Certified Cybersecurity Technician (CCT) Free Sample Questions

Network Access Control (NAC) is the correct solution. NAC systems are designed to enforce security policies on devices seeking to access network resources. They can check for compliance (e.g., updated antivirus, OS patches) and use 802.1X for port-based authentication, automatically quarantining non-compliant devices. An IPS inspects traffic for malicious activity, a proxy server mediates client requests to the internet, and a VPN provides secure remote access.

The scenario describes a classic TCP SYN flood, a type of Denial of Service (DoS) attack. The attacker sends a high volume of SYN packets, often with spoofed source IPs, to overwhelm the server's connection table (half-open connections). Since the server never receives the final ACK, it keeps resources allocated, eventually exhausting them and denying service to legitimate users. Port scanning involves probing multiple ports, not flooding one. ARP poisoning manipulates MAC-to-IP mappings locally. A smurf attack uses ICMP echo requests.

WPA3 is the latest and most secure wireless security protocol. It replaces the Pre-Shared Key (PSK) exchange in WPA2 with Simultaneous Authentication of Equals (SAE), making it resistant to offline dictionary attacks. WEP and WPA are deprecated and highly insecure. WPA2 is still common but WPA3 offers superior security features and is the correct choice for a new, secure implementation.

The value is a cryptographic hash, which serves as a digital fingerprint to verify data integrity. SHA-256 is a widely used and secure hashing algorithm for this purpose.

SHA-256 is a standard hashing algorithm used in digital forensics to create a unique hash value for evidence, ensuring its integrity throughout the investigation.

Symmetric encryption uses a single, shared key for both encryption and decryption. It is fast and efficient, making it ideal for encrypting large amounts of data at rest, such as data in a database. Asymmetric encryption uses a key pair (public and private) and is typically used for key exchange and digital signatures. Hashing is a one-way function and cannot be used for decryption. Steganography is the practice of hiding data within other data.

This practice mitigates username enumeration (or user enumeration). If an application responds differently to an invalid username ('User not found') versus an invalid password ('Incorrect password'), an attacker can use this difference to build a list of valid usernames. By providing a generic error message ('Invalid username or password') in all failure cases, the application prevents attackers from discovering valid user accounts.

This statement is false. According to the shared responsibility model for IaaS, the cloud provider is responsible for the security of the cloud (i.e., the physical infrastructure, virtualization layer). The customer is responsible for security in the cloud, which includes securing and patching the guest operating systems, applications, and data they deploy on the infrastructure.

A Threat Intelligence Platform (TIP) aggregates, correlates, and analyzes threat data from multiple sources. Modern TIPs can integrate with other security tools like firewalls and SIEMs to automate defensive actions, such as automatically creating firewall rules to block newly identified malicious IP addresses. A honeypot is a decoy system. A load balancer distributes traffic. A vulnerability scanner identifies potential weaknesses but does not typically automate firewall rule creation in this manner.

Given that the IoT devices do not support enterprise authentication, using WPA2 or WPA3-Personal with a very strong, complex preshared key is the best available encryption option. To add another layer of security, the network should be on a separate, isolated VLAN, and MAC address filtering should be enabled to only allow the specific medical devices to connect. While MAC filtering can be spoofed, it provides a deterrent and is a valid part of a defense-in-depth strategy for limited-capability devices. Disabling SSID broadcast is a weak security measure (security by obscurity). WPA3-Enterprise is not supported by the devices.

The act of isolating compromised systems is part of the Containment phase. According to the NIST incident response lifecycle (Preparation -> Detection & Analysis -> Containment -> Eradication & Recovery -> Post-Incident Activity), the phase immediately following Containment is Eradication & Recovery. This is where the analyst would remove the malware, patch vulnerabilities, and restore the systems to normal operation.