801-850 Flashcards

1
Q

A penetration test revealed that several Linux servers were misconfigured at the file level and access was granted incorrectly. A security analyst is referencing the instructions in the incident response runbook for remediation information. Which of the following is the best command to use to resolve the issue?

A. chmod
B. cat
C. grep
D. dig

A

A. chmod

chmod: This command is used to change the permissions of files and directories on Linux and Unix-like operating systems. It allows the security analyst to modify the permissions (read, write, execute) for the owner, group, and others, thereby correcting any misconfigurations that may have granted incorrect access.

Here’s why the other options are not suitable:

B. cat: This command is used to concatenate and display the contents of files. It does not alter file permissions.

C. grep: This command is used for searching text patterns in files. While useful for finding specific lines containing text, it does not change file permissions.

D. dig: This command is used for querying DNS name servers. It is not related to changing file permissions.

Therefore, A. chmod is the correct and best command to use for remediation in this scenario where Linux servers have misconfigured file permissions granting incorrect access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which of the following is the most important security concern when using legacy systems to provide production service?

A. Instability
B. Lack of vendor support
C. Loss of availability
D. Use of insecure protocols

A

B. Lack of vendor support

Here’s why:

Lack of Vendor Support: Legacy systems often reach a point where the original vendor no longer provides updates, patches, or support. This leaves the system vulnerable to newly discovered security vulnerabilities and makes it difficult or impossible to address security issues promptly.

Security Implications: Without vendor support, there are no security patches or updates to protect the system from evolving threats. This increases the risk of exploitation through known vulnerabilities, potentially leading to data breaches, unauthorized access, or service disruptions.

Other Options:
    Instability (option A): While instability is a concern, lack of vendor support directly impacts the ability to secure and maintain the system over time.
    Loss of availability (option C): Loss of availability can be a concern, but it is often mitigated through redundancy and failover mechanisms rather than directly related to vendor support.
    Use of insecure protocols (option D): Using insecure protocols is a security concern, but it can often be addressed through configuration changes or network segmentation, whereas lack of vendor support cannot be easily remedied.

Therefore, B. Lack of vendor support is the most critical security concern when using legacy systems for production services, as it directly affects the ability to maintain the security posture of the system over its operational lifecycle.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which of the following would best enable a systems administrator to easily determine which devices are located at a remote facility and allow policy to be pushed to only those devices?

A. Baseline configurations
B. Network diagrams
C. Standard naming conventions
D. Hot sites

A

C. Standard naming conventions
Explanation:

Standard Naming Conventions:

Definition: Standard naming conventions involve creating a systematic way of naming devices that reflect certain attributes, such as location, function, or department.
Purpose: By using a consistent naming scheme, administrators can quickly identify and categorize devices based on their names. This is particularly useful for determining the location of devices (e.g., including site codes or location identifiers in the device names).
Policy Application: Policies can be pushed to devices that match a specific naming pattern, making it easy to target only those devices at a specific remote facility.

Why Other Options Are Less Suitable:

A. Baseline configurations:

Definition: Baseline configurations refer to a set of standard settings and configurations that all devices should adhere to.
Limitation: While useful for maintaining consistency, baseline configurations do not inherently provide information about the physical location of devices.

B. Network diagrams:

Definition: Network diagrams visually represent the network infrastructure, showing how devices are interconnected.
Limitation: Although helpful for understanding the network layout, network diagrams do not offer a quick and automated way to determine device locations or push policies.

D. Hot sites:

Definition: A hot site is a fully equipped, operational facility that a company can use in the event of a disaster.
Limitation: This concept is related to disaster recovery and business continuity rather than daily device management and policy application.

Therefore, standard naming conventions are the best choice for easily determining the location of devices and enabling the targeted application of policies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

A company is utilizing an offshore team to help support the finance department. The company wants to keep the data secure by keeping it on a company device but does not want to provide equipment to the offshore team. Which of the following should the company implement to meet this requirement?

A. VDI
B. MDM
C. VPN
D. VPC

A

A. VDI (Virtual Desktop Infrastructure)

Here’s why VDI is the appropriate choice:

VDI: Virtual Desktop Infrastructure allows users, in this case, the offshore team, to access virtual desktops hosted on company-owned servers or cloud infrastructure. The data and applications remain centralized within the company's infrastructure, ensuring that sensitive information stays secure and is not stored locally on the offshore team's devices.

Security Benefits: With VDI, data remains within the controlled environment of the company's data center or cloud platform. Users access virtual desktops remotely using secure connections, such as VPN (Virtual Private Network) for additional security layers.

Other Options:
    MDM (Mobile Device Management) (option B): MDM focuses on managing mobile devices (like smartphones and tablets) and may not directly apply to managing virtual desktops or securing data on company devices.
    VPN (Virtual Private Network) (option C): VPN provides secure remote access to the company's network but does not inherently control data storage or access on remote devices.
    VPC (Virtual Private Cloud) (option D): VPC is a virtual network dedicated to a single organization within a cloud provider's infrastructure and does not address the requirement to secure data on company devices without providing equipment to the offshore team.

Therefore, A. VDI (Virtual Desktop Infrastructure) is the best solution for allowing the offshore team to securely access and work with company data on company-controlled devices without needing to provide physical equipment to the team.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Which of the following is best used to detect fraud by assigning employees to different roles?

A. Least privilege
B. Mandatory vacation
C. Separation of duties
D. Job rotation

A

D. Job rotation

Job rotation will DETECT
Seperation of duties will PREVENT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

A company implemented an MDM policy to mitigate risks after repeated instances of employees losing company-provided mobile phones. In several cases, the lost phones were used maliciously to perform social engineering attacks against other employees. Which of the following MDM features should be configured to best address this issue? (Choose two.)

A. Screen locks
B. Remote wipe
C. Full device encryption
D. Push notifications
E. Application management
F. Geolocation

A

(Community : AB 62%, BC 37%)
A. Screen locks
B. Remote wipe

Here’s why these features are appropriate:

Screen locks (option A): Configuring screen locks ensures that if a device is lost or left unattended, it automatically locks after a period of inactivity. This prevents unauthorized access to the device and the data it contains, reducing the risk of malicious use.

Remote wipe (option B): Remote wipe allows administrators to remotely erase all data on a lost or stolen device. This feature is crucial in ensuring that sensitive company information does not fall into the wrong hands and cannot be used for malicious purposes.

Other Options:
    Full device encryption (option C): While important for protecting data at rest, it does not directly prevent malicious use if the device is lost or stolen.
    Push notifications (option D): While useful for sending alerts or updates to devices, it does not directly mitigate the risk of malicious use.
    Application management (option E): Involves controlling which applications can be installed on devices, but it does not directly address the issue of lost devices being used for social engineering attacks.
    Geolocation (option F): Helps in locating lost or stolen devices, but it does not prevent malicious use once the device is lost.

Therefore, A. Screen locks and B. Remote wipe are the MDM features that should be configured to best mitigate the risk of lost company-provided mobile phones being used maliciously for social engineering attacks.

(Brain dump: B. Remote wipe, C. Full device encryption)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

During a recent company safety stand-down, the cyber-awareness team gave a presentation on the importance of cyber hygiene. One topic the team covered was best practices for printing centers. Which of the following describes an attack method that relates to printing centers?

A. Whaling
B. Credential harvesting
C. Prepending
D. Dumpster diving

A

D. Dumpster diving

Here’s why:

Dumpster diving: This attack method involves searching through physical trash or recycling bins to find sensitive information that has been discarded improperly. In the context of printing centers, documents that are printed but not securely disposed of could end up in trash bins. Attackers can then retrieve these documents through dumpster diving to obtain sensitive information such as passwords, financial data, or confidential business information.

Printing Centers: Printing centers often handle documents that may contain sensitive or confidential information. If these documents are not securely disposed of after use, they pose a significant risk if retrieved by unauthorized individuals through dumpster diving.

Other Options:
    Whaling (option A): Whaling refers to a specific type of phishing attack targeting high-profile individuals within an organization, typically executives. It does not directly relate to printing centers.
    Credential harvesting (option B): This involves gathering login credentials through various means such as phishing, keylogging, or social engineering. It does not specifically relate to printing centers.
    Prepending (option C): This term refers to adding something at the beginning of a file or data stream, not typically related to physical security risks like dumpster diving.

Therefore, D. Dumpster diving is the attack method that relates to printing centers, highlighting the importance of securely disposing of printed documents to prevent unauthorized access to sensitive information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

The security operations center is researching an event concerning a suspicious IP address. A security analyst looks at the following event logs and discovers that a significant portion of the user accounts have experienced failed log-in attempts when authenticating from the same IP address:

184.168.131.241 - userA - failed authentication
184.168.131.241 - userA - failed authentication
184.168.131.241 - userB - failed authentication
184.168.131.241 - userB - failed authentication
184.168.131.241 - userC - failed authentication
184.168.131.241 - userC - failed authentication

Which of the following most likely describes the attack that took place?

A. Spraying
B. Brute-force
C. Dictionary
D. Rainbow table

A

A. Spraying

Here’s why:

Spraying: In a spraying attack, attackers attempt to gain unauthorized access to multiple accounts by trying a small number of commonly used passwords or weak credentials across many accounts. The goal is to avoid triggering account lockouts or detection mechanisms that typically respond to numerous failed attempts on a single account.

Event Scenario: The logs show multiple failed authentication attempts across different user accounts (userA, userB, userC) from the same IP address. This pattern suggests that the attacker is trying a few credentials across various accounts to avoid detection, which aligns with the spraying attack method.

Other Options:
    Brute-force (option B): Brute-force attacks involve systematically trying all possible combinations of passwords until the correct one is found. This would typically result in many failed attempts on the same account, not spread across multiple accounts as shown in the logs.
    Dictionary (option C): Dictionary attacks involve using a predefined list of common passwords or words. However, this attack method also typically focuses on a single account rather than multiple accounts simultaneously.
    Rainbow table (option D): Rainbow table attacks are based on precomputed tables used to crack hashed passwords quickly. This is not indicated by the log entries provided, which show failed authentication attempts without reference to password cracking or hash tables.

Therefore, A. Spraying is the attack method that most likely describes the event where multiple user accounts experienced failed log-in attempts from the same IP address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which of the following is an algorithm performed to verify that data has not been modified?

A. Hash
B. Code check
C. Encryption
D. Checksum

A

A. Hash

Hashing is the process of taking an input (or ‘message’) and returning a fixed-size string of bytes. This output, known as the hash value or hash code, is unique to the specific input and is determined by the hashing algorithm used. Hash functions are designed to be fast to compute and irreversibly transform data into a fixed-size output.

Here’s why the other options are not correct:

Code check (option B): This generally refers to verifying the integrity or correctness of software code rather than data integrity.

Encryption (option C): Encryption is a process of transforming data to make it unreadable without specific knowledge or keys. While encryption can ensure confidentiality, it does not inherently verify data integrity.

Checksum (option D): Checksums are a form of error-detecting code used to detect accidental changes to raw data, such as file transfers. While similar to hashing in some aspects, checksums are generally simpler and less secure for ensuring data integrity compared to cryptographic hash functions.

Therefore, A. Hash is the algorithm performed to verify that data has not been modified, ensuring data integrity by producing a unique hash value based on the content of the data itself.

(Brain dump : D. Checksum)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

A network administrator deployed a DNS logging tool that logs suspicious websites that are visited and then sends a daily report based on various weighted metrics. Which of the following best describes the type of control the administrator put in place?

A. Preventive
B. Deterrent
C. Corrective
D. Detective

A

D. Detective

Here’s why:

Detective controls: These are controls that are designed to identify and record potentially harmful activities or security violations. They provide information about what has happened, enabling the organization to respond appropriately. The DNS logging tool that logs suspicious websites and sends reports helps to detect and record any potentially malicious or suspicious activity, making it a detective control.

Other Options:
    Preventive (option A): Preventive controls are intended to stop or prevent security incidents from occurring in the first place. Examples include firewalls, antivirus software, and access controls. The DNS logging tool does not prevent access to suspicious websites but rather logs and reports it.
    Deterrent (option B): Deterrent controls are intended to discourage individuals from engaging in potentially harmful activities. Examples include warning banners and surveillance cameras. While the logging tool might have a minor deterrent effect, its primary function is to detect and report.
    Corrective (option C): Corrective controls are designed to correct or mitigate the effects of an incident after it has occurred. Examples include backup systems and incident response plans. The DNS logging tool does not correct issues but detects and logs them.

Therefore, D. Detective best describes the type of control the administrator put in place with the DNS logging tool.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

A business uses Wi-Fi with content filtering enabled. An employee noticed a coworker accessed a blocked site from a work computer and reported the issue. While investigating the issue, a security administrator found another device providing internet access to certain employees. Which of the following best describes the security risk?

A. The host-based security agent is not running on all computers.
B. A rogue access point is allowing users to bypass controls.
C. Employees who have certain credentials are using a hidden SSID.
D. A valid access point is being jammed to limit availability.

A

B. A rogue access point is allowing users to bypass controls.

Here’s why:

Rogue Access Point: A rogue access point is an unauthorized wireless access point that has been installed on a network without the knowledge or permission of the network administrator. Rogue access points can provide unrestricted access to the internet, bypassing the company's security measures, such as content filtering and monitoring. This can lead to significant security risks as employees can access blocked or malicious sites, potentially exposing the network to security threats.

Other Options:
    Host-based security agent is not running on all computers (option A): While this could be a security concern, it does not directly explain the ability to access blocked sites via another device providing internet access.
    Employees using a hidden SSID (option C): This implies using a different, possibly authorized network with hidden SSID, which is not the main issue described. The main problem is the unauthorized internet access via another device.
    Valid access point being jammed (option D): This suggests interference with legitimate access points to deny service, which does not align with the scenario where employees are accessing the internet through another device.

Therefore, B. A rogue access point is allowing users to bypass controls best describes the security risk in the given situation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

While considering the organization’s cloud-adoption strategy, the Chief Information Security Officer sets a goal to outsource patching of firmware, operating systems, and applications to the chosen cloud vendor. Which of the following best meets this goal?

A. Community cloud
B. PaaS
C. Containerization
D. Private cloud
E. SaaS
F. IaaS

A

E. SaaS (Software as a Service)

Here’s why:

SaaS (Software as a Service): SaaS is a cloud service model where the cloud provider is responsible for managing the entire infrastructure, including the hardware, operating system, and the software applications. This means that patching of firmware, operating systems, and applications is handled by the SaaS provider. Users access the software over the internet, and the provider takes care of maintenance, including updates and security patches.

Other Options:
    Community cloud (option A): This refers to a cloud infrastructure shared by several organizations with common concerns (e.g., security, compliance). While it provides shared resources, it does not inherently outsource patching responsibilities.
    PaaS (Platform as a Service) (option B): PaaS provides a platform allowing customers to develop, run, and manage applications without dealing with the underlying infrastructure. The provider manages the underlying infrastructure and operating systems, but the customer may still need to handle application-level patching.
    Containerization (option C): This is a technology used to package and run applications and their dependencies in isolated environments. While it helps in application deployment, it does not itself handle patching responsibilities.
    Private cloud (option D): A private cloud is a cloud infrastructure operated solely for a single organization. The organization typically retains control over and responsibility for its infrastructure, including patching.
    IaaS (Infrastructure as a Service) (option F): IaaS provides virtualized computing resources over the internet. While the provider manages the hardware and virtualization, the customer is responsible for patching the operating systems and applications.

Therefore, E. SaaS best meets the goal of outsourcing the patching of firmware, operating systems, and applications to the chosen cloud vendor.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

A spoofed identity was detected for a digital certificate. Which of the following are the type of unidentified key and the certificate that could be in use on the company domain?

A. Private key and root certificate
B. Public key and expired certificate
C. Private key and self-signed certificate
D. Public key and wildcard certificate

A

C. Private key and self-signed certificate

Here’s why:

Self-signed Certificate: A self-signed certificate is signed by the entity that it certifies rather than a trusted Certificate Authority (CA). Because it is not verified by a third party, it is easier for an attacker to spoof the identity associated with the certificate.

Private Key: The private key is used in conjunction with the certificate for authentication and encryption. If a spoofed identity is detected, it indicates that the private key, which is supposed to be secret, might have been compromised or replaced in the context of the self-signed certificate.

Other Options:
    Private key and root certificate (option A): A root certificate is issued by a trusted CA and used to authenticate subordinate certificates. It is less likely to be spoofed because it is widely trusted and strictly controlled.
    Public key and expired certificate (option B): An expired certificate would not be trusted by browsers and systems, but it does not directly relate to identity spoofing.
    Public key and wildcard certificate (option D): A wildcard certificate is used to secure multiple subdomains with a single certificate. While it involves a public key, the issue described is more aligned with self-signed certificates where trust is not established by a third party.

