CIT Study Questions Flashcards
What is endpoint security solution?
It is a suite of tools that actively protect workstations or end-user devices (such as desktops, laptops, and personal mobile devices that access company resources) from most attack vectors.
True or False Endpoint Security Solution operates as an enterprise security perimeter and is best suited for bring your own device (BYOD)
True
Sean who works as a network administrator has just deployed an IDS in his organization’s network. Sean deployed an IDS that generates four types of alerts that include: true positive, false positive, false negative, and true negative. In which of the following conditions does the IDS generate a true positive alert?
-A true positive is a condition occurring when an event triggers an alarm when no actual attack is in progress.
-A true positive is a condition occurring when an IDS identifies an activity as acceptable behavior and the activity is acceptable.
-A true positive is a condition occurring when an event triggers an alarm and causes the IDS to react as if a real attack is in progress.
-A true positive is a condition occurring when an IDS fails to react to an actual attack even
A true positive is a condition occurring when an event triggers an alarm and causes the IDS to react as if a real attack is in progress.
Which detection method searches for unknown viruses by looking for known suspicious behavior or file structure?
Heuristic detection
What is NOT true of Muti-Engine Antivirus Scanning?
1) Only one AV should be installed on a workstation
2) Different AVs, different mythologies , and block lists
3) Scanning with multiple engines simultaneously
4) More than one AV can be installed on a workstation
4) More than one AV can be installed on a workstation
What is worse a false positive or false negative cybersecurity?
A false positive state is when the IDS identifies an activity as an attack but the activity is acceptable behavior. A false positive is a false alarm. A false negative state is the most serious and dangerous state. This is when the IDS identifies an activity as acceptable when the activity is actually an attack.
If multiple honeypots are connected to form a larger network, what term is used to describe the network?
a. honeycomb
b. combo lure
c. laureate
d. honey net
honeynet
Two or more honeypots on a network form a honey net.
_________ are decoy systems designed to lure potential attackers away from critical systems.
A) Honeypots
B) Bastion Hosts
C) Wasp Nests
D) Designated Targets
A) Honeypots
Which solution can be used to emulate computer services, such as mail and ftp, and to capture information related to logins or actions?
-DeMilitarized Zone (DMZ)
-Honeypot
-Intrusion Detection System (IDS)
-Firewall
-Honeypot
Which type of data loss prevention system is usually installed near the network perimeter?
Network-based data loss prevention (DLP) solutions
Data leakage prevention products can operate at which two modes?
Block List or Allow List
DLP capabilities should be ______ to reduce false positives and ensure security policies are sufficiently enforced in cloud or hybrid environments.
Content aware
Context aware
Compliance aware
Both content and compliance aware
Both content and context aware
Both content and context aware
DLP tools in cloud or hybrid environments should be content aware and context aware – meaning, in addition to knowing what data is in scope and where it is, DLP tools should be aware of who is accessing it, from where and whether that access follows security policies.
Allow Listing is always the best approach and a more secure solution true or false?
True
Which of the following is the most important aspect in determining DLP readiness before deploying?
Choosing a vendor
Focusing on DLP limitations in extreme cases
Identifying data it is designed to protect
Relying on DLP as an infallible security control
Identifying data it is designed to protect
The most simple yet significant aspect of ensuring DLP effectiveness is determining what data to protect and where that data resides. DLP works best when the data has a defined pattern, location or source.
DLP products can be categorized into which of the following two deployment models?
Zero trust and cloud-based
Cloud-based and agent-based
Network-based and agent-based
None of the above
Network-based and agent-based
When choosing a DLP product, security leaders must decide between network-based and agent-based deployment models.
Which of the following is too often considered an afterthought when implementing DLP tools for security?
Structured data in databases
unstructured data.
Account directory data
Data in transit
Structured data in databases
To detect weaknesses and improve DLP management, pay special attention to structured data found in databases, which can often be overlooked by IT leaders preoccupied with the risks associated with unstructured data.
How do DLP tools help organizations maintain data privacy compliance?
DLP software provides templates for compliance with certain regulations.
DLP systems log alerts and/or prevent sensitive data from being sent outside the organization.
Both of the above
None of the above
Both of the above
By providing templates for compliance with mandates such as HIPAA and by logging and/or preventing sensitive data from being sent externally, DLP can significantly aid compliance efforts as part of an enterprise data privacy framework.
File timestamp is a metadata that contains information about a file and reflects when the file was created, last accessed, and last modified. In digital forensics, timestamps can be used for example to validate the integrity of an access log file (i.e. to check whether the file has been tampered with to mask unauthorized access attempt). Because different systems might be set to different time zones, in order to determine the chronological order of events during a security incident it is also important to take into account time offset which denotes the difference between the timestamp and a chosen reference time (a.k.a. time normalization).
True
False
True
What is a communication protocol for electronic mail transmission?
SMTP (Simple Mail Transfer Protocol) is a method of exchanging information between a sender’s server and a recipient’s server
What port does SMTP use?
Port 25
What does POP3 stand for and what port does it use?
Post Office Protocol port 110
What does the TXT Record contain?
Contains descriptive human-readable text in a DNS record that often includes contact and hosting information
What command is used to query DNS records, create automated scripts, and perform DNS zone transfers?
nslookup
What attack method is designed to trick users into thinking the attacker is a legitimate entity so the attacker can perform such nefarious activities as gaining access to the victim’s personal information, spreading malware through infected links or attachments, and bypassing network access controls.
Spoofing
Which attack is the act of altering DNS records to redirect traffic to a malicious online destination.
DNS Spoofing
What part of the email provides the message’s routing information, which includes the email metadata, such as sender, recipient, and content type, which describes the type of data being sent (
Email header
What platform should be used for testing email attachments?
The sandbox scans the file’s behavior to determine whether or not it has malicious intentions.
What is used as a mail proxy located in DMZ and is responsible for sending and receiving email outside of and within the company
Mail Relay (can support many types of security mechanisms, such as DKIM, SPF, and DMARC to protect against phishing attacks as previously described.)
