ISACA Cybersecurity Nexus (CSX) Fundamentals Certificate — Questions and Answers

Question 1: When assessing a threat's potential impact, which factor distinguishes a high-impact threat from a low-impact one?

Whether the attack uses encryption
The geographic location of the attacker
The time of day the attack occurs
The degree of harm to confidentiality, integrity, or availability of critical assets (Correct answer)

Correct answer: The degree of harm to confidentiality, integrity, or availability of critical assets

Impact is measured by the extent to which a threat event would harm the organization's critical assets in terms of the CIA triad: confidentiality, integrity, and availability.

Question 2: What is the function of a honeypot in a network security strategy?

To balance load across web servers
To back up critical data
To filter spam emails before delivery
To lure and monitor attackers in a controlled decoy environment (Correct answer)

Correct answer: To lure and monitor attackers in a controlled decoy environment

A honeypot is a decoy system designed to attract attackers, allowing defenders to observe their techniques and gather intelligence.

Question 3: What is 'statement analysis' used for in cybersecurity investigative interviews?

Summarizing interview findings for legal counsel
Analyzing network traffic logs for anomalies
Reviewing an employee's performance statements in HR records
Examining the content and structure of a subject's verbal or written statement for indicators of deception (Correct answer)

Correct answer: Examining the content and structure of a subject's verbal or written statement for indicators of deception

Statement analysis examines language patterns, word choice, and structural inconsistencies in a subject's account to identify potential areas of deception or omission.

Question 4: A company's threat intelligence team identifies that their industry sector is being actively targeted by a nation-state group. What type of threat intelligence is this?

Strategic intelligence (Correct answer)
Technical intelligence
Tactical intelligence
Operational intelligence

Correct answer: Strategic intelligence

Strategic intelligence provides high-level information about threat actors, their motivations, and targeting trends to inform executive decision-making and long-term planning.

Question 5: What is the function of a 'findings register' in ongoing security program documentation?

A log of employee security training completions
A centralized tracking document for open, remediated, and accepted vulnerabilities (Correct answer)
A record of firewall rule changes
A list of approved security vendors

Correct answer: A centralized tracking document for open, remediated, and accepted vulnerabilities

A findings register maintains the lifecycle status of all identified vulnerabilities, enabling organizations to track remediation progress over time.

Question 6: An analyst uses the Cyber Kill Chain to understand an intrusion. At which phase would credential theft using a keylogger most likely occur?

Actions on Objectives (Correct answer)
Delivery
Installation
Exploitation

Correct answer: Actions on Objectives

Credential theft via a keylogger occurs during the 'Actions on Objectives' phase, after the attacker has established access and is actively pursuing their end goal.

Question 7: Which type of court order specifically authorizes law enforcement to capture real-time communications content, requiring a showing of probable cause and necessity?

Pen register order
Title III wiretap order (Correct answer)
Section 2703(d) order
Administrative subpoena

Correct answer: Title III wiretap order

A Title III wiretap order under the Wiretap Act authorizes interception of real-time communications content and requires a high legal standard including probable cause and a necessity showing.

Question 8: Under the Federal Rules of Civil Procedure (FRCP), electronically stored information (ESI) that must be preserved when litigation is reasonably anticipated is protected by which legal obligation?

Discovery hold
Evidence preservation order
Chain of custody requirement
Litigation hold (legal hold) (Correct answer)

Correct answer: Litigation hold (legal hold)

A litigation hold (also called a legal hold) is the duty to preserve potentially relevant ESI and documents once litigation is reasonably anticipated, preventing spoliation.

Question 9: Which of the following BEST supports long-term sustainability of security operations after an incident?

Purchasing additional security tools after each incident
Increasing the size of the incident response team
Integrating lessons learned into updated policies, training, and controls (Correct answer)
Outsourcing security operations to a third party

Correct answer: Integrating lessons learned into updated policies, training, and controls

Sustaining operations requires feeding lessons learned back into policies, training, and technical controls to prevent recurrence and improve maturity.

Question 10: What is the significance of hashing evidence files (e.g., MD5 or SHA-256) in a digital forensic investigation?

It encrypts the evidence to prevent unauthorized access
It indexes the evidence for faster searching
It verifies that the evidence has not been altered (Correct answer)
It compresses the evidence for storage

Correct answer: It verifies that the evidence has not been altered

Cryptographic hash values serve as digital fingerprints; identical hashes confirm that the forensic copy is bit-for-bit identical to the original and has not been tampered with.

Question 11: When assessing threat likelihood, which factor most directly influences the probability that a specific threat actor will successfully exploit a vulnerability?

The age of the vulnerability
The number of users on the affected system
The threat actor's capability and motivation relative to existing controls (Correct answer)
The cost of remediation

Correct answer: The threat actor's capability and motivation relative to existing controls

Likelihood is determined by evaluating whether a threat source has the capability and intent to exploit a vulnerability given the current controls in place.

Question 12: Which hashing algorithm is currently recommended by NIST for producing a 256-bit digest?

DES
MD5
SHA-1
SHA-256 (Correct answer)

Correct answer: SHA-256

SHA-256, part of the SHA-2 family, is NIST-recommended and produces a 256-bit hash, unlike the deprecated MD5 and SHA-1.

Question 13: A security researcher accesses a company's publicly available web server to demonstrate a vulnerability without authorization. Under the CFAA, which element is most contested in this scenario?

Whether the damage threshold was met
Whether the server qualifies as a 'protected computer'
Whether the researcher acted 'without authorization' or exceeded authorized access (Correct answer)
Whether federal jurisdiction applies

Correct answer: Whether the researcher acted 'without authorization' or exceeded authorized access

The 'without authorization' or 'exceeds authorized access' element is the most contentious CFAA issue for security researchers accessing systems without explicit permission.

Question 14: Which tool is commonly used to perform memory forensics on a Windows RAM dump?

FTK Imager
Nmap
Volatility (Correct answer)
Wireshark

Correct answer: Volatility

Volatility is an open-source memory forensics framework used to extract artifacts from RAM dumps, including running processes, network connections, and injected code.

Question 15: When documenting network traffic evidence in a forensic report, which file format is the industry standard for packet captures?

.csv
.pcap / .pcapng (Correct answer)
.log
.txt

Correct answer: .pcap / .pcapng

PCAP and PCAPng are the standard formats for packet capture files, supported by tools like Wireshark and accepted in forensic proceedings.

Question 16: During incident response, what is the PRIMARY purpose of memory forensics?

Identify misconfigured services
Capture running processes, network connections, and encryption keys not stored on disk (Correct answer)
Analyze firewall rule changes
Recover deleted files from disk

Correct answer: Capture running processes, network connections, and encryption keys not stored on disk

Memory forensics captures volatile artifacts such as running processes, open network sockets, and in-memory encryption keys that disappear when a system is powered off.

Question 17: An organization wants to understand which threat actors are most likely to target them specifically. Which activity best supports this goal?

Conducting threat actor profiling using OSINT and sector-specific intelligence (Correct answer)
Performing penetration testing on the web application
Reviewing past security audit reports
Running vulnerability scans against internal systems

Correct answer: Conducting threat actor profiling using OSINT and sector-specific intelligence

Threat actor profiling uses open-source intelligence and sector-specific threat feeds to identify which adversaries have the capability, intent, and history of targeting similar organizations.

Question 18: Which component should be included in the methodology section of a penetration test report?

Scope boundaries, testing phases, and tools used (Correct answer)
Attacker CVs and certifications
Client billing information
Future project proposals

Correct answer: Scope boundaries, testing phases, and tools used

The methodology section documents the testing approach including scope, phases, and tools so findings can be reproduced and validated.

Question 19: When acquiring memory from a running system, which tool is most commonly used in Windows environments?

Autopsy
WinPmem (Correct answer)
dd
Wireshark

Correct answer: WinPmem

WinPmem is a widely used Windows memory acquisition tool that can capture a full RAM dump for forensic analysis.

Question 20: What is the purpose of a threat intelligence feed in SOC operations?

To manage software license renewals and vendor contracts
To track employee productivity and workstation activity
To provide current information about known threats, IoCs, and attacker TTPs (Correct answer)
To generate financial reports on security spending and ROI

Correct answer: To provide current information about known threats, IoCs, and attacker TTPs

Threat intelligence feeds supply analysts with up-to-date indicators of compromise and adversary tactics to improve proactive detection capabilities.

