ISACA Cybersecurity Nexus (CSX) Fundamentals Certificate — Questions and Answers

Question 1: Which technique allows an attacker to hide malicious code inside a legitimate Windows process, making forensic detection more difficult?

Cross-site scripting
SQL injection
Process hollowing (Correct answer)
ARP poisoning

Correct answer: Process hollowing

Process hollowing involves creating a legitimate process in a suspended state, replacing its memory with malicious code, then resuming execution, making the malware appear as a trusted process.

Question 2: Which of the following is the most common initial step in a cyberattack?

DDoS flood
Privilege escalation
Port scanning
Phishing attack (Correct answer)

Correct answer: Phishing attack

Phishing attacks are the most common initial step in cyberattacks because they exploit human vulnerability rather than technical flaws. Attackers send deceptive emails or messages to trick individuals into revealing sensitive information or clicking malicious links, thereby gaining initial access to systems or networks. This often serves as the gateway for more sophisticated attacks, making it a prevalent starting point.

Question 3: What is 'purple teaming' in the context of cyber incident detection?

A vendor-neutral certification program
A government classification for top-secret cyber operations
A collaborative exercise where red team attackers and blue team defenders work together to improve detection capabilities (Correct answer)
A compliance framework for financial institutions

Correct answer: A collaborative exercise where red team attackers and blue team defenders work together to improve detection capabilities

Purple teaming combines offensive (red team) and defensive (blue team) functions to maximize the feedback loop and measurably improve detection and response capabilities.

Question 4: An interviewer notices a subject displays signs of anxiety only when questions relate to a specific server. What is the investigative significance?

The subject is likely just unfamiliar with technical server topics
Anxiety during any question indicates the subject is deceptive about all facts
Selective anxiety linked to a specific topic may warrant deeper inquiry into the subject's knowledge of or involvement with that server (Correct answer)
This should be disregarded unless accompanied by a verbal admission

Correct answer: Selective anxiety linked to a specific topic may warrant deeper inquiry into the subject's knowledge of or involvement with that server

Topic-specific behavioral changes can signal areas of concern worth exploring more deeply, though they must be considered alongside all other investigative information.

Question 5: An employee is suspected of stealing trade secrets via email. The company's IT team wants to capture the employee's emails without a warrant. Under what condition is this legally permissible?

Only if the employee is on probation
Only with director-level approval
Only if the employee has been notified of monitoring in the acceptable use policy (Correct answer)
Never — a warrant is always required for email access

Correct answer: Only if the employee has been notified of monitoring in the acceptable use policy

Employers may monitor company communications systems without a warrant if employees have been given prior notice (e.g., through an acceptable use policy) that monitoring may occur.

Question 6: During a forensic investigation, an analyst wants to ensure a disk image is an exact copy of the original evidence. Which method is used to verify this?

Visually inspecting both drives for physical damage
Running antivirus scans on both drives
Comparing file counts between source and destination
Generating and comparing cryptographic hash values (MD5/SHA-256) of the original and copy (Correct answer)

Correct answer: Generating and comparing cryptographic hash values (MD5/SHA-256) of the original and copy

Cryptographic hashing (MD5, SHA-1, or SHA-256) produces a unique fingerprint of the data; matching hashes on original and copy confirm bit-for-bit integrity of the forensic image.

Question 7: What does CPTED stand for in CSX security planning?

Community Protection and Emergency Defense Team
Criminal Profiling and Tactical Enforcement Division
Certified Professional Training and Education Development
Crime Prevention Through Environmental Design (Correct answer)

Correct answer: Crime Prevention Through Environmental Design

CPTED is a multi-disciplinary approach to crime prevention that uses environmental design strategies (lighting, landscaping, building layout) to reduce criminal opportunity and promote natural surveillance.

Question 8: Which of the following is an example of a 'closed question' in an investigative interview?

Did you click on the link in the email? (Correct answer)
What were you thinking when you received that email?
Tell me everything you did on the afternoon of the incident.
Walk me through your actions from the time you arrived at work.

Correct answer: Did you click on the link in the email?

Closed questions elicit a yes/no or limited factual response, as in 'Did you click on the link?', and are used strategically to confirm specific facts.

Question 9: Why is containment important during incident response?

