CompTia practice questions Flashcards
- An attacker sends a targeted email with a malicious attachment to a user in
your company. This attacker researched public information about the user to
send a “more personal” and targeted email to the user. Which of the following
is this type of attack?
a. Spear phishing
b. Typo squatting
c. Pharming
d. None of these answers are correct.
- A. Spear phishing is one of the most common social engineering attacks
where the attacker searches for public information about the victim to
send a targeted email to steal information. Typo squatting (or typosquatting) is a technique used by adversaries that leverages human error when
typing a URL in their web browser. Pharming is the term used to describe
a threat actor redirecting a victim from a valid website or resource to
a malicious one that could be made to appear as a valid site to the user.
From there, an attempt is made to extract confidential information from
the user or to install malware in the victim’s system.
2. Which of the following is an example of a tool that can be used specifically to perform social engineering attacks? a. Maltego b. SET c. The Harvester d. Recon-NG
- B. The Social Engineering Toolkit (SET) is an example of a tool that can
be used specifically to perform social engineering attacks.
- Which of the following best describes the difference between smishing and
vishing?
a. Vishing is a social engineering attack in which the attacker calls the user
over the phone and then persuades the user to reveal sensitive information or perform a given action. Smishing is a type of phishing campaign
using SMS text messages instead of email.
b. Vishing is a social engineering attack in which the attacker leaves a
voicemail and then persuades the user to reveal sensitive information or
perform a given action. Smishing is a type of typo squatting and pharming campaign using Bluetooth.
c. Vishing is a social engineering attack in which the attacker leaves a
voicemail and then persuades the user to reveal sensitive information or
perform a given action. Smishing is a type of typo squatting and pharming campaign using short Internet messaging systems.
d. None of these answers are correct.
- A. Vishing is social engineering attack in which the attacker calls the user
over the phone and then persuades the user to reveal sensitive information
or perform a given action. Smishing is a type of phishing campaign using
SMS text messages instead of email.
- A(n) ______ is a small space that can usually only fit one person, used to combat tailgating.
a. tunnel-gap
b. tunnel-trap
c. piggyback
d. access control vestibule
- D. An access control vestibule is a small space that can usually fit only one
person, used to combat tailgating. Tunnel-gap or tunnel-traps are not correct social engineering terms. Piggyback is the act of following someone
while opening a door to enter a building or a room.
Which of the following best describes pretexting?
a. Impersonation
b. Social engineering
c. Whaling
d. Pharming
A. Pretexting is the act of impersonating someone else.
Which of the following refers to the act of incorporating malicious ads on
trusted websites, which results in users’ browsers being inadvertently redirected to sites hosting malware?
a. Malvertising
b. Pharming
c. Active ad exploitation
d. Whaling
B. Pharming is a social engineering technique where an attacker incorporates malicious ads on trusted websites, which results in users’ browsers
being inadvertently redirected to sites hosting malware.
Which of the following is true about spear phishing?
a. Spear phishing attacks use the Windows Administrative Center.
b. Spear phishing attacks are phishing attempts that are constructed
in a very specific way and directly targeted to specific individuals or
companies.
c. Spear phishing, whaling, and phishing are the same type of attack.
d. Spear phishing attacks use the Windows PowerShell.
B. Spear phishing is phishing attempts that are constructed in a very specific way and directly targeted to specific individuals or companies.
Derek is the CEO of a Fortune 500 company. He received an email with a
malicious attachment. Once Derek clicked on the attachment, malware was
installed on his system. Which of the following best describes this attack?
a. Smishing
b. Vishing
c. Whaling
d. Pretexting
C. Whaling is a social engineering attack similar to phishing and spear phishing. However, in whaling attacks the attacker targets executives and key personnel of an organization (aka the “big fish”).
Which of the following is true about social engineering motivation
techniques?
a. Social proof can be used to create a feeling of urgency in a decisionmaking context. It is possible to use specific language in an interaction to
present a sense of urgency and manipulate the victim.
b. Scarcity can be used to create a feeling of urgency in a decision-making
context. It is possible to use specific language in an interaction to present
a sense of urgency and manipulate the victim.
c. Scarcity cannot be used to create a feeling of urgency in a decisionmaking context. It is possible to use specific language in an interaction to
present a sense of urgency and manipulate your victim.
d. Social proof cannot be used in an interrogation because it is illegal. It is
not legal to use specific language in an interaction to present a sense of
urgency and manipulate your victim.
B. Attackers use the social engineering scarcity technique to create a feeling of
urgency in a decision-making context. It is possible to use specific language in
an interaction to present a sense of urgency and manipulate the victim.
Which of the following recommendations can be used in user security
awareness education?
a. Adhere to the organization’s clean desk policy, which states that all documents, electronics, personally owned devices, and other items be put
away (or locked away) when the user is not at his or her desk, or other
work area.
b. Always screen your email and phone calls carefully and keep a log of
events. This is also known as communications vetting.
c. Use encryption when possible to protect emails, phone calls, and data.
d. All of these answers are correct.
D. All of the available answers can be used as recommendations for user security awareness training and education.
You logged in to your laptop and noticed a message saying that all your files
have been encrypted and to recover them you need to pay $1,000 in Bitcoins.
What has your system been infected with?
a. Ransomware
b. Worm
c. Keylogger
d. None of these answers are correct.
A. Ransomware is a type of malware that restricts access to a computer system and demands that a ransom be paid. It informs the user that in order to
decrypt the files or unlock the computer to regain access to the files, a payment would have to be made to one of several banking services (typically
crypto currencies like Bitcoin).
What type of malware can look like legitimate software but then performs
negative actions to manipulate your system?
a. Trojan
b. Ransomware
c. Worm
d. None of these answers are correct
A. Trojans appear to perform desirable functions but are actually performing
malicious functions behind the scenes.
Which malware type can allow an attacker to gain administrator privileges?
a. Keylogger
b. Rootkit
c. Ransomware
d. All of these answers are correct.
B. Rootkit is a type of malware designed to gain administrator-level control
over a computer system without being detected.
What type of malware does not reside on the hard drive of a computer?
a. Ransomware
b. Botnets
c. Fileless malware
d. None of these answers are correct.
C. Fileless malware works differently from traditional malware that puts malicious executables within the file system; instead, it works in a memory-based
environment.
Bots in a botnet typically receive instructions from which of the following?
a. A command-and-control (C2) server
b. A zombie system
c. A malvertising site
d. All of these answers are correct.
A. A group of compromised computers (bots), known as a botnet, is typically
controlled by a command-and-control (C2) server/system.
An attacker using John the Ripper, which uses a wordlist, is an example of which of the following? a. Social engineering attack b. Dictionary password attack c. Buffer overflow attack d. Cross-site request forgery attack
B. A dictionary password attack pulls words from the dictionary or word lists
to attempt to discover a user’s password. A dictionary attack uses a predefined
dictionary to look for a match between the encrypted password and the
encrypted dictionary word
An attacker using a large number of usernames with a few commonly used
passwords is considered what kind of attack?
a. Password spraying
b. Credential harvesting
c. Password cracking
d. None of these answers are correct
A. In password spraying an attacker attempts to compromise a system using a
large number of usernames with a few commonly used passwords.
What type of attack occurs when an attacker captures credit card information
or information from other similar cards (gift cards, loyalty cards, identification
cards, and so on)?
a. Skimming
b. Shimming
c. SIM cloning
d. None of these answers are correct
A. Skimming is a type of attack in which an attacker captures credit card
information or information from other similar cards (gift cards, loyalty cards,
identification cards, and so on) from a cardholder surreptitiously. Attackers use
a device called a skimmer that can be installed at strategic locations such as
ATMs and gas pumps to collect card data.