Question 21: Certificate Transparency (CT) logs are useful for reconnaissance because they:

Reveal encryption keys used to protect HTTPS traffic
List all registered domain owners with contact information
Publicly record all TLS certificates issued, exposing subdomains and internal hostnames (Correct answer)
Provide WHOIS history for expired domains

Correct answer: Publicly record all TLS certificates issued, exposing subdomains and internal hostnames

CT logs require CAs to publicly log every issued certificate, enabling attackers and defenders alike to discover subdomains and infrastructure that organizations may not have intended to expose.

Question 22: When performing a threat assessment, an analyst categorizes threats by their potential impact and likelihood. This process is best described as:

Risk prioritization (Correct answer)
Penetration testing
Vulnerability scanning
Security auditing

Correct answer: Risk prioritization

Risk prioritization involves ranking threats based on the combination of their likelihood of occurrence and the potential impact they would have if realized.

Question 23: An examiner is analyzing a Windows system and wants to determine recently opened files. Which artifact provides this information?

Shadow Volume Copies
Jump Lists and LNK files (Correct answer)
The pagefile.sys
The hibernation file (hiberfil.sys)

Correct answer: Jump Lists and LNK files

Jump Lists and LNK (shortcut) files in Windows record recently accessed files and applications, providing valuable timeline artifacts.

Question 24: What is the significance of the 'MZ' magic bytes found at the beginning of a file?

The file is a Windows Portable Executable (PE) file (Correct answer)
The file is an encrypted TrueCrypt container
The file is a compressed ZIP archive
The file is a Linux ELF binary

Correct answer: The file is a Windows Portable Executable (PE) file

The 'MZ' signature (0x4D 0x5A) marks the start of a Windows Portable Executable file, named after Mark Zbikowski, one of the DOS architects who designed the format.

Question 25: Which of the following best describes a man-in-the-middle (MitM) attack?

An attacker intercepts and potentially alters communication between two parties (Correct answer)
An attacker floods a server with traffic to cause downtime
An attacker gains physical access to a server room
An attacker exploits a buffer overflow to execute code

Correct answer: An attacker intercepts and potentially alters communication between two parties

In a MitM attack, the adversary secretly intercepts and can modify communications between two parties who believe they are communicating directly.

Question 26: Which technique do attackers use to blend malicious traffic with legitimate communications and avoid detection?

Credential dumping
Privilege escalation
Living off the land (LotL) and using trusted protocols like HTTPS for C2 (Correct answer)
Pass-the-hash attacks

Correct answer: Living off the land (LotL) and using trusted protocols like HTTPS for C2

Living-off-the-land techniques use trusted tools and protocols (like HTTPS, DNS) for C2 communications, making malicious traffic difficult to distinguish from legitimate traffic.

Question 27: An interviewer notices a subject displays signs of anxiety only when questions relate to a specific server. What is the investigative significance?

The subject is likely just unfamiliar with technical server topics
Anxiety during any question indicates the subject is deceptive about all facts
Selective anxiety linked to a specific topic may warrant deeper inquiry into the subject's knowledge of or involvement with that server (Correct answer)
This should be disregarded unless accompanied by a verbal admission

Correct answer: Selective anxiety linked to a specific topic may warrant deeper inquiry into the subject's knowledge of or involvement with that server

Topic-specific behavioral changes can signal areas of concern worth exploring more deeply, though they must be considered alongside all other investigative information.

Question 28: What is the primary goal of a post-incident review (PIR) or lessons-learned session?

To assign individual blame and document personnel disciplinary actions
To identify what worked, what failed, and how to improve future incident response capabilities (Correct answer)
To calculate the full financial impact of the incident for insurance purposes
To notify affected customers about upcoming pricing changes

Correct answer: To identify what worked, what failed, and how to improve future incident response capabilities

A PIR analyzes the incident response process to surface improvements that strengthen detection, response, and prevention for future events.

Question 29: What is the primary purpose of an incident report in CSX operations?

To satisfy media inquiries
To assign blame to individuals
To process insurance claims only
To create an official record of events for investigation, legal proceedings, and organizational learning (Correct answer)

Correct answer: To create an official record of events for investigation, legal proceedings, and organizational learning

Incident reports serve as official, factual records of events that support investigations, legal proceedings, and organizational learning. They must be accurate, objective, timely, and thorough.