To prevent further damage and spread (Correct answer)
To delete compromised files immediately
To slow down the internet
To reinstall the operating system

Correct answer: To prevent further damage and spread

Containment is a critical phase in incident response aimed at limiting the scope and impact of a security incident. By isolating compromised systems or segments of the network, organizations can prevent the attack from spreading further, minimizing damage and preserving evidence for later analysis. This step is essential to prevent a localized incident from escalating into a widespread disaster.

Question 10: What is the PRIMARY advantage of using threat intelligence feeds in a SOC environment?

They replace SIEM platforms
They eliminate the need for human analysts
They automatically patch vulnerabilities
They provide current IoCs and TTPs to proactively detect known threats before they cause damage (Correct answer)

Correct answer: They provide current IoCs and TTPs to proactively detect known threats before they cause damage

Threat intelligence feeds supply timely IoCs and adversary TTPs that enable SOC analysts to proactively hunt for and detect active threat campaigns in their environment.

Question 11: During malware analysis, what is the purpose of running a sample in a 'sandbox' environment?

To observe malware behavior in an isolated environment without risking production systems (Correct answer)
To permanently delete the malware from the infected system
To extract cryptographic keys from the malware
To patch vulnerabilities the malware exploits

Correct answer: To observe malware behavior in an isolated environment without risking production systems

A sandbox provides an isolated, monitored environment where malware can execute safely, allowing analysts to observe its behavior, network connections, and system modifications.

Question 12: Which of the following is a key difference between an 'event' and an 'incident' in cybersecurity?

Incidents are automatically detected; events require manual investigation
Events are always malicious; incidents may or may not be
An event is any observable occurrence; an incident is an event that negatively affects or threatens security (Correct answer)
Events are internal; incidents always involve external actors

Correct answer: An event is any observable occurrence; an incident is an event that negatively affects or threatens security

Every security incident begins as an event, but not every event becomes an incident—an incident is specifically an event with adverse security implications.

Question 13: Which approach improves readability when presenting multiple vulnerabilities in a security assessment report?

Writing each finding as an academic footnote
Sorting vulnerabilities by CVE number only
Using a structured table with columns for severity, system, and status (Correct answer)
Listing all vulnerabilities in a single paragraph

Correct answer: Using a structured table with columns for severity, system, and status

A structured table allows readers to quickly scan, filter, and prioritize vulnerabilities by severity and affected system.

Question 14: In a post-breach interview program, why should investigators interview uninvolved employees in addition to suspects and victims?

To ensure all employees are aware the investigation is underway
Uninvolved employees may have observed behaviors or anomalies that serve as corroborating or contradictory evidence (Correct answer)
Interviewing all employees is required under US federal cybersecurity law
To legally establish which employees cannot be held liable

Correct answer: Uninvolved employees may have observed behaviors or anomalies that serve as corroborating or contradictory evidence

Peripheral witnesses often possess valuable contextual information or have noticed unusual behaviors they did not initially connect to the incident.

Question 15: What security control helps mitigate ARP spoofing attacks on a local network?

Border Gateway Protocol (BGP)
Spanning Tree Protocol (STP)
Open Shortest Path First (OSPF)
Dynamic ARP Inspection (DAI) (Correct answer)

Correct answer: Dynamic ARP Inspection (DAI)

Dynamic ARP Inspection validates ARP packets against a trusted DHCP snooping binding table to prevent spoofing.

Question 16: Which type of firewall inspects traffic up to the application layer, including packet payload content?

Next-generation firewall (NGFW) (Correct answer)
Circuit-level gateway
Packet-filtering firewall
Stateless firewall

Correct answer: Next-generation firewall (NGFW)

Next-generation firewalls perform deep packet inspection at the application layer, enabling content-aware filtering.

Question 17: Which metrics are most commonly used to measure SOC effectiveness in detecting and resolving incidents?

Total number of employees in the SOC and annual training hours
Cost per security tool license and vendor renewal dates
Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) (Correct answer)
Number of tools deployed and total log volume ingested

Correct answer: Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR)

MTTD and MTTR are key performance indicators measuring how quickly threats are identified and how rapidly they are contained or resolved.

Question 18: Which attack exploits the lack of source validation in DNS to amplify traffic toward a victim?

ARP poisoning
Session hijacking
DNS amplification attack (Correct answer)
SQL injection

Correct answer: DNS amplification attack

DNS amplification attacks send forged DNS queries with the victim's IP as the source, causing large response floods.

Question 19: In CSX practice, what principle guides the use of force continuum?

