Chapters 7-11

Question 1

Attackers have launched an attack using multiple systems against a single target. Which type of attack is this?

A. DoS
B. DDoS
C. SYN flood
D. Buffer overflow

Answer 1

B. A distributed denial-of-service (DDoS) attack includes attacks from multiple systems with the goal of depleting the target’s resources.

• A DoS attack comes from a single system and
• a SYN flood is an example of a DoS attack.
• A buffer overflow is a type of DoS attack that attempts to write data into an application’s memory.

Question 2

An attacker has captured a database filled with hashes of randomly generated passwords. Which of the following attacks is MOST likely to crack the largest number of passwords in this database?

A. Dictionary attack
B. Birthday attack
C. Brute force attack
D. Rainbow tables

Answer 2

D. A rainbow table attack attempts to discover the password from the hash. However, they use rainbow tables, which are huge databases of precomputed hashes.

-A dictionary attack compares passwords against
words in a dictionary of words, but a dictionary of words wouldn’t include randomly generated passwords.
-A birthday attack relies on hash
collisions. However, it wouldn’t necessarily be effective depending on what hashing algorithm is used.
-A brute force attack attempts to guess
all possible character combinations but is very time-consuming for each
password.

Question 3

An application stores user passwords in a hashed format. Which of the following can decrease the likelihood that attackers can discover these passwords?

A. Rainbow tables
B. MD5
C. Salt
D. Input validation

Answer 3

C. A password salt is additional random characters added to a password before hashing the password, and it decreases the success of password attacks.

-Rainbow tables are used by attackers and contain
precomputed hashes.
-Message Digest 5 (MD5) is a hashing algorithm
that creates hashes, but the scenario already states that passwords are hashed.
-Input validation techniques verify data is valid before using it and they are unrelated to protecting hashed passwords.

Question 4

An attacker has been analyzing encrypted data that he intercepted. He knows that the end of the data includes a template sent with all similar messages. He uses this knowledge to decrypt the message. Which of the following types of attacks BEST describes this attack?

A. Known ciphertext
B. Known plaintext
C. Brute force
D. Rainbow table

Answer 4

B. This describes a known plaintext attack because the attacker knows some of the plaintext data used to create the encrypted data. More specifically, this is a chosen plaintext attack (but that wasn’t
available as an answer) because the attacker knew a portion of the plaintext.

• In a known ciphertext attack, the attacker doesn’t have any information on the plaintext.
• A brute force attack attempts to guess a password.
• A rainbow table attack uses a table of hashes to identify a password from a matched hash.

Question 5

An attacker is attempting to write more data into a web application’s memory than it can handle. Which type of attack is this?

A. XSRF
B. DLL injection
C. Pass the hash
D. Buffer overflow

Answer 5

D. One type of buffer overflow attack attempts to write more data into an application’s memory than it can handle. None of the other answers are directly related to overloading the application’s memory.

-A cross-site request forgery (XSRF) attack attempts to launch attacks with HTML code.
-A Dynamic Link Library (DLL) injection attack injects a
DLL into memory and causes it to run.
-A pass the hash attack attempts to discover a password.

Question 6

Management at your organization is planning to hire a development firm to create a sophisticated web application. One of their primary goals is to ensure that personnel involved with the project frequently
collaborate with each other throughout the project. Which of the following is an appropriate model for this project?

A. Waterfall
B. SDLC
C. Agile
D. Secure DevOps

Answer 6

C. The agile software development model is flexible, ensures that personnel interact with each other throughout a project, and is the best of the available choices.

-The waterfall model isn’t as flexible and
focuses instead on completing the project in stages.
-Both agile and waterfall are software development life cycle (SDLC) models, which is a generic concept designed to provide structure for software development projects.
-Secure DevOps is an agile-aligned development methodology

Question 7

A web developer is adding input validation techniques to a web site application. Which of the following should the developer implement during this process?

A. Perform the validation on the server side.
B. Perform the validation on the client side.
C. Prevent boundary checks.
D. Implement pointer dereference techniques.

Answer 7

A. Input validation should be performed on the server side.

• Clientside validation can be combined with server-side validation, but it can be bypassed, so it should not be used alone.
• Boundary or limit checks are an important part of input validation.
• Pointer dereference techniques use references to point to values and are unrelated to input validation techniques.

Question 8

Developers have created an application that users can download and install on their computers. Management wants to provide users with a reliable method of verifying that the application has not been modified.
Which of the following methods provides the BEST solution?

A. Code signing
B. Input validation
C. Code obfuscation
D. Stored procedures

Answer 8

A. Code signing provides a digital signature for the code and verifies the publisher of the code and verifies that it hasn’t been modified since the publisher released it. None of the other answers verify the application hasn’t been modified.

-Input validation verifies data is valid before using it.
-Code obfuscation makes the code more difficult to read.
-Stored procedures are used with SQL databases and can be used for input
validation.

Question 9

Your organization is preparing to deploy a web-based application, which will accept user input. Which of the following will BEST test the reliability of this application to maintain availability and data integrity?

A. Model verification
B. Input validation
C. Error handling
D. Dynamic analysis

Answer 9

D. Dynamic analysis techniques (such as fuzzing) can test the application’s ability to maintain availability and data integrity for some scenarios. Fuzzing sends random data to an application to verify the random data doesn’t crash the application or expose the system to a data breach.

-Model verification ensures that the software meets specifications and fulfills its intended purpose, but it doesn’t focus on reliability or integrity.
-Input validation and error-handling techniques protect
applications, but do not test them.

Question 10

You are overseeing a large software development project. Ideally, developers will not add any unauthorized changes to the code. If they do, you want to ensure that it is easy to identify the developer who made the change. Which of the following provides the BEST solution for this need?

A. Agile SDLC
B. Version control
C. Secure DevOps
D. Static code analysis

Answer 10

B. A version control system will track all changes to a system, including who made the change and when. Change management processes (not available as a possible answer) typically provide the same
solution.

• An agile software development life cycle (SDLC) model focuses on interaction from all players in a project, but doesn’t necessarily include a version control system.
• Secure DevOps is an agile-aligned software development methodology that focuses on security throughout the process.
• Static code analysis examines the code without executing it as a method of code testing.