Question 30: What is the primary purpose of log retention policies in a SOC?

To automate security patch deployment across endpoints
To reduce the cost of analyst salaries by limiting the data they review
To ensure logs remain available for incident investigation, forensic analysis, and compliance requirements (Correct answer)
To improve real-time network performance by purging old data

Correct answer: To ensure logs remain available for incident investigation, forensic analysis, and compliance requirements

Log retention policies define how long logs must be preserved to support after-the-fact investigations, forensic analysis, and regulatory compliance mandates.

Question 31: Which term refers to limiting user access to only what is necessary for their job?

Need-to-know principle
Zero trust
Least privilege (Correct answer)
Full access rights

Correct answer: Least privilege

The principle of least privilege dictates that users, programs, or processes should be granted only the minimum necessary access rights to perform their legitimate functions. This security best practice minimizes the potential damage from a compromised account or system, as an attacker would have limited permissions even if they gained access. It significantly reduces the attack surface and potential impact of security incidents.

Question 32: Which containment strategy allows investigation to continue while limiting attacker movement?

Immediately reimaging all affected machines
Blocking all outbound traffic at the perimeter
Network segmentation and isolation of compromised hosts (Correct answer)
Hard shutdown of affected systems

Correct answer: Network segmentation and isolation of compromised hosts

Network segmentation isolates compromised systems to prevent spread while keeping them online for forensic investigation.

Question 33: A federal agency seeks real-time GPS tracking of a suspect's vehicle without a warrant. Which Supreme Court ruling is most directly relevant to this scenario?

Terry v. Ohio (1968)
United States v. Jones (2012) (Correct answer)
Carpenter v. United States (2018)
Herring v. United States (2009)

Correct answer: United States v. Jones (2012)

United States v. Jones held that attaching a GPS device to a vehicle constitutes a Fourth Amendment search, requiring a warrant.

Question 34: What is the primary goal of a Business Email Compromise (BEC) attack?

Exfiltrating email database contents
Disrupting email services through spam flooding
Manipulating employees into fraudulent wire transfers or credential disclosure (Correct answer)
Installing ransomware on corporate servers

Correct answer: Manipulating employees into fraudulent wire transfers or credential disclosure

BEC attacks use social engineering via spoofed or compromised executive email accounts to trick employees into transferring funds or revealing sensitive information.

Question 35: An analyst is reviewing NetFlow data and notices a host sending 50MB to an external IP but only receiving 2KB in return. What does this asymmetric pattern MOST likely indicate?

Normal web browsing behavior
Data exfiltration from the internal host to an external server (Correct answer)
A DDoS attack targeting the internal host
An incoming phishing email delivery

Correct answer: Data exfiltration from the internal host to an external server

Significantly higher outbound than inbound traffic to an unfamiliar external IP is a classic data exfiltration pattern, as stolen data is being sent out.

Question 36: What is a key security advantage of using VLANs in enterprise network design?

They eliminate the need for authentication protocols
They encrypt all inter-VLAN traffic by default
They logically separate broadcast domains to limit exposure (Correct answer)
They replace the need for firewalls

Correct answer: They logically separate broadcast domains to limit exposure

VLANs create logical network segments that contain broadcast traffic and reduce the attack surface between different user groups.

Question 37: Which type of backup strategy captures only data that has changed since the LAST FULL backup?

Mirror backup
Differential backup (Correct answer)
Incremental backup
Snapshot backup

Correct answer: Differential backup

A differential backup copies all data changed since the last full backup, making restoration require only two sets: the full backup and the latest differential.

Question 38: What is a major benefit of system redundancy in recovery planning?

Reduces patching efforts
Improves backup compression
Increases attack surface
Ensures high availability (Correct answer)

Correct answer: Ensures high availability

System redundancy involves duplicating critical components or systems to provide a backup in case of failure. A major benefit in recovery planning is that it ensures high availability, meaning that if one component fails, another can immediately take over. This minimizes downtime and maintains continuous operation, significantly improving an organization's resilience against disruptions.

Question 39: What does analyzing the $I30 index attribute in NTFS reveal to a forensic investigator?

