View Full Cyber AB CCP Exam Dumps and Practice Test Dumps

 

Question 221

What is the main purpose of a security baseline?

1. Define an approved minimum security configuration
2. Estimate annual software revenue
3. Track employee attendance
4. Measure office occupancy

Correct Answer: 1

Explanation:

A security baseline establishes an approved minimum configuration or security condition that systems are expected to maintain. It can specify required settings for operating systems, applications, network devices, or cloud resources. Baselines help organizations reduce configuration inconsistencies and provide a reference for identifying unauthorized or insecure changes. They may include requirements for services, authentication settings, logging, encryption, or unnecessary functionality. Baselines should be reviewed periodically because technology and security requirements evolve. They are particularly useful when combined with configuration monitoring, change management, and automated compliance checks that can identify systems deviating from the approved state.

Question 222

What is configuration drift?

1. Accidental loss of encrypted backups
2. Gradual deviation from an approved system configuration
3. Unauthorized entry into a restricted facility
4. Failure of an employee awareness course

Correct Answer: 3

Explanation:

Configuration drift occurs when a system gradually moves away from its approved or intended configuration. Changes can result from manual administration, software updates, troubleshooting, temporary modifications, or unauthorized activity. Even seemingly minor differences can create security weaknesses if required protections are disabled or inconsistent settings are introduced. Organizations can reduce configuration drift through standardized baselines, automated configuration management, continuous monitoring, and controlled change processes. Detecting drift allows security teams to determine whether a deviation is legitimate or requires remediation. Maintaining consistent configurations is especially important across large environments where manually checking every system is impractical.

Question 223

What is the primary benefit of infrastructure as code security controls?

1. They eliminate the need for system administrators
2. They prevent all cloud outages
3. They allow security requirements to be checked in automated deployment definitions
4. They replace incident response teams

Correct Answer: 4

Explanation:

Infrastructure as code, or IaC, allows infrastructure configurations to be represented in machine-readable files and deployed through automated processes. Security controls can be incorporated into these definitions and checked before resources are deployed. This can help identify insecure configurations earlier and make environments more consistent. Examples include detecting publicly exposed storage, overly broad permissions, or prohibited network settings during deployment validation. IaC security does not eliminate administrators or guarantee availability. Instead, it moves security checks earlier into the infrastructure lifecycle and helps organizations apply repeatable configuration requirements across environments.

Question 224

Why is container image scanning performed?

1. To identify vulnerabilities or unwanted components before deployment
2. To increase monitor resolution
3. To replace identity verification
4. To manage office access cards

Correct Answer: 2

Explanation:

Container image scanning examines container images for security issues before they are deployed into an environment. Scanners may identify known vulnerabilities in operating-system packages, application libraries, outdated components, or potentially unwanted content. Early detection allows development and security teams to address problems before affected workloads reach production. Scanning should be integrated into development and deployment workflows and repeated because vulnerabilities can be discovered after an image was originally built. Image scanning is not a complete container security strategy; runtime monitoring, access controls, image provenance, secure configurations, and dependency management remain important.

Question 225

What does a software artifact repository primarily store?

1. Approved build outputs and software packages
2. Employee identity documents
3. Physical access badges
4. Disaster recovery contact numbers

Correct Answer: 1

Explanation:

An artifact repository stores software outputs such as compiled packages, libraries, container images, and other files produced or consumed during development and deployment. Centralized repositories can help organizations control which artifacts are approved for use and preserve version history. Security controls can include access restrictions, integrity verification, retention rules, malware scanning, and provenance information. Protecting repositories is important because attackers who modify legitimate build artifacts may introduce malicious code into downstream systems. Artifact management therefore contributes to software supply-chain security. It should work alongside secure build processes, code review, dependency management, and deployment controls.

Question 226

What is build integrity intended to protect?

1. The physical location of development offices
2. The trustworthiness of software produced by a build process
3. The lifespan of network cables
4. The number of users assigned to an application

Correct Answer: 2

Explanation:

Build integrity focuses on ensuring that software produced by a build process has not been improperly modified and originates from trusted inputs and processes. Compromised build environments can allow attackers to inject malicious code into otherwise legitimate software. Organizations can strengthen build integrity through controlled build environments, protected source repositories, restricted pipeline permissions, dependency verification, artifact signing, and auditable build records. Reproducible or independently verifiable builds can provide additional confidence where appropriate. Protecting the build process is important because compromising a trusted software production mechanism can affect many downstream systems and users.

Question 227

What is code signing primarily used to provide?

1. Evidence that software came from an identified signing source and was not altered
2. Faster execution of application code
3. Automatic removal of software vulnerabilities
4. Physical protection for development servers

Correct Answer: 3

Explanation:

Code signing uses cryptographic signatures to help establish the authenticity and integrity of software or other digital code. A valid signature can provide evidence that the signed content was associated with the holder of a particular signing key and has not been altered since signing, assuming the key and trust process remain secure. Code signing does not prove that software is free of vulnerabilities or malicious behavior. Organizations must protect signing keys carefully because unauthorized use could allow attackers to produce apparently trusted software. Verification mechanisms should also validate signatures against appropriate trusted certificates or keys.

Question 228

Why is dependency pinning useful in software development?

1. It prevents developers from using version control
2. It ensures a project consistently references specified dependency versions
3. It automatically removes all vulnerable libraries
4. It eliminates the need for application testing

Correct Answer: 4

Explanation:

Dependency pinning specifies particular versions of external software components instead of allowing builds to automatically select changing versions. This improves reproducibility and reduces the possibility that an unexpected dependency update introduces breaking changes or security concerns. Pinning does not guarantee that a selected version is secure; pinned components still need vulnerability monitoring and planned updates. Teams should establish processes for reviewing pinned dependencies and upgrading them when security fixes become available. Dependency management is especially important in automated build environments because uncontrolled changes to external packages can alter software behavior without developers intentionally modifying application source code.

Question 229

What is a secrets rotation process designed to accomplish?

1. Periodically replace sensitive credentials or keys
2. Increase storage capacity
3. Delete application source code
4. Disable all service accounts permanently

Correct Answer: 1

Explanation:

Secrets rotation involves replacing sensitive authentication material such as API keys, passwords, tokens, or cryptographic credentials according to defined requirements. Regular rotation can reduce the period during which a compromised secret remains useful. Rotation is particularly important when credentials are long-lived or when exposure is suspected. Automated systems can help rotate secrets while minimizing service interruption. Organizations should also maintain procedures for emergency rotation following suspected compromise. Rotation alone is not sufficient if secrets are stored insecurely or widely shared. Access restrictions, secure storage, monitoring, and proper lifecycle management should accompany rotation practices.

Question 230

What is a workload identity primarily associated with?

1. Identifying and authorizing applications or automated workloads
2. Assigning employees to office departments
3. Recording physical equipment dimensions
4. Scheduling backup maintenance rooms

Correct Answer: 2

Explanation:

Workload identity provides a way for applications, services, containers, or other automated workloads to authenticate and receive appropriate authorization without relying on a human user’s credentials. This can reduce the risks associated with embedding long-lived passwords or static secrets into application code. Workload identities can be integrated with cloud platforms, identity providers, and service authorization systems. Permissions should follow least-privilege principles so workloads receive only the access they require. Proper lifecycle management is also necessary because identities associated with retired applications or services should no longer remain active.

Question 231

What is adaptive authentication designed to do?

1. Apply authentication requirements based on assessed context or risk
2. Disable authentication for internal users
3. Replace all authorization decisions
4. Store authentication secrets in application logs

Correct Answer: 3

Explanation:

Adaptive authentication adjusts authentication requirements according to contextual or risk-related information. Factors may include device condition, location, behavior, network characteristics, previous activity, or other signals. A low-risk access attempt might proceed normally, while an unusual request could trigger stronger verification. This approach can improve security by applying additional controls when circumstances suggest elevated risk. Adaptive authentication does not eliminate authorization because determining what a user may access remains a separate concern. Organizations should carefully configure risk signals and fallback mechanisms so attackers cannot easily manipulate conditions to bypass stronger authentication requirements.

Question 232

What is passwordless authentication intended to reduce?

1. The number of approved network devices
2. Reliance on reusable passwords
3. The need for software updates
4. The number of security logs generated

Correct Answer: 4

Explanation:

Passwordless authentication reduces or eliminates reliance on traditional reusable passwords as the primary authentication secret. Modern approaches may use cryptographic credentials, hardware-backed authenticators, biometrics combined with secure devices, or other authentication mechanisms. Reducing password dependence can address risks such as password reuse, phishing, credential stuffing, and weak password selection. Passwordless systems still require secure enrollment, account recovery, device protection, and lifecycle management. Removing passwords does not automatically remove all authentication risks. Organizations should ensure that recovery procedures and alternative authentication paths are also protected because attackers may target weaker fallback mechanisms.

Question 233

What is a secure cookie attribute used to help ensure?

1. Cookies are transmitted only through protected connections
2. Cookies are stored permanently
3. Cookies can be accessed by every application
4. Cookies bypass authentication controls

Correct Answer: 1

Explanation:

The Secure cookie attribute instructs a browser to send the associated cookie only over an HTTPS connection. This helps reduce the risk of session information being exposed through an unencrypted HTTP connection. Secure cookies should be considered alongside other protections such as appropriate expiration, the HttpOnly attribute where suitable, and appropriate SameSite settings. These mechanisms address different aspects of cookie security and do not replace secure application design. Session cookies are particularly sensitive because possession of a valid session identifier may allow an attacker to impersonate an authenticated user.

Question 234

What is the purpose of the HttpOnly cookie attribute?

1. Force cookies to expire after one minute
2. Prevent cookies from being transmitted over HTTPS
3. Restrict client-side scripts from directly accessing the cookie
4. Automatically encrypt the web server database

Correct Answer: 2

Explanation:

The HttpOnly attribute helps prevent client-side scripts from directly accessing a cookie through browser scripting interfaces. This can reduce the ability of certain client-side attacks to directly retrieve session cookies. It does not prevent the browser from sending the cookie to the appropriate server, and it does not itself protect against every form of cross-site scripting or session compromise. Secure transport, output encoding, input handling, and appropriate cookie scope remain important. Cookie attributes should therefore be used together as part of a broader session-security strategy rather than treated as standalone protection.

Question 235

What is the purpose of a network tap?

1. Provide a copy of network traffic for monitoring or analysis
2. Encrypt all stored database records
3. Assign identities to cloud workloads
4. Manage employee training schedules

Correct Answer: 3

Explanation:

A network tap provides a way to obtain a copy of network traffic for monitoring, troubleshooting, or security analysis. Security teams can use traffic copies with network monitoring and detection systems to examine communications without necessarily placing the monitoring tool directly inline with production traffic. Taps can support incident investigation, performance analysis, and detection activities. Their deployment should consider network architecture, traffic volume, privacy requirements, and physical security. A tap does not automatically analyze the copied traffic; monitoring or analysis tools are still required to interpret the information and identify suspicious behavior.

Question 236

What is ingress filtering intended to restrict?

1. Unauthorized or invalid traffic entering a network
2. The number of employees entering a building
3. The frequency of backup restoration
4. The storage duration of audit records

Correct Answer: 4

Explanation:

Ingress filtering controls traffic entering a network or system and can restrict packets that do not meet defined source, destination, protocol, or policy requirements. Proper filtering can reduce exposure to unauthorized connections and certain spoofing or malicious traffic patterns. Rules should reflect legitimate communication requirements and should be reviewed as the environment changes. Ingress filtering is one layer of network defense and should operate alongside segmentation, authentication, monitoring, endpoint protection, and other controls. Filtering alone cannot determine whether an authorized connection is being used maliciously after access has been established.

Question 237

What is DNSSEC validation primarily intended to verify?

1. That DNS responses have valid cryptographic authenticity
2. That websites have unlimited bandwidth
3. That email attachments contain no malware
4. That users have selected strong passwords

Correct Answer: 1

Explanation:

DNSSEC validation allows a resolver to verify the authenticity and integrity of signed DNS information. When validation succeeds, the resolver has greater assurance that the response originated from the appropriate DNS zone and was not modified in transit. DNSSEC does not provide general confidentiality for DNS queries and does not determine whether a website itself is safe. Proper key management, signing, delegation, and resolver configuration are necessary for effective deployment. DNSSEC can help defend against certain forms of DNS manipulation, particularly attacks that attempt to provide forged DNS records to users or applications.

Question 238

What is a reverse proxy commonly positioned to do?

1. Receive client requests and forward them to backend services
2. Replace all endpoint security software
3. Destroy expired cryptographic keys
4. Approve employee access badges

Correct Answer: 2

Explanation:

A reverse proxy sits between clients and backend servers and receives requests on behalf of those services. It can provide functions such as traffic routing, TLS termination, access control, caching, load distribution, and security filtering depending on the implementation. Because backend systems may not need to be directly exposed to clients, a reverse proxy can also contribute to architectural separation. It should not be considered a complete security solution. Backend applications still require secure authentication, authorization, validation, patching, and monitoring. Reverse proxies are commonly used as part of layered architectures for web applications and APIs.

Question 239

Why is a jump server used in some administrative environments?

1. To provide a controlled intermediary for privileged access
2. To increase the physical size of a data center
3. To store customer marketing preferences
4. To eliminate authentication requirements

Correct Answer: 3

Explanation:

A jump server provides an intermediary point through which administrators can access protected systems. Instead of allowing direct administrative connections from numerous user devices, organizations can require privileged sessions to pass through a controlled and monitored system. This architecture can simplify logging, restrict access paths, and reduce exposure of sensitive management interfaces. Jump servers should themselves be strongly secured, monitored, patched, and limited to necessary services. They work particularly well with multifactor authentication, privileged access controls, session recording, and network segmentation. A jump server does not remove the need to authenticate or authorize administrative users.

Question 240

What is egress monitoring particularly useful for detecting?

1. Unauthorized outbound communication or possible data transfer
2. Physical damage to server racks
3. Incorrect employee job titles
4. Expired building access cards

Correct Answer: 4

Explanation:

Egress monitoring examines outbound network activity to identify unusual or unauthorized communication leaving an environment. Security teams may look for unexpected destinations, abnormal transfer volumes, unusual protocols, or connections associated with suspicious infrastructure. Such monitoring can help identify command-and-control activity, data exfiltration, malware communication, or compromised accounts. Effective monitoring requires knowledge of legitimate business traffic so normal services are not incorrectly treated as threats. Outbound visibility is valuable because attackers who compromise internal systems may attempt to communicate externally after gaining access. Combining egress monitoring with endpoint and identity telemetry can provide stronger investigative context.