Which of the following techniques are used to attack machine learning (ML)
implementations?
a. Tainting of data to cause errors in the outcome of the ML solution
b. Overfitting attacks
c. ML transfer attacks
d. All of these answers are correct.
D. Tainting, overfitting, and transfer attacks are types of adversarial techniques
against machine learning (ML) implementations.
You purchased a brand-new Internet of Things (IoT) device and noticed that
it started collecting personal information (PI) and attempted to send your data
by communicating with random IP addresses. You noticed that an implant
could have been installed during the manufacturing of the product. What type
of attack might this be?
a. Supply-chain attack
b. Cross-site scripting
c. Return to libc attack
d. Masquerading attack
A. A supply-chain attack occurs when attackers target security weaknesses in
the supply network and install malicious software or hardware implants to perform different nefarious activities.
Which of the following attacks are made against cloud implementations?
a. API attacks
b. DNS attacks
c. VM escape attacks
d. All of these answers are correct.
D. Attackers can perform virtual machine (VM) escape, API, and DNS attacks
to compromise cloud-hosted applications and services.
An attacker attempts to force an application to roll back the version of TLS
(from TLS version 1.3 to 1.0). What is the name of this type of attack?
a. Privilege escalation
b. Downgrade attack
c. Cracking
d. Fuzzing
B. A downgrade attack is a type of cryptographic attack that forces the rollback
of a strong algorithm in favor of an older, lower-quality algorithm or mode of
operation.
What type of privilege escalation attack occurs when a user accesses functions
or content reserved for other normal users—for example, if one user reads
another’s email?
a. Horizontal
b. Vertical
c. Sudo abuse
d. None of these answers are correct.
A. The two types of privilege escalation attacks are vertical and horizontal. A horizontal privilege escalation attack occurs when a user accesses functions or content reserved for other users. Vertical privilege escalation occurs when a lower-privileged user accesses functions reserved for higher-privileged users— for example, if a standard user can access functions of an administrator. This is also known as privilege elevation and is the most common description. To protect against this type of situation, you should update the network device firmware. In the case of an operating system, it should again be updated, and use of some type of access control system is also advisable—for example, User Account Control (UAC).
Which vulnerability can lead to stealing of cookies or redirecting users to
malicious sites and where the malicious code or script is permanently stored
on a vulnerable system?
a. DOM-based XSS
b. Stored XSS
c. Reflected XSS
d. All of these answers are correct.
B. Stored, or persistent, XSS attacks occur when the malicious code or script
is permanently stored on a vulnerable or malicious server, using a database.
These attacks are typically carried out on websites hosting blog posts (comment forms), web forums, and other permanent storage methods. An example
of a stored XSS attack is a user requesting the stored information from the
vulnerable or malicious server, which causes the injection of the requested
malicious script into the victim’s browser. In this type of attack, the vulnerable
server is usually a known or trusted site.
Which type of injection attack occurs when code is run within the address
space of another process, forcing it to load another library?
a. DLL injection
b. LDAP injection
c. SQL injection
d. None of these answers are correct.
A. DLL injection occurs when code is run within the address space of another
process by forcing it to load a dynamic link library (DLL). Ultimately, this
type of attack can influence the behavior of a program that was not originally
intended. This attack can be uncovered through penetration testing.
Which condition occurs when a program dereferences a pointer that it expects to
be valid but is null, which can cause the application to exit or the system to crash?
a. Address space layout randomization
b. Tunnel-trap
c. Format string
d. Null pointer dereferences
D. A null pointer dereference occurs when a program dereferences a pointer
that it expects to be valid but is null, which can cause the application to exit
or the system to crash. From a programmatical standpoint, the main way to
prevent this situation is to use meticulous coding. Programmers can use special memory error analysis tools to enable error detection for a null pointer
dereference.
Which type of attack occurs when an attacker tries to escape the web root
folder and access arbitrary files by using ../../ in an URL?
a. Directory traversal
b. Path traversal
c. Dot-dot-slash
d. All of these answers are correct.
D. Directory traversal, path traversal, and the ../ (“dot-dot-slash”) attack are
methods of accessing unauthorized parent (or worse, root) directories. They
are often used on web servers that have PHP files and are Linux or UNIXbased but can also be perpetrated on Microsoft operating systems (in which
case, it would be ..\ or the “dot-dot-backslash” attack).
What occurs when arithmetic operations attempt to create a numeric value
that is too big for the available memory space?
a. Stack overruns
b. Integer overflows
c. Format strings
d. Heap underruns
B. A dictionary password attack pulls words from the dictionary or word lists
to attempt to discover a user’s password. A dictionary attack uses a predefined
dictionary to look for a match between the encrypted password and the
encrypted dictionary word.
Race conditions are also known as ________ attacks.
a. Heap overflows
b. Time-of-check (TOC) or time-of-use (TOU)
c. Stack overflows
d. Buffer overflows
B. Race conditions are also known as time-of-check (TOC) or time-of-use
(TOU) attacks.
_______________code should be checked thoroughly so that a malicious user
can’t find out any additional information about the system.
a. Regression
b. Patched
c. Error exception handling
d. Remote code execution
C. Error handling or error exception handling code should be checked thoroughly so that a malicious user can’t find out any additional information about
the system. These error handling methods are sometimes referred to technically as pseudocodes.
Input validation vulnerabilities can be found by using which of the following techniques? a. A python debugger b. Fuzzing c. Heap flags d. All of these answers are correct.
B. A fuzzer is a program that can send crafted messages to a vulnerable application or system to find input validation vulnerabilities.
Which type of attack occurs when an attacker might use a packet sniffer to intercept data and retransmit it later? a. Overflow b. DLL injection c. XSS d. Replay
D. A replay attack is a network attack in which a valid data transmission is
maliciously or fraudulently repeated or delayed. It differs from session hijacking in that the original session is simply intercepted and analyzed for later use.
In a replay attack, an attacker might use a packet sniffer to intercept data and
retransmit it later. In this way, the attacker can impersonate the entity that
originally sent the data.
A web session ID is typically represented in a cookie. Which type of attack
occurs when an attacker could steal a valid user’s session ID and reuse it to
perform malicious transactions?
a. Session replay
b. Session fuzzing
c. SQL injection
d. All of these answers are correct.
A. Session replay attacks occur when an attacker steals a user’s valid session ID
and reuses that ID to perform malicious transactions and activities with a web
application.
__________ attacks leverage the trust that the application has in the targeted
user. For example, the attacker could inherit the privileges of the user to perform an undesired action, such as stealing sensitive information, creating users,
or downloading malware.
a. XSS
b. SQLi
c. XML injection
d. XSRF
D. Cross-site request forgery (XSRF) attacks leverage the trust that the application has in the targeted user. For example, the attacker could inherit the
privileges of the user to perform an undesired action, such as stealing sensitive
information, creating users, or downloading malware.
Which of the following are general best practices to protect APIs?
a. Secure API services to provide only HTTPS endpoints with a strong
version of TLS.
b. Validate parameters in the application and sanitize incoming data from
API clients.
c. Explicitly scan for common attack signatures; injection attacks often
betray themselves by following common patterns.
d. All of these answers are correct.
D. All of the available answers are best practices to help protect application programming interfaces (APIs).
Which of the following is a type of denial-of-service (DoS) attack?
a. C2
b. Botnet
c. Resource exhaustion
d. None of these answers are correct.
C. Resource exhaustion is an attack against availability that is designed to
bring the network, or access to a particular TCP/IP host/server, to its knees
by flooding it with useless traffic. Resource exhaustion attacks are a form of
denial-of-service (DoS) attacks. They can also leverage software vulnerabilities
such as memory leaks and file descriptor leaks.
