Appendix B. Practice Exams

This set of practice exam questions reviews the foundational ideas that underpin cybersecurity, especially the protection of the CIA triad: confidentiality, integrity, and availability. It reinforces how confidentiality is achieved through controls like encryption, access restrictions, and proper data handling, while integrity focuses on preventing unauthorized or unintended changes and availability emphasizes timely, reliable access to information and services. The questions also connect these principles to related concepts such as digital certificates, authentication methods, biometrics, and encryption in both public-key and general security contexts.

Another major theme is risk, governance, and organizational responsibility. The material highlights how to distinguish between threats, vulnerabilities, threat actors, and risk responses such as mitigation, acceptance, avoidance, and transference. It also covers the purpose of policies, procedures, standards, and regulations, along with the role of professional ethics, including the ISC2 Code of Ethics and obligations under laws and frameworks such as HIPAA and PCI DSS. In addition, the set emphasizes the importance of classification, least privilege, separation of duties, dual control, and other access control principles for limiting exposure and reducing insider misuse.

The final portion shifts into operations, networking, incident response, and resilience planning. It reviews core networking concepts such as Ethernet, TCP and UDP, ports, firewalls, VLANs, IDS and IPS, and common attacks including phishing, smishing, on-path attacks, denial of service, malware, and cross-site scripting. It also tests knowledge of incident response roles and procedures, business continuity and disaster recovery planning, business impact analysis, change management, and environmental safeguards like generators, redundant power, fire suppression, and physical security measures. Overall, the practice exam serves as a broad review of the knowledge needed to recognize threats, apply controls, and support secure and resilient systems.

1. The correct answer is A. Digital certificates are digital credentials that link a public key to an entity's identity, providing a means to verify that an entity is who it claims to be and enabling the authentication of digital documents. For example, when a user visits a secure Web site, the Web site presents a digital certificate to the user's browser.
2. The correct answer is A. Encryption is a method used to protect the confidentiality of data by converting it into a format that can only be read by those with the appropriate decryption key. The other options are incorrect, because digital signatures are used to verify the authenticity and integrity of data and provide non-repudiation, tokenization replaces sensitive data with non-sensitive equivalent, and finally, hashing provides data integrity instead of confidentiality.
3. The correct answer is C. Confidentiality is about ensuring that information is accessible only to those with appropriate privileges and protecting the data from unauthorized access, disclosure, or destruction. For example, an organization might encrypt sensitive documents and make them available only to certain individuals.
4. The correct answer is A. Data integrity refers to ensuring that data is not altered or corrupted in an unintended or unauthorized manner. For example, in a healthcare environment, data integrity ensures that a patient's medical records are accurately maintained and not altered without proper authorization.
5. The correct answer is B. Availability is defined as timely and reliable access to information and the ability to use it. For example, in a cloud storage service, users should be able to retrieve their stored files whenever they need them, and the files should be intact and usable.
6. The correct answer is C. Voice pattern recognition is a type of biometric authentication that verifies a person's identity based on physical or behavioral characteristics unique to that individual. Voice pattern recognition is not a "something you know" factor, as it does not involve knowledge-based information. It is not a "something you have" factor, as it does not involve possessing a physical object. It is also not a "somewhere you are" factor, as it does not involve location-based authentication.
7. The correct answer is A. Authentication typically involves the user providing credentials such as a username and password, a biometric scan, or a security token. For example, when you sign in to your e-mail account, you authenticate your identity by providing your username and password. The remaining options, while related, do not accurately describe the process of verifying a user's identity.
8. The correct answer is A. Authentication is the process of verifying the identity of a user or system, which is a critical step before granting access to a network or system. For example, when you log in to your online banking account, you are authenticated by entering your username and password. You may also be asked to enter a one-time password (OTP).
9. The correct answer is A. Risk mitigation involves implementing strategies to limit the impact or likelihood of threats occurring. Risk acceptance, on the other hand, is a conscious decision to acknowledge a risk but not take immediate action.
