✅ Correct Answer: B

Authority is used because the adversary impersonates the IT department — a position of power over the employee. Urgency is created by the 2-hour deadline, pressuring the target to act quickly without verifying. Option A is wrong because scarcity refers to limited availability (not time pressure), and familiarity means pretending to be someone the target knows personally. Option C is wrong because consensus involves social pressure from peers, not a deadline. Option D is wrong because while pretexting (creating a believable story) is present, the primary combination is authority + urgency.

✅ Correct Answer: C

An evil twin attack is when an adversary sets up a wireless access point with an SSID similar to a legitimate network. The student joined an open network with a similar name to the real one — a classic evil twin. A jamming attack (A) would prevent all wireless connections, not just slow them down. War driving (B) is reconnaissance to detect networks, not an attack that affects the victim. A DoS attack (D) would make the network completely unavailable, not redirect traffic through a fake network.

✅ Correct Answer: D

The attack uses a voice clone over a phone call — it does not involve the email system at all. Enabling MFA on email (D) would protect against email-based attacks but does nothing to verify the identity of a phone caller. Options A, B, and C all directly address the voice impersonation: a shared secret (A) verifies identity through knowledge only the real person would have, secondary verification (B) contacts the executive through a different channel, and requiring written authorization (C) adds a control that cannot be bypassed by a voice call alone.

✅ Correct Answer: A

Risk assessment considers both likelihood and severity. The high classification is justified because the asset is extremely valuable (50,000 credit card records = high severity) and the physical vulnerabilities are easily exploitable (basic lock, no cameras, unmonitored hallway = high likelihood). Option B mentions technical controls that are not part of the scenario — the question describes physical vulnerabilities. Option C speculates about a specific adversary type without evidence. Option D identifies a missing control but doesn’t capture the core risk calculation (asset value × vulnerability exploitability).

✅ Correct Answer: B

This is piggybacking because the adversary used social engineering (pretending to be a delivery person with a large box) to manipulate the authorized person into knowingly granting access. The key distinction: in tailgating, the authorized person is unaware the adversary is following behind. In piggybacking, the authorized person knowingly (but mistakenly) allows the adversary access. The employee actively held the door open — that is piggybacking, not tailgating.

✅ Correct Answer: C

Statement I is correct: risk avoidance stops the risk-generating activity. Statement II is incorrect: risk transference places the burden of risk on another entity (like insurance), but it does not eliminate the vulnerability itself — the vulnerability still exists, the financial impact is simply shifted. Statement III is correct: residual risk is explicitly defined as the risk remaining after all management strategies have been applied, and it represents the level of risk an organization accepts.

✅ Correct Answer: A

ACL rules are checked in order, and the first matching rule is executed. The device at 192.168.1.15 is in the 192.168.1.0/24 subnet, so Rule 1 matches first and denies the traffic. Rule 2 is never reached for this specific source. Option D is incorrect because ACL rules are strictly sequential — more specific rules do not automatically override broader ones; only their position in the rule order matters.

✅ Correct Answer: D

Three factors point to hybrid detection: (1) the data is highly sensitive (patient records + ICU data), justifying the higher cost, (2) the concern about novel attacks means signature-based alone is insufficient (it cannot detect new attacks without known signatures), and (3) the consistent traffic patterns make anomaly-based detection effective (it works best when there is a reliable baseline). Hybrid combines both methods for the most comprehensive coverage.

✅ Correct Answer: B

A MAC flooding attack sends the target switch many Ethernet frames, each with a different MAC address, which overwhelms the switch’s MAC address table and forces it into broadcast mode. This allows the adversary to eavesdrop on all network traffic. ARP poisoning (A) modifies the ARP table on a default gateway, not a switch’s MAC table. DNS poisoning (C) targets DNS records, not switches. A smurf attack (D) uses ICMP requests, not Ethernet frames with different MAC addresses.

✅ Correct Answer: C

The malware was embedded in what appeared to be a legitimate software update — this is the defining characteristic of a trojan (malware hidden in harmless-looking software). The malware then encrypted files and demanded payment — this is ransomware. It is not a worm (A) because it required users to download and install it (worms spread without human interaction). It is not a rootkit (B) because the scenario describes file encryption, not OS-level hiding. It is not a logic bomb (D) because it executed immediately upon installation, not when specific conditions were met.

✅ Correct Answer: A

Salt is a few random bits unique to each user that are hashed together with the password. Even though both users have the same password, their different salts produce different hash outputs. Option B is wrong because organizations use the same hash algorithm for all users. Option C confuses encryption with hashing — passwords should be hashed, not encrypted. Option D is wrong because a key property of cryptographic hash functions is that they are repeatable — the same input always produces the same output. Salt changes the input, not the function’s behavior.

✅ Correct Answer: D

A rainbow table is a pre-computed table mapping passwords to their hashes. The adversary searches this table for matches against the captured hashes. Salting defeats rainbow tables because each user’s salt changes the hash input, making pre-computed tables useless — the adversary would need a separate rainbow table for every possible salt value. This is an offline attack (using a captured database), so account lockout (C) does not apply. It is not brute force (A) because the adversary is not testing every combination, and it is not a dictionary attack (B) because the adversary is using pre-computed hashes, not submitting passwords to a live system.

✅ Correct Answer: B

Asymmetric encryption solves the key distribution problem. The sender encrypts with the recipient’s public key (freely available), and only the recipient’s private key (kept secret) can decrypt it. Option A fails because AES requires a shared symmetric key that the parties have never exchanged. Option C is wrong because hashing provides integrity (verifying the document wasn’t modified), not confidentiality (hashing does not hide the document’s content). Option D provides authentication (proving the sender’s identity) but not confidentiality — anyone with the sender’s public key could decrypt it.

✅ Correct Answer: C

Statement I is incorrect: hashing is a one-way function with pre-image resistance — it cannot be reversed. There is no key involved in hashing. Statement II is correct: symmetric encryption uses a single shared key. Statement III is correct: asymmetric encryption is computationally slower than symmetric encryption, which is why real-world systems often use asymmetric encryption to exchange a symmetric key, then use the faster symmetric algorithm for the actual data.

✅ Correct Answer: A

The scenario describes an injection attack where user input is being copied directly into database queries without validation. Input validation and sanitization (A) directly prevents this by checking and cleaning user input before it reaches the database. Encryption (C) protects data at rest but does not prevent the application from executing malicious queries. An IDS (B) might detect the attack but does not prevent the underlying vulnerability. MFA (D) controls who accesses the system but does not address how the application handles user input.