651-700 Flashcards
The security team would like to gather intelligence about the types of attacks being launched against the organization.
Which of the following would provide them with the MOST information?
A.
Implement a honeynet
Jane, a security analyst, is reviewing logs from hosts across the Internet which her company uses to gather data on new malware.
Which of the following is being implemented by Jane’s company?
B.
Honeynet
A security administrator wants to get a real time look at what attackers are doing in the wild, hoping to lower the risk of zero-day attacks.
Which of the following should be used to accomplish this goal?
B.
Honeynets
During a security assessment, an administrator wishes to see which services are running on a remote server.
Which of the following should the administrator use?
A.
Port scanner
Which of the following tools would a security administrator use in order to identify all running services throughout an organization?
C.
Port scanner
Sara, the Chief Information Officer (CIO), has requested an audit take place to determine what services and operating systems are running on the corporate network.
Which of the following should be used to complete this task?
D.
Port scan and fingerprinting
Which device monitors network traffic in a passive manner?
A.
Sniffer
A new security analyst is given the task of determining whether any of the company’s servers are vulnerable to a recently discovered attack on an old version of SSH.
Which of the following is the quickest FIRST step toward determining the version of SSH running on these servers?
B.
Banner grabbing
After analyzing and correlating activity from multiple sensors, the security administrator has determined that a group of very well organized individuals from an enemy country is responsible for various attempts to breach the company network, through the use of very sophisticated and targeted attacks.
Which of the following is this an example of?
B.
Advanced persistent threat
A system administrator has noticed vulnerability on a high impact production server. A recent update was made available by the vendor that addresses the vulnerability but requires a reboot of the system afterwards.
Which of the following steps should the system administrator implement to address the vulnerability?
C.
Test the update in a lab environment, backup the server, schedule downtime to install the patch, install the update, reboot the server, and monitor for any changes
A security specialist has been asked to evaluate a corporate network by performing a vulnerability assessment.
Which of the following will MOST likely be performed?
A.
Identify vulnerabilities, check applicability of vulnerabilities by passively testing security controls.
Which of the following would a security administrator implement in order to identify change from the standard configuration on a server?
C.
Baseline review
Several users report to the administrator that they are having issues downloading files from the file server.
Which of the following assessment tools can be used to determine if there is an issue with the file server?
C.
Baselines
One of the servers on the network stops responding due to lack of available memory. Server administrators did not have a clear definition of what action should have taken place based on the available memory.
Which of the following would have BEST kept this incident from occurring?
B.
Set up a performance baseline
Ann, the software security engineer, works for a major software vendor.
Which of the following practices should be implemented to help prevent race conditions, buffer overflows, and other similar vulnerabilities prior to each production release?
D.
Code review
Which of the following assessment techniques would a security administrator implement to ensure that systems and software are developed properly?
D.
Design reviews
A financial company requires a new private network link with a business partner to cater for realtime and batched data flows.
Design review
Which of the following activities should be performed by the IT security staff member prior to establishing the link?
B.
Design review
Which of the following assessments would Pete, the security administrator, use to actively test that an application’s security controls are in place?
B.
Penetration test
Which of the following is the MOST intrusive type of testing against a production system?
D.
Penetration testing
During an anonymous penetration test, Jane, a system administrator, was able to identify a shared print spool directory, and was able to download a document from the spool.
Which statement BEST describes her privileges?
C.
All users have read access to the file.