Only verbal commands are permitted
Force must be proportional to the threat and escalated/de-escalated based on the subject's behavior (Correct answer)
Force is never acceptable under any circumstances
Maximum force should always be used initially

Correct answer: Force must be proportional to the threat and escalated/de-escalated based on the subject's behavior

The use of force continuum requires that force be proportional and appropriate to the threat level, with officers trained to escalate or de-escalate their response based on the subject's actions and compliance level.

Question 20: Which tier in a typical three-tier SOC structure is responsible for initial alert triage?

Tier 0 (automation layer)
Tier 2 (incident responders)
Tier 1 (alert analysts) (Correct answer)
Tier 3 (advanced threat hunters)

Correct answer: Tier 1 (alert analysts)

Tier 1 analysts handle the first line of monitoring and triage incoming alerts to determine severity before escalating to higher tiers.

Question 21: Certificate Transparency (CT) logs are useful for reconnaissance because they:

Provide WHOIS history for expired domains
Publicly record all TLS certificates issued, exposing subdomains and internal hostnames (Correct answer)
Reveal encryption keys used to protect HTTPS traffic
List all registered domain owners with contact information

Correct answer: Publicly record all TLS certificates issued, exposing subdomains and internal hostnames

CT logs require CAs to publicly log every issued certificate, enabling attackers and defenders alike to discover subdomains and infrastructure that organizations may not have intended to expose.

Question 22: What should be regularly tested to ensure operational resilience after an incident?

Marketing strategy
Employee satisfaction survey
Annual financial reports
Disaster recovery plan (Correct answer)

Correct answer: Disaster recovery plan

A Disaster Recovery Plan (DRP) outlines the procedures for an organization to recover from a disaster and restore critical IT infrastructure and operations. Regular testing of the DRP is essential to ensure its effectiveness, identify any gaps or outdated information, and confirm that the organization can indeed achieve operational resilience in the face of a real incident. Testing validates the plan's viability.

Question 23: An investigator recovers deleted files from a suspect's SSD drive. What technical factor makes SSD forensics more challenging than traditional HDD forensics?

TRIM command may have permanently erased deleted data (Correct answer)
SSDs cannot be imaged with standard tools
SSDs use proprietary encryption by default
SSD data is stored in the cloud automatically

Correct answer: TRIM command may have permanently erased deleted data

The TRIM command, when enabled on SSDs, instructs the drive to proactively erase blocks marked as deleted, potentially destroying recoverable evidence before imaging can occur.

Question 24: What is the function of a honeypot in a network security strategy?

To lure and monitor attackers in a controlled decoy environment (Correct answer)
To balance load across web servers
To back up critical data
To filter spam emails before delivery

Correct answer: To lure and monitor attackers in a controlled decoy environment

A honeypot is a decoy system designed to attract attackers, allowing defenders to observe their techniques and gather intelligence.

Question 25: When collecting evidence from a mobile device, why is it important to place it in airplane mode or a Faraday bag?

To prevent remote wiping or data modification via wireless connections (Correct answer)
To comply with FCC regulations during forensic analysis
To preserve battery life during acquisition
To speed up the data extraction process

Correct answer: To prevent remote wiping or data modification via wireless connections

Placing a mobile device in airplane mode or a Faraday bag prevents remote wipe commands or over-the-air updates from destroying evidence.

Question 26: What does the Fourth Amendment protect against in CSX operations?

Right to legal counsel
Unreasonable searches and seizures by requiring probable cause or warrants (Correct answer)
Freedom of speech
Right to bear arms

Correct answer: Unreasonable searches and seizures by requiring probable cause or warrants

The Fourth Amendment protects individuals from unreasonable searches and seizures by the government, generally requiring probable cause and a warrant issued by a neutral judge before searches can be conducted.

Question 27: What is the primary goal of a post-incident review (PIR) or lessons-learned session?

To identify what worked, what failed, and how to improve future incident response capabilities (Correct answer)
To notify affected customers about upcoming pricing changes
To calculate the full financial impact of the incident for insurance purposes
To assign individual blame and document personnel disciplinary actions

Correct answer: To identify what worked, what failed, and how to improve future incident response capabilities

A PIR analyzes the incident response process to surface improvements that strengthen detection, response, and prevention for future events.

Question 28: What is the primary function of a Security Operations Center (SOC)?