Which of the following attacks can reduce the performance of a computer,
especially in systems with shared memory or limited memory?
a. Heap underrun
b. Format string
c. XSS
d. Memory leak
D. A memory leak is a type of resource leak caused when a program does not
release memory properly. The lack of freed-up memory can reduce the performance of a computer, especially in systems with shared memory or limited
memory. A kernel-level leak can lead to serious system stability issues. The
memory leak might happen on its own due to poor programming, or it could
be that code resides in the application that is vulnerable and is later exploited
by an attacker who sends specific packets to the system over the network.
Which of the following is a common way to launch an SSL strip attack?
a. Creating a rogue wireless access point (hotspot)
b. Launching Metasploit
c. Fuzzing an application
d. Leveraging a memory leak
A. An attacker can launch an SSL strip attack in different ways. One of the
most common ways is to create a wireless hotspot and lure the victims to connect to it.
Which of the following is a driver manipulation attack where an attacker adds
a small library that intercepts API calls?
a. Kernel module attack
b. Request forgery
c. Refactoring
d. Shimming
D. Attackers can potentially modify drivers through the use of driver shimming (the adding of a small library that intercepts API calls) and driver refactoring (the restructuring of driver code).
Pass the hash are attacks usually performed in which of the following operating systems?
a. Apple iOS
b. macOS
c. Linux
d. Windows
D. Pass the hash attacks leverage deficiencies in Windows NTLM
implementations.
Which of the following is a type of related-key attack, which occurs when an
attacker observes the operation of a cipher using several different keys and
finds a mathematical relationship between those keys, allowing the attacker to
ultimately decipher data?
a. IV attack
b. Evil twin
c. WPA attack
d. None of these answers are correct.
A. An initialization vector (IV) attack is a type of related-key attack, which
occurs when an attacker observes the operation of a cipher using several different keys and finds a mathematical relationship between those keys, allowing
the attacker to ultimately decipher data.
Which of the following can be used to perform an on-path attack?
a. SQL injection
b. ARP cache poisoning
c. Buffer overflow
d. All of these answers are correct
B. ARP cache poisoning (also known as ARP spoofing) is an example of an
attack that leads to a man-in-the-middle scenario. An ARP spoofing attack can
target hosts, switches, and routers connected to a Layer 2 network by poisoning the ARP caches of systems connected to the subnet and by intercepting
traffic intended for other hosts on the subnet.
Which of the following describes when an attacker must first infect the
victim’s computer with a Trojan or a malicious browser extension or plug-in
to intercept transactions from a web browser?
a. On-path attack
b. LDAP injection
c. SQL injection
d. Keylogger injection
A. With an on-path attack, the attacker must first infect the victim’s computer
with a Trojan. The attacker usually gets the malware onto the victim’s computer through some form of trickery or deceit.
Which of the following describes when an attacker must first infect the
victim’s computer with a Trojan or a malicious browser extension or plug-in
to intercept transactions from a web browser?
a. On-path attack
b. LDAP injection
c. SQL injection
d. Keylogger injection
A. With an on-path attack, the attacker must first infect the victim’s computer
with a Trojan. The attacker usually gets the malware onto the victim’s computer through some form of trickery or deceit.
Which of the following attacks occurs when the threat actor sends numerous
unknown MAC addresses to a network switch to cause a DoS condition or to
sniff network connections over a switched network while disrupting network
performance?
a. CAM memory leak attack
b. MITM
c. ARP cache poisoning
d. MAC flooding attacks
D. Attackers launch MAC flooding attacks by sending numerous unknown
MAC addresses to a network switch to cause a DoS condition. In addition,when the Layer 2 forwarding table limit is exceeded, packets are flooded
to all ports in a virtual LAN (VLAN). This, in turn, enables the attacker to
sniff network connections over a switched network while disrupting network
performance.
Which of the following attacks occurs when the attacker changes the
registration of a domain name without the permission of the original owner/
registrant?
a. Directory traversal
b. Path traversal
c. Dot-dot-slash
d. Domain hijacking
D. Domain hijacking is a type of hijacking attack in which the attacker changes
the registration of a domain name without the permission of the original
owner/registrant. One of the most common methods to perform a domain
hijacking is using social engineering.
Which of the following protocols has been used for amplification attacks?
a. IPX
b. DNS
c. NetFlow
d. None of these answers are correct.
B. One specific type of DDoS attack is the DNS amplification attack. Amplification attacks generate a high volume of packets ultimately intended to flood a
target website.
Which of the following has been used by attackers to create malicious macros in applications such as Excel or Word? a. Keyloggers b. VBA c. DNS d. NTP
B. Visual Basic for Applications (VBA) is an event-driven programming capability in Microsoft operating systems and applications. Attackers have used
VBA to create malicious macros in applications such as Excel or Word.
Which of the following threat actors typically aims to cause denial-of-service
conditions or deface websites due to a political or social belief?
a. Hacktivists
b. Semi-authorized hackers
c. Script kiddies
d. Nation state actors
A. The name hacktivist is often applied to different kinds of activities—from
hacking for social change, to hacking to promote political agendas, to fullblown cyberterrorism. Due to the ambiguity of the term, a hacktivist could be
inside a company or attack from the outside and will have varying amounts of
resources and funding. However, a hacktivist is usually far more competent
than a script kiddie.
Which of the following threat actors is typically motivated by money? (Choose
the best answer.)
a. Authorized hackers
b. Criminal syndicates and organized crime
c. Exploit groups
d. None of these answers are correct.
B. Cybercriminals might work on their own, or they might be part of criminal
syndicates and organized crime—a centralized enterprise run by people motivated mainly by money.
Which of the following attributes make threat actors different?
a. Level of sophistication
b. Resources
c. Funding
d. All of these answers are correct.
D. The level of sophistication/capability, resources, and funding are all attributes of threat actors that put them into different categories (that is, statesponsored actors, script kiddies, hacktivists, criminals).
Which incident response concept is designed to represent a cybersecurity incident and is made up of four parts?
a. FIRST
b. InfraGard
c. Diamond Model of Intrusion
d. All of these answers are correct.
C. The Diamond Model is designed to represent a cybersecurity incident
and is made up of four parts. Active intrusions start with an adversary who
targets a victim. The adversary will use various capabilities along some form
of infrastructure to launch an attack against the victim. Capabilities can be
various forms of tools, techniques, and procedures, while the infrastructure
is what connects the adversary and victim. The lines connecting each part of
the model depict a mapping of how one point reached another. This mapping helps you understand the motives, intent, sophistication, capabilities, and
resources that a threat actor may have.
Which of the following is an effective attack vector where an attacker could
modify or tamper hardware or software from a vendor to perform mass
compromise attacks?
a. Supply chain
b. Removable media
c. Wireless
d. Direct access
A. One of the most effective attacks for mass compromise is to attack the supply
chain of a vendor to tamper with hardware and/or software. This tampering might
occur in-house or earlier, while in transit through the manufacturing supply chain.
Which of the following elements could an attacker leverage to perform a
cloud-based attack?
a. Misconfigured VMs
b. Unpatched applications and operating systems
c. Misconfigured storage buckets
d. All of these answers are correct.
D. Attackers can leverage misconfigured and insecure cloud deployments
including unpatched applications, operating systems, and storage buckets.
Which term refers to the knowledge about an existing or emerging threat to assets, including networks and systems? a. Threat intelligence b. Threat feed c. Threat model d. None of these answers are correct.
A. Threat intelligence refers to knowledge about an existing or emerging
threat to assets, including networks and systems. Threat intelligence includes
context, mechanisms, indicators of compromise (IoCs), implications, and
actionable advice.
