ISC CISSP Certified Information Systems Security Professional Exam Dumps and Practice Test Questions Set 6 Q76-90
Visit here for our full ISC CISSP exam dumps and practice test questions.
Question 76:
Which principle requires that users only receive access necessary to perform their job tasks?
A) Role-Based Access Control
B) Least Privilege
C) Separation of Duties
D) Need-to-Know
Answer: B
Explanation:
Role-Based Access Control (RBAC) assigns permissions based on defined roles within an organization. While it helps streamline permission management and ensures that users in similar job functions have consistent access, RBAC may inadvertently grant more privileges than strictly necessary for certain tasks. This can result in overprivileged accounts, which become attractive targets for attackers. Similarly, Separation of Duties (SoD) is a control mechanism designed to reduce the risk of fraud, errors, or misuse by dividing critical tasks among multiple individuals. However, SoD focuses on operational checks and balances rather than strictly limiting access to resources. Need-to-Know is another security principle that restricts information disclosure, ensuring that sensitive data is shared only with individuals who require it for their work. While effective for protecting confidential information, Need-to-Know does not inherently control all system privileges or functional access.
Least Privilege, in contrast, is a proactive approach that enforces minimal access rights. By granting users only the permissions required to perform their duties—and no more—organizations can significantly reduce the likelihood of accidental or deliberate misuse of system resources. This principle also mitigates the impact of compromised accounts, as attackers cannot exploit elevated privileges that the user does not possess. Least Privilege supports a broad range of security practices, including defense-in-depth strategies, privilege auditing, and compliance with regulatory standards such as GDPR, HIPAA, and PCI DSS. It also addresses privilege creep, a common issue where users accumulate unnecessary permissions over time due to job changes or legacy access.
Implementation of Least Privilege spans both operating systems and applications. Access control lists (ACLs), role-based policies, identity and access management (IAM) platforms, and automated provisioning/deprovisioning workflows help enforce this principle consistently. When properly applied, Least Privilege not only enhances system security but also improves operational efficiency by reducing administrative overhead and clarifying responsibility boundaries. In essence, Least Privilege serves as a cornerstone of modern cybersecurity, ensuring that access is tightly controlled, monitored, and aligned with business needs.
The security principle that limits user access to only what is required is Least Privilege, making it the correct and most effective choice for minimizing risk.
Question 77:
Which type of attack involves tricking a system into executing unintended commands?
A) SQL Injection
B) Cross-Site Scripting
C) Command Injection
D) Denial-of-Service
Answer: C
Explanation:
Command Injection attacks occur when an application improperly handles user input, allowing attackers to inject and execute arbitrary commands on the host operating system. This type of vulnerability often exists in scripts, web forms, or applications that directly pass user input to system calls without adequate sanitization or validation. Unlike SQL Injection, which targets databases specifically, or Cross-Site Scripting (XSS), which targets client-side scripts executed in web browsers, command injection directly affects the underlying operating system. Attackers may exploit such vulnerabilities to gain unauthorized system access, manipulate files, escalate privileges, or install persistent malware.
For example, if a web application allows a user to input a filename to be processed by a system command like cat or ls without proper sanitization, an attacker could append additional commands (; rm -rf /) that the system executes, resulting in critical damage. Command injection exploits often rely on system-level commands and the environment in which the application operates. Successful exploitation can lead to the exposure of sensitive data, unauthorized modification of system configurations, and a complete system compromise.
Prevention measures are crucial and include rigorous input validation, strict whitelisting of acceptable input, parameterized execution methods, and employing sandboxing techniques to isolate application execution from critical system components. Regular security testing, including penetration tests and code reviews, helps identify potential vulnerabilities before they are exploited. Security frameworks and secure coding guidelines, such as OWASP’s recommendations, emphasize the importance of treating all user input as untrusted, escaping characters correctly, and avoiding direct command execution whenever possible.
In enterprise environments, command injection represents a severe threat because it can bypass application-level restrictions entirely and interact with the underlying operating system with the privileges of the application. For organizations handling sensitive or regulated data, even a minor command injection vulnerability can have cascading effects, including data breaches, financial losses, and reputational damage. Overall, understanding and mitigating command injection is a fundamental aspect of secure software design and system administration.
Question 78:
Which security control is designed to detect unauthorized activity after it has occurred?
A) Preventive
B) Detective
C) Corrective
D) Deterrent
Answer: B
Explanation:
Detective security controls are designed to identify, log, and alert organizations to security events after they have occurred, unlike preventive controls that attempt to stop incidents proactively. They are a key component of a comprehensive security program because not all attacks can be fully prevented. Detective controls provide visibility into system activity, help uncover attempted or successful intrusions, and serve as a foundation for incident response and forensic investigations.
Examples of detective controls include intrusion detection systems (IDS), audit logs, file integrity monitoring, security event monitoring, anomaly detection tools, and SIEM (Security Information and Event Management) systems. IDS, for instance, can monitor network traffic and system activities for suspicious behavior and generate alerts if anomalies or known attack patterns are detected. Audit logs capture detailed records of user activity, system access, and configuration changes, enabling organizations to trace events, identify unauthorized actions, and support accountability requirements.
Detective controls are essential for compliance with regulations such as GDPR, HIPAA, or PCI DSS, where organizations must demonstrate the ability to monitor, detect, and report security incidents. Unlike deterrent controls, which discourage malicious actions through policies or consequences, detective controls actively monitor and identify security violations. They work synergistically with preventive controls (like firewalls or access controls) and corrective controls (like patches or restoration processes) to provide a layered defense.
Furthermore, detective controls can help detect insider threats, advanced persistent threats (APTs), and zero-day attacks that bypass preventive measures. By providing detailed logging and alerting mechanisms, organizations can analyze trends, perform root-cause investigations, and strengthen future defenses. The effectiveness of detective controls depends on their timely configuration, regular monitoring, and integration into an incident response strategy.
Detective controls act as the organization’s security “watchtower”, identifying and reporting unauthorized activity, making them indispensable in a proactive security posture.
Question 79:
Which type of cloud service provides users with access to applications without managing the underlying infrastructure?
A) Infrastructure as a Service
B) Platform as a Service
C) Software as a Service
D) Function as a Service
Answer: C
Explanation:
Software as a Service (SaaS) is a cloud computing model in which fully functional applications are delivered over the internet, eliminating the need for users to manage the underlying infrastructure, operating systems, or runtime environments. Users interact with software through web browsers or APIs, while the service provider handles everything from server management and network configuration to security patches, updates, and backups.
In contrast, Infrastructure as a Service (IaaS) provides virtualized computing resources such as servers, storage, and networking, requiring users to install and manage their own operating systems and applications. Platform as a Service (PaaS) offers a platform for developers to build, deploy, and run applications, managing runtime environments but not necessarily the end-user applications themselves. Function as a Service (FaaS) focuses on event-driven execution of code snippets, scaling automatically, and abstracts infrastructure at a micro-level.
SaaS delivers several advantages, making it extremely popular in both business and consumer markets. Users benefit from reduced IT maintenance costs, rapid deployment, seamless updates, and easy scalability. SaaS platforms are commonly used for email (e.g., Gmail), customer relationship management (e.g., Salesforce), collaboration tools (e.g., Microsoft Teams, Slack), and enterprise resource planning. SaaS also supports remote work and global access, as services are accessible anywhere with an internet connection.
Security in SaaS is the responsibility of the provider for infrastructure and application-level controls, while users are typically responsible for access management and data governance. Advanced SaaS offerings include built-in compliance measures, encryption, single sign-on (SSO), multi-factor authentication (MFA), and logging capabilities to meet regulatory standards.
Overall, SaaS simplifies software consumption, enabling organizations to focus on using applications effectively rather than maintaining hardware, software updates, or patching systems. It represents a cost-efficient, scalable, and low-overhead solution for modern digital operations, making it the correct answer to this question.
Question 80:
Which backup type copies only the files that have changed since the last backup, resetting the archive bit?
A) Full Backup
B) Differential Backup
C) Incremental Backup
D) Synthetic Full Backup
Answer: C
Explanation:
Incremental backups are designed to efficiently back up only the data that has changed since the last backup, whether that previous backup was a full backup or another incremental backup. This method significantly reduces storage requirements and backup time compared to full backups, which copy all files regardless of modification.
Unlike differential backups, which track changes since the last full backup but do not reset the archive bit, incremental backups reset the archive bit after copying files. This reset mechanism ensures that the next incremental backup only includes new or modified files, further optimizing storage and reducing redundancy. Incremental backups are typically used in daily backup cycles, while full backups are scheduled periodically (e.g., weekly) to provide a complete recovery point.
Advantages of incremental backups include faster backup windows, lower storage consumption, and minimized impact on system performance. However, restoration requires careful planning, as all incremental backups and the last full backup must be applied in the correct sequence to fully restore data. Missing or corrupted incremental backups can prevent complete recovery.
