View Full Cyber AB CCP Exam Dumps and Practice Test Dumps

 

Question 121

Which control helps identify unusual changes to important system files?

1. File integrity monitoring
2. Bandwidth allocation
3. Printer queue management
4. Screen resolution control

Correct Answer: 1

Explanation:

File integrity monitoring, or FIM, tracks designated files and system components for unexpected modifications. It can establish a known state and alert security personnel when protected files change outside approved processes. FIM can be useful for detecting unauthorized modifications, malware activity, configuration changes, or other suspicious behavior. Alerts should be evaluated against legitimate change records because authorized maintenance can also modify monitored files. FIM is most effective when organizations carefully select important files, establish appropriate baselines, protect monitoring data, and integrate alerts with investigation procedures. It provides visibility into changes rather than automatically determining whether every change is malicious.

Question 122

Which security control records actions performed by users and systems for later review?

1. Data deduplication
2. Audit logging
3. Cable shielding
4. Image compression

Correct Answer: 3

Explanation:

Audit logging records security-relevant activities performed by users, applications, devices, and other system components. Logs can capture events such as authentication attempts, privilege changes, administrative actions, configuration modifications, and access to sensitive resources. Well-designed audit records support accountability, incident investigation, compliance activities, and operational troubleshooting. Organizations should determine which events require logging, protect logs from unauthorized modification, establish suitable retention periods, and restrict access to sensitive records. Excessive logging can create unnecessary storage and analysis challenges, so logging requirements should be aligned with business and security objectives.

Question 123

Why should security logs be protected from unauthorized modification?

1. To make applications run faster
2. To reduce electricity consumption
3. To preserve their reliability as investigative records
4. To increase available storage capacity

Correct Answer: 4

Explanation:

Security logs may provide important evidence about activities occurring before, during, and after a security event. If unauthorized personnel can modify or delete those records, investigators may lose information needed to reconstruct what happened. Protecting logs can involve access restrictions, centralized collection, integrity controls, separate administrative privileges, and appropriate retention mechanisms. Organizations should also monitor attempts to alter logging infrastructure because attackers may target logs to conceal their actions. Log protection should be part of the overall monitoring architecture rather than treated as an afterthought once an incident has already occurred.

Question 124

Which security measure reduces the likelihood that an attacker can use an unused network service?

1. Service hardening
2. Credential sharing
3. Open-port expansion
4. Unrestricted feature activation

Correct Answer: 2

Explanation:

Service hardening involves reducing unnecessary functionality and applying secure configurations to services and systems. Disabling unused services can reduce the number of exposed components that attackers might discover or exploit. Hardening may also involve restricting unnecessary ports, removing default accounts, changing insecure settings, applying appropriate updates, and limiting administrative interfaces. The correct configuration depends on the system’s intended purpose because disabling a required service can disrupt legitimate operations. Organizations should use documented baselines and change-management procedures when implementing hardening measures so that security improvements remain controlled and traceable.

Question 125

Which assessment method actively searches an environment for evidence of previously undetected attacker activity?

1. Threat hunting
2. License reconciliation
3. Capacity forecasting
4. Records indexing

Correct Answer: 4

Explanation:

Threat hunting is a proactive security activity in which analysts search systems, networks, identities, and other data sources for signs of malicious activity that automated alerts may have missed. Hunters may investigate unusual processes, authentication behavior, network connections, persistence mechanisms, or other patterns associated with known or suspected threats. Threat hunting differs from ordinary alert response because analysts intentionally search for evidence rather than waiting for a detection to trigger. Effective hunting depends on reliable telemetry, useful hypotheses, threat knowledge, analytical skills, and appropriate access to security data. Findings can also improve future detection rules.

Question 126

Which network component can inspect domain requests and block connections to known malicious destinations?

1. Storage gateway
2. Secure DNS service
3. Print management server
4. Database replication node

Correct Answer: 1

Explanation:

A secure DNS service can apply security intelligence when resolving domain names and may block requests associated with known malicious domains. This can help prevent users or applications from connecting to infrastructure associated with phishing, malware distribution, command-and-control activity, or other threats. DNS-based security is useful because many applications rely on domain resolution before establishing connections. However, it is not a complete defense because attackers can use newly created domains, direct IP addresses, compromised legitimate infrastructure, or encrypted mechanisms. Organizations should combine DNS security with endpoint protection, network monitoring, email controls, and threat intelligence.

Question 127

What is a major security benefit of network microsegmentation?

1. It gives every endpoint identical permissions
2. It removes all network filtering
3. It restricts communication between narrowly defined workloads
4. It eliminates identity verification

Correct Answer: 3

Explanation:

Microsegmentation divides an environment into small security boundaries and applies communication policies between individual workloads, applications, or groups of resources. This can reduce unnecessary lateral movement after an attacker compromises one system. Instead of allowing broad communication across a network segment, policies can restrict connections to those specifically required by applications or business processes. Microsegmentation can be implemented using network controls, host-based enforcement, software-defined networking, or cloud security capabilities. It requires accurate knowledge of application dependencies because overly restrictive policies can interrupt legitimate services. Regular review is important as workloads and communication requirements change.