Which technique is used when you leverage public information from DNS
records, social media sites, websites, search engines, and other sources for
reconnaissance?
a. OSINT
b. Threat maps
c. Threat models
d. Threat analysis
A. Open-source intelligence (OSINT) applies to offensive security (ethical hacking/penetration testing) and defensive security. In offensive security,
OSINT enables you to leverage public information from DNS records, social
media sites, websites, search engines, and other sources for reconnaissance—in
other words, to obtain information about a targeted individual or an organization. When it comes to threat intelligence, OSINT refers to public and free
sources of threat intelligence.
Which of the following could be threat and vulnerability research sources?
a. Vendor websites
b. Threat feeds
c. Vulnerability feeds
d. All of these answers are correct.
D. Vendor websites, threat feeds, and vulnerability feeds could all be used for
threat and vulnerability research.
Which framework was created by MITRE to describe adversary tactics and techniques? a. InfraGard b. CVE c. ATT&CK d. CWE
C. The MITRE ATT&CK framework (https://attack.mitre.org) is a collection of different matrices of tactics and techniques. InfraGard is a collaborative
effort between the FBI and the private sector. The Common Vulnerability
and Exposure (CVE) is a standard to identify vulnerabilities created and maintained by MITRE. The Common Weakness Enumeration (CWE) is a standard to identify the weaknesses (root cause) of security vulnerabilities. CWE
was also created by MITRE
Which cloud service model offers computer networking, storage, load balancing, routing, and VM hosting? a. IaaS b. PaaS c. SaaS d. None of these answers are correct.
A. Infrastructure as a service (IaaS) is a type of cloud service that offers computer networking, storage, load balancing, routing, and VM hosting. Platform
as a service (PaaS) provides various software solutions to organizations, especially the capability to develop applications in a virtual environment without
the cost or administration of a physical platform. Software as a service (SaaS)
is a cloud service model where the cloud provider offers the complete infrastructure and the application. Examples of SaaS include Gmail, Office 365,
Webex, Zoom, Dropbox, Google Drive, and many other applications you use
every day
Which of the following is a security concern in cloud deployments?
a. Encryption
b. Authentication methods
c. Identity management
d. All of these answers are correct.
D. Encryption, authentication methods, and identity management are all security concerns in cloud deployments and environments.
Which type of vulnerability is disclosed by an individual or exploited by an
attacker before the creator of the software can create a patch to fix the underlying issue?
a. Cross-site scripting
b. Zero-day
c. Information disclosure
d. None of these answers are correct.
B. A zero-day vulnerability is a type of vulnerability that is disclosed by an
individual or exploited by an attacker before the creator of the software can
create a patch to fix the underlying issue. Attacks leveraging zero-day vulnerabilities can cause damage even after the creator knows of the vulnerability
because it may take time to release a patch to prevent the attacks and fix damage caused by them.
Which of the following can be considered a weak configuration that can allow
attackers to perform an attack and compromise systems?
a. Default settings and passwords
b. Weak encryption
c. Open permissions
d. All of these answers are correct.
D. Default settings and passwords, weak encryption, and open permissions are
examples of the most prevalent types of weak configurations that can be leveraged by an attacker to perform malicious activities and compromise systems.
Which of the following is a weak protocol that should be avoided?
a. HTTP without encryption
b. Telnet
c. FTP without encryption
d. All of these answers are correct.
D. Protocols such as Telnet, FTP (without encryption), and HTTP without encryption should be avoided at all times because they are considered
unsecure.
Which of the following should be considered when assessing third-party risks?
a. Vendor management
b. Supply chain
c. Outsourced code development
d. All of these answers are correct.
D. Vendor management, system integration, lack of vendor support, supply
chain, and outsourced code development should all be assessed when performing an analysis of third-party risks.
In Windows, what is a broadly released fix for a product-specific securityrelated vulnerability?
a. Security update
b. Service pack
c. Threat model
d. None of these answers are correct.
A. A security update is a broadly released fix for a product-specific securityrelated vulnerability or group of vulnerability. Security vulnerabilities are rated
based on their severity, which is indicated in the Microsoft Security Bulletin as
critical, important, moderate, or low.
Which of the following is a disadvantage of running legacy platforms and
products?
a. They are often affected by security vulnerabilities.
b. They do not have modern security features.
c. When a device is past the last day of support, vendors will not investigate
or patch security vulnerabilities in those devices.
d. All of these answers are correct.
D. Legacy platforms and products that have passed the end of support date are
often affected by unfixed security vulnerabilities and do not have modern security features. When a device is past the last day of support, vendors will not
investigate or patch security vulnerabilities in those devices.
Which of the following could be categorized as different types of negative
impact that a security breach could have in a corporation?
a. Financial
b. Reputation
c. Availability loss
d. All of these answers are correct.
. D. A security breach could have direct financial impact to a corporation (such
as fines and lawsuits). The brand and reputation of a company can also be
damaged by major cybersecurity incidents and breaches. Cybersecurity incidents can also lead to outages and availability loss.
Which of the following can be used by attackers to obfuscate their tactics
when exfiltrating data from their target (victim)?
a. Encryption
b. Tunneling over a known protocol like DNS
c. Encoding
d. All of these answers are correct.
D. Attackers can leverage different types of obfuscation and evasion techniques
to go undetected (including encoding of data, tunneling, and encryption).
What is the act of proactively and iteratively looking for threats in your
organization that may have bypassed your security controls and monitoring
capabilities?
a. Threat intelligence
b. Threat hunting
c. Threat binding
d. None of these answers are correct.
B. Threat hunting is the act of proactively and iteratively looking for threats in
your organization.
Which of the following provides a matrix of adversary tactics, techniques, and procedures that modern attackers use? a. ATT&CK b. CVSS c. CVE d. All of these answers are correct.
A. The MITRE ATT&CK is a collection of matrices that outline adversary
tactics, techniques, and procedures (TTPs) that modern attackers use.
Which identifier is assigned to disclosed vulnerabilities?
a. CVE
b. CVSS
c. ATT&CK
d. TTP
A. Most of the vulnerabilities disclosed to the public are assigned Common
Vulnerability and Exposure (CVE) identifiers. CVE is a standard created by
MITRE (www.mitre.org) that provides a mechanism to assign an identifier
to vulnerabilities so that you can correlate the reports of those vulnerabilities
among sites, tools, and feeds.
Which broad term describes a situation in which a security device triggers an
alarm, but no malicious activity or actual attack is taking place?
a. False negative
b. True negative
c. False positive
d. True positive
C. A false positive is a broad term that describes a situation in which a security device triggers an alarm, but no malicious activity or actual attack is taking place. In other words, false positives are false alarms, and they are also
called benign triggers.
Which of the following is a successful identification of a security attack or a malicious event? a. True positive b. True negative c. False positive d. False negative
A. A true positive is a successful identification of a security attack or a malicious event. A true negative occurs when the intrusion detection device identifies an activity as acceptable behavior and the activity is actually acceptable.
False positives are false alarms, and false negative is the term used to describe a
network intrusion device’s inability to detect true security events under certain
circumstances—in other words, a malicious activity that is not detected by the
security device.
Which of the following occurs when a vulnerability scanner logs in to the
targeted system to perform deep analysis of the operating system, running
applications, and security misconfigurations?
a. Credentialed scan
b. Application scan
c. Noncredentialed scan
d. None of these answers are correct.
A. Vulnerability scanners can often log in to the targeted system to perform
deep analysis of the operating system, running applications, and security misconfigurations. This technique is called a credentialed scan.
Which of the following are functions of a SIEM?
a. Log collection
b. Log normalization
c. Log correlation
d. All of these answers are correct.
D. SIEMs can provide log collection, normalization, and correlation.
Which solution allows security analysts to collect network traffic metadata?
a. NetFlow
b. SIEM
c. SOAR
d. None of these answers are correct.
A. NetFlow is a technology invented by Cisco to collect network metadata
about all the different “flows” of traffic on your network.
Which solution provides capabilities that extend beyond traditional SIEMs?
a. SOAR
b. CVSS
c. CVE
d. IPFIX
A. Security Orchestration, Automation, and Response (SOAR) systems extend
beyond traditional SIEMs to allow organizations to collect security threat data
and alerts from multiple sources and to perform many different automated
response capabilities.
Which of the following can be capabilities and benefits of a SOAR solution?
a. Automated vulnerability assessment
b. SOC playbooks and runbook automation
c. Orchestration of multiple SOC tools
d. All of these answers are correct.
D. Unlike traditional SIEM platforms, SOAR solutions can also be used for
threat and vulnerability management, security incident response, and security
operations automation (including playbook and runbook automation, as well as
orchestration of multiple SOC tools).
Which term is used to define the practice of mimicking a threat actor by using
the same methodologies and tools to find and exploit vulnerabilities with the
permission of the system or network owner?
a. Ethical hacking
b. Pen testing
c. Penetration testing
d. All of these answers are correct.
D. Ethical hacking, pen testing, and penetration testing are all terms used to
define the process of finding vulnerabilities and mimicking what an attacker
could do against your systems and networks. Penetration testing is done after
obtaining permission from the system or network owner.
Which of the following is a type of penetration testing where the tester starts
out with a significant amount of information about the organization and its
infrastructure?
a. Known environment
b. Unknown environment
c. Partially known environment
d. None of these answers are correct.
A. In the known environment pen testing type, the pen tester starts out with
a significant amount of information about the organization and its infrastructure. The tester would normally be provided network diagrams, IP addresses,
configurations, and a set of user credentials, for example. If the scope includes
an application assessment, the tester might also be provided the source code of
the target application. The idea of this type of test is to identify as many security holes as possible.
Which of the following are elements of the penetration pre-engagement
phase?
a. Developing the rules of engagement document
b. Negotiating contracts
c. Creating the statement of work (SOW)
d. All of these answers are correct.
D. The pre-engagement tasks include items such as contract negotiations, the
statement of work (SOW), scoping, and the rules of engagement.
Which of the following elements are typically included in the rules of engagement document during a penetration testing?
a. Testing timeline
b. Location of the testing
c. The security controls that could potentially detect or prevent testing
d. All of these answers are correct.
D. The rules of engagement document typically includes the testing timeline,
location of the testing, time window of the testing, preferred method of communication, the security controls that could potentially detect or prevent testing, IP addresses or networks from which testing will originate, and the scope
of the engagement.
Which term is used when a penetration tester uses public records to perform passive reconnaissance? a. OSINT gathering b. Scanning c. Banner fingerprinting d. Shodan
A. Open-source intelligence (OSINT) gathering is the term used when a penetration tester uses public records to perform passive reconnaissance.
Which of the following is an example of a blue team?
a. CSIRT
b. Pen testing teams
c. Offensive security teams
d. None of these answers are correct.
D. Active reconnaissance is carried out mostly by using network and vulnerability scanners. Nmap is an open-source network and port scanner. Nessus is
a vulnerability scanner sold by Tenable. Nikto is an open-source web application vulnerability scanner.
What term is used to describe how an organization integrates the defensive
capabilities of a blue team with the adversarial techniques used by the red
team?
a. Advanced red teaming
b. Adversarial emulation
c. Purple teaming
d. None of these answers are correct.
C. Purple teams integrate the defensive capabilities of a blue team with the
adversarial techniques used by the red team. Often the purple team is not a
separate team, but a solid dynamic between the blue and red teams.
Which term is often used to define the team that focuses in security governance, regulatory compliance, and risk management?
a. White team
b. Purple team
c. Red team
d. Blue team
A. White teams are individuals who are focused on governance, management,
risk assessment, and compliance.
Which of the following is a primary goal of configuration management?
a. Maintaining computer systems, servers, network infrastructure, and software in a desired, consistent state
b. Reducing the cost of acquiring computer systems, servers, network infrastructure, and software used for information security
c. Ensuring that any changes done to the infrastructure do not affect the
underlying organization’s IT budget
d. All of these answers are correct.
A. Configuration management is an ongoing process created with the goal of
maintaining computer systems, servers, network infrastructure, and software
in a desired, consistent state. One of the primary goals of configuration management is to ensure that your infrastructure performs as it’s expected to as
changes are made over time.
After a minimum desired state of security is defined, ________ should be taken
to assess the current security state of computers, servers, network devices, and
the network in general.
a. network diagrams
b. IPv4 schemas
c. baselines
d. None of these answers are correct.
C. After a minimum desired state of security is defined, baselines should
be taken to assess the current security state of computers, servers, network devices, and the network in general. Baseline configurations should
be properly documented and reviewed to include a set of specifications for
information systems or configuration items within those systems. Baseline
configurations are used by security professionals, along with network and system administrators, as a basis for future deployments, releases, or changes to
information systems and applications.
Which of the following is a benefit of standard naming conventions in an IT
infrastructure?
a. Appropriate naming conventions are used to avoid conflicts and to be
able to correlate data among disparate systems.
b. Appropriate naming conventions are used to reduce unnecessary spending of IT infrastructure.
c. Appropriate naming conventions are used to better create IPv6 network
schemas and for data sovereignty.
d. None of these answers are correct.
A. You should make sure that your organization has appropriate naming conventions for describing IT infrastructure, applications, and users. Appropriate
naming conventions are used to avoid conflicts and to be able to correlate data
among disparate systems.
Which of the following are privacy laws or regulations? (Choose two.)
a. PCI-DSS
b. CCPA
c. GDPR
d. FedRamp
B and C. The General Data Protection Regulation (GDPR) is a regulation
in the European Union and the European Economic Area focused on data
protection and privacy. Another example is the California Consumer Privacy
Act (CCPA). These regulations give consumers the right to know what personal information is being collected by companies, government, and any other
organizations.
Which of the following is a type of software or hardware-based data loss prevention solution? a. Endpoint DLP systems b. Network DLP systems c. Storage DLP systems d. All of these answers are correct.
D. Data loss prevention (DLP) systems can be software or hardware-based
solutions and are categorized in three general types: endpoint, network, and
storage DLP systems
You were hired to deploy a system to prevent unauthorized use and transmission of confidential information. What should you prioritize to protect and encrypt? a. Data at rest b. Data in use c. Data in motion d. All of the answers are correct.
D. You should always encrypt data at rest, in use, and in motion in order to
protect sensitive data.
Which of the following are used in digital signatures, in file and message
authentication, and as a way to protect and verify the integrity of sensitive
data?
a. Data masking
b. Tokenization
c. Hashes
d. Redaction
C. Hashes are used in digital signatures, in file and message authentication,
and as a way to protect the integrity of sensitive data—for example, data
entered into databases or perhaps entire hard drives. A hash is generated
through the use of a hash function to verify the integrity of the file or message,
most commonly after transit over a network.
What do you call a redundant site that has tables, chairs, bathrooms, and possibly some technical setup, but a lot of configuration of computers and data
restoration is necessary before the site can be properly utilized?
a. Hot site
b. Warm site
c. Cluster site
d. Cold site
A. A hot site is a near duplicate of the original site of the organization that
can be up and running within minutes (in some cases longer). Computers and
phones are installed and ready to go, a simulated version of the server room
stands ready, and the vast majority of the data is replicated to the site on a
regular basis in the event that the original site is not accessible to users for
whatever reason.