10. The correct answer is A. An example of a threat actor could be a group of hackers planning to breach an organization's firewall to gain unauthorized access. The remaining options are incorrect because a way to gain access is a threat vector, an exploitable weakness is a vulnerability, and an event that can negatively impact an organization is a risk.
11. The correct answer is B. The PRIMARY difference between the two types of risk analysis is in the nature and treatment of the data used. Qualitative risk analysis is less precise and relies on subjective data such as expert judgment, perceptions and opinions (e.g., questionnaires). Conversely, quantitative risk analysis uses numerical or statistical data to produce measurable and calculable results (e.g., potential financial loss).
12. The correct answer is D. Risk assessment involves identifying potential threats to an organization's systems and data, evaluating their potential impact and vulnerability, and prioritizing them according to their severity and the resources required to mitigate them. The remaining alternatives are incorrect because the goal of risk assessment is not to analyze, eliminate, or necessarily reduce risk.
13. The correct answer is A. Access controls and encryption protect confidentiality by ensuring that only authorized users have access to sensitive information. In contrast, backup systems and fault tolerance protect availability, digital signatures and checksums protect integrity, and routers and VLANs isolate potential security risks and reduce broadcast domains, but they do not specifically protect confidentiality.
14. The correct answer is B. Risk acceptance is a risk management strategy that involves a conscious decision not to take action to reduce or mitigate a risk. This strategy is typically used when the cost of mitigating the risk is greater than the cost of accepting the risk. Risk avoidance, risk mitigation, and risk transference are all risk management strategies that involve taking action to reduce or mitigate a risk.
15. The correct answer is A. A policy is a high-level document that outlines an organization's cybersecurity principles, rules, and expectations. The remaining options differ from the general nature of a policy because they refer to procedures, standards, and regulations.
16. The correct answer is A. Procedures are documents that outline the specific step-by-step instructions for accomplishing a task or process. Policies are documents that define the rules and guidelines that an organization must follow. Regulations are documents that define the laws that an organization must follow. Standards are documents that define the technical specifications and requirements for a system or process.
17. The correct answer is D. The Internet Engineering Task Force (IETF) sets standards for communication protocols, such as the Internet Protocol (IP), that enable global computer connectivity. In contrast, IEEE focuses on telecommunications and technology standards, ISO develops international standards, including information security, and NIST publishes standards for various technologies.
18. The correct answer is A. HIPAA governs Protected Health Information (PHI), which includes medical information that identifies individuals and is obtained during healthcare. PCI focuses on securing credit card data, PII covers personally identifiable information beyond health data, and PDI is not a commonly used acronym. HIPAA is designed to protect health information, so PHI is the appropriate category.
19. The correct answer is A. The ISC2 Code of Ethics Canon is a set of professional ethics statements that guide the behavior of cybersecurity professionals. It contains four canons, but the three mentioned in this option are: Protect society (Canon 1), Provide diligent and competent service to principals (Canon 3), and Advance and protect the profession (Canon 4), which includes acting ethically.
20. The correct answer is C. Providing diligent and competent service to principals emphasizes the importance of providing quality service to clients or employers and fulfilling professional responsibilities with due care and expertise. The remaining options are not related to this principle.
21. The correct answer is C. Failure to adhere to the principles of the ISC2 Code of Ethics can result in serious consequences, including revocation of certification. Revocation of certification means that the individual is no longer recognized as certified by ISC2, which can have a significant impact on their professional standing and career opportunities. The other options are not as severe or definitive as revocation of certification.
22. The correct answer is D. Incident response focuses on identifying, containing, and remediating security incidents. However, collecting employee data is unnecessary and risks privacy violations. Conversely, log files, network traffic, and system configurations are critical data to collect during incident response to establish timelines, reveal attacker activity, and provide system context.
23. The correct answer is D. In cybersecurity, a threat is a potential malicious actor or event that could cause harm to an organization or its assets. Conversely, a breach is a successful compromise, a zero-day vulnerability is an unpatched vulnerability, and a vulnerability is a system weakness that threats can exploit.
24. The correct answer is B. The public relations coordinator manages external stakeholder communications during incidents, ensuring consistency and accuracy while informing the incident response team. Although critical, roles such as incident manager, technical manager, and legal counsel do not manage external stakeholder communications.
