✅ Correct Answer: B

The message uses intimidation (threatening account lockout — a negative consequence) and urgency (the 30-minute deadline pressures the target to act quickly without verifying). While authority is partially present (the bank is a trusted entity), the primary lever is the threat + deadline combination. Scarcity (C) refers to limited availability of something, not time pressure.

✅ Correct Answer: C

The pattern of many rapid failed attempts from a single IP followed by success is characteristic of an online password attack (brute force or dictionary attack against a live authentication portal). Credential stuffing (B) uses stolen credentials and would typically show fewer attempts. A rainbow table attack (D) is an offline attack against a captured hash database, not a live login portal. Social engineering (A) does not produce this log pattern.

✅ Correct Answer: A

War driving is when adversaries drive or walk around a target area to detect wireless network beacons, gathering information about SSIDs, encryption types, and areas where the signal extends beyond the physical building. This is a reconnaissance activity, not an active attack. An evil twin (B) involves setting up a fake access point. Jamming (C) involves disrupting signals. ARP poisoning (D) targets internal network tables, not wireless signals.

✅ Correct Answer: D

The adversary is using a generative AI tool (LLM) to create phishing messages in a language they may not speak natively. The course framework specifically notes that AI allows adversaries to craft phishing messages in any language that read as though written by a native speaker, eliminating the traditional indicator of unnatural language in phishing emails. The scenario does not involve voice cloning (A), malware development (B), or social media reconnaissance (C).

✅ Correct Answer: B

The course framework repeatedly emphasizes that AI recommendations should always be reviewed by a knowledgeable human before being implemented. This applies to code vulnerability fixes, firewall rule suggestions, and detection rules. AI should never automatically deploy changes (A). Running the tool again (C) does not substitute for human review. Ignoring AI entirely (D) wastes a valuable defensive tool.

✅ Correct Answer: D

Statement I is correct: low-skilled adversaries rely on tools created by others that exploit known vulnerabilities. Statement II is correct: high-skilled adversaries can create new tools, modify existing ones, and discover zero-day vulnerabilities. Statement III is incorrect: adversaries have a variety of motivations including greed, desire for recognition, dedication to a cause, revenge, politics, and beliefs.

✅ Correct Answer: A

The scenario describes a likely deepfake video call using AI-generated voice and image. A shared secret (A) is the most direct defense — a phrase known only to the real CEO and trusted employees that verifies identity in high-stakes situations. MFA (B) protects account login but does not verify the identity of someone already on a call. Anti-malware (C) does not detect deepfakes on the caller’s end. Option D is a general AI safety practice unrelated to this specific attack.

✅ Correct Answer: C

The adversary uses pretexting (creating a believable story about troubleshooting a server issue) combined with authority (impersonating someone from the IT department, a position of power over technical matters). No time deadline is given (not urgency). The adversary does not claim others have complied (not consensus). Familiarity would require pretending to be a personal acquaintance, not just someone from a department.

✅ Correct Answer: A

The reconnaissance phase is when adversaries gather as much information as possible about their target, often using OSINT (freely available information from websites, social media, and public records). This happens before any active attack. Initial access (B) is establishing a foothold. Lateral movement (C) happens after access is gained. Evading detection (D) is the final phase.

✅ Correct Answer: B

Insider adversaries are unique threats because they already have legitimate credentials and access. This former employee used credentials that were never revoked — legitimate access that should have been removed. The motivation (revenge after termination, plus financial gain from selling data) aligns with typical insider threat motivations. Script kiddies (A) lack the insider access described. Nothing indicates a social cause (C) or critical infrastructure disruption (D).

✅ Correct Answer: D

When the cost of mitigation significantly exceeds the expected loss from an attack, risk acceptance is appropriate. The framework states that organizations favor solutions that are cost-effective — costing less to install and maintain than the expected loss. Since this vulnerability has low severity and mitigation is too expensive, accepting the residual risk is the most rational strategy.

✅ Correct Answer: A

The CIA triad consists of three complementary principles that together form the foundation of information security. Confidentiality ensures only authorized access, integrity ensures data accuracy, and availability ensures access when needed. A defense-in-depth strategy addresses all three. They are not ranked (B) — the priority depends on context. They are not mutually exclusive (C). They apply to both digital and physical security (D).

✅ Correct Answer: C

This is tailgating because the adversary follows closely behind without the employee’s knowledge. (If the employee knowingly held the door, it would be piggybacking.) An access control vestibule (also called a mantrap) physically prevents more than one person from passing through at a time, directly stopping tailgating. Training (A) helps but is less reliable than a physical control. Shoulder surfing (B) involves watching someone enter credentials. Card cloning (D) addresses a different attack vector.

✅ Correct Answer: B

A security policy is a managerial control — it is a set of rules, guidelines, and procedures that specify what security measures should be in place. While the policy mentions physical items (surge protectors) and technical actions (locking computers), the policy itself is managerial. The individual items it mandates may be physical or technical controls, but the document that requires them is managerial.

✅ Correct Answer: D

Motion sensors should be placed in areas where traffic is unexpected, like server rooms or areas with restricted access. In high-traffic areas (lobbies, cafeterias, offices), motion sensors create many false alarms, which leads to alert fatigue — responders become accustomed to false alerts and take them less seriously. Server rooms (D) have minimal legitimate traffic, so any motion detected is genuinely suspicious.

✅ Correct Answer: C

This assessment uses both quantitative and qualitative methods. The quantitative elements include the dollar amounts ($2.4M asset value, $800K estimated loss) and the numeric rating (9/10). The qualitative element is the descriptive term “High” for likelihood. In practice, organizations often combine both approaches for a more complete risk picture.

✅ Correct Answer: B

ARP poisoning sends falsified ARP packets to the default gateway, modifying its ARP table to link the target’s IP address with the adversary’s MAC address. This redirects traffic through the adversary, creating an on-path (man-in-the-middle) attack. MAC flooding (A) targets switch MAC tables with many different addresses. DNS poisoning (C) targets DNS records. A smurf attack (D) uses ICMP broadcasts.

✅ Correct Answer: D

A next-generation firewall (NGFW) has all capabilities of stateless and stateful firewalls plus advanced features including intrusion prevention, deep packet inspection, and filtering by application type. A stateless firewall (A) only filters by packet headers. A stateful firewall (B) adds connection tracking but not deep packet inspection or application filtering. The combination in (C) does not provide application-level filtering.

✅ Correct Answer: A

ACL rules are checked in order, and the first matching rule executes. Rule 1 allows HTTPS (443) from anywhere. Rule 2 allows SSH (22) only from 10.0.0.0/8. Rule 3 denies everything else. Rules do not override each other (B) — they execute sequentially. The 10.0.0.0/8 subnet (C) covers 10.0.0.0–10.255.255.255, not all addresses. ACL rule sets do not create conflicts (D) — the order resolves all ambiguity.

✅ Correct Answer: C

A screened subnet (DMZ) sits between the public internet and the internal network, typically protected by firewalls on both sides. It holds publicly-facing resources (like web servers) to keep them separated from sensitive internal systems. VLANs (A) logically separate devices on switches but don’t describe this specific two-firewall architecture. A VPN (B) provides encrypted remote access. Port security (D) limits MAC addresses per port.

✅ Correct Answer: D

Alert fatigue occurs when responders become accustomed to false positives and begin taking alerts less seriously, assuming they are false before investigating. This is a critical risk because real attacks hidden among the false alerts may go uninvestigated. A false negative (A) is when detection misses an attack — here the system is detecting too much, not too little.

✅ Correct Answer: A

Signature-based detection is preferred here for two reasons: (1) it is more efficient for high-volume traffic because it runs faster than anomaly-based methods, and (2) anomaly-based detection requires consistent traffic patterns to establish a reliable baseline. With inconsistent seasonal patterns, anomaly detection would produce excessive false positives, as normal business fluctuations would appear anomalous.

✅ Correct Answer: B

MAC flooding overwhelms a switch’s MAC address table, forcing the switch into broadcast mode. In broadcast mode, all frames are sent to every port, allowing the adversary to eavesdrop (sniff) all network traffic. This is distinct from ARP poisoning (A, which modifies gateway ARP tables), a smurf/DDoS attack (C, which uses ICMP), and DNS poisoning (D, which targets DNS records).

✅ Correct Answer: C

Beacon frames broadcast a network’s SSID and basic properties (like encryption protocols). Disabling beacon frame broadcasting makes it harder for adversaries to discover that the network exists and learn its basic properties — they would need to use more advanced techniques to detect the network. It does not affect encryption strength (A), DoS attacks (B), or authentication attacks (D).

✅ Correct Answer: D

A rogue access point is created when an adversary plugs an unauthorized wireless access point into an open network port, gaining direct access to the internal LAN and potentially allowing wireless access from outside the physical space. While similar to an evil twin (A), the distinction is that a rogue AP is physically connected to the internal network, bypassing firewalls entirely. An evil twin mimics a legitimate network’s SSID but is not connected to the target’s infrastructure.

✅ Correct Answer: B

A jamming attack floods a specific area with strong electromagnetic signals in the same frequency range as the wireless network, preventing legitimate traffic between the access point and users. The localized nature (only the east wing) and the detection of EM noise in the wireless range are the definitive indicators. An evil twin (A) would allow connections to a fake network, not prevent all connections. DNS poisoning (C) and ARP poisoning (D) do not affect wireless signal strength.

✅ Correct Answer: D

IoT (Internet of Things) devices are everyday devices with embedded computers. The sensors have minimal processing power and storage, specialized instruction sets, and are connected to the internet — all characteristics of embedded/IoT devices. They are not personal computers (A), servers (B), or handheld devices (C). IoT devices are often uniquely vulnerable because they tend to be slower, cheaper, and harder to update.

✅ Correct Answer: B

The malware was hidden inside software that appeared legitimate (a PDF converter) — the defining characteristic of a trojan. The hidden program providing remote access is a Remote Access Trojan (RAT). It is not a worm (A) because the employee actively downloaded and installed it (worms spread without human interaction). Slow performance alone does not indicate ransomware (C). A logic bomb (D) triggers on specific conditions, not immediately after installation.

✅ Correct Answer: C

Description I (spreads without human interaction) = Worm. Description II (requires user activation) = Virus. Description III (embeds in OS and hides from detection) = Rootkit. The key distinctions: viruses need user action while worms don’t, and rootkits are uniquely capable of controlling the OS and hiding themselves from detection tools.

✅ Correct Answer: A

Statement A is NOT true — cryptographic hash functions have pre-image resistance, meaning it is infeasible to determine the original input from the hash output. There is no “decryption key” for a hash because hashing is one-way, not encryption. Statements B (repeatability), C (collision possibility), and D (fixed output length) are all true properties of cryptographic hash functions.

✅ Correct Answer: D

Rainbow tables are pre-computed mappings of common passwords to their hashes. They are most effective against short, common passwords (D) because these passwords are most likely to appear in the pre-computed table. A 24-character random password (A) is extremely unlikely to be in any rainbow table. SHA-512 vs. MD5 (B) does not affect the attack — rainbow tables can be built for any algorithm. Salting (C) would defeat the attack entirely, but the scenario states passwords are NOT salted.

✅ Correct Answer: C

Fileless malware is malicious code that lives in RAM (not on disk) and uses legitimate programs already installed on the device to compromise it. The key indicators are: no unauthorized software found on disk + code running in memory + using legitimate system programs. A virus (A) would leave files on disk. Ransomware (B) would encrypt files and display a ransom demand. A keylogger (D) records keystrokes specifically, not general data exfiltration.

✅ Correct Answer: A

The policy specifically targets authentication strength — longer passwords with distributed special characters resist brute force and dictionary attacks, while MFA adds an additional layer. This directly addresses the vulnerability of weak authentication being exploited by automated password attacks. The policy does not address software patching (B), open ports (C), or anti-malware (D).

✅ Correct Answer: B

Password spraying is when an adversary attempts a common password against many different user accounts. This differs from brute force (A, which tests all possible combinations against one account), a dictionary attack (C, which tests many common passwords against one account), and credential stuffing (D, which uses previously stolen username/password pairs).

✅ Correct Answer: A

The combined approach exists because asymmetric encryption is significantly slower than symmetric encryption. It is computationally expensive for large amounts of data. By using asymmetric encryption only for the small key exchange (solving the key distribution problem) and then switching to the faster symmetric algorithm for bulk data, systems get the best of both approaches. Option D reverses the key-sharing properties — symmetric requires a shared key, asymmetric does not.

✅ Correct Answer: C

Because hash functions are repeatable (same input = same output), computing the SHA-256 hash of the downloaded file and comparing it to the vendor’s published hash verifies data integrity. If the hashes match, the file has not been modified. Hashing is not encryption (A), so there is no decryption step. AES encryption (B) is unrelated to integrity verification. While AI (D) could help, the standard and most direct method is hash comparison.

✅ Correct Answer: B

Input validation (I) checks that user input conforms to expected formats (rejecting unexpected characters), and input sanitization (III) removes or escapes potentially dangerous characters before they reach the database. Together, they directly prevent injection attacks by ensuring user input cannot be interpreted as commands. Database encryption (II) protects data at rest but does not prevent the application from executing malicious queries. MFA for admins (IV) controls access but does not address the application’s input handling vulnerability.

✅ Correct Answer: D

In asymmetric encryption, data encrypted with a public key can only be decrypted with the corresponding private key. Since the email was encrypted with the colleague’s public key, only the colleague’s private key can decrypt it. The public key cannot decrypt what it encrypted (B). The sender’s keys are not involved in decryption (A, C).

✅ Correct Answer: A

A digital certificate issued by a CA binds a public key to a verified identity, creating a chain of trust. When users connect to the server, they can verify (through the CA’s signature on the certificate) that the public key truly belongs to the legitimate company, not an impersonator. Certificates do not encrypt stored data (B), do not eliminate the need for symmetric encryption (C), and do not prevent DoS attacks (D).

✅ Correct Answer: C

Statement I is correct: encryption is two-way (encrypt with a key, decrypt with a key). Statement II is correct: hashing is one-way with pre-image resistance. Statement III is incorrect: AES (Advanced Encryption Standard) is a symmetric encryption algorithm, not a hashing algorithm. Hashing algorithms include SHA-256, SHA-512, and MD5. This distinction between encryption and hashing is fundamental to the course.