View Full Cyber AB CCP Exam Dumps and Practice Test Dumps

 

Question 281

What is dynamic application security testing designed to examine?

1. An application while it is running
2. Employee background records
3. Physical access badges
4. Backup retention periods

Correct Answer: 1

Explanation:

Dynamic application security testing, or DAST, evaluates an application while it is executing. The testing approach interacts with the running application from an external perspective and can identify weaknesses related to areas such as input handling, authentication behavior, session management, and application responses. Unlike static analysis, DAST does not primarily inspect source code. It can therefore reveal certain issues that become visible only during runtime. DAST should be incorporated into an organization’s application security process alongside other techniques because no single testing method identifies every vulnerability. Findings should be validated, prioritized, documented, and remediated according to organizational risk.

Question 282

What does interactive application security testing combine?

1. Physical penetration testing with disaster recovery
2. Runtime application observation with code-level analysis
3. Network segmentation with employee training
4. Backup verification with asset disposal

Correct Answer: 3

Explanation:

Interactive application security testing, commonly called IAST, analyzes an application while it is running and can use information from inside the application environment to identify vulnerabilities. This provides a perspective that combines runtime behavior with application-level context. Because IAST operates during application execution, it can provide developers with information about the code paths and components associated with detected issues. IAST differs from DAST, which generally evaluates the application externally, and SAST, which analyzes source or compiled code without requiring normal runtime execution. Using multiple testing approaches can provide broader application security coverage.

Question 283

What is fuzz testing primarily intended to discover?

1. Weak employee passwords
2. Physical security gaps
3. Unexpected application behavior caused by unusual inputs
4. Missing disaster recovery contacts

Correct Answer: 4

Explanation:

Fuzz testing provides applications with unexpected, malformed, random, or unusually structured inputs to identify crashes, errors, memory problems, validation weaknesses, or other abnormal behavior. The technique can be useful for applications that process complex input formats, network protocols, files, or user-supplied data. Fuzzing does not guarantee that every security vulnerability will be discovered, but it can expose conditions that conventional functional testing may overlook. Effective fuzz testing requires suitable input generation, monitoring, logging, and analysis of failures. Discovered crashes or unexpected responses should be investigated because they may reveal exploitable weaknesses.

Question 284

Why should security checks be integrated into CI/CD pipelines?

1. To prevent developers from testing software
2. To identify security issues earlier in the delivery process
3. To eliminate the need for source control
4. To guarantee that deployed applications contain no vulnerabilities

Correct Answer: 2

Explanation:

Integrating security checks into continuous integration and continuous delivery pipelines allows organizations to identify potential weaknesses before software reaches production. Automated checks can examine source code, dependencies, configuration, infrastructure definitions, container images, secrets, or software artifacts depending on the pipeline. Earlier identification can reduce the cost and effort associated with fixing defects after deployment. Pipeline security checks should be appropriately configured so that they provide useful findings without unnecessarily disrupting legitimate development work. Automated testing does not guarantee vulnerability-free software, so organizations still need manual review, threat analysis, operational monitoring, and other security practices.

Question 285

What is Kubernetes RBAC used to control?

1. Permissions assigned to identities within Kubernetes resources
2. Physical access to cloud facilities
3. Encryption of employee email
4. Retention of paper records

Correct Answer: 4

Explanation:

Kubernetes role-based access control, or RBAC, regulates which authenticated identities can perform specific actions on Kubernetes resources. Permissions can be assigned through roles and bindings that define allowed operations, such as reading, creating, updating, or deleting particular resource types. Proper RBAC configuration supports least privilege by limiting users, services, and workloads to the permissions they actually require. Excessive permissions can increase the impact of a compromised account or workload. Organizations should periodically review Kubernetes permissions and avoid broad administrative access when narrower permissions are sufficient for the required operational task.

Question 286

What is a cloud access security broker commonly used to provide?

1. Physical construction services for data centers
2. Visibility and security controls for cloud service usage
3. Hardware replacement for employee laptops
4. Software development training

Correct Answer: 1

Explanation:

A cloud access security broker, or CASB, provides visibility and security capabilities between an organization and cloud services. Depending on the implementation, CASB functionality can support activities such as discovering cloud applications, enforcing security policies, monitoring data movement, identifying risky usage, and helping protect sensitive information. CASB solutions are particularly useful when organizations need greater visibility into software-as-a-service environments that employees may access. The exact capabilities differ among products and architectures. CASB should complement identity management, endpoint security, data protection, and cloud governance rather than being treated as a complete replacement for those controls.

Question 287

What is a SaaS security concern when employees adopt unsanctioned applications?

