: Which component should be included in the methodology section of a penetration test report?

Future project proposals
Attacker CVs and certifications
Client billing information
Scope boundaries, testing phases, and tools used (Correct answer)

Correct answer: Scope boundaries, testing phases, and tools used

The methodology section documents the testing approach including scope, phases, and tools so findings can be reproduced and validated.

Question 68: Which documentation requirement is MOST critical immediately after an organization executes an active cyber defense measure?

Notifying the attacker's ISP
Creating a detailed chain-of-custody and action log (Correct answer)
Publishing a press release
Filing a patent on the defensive technique

Correct answer: Creating a detailed chain-of-custody and action log

A detailed action log and chain-of-custody record supports legal defensibility, incident review, and regulatory compliance following any active defensive measure.

Question 69: What is the primary purpose of an incident report in CSX operations?

To create an official record of events for investigation, legal proceedings, and organizational learning (Correct answer)
To assign blame to individuals
To process insurance claims only
To satisfy media inquiries

Correct answer: To create an official record of events for investigation, legal proceedings, and organizational learning

Incident reports serve as official, factual records of events that support investigations, legal proceedings, and organizational learning. They must be accurate, objective, timely, and thorough.

Question 70: Which technology is used to securely access private networks over the internet?

VPN (Correct answer)
Proxy server
Firewall
Antivirus

Correct answer: VPN

A Virtual Private Network (VPN) creates a secure, encrypted connection over a less secure network, such as the internet. It establishes a 'tunnel' that protects data in transit from eavesdropping and ensures confidentiality and integrity. This technology allows users to securely access private network resources remotely, making it essential for remote work and secure communication over public networks.

Question 71: Which metric best reflects the effectiveness of detecting cyber incidents quickly?

Mean Time to Detect (Correct answer)
Patch Time
Mean Time to Recovery
Incident Volume

Correct answer: Mean Time to Detect

Mean Time to Detect (MTTD) is a crucial metric that measures the average time it takes for an organization to identify a security incident from the moment it occurs. A lower MTTD indicates a more effective and responsive security monitoring system, allowing for quicker intervention and reduced potential damage. It directly reflects the efficiency of an organization's detection capabilities.

Question 72: During incident response, what is the PRIMARY purpose of memory forensics?

Identify misconfigured services
Recover deleted files from disk
Capture running processes, network connections, and encryption keys not stored on disk (Correct answer)
Analyze firewall rule changes

Correct answer: Capture running processes, network connections, and encryption keys not stored on disk

Memory forensics captures volatile artifacts such as running processes, open network sockets, and in-memory encryption keys that disappear when a system is powered off.

Question 73: Which passive reconnaissance technique involves capturing and analyzing network packets without sending any traffic to the target?

DNS zone transfer
Packet sniffing (Correct answer)
Banner grabbing
Port scanning

Correct answer: Packet sniffing

Packet sniffing captures traffic flowing across a network segment without transmitting any probes, making it a purely passive reconnaissance technique.

Question 74: What is the PRIMARY purpose of a post-incident review (PIR) in the context of sustaining operations?

To identify lessons learned and improve future response (Correct answer)
To satisfy regulatory reporting requirements
To calculate financial losses from the incident
To assign blame for the incident

Correct answer: To identify lessons learned and improve future response

Post-incident reviews focus on identifying what worked, what didn't, and how processes can be improved to strengthen future response.

Question 75: The Tallinn Manual 2.0 is best described as:

A non-binding scholarly analysis of how international law applies to cyber operations (Correct answer)
A binding NATO treaty governing state-sponsored cyberattacks
An ISACA policy framework for corporate cyber use of force
A US federal regulation on active cyber defense

Correct answer: A non-binding scholarly analysis of how international law applies to cyber operations

The Tallinn Manual 2.0 is a non-binding academic study produced by international law experts explaining how existing international law applies to cyber operations.

ISACA Cybersecurity Nexus (CSX) Fundamentals Certificate

The ISACA Cybersecurity Fundamentals Certificate (CSX-F) validates foundational knowledge across information security principles, the threat landscape, asset protection controls, and security operations and incident response. It is an entry-level credential for students and IT professionals entering cybersecurity.

Questions

120 min

Time Limit

65%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds