51-100 Flashcards

1
Q

Which of the following organizations sets frameworks and controls for optimal security configuration on systems?

a. ISO
b. GDPR
c. PCI DSS
d. NIST

A

d. NIST (National Institute of Standards and Technology)

Explanation:

NIST: NIST is a non-regulatory federal agency within the United States Department of Commerce. It develops and publishes standards, guidelines, and best practices for various areas, including cybersecurity and information security. Specifically, NIST Special Publication 800-53 provides a comprehensive set of security controls for federal information systems and organizations that need to adhere to federal regulations and guidelines.

Here’s a brief overview of the other options:

a. ISO (International Organization for Standardization): ISO publishes various standards, including those related to information security (e.g., ISO/IEC 27001), but it does not specifically focus on setting detailed frameworks and controls for optimal security configuration on systems.

b. GDPR (General Data Protection Regulation): GDPR is a regulation in EU law on data protection and privacy for all individuals within the European Union and the European Economic Area. It primarily focuses on personal data protection and privacy, not on security configuration standards for systems.

c. PCI DSS (Payment Card Industry Data Security Standard): PCI DSS is a set of security standards designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment. While it includes specific requirements for securing systems that handle payment card information, it does not cover all aspects of general security configuration for systems.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

An organization discovered files with proprietary financial data have been deleted. The files have been recovered from backup, but every time the Chief Financial Officer logs in to the file server, the same files are deleted again. No other users are experiencing this issue. Which of the following types of malware is MOST likely causing this behavior?

a. Logic bomb
b. Cryptomalware
c. Spyware
d. Remote access Trojan

A

a. Logic bomb

Explanation:

Logic bomb: A logic bomb is a type of malware that is typically set to execute or trigger upon a specific condition or event. In this case, it appears to trigger whenever the Chief Financial Officer logs in to the file server. The logic bomb could be programmed to delete specific files each time this event occurs, which explains why the files keep getting deleted even after they are restored from backup.

Here’s why the other options are less likely:

b. Cryptomalware: Cryptomalware (or ransomware) typically encrypts files to extort money from victims, rather than simply deleting them repeatedly. It doesn't usually target specific files repeatedly after restoration.

c. Spyware: Spyware is designed to gather information covertly and send it to an external entity. It is not typically associated with behavior where files are deleted upon a specific user's login.

d. Remote access Trojan (RAT): RATs provide unauthorized remote access to a computer system. While they can be used to perform various malicious actions, including file manipulation, the scenario described (specific files being deleted upon the CFO's login) aligns more closely with the characteristics of a logic bomb.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

A security analyst has identified malware spreading through the corporate network and has activated the CSIRT. Which of the following should the analyst do NEXT?

a. Review how the malware was introduced to the network.
b. Attempt to quarantine all infected hosts to limit further spread.
c. Create help desk tickets to get infected systems reimaged.
d. Update all endpoint antivirus solutions with the latest updates.

A

b. Attempt to quarantine all infected hosts to limit further spread.

Explanation:

Quarantine infected hosts: This step is crucial to prevent the malware from spreading further within the network. By isolating or quarantining infected hosts, the analyst can contain the impact and prevent the malware from infecting additional systems or accessing sensitive data.

Here’s why the other options are not the immediate next step:

a. Review how the malware was introduced to the network: While investigating the initial infection vector is important for understanding the attack's root cause and preventing future incidents, it is not the immediate action needed to mitigate the current spread of the malware.

c. Create help desk tickets to get infected systems reimaged: Reimaging infected systems is part of the remediation process, but it should follow containment efforts. Reimaging typically requires coordination and verification, which may take time and should not delay containment efforts.

d. Update all endpoint antivirus solutions with the latest updates: Updating antivirus solutions is important for improving detection and prevention capabilities against known threats. However, during an active malware outbreak, containing the spread takes priority over updating antivirus signatures.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

During an incident response, an analyst applied rules to all inbound traffic on the border firewall and implemented ACLs on each critical server. Following an investigation, the company realizes it is still vulnerable because outbound traffic is not restricted, and the adversary is able to maintain a presence in the network.
In which of the following stages of the Cyber Kill Chain is the adversary currently operating?

a. Reconnaissance
b. Command and control
c. Actions on objective
d. Exploitation

A

b. Command and control

Explanation:

Command and control (C2): In the Cyber Kill Chain, the command and control phase involves the adversary establishing communication channels and maintaining control over compromised systems within the network. Even though inbound traffic rules and server ACLs were implemented to defend against initial intrusion attempts (which would typically fall under exploitation), the fact that the adversary still maintains a presence suggests they have successfully established control mechanisms to communicate outbound from compromised systems back to their command infrastructure.

Here’s why the other options are not correct in this context:

a. Reconnaissance: Reconnaissance involves gathering information about the target network and identifying potential vulnerabilities or entry points. While reconnaissance precedes exploitation, the scenario describes a situation where the adversary has already breached the network and is actively maintaining control.

c. Actions on objective: Actions on objective involve the adversary achieving their goals, such as exfiltrating data or disrupting operations. While the adversary may eventually progress to this stage, the scenario indicates that they are currently focused on maintaining their presence through command and control.

d. Exploitation: Exploitation involves the initial compromise of systems or networks. While this may have occurred earlier in the attack lifecycle, the current focus is on the ongoing control and persistence within the network, which aligns more closely with the command and control phase.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

A recent security breach exploited software vulnerabilities in the firewall and within the network management solution. Which of the following will MOST likely be used to identify when the breach occurred through each device?

a. SIEM correlation dashboards
b. Firewall syslog event logs
c. Network management solution login audit logs
d. Bandwidth monitors and interface sensors

A

a. SIEM correlation dashboards

Explanation:

SIEM (Security Information and Event Management) correlation dashboards: SIEM systems collect and correlate logs from various sources, including firewalls and network management solutions. They provide a centralized platform to analyze and correlate events across the network and security infrastructure. In the context of a security breach that exploited vulnerabilities in these devices, SIEM correlation dashboards can help identify suspicious activities, anomalies, or specific events that indicate the breach.

Here’s why the other options are less likely to be used for identifying when the breach occurred:

b. Firewall syslog event logs: Firewall syslog event logs are useful for monitoring and analyzing firewall activities, such as traffic allowed or denied, but they may not provide comprehensive visibility into broader network management vulnerabilities or correlated events across different devices.

c. Network management solution login audit logs: While login audit logs from the network management solution are important for tracking user access and activities within the management system, they may not directly correlate with the exploitation of vulnerabilities in the firewall or network devices themselves.

d. Bandwidth monitors and interface sensors: Bandwidth monitors and interface sensors primarily monitor network traffic and performance metrics, such as bandwidth utilization and interface status. They are useful for network performance monitoring but typically do not provide the detailed event data needed to identify specific software vulnerabilities being exploited.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which of the following is the FIRST environment in which proper, secure coding should be practiced?

a. Stage
b. Development
c. Production
d. Test

A

b. Development

Explanation:

Development: Secure coding practices should be integrated into the development phase of software or application lifecycle. This ensures that security considerations are addressed from the beginning of the development process. Developers should follow secure coding guidelines and practices to minimize vulnerabilities and reduce the risk of introducing security flaws into the software.

Here’s why the other options are less suitable:

a. Stage: The stage environment typically comes after development and is used for testing the application in an environment that closely mirrors production. While security testing and validation should occur in stage environments, secure coding practices should ideally be implemented earlier during development.

c. Production: Production environments are where the live application or software is deployed and used by end-users. Secure coding practices should ideally prevent vulnerabilities from reaching production, as addressing security flaws at this stage can be more costly and risky.

d. Test: While testing is crucial for identifying and validating software functionality and security, including security testing (e.g., penetration testing, vulnerability scanning), secure coding should ideally be applied during development to prevent vulnerabilities from being introduced in the first place.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

A cloud service provider has created an environment where customers can connect existing local networks to the cloud for additional computing resources and block internal HR applications from reaching the cloud. Which of the following cloud models is being used?

a. Public
b. Community
c. Hybrid
d. Private

A

c. Hybrid

Explanation:

Hybrid cloud: In a hybrid cloud environment, organizations integrate their on-premises infrastructure (local networks in this case) with cloud services, allowing them to extend their capabilities and leverage cloud resources while maintaining control over sensitive data or applications that need to remain on-premises. In this scenario, the organization is selectively choosing which applications (in this case, internal HR applications) are allowed to access the cloud resources.

