Domain 6: Review Questions

Question 1

For which of the following penetration tests does the testing team have limited knowledge of the network systems and devices with only access to publicly available information?

A. Target test
B. Physical test
C. Blind test
D. Double-blind test

Answer 1

C.

With a blind test, the testing team knows an attack is coming and has limited knowledge of the network systems and devices and publicly available information. A target test occurs when the testing team and the organization’s security team are given maximum information about the network and the type of attack that will occur. A physical test is not a type of penetration test. It is a type of vulnerability assessment. A double-blind test is like a blind test except that the organization’s security team does not know an attack is coming.

Question 2

Which of the following is not a guideline according to NIST SP 800-92?

A. Organizations should establish policies and procedures for log management.
B. Organizations should create and maintain a log management infrastructure.
C. Organizations should prioritize log management appropriately throughout the organization.
D. Choose auditors with security experience.

Answer 2

D.

NIST SP 800-92 does not include any information regarding auditors. So, the “Choose auditors with security experience” option is not a guideline according to NIST SP 800-92.

Question 3

According to NIST SP 800-92, which of the following are facets of log management infrastructure? (Choose all that apply.)

A. General functions (log parsing, event filtering, and event aggregation)
B. Storage (log rotation, log archival, log reduction, log conversion, log normalization, log file integrity checking)
C. Log analysis (event correlation, log viewing, log reporting)
D. Log disposal (log clearing)

Answer 3

A, B, C, D.

According to NIST SP 800-92, log management functions should include general functions (log parsing, event filtering, and event aggregation), storage (log rotation, log archival, log reduction, log conversion, log normalization, log file integrity checking), log analysis (event correlation, log viewing, log reporting), and log disposal (log clearing).

Question 4

What are the two ways of collecting logs using security information and event management (SIEM) products, according to NIST SP 800-92?

A. Passive and active
B. Agentless and agent-based
C. Push and pull
D. Throughput and rate

Answer 4

B.

The two ways of collecting logs using security information and event management (SIEM) products, according to NIST SP 800-92, are agentless and agent-based.

Question 5

Which monitoring method MOST likely captures and analyzes every transaction of every application or website user when configured correctly?

A. RUM
B. Synthetic transaction monitoring
C. Code review and testing
D. Misuse case testing

Answer 5

A.

Real user monitoring (RUM) captures and analyzes every transaction of every application or website user.

Question 6

Which type of testing is also known as negative testing?

A. RUM (real user monitoring)
B. Synthetic transaction monitoring
C. Code review and testing
D. Misuse case testing

Answer 6

D. Misuse case testing is also known as negative testing.

Question 7

What is the first step of the information security continuous monitoring (ISCM) plan, according to NIST SP 800-137?

A. Establish an ISCM program.
B. Define the ISCM strategy.
C. Implement an ISCM program.
D. Analyze the data collected.

Answer 7

B. Define an ISCM strategy

The steps in an ISCM program, according to NIST SP 800-137, are

1. Define an ISCM strategy.
2. Establish an ISCM program.
3. Implement an ISCM program and collect the security-related information required for metrics, assessments, and reporting.
4. Analyze the data collected, report findings, and determine the appropriate responses.
5. Respond to findings.
6. Review and update the monitoring program.

Question 8

What is the second step of the information security continuous monitoring (ISCM) plan, according to NIST SP 800-137?

A. Establish an ISCM program.
B. Define the ISCM strategy.
C. Implement an ISCM program.
D. Analyze the data collected.

Answer 8

A. Establish an ISCM program

The steps in an ISCM program, according to NIST SP 800-137, are

1. Define an ISCM strategy.
2. Establish an ISCM program.
3. Implement an ISCM program and collect the security-related information required for metrics, assessments, and reporting.
4. Analyze the data collected, report findings, and determine the appropriate responses.
5. Respond to findings.
6. Review and update the monitoring program.

Question 9

Which of the following is not a guideline for internal, external, and third-party audits?

A. Choose auditors with security experience.
B. Involve business unit managers early in the process.
C. At a minimum, perform biannual audits to establish a security baseline.
D. Ensure that the audit covers all systems and all policies and procedures.

Answer 9

C. At a minimum, perform biannual audits to establish a security baseline.

The following are guidelines for internal, external, and third-party audits:
* At minimum, perform annual audits to establish a security baseline.
* Determine your organization’s objectives for the audit and share them with the auditors.
* Set the ground rules for the audit, including the dates/times of the audit, before the audit starts.
* Choose auditors who have security experience.
* Involve business unit managers early in the process.
* Ensure that auditors rely on experience, not just checklists.
* Ensure that the auditor’s report reflects risks that the organization has identified.
* Ensure that the audit is conducted properly.
* Ensure that the audit covers all systems and all policies and procedures.
* Examine the report when the audit is complete.

Question 10

Which SOC (Service Organization Control) report can be shared with the general public WITHOUT causing any harm to the organization?

A. SOC 1, Type 1
B. SOC 1, Type 2
C. SOC 2
D. SOC 3

Answer 10

D. SOC 3 is the only SOC report that should be shared with the general public.

Question 11

Which of the following is the last step in performing a penetration test?

A. Document the results of the penetration test and report the findings to management, with suggestions for remedial action.
B. Gather information about attack methods against the target system or device.
C. Document information about the target system or device.
D. Execute attacks against the target system or device to gain user and privileged access.

Answer 11

A.

The steps in performing a penetration test are as follows:
1. Document information about the target system or device.
2. Gather information about attack methods against the target system or device. This step includes performing port scans.
3. Identify the known vulnerabilities of the target system or device.
4. Execute attacks against the target system or device to gain user and privileged access.
5. Document the results of the penetration test and report the findings to management, with suggestions for remedial action.

Question 12

In which of the following does the testing team have zero knowledge of the organization’s network?

A. Gray-box testing
B. Black-box testing
C. White-box testing
D. Physical testing

Answer 12

B.

In black-box testing, or zero-knowledge testing, the testing team is provided with no knowledge regarding the organization’s network.

In white-box testing, the testing team goes into the testing process with a deep understanding of the application or system. In gray-box testing, the testing team is provided more information than in black-box testing, while not as much as in white-box testing. Gray-box testing has the advantage of being nonintrusive while maintaining the boundary between developer and tester. Physical testing reviews facility and perimeter protections.

Question 13

Which of the following is defined as a dynamic testing tool that tests the software’s limits and may discover flaws?

A. Interface testing
B. Static testing
C. Test coverage analysis
D. Fuzz testing

Answer 13

D.

Fuzz testing is a dynamic testing tool that provides input to the software to test the software’s limits and discover flaws. The input provided can be randomly generated by the tool or specially created to test for known vulnerabilities.

Interface testing evaluates whether an application’s systems or components correctly pass data and control to one another. It verifies whether module interactions are working properly and errors are handled correctly. Static testing analyzes software security without actually running the software. This is usually provided by reviewing the source code or compiled application. Test coverage analysis uses test cases that are written against the application requirements specifications.

Question 14

Which factors should security professionals follow when performing security testing? (Choose all that apply.)

A. Changes that could affect the performance
B. System risk
C. Information sensitivity level
D. Likelihood of technical failure or misconfiguration

Answer 14

a, b, c, d.

Security professionals should consider the following factors when performing security testing:
* Impact
* Difficulty
* Time needed
* Changes that could affect the performance
* System risk
* System criticality
* Security test availability
* Information sensitivity level
* Likelihood of technical failure or misconfiguration

Question 15

Which of the following can a hacker use to identify common vulnerabilities in an operating system running on a host or server?

A. Operating system fingerprinting
B. Network discovery scan
C. Key performance and risk indicators
D. Third-party audits

Answer 15

A.

Operating system fingerprinting is the process of using some method to determine the operating system running on a host or a server. By identifying the OS version and build number, hackers can identify common vulnerabilities of that OS using readily available documentation from the Internet. A network discovery scan examines a range of IP addresses to determine which ports are open. This type of scan only shows a list of systems on the network and the ports in use on the network. It does not actually check for any vulnerabilities. By using key performance and risk indicators of security process data, organizations better identify when security risks are likely to occur. Key performance indicators allow organizations to determine whether levels of performance are below or above established norms. Key risk indicators allow organizations to identify whether certain risks are more or less likely to occur. Organizations should conduct internal, external, and third-party audits as part of any security assessment and testing strategy.

Question 16

During a port scan, Susan discovers a system running services on TCP and UDP 137–139 and TCP 445, as well as TCP 1433. What type of system is she likely to find if she connects to the machine?

A. A Linux email server
B. A Windows SQL server
C. A Linux file server
D. A Windows workstation

Answer 16

B.

TCP and UDP ports 137–139 are used for NetBIOS services, whereas 445 is used for Active Directory. TCP 1433 is the default port for Microsoft SQL, indicating that this is probably a Windows server providing SQL services.

Question 17

Which of the following is a method used to automatically design new software tests and to ensure the quality of tests?

A. Code auditing
B. Static code analysis
C. Regression testing
D. Mutation testing

Answer 17

D.

Mutation testing modifies a program in small ways and then tests that mutant to determine if it behaves as it should or if it fails. This technique is used to design and test software tests through mutation. Static code analysis and regression testing are both means of testing code, whereas code auditing is an analysis of source code rather than a means of designing and testing software tests.

Question 18

During a port scan, Naomi found TCP port 443 open on a system. Which tool is best suited to scanning the service that is most likely running on that port?

A. zzuf
B. Nikto
C. Metasploit
D. Sqlmap

Answer 18

B.

TCP port 443 normally indicates an HTTPS server. Nikto is useful for vulnerability scanning web servers and applications and is the best choice listed for a web server. Metasploit includes some scanning functionality but is not a purpose-built tool for vulnerability scanning. zzuf is a fuzzing tool and isn’t relevant for vulnerability scans, whereas sqlmap is a SQL injection testing tool.

Question 19

What message logging standard is commonly used by network devices, Linux and Unix systems, and many other enterprise devices?

A. Syslog
B. Netlog
C. Eventlog
D. Remote Log Protocol (RLP)

Answer 19

A. Syslog is a widely used protocol for event and message logging. Eventlog, netlog, and Remote Log Protocol are all made-up terms.

Question 20

Alex wants to use an automated tool to fill web application forms to test for format string vulnerabilities. What type of tool should he use?

A. A black box
B. A brute-force tool
C. A fuzzer
D. A static analysis tool

Answer 20

C.

Fuzzers are tools designed to provide invalid or unexpected input to applications, testing for vulnerabilities like format string vulnerabilities, buffer overflow issues, and other problems. A static analysis relies on examining code without running the application or code and thus would not fill forms as part of a web application. Brute-force tools attempt to bypass security by trying every possible combination for passwords or other values. A black box is a type of penetration test where the testers do not know anything about the environment.

Question 21

Susan needs to scan a system for vulnerabilities, and she wants to use an open-source tool to test the system remotely. Which of the following tools will meet her requirements and allow vulnerability scanning?

A. Nmap
B. OpenVAS
C. MBSA
D. Nessus

Answer 21

B.

OpenVAS is an open-source vulnerability scanning tool that will provide Susan with a report of the vulnerabilities that it can identify from a remote, network-based scan. Nmap is an open-source port scanner. Both the Microsoft Baseline Security Analyzer (MBSA) and Nessus are closed-source tools, although Nessus was originally open source.

Question 22

Morgan is implementing a vulnerability management system that uses standards-based components to score and evaluate the vulnerabilities it finds. Which of the following is most commonly used to provide a severity score for vulnerabilities?

A. CCE
B. CVSS
C. CPE
D. OVAL

Answer 22

B.

CVSS, the Common Vulnerability Scoring System, is used to describe the severity of security vulnerabilities. CCE is Common Configuration Enumeration, a naming system for configuration issues. CPE is Common Platform Enumeration, which names operating systems, applications, and devices. OVAL is a language for describing security testing procedures.

Question 23

Jim has been contracted to perform a penetration test of a bank’s primary branch. To make the test as real as possible, he has not been given any information about the bank other than its name and address. What type of penetration test has Jim agreed to perform?

A. A crystal-box penetration test
B. A gray-box penetration test
C. A black-box penetration test
D. A white-box penetration test

Answer 23

C.

Jim has agreed to a black-box penetration test, which provides no information about the organization, its systems, or its defenses. A crystal- or white-box penetration test provides all of the information an attacker needs, whereas a gray-box penetration test provides some, but not all, information.

Question 24

In a response to a request for proposal, Susan receives an SSAE 18 SOC report. If she wants a report that includes details on operating effectiveness, what should Susan ask for as follow-up, and why?

A. A SOC 2 Type II report, because Type I does not cover operating effectiveness
B. A SOC 1 Type I report, because SOC 2 does not cover operating effectiveness
C. A SOC 2 Type I report, because SOC 2 Type II does not cover operating effectiveness
D. A SOC 3 report, because SOC 1 and SOC 2 reports are outdated

Answer 24

A.

The key to answering this question correctly is understanding the difference between SOC 1 and SOC 2 reports, and Type I and Type II audits.

SOC 1 reports cover financial reporting, and

SOC 2 reports look at security.
Type I audits cover only a single point in time and are based on management descriptions of controls. They do not include an assessment of operating effectiveness.
Type II audits cover a period of time and include an assessment of operating effectiveness.

Question 25

During a wireless network penetration test, Susan runs aircrack-ng against the network intending to capture a password as part of the four-way handshake and then crack the password offline. What might cause her to fail in her password-cracking efforts if the target is using WPA3 in Personal network mode? A. WPA3 uses complex passwords. B. WPA3 uses SAE and does not transfer the password over the air. C. WPA3 requires multifactor, making a password alone insufficient. D. The password crack will work due to flaws in WPA3.

Answer 25

B. WPA3 uses SAE, or simultaneous authentication of equals, and does not send the password over the air. Traditional cracking methods used against previous versions of WPA and WPA2 no longer work. This is not because of complex passwords or MFA, but because of how the handshake's elements are created to avoid sending the password.

Question 26

A zero-day vulnerability is announced for the popular Apache web server in the middle of a workday. In Jacob's role as an information security analyst, he needs to quickly scan his network to determine what servers are vulnerable to the issue. What is Jacob's best route to quickly identify vulnerable systems? A. Immediately run Nessus against all of the servers to identify which systems are vulnerable. B. Review the CVE database to find the vulnerability information and patch information. C. Create a custom IDS or IPS signature. D. Identify affected versions and check systems for that version number using an automated scanner.

Answer 26

D. In many cases when an exploit is initially reported, there are no prebuilt signatures or detections for vulnerability scanners, and the CVE database may not immediately have information about the attack. Jacob's best option is to quickly gather information and review potentially vulnerable servers based on their current configuration. As more information becomes available, signatures and CVE information are likely to be published. Unfortunately for Jacob, IDS and IPS signatures will detect only attacks and won't detect whether systems are vulnerable unless he sees the systems being exploited.

Question 27

What type of testing is used to ensure that separately developed software modules properly exchange data? A. Fuzzing B. Dynamic testing C. Interface testing D. API checksums

Answer 27

C. Interface testing is used to ensure that software modules properly meet interface specifications and thus will properly exchange data. Dynamic testing tests software in a running environment, whereas fuzzing is a type of dynamic testing that feeds invalid input to running software to test error and input handling. API checksums are not a testing technique.

Question 28

Selah wants to provide security assessment information to customers who want to use her organization's cloud services. Which of the following options should she select to ensure that the greatest number of customers are satisfied with the assessment information? A. Use an internal audit team to self-assess against internal metrics. B. Use a third-party auditor. C. Use internal technical staff who know the systems. D. Use an internal audit team to self-assess against a common standard like COBIT.

Answer 28

B. Using a third-party auditor from a well-known and well-regarded firm is often the best option when providing audit and compliance information to third parties. Selah could engage an appropriate vendor for a SOC 2 Type II engagement as one example of a reasonable option to provide detail to her customers. Internal staff assessing against a common standard like COBIT would be the next most acceptable option on this list, with an internal standard less useful than that. Finally, relying on internal personnel not specialized in audits proves to be the least effective strategy in this context.

Question 29

Yasmine has been asked to consider a breach and attack simulation system. What type of system should she look for? A. A ticket and change management system designed to help manage incidents B. A system that runs incident response simulations for blue teams to test their skills C. A system that combines red and blue team techniques with automation D. A security operations and response (SOAR) system

Answer 29

C. Breach and attack simulation (BAS) systems combine red team (attack) and blue team (defense) techniques together with automation to simulate advanced persistent threats and other advanced threat actors when run against your environment. This allows a variety of threats to be replicated and assessed in an environment without as much overhead as a fully staffed purple team would.

Question 30

Monica wants to gather information about security awareness in her organization. What technique is most frequently used to assess the broad range elements that make up security awareness? A. Phishing simulations B. Gamified applications C. Assessment tests D. Surveys

Answer 30

D. Most organizations use surveys to assess security awareness. Phishing simulators are also frequently used, but only test awareness of phishing issues and techniques, not general security awareness. Gamified applications are continuing to grow in popularity, but the ease of use and availability of surveys make them the most popular. Finally, assessment tests may be used when compliance knowledge assessments are required to meet a specific standard, but testing is not as common as surveying.

Question 31

16. Jim has been contracted to conduct a gray-box penetration test, and his clients have provided him with the following information about their networks so that he can scan them: Data center: 10.10.10.0/24 Sales: 10.10.11.0/24 Billing: 10.10.12.0/24 Wireless: 192.168.0.0/16 What problem will Jim encounter if he is contracted to conduct a scan from off-site? A. The IP ranges are too large to scan efficiently. B. The IP addresses provided cannot be scanned. C. The IP ranges overlap and will cause scanning issues. D. The IP addresses provided are RFC 1918 addresses.

Answer 31

D. The IP addresses that his clients have provided are RFC 1918 nonroutable IP addresses, and Jim will not be able to scan them from off-site. To succeed in his penetration test, he will have to either first penetrate their network border or place a machine inside their network to scan from the inside. IP addresses overlapping is not a real concern for scanning, and the ranges can easily be handled by current scanning systems.

Question 32

Mark's company has been notified of a flaw in their web application. The anonymous individual has notified them that they have two weeks to fix it before the details of the flaw are published along with example exploit code. What industry norm is the individual who contacted Mark's company violating? A. Zero-day reporting B. Ethical disclosure C. Ethical hacking D. The ISC2 vulnerability disclosure ethics statement

Answer 32

B. Ethical (or responsible) disclosure practices will provide companies and organizations with a reasonable period of time to fix a flaw and to get that fix into the hands of their customers. Two weeks is unlikely to be a reasonable amount of time for this. Unfortunately, Mark may not be able to persuade the individual to make a different decision, and Mark's company will need to determine what to do about the issue.

