ISC CISSP Certified Information Systems Security Professional Exam Dumps and Practice Test Questions Set 12 Q166-180
Visit here for our full ISC CISSP exam dumps and practice test questions.
Question 166:
Which security principle requires that users and processes operate only with the privileges necessary to perform their tasks?
A) Separation of Duties
B) Least Privilege
C) Defense in Depth
D) Need-to-Know
Answer: B
Explanation:
The principle of Least Privilege is a foundational concept in cybersecurity, system administration, and secure software design. It mandates that users, applications, or processes are granted only the minimum permissions required to perform their legitimate tasks and no more. This approach ensures that every action within a system operates under the principle of restriction and accountability, minimizing the attack surface, reducing potential damage in the event of compromise, and preventing accidental or intentional misuse of privileges.
Implementing least privilege requires a systematic assessment of roles, responsibilities, and required resources within an organization. Role-Based Access Control (RBAC) is commonly used in conjunction with least privilege, assigning permissions according to job functions rather than granting blanket access. For instance, a payroll clerk may have read/write access to employee salary records but no access to the IT configuration files, while an IT administrator may have system-level access but not personal employee records. This segregation ensures that compromise of one account or process does not cascade into unauthorized access across unrelated systems.
Least privilege also plays a critical role in securing processes and applications. Service accounts, APIs, or automated scripts should operate with only the permissions needed for their function. For example, a web server serving public content does not require administrative privileges over the database server; granting such access unnecessarily increases vulnerability to attacks. Just-in-time (JIT) access provisioning further enhances security by allowing elevated privileges only for a limited time and for specific tasks, reducing exposure windows and auditing risk.
From a cybersecurity perspective, least privilege mitigates the impact of malware, ransomware, insider threats, and phishing attacks. If a compromised account has minimal permissions, the attacker’s ability to move laterally across the network, access sensitive data, or install malicious software is significantly reduced. Regulatory standards such as PCI DSS, HIPAA, NIST SP 800-53, and ISO 27001 explicitly reference least privilege as a requirement, emphasizing its role in compliance and organizational risk management.
Implementation challenges include accurately mapping roles and responsibilities, regularly reviewing permissions, and ensuring that least privilege does not interfere with productivity. Access reviews, automated auditing tools, and adherence to the principle of separation of duties complement least privilege, creating a layered and enforceable security posture.
By reducing the attack surface, limiting potential damage, and supporting compliance, it is a core principle of secure system design. The correct answer is Least Privilege.
Question 167:
Which type of malware replicates by attaching itself to legitimate files?
A) Virus
B) Worm
C) Trojan
D) Spyware
Answer: A
Explanation:
A computer virus is a type of malware designed to attach itself to executable files, documents, or other host files and propagate when these files are executed. Unlike worms, which can self-replicate autonomously across networks, or Trojans, which rely on user deception and execution, viruses require a host file to spread. This makes them highly dependent on human action or system behavior to infect new environments, but also capable of deeply integrating into systems to disrupt operations or steal information.
Viruses operate by modifying the host file or injecting malicious code segments that execute when the host file runs. Common types include file infectors, boot sector viruses, macro viruses, and polymorphic viruses that change their code to evade detection. Viruses can corrupt files, alter system configurations, degrade performance, or create vulnerabilities that other malware can exploit. For example, a macro virus in a Word document can automatically send infected copies to email contacts, silently spreading through corporate networks.
Detection and prevention rely on a combination of strategies, including signature-based antivirus scanning, heuristic analysis, behavioral monitoring, and secure file handling practices. Keeping software up to date, disabling unnecessary macros, and training users to recognize suspicious files further reduce virus propagation. While the threat of viruses has evolved with modern cybersecurity practices, they remain relevant, especially in environments where outdated systems, removable media, or legacy applications are used.
Viruses also illustrate the importance of security awareness and layered defenses. Even a single infected file can compromise multiple systems if it is executed in privileged environments or shared widely. Therefore, integrating endpoint protection, intrusion detection systems, backup strategies, and incident response plans is critical for minimizing the impact of viral infections.
In summary, viruses attach to legitimate files and propagate when these files are executed, potentially causing system corruption, data loss, or further malware deployment. Their dependence on user interaction distinguishes them from worms and Trojans, and understanding their behavior is essential for effective defense. The correct answer is Virus.
