401-450 Flashcards

1
Q

A security analyst is reviewing logs on a server and observes the following output:

01/01/2020 03:33:23 admin attempted login with password sneak
01/01/2020 03:33:23 admin attempted login with password sneaked
01/01/2020 03:33:23 admin attempted login with password sneaker
01/01/2020 03:33:23 admin attempted login with password sneer
01/01/2020 03:33:23 admin attempted login with password sneeze
01/01/2020 03:33:23 admin attempted login with password sneezy

Which of the following is the security analyst observing?

a. A rainbow table attack
b. A password-spraying attack
c. A dictionary attack
d. A keylogger attack

A

c. A dictionary attack.

Here’s why:

Dictionary Attack: In a dictionary attack, the attacker uses a list of commonly used passwords or words from a dictionary to attempt to gain unauthorized access to a system. The log entries show multiple login attempts with variations of the password "sneak" (like "sneaked", "sneaker", "sneer", "sneeze", "sneezy"), indicating that the attacker is systematically trying different permutations of a known word or pattern.

Rainbow Table Attack: A rainbow table attack involves precomputed hashes of commonly used passwords to quickly crack hashed passwords. It is not evident in the log entries provided, as the attempts are with different variations of a single word rather than hashed values.

Password-Spraying Attack: Password-spraying involves attempting a few commonly used passwords against many accounts. It typically targets multiple usernames with a few common passwords rather than trying variations of a single password.

Keylogger Attack: A keylogger attack involves malware or hardware that captures keystrokes entered by users, including passwords. There is no indication of keylogging in the log entries provided.

Therefore, based on the pattern of login attempts with variations of the password “sneak”, the activity described aligns with a dictionary attack where the attacker is systematically trying different variations of a word in an attempt to guess the correct password and gain unauthorized access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

A company is launching a website in a different country in order to capture user information that a marketing business can use. The company itself will not be using the information. Which of the following roles is the company assuming?

a. Data owner
b. Data processor
c. Data steward
d. Data collector

A

d. Data collector.

Here’s why:

Data Collector: A data collector is an entity that collects personal data directly from individuals or through other sources. In this case, the company is launching a website in a different country to capture user information. Although the company itself will not be using the information, it is gathering (collecting) this data on behalf of a marketing business. The primary function here is to gather the data from users.

Data Owner: The data owner is typically the individual or organization that has ultimate control over the data, including its use and disclosure. In this scenario, it's not explicitly stated that the company retains ownership or control over the data after collection.

Data Processor: A data processor processes personal data on behalf of the data controller (owner) based on their instructions. Since the company is not processing the data for its own purposes but rather collecting it for another entity (the marketing business), it does not fit the definition of a data processor.

Data Steward: A data steward is responsible for managing and maintaining the quality, security, and use of data within an organization. This role focuses more on governance and ensuring that data is handled correctly within the organization, which differs from the primary function of collecting data from external sources.

Therefore, based on the description provided, the company assuming the role of gathering user information for a marketing business is acting as a data collector.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

An organization would like to remediate the risk associated with its cloud service provider not meeting its advertised 99.999% availability metrics. Which of the following should the organization consult for the exact requirements for the cloud provider?

a. SLA
b. BPA
c. NDA
d. MOU

A

a. SLA (Service Level Agreement)

Here’s why:

SLA (Service Level Agreement): An SLA is a contract between a service provider (in this case, the cloud service provider) and the customer (the organization). It specifies the level of service that the provider agrees to offer, including metrics such as availability, performance, uptime guarantees, and response times. The SLA outlines what happens if the provider fails to meet these metrics, typically including remedies such as service credits or penalties.

BPA (Business Partnership Agreement): A BPA typically outlines the broader terms and conditions of a business relationship but does not usually specify detailed service-level metrics like availability.

NDA (Non-Disclosure Agreement): An NDA is a legal contract that protects confidential information shared between parties and is not related to service-level requirements.

MOU (Memorandum of Understanding): An MOU is a formal agreement between parties outlining their mutual intentions and expectations, but it does not typically include specific service-level metrics or remedies for non-compliance.

Therefore, to understand the exact requirements for the cloud provider’s advertised availability metrics and to remediate the risk associated with non-compliance, the organization should refer to the SLA (Service Level Agreement). This document will provide clarity on the agreed-upon service levels and the recourse available if those levels are not met.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which of the following secure application development concepts aims to block verbose error messages from being shown in a user’s interface?

a. OWASP
b. Obfuscation/camouflage
c. Test environment
d. Prevention of information exposure

A

d. Prevention of information exposure.

Here’s why:

Prevention of Information Exposure: This concept involves ensuring that sensitive information, such as verbose error messages that could potentially provide attackers with useful information about the application or its environment, is not exposed to users or unauthorized parties. By minimizing or controlling the amount of information exposed through error messages, developers can reduce the risk of attackers exploiting such information to launch targeted attacks.

Let’s briefly cover the other options to clarify:

OWASP: OWASP (Open Web Application Security Project) is a nonprofit organization focused on improving software security. While OWASP provides guidelines and resources for secure application development, it is not specifically focused on blocking verbose error messages.

Obfuscation/Camouflage: Obfuscation and camouflage techniques are used to make code or data difficult to understand or analyze, which can help in protecting against reverse engineering or unauthorized access to sensitive information. However, they do not directly address the issue of verbose error messages in user interfaces.

Test Environment: A test environment is where developers test their applications before deployment to ensure functionality and security. It is not directly related to blocking verbose error messages in a user interface.

Therefore, d. Prevention of information exposure is the concept that specifically addresses the secure development practice of ensuring that detailed error messages and other sensitive information are not exposed to users or attackers, thus minimizing security risks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

If a current private key is compromised, which of the following would ensure it cannot be used to decrypt all historical data?

a. Perfect forward secrecy
b. Elliptic-curve cryptography
c. Key stretching
d. Homomorphic encryption

A

a. Perfect forward secrecy.

Here’s why:

Perfect Forward Secrecy (PFS): PFS is a property of key-agreement protocols that ensures that session keys derived from a long-term key (such as a private key) are not compromised even if the long-term key is compromised at a later time. In other words, if a current private key is compromised and PFS is implemented, the compromise does not affect the confidentiality of past communications. Each session key is unique and not derived directly from the long-term private key, so compromising the long-term key does not compromise past session keys.

Elliptic-curve Cryptography (ECC): ECC is an encryption method that uses elliptic curves to provide security. While it offers advantages such as smaller key sizes for equivalent security levels compared to RSA, it does not inherently prevent decryption of historical data if the private key is compromised.

Key Stretching: Key stretching techniques (like PBKDF2, bcrypt, or scrypt) are used to make keys derived from passwords more resistant to brute-force attacks. They do not directly address the issue of protecting historical data if a private key is compromised.

Homomorphic Encryption: Homomorphic encryption allows computations to be performed on encrypted data without decrypting it. It does not directly address the issue of preventing decryption of historical data if a private key is compromised.

Therefore, a. Perfect forward secrecy is the concept that ensures a compromised current private key cannot be used to decrypt all historical data, making it a crucial feature in secure communications protocols, particularly in scenarios where long-term keys might be compromised.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

An organization has expanded its operations by opening a remote office. The new office is fully furnished with office resources to support up to 50 employees working on any given day. Which of the following VPN solutions would BEST support the new office?

a. Always-on
b. Remote access
c. Site-to-site
d. Full tunnel

A

c. Site-to-site VPN.

Here’s why:

Site-to-site VPN: This type of VPN establishes a secure connection between two or more physical locations (in this case, between the main office and the remote office). It allows all network traffic between the two sites to be encrypted and transmitted securely over the internet. Site-to-site VPNs are ideal for connecting entire networks, such as connecting the main office network to the network at the remote office with up to 50 employees.

Always-on VPN: An always-on VPN is a type of VPN configuration where the VPN connection is automatically established whenever a device connects to the internet. It is suitable for individual devices rather than connecting entire office networks.

Remote access VPN: A remote access VPN allows individual users to connect securely to a corporate network from remote locations. It is more suitable for mobile employees or individuals working from home rather than connecting an entire office.

Full tunnel VPN: A full tunnel VPN directs all traffic from a client device through the VPN tunnel to the corporate network, regardless of whether the traffic is destined for resources on the corporate network or the internet. It is a configuration option rather than a type of VPN solution like site-to-site or remote access VPN.

Therefore, c. Site-to-site VPN is the best choice for connecting the new remote office with up to 50 employees to the main office network securely and efficiently. It provides a seamless and secure connection between the two office locations, enabling access to shared resources and applications as if they were locally connected.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which of the following scenarios BEST describes a risk reduction technique?

a. A security control objective cannot be met through a technical change, so the company purchases insurance and is no longer concerned about losses from data breaches.
b. A security control objective cannot be met through a technical change, so the company implements a policy to train users on a more secure method of operation.
c. A security control objective cannot be met through a technical change, so the company performs regular audits to determine if violations have occurred.
d. A security control objective cannot be met through a technical change, so the Chief Information Officer decides to sign off on the risk.

A

b. A security control objective cannot be met through a technical change, so the company implements a policy to train users on a more secure method of operation.

Here’s why:

Training Users on Secure Methods: This approach addresses the inability to meet a security control objective through technical means by focusing on human behavior and awareness. By educating users on more secure methods of operation, such as proper handling of data, recognizing phishing attempts, or following secure procedures, the organization reduces the likelihood of security incidents caused by human error or ignorance.

Let’s briefly cover the other options to clarify:

Purchasing Insurance: While purchasing insurance can mitigate financial losses from data breaches, it does not directly reduce the risk associated with the security control objective itself. It is more of a risk transfer mechanism rather than a risk reduction technique.

Performing Regular Audits: Audits help in detecting violations or non-compliance but do not actively reduce the risk associated with the security control objective. They are more about monitoring and ensuring adherence to policies rather than directly mitigating risks.

Signing Off on the Risk: Signing off on the risk (option d) implies accepting the risk rather than actively reducing it. It does not involve implementing controls or measures to decrease the likelihood or impact of a security incident.

Therefore, b. Implementing a policy to train users on a more secure method of operation is the option that represents a proactive risk reduction technique by addressing the human element and enhancing security awareness and practices within the organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which of the following social engineering attacks BEST describes an email that is primarily intended to mislead recipients into forwarding the email to others?

a. Hoaxing
b. Pharming
c. Watering-hole
d. Phishing

A

a. Hoaxing.

Here’s why:

Hoaxing: Hoaxing involves spreading false information or rumors through various means, including emails, with the intent to deceive and mislead recipients. In the context of emails, hoax emails often encourage recipients to forward the message to others, typically by appealing to emotions, spreading false news, or promoting chain letters.

Let’s briefly cover the other options to clarify:

Pharming: Pharming is a cyber attack where malicious code is used to redirect a website's traffic to a fake website without the user's knowledge. It typically involves DNS hijacking or malware and is not directly related to forwarding misleading emails.

Watering-hole: A watering-hole attack involves compromising websites that a targeted group of individuals is likely to visit and injecting them with malware. It aims to infect visitors with malware rather than forwarding misleading emails.

Phishing: Phishing is a social engineering attack where attackers send deceptive emails or messages pretending to be from a reputable source to trick recipients into revealing sensitive information or clicking on malicious links. While phishing emails can sometimes instruct recipients to forward the message, their primary goal is usually to deceive recipients into taking actions like clicking links or providing credentials.

Therefore, a. Hoaxing is the social engineering attack that specifically involves emails intended to mislead recipients into forwarding the email to others, often perpetuating false information or initiating chain messages.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which of the following will provide the BEST physical security countermeasures to stop intruders? (Choose two.)

a. Alarms
b. Signage
c. Lighting
d. Access control vestibules
e. Fencing
f. Sensors

A

(Community : DE 100%)
d. Access control vestibules
e. Fencing

Intruders can be detected by strong lightning, alarms, and sensors. However, these measures alone don’t physically prevent intruders from bypassing security. Signage may discourage intruders but doesn’t physically stop them. Access control vestibules and fences can physically prevent intruders from accessing valuable assets and restricted areas

ChatGPT : DE
d. Access control vestibules: Also known as mantraps, these are secure entryways that use two sets of interlocking doors to prevent unauthorized access. They provide a high level of security by ensuring that only authorized personnel can enter the premises.

e. Fencing: Fencing acts as a physical barrier to entry, making it more difficult for intruders to gain access to the property. It can also be combined with other security measures like barbed wire, sensors, and cameras to enhance overall security.

These two countermeasures provide substantial physical barriers and control mechanisms to effectively deter and stop intruders from gaining unauthorized access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

An organization is concerned about hackers potentially entering a facility and plugging in a remotely accessible Kali Linux box. Which of the following should be the first lines of defense against such an attack? (Choose two.)

a. MAC filtering
b. Zero trust segmentation
c. Network access control
d. Access control vestibules
e. Guards
f. Bollards

A

(Community : DE 49%, CD 49%)

Choose CD.

ChatGTP
c. Network access control
d. Access control vestibules
Explanation:

Network Access Control (NAC):
    Purpose: NAC systems enforce security policy on devices seeking to access network resources. They can block unauthorized devices, such as a rogue Kali Linux box, from gaining network access.
    Benefit: This helps prevent unauthorized devices from communicating over the network, thus mitigating the risk of data breaches and other security threats.

Access Control Vestibules:
    Purpose: These are physical security measures that control and monitor the entry of personnel into a facility. Often referred to as "mantraps," these vestibules ensure that only authorized individuals gain access to secure areas.
    Benefit: This reduces the risk of unauthorized individuals physically entering the premises and deploying malicious devices.

Why the other options are less suitable as first lines of defense:

a. MAC filtering:
    While useful, MAC filtering can be bypassed by spoofing the MAC address. It is more of a secondary measure rather than a primary defense against physical intrusion and rogue devices.

b. Zero trust segmentation:
    This is an excellent internal network security strategy but does not address the physical aspect of preventing unauthorized device access at the network level.

e. Guards:
    While security guards are important, they are not as effective on their own as access control vestibules for systematically ensuring that unauthorized individuals do not gain access to secure areas.

f. Bollards:
    Bollards are designed to prevent vehicular access and do not directly prevent individuals from physically entering a facility and deploying a rogue device.

By focusing on network access control to block unauthorized devices and access control vestibules to prevent unauthorized physical access, the organization can effectively mitigate the risk of hackers deploying a remotely accessible Kali Linux box.

(Braindump : A. Zero trust segmentation c. Network access control)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

An employee used a corporate mobile device during a vacation. Multiple contacts were modified in the device during the employee’s vacation. Which of the following attack methods did an attacker use to insert the contacts without having physical access to the device?

a. Jamming
b. Bluejacking
c. Disassociation
d. Evil twin

A

b. Bluejacking.

Here’s why:

Bluejacking: Bluejacking is a relatively harmless attack where an attacker sends unsolicited messages or contacts over Bluetooth to nearby Bluetooth-enabled devices. The goal is typically to send spam or messages rather than maliciously modify contacts, but in some cases, it could involve adding or modifying contacts if the device settings allow it.

Let’s briefly cover the other options to clarify:

Jamming: Jamming involves intentionally disrupting wireless communication signals (such as Wi-Fi or Bluetooth) to prevent normal operation. It does not involve modifying contacts or inserting data into devices.

Disassociation: Disassociation typically refers to the process of disconnecting a device from a wireless network. It is not related to inserting or modifying contacts on a mobile device.

Evil twin: An evil twin attack involves creating a rogue wireless access point (Wi-Fi hotspot) that masquerades as a legitimate one to trick users into connecting. It does not directly involve inserting or modifying contacts on a mobile device.

Therefore, b. Bluejacking is the attack method where the attacker could have sent or modified contacts on the corporate mobile device via Bluetooth without physically accessing the device, assuming the device was susceptible to such actions over Bluetooth connections.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

A security administrator wants to implement a program that tests a user’s ability to recognize attacks over the organization’s email system. Which of the following would be best suited for this task?

a. Social media analysis
b. Annual information security training
c. Gamification
d. Phishing campaign

A

d. Phishing campaign.

Here’s why:

Phishing Campaign: A phishing campaign involves sending simulated phishing emails to employees to test their awareness and ability to identify phishing attacks. These emails are designed to mimic real phishing attempts, but without malicious intent, aiming to educate users on how to recognize and respond to phishing emails correctly.

Let’s briefly cover the other options to clarify:

Social Media Analysis: Social media analysis involves monitoring and analyzing social media platforms for security threats or information leakage related to an organization. It does not directly test a user's ability to recognize email-based attacks.

Annual Information Security Training: While annual information security training is essential for educating employees on various security topics, including phishing, it does not specifically simulate real phishing attacks to test immediate recognition and response capabilities.

Gamification: Gamification involves incorporating game-like elements (such as points, rewards, and competition) into training programs to engage and motivate participants. While it can enhance training effectiveness, it typically focuses on learning retention and engagement rather than testing specific skills like recognizing email attacks.

Therefore, d. Phishing campaign is the most appropriate choice for actively testing and improving users’ ability to identify and respond to phishing attacks via the organization’s email system. It provides a practical simulation of real-world threats to enhance awareness and readiness among employees.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

A security analyst is reviewing packet capture data from a compromised host on the network. In the packet capture, the analyst locates packets that contain large amounts of text. Which of the following is most likely installed on the compromised host?

a. Keylogger
b. Spyware
c. Trojan
d. Ransomware

A

a. Keylogger

Here’s why:

Keylogger: Keyloggers are malicious programs designed to record keystrokes made by a user on a computer. They capture all keystrokes entered, including text typed into documents, web forms, passwords, and other sensitive information. If the packet capture data includes large amounts of text from various sources (such as documents, emails, or chat messages), it suggests that a keylogger is actively capturing and transmitting this information.

Spyware: Spyware is a broader category of malicious software that includes keyloggers but also encompasses other types of software designed to monitor and gather information about a user's activities without their knowledge. However, keyloggers specifically target and capture keystrokes, which aligns with the description provided in the scenario.

Trojan: Trojans are malicious programs disguised as legitimate software. While Trojans can include keyloggers or spyware functionality, the focus on capturing and transmitting text data specifically points towards a keylogger rather than a Trojan in general.

Ransomware: Ransomware encrypts files on a computer and demands payment for decryption. It typically does not involve capturing large amounts of text data but rather focuses on locking access to files or systems.

Therefore, a. Keylogger is the most likely software installed on the compromised host based on the packet capture data showing large amounts of captured text.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

An organization needs to implement more stringent controls over administrator/root credentials and service accounts. Requirements for the project include:

*Check-in/checkout of credentials
*The ability to use but not know the password
*Automated password changes
*Logging of access to credentials

Which of the following solutions would meet the requirements?

a. OAuth 2.0
b. Secure Enclave
c. A privileged access management system
d. An OpenID Connect authentication system

A

(Community C 100%)

C. A privileged access management system
Privileged access management (PAM, sometimes called privileged
account management) allows an organization to apply more stringent
security controls over accounts with elevated privileges, such as
administrator or root-level accounts.

Some capabilities of PAM are:

-Allow users to access the privileged account without knowing
the password
-Automatically change privileged account passwords
periodically
-Limit the time users can use the privileged account
-Allow users to check out credentials
-Log all access of credentials

ChatGPT
c. A privileged access management (PAM) system

Here’s how a PAM system aligns with each requirement:

Check-in/checkout of credentials: A PAM system provides a secure vault where privileged credentials (such as administrator/root credentials and service account passwords) are stored. Access to these credentials can be managed through check-in and checkout mechanisms, ensuring that credentials are only accessible when needed and are returned after use.

The ability to use but not know the password: PAM systems typically provide mechanisms such as session management and password injection that allow users to access systems without revealing the actual passwords. Instead, credentials are managed and rotated automatically by the PAM system.

Automated password changes: PAM systems can automate the rotation and changing of passwords according to policies and schedules defined by the organization. This ensures that passwords are regularly updated to enhance security.

Logging of access to credentials: PAM systems maintain detailed audit logs of all access and actions performed using privileged credentials. This includes logging who accessed which credentials, when, and for what purpose, providing accountability and traceability.

Let’s briefly cover the other options to clarify why they are not as suitable:

OAuth 2.0: OAuth 2.0 is an authorization framework that allows third-party applications to obtain limited access to an HTTP service. It is not designed for managing privileged credentials and does not provide the comprehensive controls and auditing capabilities required for administrator/root credentials and service accounts.

Secure Enclave: A secure enclave is a hardware-based security feature that provides isolated execution environments for sensitive computations. While it enhances security for specific tasks, it does not directly address the management and control of privileged credentials as comprehensively as a PAM system.

An OpenID Connect authentication system: OpenID Connect is an authentication protocol that allows for the authorization of clients to access protected resources. It focuses on user authentication and identity management, rather than managing privileged credentials and enforcing strict controls over administrator/root accounts and service accounts.

Therefore, c. A privileged access management (PAM) system is the solution that best meets the requirements outlined for implementing stringent controls over administrator/root credentials and service accounts within the organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

A systems analyst is responsible for generating a new digital forensics chain-of-custody form. Which of the following should the analyst include in this documentation? (Choose two).

a. The order of volatility
b. A forensics NDA
c. The provenance of the artifacts
d. The vendor’s name
e. The date and time
f. A warning banner

A

(Braindump : c. The provenance of the artifacts e. The date and time)
The systems analyst should include the date and time and the provenance of the artifacts in the digital forensics chain-of-custody form. The date and time are important for tracking when the evidence was collected and when it was transferred between individuals or organizations. The provenance of the artifacts is also important for tracking the chain of custody and ensuring that the evidence has not been tampered with.

The order of volatility is a concept used in digital forensics to determine the order in which volatile data should be collected. A forensics NDA is a non-disclosure agreement that is used to protect sensitive information during a digital forensics investigation. The vendor’s name is not typically included in a digital forensics chain-of-custody form. A warning banner is a message that is displayed to users before they log in to a system to warn them about the consequences of unauthorized access.

a. The order of volatility

The order of volatility refers to the sequence in which volatile data (data that is likely to change or be lost quickly) should be collected and preserved during the forensic investigation. This ensures that the most volatile data, which may provide crucial evidence, is collected first.

c. The provenance of the artifacts

Provenance refers to the origin or source of the artifacts collected during the investigation. It includes information such as where and how the artifacts were discovered, who collected them, and under what circumstances. Documenting provenance is critical for establishing the authenticity and reliability of the evidence in legal proceedings.

Let’s briefly cover the other options to clarify why they are not typically included in a digital forensics chain-of-custody form:

b. A forensics NDA: While a Non-Disclosure Agreement (NDA) is important for protecting confidential information and ensuring confidentiality among parties involved in the investigation, it is not typically part of the chain-of-custody form itself. NDAs are separate legal agreements that may be signed between parties involved in the investigation.

d. The vendor's name: Unless the investigation involves external vendors or service providers who are directly handling or assisting with the forensic process, the vendor's name is not typically relevant to include in the chain-of-custody form.

e. The date and time: While the date and time are crucial for documenting when artifacts were collected or transferred, they are usually included as part of the chain-of-custody process itself rather than being explicitly listed in the form.

f. A warning banner: A warning banner is a notification displayed on systems to inform users of the monitoring or security policies in place. While important for system usage and awareness, it is not directly related to documenting the chain-of-custody for forensic artifacts.

Therefore, the systems analyst should focus on including a. The order of volatility and c. The provenance of the artifacts in the digital forensics chain-of-custody form to ensure comprehensive documentation and integrity of the forensic investigation process.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

A security analyst reviews web server logs and notices the following line:

104.35.45.53 - - [22/May/2020:07:00:58 +0100] “GET /wordpress/wp-content/plugins/custom_plugin/check_user/php?userid=1 UNION ALL SELECT user_login, user,_pass, user_email from wp_users== HTTP/1.1” 200 1072 “http://www.example.com/wordpress/wp-admin/”

Which of the following vulnerabilities is the attacker trying to exploit?

a. SSRF
b. CSRF
c. XSS
d. SQLi

A

d. SQL Injection (SQLi) vulnerability.

Here’s why:

SQL Injection (SQLi): SQL Injection involves inserting malicious SQL code into input fields (in this case, the userid parameter in the URL) that are directly used in SQL queries executed by the application's backend database. The attacker aims to manipulate the SQL query to extract sensitive information from the database. In the log entry:
    userid=1 UNION ALL SELECT user_login, user,_pass, user_email from wp_users: This part of the URL is attempting to perform a SQL UNION query to retrieve user login names (user_login), passwords (user,_pass), and email addresses (user_email) from the wp_users table in the WordPress database (wp_users).

Let’s briefly cover why the other options are not correct:

a. SSRF (Server-Side Request Forgery): SSRF involves tricking the server into making requests on behalf of the attacker to internal or external systems that the server has access to. The provided log does not indicate any SSRF attempt.

b. CSRF (Cross-Site Request Forgery): CSRF involves tricking a user into executing actions in an application without their knowledge or consent. It typically involves forging requests from the user's browser context, not directly through server logs as shown.

c. XSS (Cross-Site Scripting): XSS involves injecting malicious scripts into web pages viewed by other users. It does not involve manipulating SQL queries to extract data from databases as shown in the log.

Therefore, the correct answer is d. SQLi, as the attacker is attempting to exploit a SQL Injection vulnerability by manipulating the SQL query through the userid parameter in the URL to extract sensitive information from the database.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

A user is having network connectivity issues when working from a coffee shop. The user has used the coffee shop as a workspace for several months without any issues. None of the other customers at the coffee shop are experiencing these issues. A help desk analyst at the user’s company reviews the following Wi-Fi log:

Time Network Status Frequency
08:13:40 Coffee_Wi-Fi Network connected 5 GHz
08:13:45 Coffee_Wi-Fi Network disconnected 5 GHz
09:04:10 Coffee_Wi-Fi Network connected 5 GHz
09:04:15 Coffee_Wi-Fi Network disconnected 5 GHz
11:15:07 Coffee_Wi-Fi Network connected 2.4 GHz
11:15:12 Coffee_Wi-Fi Network disconnected 2.4 GHz

Which of the following best describes what is causing this issue?

a. Another customer has configured a rogue access point.
b. The coffee shop network is using multiple frequencies.
c. A denial-of-service attack by disassociation is occurring.
d. An evil twin access point is being utilized.

A

(Community : C 83%)

c. A denial-of-service attack by disassociation is occurring.

Here’s why:

The Wi-Fi log shows that the user’s device repeatedly connects to the network and then disconnects almost immediately. This pattern is indicative of a disassociation attack, a type of denial-of-service attack where an attacker sends disassociation frames to the victim’s device, causing it to disconnect from the network repeatedly.

Let’s briefly discuss why the other options are less likely:

a. Another customer has configured a rogue access point: While a rogue access point can cause connectivity issues, it would typically result in the user connecting to the wrong network rather than frequent disconnections after connecting to the correct network.

b. The coffee shop network is using multiple frequencies: The log shows connections on both 5 GHz and 2.4 GHz frequencies, but the disconnection issue is not due to the use of multiple frequencies. If it were simply a frequency issue, we would not expect the immediate disconnections after connecting.

d. An evil twin access point is being utilized: An evil twin attack involves setting up a malicious access point that mimics the legitimate one to intercept data. This could cause connection issues, but it typically results in connections to the fake access point rather than frequent disconnections.

Therefore, the log entries showing immediate disconnections after successful connections are most consistent with a denial-of-service attack by disassociation, where an attacker is deliberately causing the user’s device to disconnect from the network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which of the following is a physical security control that ensures only the authorized user is present when gaining access to a secured area?

a. A biometric scanner
b. A smart card reader
c. A PKI token
d. A PIN pad

A

a. A biometric scanner

Here’s why:

Biometric Scanner: A biometric scanner uses unique physical characteristics of an individual, such as fingerprints, facial recognition, iris scans, or voice recognition, to verify their identity. This ensures that the person attempting to gain access is physically present and is the authorized individual, as these biometric traits are difficult to replicate or share.

Let’s briefly cover why the other options are less effective in ensuring the physical presence of the authorized user:

Smart Card Reader: A smart card reader authenticates access based on a smart card that the user possesses. While it confirms the presence of the card, it does not verify that the person holding the card is the authorized user, as smart cards can be lost, stolen, or shared.

PKI Token: A Public Key Infrastructure (PKI) token provides authentication through cryptographic keys. Similar to smart cards, it ensures the presence of the token but does not verify the identity of the person holding the token.

PIN Pad: A PIN pad requires the user to enter a Personal Identification Number (PIN) to gain access. While it authenticates based on knowledge of the PIN, it does not confirm the physical presence of the authorized user, as PINs can be shared or guessed.