Continuously monitoring and analyzing an organization's security posture (Correct answer)
Developing new software applications
Managing human resources and employee onboarding
Performing financial audits and compliance reviews

Correct answer: Continuously monitoring and analyzing an organization's security posture

A SOC's primary function is to continuously monitor, detect, analyze, and respond to cybersecurity threats and incidents around the clock.

Question 29: What is the main security risk associated with using outdated SSL 3.0 or TLS 1.0 protocols?

They contain known vulnerabilities like POODLE and BEAST that allow traffic decryption (Correct answer)
They can only encrypt traffic under 1MB
They do not support certificate validation
They are incompatible with modern browsers

Correct answer: They contain known vulnerabilities like POODLE and BEAST that allow traffic decryption

Older SSL/TLS versions have known cryptographic weaknesses exploited by attacks like POODLE and BEAST, enabling plaintext recovery.

Question 30: Which threat assessment methodology assigns numeric scores to threats based on damage potential, reproducibility, exploitability, affected users, and discoverability?

PASTA
OCTAVE
DREAD (Correct answer)
STRIDE

Correct answer: DREAD

DREAD is a risk-scoring model where each letter represents a rating category: Damage, Reproducibility, Exploitability, Affected users, and Discoverability.

Question 31: What is a 'dead box' forensic examination?

Forensic analysis of systems that have been destroyed
Analysis of a powered-off system where the storage media is examined externally (Correct answer)
Analysis of encrypted containers without the decryption key
Examination of network traffic on an air-gapped system

Correct answer: Analysis of a powered-off system where the storage media is examined externally

Dead box forensics involves analyzing a powered-off system, typically by removing the storage media and examining it in a controlled lab environment with write blockers.

Question 32: A subject being interviewed about a ransomware attack asks whether they need a lawyer present. How should a corporate cybersecurity investigator respond?

Inform the subject that requesting a lawyer implies guilt
Continue the interview but note the request in documentation
Acknowledge the request and immediately pause the interview to allow the subject to obtain legal counsel if desired (Correct answer)
Tell the subject they do not need a lawyer since this is an internal matter

Correct answer: Acknowledge the request and immediately pause the interview to allow the subject to obtain legal counsel if desired

Respecting a subject's right to legal counsel is ethically required and protects the admissibility of any information gathered in subsequent proceedings.

Question 33: An analyst uses the Cyber Kill Chain to understand an intrusion. At which phase would credential theft using a keylogger most likely occur?

Actions on Objectives (Correct answer)
Delivery
Installation
Exploitation

Correct answer: Actions on Objectives

Credential theft via a keylogger occurs during the 'Actions on Objectives' phase, after the attacker has established access and is actively pursuing their end goal.

Question 34: Which principle describes deploying multiple overlapping security controls across different layers of the environment?

Least privilege access control
Defense in depth (Correct answer)
Security through obscurity
Zero trust architecture

Correct answer: Defense in depth

Defense in depth applies multiple security controls across network, endpoint, application, and data layers so that the failure of one control does not result in a full compromise.

Question 35: Under FISMA (Federal Information Security Modernization Act of 2014), which agency is responsible for developing federal information security standards and guidelines for non-national-security systems?

National Security Agency (NSA)
Cybersecurity and Infrastructure Security Agency (CISA)
National Institute of Standards and Technology (NIST) (Correct answer)
Office of Management and Budget (OMB)

Correct answer: National Institute of Standards and Technology (NIST)

FISMA designates NIST as the agency responsible for developing cybersecurity standards, guidelines, and recommendations (such as the NIST SP 800 series) for federal non-national-security systems.

Question 36: What is the significance of the 'MZ' magic bytes found at the beginning of a file?

The file is a Windows Portable Executable (PE) file (Correct answer)
The file is a compressed ZIP archive
The file is a Linux ELF binary
The file is an encrypted TrueCrypt container

Correct answer: The file is a Windows Portable Executable (PE) file

The 'MZ' signature (0x4D 0x5A) marks the start of a Windows Portable Executable file, named after Mark Zbikowski, one of the DOS architects who designed the format.

Question 37: Which legal authority in the United States governs the collection of foreign intelligence through electronic surveillance conducted inside the country?

