I85PREP
⌘ K
ISACA CSX Fundamentals study materials
ISACA CSX Fundamentals study resources

ISACA CSX Fundamentals practice questions

One question at a time. Build your ISACA CSX Fundamentals understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cybersecurity Fundamentals

Which security principle states that a user should be granted only the minimum access rights needed to perform their job?

  1. Non-repudiation
  2. Least privilege Correct answer.
  3. Separation of duties
  4. Defense in depth

Explanation

Least privilege limits each account to the minimum permissions required for its assigned tasks, reducing the blast radius of a compromised account. Separation of duties divides a sensitive task among multiple people, which is a different control goal.

Question 2Cybersecurity Fundamentals

In the CIA triad, which property is directly compromised when an attacker alters a bank transaction amount in transit?

  1. Authenticity of the source only
  2. Availability
  3. Confidentiality
  4. Integrity Correct answer.

Explanation

Integrity concerns the accuracy and completeness of data, so unauthorized modification of a transaction value violates integrity. Confidentiality would be at risk only if the data were disclosed, and availability only if access were disrupted.

Question 3Cybersecurity Fundamentals

Which type of malware self-replicates across networks by exploiting vulnerabilities without requiring a user to open a file?

  1. Rootkit
  2. Worm Correct answer.
  3. Logic bomb
  4. Trojan

Explanation

A worm propagates autonomously by exploiting vulnerable services on reachable hosts, so it does not depend on user interaction. A Trojan instead relies on deceiving a user into executing it.

Question 4Cybersecurity Fundamentals

An organization wants to ensure that a deleted file cannot be recovered from a disk being resold. Which control is most appropriate?

  1. Encrypting the file before deletion
  2. Media sanitization such as cryptographic erase or overwrite Correct answer.
  3. Moving the file to the recycle bin
  4. Renaming the file and emptying the cache

Explanation

Sanitization removes or destroys residual data so recovery is infeasible, which is the required outcome before disposal or resale. Deleting or moving files only removes references while the underlying blocks may persist.

Question 5Cybersecurity Fundamentals

Which authentication factor category is a hardware token that generates a time-based one-time code?

  1. Something you have Correct answer.
  2. Something you know
  3. Somewhere you are
  4. Something you are

Explanation

A physical token is a possession factor, classified as something you have. The generated code changes over time but the factor's strength derives from control of the device.

Question 6Cybersecurity Fundamentals

What is the primary purpose of hashing a stored password rather than encrypting it?

  1. To make verification possible without retaining the original secret Correct answer.
  2. To allow administrators to read the password for support
  3. To transmit the password securely over the network
  4. To compress the password for storage efficiency

Explanation

A one-way hash lets the system verify a supplied password by recomputing the digest while never storing the recoverable secret. Encryption is reversible, so a key compromise would expose all passwords.

Question 7Cybersecurity Fundamentals

Which cryptographic property does a digital signature primarily provide to a recipient?

  1. Compression of the payload
  2. Anonymity of the sender
  3. Integrity and origin authentication Correct answer.
  4. Confidentiality of the message body

Explanation

A signature computed with the sender's private key can be verified with the public key, proving origin and detecting modification. It does not hide the message content unless combined with encryption.

Question 8Cybersecurity Fundamentals

A web application reflects user input into the page without encoding, and an attacker injects a script that steals session cookies. Which vulnerability is being exploited?

  1. Directory traversal
  2. Cross-site request forgery
  3. SQL injection
  4. Cross-site scripting Correct answer.

Explanation

Reflected input rendered without output encoding lets attacker script execute in the victim's browser, which is cross-site scripting. The stolen cookie then allows session hijacking.

Question 9Cybersecurity Fundamentals

Which control best mitigates SQL injection in a web application?

  1. Renaming database tables periodically
  2. Client-side input length limits
  3. Hiding database error messages
  4. Parameterized queries with bound variables Correct answer.

Explanation

Parameterized queries separate code from data so user input cannot alter query structure, which addresses the root cause. Error hiding and client-side checks reduce information leakage or convenience but not the injection itself.

Question 10Cybersecurity Fundamentals

What distinguishes a vulnerability from a risk?

  1. A risk exists only after an incident, while a vulnerability exists before
  2. A vulnerability applies to software, while risk applies only to physical assets
  3. A vulnerability is always exploitable, while risk is theoretical
  4. A vulnerability is a weakness, while risk combines likelihood and impact of that weakness being exploited Correct answer.

