View Full Cyber AB CCP Exam Dumps and Practice Test Dumps

 

Question 181

What is the main purpose of a security policy hierarchy?

1. Organize mandatory security requirements at different levels
2. Determine processor operating temperatures
3. Replace all technical procedures
4. Record individual login timestamps

Correct Answer: 1

Explanation:

A security policy hierarchy organizes governance documents according to their authority, scope, and level of detail. A high-level policy may establish mandatory organizational requirements, while standards, procedures, and guidelines provide increasingly specific direction for implementation. This structure helps employees understand which requirements are authoritative and how detailed instructions relate to broader security expectations. A clear hierarchy can also reduce conflicts between documents and make policy maintenance easier. Technical procedures should support higher-level requirements rather than contradict them. Organizations benefit when document ownership, approval authority, review frequency, and relationships between different security documents are clearly defined.

Question 182

Which document usually provides mandatory technical requirements for implementing a policy?

1. Informal suggestion
2. Security standard
3. Marketing brochure
4. Employee newsletter

Correct Answer: 2

Explanation:

A security standard typically translates broad policy requirements into specific, mandatory technical or operational expectations. For example, a policy might require strong authentication, while a standard could specify approved authentication mechanisms and minimum configuration requirements. Standards are more prescriptive than general guidelines, which usually provide recommended practices rather than mandatory instructions. Maintaining clear standards helps teams implement security consistently across systems and departments. Standards should be reviewed periodically because technologies, threats, regulatory expectations, and business requirements can change. Proper approval and ownership also help ensure that standards remain authoritative and enforceable.

Question 183

What is the primary purpose of a corrective control?

1. Prevent every security incident before it occurs
2. Identify suspicious activity as it happens
3. Restore or fix a condition after a problem is identified
4. Classify information according to business value

Correct Answer: 3

Explanation:

A corrective control is intended to address a problem after an undesired condition has occurred or been identified. Examples include restoring affected systems, correcting an insecure configuration, removing unauthorized access, or repairing a control deficiency. Corrective controls differ from preventive controls, which aim to stop an unwanted event before it occurs, and detective controls, which identify events or conditions requiring attention. Effective security programs often combine all three types. Corrective actions should be tracked to completion and, where appropriate, validated afterward to confirm that the underlying issue has actually been resolved.

Question 184

Why is asset ownership important in cybersecurity management?

1. It determines the physical weight of equipment
2. It establishes accountability for decisions concerning an asset
3. It guarantees that every asset is encrypted
4. It eliminates the need for asset inventories

Correct Answer: 4

Explanation:

Asset ownership establishes who is accountable for important decisions concerning a particular asset. An owner may be responsible for determining appropriate protection requirements, approving access, classifying information, or accepting certain risks associated with the asset. Ownership should not be confused with physical possession or day-to-day administration. A technical administrator may operate a system without being the person accountable for business decisions concerning it. Clearly assigned ownership improves accountability and supports activities such as risk assessment, access review, lifecycle management, and security control selection. Without ownership, important decisions can remain unresolved because responsibilities are unclear.

Question 185

What is the purpose of a patch management window?

1. Provide a planned period for applying system updates
2. Prevent all employees from changing passwords
3. Create permanent exceptions to security requirements
4. Replace vulnerability assessments

Correct Answer: 1

Explanation:

A patch management window provides a planned period during which approved updates can be installed on systems. Scheduling maintenance helps organizations coordinate technical work, communicate potential service interruptions, and reduce operational disruption. Patch windows may differ according to system criticality, business requirements, and the urgency of a security fix. Critical vulnerabilities may require accelerated remediation outside normal maintenance schedules. Effective patch management also includes testing, deployment tracking, verification, and handling systems that cannot immediately be updated. A scheduled window is therefore one component of patch governance rather than a substitute for vulnerability identification or risk-based prioritization.

Question 186

What does a threat actor’s TTPs describe?

1. The organization’s hardware inventory
2. Techniques, tactics, and procedures used by the actor
3. The retention period for audit records
4. The encryption keys stored in a vault

Correct Answer: 2

Explanation:

TTPs stands for tactics, techniques, and procedures. The term describes how threat actors conduct operations, ranging from their broader objectives and approaches to specific methods they use during an attack. Security teams can use knowledge of TTPs to improve detection rules, threat hunting, incident analysis, and defensive planning. TTP information can be more useful than relying only on specific indicators because technical indicators such as addresses or file hashes can change relatively quickly. Understanding recurring attacker behavior can therefore help defenders identify related activity even when the exact tools or infrastructure used by an attacker have changed.

Question 187

What is beaconing commonly associated with?

1. Routine printer maintenance
2. Automated communication from a compromised system to external infrastructure
3. Scheduled employee training
4. Normal database indexing

Correct Answer: 3

Explanation:

Beaconing describes recurring communication between a system and another endpoint, often associated with command-and-control activity. Malware may periodically contact attacker-controlled infrastructure to receive instructions, report status, or retrieve additional content. Repeated connections at regular intervals can sometimes provide a useful detection signal, particularly when destinations are suspicious or the communicating process is unexpected. Security teams may analyze timing, destination reputation, network protocols, process activity, and connection patterns when investigating possible beaconing. Not every periodic network connection is malicious, so context is important. Legitimate software updates, monitoring systems, and cloud services can also generate recurring communications.