Which term is used to categorize a group of computers used to attract and trap
potential adversaries to counteract and analyze an attack?
a. Honeypot
b. Honeynet
c. Honeyfile
d. None of these answers are correct.
B. A honeypot is generally a single computer but could also be a file, group of
files, or an area of unused IP address space, whereas a honeynet is a group of
computers, servers, or an area of a network; a honeynet is used when a single
honeypot is not sufficient. Either way, the individual computers, or group of
servers, will usually not house any important company information. Various
analysis tools are implemented to study the attacker; these tools, along with
a centralized group of honeypots (or a honeynet), are known collectively as a
honeyfarm.
A security analyst creates a file called passwords.txt to lure attackers to access
it. Which term is used for this technique?
a. Honeynet
b. Honeypot
c. Honeyfarm
d. Honeyfile
D. Honeyfiles are used as bait files intended to lure adversaries to access them
and then send alarms to a security analyst to potentially learn the tactics and
techniques used by the attacker.
In a _________ you configure one or more DNS servers to provide false
results to attackers and redirect them to areas in the network where you can
observe their tactics and techniques.
a. DNS sinkhole
b. DNS tunnel
c. DNS Zone transfer
d. None of these answers are correct.
A. In a DNS sinkhole you configure one or more DNS servers to provide false
results to attackers and redirect them to areas in the network where you can
observe their tactics and techniques. DNS sinkholes have been used to contain
different types of malware such as the infamous WannaCry ransomware and to
disrupt certain malicious DNS operations in denial-of-service (DoS) and other
attacks.
Which of the following cloud service models will you use if you want to
host applications on virtual machines, deploy load balancers, and use storage
buckets?
a. IaaS
b. PaaS
c. SaaS
d. None of these answers are correct.
A. IaaS is a service that offers computer networking, storage, load balancing,
routing, and VM hosting. More and more organizations are seeing the benefits
of offloading some of their networking infrastructure to the cloud.
A. A community cloud is a mix of public and private cloud deployments where
multiple organizations can share the public portion.
Which of the following cloud deployments is a mix of public and private cloud
solutions where multiple organizations can share the public cloud portion?
a. Community cloud
b. PaaS
c. SaaS
d. MSSP cloud
A. A community cloud is a mix of public and private cloud deployments where
multiple organizations can share the public portion.
Google Drive, Office 365, and Dropbox are examples of which of the following types of cloud service?
a. SaaS
b. IaaS
c. PaaS
d. All of these answers are correct.
A. Google Drive, Office 365, and Dropbox are examples of the software as a
service (SaaS) cloud service model.
What type of company or organization provides services to manage your security devices and can also help monitor and respond to security incidents?
a. SaaS provider
b. PaaS provider
c. MSSP
d. Serverless provider
C. A managed security service provider (MSSP) provides services to manage your security devices and can also help monitor and respond to security
incidents.
Which of the following organizations delivers network, application, system,
and management services using a pay-as-you-go model?
a. SaaS provider
b. PaaS provider
c. XaaS provider
d. Managed service provider (MSP)
D. Managed service providers (MSPs) can deliver network, application, system,
and management services using a pay-as-you-go model. An MSP is an organization that can manage your network infrastructure, servers, and in some cases
your security devices. Companies that provide services to manage your security
devices and can also help monitor and respond to security incidents are called
managed security service providers (MSSPs).
Which term is used to describe an ecosystem of resources and applications in
new network services (including 5G and IoT)?
a. SaaS
b. VPC
c. Edge computing
d. None of these answers are correct.
C. The term edge computing describes an ecosystem of resources and applications in new network services (including 5G and IoT). One of the main benefits is to provide greater network speeds, low latency, and computational power
near the user.
Which of the following are computer systems that run from resources stored
on a central server or from the cloud instead of a local (on-premises) system?
a. Thin clients
b. Fog edge devices
c. VPCs
d. Containers
A. Thin clients are computer systems that run from resources stored on a central server or from the cloud instead of a local (on-premises) system. When
you use a thin client, you connect remotely to a server-based computing environment where the applications, sensitive data, and memory are stored.
Which of the following are technologies and solutions to manage, deploy, and orchestrate containers? a. Docker Swarm b. Apache Mesos c. Kubernetes d. All of these answers are correct
D. Docker Swarm, Apache Mesos, and Kubernetes are technologies and solutions to manage, deploy, and orchestrate containers.
What condition could occur when an organization can no longer effectively
control and manage all the VMs on a network or in the cloud?
a. VM sprawl
b. VM escape
c. Hypervisor escape
d. Hypervisor sprawl
A. VM sprawl (otherwise known as virtualization sprawl) occurs when an organization can no longer effectively control and manage all the VMs on a network or in the cloud.
Which condition occurs when an attacker or malware compromises one VM and then attacks the hypervisor? a. VM escape b. Hypervisor escape c. VM sprawl d. Hypervisor sprawl
A. In a VM escape attack, the guest VM breaks out of its isolated environment
and attacks the hypervisor or compromises other VMs hosted and controlled
by the hypervisor.
Which of the following is a software and hardware development and project
management methodology that has at least five to seven phases that follow in
strict linear order?
a. Waterfall
b. Agile
c. DevOps
d. SDLC
Which of the following is a software and hardware development and project
management methodology that has at least five to seven phases that follow in
strict linear order?
a. Waterfall
b. Agile
c. DevOps
d. SDLC
A. The traditional software development methodology is the waterfall model,
which is a software and hardware development and project management methodology that has at least five to seven phases that follow in strict linear order.
Each phase cannot start until the previous phase has been completed.
Which of the following is a benefit when you use log aggregation tools to
maintain and analyze logs of every element that goes into the provisioning of
applications?
a. The ability to scale horizontally
b. The ability to respond quickly and deprovision the application in the
event that something wrong
c. The ability to design an elastic infrastructure
d. None of these answers are correct.
B. You can integrate with log aggregation tools to maintain and analyze logs
of every element that goes into the provisioning. This allows you to respond
quickly and deprovision the application in the event that something went
wrong. When you go back, you can check the logs and accurately find and fix
the root cause of the error.
Which of the following elements can help software (code) integrity?
a. Unit testing
b. Integration testing
c. Identifying a code integrity manager
d. All of these answers are correct.
D. Unit testing, integration testing, and identifying a code integrity manager
can help software (code) integrity.
Which process includes identifying assets to the system or application, uncovering vulnerabilities, identifying threats, documenting threats, and rating those
threats according to their potential impact?
a. SECOPS
b. Principle of least privilege
c. Threat modeling
d. None of these answers are correct.
C. Threat modeling enables you to prioritize threats to an application based
on their potential impact. This modeling process includes identifying assets
to the system or application, uncovering vulnerabilities, identifying threats, documenting threats, and rating those threats according to their potential
impact. The more risk, the higher the rating. Threat modeling is often incorporated into the software development lifecycle (SDLC) during the design,
testing, and deployment phases.
Which of the following are important security principles that should be incorporated into the SDLC?
a. Input validation
b. Principle of least privilege
c. Failing securely
d. All of these answers are correct.
D. Input validation, principle of least privilege, and failing securely are all
important security principles that should be incorporated into the SDLC.
Which of the following might include syntax errors in the code and typechecking errors?
a. Misconfigured VMs
b. Unpatched applications and operating systems
c. Misconfigured storage buckets
d. Compile-time errors
D. Compile time refers to the duration of time during which the statements
written in any programming language are checked for errors. Compile-time
errors might include syntax errors in the code and type-checking errors. A
programmer can check these errors without actually running the program and
instead check it in the compile stage when it is converted into machine code.