Explanation

A vulnerability is a weakness in a system or control, whereas risk expresses the potential for loss as a function of threat likelihood and impact. The same vulnerability can carry different risk depending on exposure and asset value.

Question 11Cybersecurity Fundamentals

In risk treatment, what does risk transfer mean?

  1. Reducing likelihood through new controls
  2. Shifting the financial consequence to a third party such as an insurer Correct answer.
  3. Accepting the risk without further action
  4. Eliminating the activity that creates the risk

Explanation

Transfer moves the financial impact of a risk to another party, commonly through insurance or contractual clauses, while the underlying exposure may remain. The organization still owns the operational consequences.

Question 12Cybersecurity Fundamentals

Which document typically defines the acceptable use of organizational IT resources by employees?

  1. Acceptable use policy Correct answer.
  2. Incident response plan
  3. Business continuity plan
  4. Service level agreement

Explanation

An acceptable use policy sets rules for how employees may use systems, networks, and data, and usually states monitoring and consequences. It is a governance document rather than a recovery or service document.

Question 13Cybersecurity Fundamentals

What is the main security benefit of network segmentation?

  1. It removes the need for authentication
  2. It increases available bandwidth for all users
  3. It limits lateral movement between zones if one host is compromised Correct answer.
  4. It encrypts all traffic automatically

Explanation

Segmentation divides a network into zones with controlled traffic between them, so a compromised host cannot freely reach other systems. Access control between segments must still be enforced by firewalls or equivalent.

Question 14Cybersecurity Fundamentals

Which device primarily enforces rules about which traffic may pass between two networks?

  1. Switch
  2. Proxy cache
  3. Firewall Correct answer.
  4. Load balancer

Explanation

A firewall inspects traffic against configured rules and permits or blocks it at a boundary between zones. Switches forward frames within a network but do not define inter-zone policy by default.

Question 15Cybersecurity Fundamentals

An attacker floods a server with SYN packets using spoofed source addresses so that half-open connections exhaust resources. Which attack type is this?

  1. Privilege escalation
  2. Data exfiltration
  3. Denial of service Correct answer.
  4. Phishing

Explanation

The SYN flood consumes connection state until legitimate clients cannot connect, which is a denial-of-service condition. Spoofed sources make filtering harder but do not change the attack category.

Question 16Cybersecurity Fundamentals

What is the primary role of a DMZ in a network architecture?

  1. To store encrypted backups
  2. To authenticate employees at the perimeter
  3. To host public-facing services while shielding the internal network Correct answer.
  4. To aggregate routing tables between branches

Explanation

A DMZ is a buffer zone for internet-facing systems so that compromise of those systems does not grant direct access to internal assets. Traffic between the DMZ and the internal network is restricted.

Question 17Cybersecurity Fundamentals

During which phase of incident response is evidence collected and preserved for potential legal action?

  1. Detection and analysis Correct answer.
  2. Preparation
  3. Post-incident activity
  4. Containment, eradication, and recovery

Explanation

Evidence gathering begins as soon as an incident is detected and analyzed, because volatile data such as memory and connections disappears quickly. Preserving it early supports later investigation and legal proceedings.

Question 18Cybersecurity Fundamentals

Which activity best describes threat hunting?

  1. Proactively searching for undetected adversary activity using hypotheses Correct answer.
  2. Waiting for alerts from the SIEM before investigating
  3. Blocking all inbound traffic at the perimeter
  4. Running scheduled vulnerability scans of servers

Explanation

Threat hunting is proactive and hypothesis-driven, seeking evidence of compromise that existing detection rules missed. It differs from reactive alert triage and from routine scanning.

Question 19Cybersecurity Fundamentals

What is the key difference between a vulnerability scan and a penetration test?

  1. A scan requires legal authorization, while a penetration test does not
  2. A scan identifies potential weaknesses, while a penetration test attempts controlled exploitation to validate impact Correct answer.
  3. A scan tests only networks, while a penetration test tests only applications
  4. A scan is always manual, while a penetration test is always automated

Explanation

Scanning enumerates candidate weaknesses, often with false positives, whereas penetration testing validates exploitability and business impact through authorized simulated attack. Both require authorization and can cover networks and applications.

Question 20Cybersecurity Fundamentals

Which practice most directly reduces the risk of a successful phishing email leading to account compromise?