Here’s why the other options are not correct:

a. Public cloud: A public cloud model involves cloud services provided over the public internet, where resources are shared among multiple customers. It does not typically involve direct integration with on-premises networks or the ability to selectively block specific applications from accessing cloud resources.

b. Community cloud: A community cloud is a cloud infrastructure shared by several organizations with similar computing concerns (e.g., regulatory requirements). It does not inherently involve integration with existing on-premises networks as described in the scenario.

d. Private cloud: A private cloud is dedicated to a single organization and can be located on-premises or off-premises. While it offers more control and security, it does not typically involve the integration of existing local networks with external cloud resources as described in the scenario.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

An organization has developed an application that needs a patch to fix a critical vulnerability. In which of the following environments should the patch be deployed LAST?

a. Test
b. Staging
c. Development
d. Production

A

d. Production environment.

Explanation:

Production: The production environment is where the live application or software is accessed and used by end-users. Deploying patches directly to production without adequate testing in lower environments (such as test, staging, and development) can pose significant risks. These risks include introducing new issues, disrupting service availability, or causing downtime for users.

Here’s why the other options are not correct:

a. Test: The test environment is used to conduct functional testing, integration testing, and security testing of the application. Patches are typically deployed here first to verify that they do not introduce new issues or conflicts with existing functionality.

b. Staging: The staging environment closely mirrors the production environment and is used for final testing before deployment to production. Patches are deployed here to validate their effectiveness and ensure they do not cause issues when applied to the actual production environment.

c. Development: The development environment is where changes to the application are initially made and tested by developers. Patches may be developed and tested here first, but they should undergo thorough testing in higher environments (test, staging) before being deployed to production.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

An organization is building backup server rooms in geographically diverse locations. The Chief Information Security Officer implemented a requirement on the project that states the new hardware cannot be susceptible to the same vulnerabilities in the existing server room. Which of the following should the systems engineer consider?

a. Purchasing hardware from different vendors
b. Migrating workloads to public cloud infrastructure
c. Implementing a robust patch management solution
d. Designing new detective security controls

A

a. Purchasing hardware from different vendors

Here’s why:

Avoiding Single Points of Failure: By purchasing hardware from different vendors, the organization reduces the risk that the same vulnerabilities will affect both the existing and new server rooms. Different vendors may use different hardware and software components, which can diversify the risk landscape.
Vendor-Specific Vulnerabilities: Different hardware vendors have unique design and implementation processes. This means that a vulnerability found in one vendor's product may not exist in another vendor's product, reducing the likelihood of a common vulnerability across all server rooms.

While the other options are also important aspects of a comprehensive security strategy, they do not directly address the CISO’s requirement of ensuring that the new hardware is not susceptible to the same vulnerabilities as the existing hardware:

Migrating workloads to public cloud infrastructure: This is a strategic decision but does not directly address hardware vulnerabilities in server rooms.
Implementing a robust patch management solution: This is crucial for maintaining security but does not address the inherent vulnerabilities in the hardware itself.
Designing new detective security controls: While important, this focuses on detecting issues rather than preventing the same vulnerabilities in hardware.

Therefore, purchasing hardware from different vendors is the best choice to meet the requirement specified by the CISO.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

A security analyst is working on a project to implement a solution that monitors network communications and provides alerts when abnormal behavior is detected.
Which of the following is the security analyst MOST likely implementing?

a. Vulnerability scans
b. User behavior analysis
c. Security orchestration, automation, and response
d. Threat hunting

A

b. User behavior analysis

Explanation:

User behavior analysis: This involves monitoring and analyzing patterns of user activity across the network to detect deviations from normal behavior. The goal is to identify potential security incidents or insider threats based on unusual actions or access patterns.

Here’s why the other options are less likely:

a. Vulnerability scans: Vulnerability scans are automated processes to identify weaknesses in systems, applications, or networks. They focus on identifying known vulnerabilities rather than detecting abnormal behavior in real-time.

c. Security orchestration, automation, and response (SOAR): SOAR platforms integrate security tools and automate incident response workflows. While SOAR can include monitoring capabilities, it primarily focuses on automation and orchestration of response activities rather than detecting abnormal behavior.

d. Threat hunting: Threat hunting involves proactive and iterative searching for threats within an environment based on indicators of compromise (IoCs) and knowledge of attacker tactics, techniques, and procedures (TTPs). It is more focused on actively seeking out threats rather than monitoring for abnormal behavior passively.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Data exfiltration analysis indicates that an attacker managed to download system configuration notes from a web server. The web-server logs have been deleted, but analysts have determined that the system configuration notes were stored in the database administrator’s folder on the web server. Which of the following attacks explains what occurred? (Choose two.)

a. Pass-the-hash
b. Directory traversal
c. SQL injection
d. Privilege escalation
e. Cross-site scripting
f. Request forgery

A

b. Directory traversal
d. Privilege escalation

Here’s the reasoning:

Directory Traversal:
    This attack involves navigating through directories in a file system to access files and directories that are outside the web root directory. In this case, it explains how the attacker could access the database administrator's folder on the web server, which should not have been directly accessible through the web server.

Privilege Escalation:
    This attack involves gaining elevated access to resources that are normally protected from an application or user. In this scenario, the attacker may have used privilege escalation to gain the necessary permissions to access or download the system configuration notes from the database administrator's folder.

The other options are less likely to explain this specific incident:

Pass-the-hash: This is a network attack where an attacker captures a password hash and reuses it to authenticate as the user. It doesn't directly explain accessing specific files on a web server.
SQL injection: While this could be used to manipulate a database, it doesn't directly explain accessing files stored in a directory structure on the web server.
Cross-site scripting (XSS): This is a client-side attack that targets users of a web application, not the server's file system.
Request forgery: This involves tricking a user into making unwanted requests. It doesn't directly explain how the attacker accessed specific files on the web server.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

A junior security analyst is conducting an analysis after passwords were changed on multiple accounts without users’ interaction. The SIEM have multiple login entries with the following text:

suspicious event - user: scheduledtasks successfully authenticate on AD on abnormal time suspicious event - user: scheduledtasks failed to execute c:\weekly_checkups\amazing-3rdparty-domain-assessment.py suspicious event - user: scheduledtasks failed to execute c:\weekly_checkups\secureyourAD-3rdparty-compliance.sh suspicious event - user: scheduledtasks successfully executed c:\weekly_checkups\amazing-3rdparty-domain-assessment.py

Which of the following is the MOST likely attack conducted on the environment?

a. Malicious script
b. Privilege escalation
c. Domain hijacking
d. DNS poisoning

A

a. Malicious script

Explanation:

The events indicate that a user named scheduledtasks successfully authenticated on Active Directory (AD) at abnormal times, which suggests unauthorized access or misuse of credentials associated with a scheduled task.
There are failed attempts to execute scripts (amazing-3rdparty-domain-assessment.py and secureyourAD-3rdparty-compliance.sh) from a directory (c:\weekly_checkups\), indicating attempts to run potentially malicious scripts on the system.
Finally, there is a successful execution of the amazing-3rdparty-domain-assessment.py script by the scheduledtasks user, which implies that a malicious script was successfully executed on the system.