Which of the following are top web application security risks?
a. Broken Access Control
b. XML External Entities (XXE)
c. Cross-Site Scripting (XSS)
d. All of these answers are correct.
D. One of the most popular OWASP projects is the Top 10 Web Application
Security Risks. You can find the latest Top 10 Web Application Security Risks
at https://owasp.org/www-project-top-ten. All of these answers are top web
application security risks.
Which of the following terms is often used when a compiler is modified to
generate variants of a binary (target application) that operates in the same way
when processing benign input but may operate in a different manner when
given malicious input?
a. ASLR
b. Random forest
c. Software diversity
d. None of these answers are correct.
C. In an example of software diversity, a compiler is modified to generate
variants of a binary (target application) that operates in the same way when
processing benign input; however, it may operate in a different manner when
given malicious input. This new aspect of software diversity is handled by generating variants of a program by building a binary with a diversifying compiler
that can randomize the code layout, stack variables, and random allocations of
heap objects at different locations in each variant.
Which of the following is a software development practice where programmers merge code changes in a central repository multiple times a day?
a. Continuous integration
b. DevSecOps
c. Waterfall
d. All of these answers are correct.
A. Continuous integration (CI) is a software development practice in which programmers merge code changes in a central repository multiple times a day. Continuous delivery (CD) sits on top of CI and provides a way for automating the entire software release process. When you adopt CI/CD methodologies, each change in code should trigger an automated build-and-test sequence. This automation should also provide feedback to the programmers who made the change.
Which of the following is the ability of an underlying infrastructure to react to
a sudden increase in demand by provisioning more resources in an automated
way?
a. Load balancing
b. Using Kubernetes
c. Elasticity
d. All of these answers are correct
C. Elasticity is the ability of an underlying infrastructure to react to a sudden
increase in demand by provisioning more resources in an automated way. Elasticity and scalability are often achieved by deploying technologies such as load
balancers and by deploying applications and resources in multiple geographical
locations (data centers around the world). Other technologies such as enabling
concurrent processing (parallel processing) and automated container deployments (that is, using Kubernetes) allow organizations to auto-scale.
D. Microsoft Active Directory (AD) allows administrators to organize elements of a network, such as users, computers, and devices, into a hierarchical
containment structure.
Which of the following best describes a directory structure used on Microsoft Windows-based servers and computers to store data and information about networks and domains? a. Token Ring Network b. Packet Passing Ring c. AAA d. Active Directory e. TOPD
D. Microsoft Active Directory (AD) allows administrators to organize elements of a network, such as users, computers, and devices, into a hierarchical
containment structure.
Which of the following should be distributed among different physical
locations to provide redundancy for user authentication?
a. Linux servers
b. Azure Webservers
c. Smart cards
d. Directory services
D. Users authenticate against a directory service to ensure that it is highly
available at all times. A best practice requires that it be distributed in multiple
locations.
Which of the following is a contactless technology that is capable of matching a human face from a digital image? a. Fingerprint authentication b. Retinal authentication c. Facial recognition d. Iris authentication
C. In biometrics, facial recognition is the most common and least accurate way
to identify a user; it has higher false rejection and higher false acceptance rates
than other biometric security methods.
What biometric security measure is characterized by the identification and authentication of vocal modalities? a. Retinal authentication b. Voice verification c. Facial recognition d. Fingerprint authentication
B. Speaker verification is a 1:1 match where one speaker’s voice is matched to
one template, also called a voice print or voice model.
A physical item like a smart card (CAC) represents what multifactor
authentication (MFA) factor or attribute?
a. Something you know
b. Something you have
c. Something you are
d. Something you exhibit
B. You must have this physical item with you—something you have such as a
crypto card, token, or key fob that is used as a method to authenticate you as a
user.
Which of the following is an example of a biometric security measure that is something you exhibit? a. Personality trait or behavior b. Geolocation or IP address c. Facial recognition d. Photo ID
A. Physical movements such as the way you walk, typing patterns, and mouse
movements are examples of a personality trait, behavior, or observable biometric that can be used to authenticate you as a person.
What does the abbreviation AAA mean?
a. Authentication, authorization, and accounting
b. Authorization, accounting, and accredited
c. Accounting, abbreviate, and accentuate
d. Accounting, allocation, and attenuate
A. Authentication, authorization, and accounting (AAA) is a framework for
intelligently controlling access to computer resources, enforcing policies, and
auditing usage. These processes working in concert are important for effective
network management and security.
Which of the following is a feature that provides a way of identifying a user
using a user ID and a password specific to that user?
a. The AAA authentication feature
b. Authorization, accounting, and accredited
c. Authorization and accounting
d. Diametric simulation
A. Authentication provides a method of identifying a user, typically by having
the user enter a valid username and password before access to the network is
granted. Authentication is based on each user having a unique set of login credentials for gaining network access.
Which method provides highly available, always-on, pay-as-you-grow systems and services? a. Enterprise Data Center b. HAS highly available services c. Cloud-based hosted systems d. Next-generation data services
C. Enterprises that elect to use a cloud computing model need to pay only for
the resources that they use, with none of the maintenance and upkeep costs.
The price adjusts up or down depending on how much is consumed.
From a compliance perspective, which method of authentication hosting is preferred? a. Static code placement b. Enterprise on-premises hosting c. Cloud-based hosted systems d. Third-party hosted data and systems
B. On-premises authentication is preferred. Many companies these days operate under some form of regulatory control, regardless of the industry. The
most common one is the Health Insurance Portability and Accountability Act
(HIPAA) for private health information, but there are other government and
industry regulations. For companies that are subject to such regulations, it is
imperative that they remain compliant and know where their data is at all times.
Which of the following is one of the primary goals of geographic dispersal of
data and data processing?
a. Ensuring availability of data in the event of a disaster or regional issue,
such as power outage
b. Reducing the cost of acquiring computer systems, servers, network
infrastructure, and software used for information security
c. Ensuring the application infrastructure does not affect the underlying
network
d. All of these answers are correct.
A. Geographic dispersal of computing and data assets if a disaster, natural or
person-made, occurs ensures the company can continue to function. In such
cases, the company relies on infrastructure in another city, state, or country to
be available.
Which of the following describes the disk redundancy method of RAID 5?
a. It uses more hard disks and stripes data and parity over all hard disks.
b. It is a parity hard disk proportional to the log of HDD numbers.
c. It is a JBOD, otherwise known as just a bunch of drives.
d. It duplicates data from one hard disk to another; typically, it is two hard
disks set up to copy data to both disks.
A. RAID 5 writes the parity over all disks, making it possible to continue to
run even if one disk fails. Recovery is done by removing the failed drive and
executing the recovery process, where the drive is rebuilt and added to the
array once completed.
Which hard disk resilience mechanism uses two hard disks to provide redundancy and copies everything to both hard disks?
a. RAID 0
b. RAID 3
c. RAID 6
d. RAID 10
A. RAID 0 is known as disk striping; it is the process of dividing data into
blocks and spreading the data blocks across multiple storage devices, such as
hard disks or solid-state drives (SSDs). In a Redundant Array of Independent
Disks (RAID) group, there is no parity. The more hard drives in a RAID 0
array, the higher probability of array failure.
When a network interface card fails in a server, a secondary NIC continues transmitting traffic uninterrupted. What mechanism allows this feature to operate?
a. Redundant NIC
b. NIC teaming
c. NIC failover
d. Mirrored NIC
B. By deploying NIC teaming on your server, you can maintain a connection to multiple physical switches and use a single IP address. Load balancing
becomes readily available, fault tolerance becomes instant instead of waiting
for DNS records to time out or update, and management becomes simpler.
