View Full Cyber AB CCP Exam Dumps and Practice Test Dumps

 

Question 161

What is the primary purpose of a privacy impact assessment?

1. Measure network bandwidth usage
2. Identify privacy risks associated with processing personal information
3. Calculate hardware depreciation
4. Determine employee attendance levels

Correct Answer: 2

Explanation:

A privacy impact assessment, or PIA, evaluates how a planned system, process, or activity may affect the privacy of individuals whose information is collected or processed. It helps identify potential privacy risks before or during implementation and supports the selection of appropriate safeguards. A PIA may examine the types of information involved, collection purposes, access, retention, sharing, and potential impacts on individuals. Conducting the assessment early can allow privacy concerns to be addressed during system design rather than after deployment. It is therefore an important component of responsible information handling and privacy risk management.

Question 162

Which principle requires personal information to be collected for clearly defined purposes?

1. Data portability
2. Purpose limitation
3. Network segmentation
4. Cryptographic agility

Correct Answer: 2

Explanation:

Purpose limitation requires organizations to identify and communicate legitimate purposes for collecting personal information and avoid using that information in ways incompatible with those purposes. The principle encourages organizations to consider why information is needed before collecting it and to prevent unnecessary secondary uses. Purpose limitation can influence privacy notices, system design, data-sharing arrangements, and retention practices. It differs from data portability, which concerns transferring information, and network segmentation, which is a security architecture technique. Applying purpose limitation can reduce unnecessary processing and help organizations maintain clearer boundaries around how personal information is used.

Question 163

What is pseudonymization intended to achieve?

1. Permanently destroy personal information
2. Remove all security requirements from sensitive data
3. Reduce direct identifiability by replacing identifiers with alternatives
4. Make information publicly searchable

Correct Answer: 3

Explanation:

Pseudonymization reduces direct identification of individuals by replacing identifying information with another value, such as a randomly generated identifier. The original identity may still be recoverable when additional information, such as a mapping table or key, is available and properly protected. This distinguishes pseudonymization from anonymization, where information is processed so that individuals should no longer be reasonably identifiable. Pseudonymization can reduce exposure when organizations need to process information for legitimate purposes while limiting direct identifiers. The replacement mechanism and associated information must still receive appropriate security protection because re-identification may remain possible.

Question 164

What is tokenization primarily used to accomplish?

1. Convert passwords into stronger passwords
2. Replace sensitive values with non-sensitive surrogate tokens
3. Compress large database tables
4. Synchronize clocks between servers

Correct Answer: 4

Explanation:

Tokenization replaces sensitive information with a surrogate value called a token. The token itself generally has no meaningful value outside the controlled tokenization system, while the original sensitive value is stored separately and protected. Organizations may use tokenization to reduce the exposure of payment information or other sensitive data within applications and databases. Unlike encryption, tokenization does not necessarily transform the original value through a reversible cryptographic algorithm. Proper token management and protection of the underlying data remain essential. Tokenization can also reduce the number of systems that directly handle sensitive information.

Question 165

Which control helps prevent unauthorized use of removable storage devices?

1. Endpoint device-control restrictions
2. Public website analytics
3. Database indexing
4. Employee scheduling software

Correct Answer: 1

Explanation:

Endpoint device-control restrictions can regulate how removable storage devices such as USB drives are used on organizational systems. Depending on policy, the control may block unauthorized devices, permit only approved hardware, restrict writing to removable media, or require encryption. These measures can reduce the risk of data theft, malware introduction, and uncontrolled movement of sensitive information. Device control should normally be combined with user awareness, endpoint monitoring, and data protection requirements. Merely having a written policy may not prevent technical misuse. Technical restrictions provide an enforcement mechanism that can help organizations apply their removable-media requirements consistently.

Question 166

What does data masking generally do?

1. Permanently erase information from storage
2. Display sensitive values in a modified or obscured form
3. Increase database query performance
4. Create additional administrator accounts

Correct Answer: 2

Explanation:

Data masking changes how sensitive information is displayed or represented so that unauthorized viewers cannot see the original values. For example, an application might display only the last few digits of an account number while concealing the remaining characters. Masking is particularly useful in user interfaces, testing environments, support systems, and reporting applications where full values are unnecessary. Unlike deletion, masking does not necessarily remove the original information from the underlying system. Access controls and other safeguards are still required because improperly protected original data could remain accessible through another interface or process.

Question 167

Why might an organization deploy a secure email gateway?

1. To manage physical building access
2. To filter and inspect inbound and outbound email threats
3. To replace all endpoint operating systems
4. To assign database ownership

Correct Answer: 2

Explanation:

A secure email gateway provides a security layer for organizational email traffic. It can inspect messages for malicious attachments, phishing indicators, spam, suspicious links, malware, and policy violations. Depending on its capabilities, it may also enforce email encryption or data-loss prevention rules. Positioning the gateway between external mail sources and internal mail infrastructure allows organizations to apply filtering before messages reach users. It does not eliminate the need for endpoint protection or user awareness because some malicious content can evade automated filtering. Email security is strongest when gateway controls operate alongside authentication, monitoring, and awareness measures.

Question 168

Which DNS-related technology helps authenticate the origin of DNS data?

1. DNSSEC
2. FTP
3. Telnet
4. SMTP

Correct Answer: 1

Explanation:

DNS Security Extensions, or DNSSEC, add cryptographic authentication to DNS responses. They help clients verify that DNS information originated from an authorized source and has not been altered during transmission. This helps address attacks involving forged or manipulated DNS responses. DNSSEC does not provide general confidentiality for DNS queries, nor does it replace transport encryption. Its primary security value is authenticity and integrity of DNS data. Organizations implementing DNSSEC must manage signing keys and supporting DNS records correctly. Proper validation by resolvers is also necessary for the protections to be effective.

Question 169

What is the purpose of DMARC in email security?

1. Assign wireless network channels
2. Compress email attachments
3. Define employee password complexity
4. Help domain owners specify handling for authentication failures

Correct Answer: 4

Explanation:

Domain-based Message Authentication, Reporting, and Conformance, or DMARC, allows domain owners to publish policies concerning messages that fail specified email authentication checks. It builds on mechanisms such as SPF and DKIM and can provide reporting that helps organizations understand how their domains are being used. DMARC can therefore help reduce certain forms of domain impersonation and improve visibility into unauthorized email activity. A DMARC policy can instruct receiving systems to take actions such as monitoring, quarantining, or rejecting messages that fail the relevant requirements. Correct configuration and gradual deployment are important to avoid disrupting legitimate mail.

Question 170

What is the main purpose of a web application firewall?

1. Protect web applications by filtering application-layer requests
2. Synchronize time across network devices
3. Manage employee identity documents
4. Store offline backup media

Correct Answer: 1

Explanation:

A web application firewall, or WAF, monitors and filters HTTP or HTTPS requests directed toward web applications. It can help detect or block certain application-layer attacks, including malicious input patterns and abnormal requests. A WAF provides an additional defensive layer between clients and applications, but it should not be treated as a replacement for secure application development. Developers still need proper input validation, authentication, authorization, and secure coding practices. WAF rules should also be maintained as applications and attack techniques evolve. Proper tuning is important because overly broad rules may block legitimate requests while weak rules may fail to detect malicious activity.

Question 171

Which protocol is commonly used to provide centralized authentication for network access?

1. SNMP
2. RADIUS
3. NFS
4. IMAP

Correct Answer: 2

Explanation:

RADIUS, or Remote Authentication Dial-In User Service, is commonly used to centralize authentication, authorization, and accounting for network access services. It can support environments such as wireless networks, VPN services, and network access infrastructure. Centralizing these functions can reduce the need for independent credentials and authentication configurations across numerous access devices. RADIUS can work with various authentication methods and is frequently integrated with directory services. Its use does not eliminate the need for strong identity controls or appropriate authorization policies. Organizations should protect communications and administrative interfaces associated with the authentication infrastructure.

Question 172

What is 802.1X primarily used for?

1. Database encryption
2. Email message signing
3. Port-based network access control
4. File compression

Correct Answer: 3

Explanation:

IEEE 802.1X provides port-based network access control, allowing a network device to require authentication before granting access through a controlled port. It is commonly deployed on wired switches and enterprise wireless networks. An endpoint can be required to authenticate before receiving normal network connectivity, helping organizations prevent unauthorized devices from simply connecting to internal networks. 802.1X commonly works with an authentication server and an authentication method suitable for the environment. It is different from network encryption because its primary purpose is controlling access to the network rather than encrypting application data.

Question 173

What is the purpose of egress filtering?

1. Restrict unauthorized outbound network traffic
2. Increase the number of available IP addresses
3. Replace endpoint authentication
4. Automatically classify documents

Correct Answer: 1

Explanation:

Egress filtering controls traffic leaving an organization’s network. It can restrict outbound communication to approved destinations, protocols, ports, or address ranges. This can help limit data exfiltration, prevent communication with malicious infrastructure, and reduce the impact of compromised systems attempting to contact external services. Egress controls are especially useful because many security architectures focus heavily on incoming traffic while giving less attention to outbound communication. Effective egress filtering should be aligned with legitimate business requirements so necessary services continue to function. Monitoring denied outbound connections can also provide useful indicators of suspicious activity.

Question 174

What is a bastion host generally designed to provide?

1. A public repository for confidential documents
2. A hardened system used as a controlled access point
3. A replacement for disaster recovery backups
4. A method for anonymizing all internet traffic

Correct Answer: 2

Explanation:

A bastion host is a hardened system designed to serve as a controlled access point into a protected environment. It may provide administrators with a limited and monitored path to internal systems that should not be directly exposed. Bastion hosts are typically configured with minimal services, strong authentication, restricted access, and extensive monitoring. Their reduced attack surface helps limit opportunities for compromise. A bastion host does not replace backups or automatically anonymize traffic. Organizations may combine bastion hosts with jump servers, privileged access controls, network segmentation, and session monitoring to strengthen administrative access.

Question 175

Which technology is commonly used to provide encrypted remote network connectivity?

1. VLAN
2. VPN
3. DHCP
4. ARP

Correct Answer: 4

Explanation:

A virtual private network, or VPN, can establish an encrypted communication channel across an untrusted or public network. Organizations commonly use VPNs to provide remote users or connected sites with protected access to internal resources. Depending on the implementation, a VPN can provide confidentiality and integrity for traffic traversing the underlying network. Strong authentication and appropriate authorization remain important because encryption alone does not determine whether a user should access a resource. VPN configurations should also be maintained and monitored because compromised credentials or poorly secured endpoints can still create significant risk.

Question 176

What is a secure API gateway commonly responsible for?

1. Managing and protecting API traffic between clients and services
2. Physically destroying obsolete storage devices
3. Measuring employee satisfaction
4. Assigning building evacuation routes

Correct Answer: 1

Explanation:

An API gateway provides a controlled entry point for API traffic between clients and backend services. Depending on its design, it can enforce authentication, authorization, rate limits, request validation, routing, logging, and other security policies. Centralizing these functions can provide consistent protection across multiple services. An API gateway does not automatically make an underlying application secure; backend services still require appropriate authorization, input validation, and secure implementation. Monitoring gateway activity can also help identify abnormal request patterns and potential abuse. Rate limiting is particularly useful for reducing certain forms of automated misuse and excessive request activity.

Question 177

What is rate limiting intended to control?

1. The physical temperature of data centers
2. The number of requests accepted during a defined period
3. The encryption strength of stored files
4. The number of employees in a department

Correct Answer: 2

Explanation:

Rate limiting restricts how many requests, transactions, or actions a user, application, or client can perform within a specified period. It is commonly used to protect APIs, login services, and web applications from excessive requests and automated abuse. For example, limiting repeated authentication attempts can reduce the effectiveness of automated credential attacks. Rate limits can also help preserve service availability by preventing individual clients from consuming disproportionate resources. The appropriate threshold depends on business requirements and expected usage patterns. Rate limiting should complement authentication, monitoring, and other controls rather than operate as the sole defense.

Question 178

What does federated identity allow organizations to accomplish?

1. Use trusted identity relationships across separate security domains
2. Eliminate all user authentication
3. Disable authorization controls between applications
4. Store every password in plain text

Correct Answer: 1

Explanation:

Federated identity allows users to authenticate through a trusted identity provider and access services across separate organizational or security domains. Instead of every service independently maintaining the user’s authentication information, participating systems establish trust and exchange appropriate identity assertions or tokens. Federation can simplify access management and reduce repeated authentication experiences. It does not eliminate authentication or authorization requirements. Trust relationships must be carefully configured, and identity providers require strong protection because compromise could affect many connected services. Organizations should also define which attributes and permissions can be transferred between participating systems.

Question 179

What is a session hijacking attack?

1. Deleting expired authentication logs
2. Capturing or abusing an active user’s session
3. Replacing a damaged backup disk
4. Blocking legitimate DNS records

Correct Answer: 3

Explanation:

Session hijacking occurs when an attacker gains unauthorized control of an active authenticated session. The attacker may obtain or abuse a session identifier, token, or other authentication state and use it to impersonate the legitimate user without necessarily knowing the user’s password. Strong session management can reduce this risk through secure cookies, appropriate session expiration, token protection, reauthentication for sensitive actions, and encrypted communications. Applications should also invalidate sessions when users sign out or when suspicious activity is detected. Session hijacking demonstrates why protecting authentication tokens can be just as important as protecting passwords.

Question 180

Which control helps reduce the risk of unauthorized access through stolen authentication tokens?

1. Increasing monitor brightness
2. Disabling system backups
3. Extending every session indefinitely
4. Requiring reauthentication for sensitive operations

Correct Answer: 4

Explanation:

Requiring reauthentication for sensitive operations can reduce the impact of stolen or misused authentication tokens. Even when an attacker obtains an active session, the application can require the user to authenticate again before allowing high-risk actions such as changing security settings or modifying payment information. This creates an additional checkpoint around particularly sensitive operations. Other useful measures include short session lifetimes, secure token storage, token rotation, device monitoring, and prompt session invalidation. Reauthentication does not replace strong authentication at initial login, but it can provide an additional layer of protection when the consequences of session compromise are significant.