Question 11

Database administrators have created a database used by a web application. However, testing shows that the application is taking a significant amount of time accessing data within the database. Which of
the following actions is MOST likely to improve the overall performance of a database?

A. Normalization
B. Client-side input validation
C. Server-side input validation
D. Obfuscation

Answer 11

A. Normalization techniques organize tables and columns in a database and improve overall database performance. None of the other answers improve the database performance.

• Input validation techniques help prevent many types of attacks, and
• server-side input validation techniques are preferred over client-side techniques.
• Obfuscation techniques make the code more difficult to read.

Question 12

Looking at logs for an online web application, you see that someone has entered the following phrase into several queries:
‘ or ‘1’=’1’ –
Which of the following is the MOST likely explanation for this?

A. A buffer overflow attack
B. An XSS attack
C. A SQL injection attack
D. A DLL injection attack

Answer 12

C. Attackers use the phrase (‘ or‘1’=’1’–) in SQL injection attacks to query or modify databases.

• A buffer overflow attack sends more data or unexpected data to an application with the goal of accessing system memory.
• A cross-site scripting (XSS) attack attempts to insert HTML or JavaScript code into a web site or email.
• A Dynamic Link Library (DLL) injection attack attempts to inject DLLs into memory, causing DLL commands to run.

Question 13

While creating a web application, a developer adds code to limit data provided by users. The code prevents users from entering special characters.
Which of the following attacks will this code MOST likely prevent?

A. Man-in-the-browser
B. Amplification
C. XSS
D. Domain hijacking

Answer 13

C. A cross-site scripting (XSS) attack can be blocked by using input validation techniques to filter special characters such as the < and > characters used in HTML code. None of the other listed attacks require the use of special characters.

-A man-in-the-browser attack exploits vulnerabilities in browsers to capture user data entries.
-An amplification attack increases the amount of data sent to a victim to overwhelm it.
-A domain hijacking attack changes the domain
registration of a domain name without permission of the owner.

Question 14

Homer recently received an email thanking him for a purchase that he did not make. He asked an administrator about it and the administrator noticed a pop-up window, which included the following code:

Which of the following is the MOST likely explanation?

A. XSRF
B. Buffer overflow
C. SQL injection
D. Dead code

Answer 14

A. A cross-site request forgery (XSRF) attack causes users to perform actions without their knowledge. This scenario indicates the
user visited a web site, most likely through a malicious link, and the link initiated a purchase. None of the other attacks cause unsuspecting
users to make purchases.

• A buffer overflow attacks a web site and attempts to access system memory.
• A SQL injection attack attempts to access data on a database server.
• Dead code is code that never executes and is unrelated to this scenario.

Question 15

Your organization recently purchased a new hardware-based firewall. Administrators need to install it as part of a DMZ within the network. Which of the following references will provide them with the MOST appropriate instructions to install the firewall?

A. A regulatory framework
B. A non-regulatory framework
C. A general-purpose firewall guide
D. A vendor-specific guide

Answer 15

D. A vendor-specific guide for the new hardware-based firewall will have the most appropriate instructions for installing it.

-Frameworks (regulatory or non-regulatory) provide structures that can be followed for different purposes, but they wouldn’t be available for a specific firewall.
-A general-purpose guide will provide general
instructions, but not instructions for a specific vendor’s firewall.

Question 16

A security expert is performing a risk assessment. She is seeking information to identify the number of times a specific type of incident occurs per year. Which of the following BEST identifies this?

A. ALE
B. ARO
C. SLE
D. WORM

Answer 16

B. The annual rate of occurrence (ARO) is the best choice to identify how many times a specific type of incident occurs in a year.

• Annual loss expectancy (ALE) identifies the expected monetary loss for a year and
• single loss expectancy (SLE) identifies the expected monetary loss for a single incident. ALE = SLE × ARO and if you know any two of these values, you can identify the third value. For example, ARO = ALE / SLE.
• Write once read many (WORM) is a term sometimes used with archived logs indicating they cannot be modified.

Question 17

Lisa needs to calculate the ALE for a group of servers used in the network. During the past two years, five of the servers failed. The hardware cost to repair or replace each server was $3,500 and the downtime resulted in $2,500 of additional losses for each outage. What is the ALE?

A. $7,000
B. $8,000
C. $15,000
D. $30,000

Answer 17

C. The annual loss expectancy (ALE) is $15,000.
You calculate the ALE as SLE × ARO ($6,000 × 2.5).

• The single loss expectancy (SLE) is $6,000 ($3,500 to repair or replace each server plus $2,500 in additional losses for each outage).
• The annual rate of occurrence (ARO) is 2.5 (five failures in two years or 5 / 2).

Question 18

Martin is performing a risk assessment on an e-commerce web server. While doing so, he created a document showing all the known risks to this server, along with the risk score for each risk. What is the
name of this document?

A. Quantitative risk assessment
B. Qualitative risk assessment
C. Residual risk
D. Risk register

Answer 18

D. A risk register lists all known risks for an asset, such as a web server, and it typically includes a risk score (the combination of the likelihood of occurrence and the impact of the risk).

• Risk assessments (including quantitative and qualitative risk assessments) might use a risk register, but they aren’t risk registers.
• Residual risk refers to the remaining risk after applying security controls to mitigate risk.

Question 19

Your organization includes an e-commerce web site used to sell digital products. You are tasked with evaluating all the elements used to support this web site. What are you performing?

A. Quantitative assessment
B. Qualitative assessment
C. Threat assessment
D. Supply chain assessment

Answer 19

D. A supply chain assessment evaluates all the elements used to create, sell, and distribute a product.

• Risk assessments (including both quantitative and qualitative risk assessments) evaluate risks, but don’t evaluate the supply chain required to support an e-commerce web site.
• A threat assessment evaluates threats.

Question 20

A penetration tester is running several tests on a server within your organization’s DMZ. The tester wants to identify the operating system of the remote host. Which of the following tools or methods are MOST
likely to provide this information?

A. Banner grabbing
B. Vulnerability scan
C. Password cracker
D. Protocol analyzer

Answer 20

A. Banner grabbing is a technique used to gain information about a remote server and it will identify the operating system of the system in the demilitarized zone (DMZ).

• A vulnerability scanner checks for vulnerabilities.
• A password cracker attempts to discover passwords.
• A protocol analyzer collects packets sent across a network and can be used to analyze the packets.

Question 21

You need to perform tests on your network to identify missing security controls. However, you want to have the least impact on systems that users are accessing. Which of the following tools is the BEST to meet
this need?

A. A syn stealth scan
B. Vulnerability scan
C. Ping scan
D. Penetration test

Answer 21

B. A vulnerability scanner is passive and has the least impact on systems, and it can detect systems that are lacking specific security controls.

• Network scanners use methods such as a syn stealth scan and a ping scan to discover devices on a network, but they don’t identify missing security controls.
• A penetration test is invasive and does not have the least impact on systems.

Question 22

You periodically run vulnerability scans on your network, but have been receiving many false positives. Which of the following actions can help reduce the false positives?

A. Run the scans as credentialed scans.
B. Run the scans as non-credentialed scans.
C. Run the scans using passive reconnaissance.
D. Run the scans using active reconnaissance.

Answer 22

A. Running the scans as credentialed scans (within the context of a valid account) allows the scan to see more information and typically results in fewer false positives.

• Non-credentialed scans run without any user credentials and can be less accurate.
• Passive reconnaissance collects information on a target using open-source intelligence.
• All vulnerability scans use active reconnaissance techniques.

Question 23

Your organization has a legacy server running within the DMZ. It is running older software that is not compatible with current patches, so management has decided to let it remain unpatched. Management wants to know if attackers can access the internal network if they successfully compromise this server. Which of the following is the MOST appropriate action?

A. Perform a vulnerability scan.
B. Perform a port scan.
C. Perform a black box test.
D. Perform a penetration test.

Answer 23

D. A penetration test attempts to exploit a vulnerability and can determine if a successful attack will allow attackers into the internal network.

• A vulnerability scan is passive. It does not attempt to compromise a system, so it cannot verify if an attacker can access the internal network.
• A port scan only identifies open ports.
• A black box test only refers to the knowledge of the testers and indicates they have zero knowledge prior to starting a test.

Question 24

A penetration tester has successfully attacked a single computer within the network. The tester is now attempting to access other systems within the network via this computer. Which of the following BEST
describes the tester’s current actions?

A. Performing reconnaissance
B. Performing the initial exploitation
C. Pivoting
D. Escalating privileges

Answer 24

C. Pivoting is the process of accessing other systems through a single compromised system.

• Reconnaissance techniques are done before attacking a system.
• A successful attack on a single computer is the initial exploitation.
• Escalating privileges attempts to gain higher privileges on a target.

Question 25

You are troubleshooting issues between two servers on your network and need to analyze the network traffic. Of the following choices, what is the BEST tool to capture and analyze this traffic?

A. Network mapper
B. Protocol analyzer
C. Network scanner
D. SIEM

Answer 25

B. A protocol analyzer (also called a sniffer) is the best choice to capture and analyze network traffic.

-A network mapper can detect all the devices on a network, and
-a network scanner can detect more
information about these devices, but neither of these tools is the best choice to capture and analyze traffic for troubleshooting purposes.
-A security information and event management (SIEM) system aggregates and correlates logs from multiple sources, but does not capture network traffic.

Question 26

A penetration tester is tasked with gaining information on one of your internal servers and he enters the following command:
echo “” | nc -vv -n -w1 72.52.206.134 80
What is the purpose of this command?

A. Identify if a server is running a service using port 80 and is reachable.
B. Launch an attack on a server sending 80 separate packets in a short period of time.
C. Use Netcat to remotely administer the server.
D. Use Netcat to start an RDP session on the server.

Answer 26

A. This command sends a query to the server over port 80 and if the server is running a service on port 80, it will connect. This is a common beginning command for a banner grabbing attempt.

• It does not send 80 separate packets.
• Netcat is often used to remotely administer servers, but not using port 80.
• Remote Desktop Protocol (RDP) uses port 3389 and is not relevant in this scenario.

Question 27

You suspect that an attacker has been sending specially crafted TCP packets to a server trying to exploit a vulnerability. You decide to capture TCP packets being sent to this server for later analysis and you want to use a command-line tool to do so. Which of the following tools will BEST meet your need?

A. Wiredump
B. Tcpdump
C. Netcat
D. Nmap

Answer 27

B. The tcpdump command-line tool is the best choice of the given answers. It is a command- line packet analyzer (or protocol analyzer) and its primary purpose is to capture packets.

• Wiredump isn’t a valid tool name.
• Wireshark (not included as an answer choice) is a graphic-based packet analyzer that can be started from the command line, but tcpdump includes more command-line options than Wireshark.
• Netcat is useful for remotely accessing systems and can be used for banner grabbing, but it doesn’t capture packets.
• Nmap analyzes packets during a scan. It can also use Npcap, the Nmap Project’s packet sniffing library, but Nmap isn’t the best choice to capture packets.

Question 28

You suspect someone has been trying a brute force password attack on a Linux system. Which of the following logs should you check to view failed authentication attempts by users?

A. /var/log/btmp
B. /var/log/fail
C. var/log/httpd
D. /var/log/kern

Answer 28

A. The /var/log/btmp log contains information on user failed login attempts. While not available as an answer, /var/log/auth also includes information on failed login attempts.

• While the /var/log/faillog log includes information on failed logins, /var/log/fail isn’t a valid log name in Linux.
• The /var/log/httpd directory includes logs from the Apache web server, when it’s installed.
• The /var/log/kern log contains information logged by the system kernel.

Question 29

An organization has a large network with dozens of servers. Administrators are finding it difficult to review and analyze the logs from all the network devices. They are looking for a solution to aggregate and
correlate the logs. Which of the following choices BEST meets this need?

A. Nmap
B. Netcat
C. Wireshark
D. SIEM

Answer 29

D. A security information and event management (SIEM) system provides a centralized solution for collecting, analyzing, and managing data from multiple sources and can aggregate and correlate logs. None
of the other choices aggregate and correlate logs.

• Nmap is a network scanner that can discover and map devices on a network.
• Netcat is a command-line tool that can be used to connect to servers.
• Wireshark is a graphical-based protocol analyzer.

Question 30

Lisa has recently transferred from the HR department to payroll. While browsing file shares, Lisa notices she can access the HR files related to her new coworkers. Which of the following could prevent this scenario from occurring?

A. Permission auditing and review
B. Continuous monitoring
C. Vulnerability scan
D. Penetration testing

Answer 30

A. A permission auditing and review process verifies that the principle of least privilege is followed. This includes ensuring users can access only the resources they need to perform their job.

• Continuous monitoring includes monitoring all relevant security controls, but isn’t the best choice for this specific scenario.
• A vulnerability scan will discover vulnerabilities on a system or network and
• a penetration test will scan a system or network and attempt to exploit vulnerabilities.
• However, vulnerability scans and penetration tests cannot verify a user has the appropriate privileges.

Question 31

After a recent attack on your organization’s network, the CTO is insisting that the DMZ uses two firewalls and they are purchased from different companies. Which of the following BEST describes this practice?

A. Single-layer security
B. Vendor diversity
C. Control diversity
D. Redundancy

Answer 31

B. The chief technology officer (CTO) is recommending vendor diversity for the demilitarized zone (DMZ). Firewalls from different companies (vendors) provide vendor diversity. This also provides defense in depth or layered security, but not single-layer security.

• Control diversity is the use of different controls such as technical, administrative, and physical.
• Redundancy is the use of duplicate components for fault tolerance, but the two firewalls work together in the DMZ.

Question 32

Management within your organization wants to create a small network used by executives only. They want to ensure that this network is completely isolated from the main network. Which of the following choices BEST meets this need?

A. Airgap
B. Mantrap
C. Control diversity
D. Infrared motion detectors

Answer 32

A. An airgap ensures that a computer or network is physically isolated from another computer or network.

• A mantrap helps prevent unauthorized entry and is useful for preventing tailgating.
• Control diversity is the use of different controls such as technical, administrative, and physical, but it doesn’t necessarily isolate networks.
• Infrared motion detectors sense motion from infrared light, but they don’t isolate networks.

Question 33

A security professional has reported an increase in the number of tailgating violations into a secure data center. Which of the following can prevent this?

A. CCTV
B. Mantrap
C. Proximity card
D. Cipher lock

Answer 33

B. A mantrap is highly effective at preventing unauthorized entry and can also be used to prevent tailgating.

• CCTV uses cameras for video surveillance and it can record unauthorized entry, but it can’t prevent it.
• A proximity card is useful as an access control mechanism, but it won’t prevent tailgating, so it isn’t as useful as a mantra.
• A cipher lock is a door access control, but it can’t prevent tailgating.

Question 34

Lisa is the new chief technology officer (CTO) at your organization. She wants to ensure that critical business systems are protected from isolated outages. Which of the following would let her know how often these systems will experience outages?

A. MTTR
B. MTBF
C. RTO
D. RPO

Answer 34

B. The mean time between failures (MTBF) provides a measure of a system’s reliability and would provide an estimate of how often the systems will experience outages.

• The mean time to recover (MTTR) refers to the time it takes to restore a system, not the time between failures.
• The recovery time objective (RTO) identifies the maximum amount of time it can take to restore a system after an outage.
• The recovery point objective (RPO) identifies a point in time where data loss is acceptable.

Question 35

Thieves recently rammed a truck through the entrance of your company’s main building. During the chaos, their partners proceeded to steal a significant amount of IT equipment. Which of the following choices can you use to prevent this from happening again?

A. Bollards
B. Guards
C. CCTV
D. Mantrap

Answer 35

A. Bollards are effective barricades that can block vehicles.

• Guards can restrict access for personnel, but they cannot stop trucks from ramming through a building.
• Closed-circuit television (CCTV) or a similar video surveillance system can monitor the entrance, but it won’t stop the attack.
• Mantraps prevent tailgating, but they most likely won’t stop a truck.

Question 36

You are a technician at a small organization. You need to add faulttolerance capabilities within the business to increase the availability of data. However, you need to keep costs as low as possible. Which of the following is the BEST choice to meet these needs?

A. Alternate processing site
B. RAID-10
C. Backups
D. Faraday cage

Answer 36

B. A redundant array of inexpensive disks 10 (RAID-10) subsystem provides fault tolerance for disks and increases data availability.

• An alternate processing site might be used for a mission-essential function, but it is expensive and does much more than increase the availability of data.
• Backups help ensure data availability, but they do not help with fault tolerance.
• A Faraday cage is a room or enclosure that prevents signals from emanating beyond the room.

Question 37

Flancrest Enterprises recently set up a web site utilizing several web servers in a web farm. The web farm spreads the load among the different web servers. Visitor IP addresses are used to ensure that clients always return to the same server during a web session. Which of the following BEST describes this configuration?

A. Affinity
B. Round-robin
C. Virtual IP
D. Active-passive

Answer 37

A. Source address IP affinity scheduling allows a load balancer to direct client requests to the same server during a web session.

• Roundrobin scheduling simply sends each request to the next server.
• Load balancers can use a virtual IP, but this refers to the IP address of the web server, not the IP address of a visitor.
• An active passive configuration has at least one server that is not actively serving clients, but the scenario doesn’t indicate any of the servers are in a passive mode.

Question 38

Your organization is planning to deploy a new e-commerce web site. Management anticipates heavy processing requirements for a back-end application. The current design will use one web server and multiple application servers. Which of the following BEST describes the application servers?

A. Load balancing
B. Clustering
C. RAID
D. Affinity scheduling

Answer 38

A. The design is using load balancing to spread the load across multiple application servers. The scenario indicates the goal is to use multiple servers because of heavy processing requirements, and this is exactly what load balancing does.

• Clustering is typically used to provide high availability by failing over to another server if one server fails.
• RAID provides fault tolerance for disk drives, not servers.
• Affinity scheduling helps ensure clients go to the same server during a session, but this isn’t relevant to this scenario.

Question 39

Flancrest Enterprises recently set up a web site utilizing several web servers in a web farm. The web farm spreads the load among the different web servers by sending the first request to one server, the next
request to the second server, and so on. Which of the following BEST describes this configuration?

A. Affinity
B. Round-robin
C. Airgap
D. Mantrap

Answer 39

B. A round-robin scheduling scheme allows a load balancer to send requests to servers one after another.

• Affinity scheduling directs user requests to a specific server based on the user’s IP address to ensure that the user accesses the same server during a web session.
• An airgap ensures that computing systems are physically separated from each other and is unrelated to this question.
• A mantrap prevents unauthorized entry using the social engineering tactic of tailgating.

Question 40

Flancrest Enterprises recently set up a web site utilizing several web servers in a web farm. The web servers access a back-end database. The database is hosted by a database application configured on two database servers. Web servers can access either of the database servers. Which of the following BEST describes the configuration of the database servers?

A. Active-passive
B. Round-robin
C. Affinity
D. Active-active

Answer 40

D. The database servers are in an active-active load balancing configuration because web servers can query both database servers.

• In an active-passive configuration, only one of the database servers would be answering queries at any given time.
• Round-robin and affinity are two methods of scheduling the load balancing in an active-active configuration.

Question 41

Your organization has decided to increase the amount of customer data it maintains and use it for targeted sales. However, management is concerned that they will need to comply with existing laws related to PII.
Which of the following should be completed to determine if the customer data is PII?

A. Privacy threshold assessment
B. Privacy impact assessment
C. Tabletop exercise
D. Affinity scheduling

Answer 41

A. A privacy threshold assessment helps an organization identify Personally Identifiable Information (PII) within a system, and in this scenario, it would help the organization determine if the customer data is PII.

• A privacy impact assessment is done after you have verified that the system is processing PII, not to determine if the data is PII.
• A tabletop exercise is a discussion-based exercise used to talk through a continuity of operations plan.
• Affinity scheduling is a load-balancing scheduling scheme using the client’s IP address and is unrelated to PII.

Question 42

Your backup policy for a database server dictates that the amount of time needed to perform backups should be minimized. Which of the following backup plans would BEST meet this need?

A. Full backups on Sunday and full backups on the other six days of the week
B. Full backups on Sunday and differential backups on the other six days of the week
C. Full backups on Sunday and incremental backups on the other six days of the week
D. Differential backups on Sunday and incremental backups on the other six days of the week

Answer 42

C. A full/incremental backup strategy is the best option with one full backup on one day and incremental backups on the other days. The incremental backups will take a relatively short time compared with the other methods.

• A full backup every day would require the most time every day.
• Differential backups become steadily larger as the week progresses and take more time to back up than incremental backups.
• Backups must start with a full backup, so a differential/incremental backup strategy is not possible.

Question 43

You are helping implement your company’s business continuity plan. For one system, the plan requires an RTO of five hours and an RPO of one day. Which of the following would meet this requirement?

A. Ensure the system can be restored within five hours and ensure it does not lose more than one day of data.
B. Ensure the system can be restored within one day and ensure it does not lose more than five hours of data.
C. Ensure the system can be restored between five hours and one day after an outage.
D. Ensure critical systems can be restored within five hours and noncritical systems can be restored within one day.

Answer 43

A. The recovery time objective (RTO) identifies the maximum amount of time it should take to restore a system after an outage.
The recovery point objective (RPO) refers to the amount of data you can afford to lose.
RTO only refers to time, not data. RPO refers to data recovery points, not time to restore a system.

Question 44

A security analyst is creating a document that includes the expected monetary loss from a major outage. She is calculating the potential impact on life, property, finances, and the organization’s reputation. Which of the following documents is she MOST likely creating?

A. BCP
B. BIA
C. MTBF
D. RPO

Answer 44

B. A business impact analysis (BIA) includes information on potential monetary losses along with the impact on life, property, and the organization’s reputation. It is the most likely document of those listed that would include this information.

• A business continuity plan (BCP) includes a BIA, but the BIA is more likely to include this information than the BCP is.
• The mean time between failures (MTBF) provides a measure of a system’s reliability.
• The recovery point objective (RPO) refers to the amount of data you can afford to lose, but it does not include monetary losses.

Question 45

A security expert at your organization is leading an on-site meeting with key disaster recovery personnel. The purpose of the meeting is to perform a test. Which of the following BEST describes this test?

A. Functional exercise
B. Full-blown test
C. Tabletop exercise
D. Simulation to perform steps of a plan

Answer 45

C. A tabletop exercise is discussion-based and is typically performed in a classroom or conference room setting. Because this is a meeting that includes disaster recovery personnel, it is a tabletop exercise.

-Functional exercises are hands-on exercises and include simulations and full-blown tests.

Question 46

Bart recently sent out confidential data via email to potential competitors. Management suspects he did so accidentally, but Bart denied sending the data. Management wants to implement a method that would prevent Bart from denying accountability in the future. Which of the following are they trying to enforce?

A. Confidentiality
B. Encryption
C. Access control
D. Non-repudiation

Answer 46

D. Non-repudiation methods such as digital signatures prevent users from denying they took an action.

• Encryption methods protect confidentiality.
• Access control methods protect access to data.

Question 47

A software company occasionally provides application updates and patches via its web site. It also provides a checksum for each update and patch. Which of the following BEST describes the purpose of the checksum?

A. Availability of updates and patches
B. Integrity of updates and patches
C. Confidentiality of updates and patches
D. Integrity of the application

Answer 47

B. The checksum (also known as a hash) provides integrity for the updates and patches so that users can verify they have not been modified.

• Installing updates and patches increases the availability of the application.
• Confidentiality is provided by encryption.
• The checksums are for the updates and patches, so they do not provide integrity for the application.

Question 48

A one-way function converts data into a string of characters. It is not possible to convert this string of characters back to the original state. What type of function is this?

A. Symmetric encryption
B. Asymmetric encryption
C. Stream cipher
D. Hashing

Answer 48

D. A hash function creates a string of characters (typically displayed in hexadecimal) when executed against a file or message, and hashing functions cannot be reversed to re-create the original data.

-Encryption algorithms (including symmetric encryption, asymmetric encryption, and stream ciphers) create ciphertext from plaintext data, but they include decryption algorithms to re-create the original data.

Question 49

An application developer is working on the cryptographic elements of an application. Which of the following cipher modes should NOT be used in this application?

A. CBC
B. CTM
C. ECB
D. GCM

Answer 49

C. The Electronic Codebook (ECB) mode of operation encrypts blocks with the same key, making it easier for attackers to crack. The other cipher modes are secure and can be used.

• Cipher Block Chaining (CBC) mode is used by some symmetric block ciphers, though it isn’t as efficient.
• Counter (CTM) mode combines an initialization vector (IV) with a counter and effectively converts a block cipher into a stream cipher.
• Galois/Counter Mode (GCM) combines the Counter mode with hashing techniques for data authenticity and confidentiality.

Question 50

The following text shows the ciphertext result of encrypting the word “passed” with an uppercase P and a lowercase p:
• Passed!—xnBKcndl+25mHjnafwi6Jw
• passed!—RqMbHJqLdPE3RCuUU17FtA
Which of the following BEST describes the cryptography concept demonstrated by comparing the resulting ciphertext of both words?

A. Confusion
B. Diffusion
C. Key stretching
D. Security through obscurity

Answer 50

B. This demonstrates diffusion because a small change in the plaintext results in a large change in the ciphertext.

• Confusion indicates that the ciphertext is significantly different than the plaintext. Although this is true for both results, the question is asking you to compare the two results.
• Key stretching techniques add salts to passwords before hashing them to thwart password cracking attacks.
• Security through obscurity methods use obfuscation methods to hide data, but they don’t necessarily encrypt data.

Question 51

Which of the following is a symmetric encryption algorithm that encrypts data 1 bit at a time?

A. Block cipher
B. Stream cipher
C. AES
D. DES
E. MD5

Answer 51

B. A stream cipher encrypts data a single bit or a single byte at a time and is more efficient when the size of the data is unknown, such as streaming audio or video.

• A block cipher encrypts data in specificsized blocks, such as 64-bit blocks or 128-bit blocks.
• Advanced Encryption Standard (AES) and Data Encryption Standard (DES) are block ciphers.
• Message Digest 5 (MD5) is a hashing algorithm.

Question 52

A supply company has several legacy systems connected within a warehouse. An external security audit discovered the company is using DES for data-at rest. It mandated the company upgrade DES to meet minimum security requirements. The company plans to replace the legacy systems next year, but needs to meet the requirements from the audit. Which of the following is MOST likely to be the simplest upgrade for these systems?

A. S/MIME
B. HMAC
C. 3DES
D. TLS

Answer 52

C. The best choice is Triple Data Encryption Standard (3DES). None of the other answers are valid replacements for the symmetric encryption algorithm Data Encryption Standard (DES).

• Secure/Multipurpose Internet Mail Extensions (S/MIME) is used to digitally sign and encrypt email.
• Hash-based Message Authentication Code (HMAC) is a hashing algorithm used to verify the integrity and authenticity of messages.
• Transport Layer Security (TLS) uses both symmetric and asymmetric encryption to encrypt data-in-transit, not data-at- rest.

Question 53

Bart wants to send a secure email to Lisa, so he decides to encrypt it. Bart wants to ensure that Lisa can verify that he sent it. Which of the following does Lisa need to meet this requirement?

A. Bart’s public key
B. Bart’s private key
C. Lisa’s public key
D. Lisa’s private key

Answer 53

A. Lisa would decrypt the digital signature with Bart’s public key and verify the public key is valid by querying a Certificate Authority (CA). The digital signature provides verification that Bart sent the message, non-repudiation, and integrity for the message.

• Bart encrypts the digital signature with his private key, which can only be decrypted with his public key.
• Lisa’s keys are not used for Bart’s digital signature, but might be used for the encryption of the email.
• Although not part of this scenario, Bart would encrypt the email with Lisa’s public key and Lisa would decrypt the email with Lisa’s private key.

Question 54

Bart wants to send a secure email to Lisa, so he decides to encrypt it. He wants to ensure that only Lisa can decrypt it. Which of the following does Lisa need to decrypt Bart’s email?

A. Bart’s public key
B. Bart’s private key
C. Lisa’s public key
D. Lisa’s private key

Answer 54

D. Lisa would decrypt the email with her private key and

• Bart would encrypt the email with Lisa’s public key. Although not part of this scenario, if Bart wanted Lisa to have verification that he sent it,
• he would create a digital signature with his private key and
• Lisa would decrypt the private key with Bart’s public key. Bart does not use his keys to encrypt email sent to someone else.

Question 55

An organization requested bids for a contract and asked companies to submit their bids via email. After winning the bid, Acme realized it couldn’t meet the requirements of the contract. Acme instead stated that it never submitted the bid. Which of the following would provide proof to the organization that Acme did submit the bid?

A. Digital signature
B. Integrity
C. Repudiation
D. Encryption

Answer 55

A. If Acme submitted the bid via email using a digital signature, it would provide proof that the bid was submitted by Acme. Digital signatures provide verification of who sent a message, non-repudiation preventing them from denying it, and integrity verifying the message wasn’t modified.

• Integrity verifies the message wasn’t modified.
• Repudiation isn’t a valid security concept.
• Encryption protects the confidentiality of data, but it doesn’t verify who sent it or provide nonrepudiation.

Question 56

Application developers are creating an application that requires users to log on with strong passwords. The developers want to store the passwords in such a way that it will thwart brute force attacks. Which of the following is the BEST solution?

A. 3DES
B. MD5
C. PBKDF2
D. Database fields

Answer 56

C. Password-Based Key Derivation Function 2 (PBKDF2) is a key stretching technique designed to protect against brute force attempts and is the best choice of the given answers. Another alternative is bcrypt. Both salt the password with additional bits.

• Triple DES (3DES) is an encryption protocol.
• Passwords stored using Message Digest 5 (MD5) are easier to crack because they don’t use salts.
• Storing the passwords in encrypted database fields is a possible solution, but just storing them in unencrypted database fields does not protect them at all.

Question 57

Administrators have noticed a significant amount of OCSP traffic sent to an intermediate CA. They want to reduce this traffic. Which of the following is the BEST choice to meet this need?

A. Pinning
B. Digital signatures
C. Stapling
D. Hashing

Answer 57

C. Online Certificate Status Protocol (OCSP) stapling reduces OCSP traffic sent to a Certificate Authority (CA). Certificate presenters append a timestamp, digitally signed OCSP response to a certificate.

• Public key pinning includes a list of public key hashes in HTTPS responses from the web server.
• While pinning helps validate certificates, it is unrelated to OCSP.
• Digital signatures won’t reduce traffic. Hashing is used for integrity and it won’t reduce OCSP traffic.

Question 58

A web site is using a certificate. Users have recently been receiving errors from the web site indicating that the web site’s certificate is revoked. Which of the following includes a list of certificates that have been revoked?

A. CRL
B. CA
C. OCSP
D. CSR

Answer 58

A. A certificate revocation list (CRL) is a list of certificates that a Certificate Authority (CA) has revoked.

• The CA stores a database repository of revoked certificates and issues the CRL to anyone who requests it.
• The Online Certificate Status Protocol (OCSP) validates trust with certificates, but only returns short responses such as good, unknown, or revoked.
• A certificate signing request (CSR) is used to request certificates.

Question 59

An organization recently updated its security policy. One change is a requirement for all internal web servers to only support HTTPS traffic. However, the organization does not have funds to pay for this. Which of the following is the BEST solution?

A. Create code signing certificates for the web servers.
B. Create one wildcard certificate for all the web servers.
C. Create a public CA and issue certificates from it.
D. Create certificates signed by an internal private CA.

Answer 59

D. The best solution is to use certificates signed by an internal private Certificate Authority (CA). This ensures connections use Hypertext Transfer Protocol Secure (HTTPS) instead of HTTP. Even if the organization doesn’t have an internal CA, it is possible to create one on an existing server without incurring any additional costs.

• A code signing certificate provides a digital signature for an application or script, not an entire web server.
• A wildcard certificate is used for a single domain with multiple subdomains. It is not used for multiple web servers unless they all share the same root domain name, but the scenario doesn’t indicate the web servers share the same root domain name.
• You would not create a public CA to support internal private servers. While it is feasible to purchase certificates from a public CA, that would cost money, but the scenario indicates money isn’t available.

Question 60

An administrator is installing a certificate with a private key on a server. Which of the following certificate types is he MOST likely installing?

A. DER
B. P12
C. P7B
D. CRT

Answer 60

B. P12 (PKCS #12) certificates commonly include a private key and they are used to install a private key on a server.

• A Distinguished Encoding Rules (DER) based certificate is an ASCII encoded file, but P12 certificates are Canonical Encoding Rules (CER) binary encoded files.
• A P7B (PKCS #7) certificate never includes the private key.
• CRT isn’t a valid certificate type, though many certificates do use the.crt extension.

Question 61

Management within your organization wants to ensure that users understand the rules of behavior when they access the organization’s computer systems and networks. Which of the following BEST describes what they would implement to meet this requirement?

A. AUP
B. NDA
C. BYOD
D. DD

Answer 61

A. An acceptable use policy (AUP) informs users of company expectations when they use computer systems and networks, and it defines acceptable rules of behavior.

• A non- disclosure agreement (NDA) ensures that individuals do not share proprietary data with others.
• A bring your own device (BYOD) policy identifies requirements for employee- owned mobile devices.
• The dd command (short for data duplicator) is available on Linux systems to copy files or entire disk images. Forensic analysts use it to create an image of a disk without modifying the original disk.

Question 62

Martin has worked as a network administrator for several years within your organization. Over time, he has been tasked with performing several jobs, including database administration and application development. Security personnel are concerned that his level of access represents a serious risk. Which of the following is the BEST solution to reduce this risk?

A. Mandatory vacations
B. Exit interview
C. Change management
D. Separation of duties

Answer 62

D. A separation of duties policy prevents any single person from performing multiple job functions that might allow the person to commit fraud. In this scenario, the administrator has accumulated privileges across several job functions, which represents the risk.

• A mandatory vacation policy is useful to discover fraud committed by an individual, but this scenario clearly indicates this individual controls too many job functions.
• An exit interview is performed when an employee leaves the organization.
• Change management ensures changes are reviewed before being implemented.

Question 63

After a recent security audit, management has decided to upgrade the security policy. Among other items, they want to identify a policy that will reduce the risk of personnel within an organization colluding to embezzle company funds. Which of the following is the BEST choice to meet this need?

A. AUP
B. Training
C. Mandatory vacations
D. Background check

Answer 63

C. Mandatory vacations help to reduce the possibility of fraud and embezzlement.

• An acceptable use policy informs users of company policies and even though users sign them, they don’t deter someone considering theft by embezzling funds.
• Training can help reduce incidents by ensuring personnel are aware of appropriate policies.
• A background check is useful before hiring employees, but it doesn’t directly reduce risks related to employees colluding to embezzle funds.

Question 64

After a major data breach, Lisa has been tasked with reviewing security policies related to data loss. Which of the following is MOST closely related to data loss?

A. Clean desk policy
B. Legal hold policy
C. Job rotation policy
D. Background check policy

Answer 64

A. A clean desk policy requires users to organize their areas to reduce the risk of possible data theft and password compromise.

• A legal hold refers to a court order to protect data that might be needed as evidence. A legal hold policy may state that the organization will comply with the court order, but it isn’t related to data theft.
• Job rotation policies require employees to change roles on a regular basis and can expose fraudulent activity.
• A background check policy typically identifies what to check for when hiring an employee.

Question 65

An organization is preparing to hire additional network administrators. They decide to perform background checks on all personnel after obtaining written permission. Which of the following items is NOT appropriate to include in a background check?

A. Social media presence
B. Criminal background
C. Financial history
D. Medical history

Answer 65

D. Medical history is not appropriate to include in a background check.

-However, it is common to check a potential employee’s social media presence, criminal background, and financial history.

Question 66

Dan has been working at your company as an accountant. However, after a disagreement with an executive, he decides to leave the company and work at the local mall. He has a user account allowing him to access network resources. Which of the following is the MOST appropriate step to take?

A. Ensure his account is disabled when he announces that he will be leaving the company.
B. Immediately terminate his employment.
C. Force him to take a mandatory vacation.
D. Ensure his account is disabled during his exit interview.

Answer 66

D. His account should be disabled (or deleted if that is the company policy) during the exit interview. It’s appropriate to conduct an exit interview immediately before an employee departs.

• Employees often give a two-week or longer notice. If their access is revoked immediately, they won’t be able to do any more work. While some companies do terminate employment when someone gives notice, from a security perspective, it’s best to take action related to the user account.
• The purpose of a mandatory vacation is to detect fraud, but if the employee is leaving, any potential fraud will be detected when that employee leaves.

Question 67

Your organization is planning to implement an incident response plan in response to a new incident response security policy. Which of the following items is the FIRST step in an incident response process?

A. Preparation
B. Identification
C. Containment
D. Eradication

Answer 67

A. The first step in an incident response process is preparation.

• When a potential incident occurs, the next step is identification.
• If the event is a security incident, the next step is containment to isolate the incident and limit the damage.
• Next, personnel take steps to eradicate all elements that caused the incident, such as malware or compromised accounts.

Question 68

Waylon reported suspicious activity on his computer. After investigating, you verify that his computer is infected with malware. Which of the following steps should you take NEXT?

A. Identification
B. Preparation
C. Containment
D. Eradication

Answer 68

C. After identifying an incident, the next step is containment. The scenario indicates you have identified the incident as a malware infection.

• Preparation is the first step in an incident response process.
• Eradication attempts to remove all elements of the incident after first containing it.

Question 69

After a recent incident, a forensic analyst was given several hard drives to analyze. Which of the following should the analyst do FIRST?

A. Take screenshots and capture drive images.
B. Take hashes and screenshots.
C. Take hashes and capture drive images.
D. Perform antivirus scans and create chain of custody documents.

Answer 69

C. Forensic analysts capture drive images and take hashes before beginning analysis,

• and they only analyze the imaged copies, not the original drive.
• Screenshots are taken when a computer is running.
• An antivirus scan might modify the drive and chain of custody documents are created when evidence is collected.

Question 70

You need to create an image of a large hard drive for forensic analysis from a Linux system. Which of the following will you MOST likely use?

A. hashing
B. screenshots
C. dd
D. logs

Answer 70

C. The dd command is available on Linux systems and it is used to copy files for analysis. As an example, the dd if=/dev/sda2 of=sd2disk.img command creates an image of a disk without modifying the original disk. None of the other choices creates an image of a drive.

• Hashing algorithms create a hash of a file.
• Screenshots create a graphic from a computer screen.
• Logs record log entries in files.

Question 71

The BizzFad company decides to partner with Costington’s to bid on a contract. Management in both companies realize that they need to share proprietary data. However, they want to ensure that distribution of this data is limited within each of the companies. Which of the following will BEST meet this need?

A. MOU
B. BPA
C. NDA
D. ISA

Answer 71

C. A non-disclosure agreement (NDA) helps ensure that proprietary data is not shared. It can be written to ensure that employees don’t share proprietary data or business partners don’t share proprietary data.

• A memorandum of understanding (MOU) expresses an understanding between two or more parties indicating their intention to work together toward a common goal.
• A business partners agreement (BPA) details the relationship between business partners, including their obligations toward the partnership.
• An interconnection security agreement (ISA) specifies the technical and security requirements for planning, establishing, maintaining, and disconnecting a secure connection between two or more entities.

Question 72

You are reviewing incident response procedures related to the order of volatility. Which of the following is the LEAST volatile?

A. Hard disk drive
B. Memory
C. RAID-10 cache
D. CPU cache

Answer 72

A. Data on a hard disk drive is the least volatile of those listed.

-All other sources are some type of memory, which will be lost if a system is turned off. This includes data in normal memory, a redundant array of inexpensive disks 10 (RAID-10) cache, and the central processing unit’s (CPU’s) cache.

Question 73

After learning that an employee had unauthorized material on his computer, management directed security personnel to confiscate his computer. Later, a security expert captured a forensic image of the system disk. However, he reported that the computer was left unattended for several hours before he captured the image. Which of the following is a potential issue if this incident goes to court?

A. Chain of custody
B. Order of volatility
C. Time offset
D. Screenshot

Answer 73

A. Chain of custody is the primary issue here because the computer was left unattended for several hours. It’s difficult to prove that the data collected is the same data that was on the employee’s computer when it was confiscated.

• Data captured from a disk is not volatile, so volatility is not an issue in this scenario.
• The time offset refers to logged times and is not related to this question.
• Screenshots are pictures of a screen at a moment in time, but are not related to this question.

Question 74

Your organization is involved in a lawsuit. A judge issued a court order requiring your organization to keep all emails from the last three years. Your data retention policy states that email should only be maintained from the last 12 months. After investigating, administrators realize that backups contain email from the last three years. What should they do with these backups?

A. Backups older than 12 months should be deleted to comply with the data retention policy.
B. Backups for the last 12 months should be protected to comply with the legal hold.
C. Backups for the last two years should be protected to comply with the legal hold.
D. Backups for the last three years should be protected to comply with the legal hold.

Answer 74

D. The court order specified a legal hold on email from the last three years, so all the backups for the last three years should be kept.

• If the backups had been destroyed before the court order, they wouldn’t be available, so the legal hold wouldn’t apply to them.
• Deleting them after the court order is illegal.
• Protecting only the backups from the last 12 months or the last two years doesn’t comply with the court order.

Question 75

Your organization has decided to implement a more aggressive training and continuing education program using role-based training. Management wants to ensure that each role gets the necessary training based on the role. Which of the following BEST describes the responsibilities of data owners and indicates what training they need?

A. Ensuring data is backed up in accordance with the data policy
B. Ensuring data is classified and labeled correctly
C. Complying with laws related to privacy
D. Understanding common threats, such as malware and phishing attacks

Answer 75

B. Owners are responsible for identifying the proper classification of data, ensuring it is labeled correctly, and ensuring security controls are implemented to protect the data.

• A data steward is responsible for routine daily tasks such as backing up data.
• A privacy officer is responsible for ensuring the organization is complying with relevant laws.
• End users need to be trained on common threats, such as malware and phishing attacks.