  1. Enforcing phishing-resistant multi-factor authentication Correct answer.
  2. Increasing password complexity requirements alone
  3. Disabling email attachments for all users
  4. Publishing the corporate directory externally

Explanation

Phishing-resistant MFA such as hardware security keys prevents an attacker who captures a password from reusing it in a real session. Complexity rules alone do not stop credential theft through deception.

Question 21Cybersecurity Fundamentals

An employee receives a call from someone claiming to be IT support who asks for a password to fix an urgent issue. Which social engineering technique is this?

  1. Shoulder surfing
  2. Pretexting Correct answer.
  3. Tailgating
  4. Dumpster diving

Explanation

Pretexting uses a fabricated scenario and assumed identity to manipulate the target into disclosing information. Legitimate support staff do not need a user's password, so the request itself is a warning sign.

Question 22Cybersecurity Fundamentals

Which element of a symmetric encryption scheme must be kept secret for the scheme to remain secure?

  1. The algorithm specification
  2. The block size
  3. The shared key Correct answer.
  4. The ciphertext length

Explanation

Kerckhoffs's principle assumes the algorithm is public and security rests on the key, so the shared key must remain secret. Ciphertext length and block size are observable properties, not secrets.

Question 23Cybersecurity Fundamentals

A company must prove that a stored record has not changed since it was approved, without revealing the record contents to the verifier. Which combination is most appropriate?

  1. Storing the record in two separate databases
  2. Encrypting the record with a shared password
  3. Hashing the record and signing the hash with the approver's private key Correct answer.
  4. Compressing the record and storing it offsite

Explanation

A hash detects any change to the record, and signing the hash binds it to the approver while keeping content hidden from the verifier. The verifier recomputes the hash and checks the signature without reading the data.

Question 24Cybersecurity Fundamentals

Why is a salt added to each password before hashing?

  1. To make identical passwords produce different hashes and defeat precomputed tables Correct answer.
  2. To shorten the resulting hash value
  3. To synchronize clocks between servers
  4. To allow the password to be decrypted later

Explanation

A unique salt per password ensures equal passwords yield distinct digests, which blocks rainbow tables and forces attackers to attack each hash separately. Salts are stored alongside hashes and need not be secret.

Question 25Cybersecurity Fundamentals

An organization discovers that a vendor holds copies of its customer data with no defined deletion timeline. Which governance action addresses this gap most directly?

  1. Adding a data retention and deletion clause to the vendor contract Correct answer.
  2. Moving the marketing website to a new host
  3. Increasing the vendor's network bandwidth
  4. Requiring the vendor to use a different operating system

Explanation

Third-party data handling must be governed by contractual terms that specify retention limits, deletion obligations, and evidence of destruction. Technical changes at the vendor do not establish the required accountability.

Question 26Cybersecurity Fundamentals

Which statement best describes the relationship between an asset, a threat, and a vulnerability in cybersecurity risk analysis?

  1. A vulnerability exploits an asset to neutralize a threat
  2. An asset exploits a threat to expose a vulnerability
  3. A threat is the monetary value assigned to a vulnerable asset
  4. A threat exploits a vulnerability to cause harm to an asset Correct answer.

Explanation

Risk analysis links three elements: an asset is something of value, a vulnerability is a weakness in that asset or its controls, and a threat is an actor or event that could exploit the weakness. Harm occurs when a threat actually exploits a vulnerability against the asset. Keeping these roles distinct is essential for assigning controls and estimating likelihood.

Question 27Cybersecurity Fundamentals

An organization wants to ensure that only approved software runs on employee workstations. Which control type most directly accomplishes this?

  1. Application allowlisting enforced by endpoint policy Correct answer.
  2. Network address translation at the perimeter firewall
  3. Full-disk encryption on each workstation drive
  4. A monthly vulnerability scan of the workstation subnet

Explanation

Allowlisting defines an explicit set of permitted executables and blocks everything else, which directly restricts execution to approved software. Encryption, scanning, and NAT address other concerns such as confidentiality, detection, and address hiding. Only allowlisting enforces the approved-software requirement at the point of execution.

Question 28Cybersecurity Fundamentals

Which principle states that a user should be granted only the access necessary to perform their assigned job duties?

  1. Least privilege Correct answer.
  2. Mandatory vacation
  3. Defense in depth
  4. Separation of duties

Explanation

Least privilege limits each account to the minimum rights required for its tasks, reducing the blast radius of misuse or compromise. Separation of duties instead splits a sensitive task among multiple people. Defense in depth layers controls, and mandatory vacation is a fraud-detection practice.

