Security practice questions

Answer: A) NIST SP 800-88

NIST SP 800-88 is the media sanitization guideline that defines the clear, purge, and destroy methods. Organizations such as Microsoft use it so they can show that drives holding sensitive data were disposed of properly.

• ANIST SP 800-88 is NIST's guideline for media sanitization. It is the source of the clear, purge, and destroy categories. Microsoft, for example, states that its datacenters follow the NIST SP 800-88 clear and purge guidelines and destroy devices with procedures that meet SP 800-88.
• BNIST SP 800-63 is NIST's digital identity guideline. It covers how users are identified and authenticated, not how storage media is sanitized before disposal.
• CNIST SP 800-61 gives recommendations for responding to computer security incidents. It doesn't define clear, purge, and destroy methods for storage media.
• DISO 9001 is a quality management system standard. It doesn't define media sanitization methods such as clear, purge, or destroy.

Answer: A) Potentially unwanted program

Software that comes with a legitimate utility and adds ads or changes browser settings, without being classed as malware, is a potentially unwanted program (PUP/PUA). Ransomware, rootkits, and worms are all malware with clearly malicious behavior that this program doesn't show.

• ACorrect. A PUP (Microsoft calls it a PUA) is not classed as malware, but it does things the user likely didn't want, such as showing ads, injecting ads into web pages, changing browser settings, or installing bundled software. Antivirus tools can detect, block, and quarantine PUPs separately from malware.
• BIncorrect. Ransomware is malware that encrypts files or locks the device and then demands payment. The scenario says no files are encrypted and nothing is held for ransom.
• CIncorrect. A rootkit is malware that hides deep in the operating system to conceal itself and keep privileged access. This program doesn't hide from the OS, and it's flagged as unwanted rather than malicious.
• DIncorrect. A worm is malware that spreads on its own to other devices over networks, shares, or removable media. The scenario says the program doesn't spread.

Answer: A) Allow installs only from official vendor sites or the Microsoft Store, keep browsers updated, and train users to decline bundled offers in installers

Browser hijackers usually arrive bundled with other software. Limiting installs to official sources, keeping browsers patched and teaching users to decline bundled offers prevents infection, while scans, resets and restore points only clean up afterward.

• ACorrect. Microsoft explains that unwanted software, including browser modifiers, often comes bundled with other downloaded apps. It recommends downloading only from official websites or the Microsoft Store. Keeping browsers updated and teaching users to uncheck bundled extras in installers block the main ways hijackers get onto a system.
• BIncorrect. These steps find or undo a hijacker after it is already installed. They are cleanup, not measures that stop the infection from happening.
• CIncorrect. These are privacy settings. They do nothing to stop a bundled installer from adding an extension or changing the homepage and search settings.
• DIncorrect. Rolling back to a restore point is a recovery step after the hijacker has already made changes. It does not stop the hijacker from being installed.

Answer: A) A clean desk policy

• AA clean desk policy requires sensitive materials — printed documents, written-down passwords, unlocked devices — to be secured or put away when an employee isn't actively at their desk, reducing the risk of exposure to anyone who might pass by unattended, whether a coworker, a visitor, or after-hours cleaning staff.
• BAn AUP governs how employees may use company IT resources broadly; a clean desk policy is a distinct, more specific physical-security practice.
• CAn SLA defines measurable service commitments, unrelated to physical desk/workspace security practices.
• DA chain of custody form documents evidence handling for an investigation, unrelated to a daily desk-security policy.

Answer: A) Keylogger

Malware that silently records typed input such as usernames and passwords and sends it to an attacker is a keylogger. Ransomware extorts, worms self-propagate and adware shows ads.

• ACorrect. A keylogger captures what the user types on the keyboard, such as credentials, and sends the captured data to the attacker. Microsoft describes a key logger as collecting and sending information about the keys you press.
• BIncorrect. Ransomware encrypts files or otherwise blocks use of the device, then demands payment. Its goal is extortion, not secretly logging what the user types.
• CIncorrect. A worm is defined by spreading itself to other devices, for example through network shares, email or removable drives. Recording typed input is not what makes something a worm.
• DIncorrect. Adware displays unwanted advertisements or promotions. It does not record keyboard input to steal credentials.