Therefore, a. Biometric scanner is the best option for ensuring that only the authorized user is present when gaining access to a secured area, as it relies on unique, non-transferable physical characteristics.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

During a forensic investigation, a security analyst discovered that the following command was run on a compromised host:

crackmapexec smb 192.168.10.232 -u localadmin -H 0A3CE8D07A46E5C51070F03593E0A5E6

Which of the following attacks occurred?

a. Buffer overflow
b. Pass the hash
c. SQL injection
d. Replay attack

A

b. Pass the hash

Here’s why:

Pass the Hash: The command crackmapexec smb 192.168.10.232 -u localadmin -H 0A3CE8D07A46E5C51070F03593E0A5E6 uses the crackmapexec tool to authenticate to an SMB (Server Message Block) service on the host 192.168.10.232 with the username localadmin and a hash (-H 0A3CE8D07A46E5C51070F03593E0A5E6). This indicates that the attacker is using the hash of the password rather than the password itself to authenticate. This technique is known as "Pass the Hash."

Let’s briefly cover why the other options are not applicable:

Buffer Overflow: A buffer overflow attack involves exploiting a program by overrunning a buffer’s boundary and overwriting adjacent memory. The given command does not show any indication of trying to overflow a buffer or manipulate memory boundaries.

SQL Injection: SQL injection involves injecting malicious SQL statements into an input field for execution by a database. The given command does not interact with a database or include any SQL code.

Replay Attack: A replay attack involves capturing and retransmitting valid data transmissions to repeat or delay a valid transaction. The given command does not indicate retransmitting data but instead shows an attempt to authenticate using a hash.

Therefore, b. Pass the hash is the correct answer, as the command shows the use of a hashed password to authenticate to a service.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

A company is moving to new location. The systems administrator has provided the following server room requirements to the facilities staff:

*Consistent power levels in case of brownouts or voltage spikes
*A minimum of 30 minutes runtime following a power outage
*Ability to trigger graceful shutdowns of critical systems

Which of the following would BEST meet the requirements?

a. Maintaining a standby, gas-powered generator
b. Using large surge suppressors on computer equipment
c. Configuring managed PDUs to monitor power levels
d. Deploying an appropriately sized, network-connected UPS device

A

d. Deploying an appropriately sized, network-connected UPS device

Here’s why:

Consistent power levels in case of brownouts or voltage spikes: A UPS (Uninterruptible Power Supply) device can provide consistent power by regulating voltage levels and protecting against brownouts and voltage spikes.

A minimum of 30 minutes runtime following a power outage: A properly sized UPS can provide battery backup power for a specified period, such as 30 minutes, allowing systems to remain operational during short outages.

Ability to trigger graceful shutdowns of critical systems: A network-connected UPS can communicate with servers and other critical systems to initiate a graceful shutdown process when the UPS battery reaches a certain threshold, ensuring data integrity and preventing damage.

Let’s briefly cover why the other options are not as suitable:

a. Maintaining a standby, gas-powered generator: While a generator can provide power during an extended outage, it typically takes some time to start up, which may not cover the initial 30 minutes following a power outage. Additionally, it does not address voltage regulation or provide the capability to trigger graceful shutdowns.

b. Using large surge suppressors on computer equipment: Surge suppressors can protect against voltage spikes but do not provide battery backup power during outages or brownouts. They also do not offer the ability to trigger graceful shutdowns.

c. Configuring managed PDUs to monitor power levels: Managed Power Distribution Units (PDUs) can monitor and manage power distribution but do not provide battery backup power or protection against voltage fluctuations. They also do not have the capability to trigger graceful shutdowns on their own.

Therefore, d. Deploying an appropriately sized, network-connected UPS device is the best solution to meet all the specified server room requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which of the following would provide guidelines on how to label new network devices as part of the initial configuration?

a. IP schema
b. Application baseline configuration
c. Standard naming convention policy
d. Wireless LAN and network perimeter diagram

A

c. Standard naming convention policy

Here’s why:

Standard Naming Convention Policy: This policy defines the rules and guidelines for naming network devices and other IT resources within an organization. It ensures consistency and clarity in the naming of devices, making it easier to manage and identify them within the network. The policy typically includes conventions for device types, locations, functions, and other relevant attributes that should be reflected in the names assigned to new devices.

Let’s briefly cover why the other options are not suitable for providing guidelines on labeling new network devices:

IP Schema: An IP schema defines the structure and allocation of IP addresses within the network but does not provide guidelines on naming or labeling devices.

Application Baseline Configuration: This refers to the standard configuration settings for applications to ensure they operate correctly and securely but does not address the naming or labeling of network devices.

Wireless LAN and Network Perimeter Diagram: This diagram visually represents the layout and structure of the wireless LAN and network perimeter but does not provide naming conventions or labeling guidelines for new network devices.

Therefore, c. Standard naming convention policy is the correct answer as it directly addresses the need for guidelines on labeling new network devices as part of the initial configuration.

22
Q

A systems engineer thinks a business system has been compromised and is being used to exfiltrate data to a competitor. The engineer contacts the CSIRT. The CSIRT tells the engineer to immediately disconnect the network cable and to not do anything else. Which of the following is the most likely reason for this request?

a. The CSIRT thinks an insider threat is attacking the network.
b. Outages of business-critical systems cost too much money.
c. The CSIRT does not consider the systems engineer to be trustworthy.
d. Memory contents, including fileless malware, are lost when the power is turned off.

A

d. Memory contents, including fileless malware, are lost when the power is turned off.

Here’s why:

Memory contents, including fileless malware, are lost when the power is turned off: Disconnecting the network cable stops the data exfiltration without powering down the system. This preserves the volatile memory (RAM) contents, which might contain crucial evidence of the compromise, such as active processes, network connections, and potentially fileless malware. Fileless malware operates in memory and would be lost if the system were powered down, making it impossible to analyze the full extent of the compromise.

Let’s briefly cover why the other options are less likely:

a. The CSIRT thinks an insider threat is attacking the network: While this could be a concern, the primary goal in this situation is to preserve evidence and stop data exfiltration. Disconnecting the network cable addresses this immediate need without implying distrust of the systems engineer.

b. Outages of business-critical systems cost too much money: Although this is a valid concern, the request to disconnect the network cable and avoid further actions is more likely focused on preserving forensic evidence rather than avoiding outages.

c. The CSIRT does not consider the systems engineer to be trustworthy: This is less likely the reason for the specific instructions given. The request is standard procedure to ensure that evidence is preserved and the investigation can proceed effectively.

Therefore, the correct answer is d. Memory contents, including fileless malware, are lost when the power is turned off, as this best explains the CSIRT’s request to disconnect the network cable while avoiding any actions that could lead to the loss of volatile memory data.

23
Q

Which of the following best describes the situation where a successfully onboarded employee who is using a fingerprint reader is denied access at the company’s main gate?

a. Crossover error rate
b. False match rate
c. False rejection
d. False positive

A

c. False rejection

Here’s why:

False Rejection (False Negative): This occurs when a legitimate user is incorrectly denied access by the biometric system. In this case, the employee has been properly onboarded and should have access, but the fingerprint reader is denying entry, which is a classic example of a false rejection.

Let’s briefly cover why the other options are not suitable:

Crossover Error Rate (CER): This is a metric used to evaluate the performance of a biometric system, representing the point at which the false acceptance rate (FAR) and false rejection rate (FRR) are equal. It does not specifically describe the situation of an individual being incorrectly denied access.

False Match Rate (False Acceptance Rate, FAR): This occurs when the biometric system incorrectly grants access to an unauthorized person. It does not describe the situation where a legitimate user is denied access.

False Positive: This is similar to a false match rate and occurs when the system incorrectly identifies an unauthorized user as authorized. It does not apply to the situation where an authorized user is denied access.

Therefore, the correct answer is c. False rejection, as it accurately describes the scenario where a legitimate, onboarded employee is denied access by the fingerprint reader.

24
Q

Which of the following should customers who are involved with UI developer agreements be concerned with when considering the use of these products on highly sensitive projects?

a. Weak configurations
b. Integration activities
c. Unsecure user accounts
d. Outsourced code development

A

(Community : D 61%, A 31%)

d. Outsourced code development

Here’s why:

Outsourced code development: When UI development or any part of a highly sensitive project is outsourced, there is a potential risk related to the security and integrity of the code. Outsourced developers may not adhere to the same security standards as internal teams, and there is a risk of introducing vulnerabilities, intentional or unintentional, into the codebase. Moreover, the confidentiality and control over sensitive information could be compromised when handled by third parties.

Let’s briefly discuss why the other options are less critical in this specific context:

Weak configurations: While weak configurations are a significant security concern, they are typically managed through proper configuration management and security policies. They are not inherently tied to UI developer agreements but rather to how the system is set up and maintained.

Integration activities: Integration activities are crucial for ensuring that different parts of a system work together seamlessly. However, the primary concern in the context of UI developer agreements and highly sensitive projects is the security of the code itself and the practices of the developers.

Unsecure user accounts: This concern relates to how user accounts are managed and protected, which is crucial for operational security. However, it is more about the implementation and maintenance of security practices rather than the development process and agreements.

Therefore, d. Outsourced code development is the most relevant concern for customers considering the use of these products on highly sensitive projects, as it directly affects the security and integrity of the development process and the final product.

(Braindump: a. Weak configurations)

25
Q

Which of the following identifies the point in time when an organization will recover data in the event of an outage?

a. ALE
b. RPO
c. MTBF
d. ARO

A

b. RPO (Recovery Point Objective)

Here’s why:

Recovery Point Objective (RPO): RPO is the maximum acceptable amount of data loss measured in time. It defines the point in time to which data must be recovered after an outage. For example, if the RPO is 4 hours, the organization needs to ensure that it can recover data from backups that are no older than 4 hours.

Let’s briefly cover what the other options mean and why they are not relevant to identifying the point in time for data recovery:

ALE (Annualized Loss Expectancy): ALE is a risk management metric that represents the expected monetary loss for an asset due to a risk over a year. It is calculated by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO).

