TheorySecurityX Test Prep Practice Questions
Free SecurityX Test Prep practice questions with answers and plain-English explanations. Browse the PDF, video and online mock test.
SecurityX Test Prep Questions
Open each answer, read the explanation, then continue into the full practice flow.
Q1Which of the following is an advantage of using elliptic curve cryptography (ECC) over RSA?
Show answer
✓ Correct answer: ECC requires shorter key lengths to achieve comparable security.
Answer: ECC requires shorter key lengths to achieve comparable security. Elliptic curve cryptography (ECC) is known for its efficiency in key length. It provides the same level of security as RSA but with significantly shorter key sizes. This results in faster computations and less storage requirement. Contrary to the distractors, ECC is not necessarily faster to implement in hardware, and its complexity can make it challenging to understand and implement. It also does not generate longer keys but rather achieves stronger security with shorter keys.
Q2A system administrator notices an employee with a company-issued laptop has installed software not available in the official repositories. What is the likely security issue with the laptop?
Show answer
✓ Correct answer: The laptop has been rooted.
Answer: The laptop has been rooted. Rooting removes system-imposed restrictions, allowing the installation of software from any source. Encrypting data through Full-Device Encryption (FDE) ensures data security. An eFuse is used to prevent tampering with system components. BIOS and firmware issues often relate to versioning and compatibility management.
Q3Which of the following techniques involves examining and monitoring server traffic in real-time to identify and mitigate potential security threats?
Show answer
✓ Correct answer: Network traffic analysis
Answer: Network traffic analysis Network traffic analysis is the process of intercepting and examining messages to deduce information from patterns in communication, which helps in identifying malicious activities and security threats in real-time. Sandboxing is a way to safely run a program in a specific isolated environment. Static code analysis involves examining code without executing it, to find vulnerabilities early in the development process. Peering is a technique for directly connecting two networks.
Q4BrightFuture Corp. uses an extensive IoT network for industrial monitoring. To ensure no unauthorized access to their sensor data, BrightFuture Corp. produces and securely stores its own cryptographic keys, without granting any access to their IoT service provider. What approach to key management is BrightFuture Corp. using?
Show answer
✓ Correct answer: HYOK
Answer: HYOK With an HYOK (hold your own key) model, customers create and manage their own keys. The IoT service provider does not have access to the keys and cannot decrypt the data. With a BYOK (bring your own key) model, customers create and manage their own keys, but the IoT service provider is allowed access to the keys and can decrypt the data. BYOD (bring your own device) is related to employees using their own devices to access corporate resources. A RRSIG (resource record digital signature) record is a type of DNSSEC record.
Q5A security specialist is evaluating a company's procedures for maintaining secure backups of sensitive data. They find that: encryption is enforced for all backups; access to backup media requires multi-factor authentication (MFA); all backup activities are logged and audited; and backup data can be deleted by an administrator. Based on this information, what should the specialist recommend?
Show answer
✓ Correct answer: Disallow an administrator from deleting backup data
Disallow an administrator from deleting backup data. Implementing strong security controls, such as disallowing any user (including administrators) from deleting backup data, is critical. Enforcing MFA, encryption, and logging and auditing activities are essential practices to ensure secure backups.
Q6A cybersecurity team needs to identify potential vulnerabilities in their network devices. Which of the following tools is NOT primarily used for vulnerability scanning?
Show answer
✓ Correct answer: Wireshark
Correct answer: Wireshark Wireshark is a network protocol analyzer used to capture and analyze network traffic, not a vulnerability scanner. Nessus is a widely used vulnerability scanner that helps identify vulnerabilities, configuration issues, and policy compliance. OpenVAS (Open Vulnerability Assessment System) is also a comprehensive vulnerability scanning tool to detect security issues. Qualys is a cloud-based service that provides vulnerability scanning, compliance management, and other security services.
Q7Which of the following is a protocol used for secure remote management and communication?
Show answer
✓ Correct answer: SSH
Answer: SSH Secure Shell (SSH) is a protocol used for secure remote management and for securely accessing a remote computer over an unsecured network. It encrypts the data being transmitted, ensuring confidentiality and integrity. FTP is the File Transfer Protocol, which is used for transferring files but does not encrypt the data. HTTP stands for HyperText Transfer Protocol, used primarily for accessing websites over the internet but without built-in encryption. SNMP is the Simple Network Management Protocol, which is used for network management but typically lacks encryption.
Q8What does the Wireshark "tcp.flags.syn == 1 and tcp.flags.ack == 0" filter do?
Show answer
✓ Correct answer: Filter for TCP SYN packets
Answer: Filter for TCP SYN packets The Wireshark filter "tcp.flags.syn == 1 and tcp.flags.ack == 0" is used to capture TCP SYN packets. TCP SYN packets are the first step in the TCP three-way handshake and are useful for identifying network connections being initiated. The command "tcp.flags.syn == 1 and tcp.flags.ack == 0" would be used within Wireshark to filter out only SYN packets, which are used to initiate TCP connections. Other filters such as "tcp.port" for port-specific traffic and "ip.addr" for traffic from a specific IP address can be combined with this filter for more granular monitoring. Filtering for TCP SYN packets can help network security professionals monitor for new connection attempts and potential scan activities.
Q9All of the following are key sources for obtaining information on network vulnerabilities EXCEPT:
Show answer
✓ Correct answer: ISO
Answer: ISO The International Organization for Standardization (ISO) provides standards for various aspects of technology and security, but does not provide real-time information on network vulnerabilities. The United States Computer Emergency Readiness Team (US-CERT) provides security advisories. The Open Vulnerability and Assessment Language (OVAL) produces definitions for detecting vulnerabilities. The National Vulnerability Database (NVD) is a repository of vulnerability information.
Q10TechCorp aims to identify security vulnerabilities in its applications during development, before the applications are moved to cloud infrastructure. Which security tool should TechCorp implement to achieve this goal?
Show answer
✓ Correct answer: SAST
Answer: SAST Static application security testing (SAST) tools analyze source code for potential security vulnerabilities such as buffer overflows and injection flaws early in the development lifecycle. This allows developers to rectify issues before deploying the application to the cloud. Dynamic application security testing (DAST) tools evaluate applications in runtime and do not analyze source code. A port scanner reviews network endpoints to identify open ports and running services. Vulnerability scanners are generally used to detect known vulnerabilities in deployed systems and applications.
Full SecurityX Test Prep bank + unlimited mocks
Try 30 questions free. Unlock the complete SecurityX Test Prep question bank, every explanation, and unlimited timed mock exams. Practice on any device.
Unlock SecurityX Test Prep →