Question 128

Which technology establishes an encrypted tunnel for protected communication across an untrusted network?

1. Load balancer
2. Virtual private network
3. Network hub
4. Traffic mirror

Correct Answer: 2

Explanation:

A virtual private network, or VPN, creates a protected communication path across a network that may not otherwise be trusted. Depending on the technology, a VPN can provide encryption, authentication, and integrity protection for traffic between endpoints or networks. VPNs are commonly used for remote access and site-to-site connectivity. Secure deployment requires strong authentication, appropriate cryptographic configurations, current software, and careful access policies. A VPN does not automatically make the endpoint secure because a compromised device can still introduce risk through the protected connection. Organizations should therefore combine VPN access with endpoint security and identity controls.

Question 129

Which wireless security protocol provides stronger modern protection than legacy WPA configurations?

1. WPA3
2. WEP
3. Open Wi-Fi
4. Shared unencrypted radio

Correct Answer: 1

Explanation:

WPA3 is a modern Wi-Fi security protocol designed to provide stronger protections than older wireless security approaches. It introduces improvements to authentication and cryptographic protection and can provide better resistance against certain password-based attacks when configured appropriately. Wireless security should still include strong credentials, suitable authentication methods, secure device configuration, and appropriate network segmentation. Older technologies such as WEP are considered obsolete and should not be used for modern protected environments. Organizations should also monitor wireless infrastructure and ensure that unauthorized access points or insecure configurations do not undermine the intended protection.

Question 130

Which mechanism allows a user to access multiple trusted applications using an identity established by a central provider?

1. Local-only authentication
2. Federated identity
3. Manual account duplication
4. Independent credential enrollment

Correct Answer: 4

Explanation:

Federated identity allows identity information and authentication decisions to be shared across organizational or application boundaries through established trust relationships. A central identity provider can authenticate a user and provide assertions or tokens that participating services use to establish the user’s identity. Federation can reduce the need for separate credentials and simplify identity administration across multiple services. It requires careful configuration of trust relationships, authentication requirements, authorization mappings, and token handling. Organizations should also define how identities are provisioned and removed so that federation does not unintentionally create persistent access after a user’s authorization has ended.

Question 131

Which authentication attack repeatedly attempts many password combinations against a single account?

1. Brute-force attack
2. Data masking
3. Certificate pinning
4. Session logging

Correct Answer: 2

Explanation:

A brute-force authentication attack systematically attempts numerous password combinations against a target account or authentication mechanism. The attack can be computationally expensive but becomes more practical when passwords are weak or when defensive controls are absent. Account lockout policies, rate limiting, multifactor authentication, strong passwords, anomaly detection, and monitoring can reduce the effectiveness of brute-force attempts. Organizations should distinguish brute-force behavior from password spraying, which generally uses a small number of passwords across many accounts. Understanding the attack pattern helps security teams select appropriate detection rules and response measures.

Question 132

Which technique uses fraudulent authentication prompts to trick users into approving an attacker’s access request?

1. Port knocking
2. MFA fatigue
3. Data replication
4. Packet encapsulation

Correct Answer: 3

Explanation:

MFA fatigue, sometimes called push-bombing, attempts to overwhelm a user with repeated multifactor authentication prompts in the hope that the person eventually approves one out of confusion, frustration, or assumption that the request is legitimate. Attackers may first obtain a valid username and password and then repeatedly trigger authentication challenges. Organizations can reduce this risk through number matching, phishing-resistant authentication methods, user education, rate controls, and monitoring for unusual authentication patterns. Users should never approve an authentication request they did not initiate. Unexpected prompts should be reported through established security channels.

Question 133

What is the main purpose of a password manager in an enterprise environment?

1. To automatically grant administrator privileges
2. To remove the need for identity verification
3. To securely store and generate unique authentication secrets
4. To make all passwords publicly accessible

Correct Answer: 4

Explanation:

A password manager can securely store credentials and generate strong, unique passwords for different services. Using unique credentials reduces the impact of a single password compromise because attackers cannot automatically reuse the same password across unrelated systems. Enterprise password managers may also provide administrative controls, sharing mechanisms, auditing, and policy enforcement. Protection of the password manager itself is critical because it can contain highly sensitive information. Strong authentication and appropriate access controls should therefore protect the password-management platform. Organizations should also establish procedures for account recovery and access when employees change roles or leave.

Question 134

Which control helps administrators manage highly privileged credentials without exposing them directly to routine users?