Electronic Communications Privacy Act (ECPA)
Foreign Intelligence Surveillance Act (FISA) (Correct answer)
Patriot Act Section 215
Computer Fraud and Abuse Act (CFAA)

Correct answer: Foreign Intelligence Surveillance Act (FISA)

FISA establishes the legal framework and oversight procedures for electronic surveillance conducted within the US for foreign intelligence purposes, including the FISA Court approval process.

Question 38: When should an organization involve law enforcement during a cyber incident?

When the incident involves criminal activity, nation-state actors, or regulatory requirements mandate it (Correct answer)
Only when the attacker's identity is confirmed
For every security incident regardless of severity
Only after the incident is fully resolved

Correct answer: When the incident involves criminal activity, nation-state actors, or regulatory requirements mandate it

Law enforcement should be engaged when incidents involve criminal activity, critical infrastructure attacks, or regulations (like financial sector rules) require mandatory reporting.

Question 39: Which element makes a security metric 'actionable' in an operational security report?

Being tied to a specific decision or remediation activity (Correct answer)
Being collected automatically by a tool
Having a comparison to industry benchmarks
Being expressed as a percentage

Correct answer: Being tied to a specific decision or remediation activity

Actionable metrics are directly linked to decisions or actions that can reduce risk, rather than being informational statistics without follow-through.

Question 40: What is the primary purpose of an incident report in CSX operations?

To assign blame to individuals
To satisfy media inquiries
To create an official record of events for investigation, legal proceedings, and organizational learning (Correct answer)
To process insurance claims only

Correct answer: To create an official record of events for investigation, legal proceedings, and organizational learning

Incident reports serve as official, factual records of events that support investigations, legal proceedings, and organizational learning. They must be accurate, objective, timely, and thorough.

Question 41: State breach notification laws in the U.S. generally require notification to affected residents when which type of data is compromised?

Any data stored in encrypted form, regardless of exposure
Any business-critical data regardless of personal nature
Defined combinations of personal information such as name plus SSN, driver's license, or financial account numbers (Correct answer)
Only data regulated by federal laws such as HIPAA or GLBA

Correct answer: Defined combinations of personal information such as name plus SSN, driver's license, or financial account numbers

State breach notification laws typically trigger when a defined combination of personal data elements (e.g., name plus SSN, financial account, or driver's license number) is compromised.

Question 42: What is the key difference between an Indicator of Compromise (IOC) and an Indicator of Attack (IOA)?

IOCs require machine learning while IOAs use signature detection
IOCs are behavioral while IOAs are file-based
IOCs identify artifacts of past compromises while IOAs identify attacker behaviors in progress (Correct answer)
IOCs are shared externally while IOAs are kept internal

Correct answer: IOCs identify artifacts of past compromises while IOAs identify attacker behaviors in progress

IOCs (file hashes, IPs, domains) indicate a compromise has already occurred, whereas IOAs focus on real-time behaviors and TTPs that indicate an attack is actively underway.

Question 43: What is the purpose of a Security Information and Event Management (SIEM) system?

Perform automated patching
Encrypt sensitive files
Block incoming emails
Aggregate and analyze security logs (Correct answer)

Correct answer: Aggregate and analyze security logs

A Security Information and Event Management (SIEM) system centralizes and correlates security event data from various sources across an organization's IT infrastructure. Its primary purpose is to aggregate these logs, analyze them for potential security incidents, and provide real-time alerts and reporting. This enables proactive threat detection, incident response, and compliance management by offering a holistic view of security events.

Question 44: Which concept ensures that a sender cannot deny having sent a message by using digital signatures?

Integrity
Confidentiality
Non-repudiation (Correct answer)
Availability

Correct answer: Non-repudiation

Non-repudiation, achieved through digital signatures, cryptographically binds the sender to a message, preventing denial.

Question 45: What is a common method to confirm a detected security incident?

Running antivirus scans manually
Log correlation and validation (Correct answer)
Code refactoring
Full disk wipe

Correct answer: Log correlation and validation

To confirm a detected security incident, security analysts often perform log correlation and validation. This involves examining logs from multiple sources (e.g., firewalls, IDS, servers) to find corroborating evidence, identify patterns, and verify that an alert represents a genuine threat rather than a false positive. This systematic approach ensures that resources are focused on actual incidents.

Question 46: A web server log shows requests containing '../../../etc/passwd' in the URL parameter. What type of attack does this indicate?

Directory traversal (path traversal) (Correct answer)
SQL injection
Command injection
Cross-site scripting (XSS)

Correct answer: Directory traversal (path traversal)

The '../' sequences in URL parameters are signatures of directory traversal attacks, where attackers attempt to access files outside the web root.

Question 47: Which protocol operates at the network layer and is commonly exploited in IP spoofing attacks?

TCP
HTTP
IP (Correct answer)
FTP

Correct answer: IP

IP (Internet Protocol) operates at the network layer and lacks built-in authentication, making it vulnerable to spoofing attacks.

Question 48: Which hashing algorithm is currently recommended by NIST for producing a 256-bit digest?

SHA-256 (Correct answer)
MD5
SHA-1
DES

Correct answer: SHA-256

SHA-256, part of the SHA-2 family, is NIST-recommended and produces a 256-bit hash, unlike the deprecated MD5 and SHA-1.

Question 49: An organization needs to ensure users accessing a VPN from personal devices meet minimum security posture requirements. Which technology BEST enforces this?

Multi-factor authentication (MFA)
Network Access Control (NAC) (Correct answer)
VLAN segmentation
Intrusion Detection System (IDS)

Correct answer: Network Access Control (NAC)

NAC evaluates device health and compliance posture before granting network access, allowing or quarantining devices based on policy.

Question 50: An organization's critical system has an RTO of 2 hours but a hot site failover consistently takes 4 hours in tests. What should the organization do?

Accept the gap since tests differ from real incidents
Switch to a cold site to save costs
Reduce the RTO to match actual failover time
Invest in automation and pre-provisioning to close the gap (Correct answer)

Correct answer: Invest in automation and pre-provisioning to close the gap

When actual recovery time exceeds the RTO, the organization must invest in improving the process — through automation, pre-staging, or staffing — to meet the objective.

Question 51: Which technique do attackers use to blend malicious traffic with legitimate communications and avoid detection?

Privilege escalation
Credential dumping
Pass-the-hash attacks
Living off the land (LotL) and using trusted protocols like HTTPS for C2 (Correct answer)

Correct answer: Living off the land (LotL) and using trusted protocols like HTTPS for C2

Living-off-the-land techniques use trusted tools and protocols (like HTTPS, DNS) for C2 communications, making malicious traffic difficult to distinguish from legitimate traffic.

Question 52: What is the significance of hashing evidence files (e.g., MD5 or SHA-256) in a digital forensic investigation?

It compresses the evidence for storage
It indexes the evidence for faster searching
It encrypts the evidence to prevent unauthorized access
It verifies that the evidence has not been altered (Correct answer)

Correct answer: It verifies that the evidence has not been altered

Cryptographic hash values serve as digital fingerprints; identical hashes confirm that the forensic copy is bit-for-bit identical to the original and has not been tampered with.

Question 53: In a threat assessment, 'threat exposure' refers to:

The number of employees aware of a threat
The degree to which an organization's assets are accessible to identified threat actors (Correct answer)
The annual cost of a potential security breach
The time window in which a vulnerability was publicly known

Correct answer: The degree to which an organization's assets are accessible to identified threat actors

Threat exposure measures how accessible an organization's valuable assets are to potential threat actors, considering factors like attack surface and existing controls.

Question 54: Which term refers to limiting user access to only what is necessary for their job?

Zero trust
Need-to-know principle
Full access rights
Least privilege (Correct answer)

Correct answer: Least privilege

The principle of least privilege dictates that users, programs, or processes should be granted only the minimum necessary access rights to perform their legitimate functions. This security best practice minimizes the potential damage from a compromised account or system, as an attacker would have limited permissions even if they gained access. It significantly reduces the attack surface and potential impact of security incidents.

Question 55: What is the first step in an incident response process?

Recovery
Containment
Eradication
Identification (Correct answer)

Correct answer: Identification

The first step in the incident response process is identification, where an organization detects and confirms that a security incident has occurred. This phase involves monitoring systems, analyzing alerts, and validating suspicious activities to determine the scope and nature of the potential breach. Accurate and timely identification is crucial for initiating an effective response.

Question 56: What is the primary purpose of a demilitarized zone (DMZ) in network security architecture?

To isolate public-facing services from the internal network (Correct answer)
To store encrypted backups
To monitor user authentication logs
To run antivirus scans on traffic

Correct answer: To isolate public-facing services from the internal network

A DMZ is a perimeter network segment that hosts public-facing services, preventing direct access to the internal network.