MTBF (Mean Time Between Failures): MTBF is a reliability metric that indicates the average time between failures for a system or component. It is used to predict the time between failures during normal operation.

ARO (Annualized Rate of Occurrence): ARO represents the expected frequency with which a specific risk is likely to occur within a year. It is used in risk assessments to calculate the likelihood of an event happening annually.

Therefore, b. RPO is the correct answer as it specifically refers to the point in time when data must be recovered in the event of an outage.

26
Q

A police department is using the cloud to share information with city officials. Which of the following cloud models describes this scenario?

a. Hybrid
b. Private
c. Public
d. Community

A

d. Community

Here’s why:

Community Cloud: A community cloud is a cloud infrastructure that is shared by several organizations with common concerns, such as security, compliance, or mission objectives. In this case, the police department and city officials are part of the same community (e.g., local government agencies) and share common interests and requirements for security, privacy, and data sharing.

Let’s briefly explain why the other options are not suitable:

Hybrid Cloud: A hybrid cloud is a combination of two or more cloud types (private, public, or community) that remain distinct entities but are bound together by standardized technology that enables data and application portability. This scenario specifically describes a shared environment rather than a hybrid setup.

Private Cloud: A private cloud is dedicated to a single organization, offering greater control and security. However, this scenario involves multiple organizations (police department and city officials), making the private cloud model less appropriate.

Public Cloud: A public cloud is owned and operated by a third-party cloud service provider and made available to the general public. This model is not typically used for sensitive government data sharing due to security and privacy concerns.

Therefore, d. Community is the best answer as it accurately describes a shared cloud environment tailored for multiple government entities with common objectives and requirements.

27
Q

A user reports that a bank’s website no longer displays a padlock symbol. A security analyst views the user’s screen and notices the connection is using HTTP instead of HTTPS. Which of the following attacks is most likely occurring?

a. Memory leak
b. SSL stripping
c. API
d. Pass the hash

A

b. SSL stripping

Here’s why:

SSL Stripping: In SSL stripping attacks, an attacker intercepts HTTP traffic between the user and the website, downgrading HTTPS connections to unencrypted HTTP connections. This makes it appear to the user that they are using a secure connection (HTTPS), but in reality, the connection is insecure (HTTP). As a result, the padlock symbol indicating a secure connection (HTTPS) does not appear in the browser.

Let’s briefly cover why the other options are less likely:

Memory leak: A memory leak occurs when a program allocates memory but fails to release it after use, leading to gradual depletion of available memory. It does not affect the display of the padlock symbol in the browser.

API: An API (Application Programming Interface) facilitates communication between software components. It does not directly relate to the display of the padlock symbol or the security of a website connection.

Pass the hash: Pass the hash is a technique used to authenticate to a remote system using the hash of the user's password instead of the plaintext password. It is not directly related to the display of the padlock symbol on a website.

Therefore, b. SSL stripping is the correct answer as it aligns with the behavior where the user sees HTTP instead of HTTPS, indicating that the connection has been downgraded from a secure (HTTPS) to an insecure (HTTP) state by an attacker intercepting the traffic.

28
Q

A data center has experienced an increase in under-voltage events following electrical grid maintenance outside the facility. These events are leading to occasional losses of system availability. Which of the following would be the most cost-effective solution for the data center to implement?

a. Uninterruptible power supplies with battery backup
b. Managed power distribution units to track these events
c. A generator to ensure consistent, normalized power delivery
d. Dual power supplies to distribute the load more evenly

A

a. Uninterruptible power supplies (UPS) with battery backup

Reasoning:

Immediate Power Stabilization: A UPS with battery backup can immediately provide stable power to critical systems during under-voltage events, ensuring continuous operation and preventing system downtime.

Cost-Effectiveness: Compared to generators and dual power supplies, UPS systems are generally more cost-effective for handling short-term power fluctuations. Generators are more suited for longer-term outages and can be significantly more expensive.

Scalability: UPS systems can be scaled to match the needs of the data center, providing flexibility as the data center grows.

Ease of Implementation: Installing UPS units can be straightforward and quickly implemented compared to the complexities and time involved in setting up generators or reconfiguring power supplies.

Generators and dual power supplies might be necessary for more severe power issues or long-term solutions, but for addressing frequent under-voltage events cost-effectively, a UPS with battery backup is the best option.

29
Q

A security architect is designing a remote access solution for a business partner. The business partner needs to access one Linux server at the company. The business partner wants to avoid managing a password for authentication and additional software installation. Which of the following should the architect recommend?

a. Soft token
b. Smart card
c. CSR
d. SSH key

A

d. SSH key

Here’s why:

SSH Key: SSH keys provide a secure and passwordless authentication method for accessing Linux servers remotely. They eliminate the need for managing passwords and additional software installation, which aligns with the business partner's requirement to avoid these complexities. SSH keys use public-key cryptography, where the private key resides on the client side (business partner's computer) and the corresponding public key is added to the authorized_keys file on the Linux server for authentication.

Let’s briefly discuss why the other options are less suitable:

Soft Token: Soft tokens are typically used for two-factor authentication (2FA) and often require additional software installation and management. They also do not eliminate the need for passwords entirely.

Smart Card: Smart cards also provide secure authentication, but they require physical cards and card readers, which may not align with the business partner's desire to avoid additional hardware and software management.

CSR (Certificate Signing Request): A CSR is used in the context of obtaining an SSL/TLS certificate and is not directly related to authentication for accessing a Linux server remotely.

Therefore, d. SSH key is the most appropriate recommendation as it meets the business partner’s requirement for passwordless authentication and avoids the need for additional software installation.

30
Q

A security analyst is assisting a team of developers with best practices for coding. The security analyst would like to defend against the use of SQL injection attacks. Which of the following should the security analyst recommend first?

a. Tokenization
b. Input validation
c. Code signing
d. Secure cookies

A

b. Input validation

Here’s why:

Input Validation: Input validation is the process of ensuring that input data is clean, correct, and useful before it is used in the application. For SQL injection attacks, input validation involves validating and sanitizing user input to ensure that it does not contain malicious SQL commands. Proper input validation prevents attackers from injecting SQL code into input fields that could manipulate database queries.

Let’s briefly discuss why the other options are not as effective or relevant for defending against SQL injection attacks:

Tokenization: Tokenization is a technique used to protect sensitive data by replacing it with unique identification symbols (tokens). While tokenization is important for protecting data at rest or in transit, it does not directly address SQL injection vulnerabilities in code.

Code Signing: Code signing ensures that code has not been altered or corrupted since it was signed by the developer. It helps in verifying the authenticity and integrity of code but does not specifically defend against SQL injection attacks.

Secure Cookies: Secure cookies are used to enhance security by ensuring that cookies are only sent over HTTPS connections and are not accessible to JavaScript. While secure cookies are important for session management and preventing certain types of attacks, they do not directly mitigate SQL injection vulnerabilities.

Therefore, b. Input validation is the first and most fundamental recommendation the security analyst should make to defend against SQL injection attacks. It helps ensure that user input is safe and does not pose a risk of SQL injection when processed by the application.

31
Q

Cloud security engineers are planning to allow and deny access to specific features in order to increase data security. Which of the following cloud features is the most appropriate to ensure access is granted properly?

a. API integrations
b. Auditing
c. Resource policies
d. Virtual networks

A

c. Resource policies

Here’s why:

Resource Policies: Resource policies in cloud environments allow you to define fine-grained permissions and access controls for specific resources. These policies are typically defined using JSON or YAML syntax and can specify who can access the resource, from where, and under what conditions. They are essential for managing access at the resource level and ensuring that access is granted according to security requirements.

Let’s briefly discuss why the other options are less suitable in the context of ensuring proper access control:

API Integrations: API integrations are important for connecting different services and applications within a cloud environment but do not directly ensure access control at the resource level.

Auditing: Auditing is crucial for monitoring and logging access activities to identify security incidents and compliance issues. While auditing provides visibility into access events, it does not enforce access controls or permissions.

Virtual Networks: Virtual networks (VPCs in AWS, VNets in Azure) provide isolated network environments within a cloud provider's infrastructure. They are important for network segmentation and isolation but do not directly manage or enforce access controls at the resource level.

Therefore, c. Resource policies is the most appropriate cloud feature to ensure access is granted properly by allowing you to define and enforce specific access controls and permissions for individual resources within the cloud environment.

32
Q

A security operations technician is searching the log named /var/messages for any events that were associated with a workstation with the IP address 10.1.1.1. Which of the following would provide this information?

a. cat /var/messages | grep 10.1.1.1
b. grep 10.1.1.1 | cat /var/messages
c. grep /var/messages | cat 10.1.1.1
d. cat 10.1.1.1 | grep /var/messages

A

a. cat /var/messages | grep 10.1.1.1

Here’s why:

cat /var/messages: This command displays the contents of the /var/messages log file.
|: This symbol is the pipe operator, which redirects the output of one command (cat /var/messages) as input to another command (grep 10.1.1.1).
grep 10.1.1.1: This command filters the input (which is the content of /var/messages from the previous cat command) and searches for lines that contain the IP address 10.1.1.1.

Therefore, the command cat /var/messages | grep 10.1.1.1 effectively searches through the log file /var/messages for any events associated with the IP address 10.1.1.1 and displays those lines in the terminal.