25. The correct answer is D. In a business continuity plan, the list of team members should include multiple contact methods and backup members for accessible communications. Contact numbers for supply chain members belong in the resource continuity section. Notification systems and call trees facilitate communication, and immediate response procedures guide actions, but they're not part of the team list.
26. The correct answer is A. The frequency of testing a business continuity plan should be based on business needs and risks. One-size-fits-all approaches, such as annual, bi-annual, or quinquennial testing intervals, may not be appropriate for some organizations, particularly those that handle sensitive data or operate in high-risk environments, which may require more frequent testing to respond to disruptions effectively.
27. The correct answer is C. A business impact analysis (BIA) assesses the potential impact of a disruption to critical business operations and supports business continuity planning. BIA identifies and prioritizes affected functions, facilitating recovery and business continuity. Options misdefine BIA by referring to recovery procedures, disruptions, or pre-intervention checklists that are different from the focus of BIA.
28. The correct answer is A. A Business Impact Analysis (BIA) is essential to disaster recovery planning. It identifies critical systems and potential impacts and helps prioritize recovery efforts. Prevention alone isn't enough; coordination and impact assessment are critical to planning.
29. The correct answer is D. A Disaster Recovery Plan (DRP) is a detailed document that outlines steps to be taken in the event of a disaster but typically excludes software source code. Executive summaries provide a high-level overview, technical guides provide detailed recovery instructions, and checklists ensure systematic recovery procedures. However, software source code is not typically included in a DRP.
30. The correct answer is A. In disaster recovery planning, RTO defines the maximum downtime tolerance for systems, applications, or networks. Recovery Team Operations, Recovery Team Objective, and Recovery Time Operations are not standard terms in this context.
31. The correct answer is B. Dual control requires two or more people to perform a sensitive task. This method increases security by ensuring no person has complete control over the task. The other options, such as segregation of duties, shared access, and peer review are not exact examples of dual control measures.
32. The correct answer is B. The two-person rule is implemented to prevent unauthorized access to sensitive areas by requiring the presence of two authorized individuals. This measure enhances security by ensuring that no person can access these areas alone, reducing the risk of security breaches. It is not primarily intended to divide the workload, limit access to specific individuals, or duplicate verification tasks.
33. The correct answer is A. Privilege creep occurs when users accumulate unnecessary system privileges without removing old privileges. Rights collision involves conflicts in access control policies. The least privilege grants users only the access they need. Excessive privileges occur when users have more access than their roles require. Privilege creep is a concern because it can lead to security vulnerabilities.
34. The correct answer is B. Controls are measures that ensure the confidentiality (C), integrity (I), and availability (A) of data. They can be technical, physical, or administrative. Other options, such as secure protocols and encryption techniques, relate to the concept but don't fully embody it; policies set rules but are not controls themselves.
35. The correct answer is B. The concentric circle model prioritizes asset protection, which includes data, hardware, software, and people. Other options are layers of protection, not central assets.
36. The correct answer is B. Decentralized access control often leads to inconsistent control over access permissions, resulting in varying levels of security and difficulty maintaining a consistent access control policy. This dispersal of access management across departments or systems can create challenges in enforcing consistent access rights across the organization.
37. The correct answer is A. Separation of duties ensures that different people handle different aspects of a task, preventing conflicts of interest. The least privilege restricts users to only the information and functions they need. Job rotation involves employees periodically changing roles. Security by obscurity relies on secrecy rather than robust security measures.
38. The correct answer is B. The option, "Healthcare workers can only access the assets they need to do their jobs and nothing more," is an example of the principle of least privilege, which advocates minimal access necessary to do one's job. All other options violate the principle of least privilege or privacy.
39. The correct answer is B. Segregation of duties ensures that multiple people are involved in high-risk tasks, preventing fraud and cybersecurity errors. Double-checking tasks is inefficient, spreading the workload evenly is a management strategy, and ensuring equal knowledge of all tasks is impractical and unnecessary.
40. The correct answer is A. CCTV (Closed-Circuit Television) would add a layer of visual surveillance that can deter, detect, and record intruders, enhancing the facility's physical security.
41. The correct answer is A. Crime Prevention through Environmental Design (CPTED) aims to deter crime by improving lighting, landscaping, and building design. Green technologies and policies are unrelated to CPTED's focus on the security of the physical environment.
42. The correct answer is D. Dogs, guards, and fences prevent and deter physical access. Detective controls identify incidents, while recovery controls restore operations. Administrative controls manage security requirements. These physical measures, combined with others, provide comprehensive security.
43. The correct answer is A. A breach is an unauthorized access to or disclosure of PII, such as posting photos of unattended documents. An exploit is the successful use of a system vulnerability that results in unauthorized activity. Attacks attempt to exploit system vulnerabilities but don't necessarily involve unauthorized access to information. Cybersecurity incidents include events that impact operations or infrastructure, not just unauthorized access to PII.
44. The correct answer is B. Biometric authentication, while secure, can raise privacy concerns because it collects personal biological data. Biometric systems offer high security because they rely on unique physical characteristics, making them harder to forge than passwords. While not flawless, inaccuracies are rare and not a PRIMARY concern for users.
45. The correct answer is B. Biometric authentication, such as fingerprint or iris scans, can expose sensitive medical information. Cost and hacking concerns vary, but biometric systems are generally secure. Moreover, they don't always require constant power; many devices run on battery power.
46. The correct answer is B. In a role-based access control (RBAC) model, permissions are assigned based on the user's role within the organization. Assigning permissions based on individual user needs or the last user to access the system would lack consistency and reliability. Similarly, granting privileges at the system administrator's discretion would lack scalability and efficiency in access management.
47. The correct answer is C. Rule-based access control (RuBAC) uses predefined rules for dynamic access. Unlike DAC, access isn't determined by object creators. RuBAC is rule-based, not based on individual privileges or user actions.
48. The correct answer is C. Mandatory Access Control (MAC) grants access based on clearance levels and object classifications. This differs from DAC, which allows user-controlled access; RBAC, which is based on organizational roles; and RuBAC, which is based on system rules.
49. The correct answer is A. Subjects granted access can change security attributes in a Discretionary Access Control (DAC) policy. Reading, modifying, and executing information is not exclusive to DAC; permissions dictate these actions. For example, read permissions allow reading, write permissions allow modification, and execute permissions allow execution.
50. The correct answer is A. Implicit deny denies access by default unless explicitly granted, while explicit deny specifically blocks access by overriding other permissions. These concepts are independent of the system administrator, the object creator, or the last user to access the system.
51. The correct answer is B. Ethernet is a standard for wired connections in LANs, not wireless connections. It governs data transmission rules over wired networks, not all network devices.
52. The correct answer is C. The Data Link Layer is not part of the TCP architecture layers. The other three layers are all part of the TCP architecture, with the Application Layer being the top layer, the Transport Layer being the layer that creates segments and provides data delivery services, and the Internet Layer the layer that handles end-to-end connections and routing.
53. The correct answer is A. A server manages network resources and delivers data to clients. It's not the endpoint of a network connection, a traffic-filtering device, or a standard that defines wired connections.
54. The correct answer is B. The PRIMARY function of a firewall is to control network traffic based on predetermined rules, not to control traffic flow, connect devices, or provide information to other computers.
55. The correct answer is A. IANA assigns known ports from 0 to 1023 for system-level processes used by TCP and UDP. Other port ranges include registered ports (1024-49151), which are used for specific applications, and dynamic or private ports (49152-65535), which are used temporarily. The listed option with ports 80, 443, and 65431 is inaccurate because it only mentions specific ports and does not cover the entire range.
56. The correct answer is D. In IPV6 addressing, '2003:0ab8:0000:0000:0000:eeee:0000:0001' can be truncated to '2003:ab8::eeee:0:1' according to the truncation rules. However, other options contain errors by either including leading zeros, incorrectly using '::' twice, or omitting null groups, violating IPV6 truncation rules.
57. The correct answer is A. The ping command is used to test a host's availability and measure the round-trip time for ICMP echo requests. It does not provide file transfer speed, a route to the remote system, or a DNS address. These functions require other tools like FTP, traceroute, or DNS lookup commands.
58. The correct answer is C. The Internet Assigned Numbers Authority (IANA) divides port numbers into three ranges: Known Ports (0-1023), Registered Ports (1024-49151), and Dynamic or Private Ports (49152-65535). The dynamic or private ports, ranging from 49152 to 65535, are typically used for temporary, ephemeral ports and used only during a specific communication session.
59. The correct answer is D. The PRIMARY transport layer protocols are TCP and UDP. TCP provides reliable data delivery, while UDP provides connectionless transmission. HTTPS, ICMP, and IMAP are not Transport Layer protocols; they operate at different OSI model layers.
60. The correct answer is B. In an on-path attack, also known as man-in-the-middle (MitM) attack, an attacker intercepts and modifies communications between two parties. This allows the attacker to eavesdrop on sensitive information or manipulate the conversation. Other attacks, such as DoS, spoofing, and fragmenting, have different objectives and methods.
61. The correct answer is B. A zero-day vulnerability is an undisclosed flaw in software or hardware that attackers exploit before developers can patch it. Novice attackers, changing the system date and time, or manipulating data tables are not associated with zero-day vulnerabilities.
62. The correct answer is C. A Distributed Denial of Service (DDoS) attack involves overwhelming a target system with traffic from secondary systems, thereby disrupting its service. This differs from attacks that target legitimate HTTP requests, forge identities for system access, or redirect users through spoofed URLs.
63. The correct answer is B. Cross-site scripting (XSS) injects malicious scripts into the code of a Web site by exploiting poor input validation. Trojans and phishing involve disguised malware and messages with hidden malicious functionality. Input validation isn't relevant to rootkit attacks.
64. The correct answer is D. An intrusion prevention system (IPS) blocks or prevents malicious network traffic, while an intrusion detection system (IDS) only detects and alerts to intrusions. The other options are incorrect because both IDS and IPS can be either software or hardware-based, their placement on the network can vary, and both can detect malware.
65. The correct answer is D. Current anti-malware solutions typically do not detect Advanced Persistent Threats (APTs), which are sophisticated, stealthy attacks launched by skilled adversaries that target specific organizations. The other options are wrong because today's anti-malware solutions are designed to detect and neutralize common types of malware, such as ransomware, spyware, and rootkits.
66. The correct answer is A. Firewalls do not operate at the OSI model's physical layer (Layer 1), which deals with raw bit streams over a physical medium. Instead, firewalls operate at higher layers such as Layer 2 (Data Link Layer), Layer 3 (Network Layer), and Layer 7 (Application Layer), where they analyze and control network traffic based on various criteria such as IP addresses, port numbers, and application data.
67. The correct answer is A. Insider threats come from within an organization and often involve employee misuse of access. A bank employee transferring funds to a personal account is an example of an insider threat. Social engineering manipulates individuals for information, which is not applicable here. Third-party risk involves external entities, which is not applicable here. Data breaches involve unauthorized access, which is different from authorized misuse here.
68. The correct answer is A. Hackers intercept and potentially modify communications between two parties in an on-path attack. Advanced Persistent Threats involve prolonged unauthorized network access. Trojans masquerade as legitimate software to install malware. Spyware secretly collects information from a user's computer. They do not include intercepting and redirecting traffic like an on-path attack.
69. The correct answer is B. Containment is the immediate priority during a ransomware attack to prevent further spread. Investigating how the malware got in comes after containment. Creating help desk tickets and updating antivirus are part of recovery and proactive measures, respectively, not immediate responses.
70. The correct answer is B. A Network Intrusion Detection System (NIDS) monitors network traffic for signs of intrusion or suspicious activity. SOAR combines threat intelligence, incident response, and automation but doesn't directly monitor network traffic. HIDS monitors individual systems, not network traffic. NIPS detects and blocks threats but may not provide alerts like NIDS.
71. The correct answer is A. Unlike viruses, which often require human intervention, worms spread automatically. Trojans rely on human action for delivery, while rootkits hide malicious software on a system.
72. The correct answer is C. Installing redundant power supplies is a practical solution for maintaining network functionality during power outages. However, other options, such as network upgrades or server-to-cloud migration, can provide more excellent resiliency, but often at a higher cost and complexity. Cybersecurity insurance doesn't directly address power outage concerns but focuses on financial protection against cyber incidents.
73. The correct answer is A. Backup generators in a data center are primarily sized to support the critical load and essential supporting infrastructure during power outages, ensuring the continued operation of critical systems and services. Other considerations, such as HVAC, fire suppression, and network infrastructure, are important but secondary to ensuring the uninterrupted operation of critical loads.
74. The correct answer is C. The PRIMARY purpose of a Virtual Local Area Network (VLAN) is to segment a network into multiple subnets for efficient management and enhanced security. However, VLANs do not directly provide secure access to networks, cloud providers, or managed service providers (MSPs). They complement, but do not replace, other security measures such as firewalls and encryption.
75. The correct answer is A. Gas-based fire suppression systems effectively extinguish fires in environments with sensitive electronic equipment, such as data centers, without damaging the equipment. However, they pose a risk to human health due to the potential toxicity of the gases used. Water-based, foam, and dry chemical fire suppression systems are less suitable for electronic equipment environments because they can damage equipment and leave difficult to clean residues.
76. The correct answer is C. A Service Level Agreement (SLA) is a contract between a service provider and a customer that details the services to be provided and the responsibilities of both parties. It does not provide secure access to networks, segment networks, or provide safe access to cloud providers.
77. The correct answer is C. DLP protects sensitive data by monitoring and preventing unauthorized access or transmission. IDS and IPS focus on network security, while TLS encrypts data transmissions.
78. The correct answer is A. Network Access Control (NAC) explicitly enforces policies related to device access to network resources. While other security measures, such as time-based access control, geolocation restrictions, and password history requirements, are essential, they address different security aspects and do not directly enforce corporate policies for device access.
79. The correct answer is A. A memorandum of understanding (MOU) is a formal document that outlines the terms of cooperation and shared goals between two or more parties. It's an appropriate choice for establishing a partnership between healthcare organizations and defining how they will collaborate on projects and share resources.
80. The correct answer is C. VLAN segmentation separates network traffic without requiring physical changes to the network layout. This approach isolates different data types, such as patient records and administrative data, and improves security by preventing unauthorized access. The other options may provide security benefits but don't specifically address the need to separate different types of data within the network.
81. The correct answer is A. The PRIMARY goal of encryption is to protect data from unauthorized access by converting it into unreadable formats that can only be decrypted by those with valid keys. While it helps prevent data breaches, its PRIMARY function is to protect data from unauthorized access. It's not primarily used for processing efficiency or data analysis.
82. The correct answer is C. Organizations periodically review retained records to comply with changing regulations, ensure legal compliance, and avoid penalties. Other reasons include operational considerations, such as preserving relevant information, freeing up storage space, and identifying security risks, but these are not the PRIMARY motivations for review.
83. The correct answer is A. Implementing a data classification policy is the most effective approach for the financial institution to categorize data based on its sensitivity to enable appropriate handling and protection measures. While relevant to security and privacy, anonymizing data, assigning data custodians, and performing vulnerability assessments are not the most appropriate data classifications in this scenario.
84. The correct answer is A. Labeling, or assigning a classification level to data based on sensitivity, is the first step in data classification. It precedes the appropriate storage and management of data. Collection involves identifying data for classification, while sharing involves securely distributing data, both of which require understanding the data classification achieved through labeling.
85. The correct answer is A. Data's "highly restricted" label indicates that its compromise could have serious consequences. In contrast, labels indicating only a temporary loss of competitive advantage or minor impact suggest a lower level of risk and would not warrant a severely restricted label. Such labels may be more appropriate for data classified as "Confidential" or "Internal Use Only.
86. The correct answer is D. The recipient (in this case, Bob) would use his private key to decrypt a message encrypted with asymmetric encryption. Since Bob is the intended recipient and needs to decrypt the message, he would use his private key for decryption. Therefore, Bob’s private key is required to decrypt Alice's encrypted message.
87. The correct answer is C. Maintaining a separate test environment is challenging due to resource requirements and the need to mirror production settings accurately. While essential for change management, it requires significant resources and coordination. Unlike resource and coordination requirements, third-party testing and simplifying rollback plans are not inherent challenges.
88. The correct answer is C. Verification and auditing in change management ensures that newly implemented changes do not disrupt the existing system or cause unintended consequences. Requesting changes to a baseline and identifying system baselines are initial steps not specific to verification and auditing. Protecting developers is essential, but it is not the direct focus of verification and audit, which focuses on assessing the impact of changes and system stability.
89. The correct answer is D. The Bring Your Own Device (BYOD) policy governs the use of personal devices for business purposes, specifying allowed devices, security requirements, and acceptable use. Meanwhile, the Data Handling Policy addresses internal data management, the Password Policy governs password creation and management, and the Acceptable Use Policy (AUP) governs acceptable behavior with corporate technologies.
90. The correct answer is C. A rollback plan is critical for organizations that cannot fully test changes. It provides a safety net to fall back on if problems arise. While change implementation drives growth, a rollback plan mitigates the risk of unexpected problems. Third-party testing complements a rollback plan, but it doesn't replace it. Establishing system baselines is critical but distinct from the rollback plan's purpose of addressing unanticipated problems.
91. The correct answer is B. The PRIMARY goal of change management in cybersecurity is to release software without introducing new vulnerabilities. Detecting and patching vulnerabilities is critical, but it's not the PRIMARY focus of change management. Similarly, ensuring a vulnerability-free environment is consistent with cybersecurity best practices, but it's not the PRIMARY goal of change management.
92. The correct answer is C. PCI DSS mandates that credit card data be kept confidential and encrypted. While pseudonymization and segregation are beneficial, they're not PCI DSS requirements. Specific roles may require access to unmasked data despite PCI DSS restrictions. In addition, PCI DSS doesn't mandate shorter retention periods for credit card data than other data types.
93. The correct answer is B. A password policy aims to enforce strong, complex passwords and regular changes to reduce the risk of unauthorized access. While ensuring unique passwords for each system is essential, it's not the PRIMARY focus. Due to security risks, encouraging the sharing of passwords or writing them down is discouraged.
94. The correct answer is B. The PRIMARY benefit of implementing least privilege is to minimize the risk of unauthorized access to sensitive data. Limiting users to the minimum necessary privileges reduces the potential damage from insider threats. While simplifying the granting of privileges can improve efficiency, it's not the PRIMARY goal of least privilege. Similarly, reducing the number of user accounts or simplifying account creation isn't the PRIMARY goal; the focus is on limiting individual access rights to improve security.
95. The correct answer is A. An Acceptable Use Policy (AUP) outlines rules for computing resource users, such as Web sites or networks. For example, requiring employees to acknowledge that only authorized individuals can use a corporate application is an example of an AUP. Non-disclosure agreements focus on confidentiality, while service-level agreements and memorandums of understanding aren't typically used to govern specific applications or services.
96. The correct answer is A. Tailgating, or piggybacking, occurs when an unauthorized person follows an authorized person into a restricted area by exploiting physical security weaknesses. This is different from whaling attacks, spear phishing, and vishing, all of which are phishing attacks.
97. The correct answer is D. Social engineering involves exploiting human psychology to access sensitive information or systems. The other options are unrelated concepts not relevant to cybersecurity.
98. The correct answer is D. Password managers provide a convenient way to manage passwords securely. However, it's essential to ensure that the master password used to access the password manager is strong and not easily compromised. Compatibility, ease of use, and cost are generally minor concerns with password managers.
99. The correct answer is C. Security awareness training programs teach users to recognize and report phishing attempts to prevent fraudulent access to sensitive information. Granting administrative access to all users, sharing passwords, and turning off antivirus software are not recommended practices covered in security awareness training.
100. The correct answer is D. Smishing involves fraudulent text messages, vishing uses phone calls for scams, whaling targets high-profile individuals, and generic phishing typically occurs via email or Web sites

FAQ