Question 57: Why is asset classification important in threat assessment?

It speeds up network traffic
It reduces cloud costs
It identifies critical systems to secure first (Correct answer)
It limits user access automatically

Correct answer: It identifies critical systems to secure first

Asset classification involves categorizing an organization's assets based on their value, sensitivity, and criticality to business operations. This process is crucial in threat assessment because it allows security teams to prioritize protection efforts. By identifying critical systems first, resources can be allocated effectively to secure the most vital components, maximizing security posture.

Question 58: Which framework helps in understanding and classifying cyber threats?

ITIL
COBIT
ISO 27001
MITRE ATT&CK (Correct answer)

Correct answer: MITRE ATT&CK

The MITRE ATT&CK framework is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. It provides a structured way to understand and classify how attackers operate, enabling organizations to develop more effective threat detection, prevention, and response strategies. This framework is invaluable for mapping and analyzing cyber threats.

Question 59: What does CPTED stand for in CSX security planning?

Crime Prevention Through Environmental Design (Correct answer)
Certified Professional Training and Education Development
Criminal Profiling and Tactical Enforcement Division
Community Protection and Emergency Defense Team

Correct answer: Crime Prevention Through Environmental Design

Question 60: The principle that organizations should collect only the minimum personal data necessary to fulfill a specific purpose is known as:

Data classification
Data residency
Data sovereignty
Data minimization (Correct answer)

Correct answer: Data minimization

Data minimization is the privacy-by-design principle requiring that only data strictly necessary for the stated purpose be collected, embodied in GDPR Article 5(1)(c) and many other frameworks.

Question 61: A private sector organization wants to automatically block traffic from IP ranges associated with a nation-state threat actor. Under most use-of-force policies, automated IP blocking is classified as:

Offensive cyber operation requiring executive approval
Active defense requiring legal review
Passive defense within normal operational authority (Correct answer)
A form of armed conflict under international law

Correct answer: Passive defense within normal operational authority

Automated IP blocking is a passive defense measure—it restricts inbound traffic to your own systems without accessing, modifying, or disrupting external infrastructure.

Question 62: A use-of-force policy requires a 'sunset clause' for all emergency authorities granted during a cyber incident. What is the purpose of a sunset clause?

To grant permanent authority to the CISO after the incident
To ensure emergency powers expire automatically after a defined period unless explicitly renewed (Correct answer)
To disable logging after the incident is resolved
To prevent law enforcement from reviewing incident actions

Correct answer: To ensure emergency powers expire automatically after a defined period unless explicitly renewed

A sunset clause automatically terminates emergency authorities after a set time, preventing temporary crisis powers from becoming permanent and ensuring oversight returns to normal governance.

Question 63: Which provision of the USA PATRIOT Act significantly expanded law enforcement's ability to conduct roving wiretaps in cybercrime investigations?

Section 702
Section 206 (Correct answer)
Section 1021
Section 215

Correct answer: Section 206

Section 206 of the PATRIOT Act authorized 'roving' wiretaps that follow a specific target across multiple devices and communication services, rather than being tied to a single device.

Question 64: Which of the following BEST describes the purpose of a playbook in incident response?

A vendor contract for incident response retainer services
A log of all incidents over the past year
A predefined, step-by-step procedure for responding to a specific type of incident (Correct answer)
A list of authorized incident responders

Correct answer: A predefined, step-by-step procedure for responding to a specific type of incident

Incident response playbooks provide step-by-step procedures tailored to specific threat scenarios, ensuring consistent and efficient response.

Question 65: Which endpoint protection feature uses behavioral analysis to detect malware that has never been seen before?

Heuristic/behavioral analysis (Correct answer)
Blocklist-based filtering
Signature-based detection
Checksum verification

Correct answer: Heuristic/behavioral analysis

Heuristic and behavioral analysis monitors how code acts at runtime, enabling detection of novel or obfuscated malware that lacks known signatures.

Question 66: A financial institution collects customer data and must comply with the Gramm-Leach-Bliley Act (GLBA). Which rule specifically requires a written information security program?

Safeguards Rule (Correct answer)
Privacy Rule
Fair Information Practices Rule
Pretexting Rule

Correct answer: Safeguards Rule

The GLBA Safeguards Rule (implemented by the FTC) requires financial institutions to develop, implement, and maintain a comprehensive written information security program.