Based on these indicators, the events point towards an attack where an unauthorized user or process (scheduledtasks) gained access to the system, likely through compromised credentials or a vulnerability, and executed malicious scripts (amazing-3rdparty-domain-assessment.py) as part of their attack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

A customer service representative reported an unusual text message that was sent to the help desk. The message contained an unrecognized invoice number with a large balance due and a link to click for more details. Which of the following BEST describes this technique?

a. Vishing
b. Whaling
c. Phishing
d. Smishing

A

d. Smishing

Explanation:

Smishing (SMS phishing) is a type of phishing attack where attackers use SMS (text messages) to deceive victims into providing sensitive information or clicking on malicious links. In this case, the text message containing an unrecognized invoice number and a link to click for more details is an attempt to trick the recipient into visiting a malicious website or downloading malware onto their device.

Phishing typically refers to email-based attacks that aim to deceive users into disclosing personal information, clicking on malicious links, or downloading attachments that contain malware.

Vishing (Voice phishing) involves attackers using voice communication (phone calls) to deceive individuals into revealing sensitive information.

Whaling targets high-profile individuals or executives within an organization, attempting to trick them into revealing sensitive information or authorizing fraudulent transactions.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which of the following actions would be recommended to improve an incident response process?

a. Train the team to identify the difference between events and incidents.
b. Modify access so the IT team has full access to the compromised assets.
c. Contact the authorities if a cybercrime is suspected.
d. Restrict communication surrounding the response to the IT team.

A

a. Train the team to identify the difference between events and incidents.

Explanation:

Incident response effectiveness often hinges on the ability of the team to quickly identify and prioritize incidents from normal events. Training team members to distinguish between events (which are regular occurrences in IT operations) and incidents (which are security breaches or potential security breaches) is crucial.

This training helps in promptly identifying incidents that require immediate action, thereby reducing response times and minimizing potential damage from security breaches.

Option b, modifying access for the IT team to have full access to compromised assets, could potentially be necessary during incident response but is not a broad recommendation for improving the entire process.

Option c, contacting authorities if cybercrime is suspected, is a specific step that may be part of incident response but doesn’t encompass the whole process.

Option d, restricting communication surrounding the response to the IT team, goes against best practices of incident response, which often involve cross-functional teams and communication with various stakeholders.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

A cybersecurity administrator needs to implement a Layer 7 security control on a network and block potential attacks. Which of the following can block an attack at Layer 7? (Choose two.)

a. HIDS
b. NIPS
c. HSM
d. WAF
e. NAC
f. NIDS

A

b. NIPS (Network-based Intrusion Prevention System)
d. WAF (Web Application Firewall)

Here’s why:

NIPS (Network-based Intrusion Prevention System):
    A NIPS can analyze network traffic and block malicious activities at various layers, including Layer 7. It can detect and prevent attacks such as SQL injection, cross-site scripting (XSS), and other web application attacks.

WAF (Web Application Firewall):
    A WAF specifically focuses on monitoring, filtering, and blocking HTTP/HTTPS traffic to and from a web application. It operates at Layer 7 and is designed to protect web applications by detecting and blocking attacks like SQL injection, XSS, and other web-based threats.

The other options do not operate at Layer 7 in a manner that allows them to block attacks:

HIDS (Host-based Intrusion Detection System): Detects suspicious activity on a specific host but does not block Layer 7 attacks.
HSM (Hardware Security Module): Manages digital keys and performs cryptographic operations, not related to blocking Layer 7 attacks.
NAC (Network Access Control): Controls access to the network but does not specifically block Layer 7 attacks.
NIDS (Network-based Intrusion Detection System): Monitors network traffic for suspicious activity but does not block attacks, and its focus is not specifically on Layer 7.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

A business operations manager is concerned that a PC that is critical to business operations will have a costly hardware failure soon. The manager is looking for options to continue business operations without incurring large costs. Which of the following would mitigate the manager’s concerns?

a. Implement a full system upgrade.
b. Perform a physical-to-virtual migration.
c. Install uninterruptible power supplies.
d. Purchase cybersecurity insurance.

A

b. Perform a physical-to-virtual migration.

Here’s why:

Cost-Effective: Physical-to-virtual (P2V) migration allows the business to continue using the existing system by running it as a virtual machine (VM) on more reliable hardware, often without the need to purchase new physical hardware immediately.
Business Continuity: Virtual machines can be easily backed up, replicated, and moved to different hosts, ensuring business operations can continue seamlessly even if there is a hardware failure.
Scalability and Flexibility: Virtual environments can be adjusted more easily to changing business needs compared to physical hardware.

The other options are less suitable for this specific concern:

Implement a full system upgrade: This could be costly and might not be necessary if the main concern is the hardware reliability of a single PC.
Install uninterruptible power supplies (UPS): This addresses power-related issues, not hardware failures.
Purchase cybersecurity insurance: This would help mitigate financial losses due to cyber incidents but does not address the concern of hardware failure directly.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

An organization has activated an incident response plan due to a malware outbreak on its network. The organization has brought in a forensics team that has identified an internet-facing Windows server as the likely point of initial compromise. The malware family that was detected is known to be distributed by manually logging on to servers and running the malicious code. Which of the following actions would be BEST to prevent reinfection from the infection vector?

a. Prevent connections over TFTP from the internal network.
b. Create a firewall rule that blocks a 22 from the internet to the server.
c. Disable file sharing over port 445 to the server.
d. Block port 3389 inbound from untrusted networks.

A

d. Block port 3389 inbound from untrusted networks.

The SMB Protocol (in all its version) doesn’t provide functionality to execute files at the remote systems. Its main objective is to support the sharing of file and print resource between machines.
The only feasible option left is logging through RDP and manually executing the file.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which of the following uses SAML for authentication?

a. TOTP
b. Federation
c. Kerberos
d. HOTP

A

b. Federation

Explanation: Federation often uses Security Assertion Markup Language (SAML) for authentication. SAML is an open standard for exchanging authentication and authorization data between parties, particularly between an identity provider and a service provider, which is a key aspect of federated identity management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

The SOC for a large MSSP is meeting to discuss the lessons learned from a recent incident that took much too long to resolve. This type of incident has become more common in recent weeks and is consuming large amounts of the analysts’ time due to manual tasks being performed. Which of the following solutions should the SOC consider to BEST improve its response time?

a. Configure a NIDS appliance using a Switched Port Analyzer.
b. Collect OSINT and catalog the artifacts in a central repository.
c. Implement a SOAR with customizable playbooks.
d. Install a SIEM with community-driven threat intelligence.

A

c. Implement a SOAR with customizable playbooks.

Here’s why SOAR (Security Orchestration, Automation, and Response) with customizable playbooks is the most appropriate choice:

Automation: SOAR platforms enable automation of repetitive tasks and workflows in incident response. This can significantly reduce the time analysts spend on manual tasks such as data enrichment, response coordination, and remediation actions.

Customizable Playbooks: SOAR platforms allow organizations to create and customize playbooks tailored to their specific incident response processes and workflows. Analysts can define automated actions based on predefined conditions and responses, ensuring consistent and efficient handling of incidents.

Integration: SOAR platforms integrate with various security tools, allowing seamless communication and automated response across the security infrastructure. This integration further enhances the efficiency of incident response operations.

In contrast, let’s briefly review why the other options are less suitable:

a. Configure a NIDS appliance using a Switched Port Analyzer: While network intrusion detection systems (NIDS) are important for detecting network-based attacks, configuring them using a Switched Port Analyzer (SPAN) focuses on monitoring network traffic. This does not directly address the need for automation and response orchestration.

b. Collect OSINT and catalog the artifacts in a central repository: Open Source Intelligence (OSINT) gathering and artifact cataloging are valuable for threat intelligence and analysis, but they do not directly improve incident response time, especially in terms of automation and process efficiency.

d. Install a SIEM with community-driven threat intelligence: SIEM (Security Information and Event Management) systems are crucial for centralized logging and correlation of security events. While they provide insights into security incidents, they do not inherently automate incident response processes like a SOAR platform does.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Business partners are working on a security mechanism to validate transactions securely. The requirement is for one company to be responsible for deploying a trusted solution that will register and issue artifacts used to sign, encrypt, and decrypt transaction files. Which of the following is the BEST solution to adopt?

a. PKI
b. Blockchain
c. SAML
d. OAuth

A

a. PKI (Public Key Infrastructure)

Here’s why PKI is the best choice:

Secure Transaction Signing: PKI provides a robust framework for managing digital certificates and keys, which are essential for securely signing, encrypting, and decrypting transaction files.

