View Full Cyber AB CCP Exam Dumps and Practice Test Dumps

 

Question 41

Which security approach assumes that network location alone should not establish trust?

1. Perimeter-only defense
2. Static routing
3. Zero trust
4. Open network access

Correct Answer: 3

Explanation:

Zero trust is a security approach based on the principle that access should not be automatically trusted simply because a user, device, or service is located inside a particular network boundary. Instead, access decisions should consider identity, device condition, requested resource, context, and other relevant signals. Authentication and authorization are continuously evaluated according to organizational requirements. Zero trust can reduce excessive implicit trust between systems and users. It is not a single product or technology. Organizations generally implement its principles through identity controls, segmentation, strong authentication, monitoring, least privilege, and other complementary safeguards.

Question 42

What is the primary purpose of a demilitarized zone in network architecture?

1. To isolate publicly exposed services from internal networks
2. To store employee passwords
3. To replace endpoint protection
4. To eliminate firewall requirements

Correct Answer: 1

Explanation:

A demilitarized zone, commonly called a DMZ, is a network segment designed to host services that need controlled communication with external networks while limiting direct exposure of internal systems. Public-facing web servers, mail gateways, or similar services may be placed within a DMZ depending on the architecture. Firewall rules can regulate traffic between the internet, DMZ, and internal network. A DMZ does not automatically make a system secure because improperly configured services can still be compromised. Its value comes from reducing unnecessary direct connectivity and creating controlled boundaries around externally accessible resources.

Question 43

Which technology can inspect endpoint activity to detect and investigate suspicious behavior?

1. Endpoint detection and response
2. Domain registration service
3. File archiving software
4. Database indexing engine

Correct Answer: 4

Explanation:

Endpoint detection and response, or EDR, focuses on monitoring activity occurring on endpoints such as workstations and servers. EDR solutions can collect telemetry involving processes, files, network connections, authentication events, and other endpoint behavior. Security personnel can use this information to investigate suspicious activity and support containment or remediation. Unlike basic antivirus functionality, EDR commonly emphasizes behavioral visibility, investigation, detection, and response capabilities. Effective deployment requires appropriate configuration, data collection, alert handling, and integration with incident-response procedures. EDR should complement rather than replace broader network, identity, vulnerability, and security-monitoring controls.

Question 44

Which security control is specifically intended to prevent sensitive information from leaving an organization through unauthorized channels?

1. Network time protocol
2. Data loss prevention
3. Load balancing
4. Asset tagging

Correct Answer: 2

Explanation:

Data loss prevention, or DLP, is designed to identify and help prevent unauthorized transmission, exposure, or handling of sensitive information. DLP controls can inspect data in different states, including information being transmitted, stored, or actively used. Policies may identify sensitive patterns and trigger actions such as blocking, alerting, quarantining, or requiring additional authorization. DLP effectiveness depends on accurate data classification, carefully designed policies, and appropriate handling of legitimate business activity. Excessively restrictive rules can create operational problems, while weak policies may fail to identify meaningful exposure. DLP therefore requires continuous tuning and oversight.

Question 45

What is the main function of a network access control solution?

1. To approve or restrict devices connecting to a network
2. To encrypt every stored database record
3. To archive security policies
4. To replace disaster recovery planning

Correct Answer: 4

Explanation:

Network access control, or NAC, helps organizations regulate which devices can connect to network resources and under what conditions. Depending on implementation, NAC can evaluate device identity, authentication status, security posture, location, or other attributes before granting access. A noncompliant endpoint may receive restricted connectivity or be directed toward remediation resources. NAC can therefore reduce the opportunity for unmanaged or unsuitable devices to gain unrestricted network access. It does not replace encryption, backup planning, or other security disciplines. NAC policies should align with organizational access requirements and account for legitimate exceptions.

Question 46

Which protocol is commonly used to protect web communications through encryption and authenticated connections?

1. FTP
2. HTTP
3. HTTPS
4. Telnet

Correct Answer: 3

Explanation:

HTTPS is the secure form of HTTP and uses Transport Layer Security, or TLS, to protect communications between a client and a web server. TLS can provide confidentiality, integrity, and server authentication when correctly configured. HTTPS helps prevent attackers from simply reading or modifying information transmitted across an untrusted network. The protection depends on appropriate certificate management, secure protocol versions, and sound configuration. HTTPS does not guarantee that the website itself is trustworthy or free from vulnerabilities. Organizations must therefore combine secure transport with application security, authentication, access control, monitoring, and other defensive measures.

Question 47

Which cryptographic function produces a fixed-length digest that can help detect data modification?