Question 188

Which technique involves disguising malicious activity to avoid security detection?

1. Data classification
2. Defense evasion
3. Capacity planning
4. Media disposal

Correct Answer: 4

Explanation:

Defense evasion refers to techniques used by attackers to avoid or weaken security controls and detection mechanisms. Examples may include disabling security tools, modifying files to appear legitimate, hiding processes, using trusted utilities, or removing evidence of malicious activity. Recognizing defense-evasion behavior is important because attackers often attempt to reduce visibility before continuing other stages of an intrusion. Organizations can strengthen detection through endpoint telemetry, centralized logging, configuration monitoring, tamper protection, and behavioral analysis. Security teams should investigate unexpected changes to defensive mechanisms because unauthorized modification of monitoring or protection tools may indicate an attempt to conceal malicious activity.

Question 189

What is whaling in the context of phishing?

1. Phishing specifically aimed at high-value or senior individuals
2. Malware spreading automatically between network segments
3. Fraud involving counterfeit hardware
4. Unauthorized modification of backup archives

Correct Answer: 1

Explanation:

Whaling is a form of targeted phishing that focuses on high-value individuals, such as senior executives or people with significant financial or administrative authority. Attackers may research the target and create highly convincing messages designed to encourage actions such as transferring funds, revealing information, or approving a fraudulent request. Because these targets may have elevated access or decision-making authority, successful attacks can have substantial consequences. Security awareness should therefore include targeted phishing scenarios, verification procedures for sensitive requests, and strong authentication. Technical controls such as email filtering and domain authentication can provide additional protection against deceptive messages.

Question 190

What is smishing?

1. Phishing delivered through physical mail
2. Phishing conducted through voice calls
3. Phishing delivered through text messaging
4. Phishing performed exclusively through websites

Correct Answer: 2

Explanation:

Smishing is phishing conducted through SMS or other text-based messaging channels. Attackers may send fraudulent messages containing malicious links, requests for credentials, fake delivery notifications, or urgent payment instructions. Because users often treat text messages as personal communications, deceptive messages can appear convincing. Organizations can reduce risk through awareness training, mobile security controls, link inspection, authentication protections, and procedures for verifying unusual requests through trusted channels. Users should be cautious when a message creates urgency or requests sensitive information unexpectedly. Smishing differs from vishing, which uses voice communication, and from traditional email phishing.

Question 191

What is the primary security concern with OAuth token theft?

1. An attacker may use the token to access authorized resources
2. The token automatically increases network bandwidth
3. The token physically unlocks every office door
4. The token deletes all expired accounts

Correct Answer: 1

Explanation:

OAuth tokens can represent delegated authorization to access specific resources or services. If an attacker obtains a valid token, the attacker may be able to use that token within its permitted scope without directly possessing the user’s password. Organizations should therefore protect tokens through secure storage, appropriate expiration, limited scopes, transport protection, and token revocation mechanisms. Monitoring unusual token use can also help identify compromise. OAuth is designed to support delegated access, but its security depends heavily on correct implementation and lifecycle management. Token theft demonstrates why protecting authorization artifacts is essential even when primary credentials remain confidential.

Question 192

What is conditional access designed to evaluate before granting access?

1. Only the user’s preferred language
2. Contextual conditions such as identity, device, or location
3. The age of the organization’s oldest server
4. The physical size of the user’s device

Correct Answer: 2

Explanation:

Conditional access evaluates contextual information before allowing access to a resource. Depending on the organization’s implementation, conditions may include user identity, device security status, application, network context, location, risk signals, or authentication strength. A policy might require additional verification when access originates from an unfamiliar device or unusual context. This approach allows organizations to apply different access requirements based on circumstances instead of treating every request identically. Conditional access should be carefully configured to balance security and usability. It works alongside authentication and authorization rather than replacing the underlying identity and access management processes.

Question 193

What is FIDO2 primarily intended to support?

1. Secure passwordless or phishing-resistant authentication
2. Automated database replication
3. Physical destruction of storage devices
4. Centralized vulnerability scoring

Correct Answer: 3

Explanation:

FIDO2 is a set of standards supporting strong authentication methods that can reduce dependence on passwords. It can enable phishing-resistant authentication using authenticators such as security keys or platform-based credentials. Instead of transmitting a reusable password to a service, the authentication process uses cryptographic mechanisms associated with the registered authenticator and service. This can significantly reduce exposure to credential phishing and password reuse. Successful deployment still requires appropriate enrollment, recovery procedures, device management, and account protection. FIDO2 is therefore primarily associated with modern authentication rather than data storage, vulnerability assessment, or backup operations.

Question 194

Which practice helps protect cryptographic keys throughout their lifecycle?

1. Sharing keys through ordinary email
2. Leaving expired keys active indefinitely
3. Restricting key access and performing controlled rotation
4. Storing private keys in public repositories

Correct Answer: 4

Explanation:

Cryptographic key management requires controls throughout the key lifecycle, including generation, storage, distribution, use, rotation, archival where appropriate, and secure destruction. Restricting access to keys reduces the chance that unauthorized individuals or systems can use them. Controlled rotation can limit the exposure associated with long-lived keys and support organizational security requirements. Private keys should never be casually distributed or placed in publicly accessible repositories. Key-management procedures should also address backup and recovery where necessary. Weak key handling can undermine otherwise strong encryption because an attacker who obtains a usable private key may bypass the intended confidentiality or authenticity protections.

Question 195

What is certificate pinning intended to help prevent?

1. Acceptance of an unexpected certificate for a trusted service
2. Unauthorized physical entry into server rooms
3. Accidental deletion of database records
4. Excessive use of removable media

Correct Answer: 1

Explanation:

Certificate pinning allows an application to associate a service with an expected certificate or public-key identity rather than accepting any certificate that otherwise appears valid through the normal trust chain. This can provide an additional defense against certain interception scenarios involving an unexpected but technically trusted certificate. Implementing pinning requires careful lifecycle management because certificates and keys may legitimately change. Poorly managed pinning can cause applications to reject legitimate connections. Organizations should therefore evaluate operational requirements before deployment. Certificate pinning is an application-layer trust mechanism and does not replace secure transport protocols or proper certificate validation.

Question 196

What is key escrow designed to provide?

1. A controlled mechanism for authorized recovery of cryptographic keys
2. A method for compressing encrypted files
3. A process for increasing wireless coverage
4. A replacement for identity verification

Correct Answer: 2

Explanation:

Key escrow involves storing or retaining cryptographic keys under controlled conditions so that authorized parties can recover them when defined circumstances require access. It may support business continuity, legal requirements, or recovery from key loss, depending on the organization’s needs and applicable rules. Because escrow introduces highly sensitive repositories, strong access restrictions, auditing, separation of duties, and secure storage are essential. Escrow arrangements should clearly define who can request recovery and under what conditions. Without proper safeguards, an escrow repository could become an attractive target because compromise of stored keys may expose protected information.

Question 197

What is a secure software bill of materials primarily used to provide?

1. A list of components included in software
2. A record of employee vacation dates
3. A map of office evacuation routes
4. A schedule for replacing physical locks

Correct Answer: 2

Explanation:

A software bill of materials, or SBOM, provides an inventory of software components and dependencies contained within an application or software product. It can help organizations understand what third-party and open-source components are present and identify affected systems when a vulnerability is discovered in a particular component. SBOM information can therefore support vulnerability management, supply-chain security, and incident response. An SBOM does not by itself guarantee that software is secure. Its value depends on accuracy, completeness, timely updates, and the organization’s ability to connect component information with vulnerability and asset data.

Question 198

What does software composition analysis primarily examine?

1. Physical server room conditions
2. Third-party and open-source software dependencies
3. Employee identification photographs
4. Network cable lengths

Correct Answer: 3

Explanation:

Software composition analysis, commonly called SCA, examines third-party, open-source, and other software dependencies used within an application. It can help identify known vulnerabilities, licensing concerns, outdated components, and dependency relationships. SCA is especially valuable because modern applications frequently rely on packages maintained outside the organization’s direct development team. Findings can support remediation decisions, such as upgrading or replacing an affected component. SCA does not replace secure coding practices or dynamic application testing. It is one part of software security that provides visibility into components developers may not have written themselves.

Question 199

Why is input validation important in application security?

1. It helps ensure received data conforms to expected requirements
2. It guarantees that every user is trustworthy
3. It automatically encrypts all application databases
4. It removes the need for access controls

Correct Answer: 4

Explanation:

Input validation checks whether data supplied to an application conforms to expected types, formats, ranges, lengths, and other defined requirements. Proper validation can reduce the risk of malicious or malformed input reaching application logic in unsafe ways. Depending on the application, validation may help mitigate attacks involving unexpected commands, injection payloads, or invalid data structures. Validation should be implemented on the server side because client-side checks can be bypassed. It also should not be considered a replacement for output encoding, parameterized queries, authentication, or authorization. Secure applications generally use multiple complementary controls to handle untrusted input.

Question 200

What is output encoding primarily intended to prevent?

1. Unauthorized physical access to equipment
2. Interpretation of untrusted data as executable markup or code
3. Loss of power during a system outage
4. Duplication of backup archives

Correct Answer: 2

Explanation:

Output encoding transforms data so that untrusted content is treated as data rather than interpreted as executable markup or code by the receiving context. It is particularly important when applications display user-controlled information in web pages, where improperly handled content can contribute to cross-site scripting vulnerabilities. The correct encoding method depends on the context in which the data is inserted, such as HTML, an attribute, JavaScript, or a URL. Output encoding works alongside input validation and other secure development practices. Developers should avoid assuming that data is safe merely because it originated from an internal or previously trusted source.