Question 29Cybersecurity Fundamentals

What is the primary purpose of a security awareness training program?

  1. To certify that staff hold professional security credentials
  2. To shift security responsibility entirely to the IT department
  3. To reduce human-related risk by improving employee security behavior Correct answer.
  4. To replace technical controls that are too costly to deploy

Explanation

Awareness training targets the human element, helping employees recognize threats such as phishing and follow secure practices. It complements rather than replaces technical and administrative controls. Its goal is behavior change that lowers the likelihood of human-triggered incidents.

Question 30Cybersecurity Fundamentals

Which type of malware encrypts a victim's files and demands payment for the decryption key?

  1. Keylogger
  2. Rootkit
  3. Ransomware Correct answer.
  4. Adware

Explanation

Ransomware encrypts data or locks systems and demands payment, typically in cryptocurrency, for restoration. Rootkits conceal attacker presence, keyloggers capture keystrokes, and adware displays unwanted advertising. The extortion-for-decryption behavior is the defining trait of ransomware.

Question 31Cybersecurity Fundamentals

Which characteristic distinguishes a worm from a typical virus?

  1. A worm is always delivered through a phishing email
  2. A worm requires a user to open an infected attachment to spread
  3. A worm self-propagates across networks without user interaction Correct answer.
  4. A worm only affects the boot sector of a single machine

Explanation

A worm spreads autonomously by exploiting network services or weak configurations, so it does not depend on a user running an infected file. A virus typically needs a host file and some user action to propagate. This self-propagation is why worms can spread very rapidly across networks.

Question 32Cybersecurity Fundamentals

In an information security context, what does the term 'confidentiality' refer to?

  1. Ensuring systems remain available to authorized users
  2. Ensuring every action can be attributed to a specific user
  3. Ensuring data is accurate and complete when accessed
  4. Ensuring information is disclosed only to authorized parties Correct answer.

Explanation

Confidentiality is the property that information is not disclosed to unauthorized individuals, entities, or processes. Accuracy and completeness relate to integrity, availability concerns uptime, and attribution relates to accountability and non-repudiation. These are distinct pillars of the CIA triad and should not be conflated.

Question 33Cybersecurity Fundamentals

Which authentication factor category is represented by a fingerprint scan?

  1. Somewhere you are
  2. Something you are Correct answer.
  3. Something you have
  4. Something you know

Explanation

Biometric traits such as fingerprints, iris patterns, and voice are inherent physical characteristics, classified as 'something you are.' Knowledge factors are memorized secrets, possession factors are physical tokens, and location is a contextual attribute rather than a core factor category.

Question 34Cybersecurity Fundamentals

A security team wants to detect unauthorized changes to critical system files on a server. Which control is most appropriate?

  1. Data loss prevention applied to outbound email
  2. Network-based intrusion prevention at the perimeter
  3. File integrity monitoring with baseline comparison Correct answer.
  4. A quarterly user access recertification

Explanation

File integrity monitoring records cryptographic hashes of files and compares them against a known-good baseline, flagging any modification. Access recertification, perimeter IPS, and email DLP address different risks and would not reliably detect file tampering on a host. Detecting unauthorized file change requires comparing current state to a trusted baseline.

Question 35Cybersecurity Fundamentals

Which statement accurately describes the role of a certificate authority (CA) in a public key infrastructure?

  1. It generates the symmetric session keys used to encrypt bulk traffic
  2. It stores every private key belonging to relying parties
  3. It decrypts all traffic between clients and servers to inspect it
  4. It binds a public key to an identity by issuing a signed certificate Correct answer.

Explanation

A CA validates an identity and issues a certificate that binds that identity to a public key, signing it with the CA's own private key so relying parties can verify it. Session keys are negotiated by the communicating parties, and private keys are not centrally held by the CA. Traffic decryption is not a CA function.

Question 36Cybersecurity Fundamentals

A user reports that a website's certificate warning appears even though the site was previously trusted. Which explanation is most consistent with a man-in-the-middle interception attempt?

  1. The server is presenting a certificate that does not chain to a trusted root for that hostname Correct answer.
  2. The website has enabled HTTP Strict Transport Security
  3. The server is using an extended validation certificate
  4. The browser has cached the site's static content

Explanation

An interceptor must present its own certificate, which typically will not chain to a trusted root or match the requested hostname, triggering a warning. HSTS, EV certificates, and content caching are legitimate behaviors that do not produce untrusted-certificate errors. The mismatch is the signal that the presented identity is not the expected one.