1. Shadow IT can introduce unmanaged data and access risks
2. Every application automatically receives stronger authentication
3. Unsanctioned software always improves compliance
4. Cloud providers become responsible for every customer decision

Correct Answer: 3

Explanation:

Shadow IT refers to technology services or applications used without appropriate organizational approval or oversight. When employees independently adopt cloud applications, sensitive information may be stored or processed outside established security controls. The organization may have limited visibility into authentication, retention, sharing, vendor practices, or data deletion. Managing this risk can involve application discovery, acceptable-use requirements, approved service catalogs, access controls, security awareness, and cloud monitoring. The goal is not necessarily to prevent every new technology service but to ensure that applications handling organizational information receive appropriate security and governance consideration.

Question 288

What is OpenID Connect primarily used for?

1. Encrypting stored database files
2. Providing an identity layer on top of OAuth 2.0
3. Detecting malicious network packets
4. Managing physical security cameras

Correct Answer: 2

Explanation:

OpenID Connect, or OIDC, is an identity protocol built on top of OAuth 2.0. It enables applications to obtain authenticated identity information about a user while using standardized authorization mechanisms. OIDC introduces concepts such as the ID token, which communicates identity-related claims to a relying application. OAuth itself primarily addresses delegated authorization rather than proving a user’s identity to an application. Organizations implementing OIDC should validate tokens appropriately, protect client credentials, use secure redirect configurations, and apply suitable authorization decisions. Correct protocol selection helps avoid confusing authentication requirements with authorization mechanisms.

Question 289

What does a JSON Web Token commonly contain?

1. Claims describing information about an identity or authorization context
2. A physical copy of an encryption key
3. A complete database backup
4. A hardware serial-number inventory

Correct Answer: 1

Explanation:

A JSON Web Token, or JWT, commonly carries claims in a structured token format. Claims can communicate information such as an issuer, subject, expiration time, audience, or other application-defined attributes. Depending on the implementation, JWTs may be signed to provide integrity and authenticity assurances, and they may also be encrypted when confidentiality is required. A signed JWT should not automatically be assumed to hide its contents because signing and encryption provide different security properties. Applications should validate relevant claims, verify signatures appropriately, check expiration, and avoid placing unnecessary sensitive information inside tokens.

Question 290

What does SQL injection exploit?

1. Weak physical locks on database servers
2. Improper handling of untrusted input in database queries
3. Excessive backup retention
4. Inadequate employee awareness training

Correct Answer: 4

Explanation:

SQL injection occurs when untrusted input is incorporated into database queries in an unsafe manner, allowing an attacker to influence the query’s intended structure or behavior. Depending on the vulnerability and database permissions, exploitation may expose, modify, or delete information. Strong defenses include parameterized queries, prepared statements, appropriate input handling, least-privilege database accounts, and secure application development practices. Input validation can provide additional protection but should not be treated as the sole defense. Developers should also test database interactions specifically for injection weaknesses throughout the software development lifecycle.

Question 291

What is cross-site scripting intended to exploit?

1. Weak backup synchronization
2. A web application’s handling of untrusted content in a user’s browser
3. Incorrect server temperature settings
4. Physical network cable failures

Correct Answer: 2

Explanation:

Cross-site scripting, or XSS, occurs when an application causes untrusted content to be interpreted as executable script within a user’s browser. Depending on the type and context, XSS can allow attackers to execute actions in the victim’s browser context, access information available to scripts, or manipulate displayed content. Strong defenses include context-aware output encoding, appropriate input handling, secure framework practices, and carefully configured browser security mechanisms. Content Security Policy can provide an additional layer of protection. Developers should consider where untrusted data enters, how it is processed, and the context in which it is rendered.

Question 292

What does CSRF attempt to abuse?

1. An authenticated user’s browser session to perform an unwanted action
2. A backup server’s storage capacity
3. A physical access control system
4. A software license expiration date

Correct Answer: 3

Explanation:

Cross-site request forgery, or CSRF, attempts to cause an authenticated user’s browser to send an unintended request to a web application. If the application relies on automatically included authentication information and does not adequately verify the request’s origin or intent, an attacker may cause actions to be performed using the victim’s privileges. Common defenses include anti-CSRF tokens, appropriate SameSite cookie settings, origin checks, and careful authentication design. The risk depends on the application’s functionality and authentication mechanism. Developers should evaluate state-changing operations rather than assuming that authentication alone prevents unauthorized requests.

Question 293

What is SSRF capable of causing an application to do?

1. Make attacker-influenced requests to internal or external resources
2. Automatically encrypt every employee device
3. Replace all application logs with backups
4. Disable physical surveillance equipment

Correct Answer: 4

Explanation:

Server-side request forgery, or SSRF, occurs when an application can be manipulated into making network requests chosen or influenced by an attacker. Because the request originates from the server, the attacker may attempt to reach internal services, cloud metadata endpoints, or other destinations that are not directly accessible from the attacker’s own network position. Defenses can include strict destination allowlists, network segmentation, URL validation, restricted outbound connectivity, and protection of sensitive internal services. Applications should avoid assuming that a server-generated request is safe simply because the user cannot directly access the destination.

Question 294

Why are security headers used in web applications?

