CYBERSECURITY-APPRENTICE Practice Questions

The most appropriate method is to combine Layer 2 and Layer 3 segmentation. Using Virtual LANs (VLANs) creates separate broadcast domains at Layer 2, logically isolating departments on the same physical network infrastructure. Assigning a unique IP subnet to each VLAN provides Layer 3 separation. This design allows for efficient IP address allocation tailored to each department's size. Traffic between these segments (inter-VLAN traffic) must pass through a Layer 3 device, such as a router or multilayer switch, which serves as a natural and effective point to implement access control lists (ACLs) or firewall policies to control inter-department communication.

A. A flat network does not provide segmentation. All devices are in the same broadcast domain, which is inefficient and insecure for a medium-sized enterprise, regardless of ACL implementation.

C. A single large subnet is a flat network that fails to achieve segmentation. Relying solely on firewalls in this topology is impractical and does not address broadcast traffic issues.

D. Implementing IP subnets without VLANs is not feasible on a modern switched network. Without VLANs, there is no Layer 2 mechanism to separate broadcast domains on shared physical switches.

1. Official Vendor Documentation:

Cisco. (n.d.). Configure InterVLAN Routing on Layer 3 Switches. Cisco Press. In the introduction, it states, "VLANs are used to segment switched networks for a variety of reasons... By default, hosts in one VLAN cannot communicate with hosts in another VLAN. To allow communication between VLANs, you need a device that can perform routing functions... Each VLAN is a unique broadcast domain. This means that a VLAN corresponds to a unique IP subnet." This directly supports the combination of VLANs and unique subnets for segmentation and controlled communication.

2. University Courseware:

Dordal, P. L. (2019). An Introduction to Computer Networks (2nd ed.). Loyola University Chicago, Department of Computer Science. Chapter 10.4, "VLANs," explains: "The standard mechanism for supporting VLANs is IEEE 802.1Q... A common arrangement is to have one IP subnet per VLAN; a host’s VLAN membership is then determined by its IP address." This highlights the standard practice of mapping one subnet to one VLAN.

3. Peer-reviewed Academic Publications / Standards:

National Institute of Standards and Technology (NIST). (2020). NIST Special Publication 1800-25: Data Integrity: Identifying and Protecting Assets Against Ransomware and Other Destructive Events. Section 3.4.1, "Network Segmentation," recommends: "Segment the network to prevent the spread of ransomware... Network segmentation can be accomplished through the use of virtual local area networks (VLANs), subnets, and firewalls." This source validates that VLANs and subnets are foundational technologies for achieving network segmentation.

The primary and most significant difference between static and dynamic routing is adaptability. Dynamic routing protocols, such as Routing Information Protocol (RIP) and Open Shortest Path First (OSPF), are designed to automatically learn the network topology and exchange routing information with other routers. When a network change occurs, such as a link failure or the addition of a new network segment, these protocols automatically recalculate paths and update their routing tables without manual intervention. This ensures network traffic is rerouted efficiently, enhancing network resilience and reducing administrative overhead in complex or changing environments. Static routing, in contrast, requires manual configuration for every route, which does not adapt to network changes.

A. Static routing requires more, not less, administrative effort for any network change or growth, as each route must be manually configured and updated.

C. Static routing is poorly suited for large, complex networks due to its lack of scalability and the immense administrative burden of manual configuration.

D. This statement is factually incorrect. RIP and OSPF are quintessential examples of dynamic routing protocols, not static routing methods.

1. Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 5, Section 5.2, "Routing Algorithms," the text explicitly contrasts static and dynamic routing, stating, "With dynamic routing algorithms, the routes change as the network traffic or topology changes," which directly supports the adaptability described in the correct answer.

2. Cisco. (2023). IP Routing: Static and Dynamic Routing. Cisco Networking Academy. In the section "Comparing Static and Dynamic Routing," the documentation highlights, "Dynamic routing protocols... can dynamically adjust to logical network topology changes." This confirms that automatic adjustment is a key feature of dynamic routing.

3. Dordal, P. L. (2019). An Introduction to Computer Networks (2nd ed.). Loyola University Chicago, Department of Computer Science. In Chapter 10, "Routing-Update Algorithms," Section 10.1 "Distance-Vector Routing-Update Algorithm," it is explained that dynamic protocols like distance-vector "allow routers to adapt to link failures." This contrasts with static routing, which is described as non-adaptive.

This statement accurately describes the functional correspondence between the TCP/IP and OSI models. The TCP/IP model's Internet layer is directly comparable to the OSI model's Network layer. Both layers are fundamentally responsible for logical host addressing (e.g., using IP addresses) and determining the best path for routing packets from a source to a destination across multiple networks. While the models differ in their structure and terminology (e.g., "Internet layer" vs. "Network layer"), the core functions described—addressing and routing—are correctly attributed to their respective layers in this option. The other options contain factual inaccuracies regarding the functions of the specified layers.

A. Error detection is primarily a function of the OSI model's Data Link and Transport layers, not the Physical layer, which deals with the raw bitstream transmission.

B. In the OSI model, encryption and decryption are functions of the Presentation layer (Layer 6), not the Session layer (Layer 5).

D. Packet sequencing is a key function of the connection-oriented protocol TCP, which operates at the Transport layer of the TCP/IP model, not the Application layer.

1. Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 1, Section 1.5, "The Internet Protocol Stack," the text explicitly maps the OSI Network Layer to the TCP/IP Internet Layer, stating both are responsible for "routing of datagrams from source to destination." This supports the functions described in option C. The text also assigns sequencing to the Transport Layer (refuting D) and encryption to the Presentation Layer (refuting B).

2. Stallings, W. (2017). Data and Computer Communications (10th ed.). Pearson. In Chapter 2, Section 2.2, "The OSI Model," and Section 2.3, "The TCP/IP Protocol Suite," the author compares the two models. The text confirms that the OSI Network Layer and the TCP/IP Internet Layer both provide the service of routing packets across networks and handling logical addressing.

3. Tanenbaum, A. S., & Wetherall, D. J. (2011). Computer Networks (5th ed.). Prentice Hall. Chapter 1, Section 1.4.3, "The TCP/IP Reference Model," describes the Internet Layer's main function as handling routing. Section 1.4.1, "The OSI Reference Model," describes the Network Layer's key function as determining how packets are routed from source to destination. This directly validates the claims in option C.

4. IETF RFC 1122, Requirements for Internet Hosts -- Communication Layers, October 1989. Section 1.3.3, "INTERNET LAYER -- IP," states, "The internet layer handles the routing of packets for the transport layer." This official document confirms the function of the TCP/IP Internet layer.

A false positive, in the context of security monitoring, is an alert that incorrectly indicates the presence of a threat. This occurs when a security system, such as an Intrusion Detection System (IDS) or a Security Information and Event Management (SIEM) tool, misinterprets a harmless or legitimate event as malicious. Both "legitimate user actions" (A) and "benign activity" (B) accurately describe the nature of the event that triggers the false alarm. These alerts require investigation to confirm their benign nature, and frequent false positives can lead to alert fatigue among security analysts.

C. This describes a true positive, where a malicious event is correctly identified and flagged by the security system.

D. This is incorrect because an alert requires investigation to be classified as a false positive; it cannot be assumed that no action is needed beforehand.

E. This describes a false negative, which is the failure of a security system to detect and alert on actual malicious activity.

1. National Institute of Standards and Technology (NIST), Special Publication 800-94, Guide to Intrusion Detection and Prevention Systems (IDPS), February 2007.

Section 3.2.1, Accuracy: "False positives are alerts that are not indicative of actual attacks. They are also known as false alarms. A high false positive rate causes a great deal of wasted time and effort." This supports the idea that benign activity is incorrectly flagged.

2. Garcia-Teodoro, P., Diaz-Verdejo, J., Maciá-Fernández, G., & Vázquez, E. (2009). Anomaly-based network intrusion detection: Techniques, systems and challenges. Computers & Security, 28(1-2), 18-28.

Section 2.1, Detection models: "False Positive (FP): a legitimate action is considered as anomalous and an alarm is generated." This directly supports option A, where legitimate actions are flagged. (https://doi.org/10.1016/j.cose.2008.08.003)

3. University of California, Berkeley, CS 161: Computer Security, Fall 2020 Lecture Slides.

Lecture 15: Network Intrusion Detection, Slide 19: Defines a False Positive as "Alarm, but no attack." This aligns with an alert being triggered by a benign (non-attack) activity, as stated in option B.