Answer: A) Access control vestibule (mantrap)

An access control vestibule (formerly called a mantrap) uses interlocking doors to let one authenticated person through at a time, which physically prevents tailgating. Bollards, single-door badge readers and cameras protect the perimeter, authenticate one person, or only detect tailgating.

• ACorrect. An access control vestibule, once called a mantrap, is a small enclosure with two interlocking doors. The inner door opens only after the outer door closes and the person is authenticated, which physically stops a second person from following them in.
• BIncorrect. Bollards are sturdy posts that protect a building's exterior, mainly from vehicles. They do not authenticate people or stop someone from following an authorized person through a door.
• CIncorrect. A badge reader authenticates the person who swipes, but once the door is open, someone else can walk in behind them. A single door cannot hold people between two interlocked doors.
• DIncorrect. Cameras can detect and record tailgating, which makes them a detective control. They do not physically stop an unauthorized person from entering.

Answer: A) Vishing

A phishing attempt made over a live or automated phone call, often with a spoofed caller ID that impersonates a bank, is vishing. Smishing uses text messages, and whaling and spear phishing describe who is targeted, not the channel.

• ACorrect. Vishing uses live or automated phone calls. The attacker often pretends to be a bank, tech support or a government office and pressures the victim into giving up account numbers or reset codes. A spoofed caller ID makes the call look legitimate.
• BIncorrect. Smishing uses fraudulent text messages to lure victims to fake websites or to a spoofed phone number. In this scenario the attacker called the employees and pressured them during the call.
• CIncorrect. Whaling targets executives or other 'big fish.' Here the targets are front-desk staff, and the deciding factor is that the attack happens over a phone call.
• DIncorrect. Spear phishing is highly targeted: the attacker researches a specific person or small group and refers to real projects or colleagues. These calls use a generic bank pretext against several staff, and the attack happens by phone.

Answer: A) It provides an audit trail of who was on site and when, which supports accountability and investigations

A visitor log is a detective, record-keeping control: it creates an audit trail of who was on site and when. Physical security still relies on other layers, such as badges, escorts, and entry barriers.

• ACorrect. A visitor log records who was present and at what times. This supports accountability and gives investigators a starting point if an incident or theft is discovered later.
• BIncorrect. A log records presence; it does not authenticate anyone or grant access. Badges and escort requirements are separate controls that decide where a visitor may go.
• CIncorrect. A log is a record, not a barrier. Controls such as access control vestibules, turnstiles, or guards are used to physically stop tailgating.
• DIncorrect. A sign-in log only captures what the visitor writes down. Checking ID is a separate step, and visitors are not employees, so they would not be in an employee database.

Answer: A) Endpoint detection and response (EDR)

EDR collects behavioral telemetry from endpoints, raises alerts, and lets analysts investigate and contain threats such as by isolating a device. XDR extends this across identities, email, and apps, and MDR outsources the analyst work to a provider.

• ACorrect. EDR continuously collects behavioral telemetry from endpoints, creates alerts and incidents, and gives analysts response actions such as isolating a device. In this scenario, the company's own team runs it and the scope is limited to endpoints.
• BIncorrect. XDR correlates detections across several domains, including endpoints, identities, email, and cloud apps, into combined incidents. This scenario covers endpoints only, which is EDR.
• CIncorrect. MDR is a service in which an outside provider's analysts monitor, triage, and investigate incidents for the customer. In this scenario, the company's own analysts do that work.
• DIncorrect. Traditional antivirus compares files against known malware signatures. It doesn't record behavioral telemetry or give analysts investigation and isolation tools from a central console.

Answer: A) It shortens how long publicly disclosed flaws stay exploitable on company devices

Timely, verified patching mainly reduces the window in which known, already-fixed vulnerabilities can be exploited on unpatched devices. It doesn't stop zero-days, and it doesn't replace anti-malware or access controls.

• ACorrect. Once a vendor releases a fix, the flaw is publicly known, and attackers target devices that haven't installed it yet. Enforcing a short deadline and verifying installs shrinks that window of exposure.
• BIncorrect. A zero-day has no official patch yet, so a patching policy can't fix it. Until a patch ships, the only options are workarounds and other controls.
• CIncorrect. Updates fix flaws in code, but they don't scan for or quarantine malware. Anti-malware is a separate control that works alongside patching.
• DIncorrect. Least privilege is enforced through account and permission management, not by installing vendor security updates.