Cybersecurity-Apprentice Sample Questions & Answers

A Virtual Private Network (VPN) creates a secure, encrypted tunnel over a public network like the internet. This allows remote users to securely connect to a private corporate network as if they were physically present, protecting the confidentiality and integrity of the data in transit.

Data Loss Prevention (DLP) systems are designed to detect and prevent data breaches and data exfiltration. They use mechanisms like deep packet inspection and content analysis to identify sensitive data patterns (like credit card numbers) within network traffic and enforce policies to block or alert on unauthorized transmission.

The Exploitation stage is where the attacker actively triggers a vulnerability to gain unauthorized access or execute code. Using a known software flaw to gain initial access is the definitive action of this stage. Reconnaissance (Step 1) preceded it, and Installation (Step 3) followed it.

The core principle of MFA is the use of multiple, independent categories of credentials. The main categories are: something you know (password, PIN), something you have (token, phone), and something you are (biometrics). SFA relies on only one of these categories (typically a password), whereas true MFA requires proof from at least two.

The core concept of DevSecOps, or 'shifting left,' is to integrate automated security testing and validation early in the CI/CD pipeline. Finding and fixing vulnerabilities during development is significantly cheaper and less risky than discovering them in production. This approach makes security a shared responsibility and builds it into the development process, rather than treating it as a final gate before release.

Security Orchestration, Automation, and Response (SOAR) platforms are specifically designed to automate and orchestrate security workflows. While a SIEM is excellent for collecting, correlating, and generating alerts from log data, a SOAR platform takes the output from the SIEM (and other tools) and executes predefined playbooks to handle repetitive tasks, thereby improving response times and freeing up analysts for more complex investigations.

A Demilitarized Zone (DMZ) is a perimeter network that protects an organization's internal local-area network (LAN) from untrusted traffic. By placing public-facing services in the DMZ, an organization can provide an additional layer of security; if a server in the DMZ is compromised, the attacker does not have direct access to the internal network.

A router is the quintessential Layer 3 device. Its primary function is to make routing decisions, reading the destination IP address of incoming packets and forwarding them to the appropriate next hop on a different network. Switches operate at Layer 2 (using MAC addresses), and hubs operate at Layer 1 (simply repeating signals).

DNS serves as the 'phonebook of the internet.' Its core function is to resolve (translate) human-friendly domain names (e.g., www.paloaltonetworks.com) into the numerical IP addresses (e.g., 199.167.52.13) that computers use to communicate with each other. Automatic IP address assignment is the function of DHCP.

This highlights the core difference. Medical IoT devices often run specialized, closed-source operating systems where traditional endpoint security agents (like antivirus) cannot be installed. Therefore, endpoint security objectives shift to hardening what is possible (e.g., configuration) and relying heavily on network security to compensate. Network security's objective is to use segmentation (e.g., placing IoT devices in a specific VLAN) and strict firewall policies to isolate these devices and limit their communication to only what is necessary, preventing them from being used as a pivot point in an attack.