Which high-availability power mechanism provides an additional power
supply that can share or split the power load?
a. Redundant supervisor modules
b. Redundant power supplies
c. Dual hard disks
d. RAID 5 power sources
B. Redundant power is a critical component in high-availability systems. In the
simplest solution, two power supplies can drive a load through bused (vertical
line shared among equipment) or N+1 configuration, where two power supply outputs are load-shared together or have one active and one or more in
standby mode.
SAN-connected servers utilize a special fiber interface card called what?
a. Network interface card (NIC)
b. Host bus adapter (HBA)
c. Storage area network device (SAND)
d. Data beam fiber (DBF) card
B. SAN-connected servers contain special fiber interface cards called host bus adapters (HBAs). They are configured as pairs, typically called HBA1 and HBA2. The fiber is then connected to a pair of SAN network switches.
You can host services in your own data center or in the cloud. What is considered a cloud-based service?
a. Azure Active Directory (AD)
b. Novell NDS Services
c. Outlook 2010
d. Data Center Hosted SAP
A. Azure Active Directory is a fully managed multi-tenant cloud-based offering
from Microsoft that offers identity and access capabilities for applications
running in an on-premises environment. It is not a replacement for on-premises
Active Directory Services but could be, or it can be used with it to extend
on-prem directory services and sync the directories to cloud applications.
Which backup method provides connected backup storage anywhere in the
world with private/public remote storage?
a. Incremental offline
b. Intermittent even days
c. Local backup session
d. Cloud-based backup
e. Tape backup to mainframe
D. Cloud-based backups are a model of data storage in which the data can be
accessed, managed, and stored in a remote cloud server via the Internet. Cloud
backups are maintained and supported by a cloud storage provider responsible
for keeping the user’s data available and accessible at any time.
You can now back up your organization’s critical data to the cloud, including
all your desktop computers and servers. What is one downside to hosting all
your backups in the cloud?
a. Restoral is available only during the work week.
b. They require a special VPN connection to each device.
c. Accessing them may be slow depending on your Internet connection.
d. Backups are rotated every 30 days.
C. Backups to a cloud services backup (IaaS) provider can be slower than
on-premises backups where they are connected at gigabit speeds. Depending
on the amount of data being backed up, restoring data from them could take
many hours or even days to complete.
What is the uptime measurement of available time for a highly available system, knowing that no system can be up forever?
a. 95.99 percent
b. 100 percent
c. 90 percent
d. 99.999 percent
D. A highly available system should be able to quickly recover from any sort
of failure state to minimize interruptions for the end user. Best practice for
achieving high availability is to eliminate single points of failure or any node
that would impact the system as a whole if it becomes dysfunctional. The highest level of uptime is considered “five nines,” or 99.999 percent, which refers to
a standard of reliability. Five nines is equivalent to downtime of only 5 minutes
and 15 seconds per year (1 minute and 18 seconds in a quarter, or 26 seconds
monthly). These are very high standards to meet.
Your company just had a catastrophic failure, and the entire data center and
campus are down. After you establish your chain of command, what is the first
service or system you need to bring up in order to start recovery?
a. Video telecom VTC systems and bridges
b. Desktop computers in network operations center
c. Active Directory and LDAP to authorized users
d. Network connectivity
D. Without the network, systems will be unable to communicate with each
other. When building the restore order for your organization, do not forget
this critical step, and make sure you add it to your desktop exercises.
An organization can add many levels of diversity to enhance its systems and
network resilience. Which components will help? (Select all that apply.)
a. Redundant Pathed Facility Power
b. Network interface card (NIC) teaming
c. Supplier and supply chain contracts
d. Security cameras at all junctions
A, B, C. These are all steps that can be taken to enhance an organization’s
resilience and provide fault tolerance and diversity
Which of the following embedded devices are field programmable and are a
reconfigurable integrated circuit that can perform logic gates such as AND
gate, OR gate, and NOT gate?
a. FPGA
b. PStat
c. BIOS
d. None of these answers are correct.
A. A field-programmable gate array (FPGA) is an integrated circuit designed
to be configured by a customer or designer after manufacturing—hence the
term field-programmable
Which of the following Supervisory Control and Data Acquisition systems are part of the logistics ecosystem? a. Just-in-time manufacturing b. Fish tank controls c. Industrial plant mixing platforms d. None of these answers are correct
A. SCADA systems are capable of managing parts inventories for just-in-time
manufacturing, regulate industrial automation and robots, and monitor processes and quality control.
Which of the following embedded devices can read plant field device output
and input and can control or regulate devices like motors and generators?
a. PLC
b. PStat
c. Bios
d. None of these answers are correct.
A. A SCADA programmable logic controller (PLC) is an industrial computer
control system that continuously monitors the state of input devices and makes
decisions based on a custom program to control the state of output devices.
Which IoT device is considered a wearable device and is helpful for your well-being? a. Smart tennis shoes b. Smart watch c. Smart jackets d. Smart headband
B. Smart watches can monitor your pulse, heart, blood pressure, exercises,
calories, and sleep patterns to help you become more fit.
Which of the following IoT devices are part of facility automation?
a. Lighting and air conditioning
b. Raspberry Pi
c. Garage door sensors
d. Computer Energy Star
A. Lighting and air conditioning controls are part of building automation and
can be controlled to help reduce the overexpense of energy use by properly
implementing sensors to know when people are in the building.
Security associated with specialized systems generally requires the user to set
up logging and auditing of passwords. What else should the user do to ensure
the system is secure?
a. Lock passwords in a password vault that only staff has access to.
b. Ensure the network operations center is aware of hard drive failures in
critical systems.
c. Always log passwords in the security operations center log book.
d. Always create and rotate very complex passwords.
D. Users should utilize the strongest encryption method available on devices,
always create and rotate very complex passwords, set up a continuous method
to log and audit access to the devices, and finally, ensure use of the latest manufacturer updates.
Today’s surveillance systems are cable of using technology to perform all of the
tasks listed here except for which of the following?
a. Monitoring the data center access
b. Pivoting from one system to another
c. Performing facial recognition
d. Authenticating application usage
D. Today’s modern surveillance systems are capable of performing facial recognition, monitoring data center access, and if exploited, pivoting to and compromising other systems in the network.
Which communication method is part of the IEEE’s 802.15.4 standard and has a transmission rate of 250 kbps? a. 5G b. Narrow band c. Baseband radio d. Zigbee
D. Zigbee creates flexibility for developers and end users while delivering stellar interoperability. It was created on the IEEE’s 802.15.4 standard, using the
2.4-GHz band and a self-healing true mesh network, and has a defined rate of
250 kbps. It is best suited for intermittent data transmissions from a sensor or
input device.
A major constraint on embedded systems deals with the size of the unit and
capability. What is one of the concerns related to security?
a. The amount of energy required to load the boot loader at startup
b. The ability to reboot the system remotely with a password
c. The amount of code required to implement a secure algorithm
d. The amount of power and amperage available to power on the unit at
startup
C. Cryptography constraints for building secure embedded systems hardware
and software have to do with the amount of code required to implement a
secure algorithm and the processing power required to crunch the number.
Which of the following is considered a system on a chip?
a. The desktop computer used to perform number calculations that can be
used to create documents
b. The ability to reboot the system remotely with a password
c. A cell phone and cell phone–type device with personal data access
d. A tablet with WiFi and/or cell LTE connectivity capabilities
C and D. A system on a chip (SoC) is essentially an integrated circuit or an IC
that takes a single platform and integrates an entire electronic or computer
system onto it.
