CTE Cybersecurity & Risk 3

Question 1

A telecom operator's 5G core network uses APIs exposed via HTTP/2. Which OWASP category represents the highest risk for these interfaces?

Accepted Answer

Broken Object Level Authorization (BOLA)

Answer

BOLA (formerly IDOR) is the top API security risk, where attackers access objects by manipulating resource identifiers in API calls.

Question 2

What is the primary security concern with deploying Network Function Virtualization (NFV) in a telecommunications environment?

Accepted Answer

Hypervisor vulnerabilities can compromise multiple virtual network functions simultaneously

Answer

In NFV environments, a compromised hypervisor (VM escape) can expose all virtual network functions running on that physical host.

Question 3

A CTE executive is establishing a Business Continuity Plan for cybersecurity incidents. Which metric defines the maximum acceptable time to restore a critical telecom service after a breach?

Accepted Answer

Recovery Time Objective (RTO)

Answer

RTO defines the maximum acceptable duration of a service outage before it causes unacceptable business impact.

Question 4

Which type of cryptographic attack specifically targets the handshake process in TLS connections used to secure telecom management interfaces?

Accepted Answer

BEAST (Browser Exploit Against SSL/TLS)

Answer

BEAST exploits a vulnerability in TLS 1.0's CBC mode cipher implementation during the handshake to decrypt encrypted data.

Question 5

An enterprise customer reports that calls originating from their PBX are being fraudulently redirected to international premium-rate numbers. This is best described as:

Accepted Answer

Toll fraud / PBX hacking

Answer

Toll fraud via PBX hacking involves unauthorized access to a PBX system to make calls to premium-rate or international numbers at the victim's expense.

(CTE) Certified Telecommunications Executive Practice Test

(CTE) Certified Telecommunications Executive Practice Test

CTE Cybersecurity & Risk 3