Question 33

The company that Jennifer works for has implemented a central logging infrastructure, as shown here. Use this diagram and your knowledge of logging systems to answer the following questions. Jennifer needs to ensure that all Windows systems provide identical logging information to the SIEM. How can she best ensure that all Windows desktops have the same log settings? A. Perform periodic configuration audits. B. Use Group Policy. C. Use Local Policy. D. Deploy a Windows syslog client.

Answer 33

B. Group Policy enforced by Active Directory can ensure consistent logging settings and can provide regular enforcement of policy on systems. Periodic configuration audits won't catch changes made between audits, and local policies can drift due to local changes or differences in deployments. A Windows syslog client will enable the Windows systems to send syslog to the SIEM appliance but won't ensure consistent logging of events.

Question 34

The company that Jennifer works for has implemented a central logging infrastructure, as shown here. Use this diagram and your knowledge of logging systems to answer the following questions. During normal operations, Jennifer's team uses the SIEM appliance to monitor for exceptions received via syslog. What system shown does not natively have support for syslog events? A. Enterprise wireless access points B. Windows desktop systems C. Linux web servers D. Enterprise firewall devices

Answer 34

B. Windows systems generate logs in the Windows native logging format. To send syslog events, Windows systems require a helper application or tool. Enterprise wireless access points, firewalls, and Linux systems all typically support syslog.

Question 35

The company that Jennifer works for has implemented a central logging infrastructure, as shown here. Use this diagram and your knowledge of logging systems to answer the following questions. 20. What technology should an organization use for each of the devices shown in the diagram to ensure that logs can be time sequenced across the entire infrastructure? A. Syslog B. NTP C. Logsync D. SNAP

Answer 35

B. Network Time Protocol (NTP) can ensure that systems are using the same time, allowing time sequencing for logs throughout a centralized logging infrastructure. Syslog is a way for systems to send logs to a logging server and won't address time sequencing. Neither logsync nor SNAP is an industry term.

Question 36

During a penetration test, Michelle needs to identify systems, but she hasn't gained sufficient access on the system she is using to generate raw packets. What type of scan should she run to verify the most open services? A. A TCP connect scan B. A TCP SYN scan C. A UDP scan D. An ICMP scan

Answer 36

A. When a tester does not have raw packet creation privileges, such as when they have not escalated privileges on a compromised host, a TCP connect scan can be used. TCP SYN scans require elevated privileges on most Linux systems due to the need to write raw packets. A UDP scan will miss most services that are provided via TCP, and an ICMP is merely a ping sweep of systems that respond to pings and won't identify services at all.

Question 37

During a port scan using nmap, Joseph discovers that a system shows two ports open that cause him immediate worry: 21/open 23/open What services are likely running on those ports? A. SSH and FTP B. FTP and Telnet C. SMTP and Telnet D. POP3 and SMTP

Answer 37

B. Joseph may be surprised to discover FTP (TCP port 21) and Telnet (TCP port 23) open on his network since both services are unencrypted and have been largely replaced by SSH, and SCP or SFTP. SSH uses port 22, SMTP uses port 25, and POP3 uses port 110.

Question 38

Aaron wants to validate his compliance with PCI-DSS. His company is a large commercial organization with millions of dollars in transactions a year. What is the most common method of conducting this type of testing for large organizations? A. Self-assessment B. To conduct a thirty-party assessment using COBIT C. To partner with another company and trade assessments between the organizations D. To conduct a third-party assessment using a qualified security assessor

Answer 38

D. Large organizations hire QSAs, or qualified security assessors, to conduct compliance checks. Third-party certification is required for large organizations by PCI-DSS, although smaller organizations can self-certify.

Question 39

What method is commonly used to assess how well software testing covered the potential uses of an application? A. A test coverage analysis B. A source code review C. A fuzz analysis D. A code review report

Answer 39

A. A test coverage analysis is often used to provide insight into how well testing covered the set of use cases that an application is being tested for. Source code reviews look at the code of a program for bugs, not necessarily at a use case analysis, whereas fuzzing tests invalid inputs. A code review report might be generated as part of a source code review.

Question 40

Testing that is focused on functions that a system should not allow is an example of what type of testing? A. Use case testing B. Manual testing C. Misuse case testing D. Dynamic testing

Answer 40

C. Testing how a system could be misused, or misuse testing, focuses on behaviors that are not what the organization desires or that are counter to the proper function of a system or application. Use case testing is used to verify whether a desired functionality works. Dynamic testing is used to determine how code handles variables that change over time, whereas manual testing is just what it implies: testing code by hand.

Question 41

What type of monitoring uses simulated traffic to a website to monitor performance? A. Log analysis B. Synthetic transaction monitoring C. Passive monitoring D. Simulated transaction analysis

Answer 41

B. Synthetic transaction monitoring uses emulated or recorded transactions to monitor for performance changes in response time, functionality, or other performance monitors. Passive monitoring uses a span port or other method to copy traffic and monitor it in real time. Log analysis is typically performed against actual log data but can be performed on simulated traffic to identify issues. Simulated transaction analysis is not an industry term.

Question 42

Derek wants to ensure that his organization tracks all changes to accounts through their life cycle. What type of tool should he invest in for his organization? A. A directory service like LDAP B. An IAM system C. A SIEM D. An EDR system

Answer 42

B. Identity and access management (IAM) systems combine life-cycle management and monitoring tools to ensure that identity and authorization are properly handled throughout an organization. Derek should invest in a capable IAM system and ensure that it is configured to use appropriate workflows and to generate the logs and reports that he needs. EDR systems are endpoint detection and response tools and are used to protect against compromise by advanced attackers.

Question 43

Jim uses a tool that scans a system for available services and then connects to them to collect banner information to determine what version of the service is running. It then provides a report detailing what it gathers, basing results on service fingerprinting, banner information, and similar details it gathers combined with CVE information. What type of tool is Jim using? A. A port scanner B. A service validator C. A vulnerability scanner D. A patch management tool

Answer 43

C. Vulnerability scanners that do not have administrative rights to access a machine or that are not using an agent to scan remote machines to gather information, including fingerprints from responses to queries and connections, banner information from services, and related data. CVE information is Common Vulnerability and Exposure information, or vulnerability information. A port scanner gathers information about what service ports are open, although some port scanners blur the line between port and vulnerability scanners. Patch management tools typically run as an agent on a system to allow them to both monitor patch levels and update the system as needed. Service validation typically involves testing the functionality of a service, not its banner and response patterns.

Question 44

Emily builds a script that sends data to a web application that she is testing. Each time the script runs, it sends a series of transactions with data that fits the expected requirements of the web application to verify that it responds to typical customer behavior. What type of transactions is she using, and what type of test is this? A. Synthetic, passive monitoring B. Synthetic, use case testing C. Actual, dynamic monitoring D. Actual, fuzzing

Answer 44

B. Emily is using synthetic transactions, which can use recorded or generated transactions, and is conducting use-case testing to verify that the application responds properly to actual use cases. Neither actual data nor dynamic monitoring is an industry term. Fuzzing involves sending unexpected inputs to a program to see how it responds. Passive monitoring uses a network tap or other capture technology to allow monitoring of actual traffic to a system or application.

Question 45

What passive monitoring technique records all user interaction with an application or website to ensure quality and performance? A. Client-server testing B. Real user monitoring C. Synthetic user monitoring D. Passive user recording

Answer 45

B. Real user monitoring (RUM) is a passive monitoring technique that records user interaction with an application or system to ensure performance and proper application behavior. RUM is often used as part of a predeployment process using the actual user interface. The other answers are all made up—synthetic monitoring uses simulated behavior, but synthetic user monitoring is not a testing method. Similarly, passive monitoring monitors actual traffic, but passive user recording is not an industry term or technique. Client-server testing merely describes one possible architecture.

Question 46

Earlier this year, the information security team at Jim's employer identified a vulnerability in the web server that Jim is responsible for maintaining. He immediately applied the patch and is sure that it installed properly, but the vulnerability scanner has continued to incorrectly flag the system as vulnerable. To prevent the issue from being flagged incorrectly in the future, what is the next step? A. Uninstall and reinstall the patch. B. Ask the information security team to flag the system as patched and not vulnerable to that particular flaw. C. Update the version information in the web server's configuration. D. Review the vulnerability report and use alternate remediation options.

Answer 46

B. Jim should ask the information security team to flag the issue as resolved if he is sure the patch was installed. Many vulnerability scanners rely on version information or banner information and may flag patched versions if the software provider does not update the information they see. Uninstalling and reinstalling the patch will not change this. Changing the version information may not change all of the details that are being flagged by the scanner and may cause issues at a later date. Reviewing the vulnerability information for a workaround may be a good idea but should not be necessary if the proper patch is installed; it can create maintenance issues later.

Question 47

Angela wants to test a web browser's handling of unexpected data using an automated tool. What tool should she choose? A. Nmap B. zzuf C. Nessus D. Nikto

Answer 47

B. zzuf is the only fuzzer on the list, and zzuf is specifically designed to work with tools like web browsers, image viewers, and similar software by modifying network and file input to applications. Nmap is a port scanner, Nessus is a vulnerability scanner, and Nikto is a web server scanner.

Question 48

Kara wants to conduct a security audit of her cloud IaaS vendor's systems, infrastructure, and practices. What type of audit is she most likely to be able to conduct? A. A third-party audit. B. She cannot conduct an audit. C. An internal audit. D. She may request the vendor's third-party audit results.

Answer 48

D. Most IaaS vendors will not allow customers to conduct an audit of their systems and infrastructure. Kara is likely to be able to obtain third-party audit reports from her vendor, and the major IaaS vendors typically either make these available publicly or to paying or prospective customers. An internal audit will not assess the underlying infrastructure and services, only those that the organization uses.

Question 49

Why should passive scanning be conducted in addition to implementing wireless security technologies like wireless intrusion detection systems? A. It can help identify rogue devices. B. It can test the security of the wireless network via scripted attacks. C. Their short dwell time on each wireless channel can allow them to capture more packets. D. They can help test wireless IDS or IPS systems.

Answer 49

A. Passive scanning can help identify rogue devices by capturing MAC address vendor IDs that do not match deployed devices, by verifying that systems match inventories of organizationally owned hardware by hardware address and by monitoring for rogue SSIDs or connections. Scripted attacks are part of active scanning rather than passive scanning, and active scanning is useful for testing IDS or IPS systems, whereas passive scanning will not be detected by detection systems. Finally, a shorter dwell time can actually miss troublesome traffic, so balancing dwell time versus coverage is necessary for passive wireless scanning efforts.

Question 50

Paul is reviewing the approval process for a penetration test and wants to ensure that it has appropriate management review. Who should he ensure has approved the request for a penetration test for a business system? A. The change advisory board B. Senior management C. The systems administrator for the system D. The service owner

Answer 50

B. In most organizations, senior management needs to approve penetration tests because of the risk to the organization and the potential impact of the test. In a small number of organizations, the service owner may be able to make this decision, but penetration tests often have broader impacts than a single service, meaning that senior management is the proper path. Change advisory boards approve changes, not penetration tests, and system administrators may be advised of the test but do not have the authority in most organizations to sign off on a penetration test.

Question 51

What term describes software testing that is intended to uncover new bugs introduced by patches or configuration changes? A. Nonregression testing B. Evolution testing C. Smoke testing D. Regression testing

Answer 51

D. Regression testing, which is a type of functional or unit testing, tests to ensure that changes have not introduced new issues. Nonregression testing checks to see whether a change has had the effect it was supposed to, smoke testing focuses on simple problems with impact on critical functionality, and evolution testing is not a software testing technique.

Question 52

Which of the following tools cannot identify a target's operating system for a penetration tester? A. Nmap B. Nessus C. Nikto D. Sqlmap

Answer 52

D. Nmap, Nessus, and Nikto all have OS fingerprinting or other operating system identification capabilities. Sqlmap is designed to perform automated detection and testing of SQL injection flaws and does not provide OS detection.

Question 53

Susan needs to predict high-risk areas for her organization and wants to use metrics to assess risk trends as they occur. What should she do to handle this? A. Perform yearly risk assessments. B. Hire a penetration testing company to regularly test organizational security. C. Identify and track key risk indicators. D. Monitor logs and events using a SIEM device.

Answer 53

C. Key risk indicators are used to tell those in charge of risk management how risky an activity is and how much impact changes are having on that risk profile. Identifying and monitoring key risk indicators can help track high-risk areas earlier in their life cycle. Yearly risk assessments may be a good idea but provide only a point-in-time view, whereas penetration tests may miss out on risks that are not directly security-related. Monitoring logs and events using a SIEM device can help detect issues as they occur but won't necessarily show trends in risk.

Question 54

What major difference separates synthetic and passive monitoring? A. Synthetic monitoring works only after problems have occurred. B. Passive monitoring cannot detect functionality issues. C. Passive monitoring works only after problems have occurred. D. Synthetic monitoring cannot detect functionality issues.

Answer 54

C. Passive monitoring works only after issues have occurred because it requires actual traffic. Synthetic monitoring uses simulated or recorded traffic and thus can be used to proactively identify problems. Both synthetic and passive monitoring can be used to detect functionality issues.

Question 55

Chris uses the standard penetration testing methodology shown here. Use this methodology and your knowledge of penetration testing to answer questions about tool usage during a penetration test. What task is the most important during Phase 1, planning? A. Building a test lab B. Getting authorization C. Gathering appropriate tools D. Determining if the test is white, black, or gray box

Answer 55

B. Getting authorization is the most critical element in the planning phase. Permission, and the “get-out-of-jail-free card” that demonstrates that organizational leadership is aware of the issues that a penetration test could cause, is the first step in any penetration test. Gathering tools and building a lab, as well as determining what type of test will be conducted, are all important, but nothing should happen without permission.

Question 56

Chris uses the standard penetration testing methodology shown here. Use this methodology and your knowledge of penetration testing to answer questions about tool usage during a penetration test. Which of the following tools is most likely to be used during discovery? A. Nessus B. John C. Nmap D. Nikto

Answer 56

C. Discovery can include both active and passive discovery. Port scanning is commonly done during discovery to assess what services the target provides, and nmap is one of the most popular tools used for this purpose. Nessus and Nikto might be used during the vulnerability scanning phase, and john, a password cracker, can be used to recover passwords during the exploitation phase. B. Penetration test r

Question 57

Chris uses the standard penetration testing methodology shown here. Use this methodology and your knowledge of penetration testing to answer questions about tool usage during a penetration test. Which of these concerns is the most important to address during planning to ensure that the reporting phase does not cause problems? A. Which CVE format to use B. How the vulnerability data will be stored and sent C. Which targets are off-limits D. How long the report should be

Answer 57

B. Penetration test reports often include information that could result in additional exposure if they were accidentally released or stolen. Therefore, determining how vulnerability data should be stored and sent is critical. Problems with off-limits targets are more likely to result in issues during the vulnerability assessment and exploitation phase, and reports should not be limited in length but should be as long as they need to be to accomplish the goals of the test.

Question 58

What four types of coverage criteria are commonly used when validating the work of a code testing suite? A. Input, statement, branch, and condition coverage B. Function, statement, branch, and condition coverage C. API, branch, bounds, and condition coverage D. Bounds, branch, loop, and condition coverage

Answer 58

B. Code coverage testing most frequently requires that every function has been called, that each statement has been executed, that all branches have been fully explored, and that each condition has been evaluated for all possibilities. API, input, and loop testing are not common types of code coverage testing measures.

Question 59

As part of his role as a security manager, Jacob provides the following chart to his organization's management team. What type of measurement is he providing for them? A. A coverage rate measure B. A key performance indicator C. A time to live metric D. A business criticality indicator

Answer 59

B. Time to remediate a vulnerability is a commonly used key performance indicator for security teams. Time to live measures how long a packet can exist in hops, business criticality is a measure used to determine how important a service or system is to an organization, and coverage rates are used to measure how effective code testing is.

Question 60

What does using unique user IDs for all users provide when reviewing logs? A. Confidentiality B. Integrity C. Availability D. Accountability

Answer 60

D. Unique user IDs provide accountability when paired with auditable logs to provide that a specific user took any given action. Confidentiality, availability, and integrity can be provided through other means like encryption, systems design, and digital signatures.

Question 61

Which of the following is not an interface that is typically tested during the software testing process? A. APIs B. Network interfaces C. UIs D. Physical interfaces

Answer 61

B. Application programming interfaces (APIs), user interfaces (UIs), and physical interfaces are all important to test when performing software testing. Network interfaces are not part of the typical list of interfaces tested in software testing.

Question 62

Alan's organization uses the Security Content Automation Protocol (SCAP) to standardize its vulnerability management program. Which component of SCAP can Alan use to reconcile the identity of vulnerabilities generated by different security assessment tools? A. OVAL B. XCCDF C. CVE D. SCE

Answer 62

C. The Common Vulnerabilities and Exposures (CVE) database provides a consistent reference for identifying security vulnerabilities. The Open Vulnerability and Assessment Language (OVAL) is used to describe the security condition of a system. The Extensible Configuration Checklist Description Format (XCCDF) is used to create security checklists in a standardized fashion. The Script Check Engine (SCE) is designed to make scripts interoperable with security policy definitions.

Question 63

Susan is reviewing software testing coverage data and sees the information shown here. What can she determine about this testing process? (Select all answers that apply.) A. The testing does not have full coverage. B. Test 4 completed with no failures. C. Test 2 failed to run successfully. D. The testing needs to be run a fifth time.

Answer 63

B, C. Test 2's total failure is likely due to a failed test run, but the tests overall show continued improvement with full success in test 4. At this point, most testing processes would consider the testing complete. This does not show coverage, and there is no reason to run a fifth run if the fourth test was successful.

Question 64

Which of the following strategies is not a reasonable approach for remediating a vulnerability identified by a vulnerability scanner? A. Install a patch. B. Use a workaround fix. C. Update the banner or version number. D. Use an application layer firewall or IPS to prevent attacks against the identified vulnerability.

Answer 64

C. Simply updating the version that an application provides may stop the vulnerability scanner from flagging it, but it won't fix the underlying issue. Patching, using workarounds, or installing an application layer firewall or IPS can all help to remediate or limit the impact of the vulnerability.

Question 65

During a penetration test, Selah calls her target's help desk claiming to be the senior assistant to an officer of the company. She requests that the help desk reset the officer's password because of an issue with his laptop while traveling and persuades them to do so. What type of attack has she successfully completed? A. Zero knowledge B. Help-desk spoofing C. Social engineering D. Black box

Answer 65

C. Selah's social engineering attack succeeded in persuading a staff member at the help desk to change a password for someone who they not only couldn't see but who they couldn't verify actually needed their password reset. Black box and zero knowledge are both terms describing penetration tests without information about the organization or system, and help-desk spoofing is not an industry term.

Question 66

In this image, what issue may occur due to the log handling settings? Source: Microsoft Corporation A. Log data may be lost when the log is archived. B. Log data may be overwritten. C. Log data may not include needed information. D. Log data may fill the system disk.

Answer 66

D. The menu shown will archive logs when they reach the maximum size allowed (20 MB). These archives will be retained, which could fill the disk. Log data will not be overwritten, and log data should not be lost when the data is archived. The question does not include enough information to determine if needed information may not be logged.

Question 67

Which of the following is not a hazard associated with penetration testing? A. Application crashes B. Denial of service C. Blackouts D. Data corruption

Answer 67

C. Penetration tests typically do not involve blackouts. Application crashes, denial of service due to system, network, or application failures, and even data corruption can all be hazards of penetration tests.

Question 68

Which NIST special publication covers the assessment of security and privacy controls? A. 800-12 B. 800-53A C. 800-34 D. 800-86

Answer 68

B. NIST SP 800-53A is titled “Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans” and covers methods for assessing and measuring controls. NIST 800-12 is an introduction to computer security, 800-34 covers contingency planning, and 800-86 is the “Guide to Integrating Forensic Techniques into Incident Response.”

Question 69

Michelle wants to assess her organization's disaster recovery readiness. What type of test could she run to most effectively assess readiness without the potential for disruption? A. Conduct a tabletop exercise. B. Conduct a failover test. C. Conduct a simulation. D. Conduct a plan review.

Answer 69

C. Simulations are the most complete test that can be conducted without the risk that a full failover test creates. Michelle should conduct a simulation to validate as much of her organization's plan as possible. Tabletop exercises and plan reviews provide less complete coverage.

Question 70

Lucca wants to conduct an audit of a hybrid cloud environment. What potential challenge should he identify for his management team? A. On-premises audits are difficult to complete. B. Hybrid audits cannot be conducted by third parties. C. Underlying cloud infrastructure may not be auditable. D. There are no differences between hybrid and cloud audits.

Answer 70

C. Hybrid environment audits involve the complexity of both cloud and on-premises audits. That means that the underlying cloud infrastructure may not be auditable, although Lucca's organization's use and configuration of the cloud will be. On-premises audits are not any more challenging to complete than other audits, hybrid audits can be conducted by third parties, and hybrid audits include both on-premises and cloud auditing challenges and requirements as they are not the same as a cloud-only audit.

Question 71

If Kara's primary concern is preventing administrative connections to the server, which port should she block? A. 22 B. 80 C. 443 D. 1433

Answer 71

A. Port 22 is used by the Secure Shell (SSH) protocol for administrative connections. If Kara wants to restrict administrative connections, she should block access on this port. Port 80 is used for HTTP, 443 for HTTPS, and 1433 for Microsoft SQL.

Question 72

During a third-party audit, Jim's company receives a finding that states, “The administrator should review backup success and failure logs on a daily basis and take action in a timely manner to resolve reported exceptions.” What potential problem does this finding indicate? A. Administrators will not know if the backups succeeded or failed. B. The backups may not be properly logged. C. The backups may not be usable. D. The backup logs may not be properly reviewed.

Answer 72

C. The audit finding indicates that the backup administrator may not be monitoring backup logs and taking appropriate action based on what they report, thus resulting in potentially unusable backups. Issues with review, logging, or being aware of the success or failure of backups are less important than not having usable backups.

Question 73

Jim is helping his organization decide on audit standards for use throughout their international organization. Which of the following is not an IT standard that Jim's organization is likely to use as part of its audits? A. COBIT B. SSAE-18 C. ITIL D. ISO 27001

Answer 73

C. ITIL, which originally stood for IT Infrastructure Library, is a set of practices for IT service management and is not typically used for auditing. The Control Objectives for Information and Related Technology (COBIT), ISO 27001, and the Statement on Standards for Attestation Engagements number 18 (SSAE-18) are all used for auditing.

Question 74

Nicole wants to conduct a standards-based audit of her organization. Which of the following is commonly used to describe common requirements for information systems? A. IEC B. COBIT C. FISA D. DMCA

Answer 74

B. COBIT, the Control Objectives for Information and Related Technologies, is commonly used as an audit framework for evaluating the governance and management of enterprise IT in an organization. The DMCA is the Digital Millennium Copyright Act, IEC is the International Electrotechnical Commission that defines standards for electrotechnology, and FISA is the Federal Intelligence Surveillance Act, not an audit standard.

Question 75

Kelly's team conducts regression testing on each patch they release. What key performance measure should they maintain to measure the effectiveness of their testing? A. Time to remediate vulnerabilities B. A measure of the rate of defect recurrence C. A weighted risk trend D. A measure of the specific coverage of their testing

Answer 75

B. Kelly's team is using regression testing, which is intended to prevent the recurrence of issues. This means measuring the rate of defect recurrence is appropriate for their work. Time to remediate vulnerabilities is associated with activities such as patching, rather than preparing the patch, whereas a weighted risk trend is used to measure risk over time to an organization. Finally, specific coverage may be useful to determine if they are fully testing their effort, but regression testing is more specifically covered by defect recurrence rates.

Question 76

Which of the following types of code review is not typically performed by a human? A. Software inspections B. Pair programming C. Static program analysis D. Software walk-throughs

Answer 76

C. Static program reviews are typically performed by an automated tool. Program understanding, program comprehension, pair programming, software inspections, and software walk-throughs are all human-centric methods for reviewing code.

Question 77

Susan is the lead of a quality assurance team at her company. The team has been tasked with the testing for a major release of their company's core software product. Susan's team of software testers are required to test every code path, including those that will be used only when an error condition occurs. What type of testing environment does her team need to ensure complete code coverage? A. White box B. Gray box C. Black box D. Dynamic

Answer 77

A. To fully test code, a white-box test is required. Without full visibility of the code, error conditions or other code could be missed, making a gray-box or black-box test an inappropriate solution. Using dynamic testing that runs against live code could also result in some conditions being missed due to sections of code not being exposed to typical usage.