Directory contents including potentially deleted file entries (Correct answer)
Volume shadow copy metadata
Disk bad sector locations
Encryption certificates used on the volume

Correct answer: Directory contents including potentially deleted file entries

The $I30 index attribute stores directory index entries, and when files are deleted, their entries may persist in the slack space of this attribute, revealing previously deleted filenames.

Question 40: Which NIST framework function is most directly associated with identifying cybersecurity threats before they cause harm?

Identify (Correct answer)
Respond
Protect
Recover

Correct answer: Identify

The NIST 'Identify' function focuses on developing organizational understanding to manage cybersecurity risk, including asset management and risk assessment.

Question 41: An organization identifies that a former employee still has active VPN credentials. In threat assessment terms, this represents:

A vulnerability that increases the likelihood of an insider threat being realized (Correct answer)
A deterrent control weakness
A threat agent with no access vector
An acceptable residual risk

Correct answer: A vulnerability that increases the likelihood of an insider threat being realized

Active credentials for a former employee create a vulnerability — an exploitable weakness — that could be used by a malicious insider or someone who obtains those credentials.

Question 42: When collecting evidence from a mobile device, why is it important to place it in airplane mode or a Faraday bag?

To comply with FCC regulations during forensic analysis
To prevent remote wiping or data modification via wireless connections (Correct answer)
To speed up the data extraction process
To preserve battery life during acquisition

Correct answer: To prevent remote wiping or data modification via wireless connections

Placing a mobile device in airplane mode or a Faraday bag prevents remote wipe commands or over-the-air updates from destroying evidence.

Question 43: What is 'purple teaming' in the context of cyber incident detection?

A vendor-neutral certification program
A collaborative exercise where red team attackers and blue team defenders work together to improve detection capabilities (Correct answer)
A compliance framework for financial institutions
A government classification for top-secret cyber operations

Correct answer: A collaborative exercise where red team attackers and blue team defenders work together to improve detection capabilities

Purple teaming combines offensive (red team) and defensive (blue team) functions to maximize the feedback loop and measurably improve detection and response capabilities.

Question 44: What is the purpose of a Security Information and Event Management (SIEM) system?

Encrypt sensitive files
Block incoming emails
Perform automated patching
Aggregate and analyze security logs (Correct answer)

Correct answer: Aggregate and analyze security logs

A Security Information and Event Management (SIEM) system centralizes and correlates security event data from various sources across an organization's IT infrastructure. Its primary purpose is to aggregate these logs, analyze them for potential security incidents, and provide real-time alerts and reporting. This enables proactive threat detection, incident response, and compliance management by offering a holistic view of security events.

Question 45: Which metric best reflects the effectiveness of detecting cyber incidents quickly?

Patch Time
Incident Volume
Mean Time to Recovery
Mean Time to Detect (Correct answer)

Correct answer: Mean Time to Detect

Mean Time to Detect (MTTD) is a crucial metric that measures the average time it takes for an organization to identify a security incident from the moment it occurs. A lower MTTD indicates a more effective and responsive security monitoring system, allowing for quicker intervention and reduced potential damage. It directly reflects the efficiency of an organization's detection capabilities.

Question 46: In a threat assessment, 'threat exposure' refers to:

The number of employees aware of a threat
The annual cost of a potential security breach
The time window in which a vulnerability was publicly known
The degree to which an organization's assets are accessible to identified threat actors (Correct answer)

Correct answer: The degree to which an organization's assets are accessible to identified threat actors

Threat exposure measures how accessible an organization's valuable assets are to potential threat actors, considering factors like attack surface and existing controls.

Question 47: A forensic examiner receives a hard drive from law enforcement. What should be the FIRST step before any analysis?

Run antivirus scans
Install forensic software on the drive
Create a bit-for-bit forensic image (Correct answer)
Index all files for keyword searching

Correct answer: Create a bit-for-bit forensic image

Creating a bit-for-bit forensic image preserves the original evidence and ensures the original drive is not modified during analysis.

Question 48: What is the first step in an incident response process?

Eradication
Recovery
Identification (Correct answer)
Containment

Correct answer: Identification

The first step in the incident response process is identification, where an organization detects and confirms that a security incident has occurred. This phase involves monitoring systems, analyzing alerts, and validating suspicious activities to determine the scope and nature of the potential breach. Accurate and timely identification is crucial for initiating an effective response.

Question 49: A business continuity plan (BCP) differs from a disaster recovery plan (DRP) in that the BCP primarily focuses on:

Identifying and patching vulnerabilities
Backing up data to alternate locations
Restoring IT systems after a failure
Maintaining critical business functions during a disruption (Correct answer)

Correct answer: Maintaining critical business functions during a disruption

A BCP covers maintaining essential business operations during any disruption, while a DRP specifically addresses IT system recovery.

Question 50: State breach notification laws in the U.S. generally require notification to affected residents when which type of data is compromised?

Any business-critical data regardless of personal nature
Only data regulated by federal laws such as HIPAA or GLBA
Defined combinations of personal information such as name plus SSN, driver's license, or financial account numbers (Correct answer)
Any data stored in encrypted form, regardless of exposure

Correct answer: Defined combinations of personal information such as name plus SSN, driver's license, or financial account numbers

State breach notification laws typically trigger when a defined combination of personal data elements (e.g., name plus SSN, financial account, or driver's license number) is compromised.

Question 51: A healthcare organization experiences a breach of unsecured PHI affecting 600 individuals. Under HIPAA, the breach notification deadline to the Department of Health and Human Services (HHS) is:

Within 60 days of discovery
Within 30 days of discovery
Within 60 days of the end of the calendar year in which the breach occurred (Correct answer)
Immediately upon discovery

Correct answer: Within 60 days of the end of the calendar year in which the breach occurred

For breaches affecting fewer than 500 individuals, HIPAA requires notification to HHS no later than 60 days after the end of the calendar year in which the breach occurred.

Question 52: Which protocol operates at the network layer and is commonly exploited in IP spoofing attacks?

IP (Correct answer)
HTTP
FTP
TCP

Correct answer: IP

IP (Internet Protocol) operates at the network layer and lacks built-in authentication, making it vulnerable to spoofing attacks.

Question 53: What is the difference between data in transit and data at rest, and which requires TLS as a protection?

Data in transit requires TLS; data at rest uses encryption like AES-256 (Correct answer)
Data at rest requires TLS; data in transit requires AES
Neither requires encryption under US law
Both require TLS with no distinction

Correct answer: Data in transit requires TLS; data at rest uses encryption like AES-256

TLS protects data in transit (moving across networks), while data at rest is protected using storage encryption like AES-256.

Question 54: Which cryptographic concept ensures that even if one session key is compromised, past session keys remain secure?

Perfect Forward Secrecy (PFS) (Correct answer)
Key derivation function (KDF)
Key stretching
Certificate transparency

Correct answer: Perfect Forward Secrecy (PFS)

Perfect Forward Secrecy generates ephemeral session keys so that compromise of a long-term key does not expose past communications.

Question 55: What is the purpose of a 'proof of concept' section in a vulnerability report?

To showcase the tester's programming skills
To demonstrate that the vulnerability is exploitable and reproducible (Correct answer)
To provide source code for the client to reuse
To estimate the cost of exploitation

Correct answer: To demonstrate that the vulnerability is exploitable and reproducible

A proof of concept demonstrates real exploitability, helping the client understand severity and prioritize remediation over theoretical risks.

Question 56: What is the main security risk associated with using outdated SSL 3.0 or TLS 1.0 protocols?

They do not support certificate validation
They are incompatible with modern browsers
They can only encrypt traffic under 1MB
They contain known vulnerabilities like POODLE and BEAST that allow traffic decryption (Correct answer)

Correct answer: They contain known vulnerabilities like POODLE and BEAST that allow traffic decryption

Older SSL/TLS versions have known cryptographic weaknesses exploited by attacks like POODLE and BEAST, enabling plaintext recovery.

Question 57: Which NIST CSF function is MOST closely associated with restoring services impaired during a cybersecurity incident?

Identify
Detect
Recover (Correct answer)
Protect

Correct answer: Recover

The NIST CSF 'Recover' function encompasses activities to restore capabilities or services impaired due to a cybersecurity incident.

Question 58: What is a 'threat indicator' in the context of cyber incident detection?

A risk rating assigned by a security vendor
An observable artifact such as an IP, domain, hash, or behavior associated with malicious activity (Correct answer)
A user's anomalous login time
A vulnerability score from CVSS

Correct answer: An observable artifact such as an IP, domain, hash, or behavior associated with malicious activity

Threat indicators (also called IoCs) are observable artifacts—IPs, domains, file hashes, registry keys—linked to known malicious activity used to detect threats.

