6.1 Summarize Confidentiality, integrity, and availability concerns

Question 1

What action can help mitigate against the risk of Man-in-the-Middle (MitM) attacks?

Answer 1

Making senders and receivers authenticate themselves and use encryption to validate messages
A Man-in-the-Middle (MitM) attack occurs when a malicious actor sits between two communicating nodes and monitors, captures, and relays all communication between them, without them realizing. Making senders and receivers authenticate themselves and use encryption to validate messages can help mitigate against this.

Question 2

If someone claims to be receiving spim, what problem is occurring?

Answer 2

The person is receiving advertising or promotional schemes through instant messaging.

Question 3

What is an email-based threat that presents various advertising materials, promotional content, or money-making schemes to users?

Answer 3

Spam

Question 4

How do cyber criminals typically use wiretapping to steal information?

Answer 4

Using a hardware device that inserts the hacker between two hosts. Cyber criminals have modern tools to perform wiretapping. For a relatively low cost, hardware devices allow a hacker to collect information traveling across a physical wire without being detected. This is commonly referred to as a network tap.

Question 5

What action can help mitigate the risk of replay attacks?

Answer 5

Ensuring that applications use encryption and time-stamping to make certain that the tokens cannot be misused

Question 6

What is a Replay Attack?

Answer 6

occurs when a malicious actor captures another host’s response to a server and replays that response in an effort to gain unauthorized access. This attack often involves exploiting an access token generated by an application. The application needs to use encryption and time-stamping to protect against this threat.

Question 7

You no longer need the data on a hard copy. How can you ensure confidentiality when disposing of the data?

Answer 7

Put it through a shredder.

Question 8

While working at your desk, you get a call from your bank. The representative tells you that he needs you to confirm your account number and password. What is the likely reason for this call?

Answer 8

This is most likely an illegitimate attempt to extract information from you.

Question 9

What technique would a hacker use to target the availability of network services?

Answer 9

Compromise hosts with bot malware to launch a coordinated attack that overwhelms a web service.
System availability means keeping a service running so that authorized users can access and process data. One attack that affects availability is called a Distributed Denial of Service (DDoS).

Question 10

As you are about to enter a secured building, a stranger waiting outside tells you he is a recent hire and asks you to let him in because he forgot his swipe card. What type of security attack is this?

Answer 10

Impersonation is a specific type of social engineering in which a person claims to be someone that he or she is not. In this case, someone who does not work at the company is trying to gain access to a secured facility by pretending to be a staff member.

Question 11

How can an administrator reduce the impact of hardware failures?

Answer 11

Provisioning redundant servers and configure a service to failover to a working server

Question 12

In which type of email-based social engineering attack does a person pretend to be someone else for the purpose of identity concealment by manipulating an IP address, MAC address, or email header?

Answer 12

Spoofing is a type of social engineering attack in which someone pretends to be someone else for the purpose of identity concealment. Hackers will often spoof the IP address, the network adapter’s hardware MAC addresses, and email headers.

Question 13

What action can help mitigate the risk of unexpected power outages?

Answer 13

Using a backup source, which provides a means to safely close down a server
Using a backup power source such as an Uninterruptible Power Supply (UPS) provides time to safely power down a system and prevents a “hard crash.”

Question 14

What security practice can a company use to protect its valuable data from catastrophic natural threats?

Answer 14

Creating backup data on servers in other facilities across the country

Question 15

Which action is an example of an appropriate redundancy measure?

Answer 15

Using a backup power generator in a hospital to provide electricity to critical life-support systems

Question 16

Which is an availability-related factor to consider when choosing a third-party cloud service provider?

Answer 16

Fault tolerance

Question 17

What is an example illustrates a successful phishing attack?

Answer 17

A user replies to an email with his bank account number because the message indicated he was required to do so.

Question 18

What is the best tactic for defeating social engineering?

Answer 18

Training users to recognize and respond to social engineering situations

Question 19

What technique can be used to prevent eavesdropping on a data network?

Answer 19

Encrypting data in-transit

Question 20

You find you are unable to control your computer, and a message on the screen states that you must pay a fee before you can once again assume control of your computer. Which type of malware is infecting your computer?

Answer 20

Ransomware

Question 21

What best practice can prevent a malicious person from snooping on a victim’s computer when the victim walks away?

Answer 21

Locking the Windows computer by holding down the “Windows Logo Key” and pressing the “L” key

Question 22

If the IT administrator asks you to prevent snooping by sanitizing an old hard drive, what action should you take?

Answer 22

Thoroughly delete and overwrite any traces or bits of sensitive data on the hard drive.

Question 23

What action can help mitigate the risk of impersonation attacks?

Answer 23

Implementing strong identity controls, such as badging systems for building access and multi-factor authentication for network access

Question 24

What term describes the threat of someone stealing hard copies that have been thrown out?

Answer 24

Dumpster diving

Question 25

What is a social engineering attack?

Answer 25

An attack that depends on human factors and deception rather than technology