CompTIA Security+ Get Certified Get Ahead - CH1 Review Flashcards
Management within your organization has defined a use case to support confidentiality of data stored in a database. Which of the following solutions will BEST meet this need?
Hashing
Disk Redundancies
Encryption
Patching
Encryption
Explanation:
Encryption is the best choice to provide confidentiality of any type of information, including data stored in a database.
Hashing supports a use case of supporting integrity.
Disk redundancies provide resilience and increase availability.
Patching systems increases availability and reliability.
Gibson, Darril. CompTIA Security+ Get Certified Get Ahead: SY0-601 Study Guide (p. 217). YCDA, LLC. Kindle Edition.
You want to verify that the syslog file is being rotated successfully on a Linux System. Which of the following commands is the BEST choice to use?
logger
cat
tail
head
head
Explanation:
The head command shows the first 10 lines (by default) of a log file, and if the log is being rotated properly, one of the first log entries indicates the logrotate.service has succeeded. Rotating the log copies the current log, erases the log, and starts logging new entries at the beginning of every day.
The logger command is used to add entries into the syslog file. It doesn’t read the file.
The cat command (short for concatenate) displays the entire contents of a file but scrolls past the first entries very quickly making them difficult to catch.
The tail command shows the last 10 lines (by default) of a log file, and is unlikely to include the first entries showing that the logrotate.service succeeded.
Gibson, Darril. CompTIA Security+ Get Certified Get Ahead: SY0-601 Study Guide (p. 220). YCDA, LLC. Kindle Edition.
You suspect that traffic in your Network is being rerouted to an unauthorized Router within your Network. Which of the following command-line tools would help you narrow down the problem?
ping
tracert
ipconfig
netstat
tracert
Explanation:
You can use tracert to track packet flow through a network, and if an extra router has been added to your network, tracert will identify it.
You can use ping to check connectivity with a remote system, but it doesn’t show the route.
The ipconfig command shows the network settings on a Windows computer, but it doesn’t identify failed routers.
Netstat shows active connections and other network statistics on a local system, but it doesn’t identify network paths.
Gibson, Darril. CompTIA Security+ Get Certified Get Ahead: SY0-601 Study Guide (p. 219). YCDA, LLC. Kindle Edition.
Which of the following is a Cryptographic Algorithm that will create a fixed-length output from a data file but cannot be used to re-create the original data file?
MD5
AES
IDS
SIEM
MD5 (Message Digest 5)
Explanation:
Message Digest 5 (MD5) is a hashing algorithm that creates a fixed-length, irreversible output. Hashing algorithms cannot re-create the original data file from just the hash.
Advanced Encryption Standard (AES) is an encryption algorithm, and you can re-create the original data file by decrypting it.
An intrusion detection system (IDS) is not a cryptographic algorithm but is a detective control.
A security information and event management (SIEM) system provides centralized logging.
Gibson, Darril. CompTIA Security+ Get Certified Get Ahead: SY0-601 Study Guide (p. 217). YCDA, LLC. Kindle Edition.
Which of the following describes the proper format of log entries for Linux Systems?
NXlog
logger
SIEM
syslog
syslog
Explanation:
The syslog protocol (defined in RFC 5424) identifies the format of Linux log entries and describes how to transport these log entries. Note that syslog is also the name of a log on Linux systems.
NXLog is a log management tool that can accept log entries from multiple sources, including Linux and Windows.
The logger command is used to add entries into the syslog file but it doesn’t describe the format.
A security information and event management (SIEM) system collects, aggregates, and correlates logs from multiple sources.
Gibson, Darril. CompTIA Security+ Get Certified Get Ahead: SY0-601 Study Guide (p. 221). YCDA, LLC. Kindle Edition.
A Server in your Network’s DMZ was recently attacked. The Firewall logs show that the Server was attacked from an external IP Address with the following socket: 72.52.230.233:6789. You want to see if the connection is still active. Which of the following tools would be BEST to use?
tracert
arp
netstat
dig
netstat
Explanation:
The netstat command can be used to display a list of open connections, including both the IP address and the port (or a socket). None of the other commands display active connections.
The tracert command lists the routers between two systems.
The arp command shows the contents of the Address Resolution Protocol (ARP) cache.
The dig command can be used on Linux systems to query Domain Name System (DNS) servers.
Gibson, Darril. CompTIA Security+ Get Certified Get Ahead: SY0-601 Study Guide (p. 218). YCDA, LLC. Kindle Edition.
You are writing a script that will perform backups on a Linux System and you plan to schedule the script to run after midnight daily. You want to ensure that the script records when the backup starts and when the backup ends. Which of the following is the BEST choice to meet this requirement?
head
tail
grep
logger
logger
Explanation:
The logger command is used to add entries into the syslog file and can be called from scripts, applications, or the terminal.
The head command can be used to view the first lines in the syslog file and can view the logger entry, but it doesn’t add any entries into the syslog file.
The tail command shows the last 10 lines (by default) of a log file, but it doesn’t write into a log file.
The grep command (short for globally search aregularexpressionandprint) is used to search files but it doesn’t write into files.
Gibson, Darril. CompTIA Security+ Get Certified Get Ahead: SY0-601 Study Guide (p. 220). YCDA, LLC. Kindle Edition.
