IBM Cybersecurity Analyst Professional Certificate • STUDY MODE
PRACTICE QUIZ
QUESTION 1 OF 73
True or False. A security architect's job is to make sure that security considerations dominate other design aspects such as usability, resilience and cost.
A
True
B
FalseCorrect Answer
QUESTION 2 OF 73
Which of these is an aspect of an Enterprise Architecture?
A
Considers the needs of the entire organizationCorrect Answer
B
Gives the technology perspectives in detail
C
Describes how specific products or technologies are used
D
Shows the internal data and use of reusable or off-the-shelf components
QUESTION 3 OF 73
Which of these is an aspect of a Solution Architecture?
A
Does not describe the internals of the main components or how they will be implemented
B
Describes how specific products or technologies are usedCorrect Answer
C
Maps the main components of a problem space and solution at a very high level
D
Considers the needs of the entire organization
QUESTION 4 OF 73
Which three (3) of these are general features of Building Blocks? (Select 3)
A
Defined boundary, but can work with other building blocksCorrect Answer
B
Package of function defined to meet a business needCorrect Answer
C
May be product or vendor aware
D
Could be an actor, business service, application or dataCorrect Answer
QUESTION 5 OF 73
Which three (3) of these are Architecture Building Blocks (ABBs)? (Select 3)
A
Certificate Authority
B
Data SecurityCorrect Answer
C
Identity and Access ManagementCorrect Answer
D
Application SecurityCorrect Answer
QUESTION 6 OF 73
Which three (3) of these are Solution Building Blocks (SBBs)? (Select 3)
A
Key Security ManagerCorrect Answer
B
HSMCorrect Answer
C
Certificate AuthorityCorrect Answer
D
Data Security
QUESTION 7 OF 73
The diagram below shows which type of architecture?
( Image S1Q7 )
A
Context-Aware Enterprise Security Architecture
B
Solution Architecture
C
Enterprise Security ArchitectureCorrect Answer
D
Solution Building Blocks
QUESTION 8 OF 73
Solution architectures often contain diagrams like the one below. What does this diagram show?
( Image S1Q8 )
A
Functional components and data flow
B
Enterprise architecture
C
External context and boundary diagram
D
Architecture overviewCorrect Answer
QUESTION 9 OF 73
In security architecture, a reusable solution to a commonly recurring problem is known as what?
APPLICATION SECURITY TECHNIQUES AND RISKS KNOWLEDGE CHECK
A
A module
B
A component
C
A blueprint
D
A patternCorrect Answer
QUESTION 10 OF 73
Which of these is an application security threat?
A
Earthquake
B
MalwareCorrect Answer
C
Hackers
D
A security flaw in source code
QUESTION 11 OF 73
Failure to use input validation in your application introduces what?
A
A vulnerabilityCorrect Answer
B
A threat
C
A vector
D
A risk
QUESTION 12 OF 73
Which software development lifecycle is characterized as a top-down approach where one stage of the project is completed before the next stage begins?
A
Iterative
B
Agile and Scrum
C
WaterfallCorrect Answer
D
Spiral
QUESTION 13 OF 73
Which form of penetration testing allows the testers complete knowledge of the systems they are trying to penetrate in advance of their attack to simulate an internal attack from a knowledgeable insider?
A
Red Box Testing
B
White Box testingCorrect Answer
C
Black Box Testing
D
Gray Box Testing
QUESTION 14 OF 73
Which application testing method requires access to the original application source code?
Which three (3) steps are part of a Supplier Risk Assessment? (Select 3)
A
Identify how the risk would impact the businessCorrect Answer
B
Identify how any risks would impact your organization)s businessCorrect Answer
C
Determine the likelihood the risk would interrupt the businessCorrect Answer
D
Identify mitigations that would minimize or eliminate the risk
QUESTION 16 OF 73
What type of firewall should you install to protect applications used by your organization from hacking?
A
A statefull firewall
B
A web application firewall (WAF)Correct Answer
C
A Juniper firewall
D
A stateless firewall
QUESTION 17 OF 73
Which type of application attack would include elevation of privilege, data tampering and luring attacks?
A
Configuration management
B
AuthorizationCorrect Answer
C
Auditing and logging
D
Exception management
QUESTION 18 OF 73
Which type of application attack would include information disclosure and denial of service?
A
Exception management
B
Authorization
C
AuthenticationCorrect Answer
D
Configuration management
QUESTION 19 OF 73
Which one of the OWASP Top 10 Application Security Risks would be occur when untrusted data is sent to an interpreter as part of a command or query?
A
InjectionCorrect Answer
B
XML external entities (XXE)
C
Broken authentication
D
Sensitive data exposure
QUESTION 20 OF 73
Which one of the OWASP Top 10 Application Security Risks would be occur when a poorly configured XML processor evaluates an external entity reference within an XML document allowing the external entity to expose internal files?
A
XML external entities (XXE)Correct Answer
B
Security misconfiguration
C
Broken access control
D
Cross-site scripting
QUESTION 21 OF 73
Which of these threat modeling methodologies was introduced in 1999 at Microsoft to provide their developer’s a mnemonic that would help them find security vulnerabilities in their products?
A
STRIDECorrect Answer
B
TRIKE
C
VAST
D
P.A.S.T.A.
QUESTION 22 OF 73
Security standards do not have the force of law but security regulations do. Which one of these is a security regulation?
DEVSECOPS & SECURITY AUTOMATION KNOWLEDGE CHECK
A
ISO 27034/24772
B
Gramm-Leach-Bliley ActCorrect Answer
C
DISA-STIG
D
PCI-DSS
QUESTION 23 OF 73
Which phase of DevSecOps would contain the activities Threat modeling & risk analysis, Security backlog and Architecture & design?
A
PlanCorrect Answer
B
Test
C
Operate & monitor
D
Release, deploy & decommission
E
Code & build
QUESTION 24 OF 73
Which phase of DevSecOps would contain the activities Continuous component control, Application and infrastructure orchestration, and Data cleansing & retention?
A
Code & build
B
Operate & monitor
C
Plan
D
Release, deploy & decommissionCorrect Answer
E
Test
QUESTION 25 OF 73
The Release step in the DevSecOps Release, Deploy & Decommission phase contains which of these activities?
A
Creation of Immutable images
B
IAM controls to regulate authorization
C
Centralized Key-Value & Secret stores
D
Versioning of infrastructureCorrect Answer
QUESTION 26 OF 73
The Detect & Visualize step in the DevSecOps Operate & Monitor phase contains which of these activities?
DEEP DIVE INTO CROSS-SCRIPTING KNOWLEDGE CHECK
A
InventoryCorrect Answer
B
Chaos engineering
C
Virtual Patching
D
Root Cause Analysis
QUESTION 27 OF 73
True or False. Finding a bug in a software product from a major vendor can be very profitable for a security researcher.
A
TrueCorrect Answer
B
False
QUESTION 28 OF 73
Which is the top vulnerability found in common security products?
A
Cross-site scriptingCorrect Answer
B
Use of broken or risky cryptographic algorithms
C
Password in clear text
D
SQL Injection
QUESTION 29 OF 73
True or False. Building software defenses into your software includes: input validation, output sensitization, strong encryption, strong authentication and authorization.
A
TrueCorrect Answer
B
False
QUESTION 30 OF 73
Complete the following statement. Cross-site scripting ____
A
allows a hacker to write a script that links applications across sites.
B
is a rare hack but a potentially dangerous one.
C
is limited to http parameters and can be defeated by using https.
D
allows attackers to inject client-side scripts into a web page.Correct Answer
QUESTION 31 OF 73
True or False. A Stored XSS attack is potentially far more dangerous than a Reflected XSS attack.
A
TrueCorrect Answer
B
False
QUESTION 32 OF 73
Cross-site scripting attacks can be minimized by using HTML and URL Encoding. How would a browser display this string?: <b>Test</b>
A
<b>Test</b>
B
<<Test>>
C
<b>Test</b>Correct Answer
D
Test
QUESTION 33 OF 73
Which is the most effective means of validating user input?
APPLICATION TESTING GRADED ASSESSMENT
A
Client-side input validation
B
Server-side input validation
C
Blacklisting
D
WhitelistingCorrect Answer
QUESTION 34 OF 73
True or False. A security architect's job is to make sure that security considerations are balanced against other design aspects such as usability, resilience and cost.
A
TrueCorrect Answer
B
FALSE
QUESTION 35 OF 73
Which three (3) of these are features of Architecture Building Blocks (ABBs)? (Select 3)
A
Guides the development of a Solution ArchitectureCorrect Answer
B
Specifies the technical components to implement a function
C
Product and vendor neutralCorrect Answer
D
Captures and defines requirements such as function, data, and applicationCorrect Answer
QUESTION 36 OF 73
The diagram below shows which level of architecture?
( Image S5Q7 )
A
High Level Security Architecture
B
Enterprise Security ArchitectureCorrect Answer
C
Domain-specific Enterprise Security Architecture
D
Solution Architecture
QUESTION 37 OF 73
Solution architectures often contain diagrams like the one below. What does this diagram show?
( Image S5Q8 )
A
Enterprise architecture
B
External context and boundry diagram
C
Functional components and data flow
D
Solution architecture overviewCorrect Answer
QUESTION 38 OF 73
Solution architectures often contain diagrams like the one below. What does this diagram show?
( Image S5Q9 )
A
Enterprise architecture
B
Functional components and data flow
C
External context and boundary diagramCorrect Answer
D
Architecture overview
QUESTION 39 OF 73
What is lacking in a security architecture pattern that prevents it from being used as a finished design?
A
Proper level of abstraction
B
Proper formatting
C
The context of the project at handCorrect Answer
D
Vendor selections
QUESTION 40 OF 73
What are the possible consequences if a bug in your application becomes known?
A
It is embarrassing to your company
B
Financial losses via lawsuits and fines can be very significant
C
Government agencies can impose fines and other sanctions against your company
D
All of the aboveCorrect Answer
QUESTION 41 OF 73
What was the ultimate consequence to Target Stores in the United States from their 2013 data breach in which over 100M records were stolen?
A
Costs and fines estimated at $1B.Correct Answer
B
Criminal negligence charges were filed 3 Target executives, 1 of whom received a prison sentence
C
Costs and fines that forced the company into bankruptcy
D
Costs of $10M and reputational damage only.
QUESTION 42 OF 73
Select the two (2) top vulnerabilities found in common security products. (Select 2)
A
Cross-site request forgeryCorrect Answer
B
Cross-site scriptingCorrect Answer
C
SQL Injection
D
Use of hard-coded credentials
QUESTION 43 OF 73
True or False. If you can isolate your product from the Internet, it is safe from being hacked.
A
True
B
FalseCorrect Answer
QUESTION 44 OF 73
Which three (3) things can Cross-site scripting be used for? (Select 3)
A
Steal cookiesCorrect Answer
B
Harvest credentialsCorrect Answer
C
Take over sessionsCorrect Answer
D
Break encryption
QUESTION 45 OF 73
True or False. Commonly a Reflect XSS attack is sent as part of an Email or a malicious link and affects only the the user who receives the Email or link.
A
TrueCorrect Answer
B
False
QUESTION 46 OF 73
Cross-site scripting attacks can be minimized by using HTML and URL Encoding. How would a browser display this string?:
<b>Password</b>
A
<<Password>>
B
Password
C
<b>Password</b>Correct Answer
D
<b>Password</b>
QUESTION 47 OF 73
Which three (3) statements about whitelisting user input are true? (Select 3)
A
Whitelisting reduces the attack surface to a known quantityCorrect Answer
B
Special characters should only be allowed on an exception basisCorrect Answer
C
Single quotes should never be allowed as user input
D
Whenever possible, input should be whitelisted to alphanumeric values to prevent XSSCorrect Answer
QUESTION 48 OF 73
Which two (2) statements are considered good practice for avoiding XSS attacks (Select 2)
A
Encode all data output as part of HTML and JavaScriptCorrect Answer
B
Develop you own validation or encoding functionality that is customized for your application
C
Use strict whitelists on accepting inputCorrect Answer
D
Use blacklists and client-side validation
QUESTION 49 OF 73
How would you classify a hactivist group who thinks that your company)s stance on climate change threatens the survival of the planet?
A
A vector
B
A threatCorrect Answer
C
A vulnerability
D
A risk
QUESTION 50 OF 73
Which software development lifecycle is characterized by short bursts of analysis, design, coding and testing during a series of 1 to 4 week sprints?
A
Agile and ScrumCorrect Answer
B
Spiral
C
Waterfall
D
Iterative
QUESTION 51 OF 73
Which software development lifecycle is characterized by a series of cycles and an emphasis on security?
A
SpiralCorrect Answer
B
Waterfall
C
Agile and Scrum
D
Iterative
QUESTION 52 OF 73
Which form of penetration testing allows the testers no knowledge of the systems they are trying to penetrate in advance of their attack to simulate an external attack by hackers with no knowledge of an organizations systems?
A
Black Box TestingCorrect Answer
B
Red Box Testing
C
Gray Box Testing
D
White Box testing
QUESTION 53 OF 73
Which application testing method requires a URL to the application, is quick and cheap but also produces the most false-positive results?
Which type of application attack would include buffer overflow, cross-site scripting, and SQL injection?
A
Authentication
B
Configuration management
C
Authorization
D
Input validationCorrect Answer
QUESTION 55 OF 73
Which type of application attack would include unauthorized access to configuration stores, unauthorized access to administration interfaces and over-privileged process and service accounts?