Incremental backups are widely adopted in enterprise IT environments, cloud backup solutions, and hybrid on-premises/cloud systems. They are compatible with automated backup schedules, disaster recovery planning, and versioning strategies. Combined with monitoring and verification tools, incremental backups ensure data integrity, help meet compliance requirements, and support business continuity objectives.
In addition, modern backup systems often integrate incremental backups with deduplication, compression, and encryption, enhancing both storage efficiency and security. Properly implemented, incremental backups allow organizations to maintain a robust and cost-effective data protection strategy without sacrificing accessibility or recovery reliability.
Therefore, the backup type that copies only changed files since the last backup and resets the archive bit is Incremental Backup, making it the correct answer.
Question 81:
Which security principle ensures multiple layers of protection are in place?
A) Least Privilege
B) Defense in Depth
C) Open Design
D) Need-to-Know
Answer: B
Explanation:
Defense in Depth is a security strategy that employs multiple overlapping layers of protection to safeguard information systems, networks, applications, and data. While principles like Least Privilege, Open Design, and Need-to-Know address specific aspects of security, Defense in Depth is unique in its holistic approach. It recognizes that no single security control is infallible and that layered defenses increase resilience against threats. For example, a firewall may block unauthorized network traffic, but if an attacker bypasses it, antivirus software and intrusion detection systems provide additional safeguards.
Defense in Depth integrates preventive, detective, and corrective controls at various levels, including physical security, network security, endpoint security, application security, and data protection. Preventive measures might include access controls, encryption, and authentication protocols, designed to stop attacks before they occur. Detective measures, such as monitoring systems, log analysis, and intrusion detection, identify suspicious activities after they occur, while corrective controls, like patching vulnerabilities or restoring backups, mitigate damage from incidents.
This layered approach also includes administrative controls, such as policies, training, and procedures, which complement technical safeguards. For instance, employees may be trained to recognize phishing attempts, reinforcing technical controls like email filters. Defense in Depth ensures redundancy, so if one layer fails, others continue to provide protection. It also enhances the likelihood of detecting breaches and responding effectively, limiting potential damage.
Organizations implementing Defense in Depth often combine tools and strategies such as firewalls, antivirus software, network segmentation, multi-factor authentication, secure coding practices, encryption, logging and auditing, and continuous monitoring. This principle is central to compliance frameworks like ISO 27001, NIST, and PCI DSS, where multiple controls across different layers are required.
By embracing Defense in Depth, organizations acknowledge that cybersecurity threats are multifaceted and dynamic. Each layer provides a buffer, compensating for weaknesses in others, and collectively, they form a resilient, comprehensive security posture. Even if an attacker successfully circumvents one control, the remaining layers continue to protect the system, making it significantly harder to achieve a full compromise.
The principle that implements multiple layers of security across people, processes, and technology is Defense in Depth, making it the correct answer.
Question 82:
Which type of attack floods systems or networks to deny service to legitimate users?
A) Man-in-the-Middle
B) Denial-of-Service
C) SQL Injection
D) Phishing
Answer: B
Explanation:
Denial-of-Service (DoS) attacks aim to disrupt the availability of a target system, network, or service, preventing legitimate users from accessing resources. Unlike Man-in-the-Middle attacks, which intercept communications, or SQL Injection, which targets databases, DoS attacks focus on overwhelming resources. Attackers generate excessive traffic, consume bandwidth, or exhaust system resources such as CPU, memory, or storage, making services unresponsive.
Distributed Denial-of-Service (DDoS) attacks are a more potent variant, leveraging multiple compromised devices, often part of a botnet, to flood the target simultaneously. The scale of a DDoS attack can vary from simple flooding of HTTP requests to complex amplification attacks, such as DNS or NTP reflection attacks, which exponentially increase traffic directed at the victim. These attacks can cause severe operational disruption, financial losses, reputational damage, and downtime that impacts business continuity.
Mitigation strategies involve both proactive and reactive measures. Rate limiting restricts the number of requests from a single source, while firewalls and intrusion prevention systems can filter suspicious traffic. Redundant systems, load balancing, and distributed architectures increase resilience by distributing traffic across multiple servers. Content delivery networks (CDNs) can absorb large volumes of traffic, preventing servers from being overwhelmed. Monitoring tools and anomaly detection systems help identify attack patterns early, enabling rapid response.
DoS attacks specifically target the availability component of the CIA triad, making them critical threats in operational contexts. While prevention may reduce risk, the unpredictable nature of such attacks underscores the importance of comprehensive incident response and recovery planning. Organizations must ensure backups, failover mechanisms, and service continuity plans are in place to maintain operational capabilities during an attack.
The attack that floods systems or networks to deny access to legitimate users is Denial-of-Service, making it the correct answer.
Question 83
Which cryptographic method converts plaintext into unreadable ciphertext to protect confidentiality?
A) Hashing
B) Symmetric Encryption
C) Digital Signature
D) Tokenization
Answer: B
Explanation:
Symmetric Encryption is a cryptographic method that transforms plaintext data into ciphertext, making it unreadable to unauthorized parties. Unlike hashing, which produces a fixed-length digest primarily for integrity verification, or digital signatures, which ensure authenticity and integrity, symmetric encryption is designed to maintain confidentiality. Tokenization substitutes sensitive data with non-sensitive equivalents but does not inherently protect data through encryption.
In symmetric encryption, a single shared key is used for both encryption and decryption. Only parties possessing the key can convert the ciphertext back into plaintext. Common algorithms include Advanced Encryption Standard (AES), Data Encryption Standard (DES), and Triple DES (3DES). Symmetric encryption is highly efficient, making it suitable for encrypting large volumes of data at rest, in transit, or in storage systems. For instance, it is widely used in securing databases, file systems, virtual private networks, and communication protocols such as TLS.
Effective symmetric encryption requires robust key management practices. Keys must be securely generated, distributed, stored, and rotated to prevent unauthorized access. Compromise of the key undermines the confidentiality of the encrypted data. Organizations often combine symmetric encryption with asymmetric encryption for secure key exchange. This hybrid approach leverages the efficiency of symmetric algorithms for bulk data encryption while using asymmetric encryption to securely exchange keys.
Symmetric encryption also supports modern security standards, compliance frameworks, and regulatory requirements. It plays a crucial role in protecting sensitive information, such as personally identifiable information (PII), financial data, intellectual property, and confidential communications. Implementing strong symmetric encryption algorithms and secure key management policies ensures that even if data is intercepted, it remains unintelligible to attackers, maintaining confidentiality.
The cryptographic method that protects data by converting it to unreadable ciphertext is Symmetric Encryption, making it the correct answer.
Question 84:
Which process ensures that system changes are documented, approved, and controlled?
A) Configuration Management
B) Patch Management
C) Change Management
D) Incident Response
Answer: C
Explanation:
Change Management is a formalized process designed to control the introduction of modifications into IT systems, networks, and applications. While Configuration Management focuses on maintaining system settings, Patch Management addresses software updates, and Incident Response handles unexpected security events, Change Management ensures that all alterations are systematically reviewed, authorized, and documented before implementation.
The process begins with a formal change request, which identifies the scope, purpose, potential risks, and impact of the proposed change. Stakeholders, including IT, security, and business representatives, review the request to evaluate benefits, risks, and compliance considerations. Approval ensures that changes align with organizational policies and operational priorities. Once authorized, the change is implemented according to a predefined plan that may include testing in a controlled environment to prevent adverse effects.
Post-implementation, Change Management includes verification, auditing, and documentation. This ensures traceability, accountability, and continuous improvement. Effective Change Management reduces operational disruptions, prevents configuration drift, and minimizes the likelihood of introducing vulnerabilities. Integration with incident response and problem management processes allows organizations to respond to issues arising from changes efficiently.
Organizations adopting Change Management frameworks benefit from enhanced system stability, improved compliance, and reduced operational risk. By standardizing the process, Change Management enables collaboration among IT, security, and business units while ensuring that critical systems are protected during modifications.
The process that governs controlled, documented system modifications is Change Management, making it the correct answer.
Question 85:
Which attack targets network communications to intercept or modify transmitted data?
A) Phishing
B) Man-in-the-Middle
C) Denial-of-Service
D) Brute-Force
Answer: B
Explanation:
Man-in-the-Middle (MitM) attacks occur when an attacker intercepts communications between two parties to capture, alter, or inject data. Unlike Phishing, which manipulates users into revealing sensitive information, Denial-of-Service attacks, which disrupt services, or Brute-Force attacks, which attempt to guess credentials, MitM directly targets the confidentiality and integrity of network transmissions.
MitM attacks can be executed through techniques such as ARP spoofing, DNS poisoning, HTTPS stripping, Wi-Fi eavesdropping, or session hijacking. The attacker may monitor traffic to steal credentials, inject malicious content, modify transactions, or impersonate one of the communicating parties. For example, an attacker on an unsecured public Wi-Fi network could intercept login credentials sent over an unencrypted connection, compromising sensitive accounts.
Preventing MitM attacks requires a combination of technical and procedural controls. Encryption protocols such as TLS and VPNs protect data in transit, making intercepted communications unreadable. Mutual authentication ensures that both parties verify each other’s identity, reducing the risk of impersonation. Secure certificate validation, strong encryption algorithms, and public key infrastructure (PKI) enhance trust in network communications.
MitM attacks occur when an attacker positions themselves between two communicating parties, intercepting, altering, or injecting data without the knowledge of the legitimate participants. This can happen on insecure Wi-Fi networks, compromised routers, or through DNS and ARP spoofing techniques. Attackers may steal credentials, financial information, or other sensitive data or inject malicious content to compromise systems further. Because the attack occurs silently, victims often remain unaware of the interception, making it highly effective and dangerous.
These attacks are particularly dangerous in financial, healthcare, and enterprise environments, where sensitive data is regularly transmitted across networks. For example, login credentials, banking information, health records, and proprietary business data are prime targets. Attackers can leverage stolen credentials to escalate privileges, access additional systems, or perform fraud. MitM attacks can also be used as a stepping stone to further attacks, such as session hijacking, code injection, or malware deployment.
Preventing MitM attacks requires a layered approach. Network security measures, such as VPNs, ensure encrypted tunnels over potentially insecure networks. Enforcing HTTPS with TLS for all web communications guarantees confidentiality and integrity for browser-based interactions. Strong cryptographic protocols, such as AES and RSA, combined with up-to-date certificate management, prevent attackers from exploiting weak or expired encryption. Mutual TLS (mTLS) strengthens authentication by ensuring that both client and server verify each other’s certificates.
Procedural controls are equally important. Organizations must educate users to recognize suspicious network behavior, avoid untrusted Wi-Fi networks, and validate website certificates. Continuous network monitoring and intrusion detection systems can identify unusual patterns, such as repeated handshake failures or abnormal packet flows, which may indicate an ongoing MitM attempt. Regular audits, penetration testing, and incident response planning help organizations remain prepared to detect and mitigate attacks effectively.
MitM attacks demonstrate the critical importance of protecting data in transit, validating identities, and maintaining end-to-end encryption. Without proper security measures, sensitive communications are vulnerable to interception and tampering. By combining technical safeguards, user awareness, and proactive monitoring, organizations can minimize the risk of MitM attacks and maintain the confidentiality, integrity, and authenticity of network communications.
The attack that intercepts or modifies transmitted network data is a Man-in-the-Middle attack, making it the correct answer.
Question 86:
Which type of security control enforces policies to prevent security incidents before they occur?
A) Detective
B) Corrective
C) Preventive
D) Deterrent
Answer: C
Explanation:
Detective controls identify and alert organizations after incidents have occurred, often through monitoring, intrusion detection systems, or audit logs. Corrective controls aim to restore systems to a secure state after a security incident, such as restoring backups, patching vulnerabilities, or applying configuration changes. Deterrent controls, on the other hand, discourage potential attackers from taking actions that could lead to security breaches but do not actively stop an incident from happening; examples include warning banners or signage.
Preventive controls are proactive measures implemented to stop security incidents before they happen. They are the first line of defense in any security strategy and serve to reduce the likelihood of exploitation. Examples of preventive controls include access control mechanisms that restrict unauthorized users, firewalls that block suspicious traffic, intrusion prevention systems, and encryption that protects data both at rest and in transit. Strong authentication mechanisms, such as multi-factor authentication, password policies, and biometrics, also serve as preventive controls by ensuring only authorized users gain access. Policies, training, and awareness programs are further preventive measures, helping to minimize human errors that could lead to breaches.
The effectiveness of preventive controls lies in their ability to address vulnerabilities before attackers exploit them. By implementing strong preventive controls, organizations not only reduce the risk of data breaches but also enhance compliance with regulations and standards, such as ISO 27001, GDPR, and HIPAA. Preventive controls also support business continuity by minimizing downtime and loss of productivity. They are integral to a layered security approach, forming a foundation upon which detective and corrective controls build. For instance, a properly configured firewall (preventive) works together with an intrusion detection system (detective) and a backup recovery plan (corrective) to create a robust security posture.
Preventive controls are the measures that enforce security policies proactively, directly aiming to prevent unauthorized access, data loss, and other security incidents. They form a cornerstone of risk management and proactive cybersecurity strategies. This proactive approach ensures that vulnerabilities are addressed before exploitation, reducing potential impacts, protecting sensitive data, and maintaining system integrity and availability. Therefore, the control type that enforces policies to prevent incidents before they occur is Preventive, making it the correct answer.
Question 87:
Which protocol provides secure communication over an insecure network by encrypting data in transit?
A) HTTP
B) FTP
C) HTTPS
D) Telnet
Answer: C
Explanation:
HTTP transmits data in plaintext, meaning anyone monitoring network traffic can read the transmitted information, including sensitive details like login credentials or personal information. FTP, while widely used for file transfers, also transmits data and credentials in cleartext unless explicitly paired with an encryption protocol such as FTPS or SFTP. Telnet, which allows remote terminal connections, similarly transmits commands and authentication information unencrypted, making it highly vulnerable to interception and man-in-the-middle attacks.
HTTPS, which combines HTTP with SSL/TLS encryption, is designed to provide secure communication over potentially insecure networks. When data is transmitted via HTTPS, it is encrypted using symmetric encryption for efficiency and asymmetric encryption for secure key exchange. TLS also provides authentication through certificates, ensuring the client is communicating with the legitimate server. In addition to confidentiality, HTTPS maintains data integrity by detecting tampering during transit and supports authenticity, protecting users from impersonation attacks.
Modern websites, especially those handling sensitive data such as banking, e-commerce, and healthcare platforms, universally adopt HTTPS. Without HTTPS, users are exposed to threats like session hijacking, eavesdropping, and injection attacks. Proper configuration of HTTPS requires the use of valid digital certificates, strong cipher suites, and adherence to security best practices, including enforcing HSTS policies and disabling insecure legacy protocols. The widespread adoption of HTTPS has made it the standard for secure web communication, with browsers now flagging sites without HTTPS as insecure.
HTTPS, which combines the Hypertext Transfer Protocol (HTTP) with Transport Layer Security (TLS), provides multiple layers of protection. TLS encrypts data in transit, ensuring that sensitive information such as passwords, credit card details, and personal identification cannot be intercepted by unauthorized parties. Encryption also protects against data tampering, ensuring that messages are delivered without modification from source to destination. Additionally, HTTPS ensures server authentication, meaning that users can verify they are communicating with the intended website and not a fraudulent or malicious clone.
One critical component of HTTPS is the use of digital certificates issued by trusted Certificate Authorities (CAs). These certificates validate the identity of websites and facilitate the secure exchange of encryption keys. When a browser establishes an HTTPS connection, it verifies the certificate, performs a handshake, and negotiates a secure session using symmetric encryption for speed and efficiency. Proper certificate management—including timely renewal, revocation handling, and configuration of intermediate certificates—is essential for maintaining trust and avoiding security warnings or connection failures.
HTTPS also supports modern security mechanisms such as HTTP Strict Transport Security (HSTS), which enforces the use of HTTPS for all connections, protecting users from protocol downgrade attacks and cookie hijacking. TLS configuration best practices involve disabling outdated protocols such as SSLv3 or TLS 1.0/1.1, selecting strong cipher suites resistant to known cryptographic attacks, and enabling forward secrecy to protect past communications even if long-term keys are compromised.
Beyond encryption, HTTPS has become critical for maintaining user trust and search engine ranking. Major browsers mark non-HTTPS sites as “Not Secure,” which can deter users and damage a website’s credibility. Search engines, including Google, also prioritize HTTPS-enabled sites in their rankings, reinforcing the importance of adopting secure communications.
Overall, HTTPS is the protocol that ensures secure, encrypted communication over insecure networks. By protecting the confidentiality, integrity, and authenticity of data in transit, it provides a robust foundation for secure web-based interactions. Without HTTPS, users and organizations are highly vulnerable to interception, data manipulation, and impersonation attacks. Hence, the correct answer is HTTPS.
Question 88:
Which type of testing evaluates a system from the perspective of an attacker without knowledge of internal components?
A) White-Box Testing
B) Gray-Box Testing
C) Black-Box Testing
D) Static Code Analysis
Answer: C
Explanation:
White-box testing involves comprehensive access to the system’s internal components, including source code, configuration files, and architecture. Testers use this knowledge to identify vulnerabilities and logic flaws. Gray-box testing represents a hybrid approach where testers have partial knowledge of the internal workings, often focusing on specific modules or functions, which allows for targeted testing. Static code analysis inspects source code without executing it, identifying vulnerabilities like buffer overflows, input validation errors, and insecure coding practices.
Black-box testing, however, evaluates a system purely from the perspective of an external attacker, without access to source code, internal architecture, or system documentation. The tester interacts with the system through its external interfaces, such as web applications, APIs, and network endpoints, attempting to find vulnerabilities visible to outside users. This simulates real-world attacks by adversaries who typically have no internal system knowledge. Black-box testing emphasizes input validation, authentication mechanisms, session management, and access control effectiveness, often uncovering flaws such as SQL injection, cross-site scripting, and misconfigurations.
Black-box testing is particularly valuable for penetration testing, as it highlights vulnerabilities exploitable from an external viewpoint. It requires testers to think creatively, exploring every interaction with the system as a potential attack vector. Since testers lack internal knowledge, they rely on trial-and-error, pattern recognition, and automated tools to identify weaknesses. Combining black-box testing with gray-box or white-box testing in a layered approach enhances overall security assessment.
The key benefit of black-box testing lies in its realism: it mirrors an attacker’s approach, providing organizations with actionable insights into vulnerabilities exposed externally. This testing methodology simulates real-world scenarios where malicious actors have no prior access to source code, internal documentation, or system configurations. As a result, it effectively identifies weaknesses that might otherwise be overlooked in controlled internal testing environments, such as misconfigured servers, unprotected APIs, weak authentication mechanisms, and exposed network services.
Black-box testing also encourages the use of diverse testing techniques, including fuzzing, input validation testing, and automated vulnerability scanning. Fuzzing involves sending unexpected or malformed inputs to applications to observe how they respond, potentially revealing critical security flaws. Input validation testing ensures that systems properly handle user inputs without allowing injection attacks or buffer overflows. Automated vulnerability scanning tools help testers quickly assess system security against known vulnerabilities and configurations, supplementing manual testing efforts and improving overall coverage.
Another important aspect of black-box testing is its role in compliance and regulatory verification. Many frameworks, such as PCI DSS, ISO 27001, and NIST guidelines, require external testing to confirm that systems are secure against attacks that do not assume internal knowledge. Organizations can use black-box testing results to demonstrate adherence to these standards, showing that security controls are not only theoretically implemented but also effective in practice.
Furthermore, black-box testing helps organizations prioritize remediation efforts. By focusing on vulnerabilities that are externally exploitable, it identifies the issues most likely to be targeted by attackers. This prioritization allows security teams to allocate resources effectively, patch critical weaknesses, and strengthen defenses against high-risk threats. Black-box testing also complements other testing methods, providing a more comprehensive security assessment when combined with gray-box or white-box testing, penetration tests, and continuous monitoring practices.
Overall, black-box testing is essential for realistic security evaluations. It simulates the perspective of an external attacker, identifies vulnerabilities visible to outside observers, and helps organizations improve defenses proactively. By emphasizing practical risk mitigation rather than theoretical security, it provides critical insights for securing systems against real-world threats. Therefore, the type of testing that evaluates a system without internal knowledge is Black-Box Testing, making it the correct answer.
Question 89:
Which security principle states that systems should operate securely even if their design is publicly known?
A) Security through Obscurity
B) Open Design
C) Defense in Depth
D) Least Privilege
Answer: B
Explanation:
Security through Obscurity relies on keeping implementation details secret, which is inherently risky because once the details are exposed, the system becomes vulnerable. Defense in Depth focuses on layering security controls to reduce risk, but does not inherently address whether a system is secure if design details are known. Least Privilege restricts user access to only what is necessary, but does not directly relate to the transparency of design.
Open Design, by contrast, asserts that a system should remain secure even when its design is fully visible. The principle encourages building security that does not rely on secrecy of implementation, fostering transparency, trust, and verifiability. It promotes practices such as thorough code review, cryptographic standards, secure protocols, and rigorous testing, ensuring systems are robust even under scrutiny. Cryptographic algorithms are a prime example: their security is public, yet they remain secure due to strong mathematical foundations rather than secrecy.
Open Design supports the principle of “assume the attacker knows everything except secret keys,” which helps organizations anticipate attacks and design systems resilient to exploitation. It also aligns with modern security standards and regulatory requirements, emphasizing auditable, verifiable, and resilient systems. By following Open Design, developers focus on building strong, tested security mechanisms rather than relying on hidden code or undocumented features.
An important aspect of Open Design is that it encourages transparency in development and implementation. By making design principles, protocols, and architectural decisions publicly known—or at least subject to review—organizations can identify weaknesses early in the development lifecycle. This transparency reduces reliance on obscurity as a security measure, which is often brittle and unreliable. Instead, it shifts the focus toward proven cryptographic methods, secure coding practices, and layered defenses that do not fail simply because an attacker knows how the system works.
Open Design also supports peer review and community-driven security assessments. When security professionals can analyze a system openly, vulnerabilities are more likely to be discovered and patched before malicious actors exploit them. Open-source software is a prime example of this principle in action, as it benefits from constant scrutiny from global security communities, resulting in higher trust and reliability. Moreover, Open Design encourages organizations to adopt defensive mechanisms that are inherently strong and auditable, such as formal verification methods, code signing, and comprehensive logging.
From a risk management perspective, Open Design ensures that security does not rely on secrecy of implementation, which can be breached or leaked. It promotes resilience under attack scenarios and prepares systems to withstand attempts to exploit known design features. This principle also integrates seamlessly with other security best practices, such as defense in depth, least privilege, and secure lifecycle management.
By emphasizing verifiable and resilient security mechanisms, Open Design helps organizations maintain a long-term security posture, increase trust among stakeholders, and foster a culture of continuous improvement. Therefore, the principle ensuring security even if the design is publicly known is Open Design, making it the correct answer.
Question 90:
Which type of attack attempts to guess passwords by trying every possible combination?
A) Brute-Force Attack
B) Rainbow Table Attack
C) Phishing
D) Dictionary Attack
Answer: A
Explanation:
Rainbow Table attacks exploit precomputed tables mapping hashed passwords to plaintext equivalents, allowing attackers to reverse weak hashes efficiently. Phishing targets human users to obtain credentials or sensitive information by deception rather than systematically guessing. Dictionary attacks attempt likely passwords based on common words or patterns instead of trying all possible combinations.
Brute-Force Attacks systematically try every possible character combination until the correct password is discovered. They are effective against weak passwords but exponentially increase in difficulty as password length and complexity increase. A well-implemented brute-force attack may use automated tools to attempt thousands or millions of password combinations quickly. Defense strategies include enforcing strong, complex passwords, implementing account lockouts after repeated failed attempts, using rate limiting, and applying multi-factor authentication.
Brute-force attacks highlight the importance of secure password policies, including a mix of letters, numbers, and special characters, and avoiding predictable sequences. They also emphasize the need to hash passwords securely using salts to prevent attackers from leveraging precomputed hash tables efficiently. Organizations often use intrusion detection systems and monitoring to identify brute-force attempts in real time, mitigating risks before compromise occurs.
In addition, brute-force attacks can be executed both online and offline. Online brute-force attacks attempt login credentials directly against a live system, often triggering security alerts and potentially being slowed by account lockouts or rate-limiting mechanisms. Offline brute-force attacks occur when attackers obtain hashed password databases and attempt to crack them using computational power without interacting with the live system. Offline attacks are typically faster and can be highly effective if passwords are weak or if hashing algorithms are outdated or unsalted. This distinction emphasizes the need for strong cryptographic hashing algorithms, such as bcrypt, scrypt, or Argon2, which are designed to slow down brute-force attempts and increase the computational cost of cracking passwords.
Moreover, brute-force attacks underline the importance of multi-factor authentication (MFA) as an additional layer of defense. Even if an attacker successfully guesses a password, MFA requires a second factor, such as a one-time code or biometric verification, reducing the risk of unauthorized access. Organizations may also implement adaptive authentication, which evaluates login attempts based on user behavior, location, and device context to further mitigate brute-force risks.
Brute-force attacks also have implications for system performance and security monitoring. Continuous failed login attempts can indicate targeted attacks, prompting organizations to respond with temporary IP blocking, alerting security teams, or initiating forensic investigations. Awareness and user education play a role as well, as users must understand the importance of unique, complex passwords for each system to reduce the likelihood of compromise across multiple accounts.
Overall, brute-force attacks represent a methodical, exhaustive approach to unauthorized access, highlighting the critical need for comprehensive password security policies, strong hashing practices, layered defenses, and proactive monitoring. The type of attack that systematically tries every possible password combination is a Brute-Force Attack, making it the correct answer.