Certificate Authority (CA): PKI involves a hierarchical system where a trusted Certificate Authority (CA) issues digital certificates that validate the identity of entities (such as business partners) and bind their public keys to their identities. This ensures the authenticity and integrity of transactions.

Encryption and Decryption: PKI supports asymmetric encryption, where entities have a public-private key pair. This allows for secure encryption of transaction data using the recipient's public key and decryption using their private key, ensuring confidentiality.

Non-repudiation: PKI enables digital signatures, which provide non-repudiation by linking the identity of the signer to the signed data, preventing the signer from later denying involvement.

In contrast, let’s briefly discuss why the other options are less suitable:

b. Blockchain: While blockchain technology provides decentralized and tamper-resistant transaction records, it is more commonly used for distributed ledger purposes rather than issuing digital certificates and managing keys for encryption.

c. SAML (Security Assertion Markup Language): SAML is primarily used for exchanging authentication and authorization data between parties, typically in web-based single sign-on (SSO) scenarios. It is not designed for managing keys or issuing certificates for transaction signing.

d. OAuth (Open Authorization): OAuth is an authorization framework that allows third-party applications to access resources without sharing credentials. It is used for access delegation rather than transaction signing and encryption.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

A security analyst has been asked by the Chief Information Security Officer to:
-develop a secure method of providing centralized management of infrastructure
-reduce the need to constantly replace aging end user machines
-provide a consistent user desktop experience

Which of the following BEST meets these requirements?

a. BYOD
b. Mobile device management
c. VDI
d. Containerization

A

c. VDI (Virtual Desktop Infrastructure)

Here’s why VDI is the appropriate choice:

Centralized Management: VDI allows for centralized management of virtual desktops from a single location. IT administrators can manage and update virtual desktop images and applications centrally, ensuring security configurations are consistent across all virtual desktop instances.

Extend the Life of End User Machines: With VDI, end user devices (like desktops or laptops) primarily serve as thin clients, meaning they require less processing power and storage since most computing occurs on the virtual desktop server. This reduces the need for frequent hardware upgrades or replacements of end user machines.

Consistent User Desktop Experience: VDI provides a consistent desktop environment to users regardless of the device they are using to access their virtual desktop. Users can access their desktop and applications from any device with an internet connection, ensuring a uniform user experience.

On the other hand, let’s briefly discuss why the other options are less suitable:

a. BYOD (Bring Your Own Device): BYOD allows employees to use their personal devices for work purposes, but it does not inherently provide centralized management or reduce the need for replacing aging end user machines. It also may not ensure a consistent user desktop experience across different devices.

b. Mobile Device Management (MDM): MDM focuses on managing mobile devices (smartphones, tablets) used within an organization, primarily for security and policy enforcement. It does not directly address centralized management of infrastructure or provide a consistent desktop experience for users.

d. Containerization: While containerization provides a lightweight and isolated environment for running applications, it is more suitable for application deployment and microservices architecture rather than providing centralized management of infrastructure or virtual desktop environments.

22
Q

Which of the following terms describes a broad range of information that is sensitive to a specific organization?

a. Public
b. Top secret
c. Proprietary
d. Open-source

A

c. Proprietary

Explanation:

Proprietary: This term refers to information that is owned by a company or organization and is considered confidential or sensitive. It encompasses a wide range of data and knowledge that is not publicly available or disclosed to the general public. Proprietary information can include trade secrets, intellectual property, business strategies, customer lists, financial data, and more.

Let’s briefly differentiate it from the other options:

Public: Information that is publicly accessible and not considered confidential or sensitive.
Top secret: Typically refers to the highest level of classified information in government or military contexts.
Open-source: Refers to software or information that is freely available for use, modification, and distribution under licenses that promote access and collaboration.
23
Q

A Chief Security Officer (CSO) is concerned that cloud-based services are not adequately protected from advanced threats and malware. The CSO believes there is a high risk that a data breach could occur in the near future due to the lack of detective and preventive controls. Which of the following should be implemented to BEST address the CSO’s concerns? (Choose two.)

a. A WAF
b. A CASB
c. An NG-SWG
d. Segmentation
e. Encryption
f. Containerization

A

b. A CASB (Cloud Access Security Broker)
c. An NG-SWG (Next-Generation Secure Web Gateway)

Here’s why:

CASB (Cloud Access Security Broker):
    A CASB provides visibility and control over data and user activities in cloud services. It offers features such as threat detection, data loss prevention (DLP), and enforcement of security policies, which are crucial for protecting cloud-based services from advanced threats and data breaches.

NG-SWG (Next-Generation Secure Web Gateway):
    An NG-SWG offers advanced web security by inspecting web traffic for malware, blocking malicious websites, and providing threat intelligence. It can prevent advanced threats from reaching cloud-based services by filtering and securing web traffic.

The other options, while important for overall security, are not as directly focused on addressing the CSO’s specific concerns about advanced threats and malware in the cloud:

WAF (Web Application Firewall): Protects web applications from attacks like SQL injection and cross-site scripting, but doesn't provide comprehensive cloud service protection.
Segmentation: Enhances security by isolating network segments, but does not directly address advanced threats and malware in cloud services.
Encryption: Protects data at rest and in transit, but doesn't prevent or detect advanced threats and malware.
Containerization: Helps with application security and isolation, but isn't specifically focused on protecting cloud-based services from advanced threats and malware.
24
Q

An organization is planning to roll out a new mobile device policy and issue each employee a new laptop. These laptops would access the users’ corporate operating system remotely and allow them to use the laptops for purposes outside of their job roles. Which of the following deployment models is being utilized?

a. MDM and application management
b. BYOD and containers
c. COPE and VDI
d. CYOD and VMs

A

c. COPE and VDI

COPE (Corporate-Owned, Personally-Enabled): In a COPE deployment model, the organization owns the laptops provided to employees. These devices are configured with corporate policies and applications, making them suitable for corporate use. However, employees are also allowed to use these devices for personal purposes within certain boundaries set by the organization.

VDI (Virtual Desktop Infrastructure): VDI allows employees to access their corporate desktop environment remotely from their laptops. This means that the laptops do not necessarily store sensitive corporate data locally but instead connect to virtualized desktops hosted on centralized servers or in the cloud. VDI ensures that employees can use their laptops securely from any location while accessing the corporate operating system and applications.

25
Q

Certain users are reporting their accounts are being used to send unauthorized emails and conduct suspicious activities. After further investigation, a security analyst notices the following:
-All users share workstations throughout the day.
-Endpoint protection was disabled on several workstations throughout the network.
-Travel times on logins from the affected users are impossible.
-Sensitive data is being uploaded to external sites.

All user account passwords were forced to be reset and the issue continued.
Which of the following attacks is being used to compromise the user accounts?

a. Brute-force
b. Keylogger
c. Dictionary
d. Rainbow

A

b. Keylogger

Keylogger: A keylogger is malicious software or hardware that records keystrokes made by a user on a compromised system. If users share workstations and a keylogger is installed on those systems, it can capture all keystrokes entered by users, including usernames, passwords, and other sensitive information. This would allow an attacker to capture newly entered passwords after resets, despite the reset attempt.

