Certified Security Specialist (ECSS v9) Free Sample Questions

Defense-in-depth is a strategy that employs multiple layers of security controls to protect assets. The correct option describes four distinct layers: network (segmentation), host (HIDS), data (encryption), and application/user (RBAC). Each of the other options represents only a single layer of security. While valuable, a single control does not constitute a defense-in-depth strategy on its own.

A Security Incident and Event Management (SIEM) system is the core technology for collecting and correlating log data from diverse sources like firewalls, servers, and applications. Its primary function is to provide real-time analysis of security alerts generated by network hardware and applications. NIDS only monitors network traffic, DLP focuses on preventing data exfiltration, and a honeypot is a decoy system.

Tunneling C2 traffic through an already allowed and expected connection (like a database port) is a classic pivoting technique. It is highly effective and stealthy because the traffic appears legitimate to firewalls and basic monitoring systems. A full Nmap scan is extremely noisy and would likely be detected. Sniffing might work, but it's passive and depends on cleartext protocols. A brute-force attack is also noisy and inefficient.

Generating and verifying cryptographic hashes is the standard and most critical method to prove that a forensic image is an exact bit-for-bit copy of the original source. A hash is calculated for the source drive before imaging and for the destination image file after imaging. If the hashes match, it provides mathematical proof of integrity. While using a write-blocker is essential to prevent modification and documentation is part of the chain of custody, only hash verification proves the copy is identical.

WPA3 is the latest and most secure wireless protocol, offering significant improvements over WPA2, including protection against offline dictionary attacks. 802.1X (often used with WPA3-Enterprise) provides robust, individual user authentication via a RADIUS server, which is far more secure than a shared password (PSK).

This statement is false. The 'Weaponization' phase involves coupling an exploit with a payload (e.g., a remote access trojan) to create a deliverable malicious tool. The act of scanning the target's network to find vulnerabilities occurs during the 'Reconnaissance' and 'Scanning' phases, which precede weaponization.

Windows automatically creates LNK (shortcut) files and Jump Lists to track recently opened files and applications for user convenience. These artifacts persist even after files are deleted and history is cleared, providing a valuable timeline of user activity. The Security event log tracks security-related events like logons, the SAM hive stores user password hashes, and the System32 directory contains core system files, not user activity logs.

Transport Layer Security (TLS), the protocol that underpins HTTPS, is designed specifically for this purpose. It encrypts data in transit (confidentiality), uses message authentication codes to prevent tampering (integrity), and uses digital certificates to authenticate the server to the client. SSH is for secure remote administration, FTP is insecure for file transfers, and IPsec operates at the network layer, typically for VPNs.

The email was disguised as an 'urgent' report, creating a sense of urgency to bypass rational thinking. The attack also leverages authority, as financial reports are typically important and come from authoritative sources, making the executive more likely to comply.

To decrypt a TLS session captured in a PCAP file (assuming a cipher suite like RSA was used for key exchange), the investigator needs the server's private key. The private key is used to decrypt the pre-master secret exchanged during the TLS handshake, which then allows the investigator's tool (like Wireshark) to derive the symmetric session keys and decrypt the application data. The public key is publicly available and cannot be used for decryption. The session key itself is what needs to be derived.