025-2026 LATEST CYBERSECURITY II
2
MANAGEMENT UPDATED EXAMS
WITH Q&A 100% ACCURATE
ANSWERS {CLEANEST VERSION}
hat is a vulnerability? - CORRECT ANSWER-a weakness in an information system,
W
system security procedures, internal controls, or implementation that could be exploited
or triggered by a threat source.
hat is a penetration test? - CORRECT ANSWER-a simulated cyber attack against
W
your systems or company
hat are the typical steps for a vulnerability test? - CORRECT ANSWER-Identify asset
W
classification list, identify vulnerabilities, test assets against vulnerabilities, and
recommend solutions to either eliminate or mitigate vulnerabilities
hat is the first thing an organization should do before defining security requirements? -
W
CORRECT ANSWER-To define security requirements, first an organization must define
its risk appetite.
hat is defense in depth? - CORRECT ANSWER-defense-in-depth principle; it is by
W
adding relevant layer of controls (e.g., access control, encryption, and monitoring) that
the expected level of protection is achieved.
hat are COTS applications? - CORRECT ANSWER-Applications developed by
W
vendors and installed on the organization's information systems. These applications are
usually purchased outright by organizations with usage based on licensing agreements.
hat are SaaS applications? - CORRECT ANSWER-Applications developed by
W
service providers or vendors and installed on the provider or vendor information system.
Organizations typically have an on-demand or pay-per-usage metrics.
hat is the goal of a security test? - CORRECT ANSWER-Verify that a control is
W
functioning properly.
, hat is a security assessment? - CORRECT ANSWER-A comprehensive reviews of
W
the security of a system, application, or other tested environment
hat is the NIST SP 800-53A? - CORRECT ANSWER-The National Institute for
W
Standards and Technology (NIST) offers a special publication that describes best
practices in conducting security and privacy assessments.
hat is COBIT? - CORRECT ANSWER-the Control Objectives for Information and
W
related Technologies describes the common requirements that organizations should
have in place surrounding their information systems.
hat does ISO 27001 describe? - CORRECT ANSWER-A standard approach for
W
setting up an information security management system
hat does ISO 27002 describe? - CORRECT ANSWER-It details specifics of
W
information security controls
hat does a vulnerability scan do? - CORRECT ANSWER-automatically probe
W
systems, applications, and networks, looking for weaknesses that may be exploited by
an attacker.
hat are the four main categories of vulnerability scans? - CORRECT
W
ANSWER-Network discovery scans, network vulnerability scans, web application
vulnerability scans, and database vulnerability scans
hat is NMAP? - CORRECT ANSWER-The most common tool used for network
W
discovery scanning
hat does a network vulnerability scanner do? - CORRECT ANSWER-Probe a
W
targeted system or network for the presence of known vulnerabilities.
hat is a false positive? - CORRECT ANSWER-The scanner may not have enough
W
information to conclusively determine that a vulnerability exists and it reports a
vulnerability when there really is no problem.
hat is a false negative? - CORRECT ANSWER-When the vulnerability scanner
W
misses a vulnerability and fails to alert the administrator to the presence of it
/F - By default, network vulnerability scanners run unauthenticated scans. -
T
CORRECT ANSWER-True
, ne way to improve the accuracy of the scanning and reduce false positive and false
O
negative reports is to perform what kind of scans? - CORRECT
ANSWER-authenticated scans
hat is sqlmap? - CORRECT ANSWER-A commonly used open-source database
W
vulnerability scanner that allows security administrators to probe web applications for
database vulnerabilities
hat is Metasploit? - CORRECT ANSWER-a tool to automatically execute exploits
W
against targeted systems
hat is a white box penetration test? - CORRECT ANSWER-Provides the attackers
W
with detailed information about the systems they target. This bypasses many of the
reconnaissance steps that normally precede attacks, shortening the time of the attack
and increasing the likelihood that it will find security flaws.
hat is a gray box penetration test? - CORRECT ANSWER-Also known as partial
W
knowledge tests, these are sometimes chosen to balance the advantages and
disadvantages of white and black box penetration tests.
hat is a black box penetration test? - CORRECT ANSWER-Does not provide
W
attackers with any information prior to the attack. This simulates an external attacker
trying to gain access to information about the business and technical environment
before engaging in an attack.
hat is static testing? - CORRECT ANSWER-Evaluates the security of software
W
without running it by analyzing either the source code or the compiled application.
hat is dynamic testing? - CORRECT ANSWER-Evaluates the security of software in
W
a runtime environment and is often the only option for organizations deploying
applications written by someone else.
hat is fuzz testing? - CORRECT ANSWER-A specialized dynamic testing technique
W
that provides many different types of input to software to stress its limits and find
previously undetected flaws.
hat is bit flipping? - CORRECT ANSWER-The process of slightly manipulating the
W
input
2
MANAGEMENT UPDATED EXAMS
WITH Q&A 100% ACCURATE
ANSWERS {CLEANEST VERSION}
hat is a vulnerability? - CORRECT ANSWER-a weakness in an information system,
W
system security procedures, internal controls, or implementation that could be exploited
or triggered by a threat source.
hat is a penetration test? - CORRECT ANSWER-a simulated cyber attack against
W
your systems or company
hat are the typical steps for a vulnerability test? - CORRECT ANSWER-Identify asset
W
classification list, identify vulnerabilities, test assets against vulnerabilities, and
recommend solutions to either eliminate or mitigate vulnerabilities
hat is the first thing an organization should do before defining security requirements? -
W
CORRECT ANSWER-To define security requirements, first an organization must define
its risk appetite.
hat is defense in depth? - CORRECT ANSWER-defense-in-depth principle; it is by
W
adding relevant layer of controls (e.g., access control, encryption, and monitoring) that
the expected level of protection is achieved.
hat are COTS applications? - CORRECT ANSWER-Applications developed by
W
vendors and installed on the organization's information systems. These applications are
usually purchased outright by organizations with usage based on licensing agreements.
hat are SaaS applications? - CORRECT ANSWER-Applications developed by
W
service providers or vendors and installed on the provider or vendor information system.
Organizations typically have an on-demand or pay-per-usage metrics.
hat is the goal of a security test? - CORRECT ANSWER-Verify that a control is
W
functioning properly.
, hat is a security assessment? - CORRECT ANSWER-A comprehensive reviews of
W
the security of a system, application, or other tested environment
hat is the NIST SP 800-53A? - CORRECT ANSWER-The National Institute for
W
Standards and Technology (NIST) offers a special publication that describes best
practices in conducting security and privacy assessments.
hat is COBIT? - CORRECT ANSWER-the Control Objectives for Information and
W
related Technologies describes the common requirements that organizations should
have in place surrounding their information systems.
hat does ISO 27001 describe? - CORRECT ANSWER-A standard approach for
W
setting up an information security management system
hat does ISO 27002 describe? - CORRECT ANSWER-It details specifics of
W
information security controls
hat does a vulnerability scan do? - CORRECT ANSWER-automatically probe
W
systems, applications, and networks, looking for weaknesses that may be exploited by
an attacker.
hat are the four main categories of vulnerability scans? - CORRECT
W
ANSWER-Network discovery scans, network vulnerability scans, web application
vulnerability scans, and database vulnerability scans
hat is NMAP? - CORRECT ANSWER-The most common tool used for network
W
discovery scanning
hat does a network vulnerability scanner do? - CORRECT ANSWER-Probe a
W
targeted system or network for the presence of known vulnerabilities.
hat is a false positive? - CORRECT ANSWER-The scanner may not have enough
W
information to conclusively determine that a vulnerability exists and it reports a
vulnerability when there really is no problem.
hat is a false negative? - CORRECT ANSWER-When the vulnerability scanner
W
misses a vulnerability and fails to alert the administrator to the presence of it
/F - By default, network vulnerability scanners run unauthenticated scans. -
T
CORRECT ANSWER-True
, ne way to improve the accuracy of the scanning and reduce false positive and false
O
negative reports is to perform what kind of scans? - CORRECT
ANSWER-authenticated scans
hat is sqlmap? - CORRECT ANSWER-A commonly used open-source database
W
vulnerability scanner that allows security administrators to probe web applications for
database vulnerabilities
hat is Metasploit? - CORRECT ANSWER-a tool to automatically execute exploits
W
against targeted systems
hat is a white box penetration test? - CORRECT ANSWER-Provides the attackers
W
with detailed information about the systems they target. This bypasses many of the
reconnaissance steps that normally precede attacks, shortening the time of the attack
and increasing the likelihood that it will find security flaws.
hat is a gray box penetration test? - CORRECT ANSWER-Also known as partial
W
knowledge tests, these are sometimes chosen to balance the advantages and
disadvantages of white and black box penetration tests.
hat is a black box penetration test? - CORRECT ANSWER-Does not provide
W
attackers with any information prior to the attack. This simulates an external attacker
trying to gain access to information about the business and technical environment
before engaging in an attack.
hat is static testing? - CORRECT ANSWER-Evaluates the security of software
W
without running it by analyzing either the source code or the compiled application.
hat is dynamic testing? - CORRECT ANSWER-Evaluates the security of software in
W
a runtime environment and is often the only option for organizations deploying
applications written by someone else.
hat is fuzz testing? - CORRECT ANSWER-A specialized dynamic testing technique
W
that provides many different types of input to software to stress its limits and find
previously undetected flaws.
hat is bit flipping? - CORRECT ANSWER-The process of slightly manipulating the
W
input
