CSX Protect and Secure Systems and Data 2

Question 1

Which encryption mode is most appropriate for encrypting large amounts of data where each block must be independently decryptable?

Accepted Answer

ECB (Electronic Codebook)

Answer

ECB mode encrypts each block independently, making individual blocks decryptable without the preceding ciphertext, though it is generally not recommended for sensitive data due to pattern leakage.

Question 2

A security engineer must ensure that a database backup stored offsite cannot be read if the storage provider is compromised. Which control BEST addresses this?

Accepted Answer

Encrypting backups with a key held only by the organization

Answer

Encrypting backups with organization-held keys ensures the storage provider cannot decrypt the data even if they gain access to the files.

Question 3

What is the PRIMARY purpose of a hardware security module (HSM) in a PKI environment?

Accepted Answer

To generate and securely store cryptographic keys

Answer

An HSM provides tamper-resistant hardware for generating, storing, and managing cryptographic keys, protecting the CA's root key from extraction.

Question 4

An organization wants to prevent sensitive data from leaving the network via email attachments. Which technology is MOST directly suited?

Accepted Answer

Data Loss Prevention (DLP)

Answer

DLP solutions inspect content in motion and can block or quarantine emails containing sensitive data based on policy rules.

Question 5

Which file system permission model uses labels such as Top Secret, Secret, and Confidential to enforce access based on user clearance levels?

Accepted Answer

Mandatory Access Control (MAC)

Answer

MAC enforces access based on system-assigned labels and user clearance levels, commonly used in government and military environments.

(CSX) Cybersecurity Nexus Certification Practice Test

(CSX) Cybersecurity Nexus Certification Practice Test

CSX Protect and Secure Systems and Data 2