TMP Security & Risk Management 2 — Questions and Answers
Question 1: In telecommunications security, what distinguishes a 'threat' from a 'vulnerability'?
- A threat is a weakness in a system; a vulnerability is a potential harmful event
- A threat is a potential harmful event or actor; a vulnerability is a weakness that could be exploited (Correct answer)
- A threat is a documented risk; a vulnerability is an undocumented risk
- There is no practical difference between the two terms
Correct answer: A threat is a potential harmful event or actor; a vulnerability is a weakness that could be exploited
A threat is any potential event or actor that could harm a system, while a vulnerability is a specific weakness or gap that a threat can exploit to cause damage.
Question 2: Which multi-factor authentication (MFA) method is generally considered the most secure for protecting telecommunications management systems?
- SMS-based one-time password (OTP)
- Hardware security key (FIDO2/U2F) (Correct answer)
- Email-based verification code
- Security questions and answers
Correct answer: Hardware security key (FIDO2/U2F)
Hardware security keys using FIDO2/U2F are resistant to phishing and man-in-the-middle attacks because they use cryptographic verification tied to the specific site, making them the strongest commonly available MFA option.
Question 3: What is the primary security benefit of network segmentation in a telecommunications environment?
- It increases total network bandwidth
- It limits the lateral spread of an attack by isolating network zones (Correct answer)
- It eliminates the need for firewalls
- It reduces hardware procurement costs
Correct answer: It limits the lateral spread of an attack by isolating network zones
By dividing the network into isolated segments, network segmentation ensures that if one segment is compromised, attackers cannot freely move to other critical systems, containing the blast radius of a breach.
Question 4: What does SIEM stand for, and what is its role in telecommunications security?
- Secure Information and Event Management; blocks unauthorized access
- Security Information and Event Management; aggregates and analyzes log data to detect threats (Correct answer)
- System Integration and Event Monitoring; manages hardware inventory
- Signal Intelligence and Encryption Management; encrypts all network traffic
Correct answer: Security Information and Event Management; aggregates and analyzes log data to detect threats
SIEM (Security Information and Event Management) collects and correlates log data from across the network to provide real-time analysis of security events and support threat detection and compliance reporting.
Question 5: Which type of firewall provides the deepest inspection by analyzing traffic at the application layer (Layer 7)?
- Packet filtering firewall
- Stateful inspection firewall
- Next-Generation Firewall (NGFW) (Correct answer)
- Circuit-level gateway
Correct answer: Next-Generation Firewall (NGFW)
A Next-Generation Firewall (NGFW) performs deep packet inspection at the application layer, identifying applications and users rather than just ports and protocols, enabling more granular and effective security policies.
Question 6: What is the primary objective of penetration testing in a telecommunications organization?
- To install new network hardware and test its performance
- To simulate real-world attacks and identify exploitable vulnerabilities before malicious actors do (Correct answer)
- To ensure regulatory compliance with billing standards
- To benchmark network speed against industry competitors
Correct answer: To simulate real-world attacks and identify exploitable vulnerabilities before malicious actors do
Penetration testing (ethical hacking) proactively simulates attacker techniques to discover and validate vulnerabilities so organizations can remediate them before a real attack occurs.
Question 7: What does the principle of least privilege (PoLP) require in a telecommunications network management context?
- All users should have administrator-level access to maximize productivity
- Users and systems should be granted only the minimum access rights needed to perform their job functions (Correct answer)
- Network devices should operate at the lowest possible bandwidth to conserve resources
- Security patches should be applied only when absolutely necessary
Correct answer: Users and systems should be granted only the minimum access rights needed to perform their job functions
The principle of least privilege restricts user and system permissions to the bare minimum required, reducing the attack surface and limiting damage if credentials are compromised.
TMP Security & Risk Management 2
In telecommunications security, what distinguishes a 'threat' from a 'vulnerability'?