Question 168:
Which cloud service model abstracts infrastructure and allows developers to focus on deploying applications?
A) IaaS
B) PaaS
C) SaaS
D) FaaS
Answer: B
Explanation:
Platform as a Service (PaaS) is a cloud computing model that abstracts infrastructure management and provides developers with a complete environment for building, deploying, and managing applications. Unlike Infrastructure as a Service (IaaS), where users must provision virtual machines, storage, and networking, or Software as a Service (SaaS), which delivers fully managed applications, PaaS focuses on the application development lifecycle, enabling developers to concentrate on code, functionality, and user experience.
PaaS environments typically include runtime environments, application servers, databases, middleware, development tools, and APIs. Examples include Microsoft Azure App Services, Google App Engine, and AWS Elastic Beanstalk. These platforms handle infrastructure provisioning, scaling, patching, load balancing, and availability, freeing developers from low-level operational concerns. By standardizing the development environment, PaaS reduces configuration errors, accelerates deployment timelines, and ensures consistency across development, testing, and production.
PaaS also supports collaboration among development teams, facilitating continuous integration and continuous deployment (CI/CD) pipelines. Developers can push code to version control systems, trigger automated builds, run tests, and deploy applications seamlessly. Additional features like monitoring, logging, and performance metrics allow teams to detect and resolve issues rapidly without direct infrastructure intervention.
The advantages of PaaS extend to cost management and resource optimization. Organizations avoid over-provisioning or underutilization of infrastructure, paying only for the resources consumed. This makes PaaS ideal for startups, agile development teams, and large enterprises seeking to innovate without the overhead of managing virtual machines, operating systems, or security patches.
Security considerations in PaaS environments focus on application-level protections, including secure coding practices, authentication, encryption, and access control. While the cloud provider manages underlying infrastructure security, the responsibility for application security remains with the developers. PaaS also supports multi-language frameworks, containerization, and microservices architectures, enabling modern software practices and rapid iteration.
In conclusion, Platform as a Service abstracts infrastructure management, allowing developers to focus on building and deploying applications efficiently. By providing pre-configured environments, scalability, and automation tools, PaaS accelerates development, reduces operational complexity, and enhances consistency across software projects. The correct answer is Platform as a Service.
Question 169:
Which attack exploits weaknesses in database input handling to execute arbitrary queries?
A) Denial-of-Service
B) SQL Injection
C) Cross-Site Scripting
D) Man-in-the-Middle
Answer: B
Explanation:
SQL Injection is a web application attack technique that exploits improper input validation in database query construction. Attackers inject malicious SQL code into input fields or parameters, allowing them to manipulate backend databases to retrieve, modify, or delete sensitive data. SQL Injection remains one of the most critical and common web application vulnerabilities, often ranking high on the OWASP Top Ten list.
The root cause of SQL Injection is insecure coding practices where user input is directly concatenated into SQL statements without proper sanitization. For example, an application that builds queries like SELECT * FROM users WHERE username = ‘userInput’ is vulnerable if userInput contains SQL commands such as ‘ OR ‘1’=’1′—. Successful attacks can bypass authentication, exfiltrate confidential data, corrupt tables, or escalate privileges.
Mitigation techniques for SQL Injection attacks extend beyond parameterized queries, prepared statements, and input validation. Developers should implement comprehensive defense-in-depth strategies that include rigorous output encoding to prevent malicious input from affecting query execution. Input validation should adhere to a whitelist approach wherever possible, allowing only expected characters or data formats. Any untrusted input should be treated as potentially dangerous, and error messages should be sanitized to avoid leaking database structure or system information that could aid attackers.
Database accounts should operate under the principle of least privilege. Application accounts should have only the necessary permissions to perform their specific tasks, avoiding administrative privileges that could magnify the impact of a successful SQL Injection attack. Segmentation of duties within the database, such as separating read and write access or isolating highly sensitive tables, further reduces risk. Implementing stored procedures can also help, as these can encapsulate SQL logic and reduce the likelihood of ad hoc query manipulation.
Web Application Firewalls (WAFs) provide an additional layer of defense by filtering malicious requests before they reach the application or database. WAFs can detect common attack patterns, SQL keywords in suspicious contexts, and anomalous input behavior. However, WAFs should complement, not replace, secure coding practices, as sophisticated attackers may bypass simplistic filtering rules. Modern development frameworks often include Object-Relational Mapping (ORM) tools that abstract direct SQL execution, further reducing exposure to injection vulnerabilities. Developers should configure ORMs securely and avoid raw queries unless necessary, always combining them with parameterization and proper validation.
