ECCouncil Updated 112-51 Exam Questions and Answers by bella-rose

Sharing confidential data on an unsecured network is a security risk associated with mobile usage policies. Mobile devices are often used to access and transmit sensitive information over public or untrusted networks, such as WiFi hotspots, cellular networks, or Bluetooth connections. This exposes the data to interception, modification, or redirection by malicious actors who may exploit mobile security vulnerabilities or use network-based attacks, such as man-in-the-middle, spoofing, or sniffing. To prevent this risk, mobile users should follow best practices such as using encryption, VPN, certificate pinning, and secure protocols to protect the data in transit. They should also avoid sending or receiving sensitive data over unsecured networks or applications, and verify the identity and integrity of the endpoint servers before establishing a connection.References:

• The 9 Most Common Security Threats to Mobile Devices in 2021, Auth0, June 25, 2021
• 7 Mobile App Security Risks and How to Mitigate Them, Cypress Data Defense, July 10, 2020
• The Latest Mobile Security Threats and How to Prevent Them, Security Intelligence, February 19, 2019

One of the most basic and important security guidelines for laptop users is to always log off or lock the system when unattended. This prevents unauthorized access to the system and the data stored on it by anyone who might have physical access to the laptop. Logging off or locking the system requires a password or other authentication method to resume the session, which adds a layer of protection to the laptop. Johana failed to comply with this security guideline, as she left the system active with the project file open and went for a coffee break, allowing Bob to access her system and modify the project file.References:

• Ten simple steps for keeping your laptop secure- Step 1: Require a password when logging in
• 6 Steps to Practice Strong Laptop Security- Step #1: Set complex passwords where it counts
• A Practical Guide to Securing Your Windows PC- Section: Lock your computer when you step away

ISO/IEC 27018 is the ISO standard that provides guidance to ensure that cloud service providers offer appropriate information security controls to protect the privacy of their customer’s clients by securing personally identifiable information entrusted to them. ISO/IEC 27018 is a code of practice for protecting personal information in cloud storage. The term for the personal data it covers is Personally Identifiable Information or PII. ISO/IEC 27018 is an addendum to ISO/IEC 27001, the first international code of practice for cloud privacy. It helps cloud service providers who process PII to assess riskand implement controls for protecting PII. ISO/IEC 27018 was created in 2014 and updated in 2019. It has the following objectives:

• Help the public cloud service provider to comply with applicable obligations when acting as a PII processor, whether such obligations fall on the PII processor directly or through contract.
• Enable the public cloud PII processor to be transparent in relevant matters so that cloud service customers can select well-governed cloud-based PII processing services.
• Assist the cloud service customer and the public cloud PII processor in entering into a contractual agreement.
• Provide cloud service customers with a mechanism for exercising audit and compliance rights and responsibilities in cases where individual cloud service customer audits of data hosted in a multiparty, virtualized server (cloud) environment can be impractical technically and can increase risks to those physical and logical network security controls in place123.

References:

• ISO/IEC 27018: Protecting PII in Public Clouds - ISMS.online, ISMS.online, 2019
• ISO/IEC 27018 - Wikipedia, Wikipedia, 2021
• ISO/IEC 27018:2019 - Information technology — Security techniques — Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors, ISO, 2019

AES (Advanced Encryption Standard) is an iterated block cipher that works by repeating the defined steps multiple times and has a 128-bit block size, having key sizes of 128, 192, and 256 bits. AES is a symmetric-key algorithm that encrypts and decrypts data using the same secret key. AES operates on a 4x4 matrix of bytes called the state, which undergoes 10, 12, or 14 rounds of transformation depending on the key size. Each round consists of four steps: sub-bytes, shift-rows, mix-columns, and add-round-key. AES is widely used for securing data in various applications and platforms, such as web browsers, VPNs, wireless networks, and smart grids. AES is the algorithm that matches the description given in the question.References:

• AES- Week 4: Cryptography Techniques
• Advanced Encryption Standard (AES)- NIST
• AES Encryption and Decryption Online Tool- Code Beautify