33
Q

A security analyst is investigating a report from a penetration test. During the penetration test, consultants were able to download sensitive data from a back-end server. The back-end server was exposing an API that should have only been available from the company’s mobile application. After reviewing the back-end server logs, the security analyst finds the following entries:

10.35.45.53 - - [22/May/2020:06:57:31 +0100] “GET /api/client_id=1 HTTP/1.1” 403 1705 “http://www.example.com/api/” “PostmanRuntime/7.26.5”
10.35.45.53 - - [22/May/2020:07:00:58 +0100] “GET /api/client_id=2 HTTP/1.1” 403 1705 “http://www.example.com/api/” “PostmanRuntime/7.26.5”
10.32.40.13 - - [22/May/2020:08:08:52 +0100] “GET /api/client_id=1 HTTP/1.1” 302 21703 “http://www.example.com/api/” “CompanyMobileApp/1.1.1”
10.32.40.25 - - [22/May/2020:08:13:52 +0100] “GET /api/client_id=1 HTTP/1.1” 200 21703 “http://www.example.com/api/” “CompanyMobileApp/2.3.1”
10.35.45.53 - - [22/May/2020:08:20:18 +0100] “GET /api/client_id=2 HTTP/1.1” 200 22405 “http://www.example.com/api/” “CompanyMobileApp/2.3.0”

Which of the following is the most likely cause of the security control bypass?

a. IP address allow list
b. User-agent spoofing
c. WAF bypass
d. Referrer manipulationmaps

A

b. User-agent spoofing

Here’s the reasoning:

User-Agent Spoofing: The User-Agent field in HTTP headers identifies the client making the request (e.g., browser, application). In the logs:
    Requests from the Penetration Testing consultants (IP address 10.35.45.53) using Postman as the User-Agent resulted in a 403 Forbidden response, indicating access was denied.
    However, requests from the Company's Mobile App (User-Agent: "CompanyMobileApp") to the same API endpoint (/api/client_id=1) resulted in a 302 Found and subsequently a 200 OK response, indicating successful access and data retrieval.

This discrepancy suggests that the API was intended to be accessed only from the company’s mobile application (CompanyMobileApp), as indicated by the User-Agent field. The successful responses to requests with the correct User-Agent indicate that the API was configured to allow access based on this header.

Therefore, b. User-agent spoofing is the most likely cause of the security control bypass, where the penetration testing consultants were able to download sensitive data by spoofing the User-Agent header to match that of the legitimate company mobile application. This allowed them to bypass IP restrictions or other security controls that might have been in place.

34
Q

Which of the following processes would most likely help an organization that has conducted an incident response exercise to improve performance and identify challenges?

a. Lessons learned
b. Identification
c. Simulation
d. Containment

A

a. Lessons learned

Here’s why:

Lessons Learned: This phase involves a comprehensive review and analysis of the incident response exercise, focusing on what worked well, what didn't, and areas for improvement. It includes gathering feedback from participants, documenting observations, and identifying actionable insights to enhance the incident response process in the future. By conducting a lessons learned session, organizations can refine their incident response procedures, update policies, improve coordination among teams, and address any gaps or weaknesses identified during the exercise.

Let’s briefly discuss why the other options are less suitable in this context:

Identification: While identification is a crucial step in incident response (specifically in understanding the nature and scope of an incident), it does not directly address the post-exercise review and improvement process.

Simulation: Simulation refers to the act of creating a realistic scenario to test incident response capabilities. While simulations are valuable for training and testing readiness, they are part of the exercise itself rather than the post-exercise improvement phase.

Containment: Containment is an immediate action taken during incident response to prevent further spread or damage caused by the incident. It focuses on stopping the incident from escalating rather than on post-exercise improvements.

Therefore, a. Lessons learned is the process that would most likely help an organization after conducting an incident response exercise to improve performance, refine procedures, and identify challenges for future incident response readiness.

35
Q

Which of the following control types is patch management classified under?

a. Deterrent
b. Physical
c. Corrective
d. Detective

A

c. Corrective

Here’s why:

Corrective Controls: These controls are designed to mitigate or remediate vulnerabilities or incidents that have been identified. Patch management falls under this category because it involves the process of identifying, acquiring, testing, and applying patches (software updates) to systems and applications to correct vulnerabilities and ensure they are up-to-date and secure.

Deterrent Controls: These controls are aimed at discouraging potential attackers and preventing incidents from occurring.

Physical Controls: These controls include physical security measures such as locks, fences, and security guards.

Detective Controls: These controls are focused on detecting incidents or anomalies that have already occurred or are ongoing.

Therefore, c. Corrective is the correct classification for patch management, as it addresses the correction of vulnerabilities through timely application of patches to software and systems.

36
Q

A security analyst is investigating what appears to be unauthorized access to a corporate web application. The security analyst reviews the web server logs and finds the flowing entries:

106.35.45.53 - - [22/May/2020:07:00:58 +0100] “GET /login?username=admin&pin=0000 HTTP/1.1” 200 11705 “http://www.example.com/login.php”
106.35.45.53 - - [22/May/2020:07:01:21 +0100] “GET /login?username=admin&pin=0001 HTTP/1.1” 200 11705 “http://www.example.com/login.php”
106.35.45.53 - - [22/May/2020:07:01:52 +0100] “GET /login?username=admin&pin=0002 HTTP/1.1” 200 11705 “http://www.example.com/login.php”
106.35.45.53 - - [22/May/2020:07:02:18 +0100] “GET /login?username=admin&pin=0003 HTTP/1.1” 200 11705 “http://www.example.com/login.php”
106.35.45.53 - - [22/May/2020:07:02:18 +0100] “GET /login?username=admin&pin=0004 HTTP/1.1” 200 11705 “http://www.example.com/login.php”

Which of the following password attacks is taking place?

a. Dictionary
b. Brute-force
c. Rainbow table
d. Spraying

A

b. Brute-force

Here’s why:

Brute-force Attack: In a brute-force attack, an attacker systematically tries all possible combinations of passwords or PINs until the correct one is found. In this case, the attacker is attempting to log in as the admin user by sequentially trying different PINs (0000, 0001, 0002, etc.) through repeated GET requests to the /login endpoint with different PIN values.

Web Server Logs: The logs show multiple sequential requests with different PIN values (pin=0000, pin=0001, pin=0002, etc.) for the admin user. Each request results in a 200 OK response, indicating that the server is accepting these requests and responding with the login page.

Other Options:
    Dictionary Attack: In a dictionary attack, the attacker uses a predefined list of common passwords or phrases, which is not evident from the logs as each PIN is sequentially attempted.
    Rainbow Table Attack: Rainbow tables are precomputed tables used for reversing cryptographic hash functions to crack passwords, which is not indicated by the direct sequential attempts in the logs.
    Spraying Attack: Password spraying involves trying a small number of commonly used passwords against many accounts, rather than trying many passwords against a single account.

Therefore, based on the evidence provided in the logs, the attack is best described as a brute-force attack, where the attacker is systematically attempting different PINs to gain unauthorized access to the admin account of the web application.

37
Q

A company that provides an online streaming service made its customers’ personal data, including names and email addresses, publicly available in a cloud storage service. As a result, the company experienced an increase in the number of requests to delete user accounts. Which of the following BEST describes the consequence of this data disclosure?

a. Regulatory fines
b. Reputation damage
c. Increased insurance costs
d. Financial loss

A

b. Reputation damage

Here’s why:

Reputation Damage: Exposing customers' personal data can severely damage the company's reputation. Customers may lose trust in the company's ability to protect their sensitive information, leading to negative publicity, social media backlash, and a decline in customer confidence. This can impact customer retention and future customer acquisition efforts.

While regulatory fines could also potentially apply depending on data protection laws violated and jurisdiction, and there might be some financial loss due to legal costs or compensation, reputation damage is typically the most immediate and significant consequence in such scenarios. It directly affects customer perception and trust in the company’s brand.

Therefore, b. Reputation damage is the best description of the consequence resulting from the data disclosure incident described.

38
Q

An organization has been experiencing outages during holiday sales and needs to ensure availability of its point-of-sale systems. The IT administrator has been asked to improve both server-data fault tolerance and site availability under high consumer load. Which of the following are the best options to accomplish this objective? (Choose two.)

a. Load balancing
b. Incremental backups
c. UPS
d. RAID
e. Dual power supply
f. VLAN

A

a. Load balancing: Load balancing distributes incoming network traffic across multiple servers. This helps optimize resource utilization, maximize throughput, minimize response time, and ensure that no single server is overwhelmed. It improves fault tolerance by redirecting traffic away from servers that may be experiencing issues or high loads, thereby maintaining availability.

d. RAID (Redundant Array of Independent Disks): RAID is a data storage virtualization technology that combines multiple physical disk drive components into one or more logical units for the purposes of data redundancy, performance improvement, or both. RAID levels like RAID 1 (mirroring) or RAID 5 (striping with parity) provide fault tolerance against disk failures, ensuring data availability even if one or more disks fail.

Here’s why the other options are less suitable in this context:

Incremental backups: While backups are important for data recovery, they do not directly address fault tolerance or availability during peak loads.

UPS (Uninterruptible Power Supply) and Dual power supply: These address power availability and stability, which are important but do not directly improve fault tolerance or availability of point-of-sale systems under high consumer load.

VLAN (Virtual Local Area Network): VLANs are used to logically segment a network, improving security and management, but they do not directly improve fault tolerance or availability of servers during peak loads.

Therefore, a. Load balancing and d. RAID are the best options to accomplish the objective of improving server-data fault tolerance and site availability under high consumer load for the organization.

39
Q

Which of the following can be used to detect a hacker who is stealing company data over port 80?

a. Web application scan
b. Threat intelligence
c. Log aggregation
d. Packet capture

A

d. Packet capture

Packet capture (option d) involves capturing and analyzing network traffic, which can help detect unauthorized activities such as data theft over port 80. Port 80 is commonly used for HTTP traffic, and by capturing packets, one can inspect the data being transmitted to identify suspicious patterns or anomalies indicative of a hacker stealing company data.

40
Q

A company recently enhanced mobile device configuration by implementing a set of security controls biometrics context-aware authentication and full device encryption. Even with these settings in place, an unattended phone was used by a malicious actor to access corporate data. Which of the following additional controls should be put in place first?

a. GPS tagging
b. Remote wipe
c. Screen lock timer
d. SEAndroid

A

c. Screen lock timer

Reasoning:

Immediate Protection: A screen lock timer will ensure that the phone automatically locks itself after a short period of inactivity, reducing the window of opportunity for an unauthorized person to access the device.

