CyberBook2

Question 1

Following log is an example of
https://www.comptia.org/contact-us/%3file..%324322fpasswd

what attack is this?

Answer 1

Directory transversal

Question 2

What is a known security risk associated with data archives that contain financial information?

Answer 2

Data becomes a liability if archived longer than required by regulatory guidance.

Question 3

Policy that provides greater depth and breadth of knowledge across an orgnaization?

Answer 3

Job rotation policy.

Question 4

Tokenization of credit card information of a public cloud proider.

Answer 4

Cloud Access Security Broker (CASB)

Question 5

Two subnets that should be able to communicate with each other directly. What should be deployed so server admins can access these devices?

Answer 5

Jump Servers

Question 6

Security analysis required deploy workstations in a room where data cannot be stored. File share is in local data center. What should be implemented?

Answer 6

VDI and thin clients.

Question 7

What prevents employees from visiting inappropriate websites?

Answer 7

AUP

Question 8

What tool can be used to scan a network to perform vulnerability checks and compliance auditing.

Answer 8

Nessus

Question 9

Which of the following protocols is commonly used to collect information about CPU utilization and memory usage from network devices?

Answer 9

Simple Network Management Protocol (SNMP)

Question 10

A type of report that shows controls are in place to protect customer data. Usally from third-party vendors and CISO may request this report.

Answer 10

Soc 2 Type Report

Question 11

A type of scan that provides calculated value for known vulnerabilities.

Answer 11

CVSS; Common Vulnerability Scoring System

Question 12

What provides a current state or image of VM’s state.

Answer 12

Snapshot

Question 13

Command to see which ports on a network are in a listening state.

Answer 13

Netstat

Question 14

Tool used to facilitate incident response threat hunting and security configuration both standalone and integrated with SIEM.

Answer 14

SOAR; Security Orchestration Automation Response.

Question 15

What is something that redirects you when clicking on a link that you didnt intend to go to, for instance (bank payments)

Answer 15

XSRF-CSRF

Question 16

A company wants to do buissness with global markeys, what international standard should the data protection officer be concerned about.

Answer 16

ISO 2701

Question 17

a Chief Information Security Officer wants to ensure zone transfers and integrity is validated, what should be implemented

Answer 17

DNSSEC

Question 18

What do you refer to if OS-leve configurations are not in compliance due too outdated hardening?

Answer 18

CIS benchmark; Center for Internet Security controls.

Question 19

Cloup computing concept is BEST described as focusing on the replacement of physical hardware at a customer’s location with cloud-based resources?

Answer 19

IaaS; Infrastructure as a service.

Question 20

Cloud computing concept BEST described as focusing on the replacement of hardware and software required when creating and testing new applications?

Answer 20

PaaS; Platform as a Service, rent fully configured systems for specific tasks.

Question 21

Data rentention policy is mainly used for what?

Answer 21

Min, Max and Description of information. There is no need for classification or security techniques in such a policy.

Question 22

Data retention policy is mainly used for what?

Answer 22

Min, Max and Description of information. There is no need for classification or security techniques in such a policy.

Question 23

What type of cloup service BEST describes using it for their programming environment?

Answer 23

PaaS; Platform as a service

Question 24

What type of cryptographic algorithms is PGP?

Answer 24

Asymmetric.

Question 25

What type of cryptographic algorithms is DES/3DES

Answer 25

Symmetric.

Question 26

What is the difference between Bluejacking/Bluesnarfing.

Answer 26

Bluejacking is harmless and only transmits data; Bluesnarfing attempts to steal data.

Question 27

If there is an sql injection, and the systems cannot be taken offline, what compensating tool can be used?

Answer 27

WAF; Web application firewall.

Question 28

What type of authentication method involdes token based authentication THAT expires?

Answer 28

TOTP; Time-based One-time Password Algorithm. HOTP; reissues upon receiving a new one.

Question 29

What type of command is used in linux to change the permission of a file.

Answer 29

chmod;

Question 30

What allows a company to use one digital certificate for all subdomains?

Answer 30

Wildcard