Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security + 401 > 601-650 > Flashcards

601-650 Flashcards

1
Q

Which of the following can only be mitigated through the use of technical controls rather that user security training?

A

B.

Zero-day

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

The security administrator is observing unusual network behavior from a workstation. The workstation is communicating with a known malicious destination over an encrypted tunnel. A full antivirus scan, with an updated antivirus definition file, does not show any signs of infection.

Which of the following has happened on the workstation?

A

A.

Zero-day attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which of the following types of application attacks would be used to identify malware causing security breaches that have NOT yet been identified by any trusted sources?

A

A.

Zero-day

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which of the following may cause Jane, the security administrator, to seek an ACL work around?

A

A.

Zero-day exploit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Matt, an IT administrator, wants to protect a newly built server from zero day attacks.

Which of the following would provide the BEST level of protection?

A

A.

HIPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Joe, a user, in a coffee shop is checking his email over a wireless network. An attacker records the temporary credentials being passed to Joe’s browser. The attacker later uses the credentials to impersonate Joe and creates SPAM messages.

Which of the following attacks allows for this impersonation?

A

D.

Session hijacking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How often, at a MINIMUM, should Sara, an administrator, review the accesses and rights of the users on her system?

A

A.

Annually

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which of the following types of logs could provide clues that someone has been attempting to compromise the SQL Server database?

A

A.

Event

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Ann, the security administrator, received a report from the security technician, that an unauthorized new user account was added to the server over two weeks ago.

Which of the following could have mitigated this event?

A

A.

Routine log audits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

A security administrator needs to determine which system a particular user is trying to login to at various times of the day.

Which of the following log types would the administrator check?

A

D.

Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

The security administrator is analyzing a user’s history file on a Unix server to determine if the user was attempting to break out of a rootjail.

Which of the following lines in the user’s history log shows evidence that the user attempted to escape the rootjail?

A

A.

cd ../../../../bin/bash

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

A security technician is attempting to improve the overall security posture of an internal mail server.

Which of the following actions would BEST accomplish this goal?

A

B.

Disabling unnecessary services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

A vulnerability assessment indicates that a router can be accessed from default port 80 and default port 22.

Which of the following should be executed on the router to prevent access via these ports? (Choose two.

A

C.
SSH service should be disabled

D.
HTTP service should disabled

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

During a routine audit a web server is flagged for allowing the use of weak ciphers.

Which of the following should be disabled to mitigate this risk? (Choose two.)

A

A.
SSL 1.0

F.
TLS 1.0

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

A new web server has been provisioned at a third party hosting provider for processing credit card transactions. The security administrator runs the netstat command on the server and notices that ports 80, 443, and 3389 are in a `listening’ state. No other ports are open.

Which of the following services should be disabled to ensure secure communications?

A

B.

HTTP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Joe analyzed the following log and determined the security team should implement which of the following as a mitigation method against further attempts?

Host 192.168.1.123
[00: 00: 01]Successful Login: 015 192.168.1.123 : local
[00: 00: 03]Unsuccessful Login: 022 214.34.56.006 : RDP 192.168.1.124
[00: 00: 04]UnSuccessful Login: 010 214.34.56.006 : RDP 192.168.1.124
[00: 00: 07]UnSuccessful Login: 007 214.34.56.006 : RDP 192.168.1.124
[00: 00: 08]UnSuccessful Login: 003 214.34.56.006 : RDP 192.168.1.124

A

D.

Hardening

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

The Chief Technology Officer (CTO) wants to improve security surrounding storage of customer passwords.

The company currently stores passwords as SHA hashes.

Which of the following can the CTO implement requiring the LEAST change to existing systems?

A

A.

Smart cards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

An auditor’s report discovered several accounts with no activity for over 60 days. The accounts were later identified as contractors’ accounts who would be returning in three months and would need to resume the activities.

Which of the following would mitigate and secure the auditors finding?

A

A.

Disable unnecessary contractor accounts and inform the auditor of the update.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

An administrator notices that former temporary employees’ accounts are still active on a domain.

Which of the following can be implemented to increase security and prevent this from happening?

A

D.

Run a last logon script to look for inactive accounts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How must user accounts for exiting employees be handled?

A

A.

Disabled, regardless of the circumstances

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

An administrator has a network subnet dedicated to a group of users. Due to concerns regarding data and network security, the administrator desires to provide network access for this group only.

Which of the following would BEST address this desire?

A

C.

Configure the switch to allow only traffic from computers based upon their physical address.

22
Q

A new virtual server was created for the marketing department. The server was installed on an existing host machine. Users in the marketing department report that they are unable to connect to the server. Technicians verify that the server has an IP address in the same VLAN as the marketing department users.

Which of the following is the MOST likely reason the users are unable to connect to the server?

A

A.

The new virtual server’s MAC address was not added to the ACL on the switch

23
Q

Which of the following can be implemented if a security administrator wants only certain devices connecting to the wireless network?

A

C.

Enable MAC filtering

24
Q

Which of the following implementation steps would be appropriate for a public wireless hotspot?

A

C.

Open system authentication

25
Q

Which of the following controls would allow a company to reduce the exposure of sensitive systems from unmanaged devices on internal networks?

A

A.

802.1x

26
Q

A system security analyst using an enterprise monitoring tool notices an unknown internal host exfiltrating files to several foreign IP addresses.

Which of the following would be an appropriate mitigation technique?

A

B.

Rogue machine detection

27
Q

Matt, a developer, recently attended a workshop on a new application. The developer installs the new application on a production system to test the functionality.

Which of the following is MOST likely affected?

A

C.

Initial baseline configuration

28
Q

In order to maintain oversight of a third party service provider, the company is going to implement a Governance, Risk, and Compliance (GRC) system. This system is promising to provide overall security posture coverage.

Which of the following is the MOST important activity that should be considered?

A

A.

Continuous security monitoring

29
Q

A security analyst performs the following activities: monitors security logs, installs surveillance cameras and analyzes trend reports.

Which of the following job responsibilities is the analyst performing? (Choose two.)

A

A.
Detect security incidents

C.
Implement monitoring controls

30
Q

Which of the following is an indication of an ongoing current problem?

A

C.

Alarm

31
Q

Which of the following is a notification that an unusual condition exists and should be investigated?

A

A.

Alert

32
Q

A security manager must remain aware of the security posture of each system.

Which of the following supports this requirement?

A

B.

Establishing baseline reporting

33
Q

Suspicious traffic without a specific signature was detected. Under further investigation, it was determined that these were false indicators.

Which of the following security devices needs to be configured to disable future false alarms?

A

D.

Anomaly based IDS

34
Q

Jane, a security administrator, has observed repeated attempts to break into a server.

Which of the following is designed to stop an intrusion on a specific server?

A

A.

HIPS

35
Q

Which of the following tools will allow a technician to detect security-related TCP connection anomalies?

A

B.

Performance monitor

36
Q

Which of the following would a security administrator implement in order to identify a problem between two systems that are not communicating properly?

A

A.

Protocol analyzer

37
Q

Which of the following is BEST used to capture and analyze network traffic between hosts on the same network segment?

A

A.

Protocol analyzer

38
Q

Which of the following would a security administrator implement in order to identify a problem between two applications that are not communicating properly?

A

A.

Protocol analyzer

39
Q

Which of the following tools would allow Ann, the security administrator, to be able to BEST quantify all traffic on her network?

A

C.

Protocol analyzer

40
Q

Joe, the security administrator, has determined that one of his web servers is under attack.

Which of the following can help determine where the attack originated from?

A

D.

Network sniffing

41
Q

Which of the following BEST allows Pete, a security administrator, to determine the type, source, and flags of the packet traversing a network for troubleshooting purposes?

A

B.

Protocol analyzers

42
Q

Which of the following security architecture elements also has sniffer functionality? (Choose two.)

A

B.
IPS

E.
IDS

43
Q

Which of the following would a security administrator implement in order to discover comprehensive security threats on a network?

A

C.

Vulnerability scan

44
Q

An administrator is concerned that a company’s web server has not been patched.

Which of the following would be the BEST assessment for the administrator to perform?

A

A.

Vulnerability scan

45
Q

Which of the following would be used to identify the security posture of a network without actually exploiting any weaknesses?

A

C.

Vulnerability scan

46
Q

Which of the following should an administrator implement to research current attack methodologies?

A

B.

Honeypot

47
Q

Based on information leaked to industry websites, business management is concerned that unauthorized employees are accessing critical project information for a major, well-known new product. To identify any such users, the security administrator could:

A

A.

Set up a honeypot and place false project documentation on an unsecure share.

48
Q

Joe, an administrator, installs a web server on the Internet that performs credit card transactions for customer payments. Joe also sets up a second web server that looks like the first web server.

However, the second server contains fabricated files and folders made to look like payments were processed on this server but really were not.

Which of the following is the second server?

A

D.

Honeypot

49
Q

Which of the following can Joe, a security administrator, implement on his network to capture attack details that are occurring while also protecting his production network?

A

D.

Honeypot

50
Q

What is a system that is intended or designed to be broken into by an attacker?

A

A.

Honeypot

Security + 401 (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions