Free Cybersecurity-Apprentice sample questions

Correct answers: Assume the network is always hostile and external.; Enforce least-privilege access for every user and device.

One of the fundamental principles of Zero Trust is to 'never trust, always verify.' This means assuming that no network, whether internal or external, is secure. Every access request must be treated as if it originates from an open network.

The principle of least privilege is central to Zero Trust. Users, devices, and applications should only be given the minimum levels of access or permissions needed to perform their specific function. This minimizes the potential damage from a compromised account or device.

Correct answer: False

In the IaaS model, the cloud provider is responsible for the security *of* the cloud (physical infrastructure, virtualization layer). The customer is responsible for security *in* the cloud, which includes securing and patching the guest operating systems, applications, and data they deploy on the virtual machines.

Correct answer: False Positive

A false positive occurs when a security system incorrectly identifies benign activity as malicious. Since the analyst confirmed the behavior was legitimate, the alert was a false alarm, which is the definition of a false positive. This is a crucial concept in security operations for tuning detection rules and reducing analyst fatigue.

Correct answer: VPN

A Virtual Private Network (VPN) creates a secure, encrypted tunnel over a public network like the internet. This allows remote users to securely connect to a private corporate network as if they were physically present, protecting the confidentiality and integrity of the data in transit.

Correct answer: Data Loss Prevention (DLP)

Data Loss Prevention (DLP) systems are designed to detect and prevent data breaches and data exfiltration. They use mechanisms like deep packet inspection and content analysis to identify sensitive data patterns (like credit card numbers) within network traffic and enforce policies to block or alert on unauthorized transmission.

Correct answer: Exploitation

The Exploitation stage is where the attacker actively triggers a vulnerability to gain unauthorized access or execute code. Using a known software flaw to gain initial access is the definitive action of this stage. Reconnaissance (Step 1) preceded it, and Installation (Step 3) followed it.

Correct answer: MFA requires credentials from two or more different categories of factors, while SFA requires only one.

The core principle of MFA is the use of multiple, independent categories of credentials. The main categories are: something you know (password, PIN), something you have (token, phone), and something you are (biometrics). SFA relies on only one of these categories (typically a password), whereas true MFA requires proof from at least two.

Correct answer: It identifies and remediates security issues earlier in the development lifecycle, reducing costs and risk.

The core concept of DevSecOps, or 'shifting left,' is to integrate automated security testing and validation early in the CI/CD pipeline. Finding and fixing vulnerabilities during development is significantly cheaper and less risky than discovering them in production. This approach makes security a shared responsibility and builds it into the development process, rather than treating it as a final gate before release.

Correct answer: SOAR

Security Orchestration, Automation, and Response (SOAR) platforms are specifically designed to automate and orchestrate security workflows. While a SIEM is excellent for collecting, correlating, and generating alerts from log data, a SOAR platform takes the output from the SIEM (and other tools) and executes predefined playbooks to handle repetitive tasks, thereby improving response times and freeing up analysts for more complex investigations.

Correct answer: DMZ

A Demilitarized Zone (DMZ) is a perimeter network that protects an organization's internal local-area network (LAN) from untrusted traffic. By placing public-facing services in the DMZ, an organization can provide an additional layer of security; if a server in the DMZ is compromised, the attacker does not have direct access to the internal network.