Midterm Exam – CSRP

A company discovers that an employee changed the bank account number in an approved payment file before it was processed. The file remained accessible to authorized employees, and the payment system remained operational.

Which element of the CIA triad was primarily compromised?

A network administrator is troubleshooting communication between two devices on different IP networks. The local device can communicate with systems on its own subnet but cannot reach any remote networks.

Which configuration should the administrator check first?

A security analyst captures network traffic and observes that a web browser establishes a TCP connection before transmitting application data.

At which OSI layer does TCP primarily operate?

A workstation sends a DHCP Discover message but receives no response. The network administrator confirms that the DHCP server is running on a different subnet.

Which network device or feature is most likely required for the workstation to receive a DHCP lease?

A Windows administrator wants to enforce a password policy for all users in an Active Directory domain.

Which tool should the administrator use?

A Linux administrator wants to allow the file owner to read and write a file, allow the group to read it, and deny all access to everyone else.

Which command applies the correct permissions?

A firewall rule permits inbound TCP traffic to a public web server on port 443. The firewall automatically allows the server’s response traffic without requiring a separate outbound rule.

Which firewall capability makes this possible?

An organization uses PAT so that multiple internal workstations can access the internet through one public IP address.

Which information allows the NAT device to distinguish between the internal connections?

A company wants remote employees to access internal applications through an encrypted connection. All internet-bound traffic from the employees’ devices must also pass through the company’s security controls while the VPN is active.

Which VPN configuration best meets this requirement?

An organization deploys a security device that monitors a copy of network traffic and generates alerts when suspicious patterns are detected. The device does not automatically block the traffic.

Which technology is being used?

A security administrator wants to ensure that employees receive access when they join the company, have their permissions updated when they change roles, and lose access promptly when they leave.

Which IAM process best addresses this requirement?

A user signs in with a password and then approves a login request through an authenticator application on a registered smartphone.

Which authentication factors are being used?

A DLP system detects a spreadsheet containing credit card numbers being attached to an outbound email.

Which state of data is the DLP system primarily protecting?

A security analyst reviews an endpoint alert showing that Microsoft Word launched PowerShell with an encoded command immediately after a user opened an email attachment.

Which action is most appropriate?

A company wants to reduce the risk of email spoofing. The security team needs a control that tells receiving mail servers what to do when a message fails both SPF and DKIM checks.

Which control best meets this requirement?