Question 37Cybersecurity Fundamentals

Which practice best protects data at rest on a lost laptop?

  1. Encrypting the storage volume with a key protected by a TPM Correct answer.
  2. Requiring a complex login password only
  3. Enforcing screen lock after inactivity
  4. Configuring the firewall to block inbound ports

Explanation

Full-volume encryption renders the disk contents unreadable without the key, so physical removal of the drive does not expose data. A screen lock and login password protect a running session but not an offline disk attack. Firewall rules govern network traffic and do not protect stored data.

Question 38Cybersecurity Fundamentals

Which model enforces access decisions based on the sensitivity labels of objects and the clearance of subjects, independent of object ownership?

  1. Role-based access control
  2. Attribute-based access control
  3. Mandatory access control Correct answer.
  4. Discretionary access control

Explanation

Mandatory access control uses system-assigned labels and clearances, and even object owners cannot override the policy. Discretionary access control lets owners set permissions, role-based access control maps rights to job roles, and attribute-based access control evaluates multiple attributes. Only MAC is driven by labels and clearances rather than ownership or roles.

Question 39Cybersecurity Fundamentals

An organization wants to detect a compromised account that is being used to access many systems it never touched before. Which monitoring approach is most effective?

  1. Counting the number of failed logins per quarter
  2. Reviewing firewall rule change tickets weekly
  3. Scanning servers for missing patches each month
  4. Baselining normal user behavior and alerting on significant deviations Correct answer.

Explanation

User and entity behavior analytics establishes a baseline of normal activity and flags anomalies such as access to unfamiliar systems or unusual volumes. Rule-change review, patch scanning, and quarterly login counts do not detect deviations in access patterns. Behavioral baselining is the technique suited to spotting account misuse.

Question 40Cybersecurity Fundamentals

Which statement best explains why logging must be centralized and protected from modification?

  1. Centralized logs reduce the storage cost of individual servers
  2. Logs are only useful for performance tuning of applications
  3. Tamper-evident central logs support investigation and accountability Correct answer.
  4. Central logging eliminates the need for intrusion detection systems

Explanation

Attackers commonly clear local logs to hide their activity, so forwarding to a protected central store preserves evidence and supports accountability. Centralization is about integrity and availability of evidence, not storage savings or performance tuning. It complements detection systems rather than replacing them.

Question 41Cybersecurity Fundamentals

Which of the following best describes the function of a security information and event management (SIEM) system?

  1. It automatically patches operating system vulnerabilities
  2. It aggregates and correlates log data from multiple sources to raise alerts Correct answer.
  3. It replaces the need for endpoint antivirus software
  4. It encrypts all data flows between internal segments

Explanation

A SIEM collects events from diverse sources, normalizes them, correlates patterns, and generates alerts for analysts. It does not encrypt traffic, patch systems, or replace endpoint protection. Its core value is centralized visibility and correlation across the environment.

Question 42Cybersecurity Fundamentals

A company stores customer records in a cloud service and must ensure data remains unreadable to the cloud provider. Which approach best achieves this?

  1. Encrypting data with customer-managed keys before it reaches the provider Correct answer.
  2. Enabling multi-factor authentication on administrator accounts
  3. Relying on the provider's default encryption at rest
  4. Signing a data processing agreement with the provider

Explanation

Client-side encryption with keys the provider cannot access keeps the data unreadable to the provider, since it never holds the plaintext or the key. Provider-managed encryption protects against disk theft but the provider can still access keys. MFA and contracts address access control and legal obligations, not cryptographic confidentiality from the provider.

Question 43Cybersecurity Fundamentals

Which statement best distinguishes a business continuity plan from a disaster recovery plan?

  1. Business continuity focuses on restoring IT infrastructure after a disaster
  2. Business continuity sustains critical business functions, while disaster recovery restores IT systems and data Correct answer.
  3. Disaster recovery addresses only personnel safety during an evacuation
  4. The two terms are interchangeable and describe identical activities

Explanation

Business continuity maintains essential business operations during and after disruption, while disaster recovery is the IT-focused subset that restores systems, data, and infrastructure. Disaster recovery is narrower than continuity. Treating them as identical obscures the broader organizational scope of continuity planning.

