View Full Cyber AB CCP Exam Dumps and Practice Test Dumps

 

Question 361

Which control helps restrict unauthorized changes to DNS records?

1. DNS zone transfer protection
2. Screen privacy filters
3. Printer access control
4. Endpoint disk cleanup

Correct Answer: 1

Explanation:

DNS records influence how systems locate services, so unauthorized modifications can redirect users or applications to unintended destinations. DNS zone transfer protection helps prevent unauthorized parties from obtaining or manipulating zone information through improperly configured transfer mechanisms. Organizations should also apply strong administrative authentication, restrict management access, monitor DNS changes, and maintain appropriate separation of duties. Screen filters, printer controls, and disk cleanup address unrelated security concerns. DNS security should be considered part of infrastructure protection because changes to name-resolution data can affect many systems simultaneously. Monitoring administrative activity and reviewing unexpected DNS modifications can further strengthen protection against unauthorized configuration changes.

Question 362

What does SPF primarily help an organization control?

1. Encryption of stored databases
2. Which mail servers may send messages for a domain
3. Physical access to server rooms
4. User permissions inside applications

Correct Answer: 2

Explanation:

Sender Policy Framework, or SPF, allows a domain owner to publish information identifying authorized mail servers that may send email on behalf of the domain. Receiving systems can evaluate that information when processing messages and use it as one signal when assessing potential email spoofing. SPF does not encrypt databases, control physical facilities, or define application permissions. It is commonly used alongside other email-authentication mechanisms to strengthen domain protection. Because SPF alone does not prove every aspect of message authenticity, organizations should consider it as one component of a broader email-security strategy that includes appropriate authentication, monitoring, and message-handling controls.

Question 363

What is DKIM primarily used to provide for email messages?

1. Evidence that selected message content was signed by an authorized domain
2. Automatic deletion of malicious attachments
3. Guaranteed delivery to every recipient
4. Encryption of the recipient’s mailbox

Correct Answer: 1

Explanation:

DomainKeys Identified Mail, or DKIM, uses a cryptographic signature associated with a sending domain to help receiving systems verify that selected parts of a message have not been altered and that the signature corresponds to a domain-controlled key. This provides an authentication signal for email handling. DKIM does not guarantee delivery, automatically remove every malicious attachment, or encrypt an entire recipient mailbox. Organizations must properly manage signing keys and publish the required public-key information. DKIM is especially useful when combined with other email-security mechanisms because it helps receiving systems evaluate whether messages claiming to originate from a particular domain have valid domain-associated signatures.

Question 364

Which technology can inspect email attachments in an isolated environment before delivery?

1. Network address translation
2. Credential vaulting
3. Email sandboxing
4. Port mirroring

Correct Answer: 3

Explanation:

Email sandboxing can execute or analyze potentially dangerous attachments in an isolated environment before allowing them to reach users. The objective is to observe suspicious behavior without exposing production endpoints directly to the content. This technique can be useful for detecting malicious documents, scripts, or executables that may evade basic signature-based inspection. Network address translation changes network addressing, credential vaulting protects authentication secrets, and port mirroring copies network traffic for monitoring. Sandboxing is therefore a useful layer within email security, particularly when attackers use previously unseen or heavily obfuscated attachments.

Question 365

Which malware type activates when a predefined condition is satisfied?

1. Logic bomb
2. Adware
3. Downloader
4. Browser extension

Correct Answer: 1

Explanation:

A logic bomb is malicious code designed to execute when a specified condition occurs. The trigger could involve a particular date, system state, event, account condition, or other predefined circumstance. Unlike malware that immediately performs its primary activity, a logic bomb may remain inactive until its trigger condition is met. Organizations can reduce related risks through application controls, code review, change management, privileged-access restrictions, and monitoring of unusual scheduled or conditional activities. Adware generally focuses on unwanted advertising, while a downloader retrieves additional content. Understanding malware behavior helps security teams select appropriate detection and prevention mechanisms.

Question 366

What is the primary role of a malware dropper?

1. Compressing legitimate backups
2. Delivering or installing another malicious component
3. Synchronizing system clocks
4. Validating digital certificates

Correct Answer: 2

Explanation:

A malware dropper is designed to deliver, install, or release another malicious component onto a target system. The dropper may contain the payload directly or retrieve additional malicious content during execution. Separating delivery from the final payload can make detection more difficult because the initial component may perform limited activity before deploying the next stage. Security controls such as endpoint monitoring, application restrictions, malware analysis, and behavioral detection can help identify suspicious deployment activity. Clock synchronization and certificate validation support legitimate security operations but do not describe the function of a malware dropper.

Question 367

Why is exploitability different from the existence of a vulnerability?

1. A vulnerability is always harmless until exploited
2. Exploitability considers how practical successful exploitation may be
3. Exploitability only measures storage capacity
4. A vulnerability automatically means an attack has succeeded

Correct Answer: 2

Explanation:

A vulnerability is a weakness that could potentially be abused, while exploitability considers factors that influence how feasible successful exploitation may be. These factors can include required access, attack complexity, available exploit techniques, authentication requirements, and environmental conditions. The existence of a vulnerability therefore does not automatically mean that an attack has succeeded. Understanding exploitability helps organizations prioritize remediation more intelligently. Security teams can combine technical severity, exposure, asset importance, threat intelligence, and exploit availability when deciding which vulnerabilities require urgent attention. This provides a more useful risk perspective than treating every discovered weakness as having identical practical consequences.

Question 368

What does a vulnerability scanner typically identify?

1. Potential weaknesses in systems or configurations
2. Employee performance ratings
3. Physical inventory purchase prices
4. Business meeting schedules

Correct Answer: 1

Explanation:

A vulnerability scanner examines systems, applications, services, or configurations for indicators of known or suspected security weaknesses. Depending on its capabilities, it may identify missing patches, insecure configurations, outdated software, exposed services, or other conditions associated with vulnerabilities. Scanner results are not automatically equivalent to confirmed exploitable compromises, so findings generally require validation and risk assessment. Employee performance ratings, purchasing information, and meeting schedules are outside the normal purpose of vulnerability scanning. Organizations can improve scanning value by maintaining accurate asset inventories, scheduling assessments appropriately, validating important findings, and tracking remediation through a structured vulnerability-management process.

Question 369

Which approach can help prioritize software patches?

1. Applying every patch in alphabetical order
2. Prioritizing according to risk, exposure, and asset importance
3. Waiting until all systems require replacement
4. Selecting patches based only on file size

Correct Answer: 2

Explanation:

Patch prioritization should consider factors such as vulnerability severity, exploit availability, system exposure, asset criticality, business impact, and compensating controls. A critical vulnerability affecting an internet-facing production system may require faster attention than a lower-risk issue on an isolated device. Applying patches alphabetically or selecting them based on file size provides no meaningful risk-based justification. Organizations should maintain a documented process that identifies affected assets, evaluates urgency, tests changes where appropriate, and tracks remediation. Risk-based prioritization helps security teams focus limited maintenance resources on weaknesses that could create greater organizational exposure.

Question 370

What does full-disk encryption primarily protect?

1. Data stored on a device when the storage is not actively being used
2. Network traffic between two web servers
3. Physical building entrances
4. DNS responses across the internet

Correct Answer: 1

Explanation:

Full-disk encryption protects information stored on a device by encrypting the contents of the storage medium. This can reduce exposure if a laptop, desktop, or other device is lost or stolen, particularly when an unauthorized person attempts to access the storage directly. It primarily addresses data at rest rather than protecting network traffic, physical entrances, or DNS communication. Effective protection also depends on proper key management and authentication controls. Organizations should understand that disk encryption does not automatically protect data after a legitimate user has unlocked the system, so it should be combined with endpoint security, access controls, and other safeguards.

Question 371

What is a break-glass account intended for?

1. Routine use by every employee
2. Emergency access when normal administrative access is unavailable
3. Sharing passwords with external vendors
4. Bypassing all security monitoring

Correct Answer: 2

Explanation:

A break-glass account provides controlled emergency access when standard administrative mechanisms are unavailable or unusable. For example, an organization may need emergency access during an identity-service outage or another situation that prevents normal privileged authentication. Because such accounts carry significant risk, they should be strongly protected, tightly limited, monitored, and subject to periodic review. Their use should normally be documented and investigated afterward. A break-glass account is not intended for routine administrative activity or password sharing. It also should not be exempt from security monitoring merely because it exists for emergencies.

Question 372

What is the purpose of an account lockout control?

1. To increase network bandwidth
2. To limit repeated unsuccessful authentication attempts
3. To encrypt archived documents
4. To assign ownership of databases

Correct Answer: 2

Explanation:

Account lockout controls can restrict or temporarily suspend authentication attempts after a defined number of unsuccessful attempts. The objective is to make repeated password-guessing attempts more difficult. Lockout policies must be configured carefully because overly aggressive settings can create denial-of-service conditions when attackers intentionally trigger lockouts against legitimate accounts. Organizations may combine lockout controls with rate limiting, monitoring, strong authentication, and appropriate password policies. The control does not encrypt documents or determine database ownership. Its primary security value comes from reducing the effectiveness of repeated authentication attempts against accounts protected by password-based mechanisms.

Question 373

Why can password history requirements be useful?

1. They prevent users from immediately reusing recently used passwords
2. They automatically encrypt every application
3. They eliminate the need for authentication
4. They guarantee that passwords cannot be exposed

Correct Answer: 1

Explanation:

Password history requirements can prevent users from immediately selecting recently used passwords when changing credentials. This reduces the likelihood that a compromised or previously exposed password will simply be reused. Password history does not eliminate authentication requirements, encrypt applications, or guarantee that credentials cannot be exposed. Its effectiveness depends on how it is implemented alongside broader identity controls. Organizations should also consider modern authentication practices, strong credential storage, multifactor authentication, monitoring, and appropriate password policies. Password controls should be designed as part of an overall identity-security strategy rather than treated as a standalone defense against every credential-related threat.

Question 374

What is an orphaned account?

