CHP 10

Question 1

MBSA

Answer 1

Microsoft Baseline Security Analyzer (MBSA) is a software tool provided by Microsoft to help administrators and users assess the security state of Windows systems and identify missing security updates and common security misconfigurations.

Question 2

fact

Answer 2

XDR provides a comprehensive view of information technology resources to more effectively identify threats and enable faster responses.

Question 3

FIM

Answer 3

File Integrity Monitoring (FIM) is a security process that involves monitoring and detecting changes to files and system configurations. It helps ensure that critical files have not been altered by unauthorized users, malicious software, or system errors.

Question 4

SFC

Answer 4

System File Checker (SFC)

Question 5

UEBA

Answer 5

user and entity behavior analytics (UEBA)
A system that can provide automated identification of suspicious activity by user accounts and computer hosts.

Question 6

PoLP

Answer 6

principle of least privilege (PoLP)

Question 7

ACE

Answer 7

An Access Control Entry (ACE) is a component of an Access Control List (ACL) that defines the permissions granted or denied to a user or group for a specific resource in a computer system. Each ACE specifies a particular access right for a given user or group.

Question 8

ICS

Answer 8

Industrial control systems (ICS)

Question 9

ad hoc network

Answer 9

An ad hoc network is a type of wireless network where nodes (devices) communicate directly with each other without relying on a fixed infrastructure like routers or access points. These networks are typically temporary and set up for specific purposes.

Question 10

BSC

Answer 10

Bluetooth Secure Connections (BSC)
Introduced in Bluetooth 4.0, BSC offers increased resistance against eavesdropping, on-path attacks, and unauthorized access.

Question 11

BLE

Answer 11

Bluetooth Low Energy (BLE) Privacy
BLE is a power-efficient version of Bluetooth that uses randomly generated device addresses that periodically change to prevent tracking and unauthorized identification of BLE devices.

Question 13

Which intrusion detection method involves the analysis engine trained to recognize baseline “normal” traffic and generates an incident when it detects deviations from this baseline?

A.Signature-based detection
B.Behavioral- and anomaly-based detection
C.Trend analysis
D.Network traffic analysis (NTA)

Answer 13

B