Therefore, the combination of C. Private key and self-signed certificate best describes the scenario where a spoofed identity was detected for a digital certificate on the company domain.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

A software developer would like to ensure the source code cannot be reverse engineered or debugged. Which of the following should the developer consider?

A. Version control
B. Obfuscation toolkit
C. Code reuse
D. Continuous integration
E. Stored procedures

A

B. Obfuscation toolkit

Here’s why:

Obfuscation toolkit: Code obfuscation is the process of modifying the source code to make it more difficult to understand and reverse engineer while preserving its functionality. An obfuscation toolkit will transform the code into a form that is hard for humans to interpret and for tools to analyze, thereby protecting it from reverse engineering and debugging.

Other Options:
    Version control (option A): Version control systems (like Git) are used to manage changes to source code over time. While important for software development, they do not prevent reverse engineering or debugging.
    Code reuse (option C): Code reuse involves using existing code for new functions or software. While it can improve efficiency, it does not inherently protect against reverse engineering.
    Continuous integration (option D): Continuous integration is a development practice where code changes are automatically tested and integrated into a shared repository. It improves software quality and collaboration but does not protect against reverse engineering.
    Stored procedures (option E): Stored procedures are precompiled collections of SQL statements and optional control-of-flow statements stored under a name and processed as a unit. They are used in databases and can enhance security within the database context but do not directly address the protection of source code from reverse engineering.

Therefore, B. Obfuscation toolkit is the appropriate choice for a developer looking to ensure that the source code cannot be easily reverse engineered or debugged.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which of the following is the most effective way to protect an application server running software that is no longer supported from network threats?

A. Air gap
B. Barricade
C. Port security
D. Screened subnet

A

Community : D 71%, A 29%
D. Screened subnet

One of the most effective ways to protect an application server is to use a screened subnet. A screened subnet is a network segment that is isolated from both the internet and the internal network by two firewalls. The application server is placed in the screened subnet, also known as the demilitarized zone (DMZ), and only the necessary ports are opened for communication. This way, the application server is shielded from external attacks and internal breaches, and the impact of a compromise is minimized.

ChatGPT & Brain dump:
A. Air gap

Here’s why:

Air gap: An air gap involves physically isolating the server from any network connections, effectively cutting it off from all external threats. This is the most secure method to protect an unsupported server from network-based attacks since there is no network path for an attacker to exploit.

Other Options:
    Barricade (option B): This is not a standard network security term. It might imply a physical barrier or some form of defense, but it is not a specific, effective network security measure.
    Port security (option C): Port security is a feature on network switches that can control access to specific ports. While useful for securing network segments, it does not provide comprehensive protection for an unsupported application server.
    Screened subnet (option D): A screened subnet (or DMZ) is a network segment that is isolated from an internal network by a firewall. While it can limit exposure, it still allows some network access, which can be a risk for unsupported software.

Therefore, A. Air gap is the most effective way to protect an application server with unsupported software from network threats by completely isolating it from potential network-based attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

A growing company would like to enhance the ability of its security operations center to detect threats but reduce the amount of manual work required for the security analysts. Which of the following would best enable the reduction in manual work?

A. SOAR
B. SIEM
C. MDM
D. DLP

A

A. SOAR (Security Orchestration, Automation, and Response)

Here’s why:

SOAR (Security Orchestration, Automation, and Response): SOAR platforms are designed to improve the efficiency and effectiveness of security operations by automating repetitive tasks, orchestrating workflows, and integrating various security tools and data sources. This reduces the manual workload for security analysts and allows them to focus on more complex and strategic tasks. SOAR can automate incident response, threat detection, and other security operations processes, significantly enhancing the SOC's capabilities.

Other Options:
    SIEM (Security Information and Event Management) (option B): SIEM systems collect and analyze security event data from various sources to detect threats and generate alerts. While SIEM is crucial for threat detection and response, it does not inherently automate responses and can still require significant manual intervention.
    MDM (Mobile Device Management) (option C): MDM solutions are used to manage and secure mobile devices within an organization. While important for mobile security, MDM does not directly reduce manual work for threat detection and response in the SOC.
    DLP (Data Loss Prevention) (option D): DLP solutions help prevent data breaches by monitoring and controlling data transfers and access. DLP is focused on data security rather than overall threat detection and response automation.

Therefore, A. SOAR is the best option to enable the reduction in manual work for security analysts while enhancing the SOC’s ability to detect and respond to threats.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Which of the following can a security director use to prioritize vulnerability patching within a company’s IT environment?

A. SOAR
B. CVSS
C. SIEM
D. CVE

A

B. CVSS (Common Vulnerability Scoring System)

Here’s why:

CVSS (Common Vulnerability Scoring System): CVSS provides a standardized way to assess and score the severity of vulnerabilities. It helps security professionals prioritize vulnerability patching by assigning a numerical score to each vulnerability, reflecting its potential impact and exploitability. This scoring system allows organizations to focus on the most critical vulnerabilities first.

Other Options:
    SOAR (Security Orchestration, Automation, and Response) (option A): SOAR tools can automate and orchestrate responses to security incidents, but they do not specifically provide a system for scoring and prioritizing vulnerabilities.
    SIEM (Security Information and Event Management) (option C): SIEM systems collect and analyze security event data, providing real-time monitoring and alerts for potential threats. While valuable for threat detection and response, SIEM does not specifically provide a method for prioritizing vulnerability patching.
    CVE (Common Vulnerabilities and Exposures) (option D): CVE is a list of publicly disclosed information security vulnerabilities and exposures. While it is useful for identifying and referencing vulnerabilities, CVE itself does not provide a scoring or prioritization system.

Therefore, B. CVSS is the appropriate tool for a security director to use in prioritizing vulnerability patching within a company’s IT environment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

The Chief Information Security Officer wants to put security measures in place to protect PH. The organization needs to use its existing labeling and classification system to accomplish this goal. Which of the following would most likely be configured to meet the requirements?

A. Tokenization
B. S/MIME
C. DLP
D. MFA

A

C. DLP (Data Loss Prevention)

Here’s why:

DLP (Data Loss Prevention): DLP solutions are designed to detect and prevent data breaches by monitoring and controlling data transfers and ensuring that sensitive information is not shared or accessed inappropriately. DLP can be configured to work with an existing labeling and classification system to enforce policies that protect PII by identifying, monitoring, and controlling the movement of sensitive data across the organization.

Other Options:
    Tokenization (option A): Tokenization replaces sensitive data with non-sensitive tokens. While it protects data, it does not directly integrate with labeling and classification systems to enforce security policies.
    S/MIME (option B): Secure/Multipurpose Internet Mail Extensions (S/MIME) is used to secure email communications through encryption and digital signatures. It does not address the broader requirement of protecting PII across the organization.
    MFA (Multi-Factor Authentication) (option D): MFA enhances access security by requiring multiple forms of verification. While important for protecting access to systems and data, it does not specifically address data protection and classification.

Therefore, C. DLP is the best option to configure in order to meet the requirements of protecting PII using the existing labeling and classification system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

A company wants to get alerts when others are researching and doing reconnaissance on the company. One approach would be to host a part of the infrastructure online with known vulnerabilities that would appear to be company assets. Which of the following describes this approach?

A. Watering hole
B. Bug bounty
C. DNS sinkhole
D. Honeypot

A

D. Honeypot

Here’s why:

Honeypot: A honeypot is a security mechanism set up to detect, deflect, or study attempts at unauthorized access to information systems. By deliberately hosting vulnerable systems that appear to be legitimate company assets, a honeypot can attract attackers and provide alerts when reconnaissance or other malicious activities are detected. This helps the company understand and respond to potential threats.

Other Options:
    Watering hole (option A): A watering hole attack involves compromising a legitimate website that is frequented by the target group, infecting it with malware to compromise users when they visit the site. It is an offensive technique rather than a defensive one.
    Bug bounty (option B): A bug bounty program is an initiative where organizations offer rewards to individuals for discovering and reporting vulnerabilities in their systems. This approach involves inviting external security researchers to find vulnerabilities, not setting up vulnerable systems for detection purposes.
    DNS sinkhole (option C): A DNS sinkhole is used to redirect malicious traffic to a controlled IP address to prevent users from reaching harmful websites. It is more about preventing access to malicious domains than detecting reconnaissance activities.

Therefore, D. Honeypot is the correct term for the described approach.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Which of the following is the final step of the incident response process?

A. Lessons learned
B. Eradication
C. Containment
D. Recovery

A

A. Lessons learned

Here’s why:

Lessons learned: After an incident has been contained, eradicated, and the affected systems have been recovered, the incident response team conducts a review. This review includes analyzing the incident, identifying what worked well and what did not, documenting lessons learned, and making recommendations for improvements to prevent similar incidents in the future. This step is crucial for continuous improvement of the organization's incident response capabilities.

Other Options:
    Eradication (option B): Eradication involves completely removing the threat or malware from affected systems. It typically occurs after containment but before recovery.
    Containment (option C): Containment involves limiting the spread and impact of the incident to prevent further damage. It is an early step in the incident response process.
    Recovery (option D): Recovery involves restoring affected systems to normal operation and ensuring business continuity. It is a necessary step but occurs before the lessons learned phase.

Therefore, A. Lessons learned is the final step of the incident response process, where the focus is on improving the organization’s overall security posture based on the insights gained from handling the incident.

21
Q

A systems administrator is redesigning how devices will perform network authentication. The following requirements need to be met:

  • An existing internal certificate must be used.
  • Wired and wireless networks must be supported.
  • Any unapproved device should be isolated in a quarantine subnet.
  • Approved devices should be updated before accessing resources.

Which of the following would best meet the requirements?

A. 802.1X
B. EAP
C. RADIUS
D. WPA2

A

A. 802.1X

Here’s how 802.1X meets each requirement:

Use of an existing internal certificate: 802.1X supports the use of digital certificates for authentication, allowing the administrator to use an existing internal certificate for authentication purposes.

Support for wired and wireless networks: 802.1X is a standard protocol that supports both wired (IEEE 802.3) and wireless (IEEE 802.11) networks, providing a unified authentication mechanism.

Isolation of unapproved devices in a quarantine subnet: With 802.1X, devices that fail authentication can be placed into a quarantine VLAN or subnet, isolating them from the main network until they meet compliance requirements.

Updating approved devices before accessing resources: Approved devices can be subjected to network policies and configuration updates upon authentication through 802.1X before gaining access to network resources.

Other Options:

EAP (Option B): Extensible Authentication Protocol (EAP) is an authentication framework that works with various authentication methods, including within 802.1X. It does not, however, provide the complete network access control and isolation capabilities described.

RADIUS (Option C): Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA) management. While integral to 802.1X implementations, RADIUS alone does not meet all the described requirements.

WPA2 (Option D): Wi-Fi Protected Access 2 (WPA2) is a security protocol for wireless networks, not wired networks, and does not provide the level of device authentication and network access control required across both wired and wireless networks.

Therefore, A. 802.1X is the best choice for meeting the specified requirements for network authentication in this scenario.

22
Q

An IT security team is concerned about the confidentiality of documents left unattended in MFPs. Which of the following should the security team do to mitigate the situation?

A. Educate users about the importance of paper shredder devices.
B. Deploy an authentication factor that requires in-person action before printing.
C. Install a software client in every computer authorized to use the MFPs.
D. Update the management software to utilize encryption.

A

B. Deploy an authentication factor that requires in-person action before printing.

MFPs = Multi-Function Printers

Here’s why this is the best option:

Authentication factor requiring in-person action: By requiring users to physically authenticate themselves at the MFP before printing (for example, using a proximity card, PIN code, or biometric authentication), the security team can ensure that only authorized personnel are able to retrieve printed documents promptly. This reduces the risk of documents being left unattended in the output tray.

Other Options Considered:
    Educate users about paper shredder devices (Option A): While educating users about secure disposal methods is important, it does not directly address the issue of documents being left unattended in MFPs.
    Install a software client in every authorized computer (Option C): This might enhance control over print jobs but does not mitigate the risk of unattended printed documents.
    Update management software to utilize encryption (Option D): Encrypting print jobs and data transmission can protect data in transit but does not address the physical security of printed documents left in the output tray.

Therefore, B. Deploy an authentication factor that requires in-person action before printing is the most effective measure to mitigate the risk of confidentiality breaches due to unattended documents in MFPs.

23
Q

A security analyst finds a rogue device during a monthly audit of current endpoint assets that are connected to the network. The corporate network utilizes 802.1 X for access control. To be allowed on the network, a device must have a known hardware address, and a valid username and password must be entered in a captive portal. The following is the audit report:

IP address MAC Host Account
10.18.04.42 BE-AC-11-F1-E4-44 PC-NY user1
10.18.04.38 EB-AC-11-82-42-F3 PC-CA user3
10.18.04.59 28-BB-5A-11-52-29 PC-PA user2
10.18.04.58 28-BB-5A-F0-E9-D1 PC-TX user4
10.18.04.22 EB-AC-11-82-42-F3 WIN10 user3
10.18.04.26 BB-28-11-21-A2-73 PC-NJ admin

Which of the following is the most likely way a rogue device was allowed to connect?

A. A user performed a MAC cloning attack with a personal device.
B. A DHCP failure caused an incorrect IP address to be distributed
C. An administrator bypassed the security controls for testing.
D. DNS hijacking let an attacker intercept the captive portal traffic.

A

A. A user performed a MAC cloning attack with a personal device.

Here’s why:

MAC address duplication: In an 802.1X environment, devices are authenticated based on their MAC addresses and user credentials. If a user clones the MAC address of an authorized device (such as a PC), the network may recognize the cloned MAC address as legitimate and grant network access, assuming the user also provides valid credentials via the captive portal. This allows the rogue device to bypass the network's security controls and gain unauthorized access.

Other Options Considered:
    DHCP failure causing an incorrect IP address (Option B): DHCP issues typically result in connectivity problems or IP conflicts but do not directly bypass 802.1X authentication.
    Administrator bypassing security controls for testing (Option C): While possible, proper procedures would involve notifying stakeholders and ensuring such actions do not compromise security controls permanently.
    DNS hijacking allowing interception of captive portal traffic (Option D): DNS hijacking primarily affects DNS resolution and could redirect traffic, but it does not directly bypass MAC-based 802.1X authentication.

Therefore, A. A user performed a MAC cloning attack with a personal device aligns most closely with how a rogue device could circumvent the network’s 802.1X authentication and connect to the network.

24
Q

A security administrator recently reset local passwords and the following values were
recorded in the system:

Host Account MD5 password values
ACCT-PC-1 admin f1bdf5ed1d7adede4e3809bd35644b0
HR-PC-1 admin d706ab8258fe67c131ebc57a6e28184
IT-PC-2 admin f8ddb9cbb321d7dfbf6cb05973f0b3d
FILE-SRV-1 admin f054bbd2f5ebab9cb5571000b2c60c02
DB-SRV-1 admin 8638f732ba7cf2d95b1697e2725da78

Which of the following is the security administrator most likely protecting against?

A. Account sharing
B. Weak password complexity
C. Pass-the-hash attacks
D. Password compromise

A

(Community : C 52%, D 48%)
C. Pass-the-hash attacks

Here’s why:

MD5 password values: The MD5 hashes provided in the system indicate that passwords are stored in a hashed format. However, MD5 hashes are vulnerable to being cracked, especially if the passwords they represent are weak or common.

Pass-the-hash attacks: In pass-the-hash attacks, attackers capture hashed credentials (like MD5 hashes) from compromised systems and use them to authenticate to other systems without needing to crack the original password. This method allows attackers to bypass traditional authentication mechanisms that rely on plaintext passwords.

Other Options Considered:
    Account sharing (Option A): While a concern, resetting passwords would not directly mitigate account sharing unless combined with other measures.
    Weak password complexity (Option B): Resetting passwords might improve password complexity if new policies are enforced, but MD5 hashes do not directly indicate weak complexity.
    Password compromise (Option D): Resetting passwords aims to prevent compromise, but MD5 hashes do not directly indicate compromise unless they are cracked.

Therefore, the security administrator resetting local passwords and recording MD5 hashes is likely protecting against C. Pass-the-hash attacks, aiming to mitigate the risk of attackers using captured password hashes to gain unauthorized access to other systems.

(Brain dump: D. Password compromise)

25
Q

Which of the following characteristics of tokenization explains how credit card information that is stored in a database is protected?

A. The fields are irreversible.
B. Symmetric algorithms are used.
C. Only authorized card holders have access.
D. The data is relabeled.

A

(Brain dump: D. The data is relabeled)
(Community : D 70%, A 30%)
D. The data is relabeled.

Tokenization does not maake the fileds irreversible, use symmetric algorithms, or restrict access to authorizeed card holders. It simply chnages the data into a different format that has no value outside the context of the transaction

Chat GPT:
A. The fields are irreversible.

Here’s why:

Irreversible fields: Tokenization involves replacing sensitive data (such as credit card numbers) with unique identification symbols (tokens) that retain essential information about the data without compromising its security. Unlike encryption, which can be decrypted to retrieve the original data, tokenization is irreversible. Once a credit card number is tokenized, there is no straightforward way to reverse the process to obtain the original card number without access to the tokenization system's mapping or tokenization vault.

Other Options Considered:
    Symmetric algorithms are used (Option B): Symmetric algorithms are not specifically tied to tokenization. They are more commonly associated with encryption methods rather than tokenization.
    Only authorized card holders have access (Option C): Access control is a general security principle that applies to protecting data systems, but it does not specifically describe tokenization.
    The data is relabeled (Option D): While tokenization does involve replacing sensitive data with tokens, the term "relabeled" is not typically used in the context of tokenization.

Therefore, A. The fields are irreversible accurately describes how tokenization protects credit card information by ensuring that the original sensitive data cannot be reconstructed from the tokens stored in the database.

26
Q

A systems administrator wants to implement a backup solution. The solution needs to allow recovery of the entire system, including the operating system, in case of a disaster. Which of the following backup types should the administrator consider?

A. Incremental
B. Storage area network
C. Differential
D. Image

A

D. Image

Here’s why:

Image backups: An image backup captures a complete snapshot of the entire system, including the operating system, applications, settings, and data. It essentially creates a mirror image of the system at a specific point in time. This type of backup is crucial for disaster recovery because it allows for quick and comprehensive restoration of the entire system onto new or repaired hardware.

Other Options Considered:
    Incremental backups (Option A): Incremental backups only capture changes made since the last backup (whether full or incremental). While efficient for storage space, they require the full backup and all subsequent incremental backups to fully restore a system, which may not be ideal for rapid disaster recovery.
    Storage Area Network (SAN) (Option B): SAN is a storage infrastructure rather than a backup type. It provides high-speed access to storage devices across a network but does not inherently address disaster recovery.
    Differential backups (Option C): Differential backups capture changes made since the last full backup. While they can be faster to restore than incremental backups, they still require the original full backup to fully restore the system.

Therefore, D. Image backups are the best choice for ensuring comprehensive system recovery, including the operating system, in case of a disaster.

27
Q

An administrator is investigating an incident and discovers several users’ computers were infected with malware after viewing files that were shared with them. The administrator discovers no degraded performance in the infected machines and an examination of the log files does not show excessive failed logins. Which of the following attacks is most likely the cause of the malware?

A. Malicious flash drive
B. Remote access Trojan
C. Brute-forced password
D. Cryptojacking

A

(Brain dump: B. Remote access Trojan)
(Community : B 70%, A 30%)
B. Remote access Trojan

ChatGPT
A. Malicious flash drive

Here’s why:

No degraded performance: Malware introduced via a malicious flash drive may not immediately degrade system performance. Instead, it could remain dormant or operate stealthily, avoiding detection while executing malicious activities in the background.

No excessive failed logins: Malware introduced through other means like brute-forcing passwords or using remote access Trojans typically leaves traces such as failed login attempts in log files. The absence of such logs suggests that these methods are less likely.

Shared files as infection vector: If users received files that were infected via a malicious flash drive and then shared them, this could easily propagate malware across multiple machines without immediately triggering noticeable performance issues or generating unusual log entries related to failed logins.

Therefore, considering the lack of degraded performance and absence of excessive failed logins in the log files, A. Malicious flash drive is the most likely cause of the malware infection described in the incident investigation.

28
Q

A security analyst discovers that a large number of employee credentials had been stolen and were being sold on the dark web. The analyst investigates and discovers that some hourly employee credentials were compromised, but salaried employee credentials were not affected.

Most employees clocked in and out while they were inside the building using one of the kiosks connected to the network. However, some clocked out and recorded their time after leaving to go home. Only those who clocked in and out while inside the building had credentials stolen. Each of the kiosks are on different floors, and there are multiple routers, since the business segments environments for certain business functions.

Hourly employees are required to use a website called acmetimekeeping.com to clock in and out. This website is accessible from the internet. Which of the following is the most likely reason for this compromise?

A. A brute-force attack was used against the time-keeping website to scan for common passwords.
B. A malicious actor compromised the time-keeping website with malicious code using an unpatched vulnerability on the site, stealing the credentials.
C. The internal DNS servers were poisoned and were redirecting acmetimekeeping.com to a malicious domain that intercepted the credentials and then passed them through to the real site.
D. ARP poisoning affected the machines in the building and caused the kiosks to send a copy of all the submitted credentials to a malicious machine.

A

C. The internal DNS servers were poisoned and were redirecting acmetimekeeping.com to a malicious domain that intercepted the credentials and then passed them through to the real site.

Here’s why:

Hourly employees affected: Only those employees who clocked in and out while inside the building had their credentials stolen. This suggests that the compromise occurred within the internal network environment.

Usage of acmetimekeeping.com: The time-keeping website acmetimekeeping.com is accessible from the internet. If internal DNS servers were poisoned, they could have been redirecting requests for acmetimekeeping.com to a malicious domain controlled by attackers.

DNS poisoning: DNS poisoning involves attackers corrupting or compromising DNS data stored on DNS servers. By poisoning the internal DNS servers, attackers can redirect legitimate requests to malicious websites controlled by them. In this case, they could redirect requests for acmetimekeeping.com to a malicious site that captures employee credentials when they log in to clock their time.

No mention of external compromise: There is no indication in the scenario that the external acmetimekeeping.com website itself was compromised. Instead, the compromise seems to have occurred within the internal network, affecting those who used the kiosks connected to the network.

Therefore, C. The internal DNS servers were poisoned is the most likely reason for the compromise of hourly employee credentials in this scenario.

29
Q

The Chief Information Security Officer of an organization needs to ensure recovery from ransomware would likely occur within the organization’s agreed-upon RPOs and RTOs. Which of the following backup scenarios would best ensure recovery?

A. Hourly differential backups stored on a local SAN array
B. Daily full backups stored on premises in magnetic offline media
C. Daily differential backups maintained by a third-party cloud provider
D. Weekly full backups with daily incremental stored on a NAS drive

A

B. Daily full backups stored on premises in magnetic offline media
Explanation:

Daily full backups: Full backups capture all data and provide a complete snapshot of the system's state at the time of backup. In the event of ransomware, where data encryption could compromise incremental or differential backups, having daily full backups ensures that the latest unencrypted data snapshot is available for restoration.

Stored on premises in magnetic offline media: Storing backups offline on magnetic media (such as tapes) ensures they are isolated from the network and inaccessible to ransomware attackers. This protects the backups from being encrypted or tampered with during an attack.

Comparison with other options:

Hourly differential backups stored on a local SAN array: Differential backups capture changes since the last full backup. However, frequent backups may still capture encrypted data if ransomware is active. SAN arrays are typically connected and vulnerable to ransomware attacks.

Daily differential backups maintained by a third-party cloud provider: While cloud backups can provide off-site storage and redundancy, the risk remains if the backups are not isolated from the network or if the cloud provider's infrastructure is compromised.

Weekly full backups with daily incremental stored on a NAS drive: Weekly full backups combined with daily incremental backups may provide some level of recovery capability, but it relies heavily on the integrity of incremental backups, which can be affected by ransomware encryption.

Therefore, option B, Daily full backups stored on premises in magnetic offline media, offers the best combination of comprehensive data capture and protection against ransomware attacks, aligning well with ensuring recovery within the organization’s RPOs and RTOs.

30
Q

A company is currently utilizing usernames and passwords, and it wants to integrate an MFA method that is seamless, can integrate easily into a user’s workflow, and can utilize employee-owned devices. Which of the following will meet these requirements?

A. Push notifications
B. Phone call
C. Smart card
D. Offline backup codes

A

A. Push notifications

Push notifications for MFA typically involve sending a notification to a user’s mobile device or application, prompting them to approve or deny access. Here’s how it meets the requirements:

Seamless integration: Push notifications are often integrated into existing applications or services, allowing users to approve access requests with a simple tap on their mobile device. This process is intuitive and does not disrupt the user’s workflow significantly.