1. Hashing
2. Compression
3. Encoding
4. Serialization

Correct Answer: 1

Explanation:

Hashing converts input data into a fixed-length value known as a hash or digest. When a suitable cryptographic hash function is used, even a small change to the original data should produce a different digest. This property makes hashing useful for integrity verification, file identification, and other security applications. Hashing is not the same as encryption because a cryptographic hash is designed as a one-way transformation rather than a reversible process using a decryption key. Security teams should select modern cryptographic algorithms appropriate for the intended purpose and avoid obsolete hashing methods where stronger alternatives are required.

Question 48

Why are digital signatures used in electronic communications?

1. To increase network bandwidth
2. To provide evidence of integrity and signer authenticity
3. To compress attachments
4. To hide all metadata

Correct Answer: 2

Explanation:

Digital signatures use asymmetric cryptography to help establish that data was associated with a particular signing key and has not been altered after signing. They can therefore provide integrity and authentication properties and may support non-repudiation requirements depending on the surrounding legal and technical framework. A digital signature does not automatically encrypt the underlying message. Encryption and signatures serve different purposes, although they can be used together. Proper certificate management and protection of private signing keys are essential because compromise of a private key can undermine trust in signatures created with it.

Question 49

What is the primary role of a public key infrastructure?

1. To manage wireless channels
2. To perform database backups
3. To support certificates and public-key trust relationships
4. To monitor physical doors

Correct Answer: 4

Explanation:

Public key infrastructure, or PKI, provides processes, technologies, and governance for managing digital certificates and public-key cryptography. A PKI can support identity verification, certificate issuance, renewal, revocation, and trust relationships between communicating parties. Certificate authorities are central components in many PKI environments because they issue certificates that bind identities to public keys. PKI is commonly used for secure communications, digital signatures, device authentication, and other cryptographic functions. Effective PKI management requires protecting private keys, maintaining accurate certificate information, and responding appropriately when certificates expire or their associated keys can no longer be trusted.

Question 50

Which mechanism allows a certificate’s status to be checked without downloading an entire revocation list?

1. SFTP
2. OCSP
3. SMTP
4. SNMP

Correct Answer: 3

Explanation:

The Online Certificate Status Protocol, or OCSP, allows a client to query a responder about the status of a digital certificate. Instead of retrieving a complete certificate revocation list, the client can request information concerning a particular certificate. This can provide a more targeted method for checking whether a certificate has been revoked. Certificate status mechanisms are important because trust in a certificate may need to be withdrawn before its normal expiration date. Organizations should consider availability, privacy, responder reliability, and implementation details when selecting certificate validation approaches for their environments.

Question 51

Which practice helps protect cryptographic keys throughout their operational lifespan?

1. Key management
2. Screen locking
3. Cable labeling
4. Software packaging

Correct Answer: 1

Explanation:

Key management covers the lifecycle activities required to securely create, distribute, store, use, rotate, revoke, archive, and destroy cryptographic keys. Strong encryption can be undermined if keys are poorly protected or handled inconsistently. Organizations should define who can access keys, where they are stored, how key usage is monitored, and when replacement is required. Key management practices should also account for compromise scenarios and recovery requirements. Depending on sensitivity, specialized technologies such as hardware security modules may provide additional protection. A formal lifecycle reduces the likelihood that unmanaged cryptographic material becomes a hidden security weakness.

Question 52

What is the primary security purpose of a hardware security module?

1. To provide physical office surveillance
2. To protect and perform operations involving cryptographic keys
3. To replace vulnerability scanners
4. To provide employee training

Correct Answer: 4

Explanation:

A hardware security module, or HSM, is a specialized device designed to provide strong protection for cryptographic keys and perform selected cryptographic operations. HSMs can help keep sensitive private keys within controlled hardware while allowing authorized applications to use cryptographic services. They may support functions such as key generation, signing, encryption, and decryption depending on the product and configuration. HSMs are particularly relevant where compromise of cryptographic keys could have serious consequences. They do not replace broader security controls. Organizations still need appropriate access management, monitoring, operational procedures, and physical protections around HSM infrastructure.

Question 53

Which secure development activity examines an application’s design for potential attack paths before implementation?

1. Threat modeling
2. Log rotation
3. Bandwidth shaping
4. Asset disposal

Correct Answer: 2

Explanation:

Threat modeling is a structured process used to identify potential threats, attack paths, trust boundaries, valuable assets, and security weaknesses during system design. Performing this activity early allows development teams to address security concerns before implementation becomes expensive or difficult to change. Threat modeling can consider application architecture, data flows, external dependencies, authentication mechanisms, and attacker capabilities. Different methodologies can be used depending on organizational needs. The objective is not to predict every possible attack but to systematically identify meaningful security risks and incorporate appropriate mitigations into the design and development process.

Question 54

Which testing method analyzes source code without executing the application?