1. An account with no current legitimate owner or business need
2. A temporary guest account with approved sponsorship
3. A service account documented by the application owner
4. A newly created account awaiting normal activation

Correct Answer: 1

Explanation:

An orphaned account is an account that remains active even though its legitimate owner, associated employee, system relationship, or business purpose is no longer valid. Such accounts can create unnecessary access paths because they may remain usable without an accountable owner. They can arise after employee departures, organizational changes, application migrations, or incomplete deprovisioning processes. Organizations can reduce this risk through regular access reviews, identity lifecycle procedures, ownership records, automated deactivation, and monitoring for unused accounts. Identifying orphaned accounts is particularly important for privileged or sensitive systems because unnecessary credentials can increase exposure even when no active misuse has yet been detected.

Question 375

What is the primary purpose of mobile device management (MDM)?

1. To centrally manage security settings on supported mobile devices
2. To replace all enterprise servers
3. To provide physical building surveillance
4. To eliminate application authentication

Correct Answer: 1

Explanation:

Mobile Device Management allows organizations to centrally administer supported mobile devices and enforce security-related settings. Depending on the platform and configuration, MDM can help manage device policies, application requirements, encryption settings, compliance status, and remote actions. Centralized management is useful because mobile devices may access organizational information from many locations and networks. MDM does not replace enterprise servers, physical surveillance, or application authentication. Organizations should define acceptable device requirements and determine which corporate resources mobile devices may access. Combining MDM with identity controls, encryption, secure application practices, and monitoring can provide broader protection for mobile computing environments.

Question 376

What security concern is especially associated with BYOD programs?

1. Personal devices may access organizational information outside direct corporate control
2. Employees cannot use wireless networks
3. Servers automatically lose encryption keys
4. Physical offices become inaccessible

Correct Answer: 1

Explanation:

Bring Your Own Device programs allow personally owned devices to access organizational resources. This creates security challenges because the organization may have less direct control over device configuration, software, ownership, physical handling, and disposal. A compromised personal device could potentially expose corporate information or credentials. Organizations can address these concerns through clear BYOD policies, device-management capabilities, application isolation, access restrictions, encryption, and defined separation between personal and organizational data. BYOD does not inherently make wireless networks unavailable or cause server encryption failures. Its main challenge is balancing user-owned technology with organizational security and privacy requirements.

Question 377

What capability does remote wipe provide for a managed device?

1. It can remove organizational data from a lost or compromised device
2. It increases the device’s processor speed
3. It repairs damaged network cables
4. It changes the organization’s risk appetite

Correct Answer: 1

Explanation:

Remote wipe allows an authorized management system to erase data from a supported device without requiring physical possession of that device. It can be useful when a device containing organizational information is lost, stolen, or otherwise considered compromised. The exact capabilities depend on the device platform, management configuration, connectivity, and whether the device remains reachable by the management service. Remote wipe does not repair physical infrastructure or change organizational risk decisions. It should be supported by other controls such as encryption, authentication, device management, and data-minimization practices because remote wiping may not always be successful.

Question 378

Which control protects information while it travels between systems?

1. Encryption of data in transit
2. Physical document shredding
3. Storage cabinet locking
4. Secure media destruction

Correct Answer: 1

Explanation:

Encryption of data in transit protects information as it moves between systems, networks, applications, or services. Properly implemented transport encryption can reduce the risk that unauthorized parties will read intercepted communications. This protection differs from physical safeguards such as locked storage cabinets or document shredding, which address other stages of information handling. Organizations should select appropriate protocols, manage certificates or keys securely, disable obsolete cryptographic configurations, and monitor relevant communication paths. Protecting data in transit is especially important when information crosses untrusted networks because attackers may otherwise attempt to observe or manipulate communications.

Question 379

What is the purpose of a cryptographic salt in password hashing?

1. To make identical passwords produce different stored hash values
2. To recover forgotten passwords automatically
3. To transmit passwords in plaintext
4. To eliminate the need for user authentication

Correct Answer: 1

Explanation:

A cryptographic salt is a unique value added to a password before the password is processed by a password-hashing function. Using a different salt for each password means that identical passwords can produce different stored hash outputs. This makes precomputed lookup approaches less useful and reduces the value of comparing hash values directly. A salt does not recover forgotten passwords, transmit credentials in plaintext, or eliminate authentication. Password storage should use an appropriate password-hashing algorithm with suitable parameters in addition to unique salts. Secure credential storage is an important defensive measure because password databases can become valuable targets during security incidents.

Question 380

What does perfect forward secrecy help protect?

1. Past encrypted sessions from being decrypted solely because a long-term key is later compromised
2. Physical access badges from duplication
3. Database records from accidental deletion
4. Email inboxes from unwanted advertising

Correct Answer: 1

Explanation:

Perfect forward secrecy helps ensure that the compromise of a long-term cryptographic key does not automatically allow an attacker to decrypt previously captured sessions. This is generally achieved through session-specific key establishment mechanisms that provide fresh session secrets rather than relying solely on one reusable long-term encryption key. The concept is particularly valuable for protecting historical communications because attackers may capture encrypted traffic and attempt to decrypt it later. Perfect forward secrecy does not address physical badges, database deletion, or email advertising. It is an important property of secure communication protocols where protection of previously established sessions is required.