The Domain Name System (DNS) is a hierarchical and distributed naming system for computers, services, or other resources connected to the Internet or a private network. Its primary function is to translate human-readable domain names (e.g., www.example.com) into the numerical IP addresses (e.g., 93.184.216.34) needed for locating and identifying computer services and devices. The scenario describes a classic DNS failure: name resolution is not working, but direct IP-based communication is successful. Therefore, the domain-to-IP address resolution function of DNS is the most relevant aspect to investigate and resolve the issue.

A. The Dynamic Host Configuration Protocol (DHCP), not DNS, is responsible for dynamically assigning IP addresses to devices on a network.

B. Encryption for web traffic is managed by protocols like Transport Layer Security (TLS), often implemented as HTTPS, not by the core DNS resolution function.

D. The Address Resolution Protocol (ARP) is used on a local network to convert IP addresses to physical MAC addresses, a different function from DNS.

1. Kurose, J. F., & Ross, K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. In Chapter 2, Section 2.5, "The Domain Name System," the text states, "The main function of the DNS is to translate hostnames to IP addresses."

2. Mockapetris, P. (1987). RFC 1034: Domain Names - Concepts and Facilities. Internet Engineering Task Force (IETF). Section 2.1, "Name space specifications and terminology," describes the primary goal of the domain system is to provide a consistent name space for referring to resources, which includes the mapping of names to addresses.

3. Saltzer, J. H. (2018). 6.033 Computer System Engineering, Spring 2018 Lecture Notes, Lecture 16: Naming. Massachusetts Institute of Technology: MIT OpenCourseWare. Section 16.2, "Domain Name System (DNS)," explains that DNS's purpose is to map human-readable names to IP addresses, noting it is "the Internet's phone book."

The Weaponization stage of the Cyber Kill Chain model is dedicated to creating the malicious tool to be used in the attack. This involves coupling an exploit, which takes advantage of a specific vulnerability, with a payload (e.g., a remote access trojan or backdoor). The outcome is a "weaponized" artifact, such as a malicious PDF or a Microsoft Office document with a harmful macro, that is prepared for the Delivery stage. This phase is purely about the adversary crafting and preparing their attack tool, not gathering information, delivering it, or executing the exploit on the target system.

A. Reconnaissance: This is the initial information-gathering phase where the adversary researches and selects targets, not the creation of a payload.

B. Exploitation: This stage occurs after delivery and involves the weaponized code being triggered to exploit the vulnerability on the target system.

C. Delivery: This is the transmission of the already-created weapon to the target, for example, via a phishing email or a compromised website.

1. Hutchins, E. M., Cloppert, M. J., & Amin, R. M. (2011). Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains. Lockheed Martin Corporation. In Section 3.2, "Weaponization," the authors state, "Weaponization is the first stage where an adversary creates a malicious payload to send to a victim." (Page 6).

2. University of Maryland Global Campus (UMGC). (n.d.). CMIT 424: The Cyber Kill Chain. Courseware. The course material defines Weaponization as: "Coupling an exploit and a backdoor into a deliverable payload. Adversaries must craft a payload that will exploit the vulnerability they discovered during reconnaissance."

3. SANS Institute. (2021). The SANS Survey of Cyber Threat Intelligence (CTI) Practice. In various SANS courseware and publications, the Cyber Kill Chain is a foundational concept. The Weaponization phase is consistently described as the process of creating a malicious payload and combining it with an exploit. For example, in the FOR578: Cyber Threat Intelligence course.

4. Dadfarnia, S. M. H., et al. (2021). A survey on cyber kill chain-based taxonomy of crypto-jacking. Journal of Information Security and Applications, 61, 102935. https://doi.org/10.1016/j.jisa.2021.102935. In Section 2, Table 1, the paper describes the Weaponization stage as: "Creating a malicious payload, by coupling an exploit with a backdoor into a deliverable payload."

Under the shared responsibility model, the cloud provider is responsible for the security of the cloud (e.g., physical hardware, data center security), while the customer is responsible for security in the cloud. This includes managing their data, applications, and access controls.

Managing identity and access policies (C) is a fundamental customer responsibility, as the organization must control who has access to its cloud resources and data. Similarly, configuring network security controls like firewalls for virtual machines (D) is a key task for the customer to protect their workloads from unauthorized network traffic. Both fall squarely within the customer's domain of control and responsibility in IaaS and PaaS environments.

A. Maintaining the underlying hardware of the cloud infrastructure is the cloud provider's responsibility. The customer consumes the hardware as a service and has no physical access or maintenance duties.

B. Ensuring the physical security of the cloud provider's data centers is a core responsibility of the cloud provider, who owns and operates the facilities.

1. Amazon Web Services (AWS). "AWS Shared Responsibility Model." AWS Documentation. Accessed 2023. In its model diagram, AWS clearly places "Identity & Access Management" and "Network & Firewall Configuration" under the customer's responsibility for IaaS services like EC2.

2. Microsoft Azure. "Shared responsibility in the cloud." Microsoft Learn Documentation, September 20, 2023. The documentation shows that for IaaS, the customer is responsible for "Identity & directory infrastructure" and "Network controls." This confirms that both managing access and configuring firewalls are customer duties.

3. Saltzer, J. H., & Schroeder, M. D. "The Protection of Information in Computer Systems." Proceedings of the IEEE, vol. 63, no. 9, pp. 1278-1308, Sept. 1975, doi:10.1109/PROC.1975.9939. While a foundational text, its principles are applied in the cloud model. The principle of least privilege, which governs identity and access management (Option C), is a user-managed control. The configuration of network perimeters (firewalls, Option D) is also a user-level responsibility for their specific environment.

4. Massachusetts Institute of Technology (MIT). "6.857 Computer and Network Security, Lecture 20: Cloud Security." MIT OpenCourseWare, Spring 2017. The lecture notes discuss the shared responsibility model, highlighting that the cloud customer is responsible for configuring access control, network security (like firewall rules), and securing their applications and data deployed in the cloud.

The primary goal of the "Detect" function within a security operations framework, such as the NIST Cybersecurity Framework (CSF), is to enable the timely discovery of cybersecurity events. This is achieved through continuous monitoring and analysis of systems, assets, and network traffic. Analyzing network traffic in real-time for potential indicators of compromise (IoCs) is a core activity of this function. It allows an organization to identify anomalies and malicious activities as they happen, which is fundamental to initiating an effective incident response.

A. This describes activities of the "Protect" function, which focuses on implementing safeguards to prevent security incidents.

C. This aligns with the "Identify" function (asset management) and the "Protect" function (access control policies).

D. This is a core component of the "Recover" function, which focuses on restoring capabilities after an incident has occurred.

1. National Institute of Standards and Technology (NIST). (2024). The NIST Cybersecurity Framework (CSF) 2.0. NIST Cybersecurity White Paper (CSWP) 29. Page 10, Section "The CSF Core".

The document defines the Detect (DE) function as: "Find and analyze possible cybersecurity attacks and compromises." One of its core categories is "Continuous Monitoring (DE.CM)," which involves analyzing data from various sources to detect cybersecurity events and verify the effectiveness of protective measures. This directly supports the real-time analysis described in the correct answer.

2. University of Washington. (n.d.). The NIST Cybersecurity Framework. Center for Information Assurance and Cybersecurity (CIAC). Module: "The Framework Core".

This university courseware explains that the Detect function's purpose is to "develop and implement the appropriate activities to identify the occurrence of a cybersecurity event." It explicitly lists "Security Continuous Monitoring" and "Detection Processes" as key categories, reinforcing that active analysis to find events is the central goal.

3. Badger, L., Grance, T., Patt-Corner, R., & Voas, J. (2014). Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0. National Institute of Standards and Technology. Page 8, Section 2.1 "Framework Core".

The original NIST CSF document states the Detect function enables "timely discovery of cybersecurity events." It includes the category "Anomalies and Events (DE.AE): Anomalous activity is detected in a timely manner and the potential impact of events is understood." This directly relates to analyzing traffic for IoCs.

An end device's operating system uses the subnet mask to perform a critical calculation: it determines whether a destination IP address is on the local network or a remote network. It does this by comparing the network portion of its own address with the network portion of the destination address. If the subnet mask is misconfigured to be more restrictive than it should be (e.g., 255.255.255.240 or /28 instead of the correct 255.255.255.0 or /24), the device will incorrectly conclude that other devices on the same physical segment are on a different, remote network. Consequently, instead of sending an ARP request to find the destination's MAC address for direct communication, it will forward the packet to its configured default gateway for routing.

A. Incorrect DNS server configurations would affect the resolution of domain names to IP addresses, but not the IP routing logic for traffic between two known IP addresses.

B. A switch operating at Layer 3 functions as a router. However, it does not force devices on the same subnet/VLAN to route through it; the end devices themselves must decide to send traffic there.

C. A default gateway is a passive device in the routing process; it only forwards packets that are explicitly sent to it. It cannot "override" or intercept traffic between two hosts on the same local network.

1. Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Section 4.4.1, "The Forwarding Table," the text describes how a host's forwarding logic determines where to send a packet. A host's forwarding table typically has a rule for its directly attached network and a default route. A misconfigured subnet mask causes the host to fail the check for the directly attached network, forcing it to use the default route (the default gateway).

2. Stallings, W. (2014). Data and Computer Communications (10th ed.). Pearson. Chapter 18, "Internet Protocol," in the section on "IP Addresses," explains that the subnet mask is used to extract the network ID from an IP address. The host uses this to determine if a destination is on its own network. An incorrect mask leads to an incorrect network ID calculation, causing the host to forward the packet to a router.

3. Odom, W. (2013). Cisco CCENT/CCNA ICND1 100-101 Official Cert Guide. Cisco Press. Chapter 16, "Fundamentals of IP Addressing and Routing," details the IP routing process for a host. It explicitly states that the host performs a logical comparison using its own IP/mask and the destination IP/mask. If the resulting network IDs do not match, the packet is sent to the default gateway. This process is fundamentally dependent on a correctly configured subnet mask.

An effective cybersecurity awareness program relies on continuous reinforcement to be successful. Sending monthly newsletters is a method of ongoing communication that keeps security top-of-mind for employees. This approach provides timely updates on new threats, reinforces best practices, and offers actionable prevention tips relevant to current events. Unlike a one-time event, this sustained engagement helps to build a lasting security-conscious culture. Regular, digestible updates are more effective at influencing long-term user behavior than infrequent, intensive training sessions or impractical memorization tasks.

A. One-time training is ineffective because knowledge retention declines over time, and it fails to address the constantly evolving threat landscape.

C. Memorizing specific malware names is impractical and does not teach the underlying principles needed to recognize and avoid various types of threats.

D. Training without deadlines lacks the necessary structure and accountability, leading to procrastination and low completion rates, thus undermining the program's effectiveness.

1. National Institute of Standards and Technology (NIST) Special Publication 800-50, Building an Information Technology Security Awareness and Training Program. Section 4.3, "Awareness," explicitly states that awareness is a continuous process and suggests using tools like "newsletters, posters, and logon screen messages" to reinforce security principles. This supports the idea of regular communication over one-time events.

2. Wilson, M., & Hash, J. (2003). Building an Information Technology Security Awareness and Training Program (NIST SP 800-50). National Institute of Standards and Technology. Page 13, Section 4.3 discusses using various methods for reinforcement, stating, "Awareness is not a one-time event; it needs to be reinforced."

3. University of California, Berkeley, Information Security Office. Security Awareness & Training. The university's official guidance emphasizes that "Security awareness is a continuous process." It outlines a program that includes ongoing activities like newsletters and phishing simulations, directly contrasting with the ineffectiveness of a single, initial training session.

4. Al-Shehri, S., & Al-Alawi, A. (2018). The Impact of Information Security Awareness on Employees’ Behavior: A Case Study of a University in Saudi Arabia. International Journal of Computer Science and Network Security, 18(1), 1-10. This study highlights that "continuous awareness programs are more effective than one-time training sessions" (p. 8) in changing employee behavior and fostering a security-positive culture.