Regular security testing is critical. Black-box testing simulates attacks without internal knowledge, revealing how the application behaves in the presence of untrusted input. Gray-box testing provides partial insight into the internal structure, allowing testers to target likely injection points more efficiently. Penetration testing and code reviews help identify insecure coding patterns and logic flaws before deployment. Security training for developers is also essential, ensuring teams understand SQL Injection mechanics and prevention techniques.
The consequences of SQL Injection are significant. Attackers can retrieve, modify, or delete sensitive data, potentially leading to financial loss, exposure of personal information, regulatory penalties, and reputational damage. Disruptions can affect operational continuity, especially in critical systems like financial platforms, healthcare records, or e-commerce databases. High-profile breaches over the past decades illustrate the real-world impact of SQL Injection, highlighting why organizations must integrate prevention into development and operational practices.
By combining secure coding standards, input validation, least privilege access, prepared statements, ORM use, web application firewalls, and continuous security testing, organizations can greatly reduce the risk of SQL Injection attacks. Understanding the mechanisms, impact, and mitigation strategies is essential for maintaining database security and protecting sensitive organizational and customer information.
The attack targeting databases via improperly validated input is SQL Injection, making it the correct answer.
Question 170:
Which type of backup copies all files that have changed since the last full backup without resetting the archive bit?
A) Full Backup
B) Incremental Backup
C) Differential Backup
D) Synthetic Full Backup
Answer: C
Explanation:
Differential Backup is a backup method that captures all files that have changed since the last full backup while leaving the archive bit unchanged. This contrasts with incremental backups, which copy only files changed since the last backup and reset the archive bit. Differential backups provide a balance between storage efficiency and ease of restoration, offering advantages in speed and data consistency.
The archive bit is a file attribute used by backup software to track whether a file has changed since its last backup. Differential backup ignores the archive bit, ensuring that each backup captures all changes since the full backup. For example, if a full backup is performed on Sunday, a differential backup on Wednesday will include all files modified since Sunday. This approach simplifies restoration, as only the last full backup and the most recent differential backup are needed, avoiding the need to chain multiple incremental backups.
Differential backups are widely used in enterprise environments where minimizing downtime and simplifying recovery processes are critical. They reduce the number of backup sets required for restoration compared to incremental backups, making recovery faster while still saving storage space compared to repeated full backups. Organizations often schedule regular differential backups in conjunction with periodic full backups to balance storage utilization, recovery speed, and system performance.
Practical considerations include the growth of differential backups over time. As changes accumulate since the last full backup, differential backup sizes increase, potentially impacting storage and network resources. Administrators must carefully plan backup schedules, retention policies, and storage capacity to maintain efficiency. Cloud-based backup solutions often provide automated differential backups with deduplication, compression, and secure storage to address these challenges.
In conclusion, differential backup captures all changes since the last full backup without resetting the archive bit, providing an efficient and reliable method for data protection and recovery. Its simplicity in restoration and balance between storage and speed make it a preferred choice in many IT environments. The correct answer is Differential Backup.
Question 171:
Which security control is designed to detect and alert after incidents occur?
A) Preventive
B) Detective
C) Corrective
D) Deterrent
Answer: B
Explanation:
Detective controls are a vital component of any comprehensive cybersecurity framework. Their primary function is to identify unauthorized activities, anomalies, or potential threats after they have occurred, providing visibility into the actual security posture of systems, networks, and applications. Unlike preventive controls, which aim to stop incidents before they happen, or corrective controls, which restore systems to normal operations post-incident, detective controls focus on observation, detection, and alerting.
Examples of detective controls include intrusion detection systems (IDS), security information and event management (SIEM) systems, audit logs, network traffic monitoring tools, anomaly detection software, file integrity monitoring, and user behavior analytics (UBA). Intrusion detection systems analyze network or host-based activity to identify patterns that may indicate attacks such as unauthorized access attempts, malware activity, or policy violations. SIEM platforms aggregate logs from multiple sources, correlate events, and provide alerts on suspicious behavior, enabling incident responders to investigate effectively.
Audit logs serve as historical records of system activity, capturing information such as user logins, file access, configuration changes, and transaction histories. They are essential for forensic investigations, regulatory compliance, and internal accountability. Advanced anomaly detection tools apply machine learning algorithms to identify deviations from established behavioral baselines, providing early warning of insider threats, compromised accounts, or unusual system activity.
Detective controls also play a critical role in complementing preventive and corrective measures. While preventive controls may reduce the likelihood of an attack, they are not foolproof, and attackers often exploit unforeseen vulnerabilities. Detective controls help organizations recognize breaches or policy violations promptly, enabling rapid response to limit damage. For instance, an IDS alert may trigger automated responses such as isolating affected systems or notifying security teams, while audit logs provide evidence for legal or compliance investigations.
In addition, detective controls support risk management and continuous improvement. By analyzing detected events over time, organizations can identify recurring vulnerabilities, evaluate the effectiveness of existing controls, and implement improvements to strengthen defenses. In environments subject to regulatory requirements, such as financial services or healthcare, detective controls are often mandated to provide accountability, traceability, and monitoring of sensitive data.
The implementation of detective controls requires careful planning, including proper configuration, tuning, and correlation of alerts to minimize false positives while maximizing detection capability. Integration with incident response plans ensures that detected events trigger timely investigations, containment, and remediation actions. Detective controls are thus a cornerstone of proactive cybersecurity programs, providing critical insights and actionable intelligence after incidents occur.
The control type explicitly designed to identify incidents after they happen is Detective, making it the correct answer.
Question 172:
Which disaster recovery metric defines acceptable data loss?
A) Recovery Time Objective
B) Recovery Point Objective
C) Maximum Tolerable Downtime
D) Mean Time Between Failures
Answer: B
Explanation:
Recovery Point Objective (RPO) is a key disaster recovery and business continuity metric that defines the maximum acceptable amount of data loss measured in time. Essentially, it specifies how far back in time an organization can afford to recover data following an incident, such as a system failure, ransomware attack, or natural disaster. Understanding and defining RPO is critical to designing effective backup, replication, and storage strategies that align with business requirements and risk tolerance.
RPO directly influences backup frequency and strategy. For example, if an organization determines that the maximum acceptable data loss is one hour, systems must be backed up or replicated at least every hour to meet this requirement. Shorter RPOs typically require continuous data protection, replication technologies, or frequent snapshot backups, while longer RPOs may allow daily or weekly backup cycles. The choice of technology and backup method—full, incremental, or differential—also depends on the RPO to balance efficiency, cost, and recovery requirements.
RPO is complementary to Recovery Time Objective (RTO), which defines the target duration for restoring systems to operational status after an outage. While RTO focuses on downtime and system availability, RPO focuses on the preservation of data. Organizations must carefully define both metrics to ensure business continuity and minimize operational and financial impact. Meeting RPO ensures that critical data is not permanently lost, maintaining transaction integrity, regulatory compliance, and operational continuity.
Different industries and applications have varying RPO requirements. Financial institutions processing high-volume transactions often require near-zero RPOs to avoid significant financial loss or regulatory noncompliance. Healthcare organizations storing electronic medical records may define RPOs in minutes to preserve patient safety and maintain compliance with HIPAA regulations. Enterprises handling non-critical or archival data might tolerate longer RPOs without significant operational disruption.
Technologies that support RPO adherence include synchronous and asynchronous replication, database mirroring, continuous data protection (CDP), cloud storage with versioning, and automated snapshot management. Cloud-based solutions often provide configurable RPOs across multiple regions, ensuring resilience against localized failures or disasters. Regular testing of backup and recovery processes is essential to verify that the defined RPOs are achievable under realistic disaster scenarios.
RPO also factors into regulatory compliance and reporting. Organizations governed by frameworks such as ISO 22301, SOC 2, and PCI DSS must document acceptable data loss limits and implement controls to achieve them. Auditors and stakeholders rely on evidence that backup and replication strategies align with organizational RPO policies, emphasizing the importance of robust disaster recovery planning.
The metric defining tolerable data loss is Recovery Point Objective, making it the correct answer.
Question 173:
Which cloud deployment model serves multiple organizations from shared infrastructure?
A) Private Cloud
B) Public Cloud
C) Hybrid Cloud
D) Community Cloud
Answer: D
Explanation:
Community Cloud is a cloud deployment model in which infrastructure, platforms, and resources are shared among a group of organizations with common concerns, requirements, or objectives. This can include regulatory compliance, security standards, industry collaboration, or specific operational needs. Unlike private clouds, which are dedicated to a single organization, or public clouds, which are available to the general public, community clouds occupy a middle ground, balancing shared cost efficiency with the ability to enforce specialized security and compliance policies.
Community clouds are often used in industries where multiple organizations operate under similar regulatory frameworks or business models. For instance, government agencies may share a community cloud for citizen services while maintaining strict access controls and auditability. Healthcare providers can use a community cloud to exchange patient data securely across hospitals and clinics while complying with HIPAA or other healthcare regulations. Financial institutions may establish a community cloud to facilitate secure interbank transactions, fraud monitoring, or collaborative analytics, ensuring that sensitive information is protected while benefiting from shared infrastructure costs.
Community clouds can be managed by one of the participating organizations, a third-party vendor, or a consortium specifically established for cloud governance. Management responsibilities include provisioning resources, maintaining security and compliance, monitoring usage, and ensuring operational availability. Since multiple organizations share resources, governance models and access controls must be carefully defined to prevent unauthorized access, ensure equitable resource allocation, and maintain isolation where necessary.
From a cost perspective, community clouds offer economies of scale. Organizations share the cost of hardware, software licenses, operational maintenance, and network infrastructure, reducing individual investment requirements compared to private cloud deployments. At the same time, community clouds can implement specialized security and compliance configurations that are more restrictive than public cloud defaults, ensuring that shared environments meet stringent operational requirements.
Community cloud deployment also enables collaboration and data exchange among member organizations. By sharing a common infrastructure, entities can implement standardized applications, APIs, and services, enhancing interoperability and reducing integration complexity. For example, universities may use a community cloud to provide access to shared research tools, data repositories, and computational resources while maintaining control over sensitive research data and intellectual property.
The shared environment of community clouds also necessitates strong monitoring and auditing practices. Security controls must detect unauthorized access or activity from internal users, and usage logs must provide accountability for all member organizations. Encryption, identity and access management (IAM), network segmentation, and multi-tenant isolation techniques are critical to maintaining both security and privacy in shared deployments.
The cloud model shared among specific organizations with common goals is Community Cloud, making it the correct answer.
Question 174:
Which type of attack tricks users into revealing sensitive information?
A) SQL Injection
B) Denial-of-Service
C) Phishing
D) Brute-force
Answer: C
Explanation:
Phishing is a social engineering attack designed to deceive users into divulging confidential information such as usernames, passwords, credit card numbers, or other sensitive data. Unlike attacks that exploit software vulnerabilities, phishing targets human behavior, leveraging trust, urgency, or fear to manipulate victims. The success of phishing attacks relies heavily on psychological manipulation and the ability to mimic legitimate entities convincingly.
Common phishing techniques include fraudulent emails, malicious websites, text messages (smishing), and voice calls (vishing). Email phishing often involves messages that appear to come from trusted institutions, such as banks, online service providers, or internal corporate departments, asking the recipient to click a link, download an attachment, or provide login credentials. Sophisticated attacks may include spear-phishing, which targets specific individuals or roles using personalized information obtained from social media, data breaches, or reconnaissance.
Phishing can lead to credential theft, financial fraud, unauthorized access to corporate networks, installation of malware, or data breaches. Attackers often use harvested credentials to escalate privileges, access sensitive systems, exfiltrate information, or deploy ransomware. In enterprise environments, phishing is a leading vector for breaches because even robust technical controls cannot fully protect against a user inadvertently revealing access credentials.
Mitigation strategies involve a combination of technical controls and user education. Email filtering solutions, domain-based message authentication, reporting mechanisms, multi-factor authentication (MFA), and secure web gateways reduce exposure to phishing attempts. Regular awareness training ensures users can recognize suspicious emails, verify sender authenticity, and respond appropriately to potential attacks. Simulated phishing campaigns are also used to assess user readiness and reinforce training outcomes.
Phishing attacks are evolving in complexity. Modern campaigns use business email compromise (BEC) tactics, deepfake audio or video, and social engineering combined with reconnaissance to increase credibility. Organizations must continuously monitor for suspicious activity, enforce access controls, and maintain incident response capabilities to respond effectively if a phishing attack succeeds.
The attack that manipulates users into disclosing information is phishing, making it the correct answer.
Question 175:
Which cloud service model allows execution of event-driven code without managing servers?
A) IaaS
B) PaaS
C) SaaS
D) FaaS
Answer: D
Explanation:
Function as a Service (FaaS), often referred to as serverless computing, is a cloud service model that allows developers to deploy individual functions or code snippets that are executed in response to specific events, triggers, or requests. Unlike traditional Infrastructure as a Service (IaaS) or Platform as a Service (PaaS), FaaS abstracts all server management, scaling, and runtime provisioning. The cloud provider automatically handles resource allocation, execution, scaling, and availability, allowing developers to focus purely on writing business logic.
FaaS is commonly implemented in cloud platforms like AWS Lambda, Microsoft Azure Functions, and Google Cloud Functions. Functions can be triggered by events such as HTTP requests, file uploads, database changes, message queues, IoT device updates, or scheduled tasks. The event-driven nature of FaaS enables highly responsive applications that scale dynamically based on workload, with billing often based on the actual compute time consumed rather than allocated resources.
Serverless architectures are ideal for microservices, real-time data processing, chatbots, API backends, automation scripts, and lightweight event-driven applications. By removing infrastructure concerns, FaaS reduces operational overhead, accelerates development cycles, and allows teams to innovate rapidly. It also supports DevOps and CI/CD practices, as functions can be deployed independently and integrated into larger workflows.
FaaS challenges include cold start latency, limited execution time, and state management. Cold starts occur when a function has not been invoked recently, requiring the platform to allocate resources, initialize runtime environments, and load code, which can introduce delays noticeable in latency-sensitive applications. Optimizing function initialization, keeping functions warm, or using provisioned concurrency can mitigate cold start impacts.
Limited execution time imposes constraints on long-running tasks, meaning that functions must complete within a platform-defined timeout. For processes requiring extended computation, developers often need to break tasks into smaller functions or leverage asynchronous workflows. Additionally, because serverless functions are typically stateless, any persistent data must be stored externally, such as in databases, distributed caches, or object storage systems. This requires careful design to handle data consistency, latency, and error recovery.
Monitoring, logging, and observability are critical to ensure reliable function execution. Tools and practices include centralized logging, structured metrics, tracing, and alerting to detect errors, performance bottlenecks, or security anomalies. Security best practices involve enforcing role-based access controls, validating event sources, encrypting sensitive data in transit and at rest, and applying least privilege principles to functions and their associated resources.
Despite these challenges, FaaS provides significant advantages, including automatic scaling, reduced operational overhead, and cost efficiency, as organizations pay only for actual function execution time. The cloud service model running code without server management is Function as a Service, making it the correct answer.
Question 176:
Which testing method uses full knowledge of internal code and logic?
A) Black-box Testing
B) Gray-box Testing
C) White-box Testing
D) Fuzz Testing
Answer: C
Explanation:
White-box Testing, also known as clear-box testing, structural testing, or glass-box testing, is a methodology in which testers have complete visibility into the internal workings of a system, including source code, architecture, data flows, algorithms, and control structures. Unlike black-box testing, which focuses purely on input/output behavior without knowledge of implementation, white-box testing allows for thorough verification of code correctness, logic, and security from a developer’s perspective.
This testing methodology is integral to the software development lifecycle (SDLC), particularly during unit testing, integration testing, and code review phases. Testers or developers can examine every conditional branch, loop, and function to ensure that the system behaves as intended. Techniques such as statement coverage, branch coverage, path coverage, and condition coverage are used to quantify how much of the code has been tested, reducing the risk of undetected bugs and logic errors.
White-box testing is particularly effective at detecting subtle errors that may not manifest during functional testing. These include off-by-one errors, uninitialized variables, incorrect use of data types, improper exception handling, or flawed authentication logic. It also enables security-focused testing, such as identifying hard-coded credentials, insecure cryptographic implementations, input validation errors, and potential buffer overflows. By examining the code at a granular level, vulnerabilities that could lead to exploits like SQL injection, cross-site scripting, or privilege escalation can be preemptively identified and mitigated.
Automated tools often assist in white-box testing. Static code analyzers review source code for potential defects without executing it, flagging vulnerabilities, coding standard violations, and performance issues. Unit testing frameworks, such as JUnit for Java, NUnit for .NET, or PyTest for Python, allow individual functions and methods to be tested systematically. Test-driven development (TDD) heavily relies on white-box principles, where test cases are written based on knowledge of the internal design and functionality of components.
White-box testing is not limited to functional correctness; it also improves maintainability, readability, and scalability of software. By understanding code dependencies and internal flows, developers can refactor code safely, optimize performance, and ensure that changes do not introduce regressions. Furthermore, white-box testing helps enforce coding standards, reduce technical debt, and provide assurance to stakeholders that the software is robust and reliable.
In security-sensitive domains such as finance, healthcare, or aerospace, white-box testing is crucial for compliance with regulatory standards like ISO 27001, PCI DSS, HIPAA, or FAA software assurance guidelines. By validating internal logic and verifying security mechanisms, organizations can reduce the likelihood of costly breaches, legal liabilities, and operational disruptions.
The testing method requiring full internal knowledge is White-box Testing, making it the correct answer.
Question 177:
Which security control principle enforces multiple layers of protection?
A) Least Privilege
B) Defense in Depth
C) Separation of Duties
D) Least Functionality
Answer: B
Explanation:
Defense in Depth (DiD) is a strategic security principle that layers multiple safeguards to protect information systems, networks, and critical assets. The core concept is that no single control is sufficient to defend against all types of threats; instead, overlapping layers of technical, administrative, and physical controls create a resilient security posture. If one layer is bypassed, others remain to provide protection, reducing overall risk exposure.
Technical layers may include firewalls, intrusion detection and prevention systems, antivirus software, endpoint protection, encryption, secure network configurations, access controls, and vulnerability scanning. Administrative layers encompass policies, procedures, employee training, incident response plans, and compliance monitoring. Physical layers involve secure data centers, restricted access areas, surveillance, environmental controls, and disaster recovery infrastructure.
The layering approach ensures comprehensive protection across the attack surface. For example, even if a phishing email bypasses email filtering, endpoint security might detect malicious attachments, and intrusion detection systems could alert on anomalous activity. Defense in Depth also incorporates redundancy and diversity; employing multiple vendors or solutions reduces the likelihood of a single point of failure.
DiD supports regulatory compliance, as frameworks like NIST, ISO 27001, and HIPAA often require multi-layered safeguards to protect sensitive data. It also encourages proactive risk management. Organizations using DiD conduct threat modeling, risk assessments, and continuous monitoring to adjust controls based on evolving threats and vulnerabilities.
Implementation requires careful integration. Each layer must complement the others without causing conflicts or blind spots. For example, access controls must be consistent across network, application, and endpoint layers, while monitoring and logging should be centralized for effective incident response. Layered security also extends to identity management, with multi-factor authentication protecting accounts while application-level controls enforce least privilege.
Defense in Depth also enhances resilience against sophisticated attacks such as advanced persistent threats (APTs), ransomware campaigns, or insider threats. By delaying or disrupting attacker progress at multiple stages, DiD provides detection opportunities and buys time for mitigation. Organizations often simulate attacks through penetration testing and red teaming exercises to evaluate the effectiveness of their layered defenses.
The principle enforcing multiple protection layers is Defense in Depth, making it the correct answer.
Question 178:
Which authentication factor is based on unique biological traits?
A) Password
B) Token
C) Biometric
D) Smart Card
Answer: C
Explanation:
Biometric authentication relies on unique physical or behavioral characteristics to verify an individual’s identity. This type of authentication provides strong assurance because biological traits are inherently difficult to replicate, share, or steal compared to traditional knowledge-based or possession-based methods. Common biometric modalities include fingerprints, iris patterns, facial recognition, voice recognition, palm prints, hand geometry, and even behavioral biometrics such as typing rhythm or gait.
The strength of biometric authentication lies in its uniqueness, permanence, and measurability. Each person’s fingerprints or iris patterns are distinct, allowing precise matching against stored templates. Behavioral biometrics, while less rigid, can enhance security by detecting subtle differences in user behavior that are difficult for attackers to mimic. Biometric systems typically capture raw data, convert it into digital templates, and compare these templates with enrolled profiles using algorithms that account for variations and environmental factors.
Biometric authentication is widely used in mobile devices, secure facilities, financial services, border control, and enterprise networks. Fingerprint scanners on smartphones provide convenient device access, while facial recognition systems are deployed in airports to expedite identity verification. In enterprise settings, biometrics can complement multi-factor authentication (MFA), combining something the user knows (password) with something the user is (biometric), significantly increasing security.
Despite its advantages, biometric authentication presents challenges. Privacy concerns arise due to the sensitive nature of biometric data, which, if compromised, cannot be changed like a password. False positives (unauthorized access granted) and false negatives (legitimate access denied) are also important considerations, requiring careful system tuning and error rate management. Environmental factors, sensor quality, and physiological changes over time can impact accuracy, necessitating continuous updates and system calibration.
Advanced biometric systems incorporate liveness detection and anti-spoofing mechanisms to prevent attacks using photos, masks, or synthetic fingerprints. Regulatory frameworks, including GDPR and CCPA, impose strict rules on the collection, storage, and processing of biometric data, emphasizing encryption, anonymization, and secure template management.
The authentication factor based on biological traits is Biometric, making it the correct answer.
Question 179:
Which type of attack attempts every possible combination to guess a password?
A) Phishing
B) Rainbow Table
C) Brute-force
D) Dictionary
Answer: C
Explanation:
A Brute-force attack is a methodical approach in which an attacker attempts every possible combination of characters, numbers, and symbols until the correct password or cryptographic key is discovered. This type of attack is exhaustive and guarantees eventual success given enough time and computational resources, assuming the password space is finite. Brute-force attacks differ from dictionary attacks, which use predefined wordlists, or rainbow table attacks, which leverage precomputed hash values to expedite cracking.
Brute-force attacks can target passwords, encryption keys, or authentication tokens. Attackers often use automated tools to generate combinations systematically, taking advantage of parallel processing, GPU acceleration, or distributed computing to increase speed. As computing power grows, the feasibility of brute-force attacks against weak passwords increases, making strong password policies, passphrases, and account lockout mechanisms critical for security.
Mitigation strategies include enforcing minimum password complexity (length, character variety), implementing multi-factor authentication (MFA), and rate limiting login attempts. Account lockouts or progressive delays reduce the practicality of brute-force attempts. Advanced security measures, such as adaptive authentication, can detect abnormal login patterns and challenge suspicious users further.
Brute-force attacks are computationally intensive and become impractical as password complexity increases. For instance, an 8-character password using only lowercase letters can be brute-forced relatively quickly, whereas a 12-character password combining uppercase, lowercase, digits, and special symbols exponentially increases the time required, often beyond feasible limits. This is why security best practices emphasize long, complex, and unique passwords, coupled with MFA, as a robust defense.
The attack attempts all possible combinations is Brute-force, making it the correct answer.
Question 180:
Which control is designed to prevent unauthorized actions before they occur?
A) Detective
B) Corrective
C) Preventive
D) Deterrent
Answer: C
Explanation:
Preventive controls are proactive measures implemented to stop unauthorized access, malicious actions, or policy violations before they can occur. They are a foundational aspect of security programs, focusing on deterrence and prevention rather than detection or remediation. Preventive controls operate at multiple layers, including technical, administrative, and physical domains, to reduce the likelihood of security incidents.
Examples of preventive controls include firewalls, intrusion prevention systems (IPS), access control lists (ACLs), encryption, authentication mechanisms, physical access restrictions, and network segmentation. Administrative preventive measures include security policies, user training, code reviews, secure development practices, and policy enforcement. By deploying these controls, organizations limit exposure to attacks, enforce compliance, and reduce operational risk.
In cybersecurity, preventive controls are critical for defending against common threats such as unauthorized access, malware infection, data exfiltration, and ransomware. For example, firewalls block traffic from untrusted sources, access controls ensure that only authorized users can reach sensitive data, and strong authentication prevents credential abuse. Preventive security also includes patch management, secure configuration, and vulnerability mitigation to reduce exploitable weaknesses.
Preventive measures are most effective when integrated with detective and corrective controls. While preventive mechanisms aim to stop incidents, detective controls monitor for potential breaches, and corrective controls restore systems after an event. Together, this triad provides comprehensive protection and resilience against evolving threats. Continuous assessment, monitoring, and updating of preventive controls are essential to adapt to changing risk landscapes, emerging vulnerabilities, and advanced attack techniques.
The control type preventing incidents proactively is Preventive, making it the correct answer.