A
Auditing and logging
B
Authentication
C
Configuration managementCorrect Answer
D
Exception management
QUESTION 56 OF 73
Which one of the OWASP Top 10 Application Security Risks would occur when authentication and session management functions are implemented incorrectly allowing attackers to compromise passwords, keys or session tokens.
A
Sensitive data exposure
B
Broken authenticationCorrect Answer
C
XML external entities (XXE)
D
Broken access control
QUESTION 57 OF 73
Which one of the OWASP Top 10 Application Security Risks would occur when restrictions on what a user is allowed to do is not properly enforced?
A
Insecure deserialization
B
Security misconfiguration
C
Cross-site scripting
D
Broken access controlCorrect Answer
QUESTION 58 OF 73
Which of these threat modeling methodologies is integrated seamlessly into an Agile development methodology?
A
VASTCorrect Answer
B
P.A.S.T.A.
C
TRIKE
D
STRIDE
QUESTION 59 OF 73
Security standards do not have the force of law but security regulations do. Which one of these is a security regulation?
A
NIST 800-53
B
HIPAACorrect Answer
C
ISO 27034/24772
D
PCI-DSS
QUESTION 60 OF 73
Which phase of DevSecOps would contain the activities Secure application code, Secure infrastructure configuration, and OSS/COTS validation?
A
Operate & monitor
B
Plan
C
Release, deploy & decommission
D
Code & buildCorrect Answer
E
Test
QUESTION 61 OF 73
Which phase of DevSecOps would contain the activities Detect & Visualize, Respond, and Recover?
A
Release, deploy & decommission
B
Test
C
Operate & monitorCorrect Answer
D
Plan
E
Code & build
QUESTION 62 OF 73
The Deploy step in the DevSecOps Release, Deploy & Decommission phase contains which of these activities?
A
Data backup cleansing
B
Versioning of infrastructure
C
IAM controles to regulate authorization
D
Creation of Immutable imagesCorrect Answer
QUESTION 63 OF 73
The Respond step in the DevSecOps Operate & Monitor phase contains which of these activities?
A
Root Cause Analysis
B
Inventory
C
Chaos engineering
D
Virtual PatchingCorrect Answer
QUESTION 64 OF 73
True or False. A security architect’s job is to make sure that security considerations dominate other design aspects such as usability, resilience and cost.
A
True
B
FalseCorrect Answer
QUESTION 65 OF 73
The diagram below shows which type of architecture?
A
Context-Aware Enterprise Security Architecture
B
Solution Architecture
C
Enterprise Security ArchitectureCorrect Answer
D
Solution Building Blocks
QUESTION 66 OF 73
Solution architectures often contain diagrams like the one below. What does this diagram show?
A
Functional components and data flow
B
Enterprise architecture
C
External context and boundary diagram
D
Architecture overviewCorrect Answer
QUESTION 67 OF 73
In security architecture, a reusable solution to a commonly recurring problem is known as what?
A
A module
B
A component
C
A blueprint
D
A patternCorrect Answer
QUESTION 68 OF 73
Which phase of DevSecOps would contain the activities Threat modeling & risk analysis, Security backlog and Architecture & design?
A
PlanCorrect Answer
B
Test
C
Operate & monitor
D
Release, deploy & decommission
E
Code & build
QUESTION 69 OF 73
Which phase of DevSecOps would contain the activities Continuous component control, Application and infrastructure orchestration, and Data cleansing & retention?
A
Code & build
B
Operate & monitor
C
Plan
D
Release, deploy & decommissionCorrect Answer
E
Test
QUESTION 70 OF 73
The Release step in the DevSecOps Release, Deploy & Decommission phase contains which of these activities?
A
Creation of Immutable images
B
IAM controls to regulate authorization
C
Centralized Key-Value & Secret stores
D
Versioning of infrastructureCorrect Answer
QUESTION 71 OF 73
The Detect & Visualize step in the DevSecOps Operate & Monitor phase contains which of these activities?
A
InventoryCorrect Answer
B
Chaos engineering
C
Virtual Patching
D
Root Cause Analysis
QUESTION 72 OF 73
Cross-site scripting attacks can be minimized by using HTML and URL Encoding. How would a browser display this string?: &lt;b&gt;Test&lt;/b&gt;
A
&lt;b&gt;Test&lt;/b&gt;
B
<<Test>>
C
<b>Test</b>Correct Answer
D
Test
QUESTION 73 OF 73
Which is the most effective means of validating user input?
A
Client-side input validation
B
Server-side input validation
C
Blacklisting
D
WhitelistingCorrect Answer
Ready to test your recall?
True or False. A security architect's job is to make sure that security considerations dominate other design aspects such as usability, resilience and cost.