1. Dynamic application testing
2. Static application security testing
3. Network traffic replay
4. Runtime performance profiling

Correct Answer: 3

Explanation:

Static application security testing, commonly called SAST, examines source code, bytecode, or related application representations without executing the application. It can identify certain classes of coding weaknesses early in the software development lifecycle. Because SAST can be integrated into development workflows, developers may receive security feedback while code is still being created or reviewed. SAST has limitations and may produce false positives or miss vulnerabilities that depend on runtime behavior. For broader assurance, organizations can combine static analysis with dynamic testing, dependency analysis, manual review, threat modeling, and other application-security techniques.

Question 55

Why should software dependencies be monitored during application development?

1. Third-party components can introduce vulnerabilities into the application
2. Dependencies automatically eliminate coding errors
3. Libraries guarantee regulatory compliance
4. External packages remove authentication requirements

Correct Answer: 1

Explanation:

Software dependencies can introduce security weaknesses because applications frequently rely on external libraries, frameworks, packages, and components. A vulnerability in a dependency can affect applications that incorporate the affected component, even when the organization’s own code is secure. Software composition analysis and dependency inventories can help teams identify component versions and known vulnerabilities. Organizations should establish processes for evaluating updates, assessing affected applications, and applying appropriate remediation. Dependency management should also consider package provenance and integrity. Maintaining visibility into third-party components is therefore an important part of secure software development and supply-chain risk management.

Question 56

What is a major security concern when developers place credentials directly inside application source code?

1. The credentials may be exposed through repositories or code sharing
2. The application will always become unavailable
3. The credentials automatically expire
4. The source code becomes encrypted

Correct Answer: 4

Explanation:

Hard-coding credentials in application source code creates a significant security concern because source repositories, build systems, logs, or shared development environments may expose those secrets. Once a credential is committed to a repository, simply deleting it from the latest version may not remove it from historical commits or copies. Organizations should use appropriate secrets-management mechanisms and limit access to sensitive credentials. If a secret is exposed, it may need to be revoked and replaced promptly. Secure development practices should also include scanning for accidentally committed secrets and establishing clear procedures for handling credential exposure.

Question 57

Which security practice separates development, testing, and production environments?

1. Environment isolation
2. Universal administrator access
3. Shared credential storage
4. Unrestricted deployment

Correct Answer: 3

Explanation:

Environment isolation separates development, testing, staging, and production systems so that activity in one environment does not unnecessarily affect another. This separation can reduce the chance that experimental code, test data, or developer access directly impacts production services. It can also support stronger access restrictions because developers may not require the same privileges in production as they do in development. Network boundaries, separate accounts, deployment controls, and distinct data handling practices can contribute to isolation. The exact architecture depends on business needs, but production environments generally require stronger controls because they support live services and organizational operations.

Question 58

Which control is most directly concerned with ensuring changes to production systems are authorized and traceable?

1. Data classification
2. Change management
3. Visitor registration
4. Backup rotation

Correct Answer: 2

Explanation:

Change management establishes a controlled process for requesting, reviewing, approving, implementing, and documenting changes to systems and services. Security benefits include reducing unauthorized modifications, preserving accountability, and making it easier to investigate unexpected behavior. Change records can identify who requested a modification, why it was needed, what was changed, and when implementation occurred. Emergency changes may follow an accelerated process while still requiring appropriate documentation and later review. Effective change management should balance control with operational needs so that necessary improvements can be implemented without creating unmanaged or undocumented production risk.

Question 59

Which backup characteristic helps prevent attackers from altering stored recovery copies after gaining administrative access?

1. Mutable storage
2. Shared write permissions
3. Immutable storage
4. Anonymous access

Correct Answer: 4

Explanation:

Immutable storage is designed so that stored data cannot be altered or deleted during a defined protection period, even by users who might otherwise have modification privileges. This characteristic can be particularly valuable against ransomware and other attacks that attempt to destroy recovery resources. Immutability should be implemented with appropriate access controls, retention settings, monitoring, and recovery testing. It is not a replacement for maintaining multiple backup copies or verifying that backups can actually be restored. Organizations should design backup strategies around business recovery requirements, including recovery point and recovery time objectives.

Question 60

What is the main purpose of a tabletop exercise in continuity or incident planning?

1. To physically rebuild every production server
2. To purchase replacement equipment
3. To discuss response actions using a simulated scenario
4. To permanently disable affected services

Correct Answer: 3

Explanation:

A tabletop exercise is a discussion-based exercise in which participants work through a simulated incident or disruption scenario. It allows teams to examine roles, communication paths, decision-making processes, dependencies, escalation procedures, and potential gaps without necessarily performing a full technical recovery. Tabletop exercises can reveal unclear responsibilities or outdated plans before a real event occurs. They are useful for incident response, business continuity, and disaster recovery planning. After an exercise, organizations should document observations and improvement actions. Regular exercises help ensure that plans remain aligned with changes in personnel, technology, suppliers, and business operations.