Complement Existing Controls: While biometrics, context-aware authentication, and full device encryption are excellent security measures, they rely on the device being locked to be effective. A screen lock timer ensures these controls are in play by locking the device when it's not in use.

User-Friendly: This control can be implemented without significant inconvenience to users, making it a practical first step in enhancing security.

Prevents Unauthorized Access: By locking the screen quickly when the phone is not actively used, it reduces the risk of someone picking up an unattended phone and gaining immediate access to corporate data.

While options like remote wipe (b) and GPS tagging (a) are useful for other security scenarios, they are more reactive measures rather than preventive. SEAndroid (d) provides a secure environment but won’t prevent access if the device is already unlocked. Therefore, implementing a screen lock timer is the most effective immediate step.

41
Q

An organization wants to quickly assess how effectively the IT team hardened new laptops. Which of the following would be the best solution to perform this assessment?

a. Install a SIEM tool and properly configure it to read the OS configuration files
b. Load current baselines into the existing vulnerability scanner
c. Maintain a risk register with each security control marked as compliant or non-compliant
d. Manually review the secure configuration guide checklists

A

b. Load current baselines into the existing vulnerability scanner

Loading current baselines into the existing vulnerability scanner (option b) is the best solution for quickly assessing how effectively the IT team has hardened new laptops. Here’s why:

Automated Assessment: Vulnerability scanners can quickly and automatically check the configuration of the laptops against the loaded baselines, providing a comprehensive and efficient assessment.
Consistency: Using a baseline ensures that all laptops are evaluated against the same standards, providing consistent results.
Speed: Automated scans are much faster than manual reviews, allowing for rapid assessment and identification of any deviations from the desired security posture.

Now, let’s examine the potential shortcomings of the other options:

a. Install a SIEM tool and properly configure it to read the OS configuration files:

Explanation: SIEM (Security Information and Event Management) tools aggregate and analyze security data from various sources to detect and respond to threats.
Potential Shortcomings: While SIEM tools are powerful for monitoring and detecting security incidents, they are not specifically designed for assessing hardening configurations. Properly configuring a SIEM tool to read OS configuration files can be complex and time-consuming, making it less suitable for a quick assessment.

c. Maintain a risk register with each security control marked as compliant or non-compliant:

Explanation: A risk register is a document used to identify and assess risks, and track the status of security controls.
Potential Shortcomings: Maintaining a risk register involves manual updates and does not provide an automated or rapid assessment of the current state of the laptops. It is more useful for ongoing risk management rather than immediate hardening assessments.

d. Manually review the secure configuration guide checklists:

Explanation: Manually reviewing checklists involves going through secure configuration guides to verify that each hardening step has been implemented.
Potential Shortcomings: Manual reviews are time-consuming and prone to human error. They are not efficient for quickly assessing multiple laptops and may miss some configuration details.

Therefore, option b (loading current baselines into the existing vulnerability scanner) is the most effective and efficient solution for quickly assessing the hardening of new laptops.

42
Q

A user is trying to upload a tax document which the corporate finance department requested but a security program is prohibiting the upload. A security analyst determines the file contains PII. Which of the following steps can the analyst take to correct this issue?

a. Create a URL filter with an exception for the destination website
b. Add a firewall rule to the outbound proxy to allow file uploads
c. Issue a new device certificate to the user’s workstation
d. Modify the exception list on the DLP to allow the upload

A

d. Modify the exception list on the DLP to allow the upload

Modifying the exception list on the Data Loss Prevention (DLP) system to allow the upload (option d) is the appropriate step to take in this scenario. Here’s why:

Context-Specific Exception: DLP systems are designed to prevent sensitive information, such as Personally Identifiable Information (PII), from being transmitted inappropriately. In this case, the upload is a legitimate request from the corporate finance department, so making an exception for this specific context ensures that the necessary document can be uploaded while maintaining overall security.
Granular Control: By modifying the exception list, the security analyst can allow the specific document or a specific type of document to be uploaded without broadly weakening security controls.
Minimal Disruption: This approach addresses the immediate issue without making broader changes to network or security configurations that could have unintended consequences.

Now, let’s examine the potential shortcomings of the other options:

a. Create a URL filter with an exception for the destination website:

Explanation: A URL filter exception would allow access to a specific website.
Potential Shortcomings: This does not address the underlying issue of the DLP system blocking the upload due to the presence of PII in the document. It might allow access to the website but would not permit the upload if the DLP is still in place.

b. Add a firewall rule to the outbound proxy to allow file uploads:

Explanation: A firewall rule could be added to allow file uploads to a specific destination.
Potential Shortcomings: This might bypass some security controls but does not specifically address the DLP system's detection of PII. It could also open broader security risks by allowing other uploads that should be blocked.

c. Issue a new device certificate to the user’s workstation:

Explanation: Issuing a new device certificate might be used for authentication or encryption purposes.
Potential Shortcomings: This does not directly address the issue of the DLP system blocking the upload. Changing the device certificate is unlikely to resolve the problem of PII detection and would not affect the DLP policy.

Therefore, the best approach to resolve the issue while maintaining security controls is to modify the exception list on the DLP system to allow the upload of the specific tax document requested by the corporate finance department.

43
Q

A cybersecurity analyst at Company A is working to establish a secure communication channel with a counterpart at Company B, which is 3,000 miles (4,828 kilometers) away. Which of the following concepts would help the analyst meet this goal in a secure manner?

a. Digital signatures
b. Key exchange
c. Salting
d. PPTP

A

(Community : B 100%)
Key exchange is a concept in cryptography that involves the secure exchange of cryptographic keys between two parties to establish a secure communication channel. This process involves using a secure algorithm to exchange keys without exposing them to eavesdropping or interception.

ChatGPT :
b. Key exchange

Key exchange (option b) is a fundamental concept in establishing a secure communication channel. It involves securely exchanging cryptographic keys between parties, allowing them to encrypt and decrypt messages. Here’s why key exchange is essential in this context:

Secure Communication: Key exchange ensures that both parties have the necessary keys to encrypt and decrypt communications, thereby maintaining confidentiality and integrity.
Foundation for Encryption: Effective encryption relies on secure key exchange mechanisms, such as Diffie-Hellman or RSA, to securely share keys over an insecure channel.

Let’s review the potential shortcomings of the other options:

a. Digital signatures:

Explanation: Digital signatures provide a way to verify the authenticity and integrity of a message, ensuring that it has not been tampered with and that it was sent by a verified sender.
Potential Shortcomings: While digital signatures are important for verifying authenticity and integrity, they do not establish the encryption keys necessary for secure communication.

c. Salting:

Explanation: Salting involves adding random data to inputs of hash functions, primarily used to securely store passwords and prevent dictionary attacks.
Potential Shortcomings: Salting is not relevant to establishing secure communication channels, as it is primarily used for enhancing the security of stored passwords.

d. PPTP (Point-to-Point Tunneling Protocol):

Explanation: PPTP is a method for implementing virtual private networks (VPNs).
Potential Shortcomings: While PPTP can create secure communication channels, it is considered outdated and has known vulnerabilities. More secure alternatives, such as OpenVPN or IPsec, are preferred for establishing secure connections.

Therefore, key exchange (option b) is the most appropriate concept to help the analyst establish a secure communication channel between Company A and Company B.

44
Q

A security analyst is reviewing computer logs because a host was compromised by malware. After the computer was infected it displayed an error screen and shut down. Which of the following should the analyst review first to determine more information?

a. Dump file
b. System log
c. Web application log
d. Security log

A

a. Dump file

Reviewing the dump file (option a) should be the first step for the analyst in this scenario. Here’s why:

Detailed Information: A dump file, often created when a system crashes, contains detailed information about the state of the system at the time of the crash. It includes memory contents, running processes, and other relevant data that can help identify the cause of the error and the nature of the malware.
Crash Analysis: Since the computer displayed an error screen and then shut down, the dump file is likely to contain critical information about what happened immediately before and during the crash, which is essential for diagnosing the issue.

Let’s review the potential shortcomings of the other options:

b. System log:

Explanation: The system log contains records of system events and messages, such as system startup and shutdown, service failures, and hardware changes.
Potential Shortcomings: While the system log can provide useful information about general system events, it may not have the detailed state information necessary to diagnose the cause of a crash resulting from malware.

c. Web application log:

Explanation: Web application logs record events related to web applications, such as user access, errors, and application-specific activities.
Potential Shortcomings: Web application logs are unlikely to contain relevant information about the system crash or the malware infection unless the malware specifically targeted a web application.

d. Security log:

Explanation: Security logs contain records of security-related events, such as login attempts, access control changes, and other security-related activities.
Potential Shortcomings: While security logs are important for understanding unauthorized access and other security incidents, they may not provide the detailed crash-related information available in the dump file.

Therefore, the dump file (option a) is the most appropriate choice for the analyst to review first to determine more information about the malware infection and subsequent system crash.

45
Q

A security architect is working on an email solution that will send sensitive data. However, funds are not currently available in the budget for building additional infrastructure. Which of the following should the architect choose?

a. POP
b. IPSec
c. IMAP
d. PGP

A

d. PGP

PGP (Pretty Good Privacy) is the most appropriate choice for the security architect in this scenario. Here’s why:

Encryption: PGP provides strong encryption for email content, ensuring that sensitive data is protected when sent via email.
No Additional Infrastructure Needed: PGP can be implemented without the need for additional infrastructure. It is software-based and can be integrated with existing email systems.
End-to-End Security: PGP offers end-to-end encryption, meaning that the data is encrypted on the sender's device and remains encrypted until it is decrypted by the intended recipient.

