CSX Protect and Secure Systems and Data 3 — Questions and Answers
Question 1: An attacker exploits a software vulnerability before a patch is available. This type of attack is known as:
- Social engineering
- Zero-day exploit (Correct answer)
- Replay attack
- Man-in-the-middle attack
Correct answer: Zero-day exploit
A zero-day exploit targets a vulnerability that is unknown to the vendor or for which no patch yet exists.
Question 2: Which principle ensures that security controls applied to a system are proportional to the value and sensitivity of the data it holds?
- Defense in depth
- Least privilege
- Risk-based security (Correct answer)
- Separation of duties
Correct answer: Risk-based security
Risk-based security allocates controls according to the likelihood and impact of threats to a given asset, matching investment to actual risk.
Question 3: A server's SSL/TLS certificate expired and users receive browser warnings. Which PKI component should have triggered an alert BEFORE expiration?
- Certificate Revocation List (CRL)
- Certificate lifecycle management system (Correct answer)
- Online Certificate Status Protocol (OCSP)
- Registration Authority (RA)
Correct answer: Certificate lifecycle management system
A certificate lifecycle management system tracks expiration dates and sends renewal alerts, preventing unexpected certificate expirations.
Question 4: Which host-based control BEST prevents unauthorized software from executing on a corporate endpoint?
- Host-based firewall
- Application whitelisting (Correct answer)
- Full-disk encryption
- Log aggregation agent
Correct answer: Application whitelisting
Application whitelisting permits only pre-approved executables to run, blocking unauthorized or malicious software by default.
Question 5: During a security assessment, a tester discovers that database credentials are stored in plaintext in a configuration file. Which control directly mitigates this?
- Enable audit logging on the database
- Store credentials in a secrets management vault (Correct answer)
- Apply network segmentation around the database
- Rotate credentials on a quarterly basis
Correct answer: Store credentials in a secrets management vault
A secrets management vault stores credentials encrypted and injects them at runtime, eliminating plaintext secrets in configuration files.
Question 6: What does the concept of 'data at rest' protection primarily address?
- Encrypting data transmitted over a network
- Securing data stored on disk, databases, or backups (Correct answer)
- Hashing data before it is processed in memory
- Monitoring data accessed by users in real time
Correct answer: Securing data stored on disk, databases, or backups
Data at rest protection uses encryption and access controls to secure stored data on disks, databases, tape backups, and other storage media.
Question 7: Which vulnerability scanning approach provides the MOST comprehensive view of vulnerabilities by using system credentials during the scan?
- External unauthenticated scan
- Credentialed (authenticated) scan (Correct answer)
- Passive network traffic scan
- Port-only scan
Correct answer: Credentialed (authenticated) scan
Credentialed scans log into target systems and inspect installed software, configurations, and patch levels, surfacing vulnerabilities invisible to unauthenticated scans.
CSX Protect and Secure Systems and Data 3
An attacker exploits a software vulnerability before a patch is available.
This type of attack is known as: