An adversary intercepts a series of packets being sent from a workstation to a backup server over a local area network. If the data is unencrypted, which state of data does this represent and what is the primary risk?
A system administrator is configuring security for a database containing patient test results and doctor visit notes. Which regulatory standard must the organization comply with for this specific type of data?
A school district collects the names, home addresses, and dates of birth of students who are 10 years old for enrollment purposes. Which law specifically regulates the protection of this data for children under 13?
A company allows its employees to use a shared spreadsheet to track customer names, credit card account numbers, and CVV codes. Which set of rules regulates how this specific information must be handled?
An employee at a law firm is currently editing a sensitive legal brief. To make these edits, the file has been opened in a word processor. Why is the data particularly challenging to protect in this state?
A regular employee in the marketing department was accidentally granted administrative privileges on their workstation. If an adversary steals this employee’s login credentials, what is the most significant risk to the system?
A web developer notices that a form on their website allows users to type any characters into a "Quantity" field. If a user enters a series of SQL commands into this field to delete a table, what vulnerability is being exploited?
A user clicks a link in a phishing email that includes a snippet of malicious code. When the link opens the company’s website, the code executes in the user's browser and steals their session cookie. What type of attack has occurred?
An adversary submits a massive string of 10,000 characters into a login field designed to hold only 50 characters. The extra data overwrites adjacent memory, allowing the adversary to execute unauthorized code. What is this attack called?
A cybersecurity analyst is reviewing a risk where an organization's CEO stores private, unencrypted memos on a shared drive with no access controls. How would this risk likely be categorized?
A company has a policy that prevents all employees from accessing the payroll database after 6:00 PM, even if they are members of the HR department. Which access control model is being used here?
In a high-security government facility, a "Secret" level user is prevented from reading a "Top Secret" document. However, they are also prevented from writing notes into an "Unclassified" logbook to prevent leaking information downward. Which model is being applied?
An engineer creates a folder for a new project and manually grants "Read" access to their teammates while denying access to everyone else. What access control model does this represent?
A new intern is given access only to the specific folders and software needed to complete their daily tasks, and nothing else. Which security principle is being followed?
A Linux user runs the command ls -l and sees the permissions for a file listed as -rwxrw-r--. What are the permissions for the "group" entity?
A Linux administrator wants to set the permissions on a file so that the owner has full access (read, write, execute), the group can only read and execute, and others have no access. Which command should they use?
After running a command, the permissions of a file are set to 541. What can a user who is NOT the owner and NOT in the group do with this file?
An organization wants to ensure that its developers know how to handle PII and follow legal regulations. Which managerial control should they implement?
A company’s security policy specifies that all internal communications must be encrypted using AES with a minimum key length of 256 bits. Where would this requirement be documented?
A hacker posts a malicious script in the comment section of a popular blog. Every user who views the blog post later has the script execute in their browser automatically. What type of attack is this?