Lisa is manually searching through a large log file on a Linux System looking for Brute Force Attack indicators. WHich of the following command will simplify this process for her?
grep
head
tail
cat
grep
Explanation:
The grep command (short for globally search aregularexpressionandprint) is used to search for a specific string or pattern of text within a file and simplifies the search. None of the other answers listed search the entire file.
The head command shows only a specific number of lines at the beginning of a file, and the tail command shows only a specific number of lines at the end of a file.
The cat command (short for concatenate) is used to display the entire contents of a file but doesn’t narrow the search for specific text strings found in a brute force attack.
Gibson, Darril. CompTIA Security+ Get Certified Get Ahead: SY0-601 Study Guide (pp. 219-220). YCDA, LLC. Kindle Edition.
Your troubleshooting a connectivity issue with a Server that has an IP Address of 192.168.1.10 from your Linux System. The Server does not respond to the ping command, but you suspect that a Router is blocking the ping traffic. Which of the following choices would you use to verify the Server is responding to traffic?
hping
ipconfig
netstat
arp
hping
Explanation:
The hping command can be used in place of the ping command when network devices are blocking ping commands using Internet Control Message Protocol (ICMP) traffic. It can send packets using TCP and other protocols instead of ICMP.
The ipconfig command is used to view TCP/IP configuration information.
Netstat shows active connections and network statistics.
The arp command shows the contents of the arp cache and does not use echo commands.
Gibson, Darril. CompTIA Security+ Get Certified Get Ahead: SY0-601 Study Guide (p. 219). YCDA, LLC. Kindle Edition.
Maggie works in the Security section of the IT department. Her primary responsibilities are to monitor Security logs, analyze trends reported by the SIEM, and validate alerts. Which of the following choices BEST identifies the primary Security Control she’s implementing?
Compensating
Preventative Control
Detective Control
Corrective Control
Detective Control
Explanation:
Monitoring security logs, analyzing trend reports from a security information and event management (SIEM), and validating alerts from a SIEM are detective controls. Detective controls try to detect security incidents after they happened.
A compensating control is an alternative control used when a primary security control is not feasible or is not yet deployed.
Preventative controls attempt to prevent incidents, but the scenario doesn’t specifically describe any preventative controls.
A corrective control attempts to reverse the impact of a security incident after it has happened.
Gibson, Darril. CompTIA Security+ Get Certified Get Ahead: SY0-601 Study Guide (p. 218). YCDA, LLC. Kindle Edition.
Maggie needs access to the project.doc file available on a Linux Server. Lisa, a System Admin responsible for this Server, sees the following permissions for the file:
rwx rw- —
What should Lisa use to grant Maggie read access to the file?
chmod
jounralctl
cat
LAMP
chmod
Explanation:
Details about the chmod command:
□ READ = 4
□ WRITE = 2
□ EXECUTE = 1
□ Read + Write = 6
□ Read + Execute = 5
□ Read + Write + Execute = 7
□ Owner / Group / All Users
chmod 760 filename
An administrator recently installed an IDS to help reduce the impact of Security incidents. Which of the following BEST identifes the control type of an IDS?
Preventative
Physical
Deterrent
Detective
Detective
Explanation:
IDS = Intrusion DETECTION System
IDS = Detects, that’s all.
An intrusion detection system (IDS) is a detective control. It can detect malicious traffic after it enters a network.
A preventative control, such as an intrusion prevention system (IPS), prevents malicious traffic from entering the network.
An IDS uses technology and is not a physical control.
Deterrent controls attempt to discourage a threat, but attackers wouldn’t know if a system had an IDS, so the IDS can’t deter attacks.
Gibson, Darril. CompTIA Security+ Get Certified Get Ahead: SY0-601 Study Guide (p. 218). YCDA, LLC. Kindle Edition.
Your organization hosts an e-commerce Web Server selling digital products. The server randomly experiences a high volume of sales and usage, which causes spikes in resource usage. These spikes occasionally take the Server down. Which of the following should be implemented to prevent these outages?
Elasticity
Scalability
Normalization
Stored Procedures
Elasticity
Explanation:
Elasticity is the best choice because it allows the server to dynamically scale up or out as needed in response to high resource usage.
Scalability isn’t the best answer because it is done manually, however, the high resource usage is random and manually adding resources can’t respond to the random spikes quick enough.
Normalization refers to organizing tables and columns in a database to reduce redundant data and improve overall database performance.
Stored procedures are a group of SQL statements that execute as a whole and help prevent SQL injection attacks.
Gibson, Darril. CompTIA Security+ Get Certified Get Ahead: SY0-601 Study Guide (pp. 217-218). YCDA, LLC. Kindle Edition.
As the CTO, Marge is implementing a Security program. She has included Security controls to address Confidentiality and Availability. Of the following choices, what else should she include?
Ensure critical systems provide uninterrupted service.
Protect data-in-transit from unauthrozied disclosure.
Ensure systems are not susceptible to unauthorized changes.
Secure data to prevent unauthorized disclosure.
Ensure systems are not susceptible to unauthorized changes.
You are considering rebooting a Database Server and want to identify if it has any active Network connections. Which of the following commands will list active Network connections?
arp
ipconfig
ping
netstat
netstat