Symptoms match:

Unauthorized emails and suspicious activities: Keyloggers can capture login credentials, allowing attackers to impersonate legitimate users and perform unauthorized actions.
Endpoint protection disabled: Keyloggers can be sophisticated enough to evade detection by endpoint protection software or even disable it.
Impossible travel times: If the attacker has gained access to user accounts, they can login from different locations, making it appear as if the user is logging in from impossible travel distances.
Sensitive data uploaded to external sites: Once credentials are compromised, attackers can exfiltrate sensitive data to external locations.
26
Q

A security forensics analyst is examining a virtual server. The analyst wants to preserve the present state of the virtual server, including memory contents. Which of the following backup types should be used?

a. Snapshot
b. Differential
c. Cloud
d. Full
e. Incremental

A

a. Snapshot

Snapshot: A snapshot captures the current state of a virtual machine (VM) at a specific point in time. This includes the contents of the VM’s memory, disk state, and configuration settings. It essentially creates a read-only copy of the VM at the time the snapshot was taken. Snapshots are useful for creating point-in-time backups and for preserving the exact state of the VM, including any volatile data in memory.

Other backup types:

Full backup: This type of backup typically copies all data from the source, but it does not specifically capture the memory state of a running virtual server.
Differential backup: This captures changes made since the last full backup, but it does not capture memory contents.
Incremental backup: This captures changes made since the last backup (full or incremental), but like differential backups, it does not include memory contents.
Cloud backup: Refers to backups stored in a cloud-based storage service; it does not describe the type of backup method used.
27
Q

After returning from a conference, a user’s laptop has been operating slower than normal and overheating, and the fans have been running constantly. During the diagnosis process, an unknown piece of hardware is found connected to the laptop’s motherboard. Which of the following attack vectors was exploited to install the hardware?

a. Removable media
b. Spear phishing
c. Supply chain
d. Direct access

A

(Brindump Community D 70%, A 20%)
d. Direct access
The answer is most likely direct access, as the problem started after going to the conference. It’s implied someone gained physical access to this laptop and installed hardware on the motherboard -or- plugged in a USB drive. It’s unlikely, however it’s possible a supply chain attacker could have also installed hardware inside the laptop prior to shipping to a company.

Either way, the attacker would have needed direct access to complete this attack. It’s more general than the other options, and covers all possibilities.

ChatGPT
d. Direct access
Explanation:

The symptoms described—slower operation, overheating, and constantly running fans—combined with the discovery of an unknown piece of hardware connected to the laptop’s motherboard, strongly suggest that someone had physical access to the laptop. This type of attack, where the attacker physically interacts with the device to install malicious hardware, falls under the category of direct access.
Why other options may be less suitable:

Removable media: This typically involves using USB drives or other external storage devices to infect a system with malware. While removable media can introduce malware, it does not explain the presence of an unknown piece of hardware connected to the motherboard.

Spear phishing: This is a targeted email attack designed to trick the user into revealing personal information or downloading malware. While spear phishing could lead to malware infection, it does not involve physically adding hardware to the laptop.

Supply chain: This involves compromising hardware or software at some point during the manufacturing or distribution process. While possible, it is less likely given the context that the hardware was found after the laptop had been in the user's possession for some time and after a specific event (returning from a conference).

Therefore, the most plausible explanation is direct access, where an attacker physically installed the unknown hardware onto the laptop’s motherboard.

(Braindump)
a. Removable media

28
Q

After a recent security breach, a security analyst reports that several administrative usernames and passwords are being sent via cleartext across the network to access network devices over port 23. Which of the following should be implemented so all credentials sent over the network are encrypted when remotely accessing and configuring network devices?

a. SSH
b. SNMPv3
c. SFTP
d. Telnet
e. FTP

A

a. SSH (Secure Shell)

Here’s why SSH is the correct choice:

SSH (Secure Shell): SSH provides a secure, encrypted method for remote login and command execution on network devices. It encrypts the entire communication session between the client and the server, including authentication credentials, commands sent, and responses received. This encryption ensures that passwords and other sensitive information are protected from eavesdropping and interception.

Other options explained:
    SNMPv3: SNMPv3 provides authentication and encryption for SNMP (Simple Network Management Protocol) messages, but it's primarily used for monitoring and management rather than interactive command execution like SSH.
    SFTP (Secure File Transfer Protocol): SFTP is used for secure file transfers, not for interactive command-line access to network devices.
    Telnet: Telnet is a legacy protocol that sends data, including passwords, in cleartext. It does not provide any encryption or security mechanisms, making it vulnerable to interception.
    FTP (File Transfer Protocol): FTP also sends data, including credentials, in cleartext. It does not provide encryption for data in transit.
29
Q

Which of the following provides a calculated value for known vulnerabilities so organizations can prioritize mitigation steps?

a. CVSS
b. SIEM
c. SOAR
d. CVE

A

a. CVSS (Common Vulnerability Scoring System)

CVSS is a standard for assessing and scoring the severity of computer system security vulnerabilities. It provides a quantitative measure of the impact and exploitability of a vulnerability, allowing organizations to prioritize their response efforts. CVSS assigns a score based on several metrics such as exploitability, impact, and complexity, which helps organizations determine the urgency and criticality of applying patches or mitigations to vulnerabilities.

Let’s briefly explain the other options for clarity:

SIEM (Security Information and Event Management): SIEM systems aggregate and analyze security event data from various sources within an organization's IT infrastructure. They provide real-time analysis of security alerts generated by applications and network hardware, helping organizations to detect and respond to security incidents.

SOAR (Security Orchestration, Automation, and Response): SOAR platforms integrate security technologies and automate incident response processes. They can help streamline and accelerate incident detection, response, and remediation tasks.

CVE (Common Vulnerabilities and Exposures): CVE is a dictionary of publicly known information security vulnerabilities and exposures. It provides unique identifiers (CVE IDs) for known vulnerabilities, but it does not provide a calculated value or scoring system for prioritization.
30
Q

Several universities are participating in a collaborative research project and need to share compute and storage resources. Which of the following cloud deployment strategies would BEST meet this need?

a. Community
b. Private
c. Public
d. Hybrid

A

a. Community

Explanation:

Community cloud deployment model is designed to meet the specific needs of a community of organizations with shared concerns (such as universities collaborating on research projects).
It allows these organizations to share infrastructure and resources securely while maintaining some level of control over their data and applications.
This model supports collaborative efforts by providing a dedicated and customizable environment that meets the shared requirements of the participating universities.
It typically offers better security, compliance, and performance compared to public cloud options, while still providing the benefits of scalability and cost-efficiency.

In contrast:

Public cloud involves resources shared by multiple organizations over the internet, which may not offer the required level of control or security for sensitive research data.
Private cloud is dedicated to a single organization, which may not be cost-effective or scalable for multiple universities collaborating on a project.
Hybrid cloud integrates private and public cloud environments, which could add unnecessary complexity for this specific collaborative research scenario.
31
Q

A forensic analyst needs to prove that data has not been tampered with since it was collected. Which of the following methods will the analyst MOST likely use?

a. Look for tampering on the evidence collection bag.
b. Encrypt the collected data using asymmetric encryption.
c. Ensure proper procedures for chain of custody are being followed.
d. Calculate the checksum using a hashing algorithm.

A

d. Calculate the checksum using a hashing algorithm.