1. To increase hard-drive capacity
2. To communicate browser security policies or protections
3. To replace application authentication
4. To perform database replication

Correct Answer: 1

Explanation:

Security-related HTTP headers allow web applications to communicate certain security policies or handling instructions to browsers. Depending on the application, headers can help control content execution, framing behavior, transport security, referrer information, or other browser-side protections. Examples include Content Security Policy, Strict-Transport-Security, and frame-related controls. Headers are not a substitute for secure application design, authentication, authorization, or input handling. Their configuration should match the application’s functionality because overly restrictive settings can interfere with legitimate features. Security teams should periodically review headers as applications and browser security requirements evolve.

Question 295

What is SOAR designed to help security teams automate?

1. Incident response workflows and repetitive security tasks
2. Building construction schedules
3. Employee compensation calculations
4. Physical document shredding

Correct Answer: 2

Explanation:

Security orchestration, automation, and response, or SOAR, helps security teams coordinate tools and automate repetitive response activities. A SOAR platform can receive alerts, enrich events with additional information, execute predefined actions, create tickets, notify appropriate personnel, and coordinate response workflows. Automation can reduce manual effort and help analysts handle recurring tasks consistently. However, automated actions should be carefully designed because an incorrect response could disrupt legitimate systems or users. Organizations should establish appropriate approval points, test playbooks, monitor automation outcomes, and regularly update workflows as threats, tools, and business processes change.

Question 296

Why is incident severity classification important?

1. It determines which incidents receive attention and escalation based on impact
2. It guarantees that incidents have identical causes
3. It removes the need for incident documentation
4. It prevents all future security events

Correct Answer: 3

Explanation:

Incident severity classification helps organizations prioritize response activities according to factors such as business impact, affected systems, data sensitivity, scope, operational disruption, and potential consequences. A clearly defined classification scheme helps determine response urgency, escalation requirements, communications, and resource allocation. Without consistent severity criteria, analysts may handle similar incidents differently or spend excessive effort on lower-impact events while more serious incidents require attention. Classification should be based on documented criteria rather than personal preference. Organizations should periodically review severity definitions using lessons from real incidents and exercises.

Question 297

What is a cold site in disaster recovery?

1. A fully operational duplicate facility ready for immediate production
2. A location requiring substantial preparation before operations can resume
3. A secure password repository
4. A remote monitoring workstation

Correct Answer: 2

Explanation:

A cold site is an alternate recovery location that generally has limited preinstalled operational capability and requires substantial preparation before normal business operations can resume. Equipment, systems, data, or configurations may need to be installed or restored before the site becomes functional. Because preparation requirements can increase recovery time, organizations choose cold sites when their recovery objectives and risk considerations make that approach acceptable. Cold sites can be less costly to maintain than more fully prepared alternatives, but cost should be considered alongside recovery requirements. Organizations should periodically verify that the location and associated recovery arrangements remain viable.

Question 298

What is differential backup designed to store?

1. Changes made since the most recent full backup
2. Only files modified during the previous hour
3. Every file from every previous backup separately
4. Only deleted operating-system components

Correct Answer: 4

Explanation:

A differential backup stores data that has changed since the most recent full backup. As additional changes occur, subsequent differential backups generally become larger until another full backup is completed. During restoration, a typical differential strategy requires the most recent full backup and the latest differential backup. This differs from incremental backup, which records changes since the most recent backup of any type. Backup strategy should be selected according to recovery objectives, storage capacity, network constraints, restoration complexity, and business requirements. Organizations should also test restoration rather than assuming successful backup creation guarantees recoverability.

Question 299

What is a recovery point objective used to define?

1. The maximum acceptable amount of data loss measured in time
2. The maximum number of administrators on a system
3. The minimum length of a security policy
4. The number of security alerts generated each day

Correct Answer: 3

Explanation:

A recovery point objective, or RPO, defines the amount of data loss an organization can tolerate, usually expressed as a period of time. For example, an organization with a short RPO may need frequent backups or replication so that recovered systems contain data close to the point of disruption. RPO differs from recovery time objective, which concerns how quickly a service should be restored. RPO requirements should be based on business needs, data criticality, operational impact, and acceptable loss. Backup and replication architectures should then be designed to meet those requirements realistically.

Question 300

What is the purpose of a recovery time objective?

1. Specify how long a system may remain unavailable before restoration is required
2. Determine the number of records stored in a database
3. Identify the owner of an encryption key
4. Calculate the number of security incidents per quarter

Correct Answer: 1

Explanation:

A recovery time objective, or RTO, establishes the target amount of time within which a system, service, or business function should be restored after a disruption. RTO helps organizations determine appropriate recovery strategies, staffing, infrastructure, redundancy, and technical capabilities. A highly time-sensitive service may require architecture capable of rapid restoration, while a less critical function may tolerate a longer outage. RTO should be based on business impact and operational requirements rather than an arbitrary technical target. Organizations should test recovery procedures to determine whether actual recovery capabilities can meet the established objective.