Integration with employee-owned devices: Push notifications can be sent to employee-owned smartphones or tablets, leveraging devices that users are already familiar with and likely have readily available.

Ease of use: Users can respond to push notifications quickly and without the need to manually enter codes or carry additional hardware tokens (as required by options like smart cards).

Why not the other options?

B. Phone call: Phone call-based MFA requires answering a call and entering a PIN or confirming access verbally. This process can be more disruptive and less seamless compared to push notifications.

C. Smart card: Smart cards require physical possession and insertion into a reader, which is less convenient for users, especially with employee-owned devices that may not have smart card readers.

D. Offline backup codes: Offline backup codes are typically used as a backup option rather than a primary MFA method. They require users to store and manage codes securely, which may not integrate as seamlessly into daily workflows as push notifications.

Therefore, A. Push notifications best meets the company’s requirements for seamless integration, easy integration with employee-owned devices, and user-friendly MFA implementation.

31
Q

Since a recent upgrade to a WLAN infrastructure, several mobile users have been unable to access the internet from the lobby. The networking team performs a heat map survey of the building and finds several WAPs in the area. The WAPs are using similar frequencies with high power settings. Which of the following installation considerations should the security team evaluate next?

A. Channel overlap
B. Encryption type
C. New WLAN deployment
D. WAP placement

A

A. Channel overlap

Here’s why channel overlap is the key consideration:

Frequency Interference: When multiple WAPs operate on similar frequencies with high power settings, they can cause interference, leading to degraded performance and connectivity issues for mobile users. This interference is primarily due to channels overlapping, where adjacent or nearby WAPs transmit on frequencies that interfere with each other.

Optimizing Channel Allocation: The security team should assess the current channel allocation of the WAPs in the lobby area. They may need to adjust the channels used by each WAP to minimize overlap and reduce interference. This can be achieved through a site survey or by using tools that analyze and recommend optimal channel configurations based on observed interference patterns.

Performance Impact: Channel overlap not only affects internet access but also impacts overall WLAN performance and reliability. By addressing channel overlap, the security team can improve the quality of service for mobile users and ensure that WLAN infrastructure operates efficiently.

Why not the other options?

B. Encryption type: Encryption type relates to securing wireless communications but does not directly address the issue of WLAN performance degradation caused by channel overlap.

C. New WLAN deployment: This option suggests a complete overhaul or deployment of a new WLAN infrastructure, which is not necessary if the issue can be mitigated by optimizing channel usage.

D. WAP placement: While WAP placement is important for coverage and signal strength, in this scenario, the issue is more likely due to channel interference rather than placement.

Therefore, A. Channel overlap is the most relevant consideration for the security team to evaluate next to resolve the connectivity issues faced by mobile users in the lobby area.

32
Q

A security administrator needs to publish multiple application URLs that will run on different internal web servers but use only one external IP address. Which of the following is the best way for the administrator to achieve this goal?

A. Jump server
B. Reverse proxy
C. MAC filtering
D. Source NAT

A

B. Reverse proxy

Here’s why a reverse proxy is the appropriate choice:

Routing and Load Balancing: A reverse proxy can route incoming requests based on the URL path or domain name to different internal web servers hosting different applications. This allows multiple applications to be accessed using different URLs but through a single external IP address.

Centralized Management: A reverse proxy provides a centralized point for managing and securing incoming traffic. It can handle SSL termination, caching, and other optimizations, improving performance and security for the applications.

Simplicity and Scalability: Implementing a reverse proxy is straightforward and scales well as additional applications or servers are added. It simplifies external access and enhances security by keeping internal server details hidden.

Why not the other options?

A. Jump server: A jump server is typically used for secure access to internal resources from an external network, but it does not provide the URL-based routing capability needed to publish multiple applications using a single external IP address.

C. MAC filtering: MAC filtering operates at the data link layer (Layer 2) and is used to control which devices can connect to a network based on their MAC addresses. It does not provide URL-based routing or allow multiple applications to share a single external IP address.

D. Source NAT (Network Address Translation): Source NAT translates internal IP addresses to a single external IP address, but it does not provide URL-based routing capabilities. It would require separate external IP addresses for each internal web server hosting different applications, which does not meet the requirement of using only one external IP address.

Therefore, B. Reverse proxy is the best choice for the security administrator to publish multiple application URLs from different internal web servers using a single external IP address efficiently and securely.

33
Q

Which of the following is the first step to take when creating an anomaly detection process?

A. Selecting events
B. Building a baseline
C. Selecting logging options
D. Creating an event log

A

B. Building a baseline

Here’s why building a baseline is the initial step:

Establishing Normal Behavior: Before detecting anomalies, it's crucial to understand what constitutes normal behavior within your system or network. Building a baseline involves collecting data over a period to establish patterns of typical activity. This baseline serves as a reference point against which future events can be compared.

Identifying Deviations: Once a baseline is established, deviations from this normal behavior can be identified as potential anomalies. These anomalies can indicate suspicious or malicious activities that may require further investigation.

Foundation for Detection Rules: The baseline helps in setting thresholds and creating detection rules for anomaly detection systems. It allows for the customization of alerts or triggers based on predefined deviations from normal behavior.

Why not the other options?

A. Selecting events: This step comes after establishing a baseline. Selecting events involves determining which events or data points are relevant to monitor based on the established baseline.

C. Selecting logging options: Logging options relate to configuring what data is logged and how it's stored, which is important but typically follows establishing a baseline to know what to log.

D. Creating an event log: Creating an event log is a necessary step in logging and monitoring, but it assumes you already know what events to log, which is informed by the baseline.

Therefore, B. Building a baseline is the critical first step when creating an anomaly detection process, as it provides the foundation for identifying and responding to deviations from normal system behavior.

34
Q

When a newly developed application was tested, a specific internal resource was unable to be accessed. Which of the following should be done to ensure the application works correctly?

A. Modify the allow/deny list for those specific resources.
B. Follow the secure coding practices for the internal resource.
C. Configure the application in a sandbox environment.
D. Utilize standard network protocols.

A

(Brain dump: A. Modify the allow/deny list for those specific resources.)
(Community A 86% )

If a newly developed application is unable to access a specific internal resource during testing, it may be necessary to modify the allow/deny list to ensure that the application has the necessary permissions to access that resource. The allow/deny list typically controls which resources or entities are allowed or denied access by the application. Adjusting the allow/deny list can help resolve access issues and ensure that the application works correctly

D. Utilize standard network protocols.

Here’s why this is the correct choice:

Standardization: Using standard network protocols ensures that the application communicates with internal resources in a way that is universally recognized and supported. This reduces compatibility issues that may arise due to non-standard protocols or configurations.

Interoperability: Standard protocols like HTTP/HTTPS, TCP/IP, FTP, etc., are designed to facilitate communication between applications and resources across different platforms and environments. They ensure that data can be transmitted and received correctly without compatibility issues.

Troubleshooting: Standard protocols have well-documented specifications and troubleshooting guides, making it easier to diagnose and resolve connectivity issues between the application and internal resources.

Why not the other options?

A. Modify the allow/deny list for those specific resources: Modifying allow/deny lists typically pertains to access control policies, which may be necessary but are more about permission settings rather than ensuring the application can correctly access an internal resource.

B. Follow the secure coding practices for the internal resource: Secure coding practices are essential for developing applications that are resistant to security threats, but they do not directly address connectivity issues between the application and internal resources.

C. Configure the application in a sandbox environment: Sandboxing is a method used for testing and isolating applications, but it's not directly related to ensuring correct access to internal resources. It's more about testing the application's behavior in a controlled environment.

Therefore, D. Utilize standard network protocols is the most appropriate action to ensure that the newly developed application can access the specific internal resource correctly, by ensuring compatibility and proper communication protocols are followed.

35
Q

Which of the following best describes why the SMS OTP authentication method is more risky to implement than the TOTP method?

A. The SMS OTP method requires an end user to have an active mobile telephone service and SIM card.
B. Generally, SMS OTP codes are valid for up to 15 minutes, while the TOTP time frame is 30 to 60 seconds.
C. The SMS OTP is more likely to be intercepted and lead to unauthorized disclosure of the code than the TOTP method.
D. The algorithm used to generate an SMS OTP code is weaker than the one used to generate a TOTP code.

A

C. The SMS OTP is more likely to be intercepted and lead to unauthorized disclosure of the code than the TOTP method.

Here’s why:

SMS Interception Risk: SMS OTP codes are sent via text messages, which travel through the cellular network. These messages can potentially be intercepted through various means, such as SIM swapping attacks, SS7 vulnerabilities, or malware on the user's device. Once intercepted, the OTP code can be used by an attacker to gain unauthorized access.

TOTP Advantage: Time-based One-Time Passwords (TOTP), on the other hand, generate codes locally on the user's device using a shared secret and the current time. These codes are typically valid for a shorter duration (e.g., 30 seconds to 1 minute) and are not transmitted over the network, reducing the risk of interception compared to SMS.

Why not the other options?

A. The SMS OTP method requires an end user to have an active mobile telephone service and SIM card: While true, this requirement is more about the availability of mobile service rather than the security risk associated with SMS OTP.

B. Generally, SMS OTP codes are valid for up to 15 minutes, while the TOTP time frame is 30 to 60 seconds: The validity period of OTP codes does influence security, but it does not inherently make SMS OTP riskier than TOTP.

D. The algorithm used to generate an SMS OTP code is weaker than the one used to generate a TOTP code: Both SMS OTP and TOTP can use strong cryptographic algorithms. The difference lies more in the transmission and interception risks rather than the algorithm strength.

Therefore, C. The SMS OTP is more likely to be intercepted and lead to unauthorized disclosure of the code than the TOTP method accurately describes the security risk associated with using SMS OTP for authentication.

36
Q

A security manager is implementing MFA and patch management. Which of the following would best describe the control type and category? (Choose two.)

A. Physical
B. Managerial
C. Detective
D. Administrative
E. Preventative
F. Technical

A

E. Preventative
F. Technical

Preventative (E):

MFA: Multi-Factor Authentication is a preventative control because it aims to prevent unauthorized access even if credentials are compromised.
Patch Management: Ensuring systems are up-to-date with patches prevents vulnerabilities from being exploited.

Technical (F):

MFA: Multi-Factor Authentication is a technical control as it involves implementing software or hardware mechanisms to enhance security.
Patch Management: This also falls under technical controls as it involves deploying and maintaining software and configurations to protect systems.
37
Q

A security analyst is creating baselines for the server team to follow when hardening new devices for deployment. Which of the following best describes what the analyst is creating?

A. Change management procedure
B. Information security policy
C. Cybersecurity framework
D. Secure configuration guide

A

D. Secure configuration guide

Explanation:

A secure configuration guide outlines the recommended settings and configurations that should be applied to devices or systems to enhance their security posture. It provides a baseline configuration that ensures consistency and reduces vulnerabilities across deployed devices. This guide helps the server team in hardening new devices by specifying security settings, access controls, software configurations, and other measures to mitigate potential risks.

Here’s why the other options are not as suitable:

A. Change management procedure: This refers to a formal process for managing changes to IT systems, not specifically the creation of security baselines.

B. Information security policy: This defines high-level requirements and expectations for security within an organization, not specific configuration settings.

C. Cybersecurity framework: This provides a structured approach to cybersecurity, including guidelines, standards, and best practices, but it is broader than just creating secure configurations for devices.

Therefore, D. Secure configuration guide best describes what the security analyst is creating in this scenario.

38
Q

Which of the following environments utilizes a subset of customer data and is most likely to be used to assess the impacts of major system upgrades and demonstrate system features?

A. Development
B. Test
C. Production
D. Staging

A

D. Staging
Explanation:

Staging environment: This environment is designed to mirror the production environment as closely as possible. It typically uses a subset of real customer data to accurately simulate the production environment. The staging environment is used to test major system upgrades, demonstrate system features, and perform final checks before changes are deployed to production.

Why other options may not be suitable:

Development environment: This environment is primarily used for coding and initial testing by developers. It usually contains mock data rather than real or subset customer data, and its primary purpose is to build and debug new features.

Test environment: Similar to the development environment, the test environment is used for more rigorous testing but usually with test data. It might be used for functional, integration, and performance testing, but it doesn’t typically mirror the production environment as closely as staging.

Production environment: This is the live environment where the actual end-users interact with the system. It contains full customer data and is not used for testing purposes.

Therefore, the staging environment is the most appropriate choice for assessing the impacts of major system upgrades and demonstrating system features using a subset of customer data.

39
Q

An external vendor recently visited a company’s headquarters for a presentation. Following the visit, a member of the hosting team found a file that the external vendor left behind on a server. The file contained detailed architecture information and code snippets. Which of the following data types best describes this file?

A. Government
B. Public
C. Proprietary
D. Critical

A

C. Proprietary

Explanation:

Government: Typically refers to information related to governmental entities or operations.
Public: Information that is freely accessible to anyone, such as public records or non-sensitive data.
Proprietary: Refers to information that is owned by a company or organization, not publicly available, and typically protected as confidential or trade secret.
Critical: Often used to describe systems, operations, or data that are crucial to an organization's functioning or security, but not typically used to describe the confidentiality status of information.

Given that the file left behind by the external vendor contained detailed architecture information and code snippets, which are likely considered confidential and proprietary to the company, C. Proprietary best describes the data type of this file.

40
Q

An organization has too many variations of a single operating system and needs to standardize the arrangement prior to pushing the system image to users. Which of the following should the organization implement first?

A. Standard naming convention
B. Hashing
C. Network diagrams
D. Baseline configuration

A

D. Baseline configuration
Explanation:

Baseline configuration: This step involves establishing a standard set of configurations for the operating system that will be used across the organization. It ensures consistency, security, and manageability. By defining a baseline configuration, the organization can create a standardized image that can be deployed to all users, reducing variations and ensuring that all systems meet the same standards.

Why other options may not be suitable:

Standard naming convention: This is important for managing and identifying systems but does not address the variations in the operating system configurations themselves.

Hashing: Hashing is used to ensure data integrity and verify that files have not been altered. It does not help in standardizing operating system configurations.

Network diagrams: These are useful for understanding and managing the network infrastructure but do not contribute to standardizing operating system configurations.

Therefore, implementing a baseline configuration is the most appropriate first step to standardize the arrangement of the operating system prior to pushing the system image to users.

41
Q

The Chief Information Security Officer (CISO) asks a security analyst to install an OS update to a production VM that has a 99% uptime SLA. The CISO tells the analyst the installation must be done as quickly as possible. Which of the following courses of action should the security analyst take first?

A. Log in to the server and perform a health check on the VM.
B. Install the patch immediately.
C. Confirm that the backup service is running.
D. Take a snapshot of the VM.

A

D. Take a snapshot of the VM.
Explanation:

Take a snapshot of the VM: This action creates a point-in-time backup of the VM, allowing for a quick rollback if the update causes any issues. It ensures that the system can be restored to its previous state without significant downtime, aligning with the 99% uptime SLA.

Why other options are secondary:

Log in to the server and perform a health check on the VM: While it's important to ensure the VM is healthy before applying updates, this step is not as crucial as taking a snapshot for quick recovery purposes.

Install the patch immediately: Installing the patch without a backup or snapshot could be risky. If the update causes issues, it could result in significant downtime.

Confirm that the backup service is running: While ensuring backups are in place is important, taking a snapshot is a more immediate and reliable way to protect against potential issues during the update process.

Therefore, the security analyst should first take a snapshot of the VM to ensure there is a quick and reliable way to recover if the update causes any problems.

42
Q

The application development teams have been asked to answer the following questions:

  • Does this application receive patches from an external source?
  • Does this application contain open-source code?
  • Is this application accessible by external users?
  • Does this application meet the corporate password standard?

Which of the following are these questions part of?

A. Risk control self-assessment
B. Risk management strategy
C. Risk acceptance
D. Risk matrix

A

A. risk control self-assessment (RCSA).

Risk control self-assessment (RCSA) involves evaluating various aspects of risks associated with a specific activity, process, or system within an organization. It typically involves asking specific questions to assess the effectiveness of controls in place, identify vulnerabilities, and determine compliance with policies and standards.

In this case:

Questions about patch management and use of open-source code address potential vulnerabilities related to software updates and code security.
The question about external accessibility assesses exposure to external threats and security measures.
The query about corporate password standards focuses on compliance with internal security policies and standards.

Therefore, A. Risk control self-assessment (RCSA) accurately describes the process of evaluating these aspects to manage and mitigate risks effectively within the organization.

43
Q

A website user is locked out of an account after clicking an email link and visiting a different website. Web server logs show the user’s password was changed, even though the user did not change the password. Which of the following is the most likely cause?

A. Cross-site request forgery
B. Directory traversal
C. ARP poisoning
D. SQL injection

A

A. Cross-site request forgery (CSRF).

Cross-site request forgery (CSRF) occurs when an attacker tricks a user into unknowingly making a request on a different website where the user is authenticated. In this case, if the user was logged into the website and then visited a different site that exploited CSRF, the attacker could have initiated a request to change the password on the original website without the user’s consent or knowledge.

Here’s how CSRF typically works in this context:

The attacker crafts a malicious link or script that, when accessed by the user (e.g., via clicking on a link in an email), sends a forged HTTP request to the vulnerable website.
If the user is authenticated (logged in) to the website where the request is being sent (due to persistent cookies or sessions), the website might mistakenly process the request as if it came from the user themselves.
In this scenario, the forged request could be to change the user's password, which the vulnerable website processes as a legitimate action initiated by the user.

Therefore, A. Cross-site request forgery (CSRF) is the most likely cause of the user’s password being changed without their explicit action.

44
Q

Two companies are in the process of merging. The companies need to decide how to standardize their information security programs. Which of the following would best align the security programs?

A. Shared deployment of CIS baselines
B. Joint cybersecurity best practices
C. Both companies following the same CSF
D. Assessment of controls in a vulnerability report

A

C. Both companies following the same CSF (Cybersecurity Framework)

Here’s why:

Cybersecurity Framework (CSF): Adopting the same framework ensures a unified approach to cybersecurity across both organizations. Frameworks like NIST Cybersecurity Framework (CSF), ISO/IEC 27001, or others provide comprehensive guidelines and best practices for managing cybersecurity risks. By following the same framework, both companies can establish common goals, processes, and controls that are recognized and understood across the merged entity.

Standardization: Using a common framework allows for the standardization of security policies, procedures, and controls. This helps in streamlining security operations, reducing redundancies, and ensuring consistency in security practices.

Integration and Merging: As the companies merge, aligning with the same CSF facilitates easier integration of systems, processes, and personnel. It provides a structured approach to assess and improve cybersecurity posture collectively.

While options like shared deployment of CIS baselines (A), joint cybersecurity best practices (B), and assessment of controls in a vulnerability report (D) are beneficial, they may not offer the comprehensive framework and structured approach to standardizing information security programs that a Cybersecurity Framework provides. Thus, C. Both companies following the same CSF ensures a strategic alignment of security efforts during and after the merger process.

45
Q

A company recently decided to allow employees to work remotely. The company wants to protect its data without using a VPN. Which of the following technologies should the company implement?

A. Secure web gateway
B. Virtual private cloud endpoint
C. Deep packet inspection
D. Next-generation firewall

A

A. Secure web gateway.

Here’s why:

Secure Web Gateway: A secure web gateway provides secure access to web-based applications and services. It can enforce policies for web traffic, including URL filtering, content inspection, malware detection, and data loss prevention (DLP). For remote workers accessing company resources over the internet, a secure web gateway can ensure that data is protected through encrypted connections and by filtering out malicious content and threats.

Virtual Private Cloud Endpoint: While this option might provide secure access to cloud resources, it typically complements rather than replaces VPNs for remote access.

Deep Packet Inspection: This technology inspects data packets at a deep level but is usually part of a firewall or network intrusion prevention system, not typically used solely for remote access without VPN.

Next-Generation Firewall: Although capable of advanced security features, it is primarily used to protect network perimeters and enforce security policies within the network, rather than for remote access without VPN.

Therefore, A. Secure web gateway is the most appropriate choice for enabling secure remote work without relying on a VPN, by ensuring secure access to web-based resources and applications while protecting company data from external threats.

46
Q

A vendor needs to remotely and securely transfer files from one server to another using the command line. Which of the following protocols should be implemented to allow for this type of access? (Choose two.)

A. SSH
B. SNMP
C. RDP
D. S/MIME
E. SMTP
F. SFTP

A

A. SSH and F. SFTP

SSH (Secure Shell): SSH provides encrypted communication sessions over an insecure network. It is commonly used for secure remote access to systems and also supports secure file transfer through utilities like SCP (Secure Copy) and SFTP (SSH File Transfer Protocol).

SFTP (SSH File Transfer Protocol): SFTP is a secure file transfer protocol that operates over SSH. It provides secure file access, transfer, and management functionalities over a reliable data stream.

Therefore, the correct choices are A. SSH and F. SFTP. These protocols ensure secure remote access and file transfer operations between servers.

47
Q

A security analyst needs to propose a remediation plan for each item in a risk register. The item with the highest priority requires employees to have separate logins for SaaS solutions and different password complexity requirements for each solution. Which of the following implementation plans will most likely resolve this security issue?

A. Creating a unified password complexity standard
B. Integrating each SaaS solution with the identity provider
C. Securing access to each SaaS by using a single wildcard certificate
D. Configuring geofencing on each SaaS solution

A

B. Integrating each SaaS solution with the identity provider

Here’s why this option is the best choice:

Centralized Identity Management: Integrating each SaaS solution with the identity provider (IdP) allows for centralized management of user identities and access policies.

Single Sign-On (SSO): With SSO integration, employees can use a single set of credentials to access multiple SaaS applications. This enhances user experience while maintaining security by enforcing strong authentication policies set by the identity provider.

Password Complexity Enforcement: The identity provider can enforce different password complexity requirements for each SaaS application based on organizational policies. This ensures that each application adheres to its specific security requirements without burdening users with multiple passwords.

In contrast, the other options do not directly address the need for separate logins and varying password complexity requirements across multiple SaaS solutions. Therefore, B. Integrating each SaaS solution with the identity provider is the most appropriate remediation plan for this scenario.

48
Q

Callers speaking a foreign language are using company phone numbers to make unsolicited phone calls to a partner organization. A security analyst validates through phone system logs that the calls are occurring and the numbers are not being spoofed. Which of the following is the most likely explanation?

A. The executive team is traveling internationally and trying to avoid roaming charges.
B. The company’s SIP server security settings are weak.
C. Disgruntled employees are making calls to the partner organization.
D. The service provider has assigned multiple companies the same numbers

A

B. The company’s SIP server security settings are weak.
Explanation:

The company’s SIP server security settings are weak: This is the most likely explanation because weak security settings on the SIP (Session Initiation Protocol) server could allow unauthorized access to the company's phone system. If the SIP server is not properly secured, malicious actors could exploit it to make unsolicited calls using the company's phone numbers. This scenario fits with the fact that the calls are validated as occurring and the numbers are not spoofed.

Why other options are less likely:

The executive team is traveling internationally and trying to avoid roaming charges: While possible, it is less likely to result in unsolicited calls to a partner organization in a foreign language. This explanation doesn't align well with the nature of the unsolicited calls.

Disgruntled employees are making calls to the partner organization: While possible, this would likely be discovered quickly and would not necessarily involve foreign language calls unless the disgruntled employees specifically spoke that language and had a motive to do so.

The service provider has assigned multiple companies the same numbers: This would be a serious error by the service provider and is highly unlikely. It would also likely lead to a broader set of issues than just unsolicited calls to a partner organization.

Therefore, weak SIP server security settings are the most plausible cause, as it explains how unauthorized callers could use the company’s phone system without spoofing the numbers.

49
Q

Which of the following best describes a penetration test that resembles an actual external attack?

A. Known environment
B. Partially known environment
C. Bug bounty
D. Unknown environment

A

D. Unknown environment
Explanation:

Unknown environment (Black-box testing): This type of penetration test is designed to simulate an actual external attack where the tester has no prior knowledge of the system. The tester acts like an external attacker trying to find and exploit vulnerabilities without any information about the internal structure of the target. This closely resembles a real-world attack scenario and tests the system's defenses against an unknown adversary.

Why other options are less suitable:

Known environment (White-box testing): In this scenario, the tester has full knowledge of the system, including architecture, source code, and network details. This is useful for a comprehensive assessment but does not mimic an actual external attack.

Partially known environment (Gray-box testing): Here, the tester has some limited knowledge about the system. This can simulate an attacker who has obtained some internal information, but it does not fully replicate the conditions of an unknown, external attack.

Bug bounty: This involves inviting external testers to find vulnerabilities in a system, often with the promise of a reward. While this can help identify real-world vulnerabilities, it doesn't specifically mimic a targeted external attack scenario.

Therefore, an unknown environment penetration test best describes an approach that resembles an actual external attack.