Let’s review the potential shortcomings of the other options:

a. POP (Post Office Protocol):

Explanation: POP is a protocol used to retrieve email from a mail server.
Potential Shortcomings: POP does not provide encryption for email content. It is primarily concerned with downloading emails from a server to a client and does not address the need for secure transmission of sensitive data.

b. IPSec (Internet Protocol Security):

Explanation: IPSec is a suite of protocols used to secure Internet Protocol (IP) communications by authenticating and encrypting each IP packet in a communication session.
Potential Shortcomings: While IPSec provides robust security for network traffic, it requires configuration and infrastructure support, such as VPNs. It is not specifically designed for securing email content and may involve additional complexity and cost.

c. IMAP (Internet Message Access Protocol):

Explanation: IMAP is a protocol used to retrieve email messages from a mail server.
Potential Shortcomings: Like POP, IMAP does not provide encryption for email content. It is designed for accessing and managing emails on a mail server, not for securing the transmission of sensitive data.

Therefore, PGP (option d) is the best choice for sending sensitive data via email without requiring additional infrastructure and while providing strong encryption to ensure data security.

46
Q

A user reset the password for a laptop but has been unable to log in to it since then. In addition, several unauthorized emails were sent on the user’s behalf recently. The security team investigates the issue and identifies the following findings:

*Firewall logs show excessive traffic from the laptop to an external site.
*Unknown processes were running on the laptop.
*RDP connections that appeared to be authorized were made to other network devices from the laptop.
*High bandwidth utilization alerts from that user’s username.

Which of the following is most likely installed on the laptop?

a. Worm
b. Keylogger
c. Trojan
d. Logic bomb

A

c. Trojan

A Trojan is the most likely type of malware installed on the laptop based on the findings. Here’s why:

Excessive Traffic: Trojans often communicate with external sites to exfiltrate data or receive commands from a remote attacker.
Unknown Processes: Trojans typically run unknown or unauthorized processes as part of their malicious activities.
RDP Connections: Trojans can be used to establish remote access to compromised devices, allowing attackers to move laterally within the network.
High Bandwidth Utilization: This could indicate data exfiltration or other malicious activities orchestrated by the Trojan.

Let’s review the potential shortcomings of the other options:

a. Worm:

Explanation: A worm is a type of malware that replicates itself to spread to other devices, often consuming network resources.
Potential Shortcomings: While worms can cause high bandwidth utilization, they typically do not focus on unauthorized RDP connections or exfiltrating data to external sites.

b. Keylogger:

Explanation: A keylogger records keystrokes to capture sensitive information like passwords.
Potential Shortcomings: Keyloggers do not usually generate excessive traffic, run unknown processes, or make RDP connections. Their primary function is to capture and report keystrokes.

d. Logic Bomb:

Explanation: A logic bomb is a piece of code intentionally inserted into software that triggers a malicious function when certain conditions are met.
Potential Shortcomings: Logic bombs are generally designed to execute specific malicious actions under predefined conditions. They do not typically account for continuous unauthorized activity like excessive traffic or RDP connections.

Therefore, a Trojan (option c) is the most plausible explanation for the observed behaviors on the compromised laptop.

47
Q

A systems administrator is required to enforce MFA for corporate email account access, relying on the possession factor. Which of the following authentication methods should the systems administrator choose? (Choose two.)

a. Passphrase
b. Time-based one-time password
c. Facial recognition
d. Retina scan
e. Hardware token
f. Fingerprints

A

b. Time-based one-time password
e. Hardware token

Both time-based one-time passwords (TOTP) and hardware tokens are examples of possession factors used in multi-factor authentication (MFA). Here’s why these options are appropriate:

Time-based one-time password (TOTP): TOTP generates a unique, temporary code that users must provide, typically through an app on a mobile device. This code changes every few seconds and can only be accessed by someone who possesses the device where the app is installed.
Hardware token: A hardware token is a physical device that generates or stores authentication codes. Users must have the physical token to authenticate, which serves as the possession factor.

Now, let’s review why the other options are not suitable for the possession factor:

a. Passphrase:

Explanation: A passphrase is a knowledge factor (something the user knows), not a possession factor.
Suitability: Does not meet the requirement for a possession factor in MFA.

c. Facial recognition:

Explanation: Facial recognition is a biometric factor (something the user is), not a possession factor.
Suitability: Does not meet the requirement for a possession factor in MFA.

d. Retina scan:

Explanation: A retina scan is also a biometric factor.
Suitability: Does not meet the requirement for a possession factor in MFA.

f. Fingerprints:

Explanation: Fingerprints are another form of biometric authentication.
Suitability: Does not meet the requirement for a possession factor in MFA.

Therefore, the systems administrator should choose time-based one-time password (TOTP) and hardware token to enforce MFA relying on the possession factor for corporate email account access.

48
Q

Which of the following best describes a technique that compensates researchers for finding vulnerabilities?

a. Penetration testing
b. Code review
c. Wardriving
d. Bug bounty

A

d. Bug bounty

A bug bounty program is a technique that compensates researchers (often referred to as ethical hackers or security researchers) for finding and reporting vulnerabilities in a company’s software, systems, or applications. Here’s why:

Incentive for Discovery: Bug bounty programs offer monetary rewards or other forms of compensation to researchers who responsibly disclose security flaws.
Crowdsourced Security: By engaging a wide community of researchers, companies can leverage diverse skill sets and perspectives to identify vulnerabilities that might be missed by internal teams.
Responsible Disclosure: These programs encourage researchers to report vulnerabilities directly to the company, allowing them to address the issues before they can be exploited maliciously.

Let’s review the other options:

a. Penetration testing:

Explanation: Penetration testing involves hiring security professionals to simulate attacks on a system to identify vulnerabilities.
Compensation Aspect: While penetration testers are compensated, it is usually for their services rather than specific vulnerabilities they find. This is typically a contracted service, not an open incentive program.

b. Code review:

Explanation: Code review is the process of systematically examining source code to find and fix vulnerabilities.
Compensation Aspect: Code reviews are often conducted by internal teams or hired consultants as part of the development process, not through an open incentive program for vulnerability discovery.

c. Wardriving:

Explanation: Wardriving involves searching for Wi-Fi networks, often for the purpose of identifying unsecured networks.
Compensation Aspect: Wardriving is not a technique that involves compensating researchers for finding vulnerabilities. It is typically associated with network reconnaissance rather than a structured, compensatory vulnerability discovery program.

Therefore, bug bounty (option d) best describes a technique that compensates researchers for finding vulnerabilities.

49
Q

Which of the following biometric authentication methods is the most accurate?

a. Gait
b. Retina
c. Signature
d. Voice

A

b. Retina

Retina scanning is considered one of the most accurate biometric authentication methods. Here’s why:

High Precision: Retina scans analyze the unique pattern of blood vessels in the retina, which is highly specific to each individual.
Low False Acceptance Rate (FAR): Retina scanning has a very low rate of false positives, meaning it is highly reliable in correctly identifying individuals.
Security: Since the retina is located inside the eye and not easily visible or replicable, it is less susceptible to spoofing or other forms of biometric fraud.

Let’s review the other options and their relative accuracy:

a. Gait:

Explanation: Gait analysis involves identifying individuals based on their walking pattern.
Accuracy: While unique to individuals, gait can be influenced by various factors such as footwear, injuries, and changes in walking surface, making it less accurate compared to retina scanning.

c. Signature:

Explanation: Signature recognition involves analyzing the way a person signs their name.
Accuracy: Signatures can vary significantly even for the same person due to factors like speed, mood, and pressure, leading to lower accuracy compared to retina scanning.

d. Voice:

Explanation: Voice recognition analyzes vocal characteristics to identify individuals.
Accuracy: Voice can be affected by illness, background noise, and intentional alteration, making it less reliable than retina scanning.

Therefore, retina scanning (option b) is the most accurate biometric authentication method among the options listed.

50
Q

A security team will be outsourcing several key functions to a third party and will require that:

*Several of the functions will carry an audit burden
*Attestations will be performed several times a year
*Reports will be generated on a monthly basis

Which of the following best describes the document that is used to define these requirements and stipulate how and when they are performed by the third party?

a. MOU
b. AUP
c. SLA
d. MSA

A

c. SLA (Service Level Agreement)

An SLA (Service Level Agreement) is the best document to define the requirements and stipulate how and when the outsourced functions will be performed by the third party. Here’s why:

Service Commitments: An SLA details the specific services to be provided, the standards and performance metrics that must be met, and the responsibilities of both parties.
Audit Burden: SLAs can include provisions for audit requirements, ensuring that the third party adheres to regulatory and compliance standards.
Attestations: SLAs can stipulate how often and in what manner attestations are to be performed.
Reporting: SLAs typically include schedules for regular reporting, such as monthly reports, to ensure transparency and accountability.

Let’s review the potential shortcomings of the other options:

a. MOU (Memorandum of Understanding):

Explanation: An MOU is a non-binding agreement that outlines the intentions and terms of a mutual understanding between parties.
Shortcomings: MOUs are generally not as detailed or enforceable as SLAs and may lack specific performance metrics and audit requirements.

b. AUP (Acceptable Use Policy):

Explanation: An AUP defines acceptable and unacceptable use of company resources and services.
Shortcomings: An AUP is not used to define service levels or audit requirements. It is focused on user behavior and compliance with internal policies.

d. MSA (Master Service Agreement):

Explanation: An MSA is a contract that outlines the overall terms and conditions governing the relationship between two parties over multiple projects or services.
Shortcomings: While an MSA provides a broad framework, it usually does not include the detailed performance metrics, audit schedules, and reporting requirements that are typically found in an SLA.

Therefore, the SLA (Service Level Agreement) is the most appropriate document to define the specific requirements and stipulate how and when the outsourced functions will be performed by the third party.