Question 59: Under the EU General Data Protection Regulation (GDPR), what is the maximum fine for the most serious violations (Tier 2)?

€5 million or 1% of global annual turnover, whichever is higher
€20 million or 4% of global annual turnover, whichever is higher (Correct answer)
€50 million or 5% of global annual turnover, whichever is higher
€10 million or 2% of global annual turnover, whichever is higher

Correct answer: €20 million or 4% of global annual turnover, whichever is higher

GDPR Tier 2 penalties for violations of core principles and data subject rights can reach €20 million or 4% of total worldwide annual turnover, whichever is higher.

Question 60: What Windows artifact tracks the last 10 files opened per application and is stored in the user's AppData folder?

Prefetch files
Jump Lists (Correct answer)
Registry UserAssist keys
Volume Shadow Copies

Correct answer: Jump Lists

Jump Lists are Windows artifacts stored in AppData that record recently and frequently accessed files per application, providing evidence of user file access activity.

Question 61: A zero-day vulnerability is particularly dangerous primarily because:

No patch or mitigation exists at the time of its exploitation (Correct answer)
It requires physical access to exploit
Antivirus software can always detect it
It only affects outdated operating systems

Correct answer: No patch or mitigation exists at the time of its exploitation

Zero-day vulnerabilities are dangerous because they are unknown to the vendor, meaning no patch exists and defenders have no advance warning to prepare.

Question 62: An analyst finds a scheduled task on a compromised Windows host that runs a Base64-encoded PowerShell command at 3 AM daily. This MOST likely represents which attacker technique?

Discovery via Active Directory enumeration
Defense evasion via log clearing
Privilege escalation via token impersonation
Persistence via scheduled task with obfuscated payload (Correct answer)

Correct answer: Persistence via scheduled task with obfuscated payload

Scheduled tasks with Base64-encoded PowerShell are a common persistence mechanism that allows attackers to maintain access and execute code periodically.

Question 63: What is a 'preservation letter' (or evidence preservation request) used for in cybercrime investigations?

Requiring a provider to retain specific data while legal process is obtained (Correct answer)
Certifying that evidence has been properly hashed
Authorizing law enforcement to access stored data immediately
Notifying the suspect that data has been seized

Correct answer: Requiring a provider to retain specific data while legal process is obtained

Under 18 U.S.C. § 2703(f), law enforcement can request that a service provider preserve specific records while full legal process (subpoena or warrant) is being obtained.

Question 64: Maltego is primarily used by security practitioners for:

Brute-forcing authentication credentials
Visualizing relationships between entities during OSINT investigations (Correct answer)
Fuzzing web application inputs
Scanning networks for open ports

Correct answer: Visualizing relationships between entities during OSINT investigations

Maltego transforms raw OSINT data into graphical link charts that reveal relationships between people, domains, IP addresses, and organizations.

Question 65: During a forensic investigation, an examiner finds the Windows Registry key 'HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR'. What artifact does this reveal?

Scheduled tasks executed on the system
Recently accessed network shares
USB storage devices that have been connected to the system (Correct answer)
Installed software history

Correct answer: USB storage devices that have been connected to the system

The USBSTOR registry key records information about USB storage devices that have been connected, including device type, serial number, and timestamps.

Question 66: In cloud forensics, what is a significant challenge compared to traditional on-premises forensics?

Cloud data cannot be hashed for integrity verification
Cloud providers do not maintain any logs
Cloud storage uses different file systems than local drives
Evidence may be distributed across multiple jurisdictions and controlled by a third party (Correct answer)

Correct answer: Evidence may be distributed across multiple jurisdictions and controlled by a third party

Cloud forensics is complicated by data being distributed across servers in multiple geographic jurisdictions and controlled by cloud service providers, creating legal and technical access challenges.

Question 67: A server's SSL/TLS certificate expired and users receive browser warnings. Which PKI component should have triggered an alert BEFORE expiration?

Registration Authority (RA)
Online Certificate Status Protocol (OCSP)
Certificate Revocation List (CRL)
Certificate lifecycle management system (Correct answer)

Correct answer: Certificate lifecycle management system

A certificate lifecycle management system tracks expiration dates and sends renewal alerts, preventing unexpected certificate expirations.

