CSX Protect and Secure Systems and Data 2 — Questions and Answers
Question 1: Which encryption mode is most appropriate for encrypting large amounts of data where each block must be independently decryptable?
- ECB (Electronic Codebook) (Correct answer)
- CBC (Cipher Block Chaining)
- CTR (Counter Mode)
- GCM (Galois/Counter Mode)
Correct answer: ECB (Electronic Codebook)
ECB mode encrypts each block independently, making individual blocks decryptable without the preceding ciphertext, though it is generally not recommended for sensitive data due to pattern leakage.
Question 2: A security engineer must ensure that a database backup stored offsite cannot be read if the storage provider is compromised. Which control BEST addresses this?
- Hashing the backup files before transfer
- Encrypting backups with a key held only by the organization (Correct answer)
- Using RAID redundancy on the offsite server
- Applying ACLs to the backup storage container
Correct answer: Encrypting backups with a key held only by the organization
Encrypting backups with organization-held keys ensures the storage provider cannot decrypt the data even if they gain access to the files.
Question 3: What is the PRIMARY purpose of a hardware security module (HSM) in a PKI environment?
- To distribute certificates to end users
- To revoke compromised certificates automatically
- To generate and securely store cryptographic keys (Correct answer)
- To scan certificates for expiration
Correct answer: To generate and securely store cryptographic keys
An HSM provides tamper-resistant hardware for generating, storing, and managing cryptographic keys, protecting the CA's root key from extraction.
Question 4: An organization wants to prevent sensitive data from leaving the network via email attachments. Which technology is MOST directly suited?
- Intrusion Prevention System (IPS)
- Data Loss Prevention (DLP) (Correct answer)
- Security Information and Event Management (SIEM)
- Web Application Firewall (WAF)
Correct answer: Data Loss Prevention (DLP)
DLP solutions inspect content in motion and can block or quarantine emails containing sensitive data based on policy rules.
Question 5: Which file system permission model uses labels such as Top Secret, Secret, and Confidential to enforce access based on user clearance levels?
- Discretionary Access Control (DAC)
- Role-Based Access Control (RBAC)
- Mandatory Access Control (MAC) (Correct answer)
- Attribute-Based Access Control (ABAC)
Correct answer: Mandatory Access Control (MAC)
MAC enforces access based on system-assigned labels and user clearance levels, commonly used in government and military environments.
Question 6: A patch is released for a critical OS vulnerability. Before deploying to production, what step should be performed FIRST?
- Apply the patch directly to all production systems
- Test the patch in a non-production environment (Correct answer)
- Notify all end users about the upcoming change
- Archive the current OS image to cold storage
Correct answer: Test the patch in a non-production environment
Testing patches in a staging or test environment first reduces the risk of introducing instability or compatibility issues into production.
Question 7: Which network security control inspects traffic at the application layer and can filter based on application identity, not just port and IP?
- Packet-filtering firewall
- Stateful inspection firewall
- Next-generation firewall (NGFW) (Correct answer)
- Network Address Translation (NAT)
Correct answer: Next-generation firewall (NGFW)
NGFWs perform deep packet inspection at the application layer, identifying and controlling traffic by application type regardless of port used.
CSX Protect and Secure Systems and Data 2
Which encryption mode is most appropriate for encrypting large amounts of data where each block must be independently decryptable?