Explanation:

Checksum using a hashing algorithm (option d) is commonly used in forensic analysis to verify data integrity. A hash function takes an input (in this case, the collected data) and produces a fixed-size string of bytes, known as the hash value or checksum.
If the data remains unchanged, the hash value will remain the same.
Even a small change to the input data will result in a significantly different hash value due to the avalanche effect of hash functions.
By comparing the hash value of the collected data to the hash value calculated later, the forensic analyst can verify if the data has been tampered with.
This method is efficient, reliable, and widely accepted in forensic investigations to ensure data integrity and prove the authenticity of collected evidence.
32
Q

Multiple business accounts were compromised a few days after a public website had its credentials database leaked on the Internet. No business emails were identified in the breach, but the security team thinks that the list of passwords exposed was later used to compromise business accounts. Which of the following would mitigate the issue?

a. Complexity requirements
b. Password history
c. Acceptable use policy
d. Shared accounts

A

b. Password history

Explanation:

Implementing password history policies ensures that users cannot reuse a certain number of their previous passwords. This can help mitigate the risk of attackers using previously leaked passwords to gain access to accounts. Complexity requirements alone (option a) do not address the issue if users reuse old passwords that have already been compromised. Acceptable use policy (option c) and shared accounts (option d) are not directly relevant to preventing the reuse of compromised

33
Q

A security analyst wants to fingerprint a web server. Which of the following tools will the security analyst MOST likely use to accomplish this task?

a. nmap -pl-65535 192.168.0.10
b. dig 192.168.0.10
c. curl –head http://192.168.0.10
d. ping 192.168.0.10

A

c. curl –head http://192.168.0.10

a. nmap -pl-65535 192.168.0.10: This command uses nmap, a network scanning tool. However, the options -pl-65535 are incorrect and would not achieve web server fingerprinting. This command is typically used for ping scanning, not for web server fingerprinting.

b. dig 192.168.0.10: The dig command is used for querying DNS (Domain Name System) servers to retrieve DNS records like A, AAAA, and others. It does not provide information about the web server itself.

c. curl –head http://192.168.0.10: This command uses curl to make an HTTP request to the specified URL (http://192.168.0.10) and retrieves the HTTP headers (–head). HTTP headers often include server information such as the server type and sometimes version number. This can help in fingerprinting the web server.

d. ping 192.168.0.10: The ping command is used to test connectivity between devices by sending ICMP echo requests. It does not provide any information about the web server software.

Conclusion: The most appropriate tool from the options provided to fingerprint a web server is c. curl –head http://192.168.0.10. This command will fetch the HTTP headers from the web server at 192.168.0.10, allowing the security analyst to gather information about the server software and version, which is crucial for fingerprinting purposes. Therefore, option c is the correct answer.

34
Q

A penetration tester was able to compromise an internal server and is now trying to pivot the current session in a network lateral movement. Which of the following tools, if available on the server, will provide the MOST useful information for the next assessment step?

a. Autopsy
b. Cuckoo
c. Memdump
d. Nmap

A

d. Nmap

a. Autopsy: Autopsy is a digital forensics platform primarily used for analyzing disk images and other media. It is not suitable for network enumeration or scanning.

b. Cuckoo: Cuckoo is a malware analysis sandbox. While useful for analyzing malware behavior and payloads, it is not typically used for network scanning or enumeration.

c. Memdump: Memdump typically refers to dumping memory contents for analysis. While memory analysis can be useful, it’s not directly related to network enumeration or lateral movement within a network.

d. Nmap: Nmap is a powerful network scanning tool that can be used to discover hosts, services, and open ports on a network. It is highly effective for mapping out network topologies, identifying live hosts, and providing information about services running on those hosts.

Conclusion: In the context of pivoting from a compromised server for lateral movement, d. Nmap would provide the most useful information. Nmap can scan the network from the compromised server, identify other hosts and services, and potentially uncover additional vulnerabilities or targets for further exploitation. Therefore, option d. Nmap is the correct answer for the penetration tester in this scenario.

35
Q

Field workers in an organization are issued mobile phones on a daily basis. All the work is performed within one city, and the mobile phones are not used for any purpose other than work. The organization does not want these phones used for personal purposes. The organization would like to issue the phones to workers as permanent devices so the phones do not need to be reissued every day. Given the conditions described, which of the following technologies would BEST meet these requirements?

a. Geofencing
b. Mobile device management
c. Containerization
d. Remote wiping

A

b. Mobile device management (MDM)

Here’s how MDM addresses the organization’s needs:

Issuing Permanent Devices: MDM solutions allow organizations to manage mobile devices centrally. This includes provisioning devices and configuring them with the necessary settings and applications. Once configured, the devices can be issued as permanent work devices to field workers, eliminating the need for daily reissuance.

Enforcement of Policies: MDM solutions enable organizations to enforce strict policies on managed devices. This includes configuring devices so they can only be used for work purposes and preventing unauthorized use for personal activities. Policies can restrict the installation of non-work-related apps and enforce usage restrictions.

Security and Compliance: MDM provides security features such as encryption, remote locking, and password policies to protect sensitive work data on the devices. It also helps ensure compliance with organizational policies and regulatory requirements.

Remote Management and Monitoring: MDM allows IT administrators to remotely monitor and manage devices. This includes tracking device location (geolocation) and status, applying updates and patches, and troubleshooting issues without physical access to the devices.

While geofencing (option a) can restrict device usage based on location, it typically does not provide comprehensive management capabilities like policy enforcement and remote management, which are crucial for maintaining control over devices used by field workers. Containerization (option c) is useful for separating work and personal data on devices, but it may not prevent personal use entirely unless strictly enforced through policy. Remote wiping (option d) is a security measure to erase data from lost or stolen devices but does not address the management and usage policy requirements described.

36
Q

Which of the following control types is focused primarily on reducing risk before an incident occurs?

a. Preventive
b. Deterrent
c. Corrective
d. Detective

A

a. Preventive

Preventive controls are designed to prevent incidents from occurring by reducing vulnerabilities or deterring potential attackers. They aim to proactively mitigate risks before they can be exploited. Examples of preventive controls include:

Access controls: Limiting access to authorized personnel only.
Encryption: Protecting sensitive data from unauthorized access.
Patching and updates: Keeping software and systems up to date to address known vulnerabilities.
Firewalls and intrusion prevention systems (IPS): Filtering network traffic to block malicious activity.
Security awareness training: Educating users about security best practices to prevent social engineering attacks.

In contrast:

Deterrent controls aim to discourage attackers from targeting a system or organization. They include measures like visible security cameras, warning signs, or security guards, which may deter potential attackers from attempting an attack.
Corrective controls are implemented after an incident has occurred to mitigate its impact and restore systems to a secure state.
Detective controls are designed to detect and respond to incidents after they have occurred, such as through monitoring, logging, and intrusion detection systems (IDS).
37
Q

A systems administrator reports degraded performance on a virtual server. The administrator increases the virtual memory allocation, which improves conditions, but performance degrades again after a few days. The administrator runs an analysis tool and sees the following output:

==3214== timeAttend.exe analyzed
==3214== ERROR SUMMARY:
==3214== malloc/free: in use at exit: 4608 bytes in 18 blocks.
==3214== checked 82116 bytes
==3214== definitely lost: 4608 bytes in 18 blocks.

The administrator terminates the timeAttend.exe, observes system performance over the next few days, and notices that the system performance does not degrade. Which of the following issues is MOST likely occurring?

a. DLL injection
b. API attack
c. Buffer overflow
d. Memory leak

A

d. Memory leak

Here’s why:

Memory leak: A memory leak occurs when a program allocates memory but fails to release it back to the operating system after it is no longer needed. Over time, this can lead to the gradual depletion of available memory resources on the system. In the scenario provided:
    The administrator ran an analysis tool (timeAttend.exe).
    The tool reported memory usage statistics, indicating that memory allocated by the timeAttend.exe process was not properly released (definitely lost: 4608 bytes in 18 blocks).
    After terminating timeAttend.exe, the system performance improved and did not degrade over the next few days, suggesting that terminating the process stopped the continuous memory consumption.

Symptoms consistent with memory leak:
    Initially, the systems administrator increased virtual memory allocation to mitigate degraded performance, which temporarily improved conditions. However, performance degraded again after a few days.
    Memory leaks typically lead to a gradual increase in memory consumption over time, eventually impacting system performance as available memory resources become exhausted.
38
Q

An administrator is experiencing issues when trying to upload a support file to a vendor. A pop-up message reveals that a payment card number was found in the file, and the file upload was blocked. Which of the following controls is most likely causing this issue and should be checked FIRST?

a. DLP
b. Firewall rule
c. Content filter
d. MDM
e. Application allow list

A

a. DLP

Here’s why:

Data Loss Prevention (DLP): DLP solutions are designed to monitor and prevent unauthorized transfer or disclosure of sensitive information, such as payment card numbers, outside of the organization's network. They typically inspect file content, both at rest and in transit, to identify sensitive data patterns based on predefined policies.

Scenario analysis:
    The administrator is trying to upload a support file to a vendor.
    During the upload process, a pop-up message indicates that a payment card number was found in the file.
    The upload is blocked, presumably to prevent the unauthorized transfer of sensitive payment card information to an external party (the vendor).

Controls involved:
    Firewall rule: Firewalls typically control network traffic based on port, protocol, or IP addresses. They are not typically involved in inspecting file content for specific data patterns like payment card numbers.
    Content filter: Content filters can inspect web content for malicious or inappropriate content, but they may not specifically focus on detecting sensitive data patterns like payment card numbers.
    MDM (Mobile Device Management): MDM solutions manage mobile devices and may enforce security policies but are not directly involved in inspecting file content during uploads.
    Application allow list: Application allow lists control which applications can run on a system but do not inspect file content during uploads.
39
Q

Which of the following risk management strategies would an organization use to maintain a legacy system with known risks for operational purposes?

a. Acceptance
b. Transference
c. Avoidance
d. Mitigation

A

a. Acceptance

Explanation:

Acceptance in risk management refers to acknowledging the existence of a risk and deciding not to take any further action to mitigate it. This strategy is typically chosen when the cost or effort required to mitigate the risk is deemed to be greater than the impact of the risk itself.

In the context of maintaining a legacy system with known risks for operational purposes, organizations often opt for acceptance. This means they are aware of the risks associated with using the legacy system but continue to use it because:
    It is critical for ongoing operations.
    The organization may lack resources or alternative solutions to upgrade or replace the system.
    The potential impact of the risks (such as downtime or data breaches) is deemed acceptable compared to the cost or disruption that would be caused by attempting to mitigate or avoid the risks.

Transference involves shifting the risk to another party, such as through insurance or outsourcing.

Avoidance aims to eliminate the risk altogether by not engaging in the activity that poses the risk.

Mitigation involves taking actions to reduce the likelihood or impact of a risk.
40
Q

Which of the following is the BEST action to foster a consistent and auditable incident response process?

a. Incent new hires to constantly update the document with external knowledge.
b. Publish the document in a central repository that is easily accessible to the organization.
c. Restrict eligibility to comment on the process to subject matter experts of each IT silo.
d. Rotate CIRT members to foster a shared responsibility model in the organization.

A

b. Publish the document in a central repository that is easily accessible to the organization.

Explanation:

Incident response processes need to be well-documented and accessible to all relevant stakeholders within the organization. By publishing the incident response document in a central repository that is easily accessible:
    Consistency is promoted because all team members can refer to the same authoritative source for guidance on how to handle incidents.
    Audibility is enhanced because auditors and stakeholders can easily review the documented process to ensure compliance and effectiveness.
    It facilitates collaboration and knowledge sharing among team members, as everyone can contribute to and benefit from a centralized resource.

Incentivizing new hires to update the document with external knowledge (option a) might encourage knowledge sharing but does not ensure the document's centralization or accessibility.

Restricting eligibility to comment on the process to subject matter experts (option c) may limit input and collaboration across teams, potentially hindering the overall effectiveness of the incident response process.

Rotating CIRT members (option d) can foster a shared responsibility model and cross-training but does not directly address the need for a centralized and easily accessible documentation repository.

(Braindump)
d. Rotate CIRT members to foster a shared responsibility model in the organization.

41
Q

During a recent penetration test, the tester discovers large amounts of data were exfiltrated over the course of 12 months via the internet. The penetration tester stops the test to inform the client of the findings. Which of the following should be the client’s NEXT step to mitigate the issue?

a. Conduct a full vulnerability scan to identify possible vulnerabilities.
b. Perform containment on the critical servers and resources.
c. Review the firewall and identify the source of the active connection.
d. Disconnect the entire infrastructure from the internet.

A

b. Perform containment on the critical servers and resources.

Explanation:

Containment is a crucial initial step in incident response. It involves isolating compromised systems or affected areas to prevent further unauthorized access or data exfiltration. By containing the critical servers and resources, the client can limit the spread of the breach and prevent ongoing data loss.

Reviewing the firewall and identifying the source of the active connection (option c) is also important but typically comes after containment. It helps in understanding how the breach occurred and what steps are needed to prevent future incidents.

Conducting a full vulnerability scan (option a) is necessary to identify vulnerabilities that might have been exploited but should be conducted after containment to prioritize immediate security measures.

Disconnecting the entire infrastructure from the internet (option d) is an extreme measure that may disrupt business operations significantly and should be considered only if containment measures fail or if there is immediate risk of ongoing data exfiltration.
42
Q

A security analyst is designing the appropriate controls to limit unauthorized access to a physical site. The analyst has a directive to utilize the lowest possible budget. Which of the following would BEST meet the requirements?

a. Preventive controls
b. Compensating controls
c. Deterrent controls
d. Detective controls

A

c. Deterrent controls

Deterrent controls are designed to discourage potential intruders by signaling that security measures are in place. They do not directly prevent access but aim to deter unauthorized individuals from attempting to breach security measures. Examples of deterrent controls include signage indicating the presence of security cameras or alarms, visible locks and barriers, and warning notices.

Here’s why deterrent controls are the best choice given the scenario:

Cost-effectiveness: Deterrent controls are generally more cost-effective to implement compared to preventive controls, which require physical barriers or access controls that might be more expensive.

Suitability for low budgets: Since the directive is to utilize the lowest possible budget, deterrent controls such as signage and visible security measures provide an effective deterrent without significant investment.

Meeting the requirement: Deterrent controls align with the objective of limiting unauthorized access by discouraging potential intruders, thus contributing to the security goal within the specified budget constraints.
43
Q

A company is looking to migrate some servers to the cloud to minimize its technology footprint. The company has 100 databases that are on premises. Which of the following solutions will require the LEAST management and support from the company?

a. SaaS
b. IaaS
c. PaaS
d. SDN

A

a. SaaS

Here’s a breakdown of why SaaS is the most suitable option:

SaaS (Software as a Service): With SaaS, the service provider hosts the application and manages everything from the infrastructure to the middleware, application software, and data. Users access the software over the internet, typically through a web browser. In this case, if the company migrates its databases to a SaaS solution, the service provider will handle all aspects of managing and supporting the databases. This includes database maintenance, backups, scaling, security updates, and availability. The company would only need to manage its data and user access, with minimal involvement in the underlying infrastructure.

IaaS (Infrastructure as a Service): With IaaS, the service provider offers virtualized computing resources over the internet, including virtual machines, storage, and networking. The company would be responsible for managing the operating systems, middleware, runtime, and data. While it provides flexibility and control over the infrastructure, it requires more management compared to SaaS as the company still needs to manage the databases themselves.

PaaS (Platform as a Service): PaaS provides a platform allowing customers to develop, run, and manage applications without the complexity of building and maintaining the infrastructure. While it abstracts much of the underlying infrastructure management, it still requires the company to manage the databases and applications deployed on the platform.

SDN (Software-Defined Networking): SDN is a network architecture approach that allows network administrators to manage network services through abstraction of lower-level functionality. It focuses on network management rather than application or database management, making it less relevant for managing databases directly.
44
Q

Which of the following employee roles is responsible for protecting an organization’s collected personal information?

a. CTO
b. DPO
c. CEO
d. DBA

A

b. DPO (Data Protection Officer).

Here’s a brief explanation of each role:

CTO (Chief Technology Officer): Typically responsible for overseeing the organization's technological needs, which can include infrastructure, security, and development. While the CTO plays a role in implementing technology solutions, they may not specifically focus on protecting personal information unless it falls under their broader responsibilities.