Question 68: What is the forensic significance of the Windows 'LNK' shortcut file format?

LNK files record every keystroke made while the target application was open
LNK files store encryption keys for associated documents
LNK files are only created for network-accessed files
LNK files contain metadata about the target file including MAC timestamps and volume serial number, even if the target has been deleted (Correct answer)

Correct answer: LNK files contain metadata about the target file including MAC timestamps and volume serial number, even if the target has been deleted

Windows LNK shortcut files preserve metadata about the target file including creation/modification timestamps, file size, and volume information that can remain even after the target is deleted.

Question 69: Which of the following is an example of a supply chain threat?

An employee clicking a phishing link
A brute-force attack on an RDP port
Malicious code inserted into a software vendor's update package (Correct answer)
A misconfigured firewall rule

Correct answer: Malicious code inserted into a software vendor's update package

Supply chain threats occur when attackers compromise a trusted third-party vendor or software to gain access to downstream targets, as seen in the SolarWinds attack.

Question 70: Which log source is MOST useful for detecting lateral movement within a Windows environment?

Windows Security Event logs (Event ID 4624/4648) (Correct answer)
DNS query logs
Firewall deny logs
Web proxy logs

Correct answer: Windows Security Event logs (Event ID 4624/4648)

Windows Security Event IDs 4624 (logon) and 4648 (explicit credential logon) reveal authentication patterns indicative of lateral movement.

Question 71: Which action is taken during the recovery phase of incident response?

Backup sensitive files
Block all IP addresses
Restore and validate system functionality (Correct answer)
Monitor threat intelligence feeds

Correct answer: Restore and validate system functionality

During the recovery phase of incident response, the primary goal is to bring affected systems and services back to full operational status. This involves restoring data from backups, rebuilding compromised systems, and thoroughly validating their functionality and security. The aim is to ensure systems are clean, resilient, and fully operational after the incident.

Question 72: What does a 'beaconing' pattern in network traffic MOST likely indicate?

Normal software update polling
A port scan in progress
Malware regularly checking in with a command-and-control server (Correct answer)
A misconfigured NTP server

Correct answer: Malware regularly checking in with a command-and-control server

Beaconing refers to malware making periodic, regular outbound connections to a C2 server to receive instructions or exfiltrate data.

Question 73: What security control helps mitigate ARP spoofing attacks on a local network?

Open Shortest Path First (OSPF)
Border Gateway Protocol (BGP)
Dynamic ARP Inspection (DAI) (Correct answer)
Spanning Tree Protocol (STP)

Correct answer: Dynamic ARP Inspection (DAI)

Dynamic ARP Inspection validates ARP packets against a trusted DHCP snooping binding table to prevent spoofing.

Question 74: What is the role of a 'chain of custody' during incident response?

To track the handling of digital evidence to ensure its integrity and admissibility (Correct answer)
To document the escalation path for incident reporting
To prioritize which systems to restore first
To assign response tasks to team members

Correct answer: To track the handling of digital evidence to ensure its integrity and admissibility

Chain of custody documents who handled evidence, when, and how, ensuring its integrity is maintained for potential legal proceedings.

Question 75: What role does 'active listening' play in a cybersecurity investigative interview?

It allows the interviewer to plan the next question without appearing distracted
It is only relevant in victim interviews, not suspect interviews
It demonstrates genuine engagement, builds rapport, and helps the interviewer identify inconsistencies and follow-up opportunities in real time (Correct answer)
It is a legal requirement to show the subject the interview is being fairly conducted

Correct answer: It demonstrates genuine engagement, builds rapport, and helps the interviewer identify inconsistencies and follow-up opportunities in real time

Active listening improves rapport, signals respect for the subject, and helps interviewers catch subtle inconsistencies or opportunities for productive follow-up in real time.

ISACA Cybersecurity Nexus (CSX) Fundamentals Certificate

The ISACA Cybersecurity Fundamentals Certificate (CSX-F) validates foundational knowledge across information security principles, the threat landscape, asset protection controls, and security operations and incident response. It is an entry-level credential for students and IT professionals entering cybersecurity.

Questions

120 min

Time Limit

65%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds