CYSA EXAM STUDY GUIDE QUESTIONS AND ANSWERS
VERIFIED 100% CORRECT
Which one of the following is a characteristic of DevOps approaches to technology?
A. Isolating operations teams from development teams
B. Requiring clear hands-offs between development and production
C. Increasing the frequency of application releases
D. Eliminating the need for developers to understand business requirements -
ANSWER C. Increasing the frequency of application releases
Which one of the following conditions is not likely to trigger an alert during an automated
cloud security assessment?
A. Presence of an API key in a public repository
B. Unrestricted API keys
C. Transmission of an API key over unsecured channels
D. Sharing of API keys among different developers - ANSWER D. Sharing of API keys
among different developers
In which cloud computing service model does the customer share responsibility with the
cloud provider for datacenter security?
A. IaaS
B. SaaS
C. PaaS
D. None of the above - ANSWER D. None of the above
What type of credential is commonly used to restrict access to an API?(Application
Programming Interface)
A. Encryption Key
B. API Key
C. Password
D. Biometrics - ANSWER B. API Key
In which of the following cloud categories are customers typically charged based on the
number of virtual server instances dedicated to their use?
A. Iaas Only
B. SaaS only
C. IaaS and PaaS
D. IaaS, SaaS, and PaaS - ANSWER C. IaaS and PaaS
,I'm reviewing my orgs network design and am concerned that a known flaw in the
border router could let an attacker disable my Internet Connectivity. Which of the
following is an appropriate compensatory control?
A. An identical second redundant router set up in an active/passive design
B. An alternate Internet connectivity method using a a different router type
C. An identical second redundant router set up in an active/active design
D. A firewall in front of the router to stop any potential exploits that could cause a failure
of connectivity - ANSWER B. An alternate Internet connectivity method using a a
different router type
Which of the following layered security controls is commonly used at the WAN, LAN,
and host layer in a security design?
A. Encryption of data at rest
B. Firewalls
C. DMZs
D. Antivirus - ANSWER B. Firewalls
I need to implement a control to ensure that I'm notified of changes to important
configuration files on my server. What type of tool should I use for this control?
A. Antimalware
B. Config Management
C. File integrity checking
D. Logging - ANSWER C. File integrity checking
I've configured my network to provide false DNS responses for known malware
domains. What technique am I using?
A. Blacklisting
B. Whitelisting
C. Sinkholing
D. Honeypotting - ANSWER C. Sinkholing
I'm designing a multifactor authentication system for my company. I've decided to use a
passphrase, a time-based code generator, and a PIN to provide additional security.
How many distinct factors will I have implemented when done?
A. One
B. Two
C. Three
D. Four - ANSWER B. Two
I want to manage access based on the job titles of members of my orgs staff. What kind
of access control is best suited to this requirement?
A. Role-based access control
B. Attribute-based access control
, C. Mandatory access control
D. Discretionary access control - ANSWER B. Attribute-based access control
Which of the follwing technologies is not a shared authentication technology?
A. OpenID Connect
B. Attribute-based access control
C. OAuth
D. Facebook Connect - ANSWER B. Attribute-based access control
What security design is best suited to protect authentication and authorization for a
network that uses TACACS+?
A. Use TACACS+ built-in encryption to protect traffic
B. Implement TACACS++
C. Enable accounting services to detect issues
D. Route management traffic over a dedicated network - ANSWER D. Route
management traffic over a dedicated network
I have user rights on my Linux workstation, but want to read my departments financial
reports, which I know is sotred in a directory that only administrators can access. I
execute a local exploit, which gives the ability to act as root. What type of attack is this?
A. Privilege Esc
B. Zero-Day
C. Rootkit
D. Session Hijacking - ANSWER A. Privilege Esc
Which party in a federated identity service model makes assertions about identities to
service providers?
A. RPs
B. CDUs
C. IDPs
D. APs - ANSWER C. IDPs
My successful attack on an authenticated user required me to duplicate the cookies that
the web app put in place to identify the legitimate user. What type of attack did I
conduct? A. Impersonation
B. MitM
C. Session Hijacking
D. Privilege Esc - ANSWER C. Session Hijacking
After a major patch is released for the web application that I'm responsible for, I proceed
to run my web app security scanner against the web application to verify that it is still
secure. What is the term for the process I'm conducting?
A. Code review
VERIFIED 100% CORRECT
Which one of the following is a characteristic of DevOps approaches to technology?
A. Isolating operations teams from development teams
B. Requiring clear hands-offs between development and production
C. Increasing the frequency of application releases
D. Eliminating the need for developers to understand business requirements -
ANSWER C. Increasing the frequency of application releases
Which one of the following conditions is not likely to trigger an alert during an automated
cloud security assessment?
A. Presence of an API key in a public repository
B. Unrestricted API keys
C. Transmission of an API key over unsecured channels
D. Sharing of API keys among different developers - ANSWER D. Sharing of API keys
among different developers
In which cloud computing service model does the customer share responsibility with the
cloud provider for datacenter security?
A. IaaS
B. SaaS
C. PaaS
D. None of the above - ANSWER D. None of the above
What type of credential is commonly used to restrict access to an API?(Application
Programming Interface)
A. Encryption Key
B. API Key
C. Password
D. Biometrics - ANSWER B. API Key
In which of the following cloud categories are customers typically charged based on the
number of virtual server instances dedicated to their use?
A. Iaas Only
B. SaaS only
C. IaaS and PaaS
D. IaaS, SaaS, and PaaS - ANSWER C. IaaS and PaaS
,I'm reviewing my orgs network design and am concerned that a known flaw in the
border router could let an attacker disable my Internet Connectivity. Which of the
following is an appropriate compensatory control?
A. An identical second redundant router set up in an active/passive design
B. An alternate Internet connectivity method using a a different router type
C. An identical second redundant router set up in an active/active design
D. A firewall in front of the router to stop any potential exploits that could cause a failure
of connectivity - ANSWER B. An alternate Internet connectivity method using a a
different router type
Which of the following layered security controls is commonly used at the WAN, LAN,
and host layer in a security design?
A. Encryption of data at rest
B. Firewalls
C. DMZs
D. Antivirus - ANSWER B. Firewalls
I need to implement a control to ensure that I'm notified of changes to important
configuration files on my server. What type of tool should I use for this control?
A. Antimalware
B. Config Management
C. File integrity checking
D. Logging - ANSWER C. File integrity checking
I've configured my network to provide false DNS responses for known malware
domains. What technique am I using?
A. Blacklisting
B. Whitelisting
C. Sinkholing
D. Honeypotting - ANSWER C. Sinkholing
I'm designing a multifactor authentication system for my company. I've decided to use a
passphrase, a time-based code generator, and a PIN to provide additional security.
How many distinct factors will I have implemented when done?
A. One
B. Two
C. Three
D. Four - ANSWER B. Two
I want to manage access based on the job titles of members of my orgs staff. What kind
of access control is best suited to this requirement?
A. Role-based access control
B. Attribute-based access control
, C. Mandatory access control
D. Discretionary access control - ANSWER B. Attribute-based access control
Which of the follwing technologies is not a shared authentication technology?
A. OpenID Connect
B. Attribute-based access control
C. OAuth
D. Facebook Connect - ANSWER B. Attribute-based access control
What security design is best suited to protect authentication and authorization for a
network that uses TACACS+?
A. Use TACACS+ built-in encryption to protect traffic
B. Implement TACACS++
C. Enable accounting services to detect issues
D. Route management traffic over a dedicated network - ANSWER D. Route
management traffic over a dedicated network
I have user rights on my Linux workstation, but want to read my departments financial
reports, which I know is sotred in a directory that only administrators can access. I
execute a local exploit, which gives the ability to act as root. What type of attack is this?
A. Privilege Esc
B. Zero-Day
C. Rootkit
D. Session Hijacking - ANSWER A. Privilege Esc
Which party in a federated identity service model makes assertions about identities to
service providers?
A. RPs
B. CDUs
C. IDPs
D. APs - ANSWER C. IDPs
My successful attack on an authenticated user required me to duplicate the cookies that
the web app put in place to identify the legitimate user. What type of attack did I
conduct? A. Impersonation
B. MitM
C. Session Hijacking
D. Privilege Esc - ANSWER C. Session Hijacking
After a major patch is released for the web application that I'm responsible for, I proceed
to run my web app security scanner against the web application to verify that it is still
secure. What is the term for the process I'm conducting?
A. Code review