Question 67: Which action is taken during the recovery phase of incident response?

Block all IP addresses
Restore and validate system functionality (Correct answer)
Backup sensitive files
Monitor threat intelligence feeds

Correct answer: Restore and validate system functionality

During the recovery phase of incident response, the primary goal is to bring affected systems and services back to full operational status. This involves restoring data from backups, rebuilding compromised systems, and thoroughly validating their functionality and security. The aim is to ensure systems are clean, resilient, and fully operational after the incident.

Question 68: Which metric best reflects the effectiveness of detecting cyber incidents quickly?

Patch Time
Mean Time to Recovery
Mean Time to Detect (Correct answer)
Incident Volume

Correct answer: Mean Time to Detect

Mean Time to Detect (MTTD) is a crucial metric that measures the average time it takes for an organization to identify a security incident from the moment it occurs. A lower MTTD indicates a more effective and responsive security monitoring system, allowing for quicker intervention and reduced potential damage. It directly reflects the efficiency of an organization's detection capabilities.

Question 69: In CSX practice, what is the chain of custody and why is it important?

A supply chain management process
A ranking system for officers
A documented record of evidence handling from collection to court presentation, ensuring admissibility (Correct answer)
A prisoner transport protocol

Correct answer: A documented record of evidence handling from collection to court presentation, ensuring admissibility

Chain of custody is the chronological documentation of evidence collection, transfer, analysis, and storage. Any break in the chain can make evidence inadmissible in court by creating doubt about its integrity.

Question 70: Which backup rotation scheme ensures that backups are retained across daily, weekly, and monthly intervals using a minimal number of media sets?

Full-differential hybrid
Grandfather-Father-Son (GFS) (Correct answer)
3-2-1 backup rule
RAID-5 rotation

Correct answer: Grandfather-Father-Son (GFS)

The Grandfather-Father-Son (GFS) scheme uses daily (Son), weekly (Father), and monthly (Grandfather) backup sets to balance retention coverage with media efficiency.

Question 71: Which port number is associated with HTTPS traffic by default?

443 (Correct answer)
80
8080
21

Correct answer: 443

HTTPS uses port 443 by default for encrypted web traffic secured by TLS/SSL.

Question 72: What is the purpose of network access control (NAC) in a corporate environment?

Ensuring only compliant and authenticated devices connect to the network (Correct answer)
Encrypting emails
Blocking all external web traffic
Scanning for malware in email attachments

Correct answer: Ensuring only compliant and authenticated devices connect to the network

NAC enforces security policies by verifying device health and identity before granting network access.

Question 73: What does analyzing the $I30 index attribute in NTFS reveal to a forensic investigator?

Volume shadow copy metadata
Disk bad sector locations
Directory contents including potentially deleted file entries (Correct answer)
Encryption certificates used on the volume

Correct answer: Directory contents including potentially deleted file entries

The $I30 index attribute stores directory index entries, and when files are deleted, their entries may persist in the slack space of this attribute, revealing previously deleted filenames.

Question 74: What is the purpose of a threat intelligence feed in SOC operations?

To track employee productivity and workstation activity
To provide current information about known threats, IoCs, and attacker TTPs (Correct answer)
To manage software license renewals and vendor contracts
To generate financial reports on security spending and ROI

Correct answer: To provide current information about known threats, IoCs, and attacker TTPs

Threat intelligence feeds supply analysts with up-to-date indicators of compromise and adversary tactics to improve proactive detection capabilities.

Question 75: Which technique allows investigators to analyze malware behavior without contaminating the evidence drive?

Running the malware on the original system
Copying suspicious files to a USB and opening them
Analyzing the malware in an isolated sandbox environment (Correct answer)
Booting from the original drive in a VM

Correct answer: Analyzing the malware in an isolated sandbox environment

An isolated sandbox environment allows safe malware execution and behavioral analysis without risking contamination of original evidence.

ISACA Cybersecurity Nexus (CSX) Fundamentals Certificate

The ISACA Cybersecurity Fundamentals Certificate (CSX-F) validates foundational knowledge across information security principles, the threat landscape, asset protection controls, and security operations and incident response. It is an entry-level credential for students and IT professionals entering cybersecurity.

Questions

35 min

Time Limit

65%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

isaca.org — Test delivery, eligibility, fees, passing score, registration deadline, renewal, retake fee, retake policy, score release, time limit · verified Oct 2026