ICT Cybersecurity Threats and Mitigation 5 — Questions and Answers
Question 1: Which security framework published by NIST is widely used to manage and reduce cybersecurity risk in critical infrastructure?
- ISO 27001
- NIST Cybersecurity Framework (CSF) (Correct answer)
- PCI DSS
- SOC 2
Correct answer: NIST Cybersecurity Framework (CSF)
The NIST Cybersecurity Framework provides a policy framework of computer security guidance using five functions: Identify, Protect, Detect, Respond, and Recover.
Question 2: An attacker floods a company's web server with traffic from thousands of IPs, making it inaccessible. What category of attack is this?
- Brute force attack
- Distributed Denial of Service (DDoS) (Correct answer)
- Smurf attack
- SYN flood
Correct answer: Distributed Denial of Service (DDoS)
A DDoS attack overwhelms a target server with traffic from many compromised systems simultaneously, exhausting resources and denying service to legitimate users.
Question 3: What is the primary function of a public key infrastructure (PKI)?
- To store passwords securely in a centralized database
- To manage digital certificates and public/private key pairs for secure communications (Correct answer)
- To block unauthorized network access
- To scan for malware on endpoints
Correct answer: To manage digital certificates and public/private key pairs for secure communications
PKI manages the creation, distribution, storage, and revocation of digital certificates, enabling trusted encrypted communications and identity verification.
Question 4: Which mitigation technique involves monitoring for unusual behavior patterns rather than matching known malware signatures?
- Signature-based detection
- Anomaly-based (behavioral) detection (Correct answer)
- Blacklisting
- Sandboxing
Correct answer: Anomaly-based (behavioral) detection
Anomaly-based detection establishes a baseline of normal behavior and flags deviations, making it effective against zero-day and unknown threats that signature-based tools miss.
Question 5: What does 'data exfiltration' mean in the context of a cyberattack?
- Deleting sensitive data from a victim's system
- Unauthorized transfer of data from a victim's environment to attacker-controlled infrastructure (Correct answer)
- Encrypting data to prevent access
- Corrupting database records
Correct answer: Unauthorized transfer of data from a victim's environment to attacker-controlled infrastructure
Data exfiltration is the unauthorized copying, transfer, or retrieval of data from a compromised system to a location controlled by the attacker.
Question 6: Which type of social engineering attack specifically targets high-level executives such as CEOs and CFOs?
- Vishing
- Whaling (Correct answer)
- Smishing
- Spear phishing
Correct answer: Whaling
Whaling is a highly targeted phishing attack aimed at senior executives (the 'big fish'), crafted with detailed personal information to appear convincing.
Question 7: What security measure should be applied to all sensitive data stored in a database to protect it if the database is breached?
- Data compression
- Encryption at rest (Correct answer)
- Data deduplication
- Load balancing
Correct answer: Encryption at rest
Encrypting data at rest ensures that even if an attacker gains physical or logical access to storage, the data remains unreadable without the encryption key.
ICT Cybersecurity Threats and Mitigation 5
Which security framework published by NIST is widely used to manage and reduce cybersecurity risk in critical infrastructure?