1. Privileged access management
2. Public file sharing
3. Anonymous browsing
4. Unrestricted terminal access

Correct Answer: 1

Explanation:

Privileged access management, or PAM, provides controls for managing accounts and credentials with elevated permissions. Depending on the implementation, PAM can support credential vaulting, temporary access, approval workflows, session monitoring, password rotation, and detailed activity records. These capabilities reduce the exposure created by permanently available administrative credentials. PAM is particularly valuable for sensitive infrastructure where privileged actions can significantly affect confidentiality, integrity, or availability. Organizations should integrate privileged access controls with identity governance and monitoring processes. Administrative access should remain limited to authorized personnel and should be reviewed as responsibilities change.

Question 135

Which security practice verifies that backup data can actually be restored successfully?

1. Recovery testing
2. Log aggregation
3. Certificate enrollment
4. Screen monitoring

Correct Answer: 2

Explanation:

Recovery testing verifies whether backup data and recovery procedures can successfully restore required systems or information. Merely creating backups does not prove that those backups are usable because files may be incomplete, corrupted, inaccessible, or incompatible with current recovery environments. Testing can identify technical problems, missing dependencies, outdated procedures, and unrealistic recovery assumptions. Organizations should conduct tests according to the criticality of their systems and document the results. Recovery exercises can range from individual file restoration to broader service recovery simulations. Findings should be addressed so that backup capabilities improve rather than simply being repeatedly tested without remediation.

Question 136

Which backup type stores only information changed since the most recent backup of any type?

1. Full backup
2. Differential backup
3. Incremental backup
4. Replica snapshot

Correct Answer: 3

Explanation:

An incremental backup stores data that has changed since the most recent backup operation, whether that previous backup was full or incremental. This generally makes incremental backups faster and smaller than repeatedly creating complete copies. During restoration, however, recovery may require the most recent full backup plus the relevant sequence of incremental backups. A differential backup behaves differently because it records changes since the most recent full backup. Organizations should select backup methods according to recovery objectives, storage capacity, operational requirements, and restoration complexity. Regardless of backup type, restoration testing remains important.

Question 137

Which backup characteristic keeps a copy disconnected from ordinary network access?

1. Offline storage
2. Public mirroring
3. Shared mounting
4. Continuous exposure

Correct Answer: 2

Explanation:

Offline storage keeps backup media or copies disconnected from normal network access for appropriate periods. This can reduce the ability of attackers who compromise production environments to directly access or modify those recovery copies. Offline backups are particularly valuable when defending against destructive attacks such as ransomware. The approach must still account for secure physical storage, access procedures, retention, restoration testing, and recovery objectives. Offline copies can complement other protections such as immutable storage and geographically separated backups. Organizations should ensure that recovery personnel know how to access and restore offline copies when a real disruption occurs.

Question 138

What is the primary purpose of a vulnerability disclosure process?

1. To prevent researchers from reporting weaknesses
2. To provide a structured method for receiving and addressing reported security flaws
3. To publish confidential credentials
4. To eliminate software testing

Correct Answer: 4

Explanation:

A vulnerability disclosure process provides a defined method for receiving, evaluating, coordinating, and addressing reports of security weaknesses. A mature process can identify communication channels, responsible teams, acknowledgment expectations, severity assessment, remediation coordination, and disclosure decisions. Clear procedures can encourage responsible reporting by researchers and other parties who discover vulnerabilities. Organizations should avoid discouraging legitimate reports through unclear or inaccessible processes. Disclosure decisions may depend on technical impact, remediation status, affected customers, legal considerations, and coordination with relevant parties. The objective is to manage reported weaknesses systematically rather than allowing them to remain unresolved.

Question 139

Which security assessment examines whether controls operate as intended through an independent evaluation?

1. Security audit
2. Data migration
3. Application packaging
4. Hardware benchmarking

Correct Answer: 3

Explanation:

A security audit evaluates whether an organization’s controls, processes, or practices conform to defined requirements. Depending on the audit scope, evidence may include policies, system records, configuration information, interviews, technical testing, and other documentation. Independent assessment can provide management with greater confidence that stated requirements are actually being followed. Audits can also identify control gaps requiring remediation. An audit should have a defined scope, criteria, methodology, and evidence process. Audit findings should be documented accurately and followed through appropriate corrective actions rather than being treated merely as administrative observations.

Question 140

Which security governance activity compares actual control performance with defined objectives?

1. Software installation
2. Security metrics monitoring
3. Cable replacement
4. File compression

Correct Answer: 4

Explanation:

Security metrics monitoring compares observed security performance with defined objectives, requirements, or thresholds. Useful metrics can help organizations understand whether controls are functioning effectively and where improvement may be needed. Examples include vulnerability remediation timelines, incident response measurements, access review completion, control coverage, or security training participation. Metrics should be meaningful and interpreted within their context because a single number rarely describes the entire security posture. Organizations should avoid selecting measurements simply because they are easy to collect. Well-designed metrics connect operational activity to organizational objectives and support informed security governance decisions.