DPO (Data Protection Officer): The DPO is specifically designated to oversee data protection strategy and implementation to ensure compliance with data protection regulations such as GDPR (General Data Protection Regulation). They monitor internal compliance, conduct data protection impact assessments, and act as a point of contact for data subjects and supervisory authorities.

CEO (Chief Executive Officer): The CEO is the highest-ranking executive in a company and is responsible for overall strategy, operations, and the organization's success. While the CEO has ultimate responsibility for everything that happens within the organization, data protection specifics are typically delegated to other roles such as the DPO.

DBA (Database Administrator): Responsible for the design, implementation, maintenance, and security of databases within an organization. While DBAs play a critical role in managing data security within databases, their focus is primarily on technical aspects related to database management rather than overarching data protection responsibilities.
45
Q

Against the recommendation of the IT security analyst, a company set all user passwords on a server as P@55w0rD. Upon review of the /etc/passwd file, an attacker found the following:

alice:a8df3b6c4fd75f0617431fd248f35191df8d237f bob:2d250c5b2976b03d757f324ebd59340df96aa05e chris:ea981ec3285421d014108089f3f3f997ce0f4150

Which of the following BEST explains why the encrypted passwords do not match?

a. Perfect forward secrecy
b. Key stretching
c. Salting
d. Hashing

A

c. Salting

The reason the encrypted passwords do not match the predictable pattern of P@55w0rD (assuming that was the password set for all users) is due to salting.

Salting is a technique used in password hashing where a random value (salt) is added to each password before hashing. This salt value ensures that even if two users have the same password, their hashed passwords will be different due to the unique salt applied to each password.

In the example provided:

If P@55w0rD was the password set for all users, the system would generate a unique salt for each user.
Each user's password (P@55w0rD in this case) would be combined with their unique salt.
The combination of password and salt is then hashed using a cryptographic hash function (like SHA-256 or similar).
The resulting hashed password stored in /etc/passwd (a8df3b6c4fd75f0617431fd248f35191df8d237f, 2d250c5b2976b03d757f324ebd59340df96aa05e, ea981ec3285421d014108089f3f3f997ce0f4150) is unique due to the salt.

Therefore, the presence of different hashed values for apparently the same password (P@55w0rD) indicates that each password was hashed with a unique salt. This makes it significantly harder for attackers to use precomputed hash tables (rainbow tables) or other methods to reverse engineer the passwords.

46
Q

After gaining access to a dual-homed (i.e., wired and wireless) multifunction device by exploiting a vulnerability in the device’s firmware, a penetration tester then gains shell access on another networked asset. This technique is an example of:

a. privilege escalation.
b. footprinting.
c. persistence.
d. pivoting.

A

d. pivoting.

The technique described where a penetration tester gains access to another networked asset after initially compromising a dual-homed multifunction device is an example of pivoting.

Pivoting in penetration testing refers to the technique where an attacker uses a compromised system as a stepping stone to attack other systems within the same or different networks to which the initial compromised system has access. This technique helps attackers maintain access to a network even if the original point of entry is discovered and closed off.

In the scenario described:

The penetration tester initially exploits a vulnerability in the multifunction device's firmware.
This allows the penetration tester to gain a foothold on the multifunction device.
The device is dual-homed (connected to both wired and wireless networks), potentially providing access to multiple network segments.
Using the compromised multifunction device as a pivot, the penetration tester gains shell access to another networked asset. This involves leveraging the compromised device's position and connectivity to extend the attack to other parts of the network.
47
Q

Which of the following should be monitored by threat intelligence researchers who search for leaked credentials?

a. Common Weakness Enumeration
b. OSINT
c. Dark web
d. Vulnerability databases

A

c. Dark web

Threat intelligence researchers who search for leaked credentials typically monitor the dark web. The dark web is a part of the internet that is not indexed by traditional search engines, and it is often used for illicit activities, including the sale and trade of stolen data such as credentials, personal information, and financial details.

Monitoring the dark web allows threat intelligence researchers to identify if any credentials associated with their organization or clients have been compromised and are being traded or sold illegally. This proactive monitoring helps organizations take swift action, such as resetting passwords or implementing additional security measures, to mitigate the risk of unauthorized access and potential data breaches.

48
Q

A security analyst needs to be able to search and correlate logs from multiple sources in a single tool. Which of the following would BEST allow a security analyst to have this ability?

a. SOAR
b. SIEM
c. Log collectors
d. Network-attached storage

A

b. SIEM (Security Information and Event Management).

SIEM (Security Information and Event Management) is designed to collect, store, analyze, and correlate logs and security events from various sources within an organization’s IT infrastructure. It provides a centralized platform where security analysts can search through logs, detect anomalies, investigate security incidents, and generate reports.

Here’s why SIEM is the best choice for the described scenario:

Centralized Logging: SIEM systems aggregate logs from diverse sources such as network devices, servers, applications, and security tools into a single repository.
Correlation: SIEM tools use correlation rules and algorithms to detect patterns and relationships across different log entries and events, helping analysts identify potential security incidents.
Search Capabilities: SIEM solutions provide powerful search capabilities, allowing analysts to quickly query and filter logs based on various criteria.
Alerting and Reporting: SIEM platforms can generate alerts in real-time based on predefined rules or anomalies detected during log analysis. They also facilitate the creation of comprehensive reports for compliance purposes and incident response.

While log collectors (option c) are important components that feed logs into a SIEM, they do not provide the same level of functionality as a SIEM, which integrates logging, correlation, analysis, and reporting capabilities into a single platform tailored for security operations.

49
Q

A security analyst is investigating suspicious traffic on the web server located at IP address 10.10.1.1. A search of the WAF logs reveals the following output:

source IP Destination IP Requested URL Action Taken
172.16.1.3 10.10.1.1 /web/cgi-bin/contact? permit and log
category=custname’–
172.16.1.3 10.10.1.1 /web/cgi-bin/contact? permit and log
category=custname+OR+1=1–

Which of the following is MOST likely occurring?

a. XSS attack
b. SQLi attack
c. Replay attack
d. XSRF attack

A

b. SQLi attack

Here’s the reasoning:

SQL Injection (SQLi): SQL injection is a type of attack where an attacker injects malicious SQL queries into input fields of a web application with the intention to manipulate the backend database. The presence of 1=1 in SQL queries is a common technique to bypass authentication or retrieve unintended data from the database.

In the provided logs:

The URLs /web/cgi-bin/contact?category=custname'-- and /web/cgi-bin/contact?category=custname+OR+1=1-- indicate that the attacker is modifying the category parameter in the URL to include SQL injection payloads ('-- and OR 1=1--).

Action Taken: The WAF (Web Application Firewall) logs show that the requests were permitted (permit) and logged. This means that the WAF did not block the requests, possibly because it did not recognize them as malicious due to evasion techniques used by the attacker.

Attack Type: The use of SQL injection payloads ('-- and OR 1=1--) in the URL parameters indicates an attempt to manipulate the SQL queries executed by the web server, typically targeting vulnerabilities in the backend database management system (DBMS).
50
Q

Which of the following components can be used to consolidate and forward inbound internet traffic to multiple cloud environments though a single firewall?

a. Transit gateway
b. Cloud hot site
c. Edge computing
d. DNS sinkhole

A

a. Transit gateway

Explanation:

A transit gateway is a service that allows organizations to connect multiple Virtual Private Clouds (VPCs) and on-premises networks through a central hub. It acts as a regional gateway and can consolidate and route traffic between VPCs, VPNs, and the internet.
By leveraging a transit gateway, organizations can centralize the management of traffic flows, implement security controls (such as firewalls), and simplify connectivity between different cloud environments and their on-premises networks.
This makes it an ideal choice for consolidating inbound internet traffic and ensuring that it is routed through a single firewall instance, thereby enhancing security and operational efficiency across multiple cloud environments.