Question 44Cybersecurity Fundamentals

An organization defines a recovery time objective (RTO) of four hours for a critical application. What does this requirement specify?

  1. The time required to complete a full security audit
  2. The maximum time allowed to restore the application after disruption Correct answer.
  3. The interval between scheduled backups of the application
  4. The maximum acceptable data loss measured in time

Explanation

RTO is the target duration within which a process or system must be restored after an outage. Maximum acceptable data loss is the recovery point objective, not the RTO. Backup intervals and audit duration are separate scheduling concerns.

Question 45Cybersecurity Fundamentals

Which of the following best describes the purpose of a security policy exception process?

  1. To allow permanent bypass of any control at an administrator's discretion
  2. To eliminate the need for risk acceptance by senior management
  3. To automatically close audit findings without further review
  4. To document, approve, and time-limit deviations from policy with compensating controls Correct answer.

Explanation

An exception process formally records why a deviation is needed, who approved it, and when it expires, often with compensating controls. It ensures deviations are risk-accepted at the right level rather than ad hoc. Permanent unilateral bypasses and automatic closure defeat the purpose of governance.

Question 46Cybersecurity Fundamentals

Which practice most directly limits the impact of a compromised service account used by an application?

  1. Sharing the account credentials among several administrators
  2. Granting the account domain administrator rights for convenience
  3. Scoping the account's permissions to only the resources the application needs Correct answer.
  4. Disabling logging for the account to reduce noise

Explanation

Scoping permissions to the minimum required limits what a compromised service account can reach, containing the blast radius. Over-privileged accounts expand the damage, credential sharing removes accountability, and disabling logging destroys the evidence needed to detect misuse. Least privilege is the key containment measure.

Question 47Cybersecurity Fundamentals

An attacker sends emails that appear to come from a company's CEO to finance staff, requesting urgent wire transfers. Which term best describes this attack?

  1. Privilege escalation
  2. Watering hole attack
  3. Business email compromise Correct answer.
  4. Denial-of-service attack

Explanation

Business email compromise impersonates a trusted executive or partner to trick staff into transferring funds or disclosing information. A watering hole compromises a site the target visits, denial of service degrades availability, and privilege escalation gains higher access. The impersonation-for-payment pattern is the hallmark of BEC.

Question 48Cybersecurity Fundamentals

A penetration tester discovers that a web server's default administrative interface is reachable from the internet with vendor-default credentials. Which remediation should be prioritized first?

  1. Documenting the finding in the risk register and waiting for the next cycle
  2. Increasing the frequency of log reviews for that server
  3. Restricting access to the interface and changing the default credentials Correct answer.
  4. Adding the server to the vulnerability scan exclusion list

Explanation

Default credentials on an internet-exposed administrative interface present an immediate compromise path, so access must be restricted and credentials changed without delay. Excluding the host from scans hides the problem, and monitoring or documentation alone leaves the exposure open. Immediate containment is warranted before longer-term risk tracking.

Question 49Cybersecurity Fundamentals

An organization's risk assessment shows a high-likelihood, high-impact risk whose mitigation cost exceeds the potential loss. Which risk treatment option is most appropriate to consider?

  1. Risk avoidance by eliminating the associated business activity
  2. Risk acceptance with formal sign-off by accountable management Correct answer.
  3. Risk transfer to a third party through cyber insurance
  4. Risk deferral until the next fiscal year without documentation

Explanation

When mitigation cost exceeds the expected loss and other options are impractical, formal risk acceptance with documented management sign-off is a legitimate treatment. Acceptance must be explicit and owned at the appropriate level. Avoidance may be infeasible, transfer does not eliminate the risk, and undocumented deferral is not a valid treatment.

Question 50Cybersecurity Fundamentals

A security analyst observes outbound DNS queries to an unusual domain at regular short intervals from a workstation, with small encoded payloads. Which conclusion is most warranted?

  1. The workstation is performing routine software updates
  2. The workstation has a failing network interface card
  3. The domain is certainly benign because DNS is a normal protocol
  4. The traffic is consistent with DNS tunneling used for command and control or exfiltration Correct answer.

Explanation

Periodic queries with encoded payloads to an unusual domain are characteristic of DNS tunneling, which can carry command-and-control traffic or exfiltrate data because DNS is often allowed through firewalls. Routine updates do not normally exhibit encoded beaconing to unusual domains. The pattern warrants investigation as a potential compromise.