Question 78

Susan is the lead of a quality assurance team at her company. The team has been tasked with the testing for a major release of their company's core software product. As part of the continued testing of their new application, Susan's quality assurance team has designed a set of test cases for a series of black-box tests. These functional tests are then run, and a report is prepared explaining what has occurred. What type of report is typically generated during this testing to indicate test metrics? A. A test coverage report B. A penetration test report C. A code coverage report D. A line coverage report

Answer 78

A. A test coverage report measures how many of the test cases have been completed and is used as a way to provide test metrics when using test cases. A penetration test report is provided when a penetration test is conducted—this is not a penetration test. A code coverage report covers how much of the code has been tested, and a line coverage report is a type of code coverage report, both of which cannot be created in a black-box test since the code is not accessible to testers.

Question 79

Susan is the lead of a quality assurance team at her company. The team has been tasked with the testing for a major release of their company's core software product. As part of their code coverage testing, Susan's team runs the analysis in a nonproduction environment using logging and tracing tools. Which of the following type of code issues is most likely to be missed during testing due to this change in the operating environment? A. Improper bounds checking B. Input validation C. A race condition D. Pointer manipulation

Answer 79

C. The changes from a testing environment with instrumentation inserted into the code and the production environment for the code can mask timing-related issues like race conditions. Bounds checking, input validation, and pointer manipulation are all related to coding issues rather than environmental issues and are more likely to be discoverable in a test environment.

Question 80

Robin recently conducted a vulnerability scan and found a critical vulnerability on a server that handles sensitive information. What should Robin do next? A. Patching B. Reporting C. Remediation D. Validation

Answer 80

D. Once a vulnerability scanner identifies a potential problem, validation is necessary to verify that the issue exists. Reporting, patching, or other remediation actions can be conducted once the vulnerability has been confirmed.

Question 81

The automated code testing and integration that Andrea ran as part of her organization's CI/CD pipeline errored out. What should Andrea do with the code if the company needs the code to go live immediately? A. Manually bypass the test. B. Review error logs to identify the problem. C. Rerun the test to see if it works. D. Send the code back to the developer for a fix

Answer 81

B. While handling errors and exceptions can be something of an art, the first thing to do in circumstances like these is to review error logs and notifications to try to find out what went wrong. From there, Andrea can make a decision to remediate a problem, send the code back for a fix, or take another action. She might even opt to send the code forward if the error occurred after testing was completed and was with the process flow or another noncritical element, but would do so only if she was absolutely certain that was the case.

Question 82

Michelle wants to compare vulnerabilities she has discovered in her data center based on how exploitable they are, if exploit code exists, and how hard they are to remediate. What scoring system should she use to compare vulnerability metrics like these? A. CSV B. NVD C. VSS D. CVSS

Answer 82

D. The Common Vulnerability Scoring System (CVSS) includes metrics and calculation tools for exploitability, impact, how mature exploit code is, and how vulnerabilities can be remediated, as well as a means to score vulnerabilities against users' unique requirements. NVD is the National Vulnerability Database, CSV is short for comma-separated values, and Visual SourceSafe (VSS) is an irrelevant term related to software development rather than vulnerability management.

Question 83

During a port scan of his network, Alex finds that a number of hosts respond on TCP ports 80, 443, 515, and 9100 in offices throughout his organization. What type of devices is Alex likely discovering? A. Web servers B. File servers C. Wireless access points D. Printers

Answer 83

D. Network-enabled printers often provided services via TCP 515 and 9100 and have both nonsecure and secure web-enabled management interfaces on TCP 80 and 443. Web servers, access points, and file servers would not typically provide service on the LPR and LPD ports (515 and 9100).

Question 84

Nikto, Burp Suite, and Wapiti are all examples of what type of tool? A. Web application vulnerability scanners B. Code review tools C. Vulnerability scanners D. Port scanners

Answer 84

A. Nikto, Burp Suite, and Wapiti are all web application vulnerability scanners, tools designed specifically to scan web servers and applications. While they share some functionality with broader vulnerability scanners and port scanning tools, they have a narrower focus and typically have deeper capabilities than vulnerability scanners.

Question 85

Frank's team is testing a new API that his company's developers have built for their application infrastructure. Which of the following is not a common API issue that you would expect Frank's team to find? A. Improper encryption B. Object-level authorization issues C. User authentication issues D. Lack of rate limiting

Answer 85

A. APIs typically transfer data for web applications via HTTPS, meaning that the API itself is not responsible for encryption. If Frank's team discovers that TLS is not enabled, they will need to work with the infrastructure or systems administration team to ensure that TLS is enabled and in use rather than making API changes. Authorization for object access, authentication weaknesses, and rate limiting are all common API issues. If you're not familiar with the types of issues you might encounter in APIs, you can read more about them in the OWASP API security top 10 at https://owasp.org/API-Security/editions/2023/en/0x11-t10.

Question 86

Jim is working with a penetration testing contractor who proposes using Metasploit as part of her penetration testing effort. What should Jim expect to occur when Metasploit is used? A. Systems will be scanned for vulnerabilities. B. Systems will have known vulnerabilities exploited. C. Services will be probed for buffer overflow and other unknown flaws. D. Systems will be tested for zero-day exploits.

Answer 86

B. Metasploit is an exploitation package that is designed to assist penetration testers. A tester using Metasploit can exploit known vulnerabilities for which an exploit has been created or can create their own exploits using the tool. While Metasploit provides built-in access to some vulnerability scanning functionality, a tester using Metasploit should primarily be expected to perform actual tests of exploitable vulnerabilities. Similarly, Metasploit supports creating buffer overflow attacks, but it is not a purpose-built buffer overflow testing tool, and of course, testing systems for zero-day exploits doesn't work unless they have been released.

Question 87

Susan needs to ensure that the interactions between the components of her e-commerce application are all handled properly. She intends to verify communications, error handling, and session management capabilities throughout her infrastructure. What type of testing is she planning to conduct? A. Misuse case testing B. Fuzzing C. Regression testing D. Interface testing

Answer 87

D. Susan is conducting interface testing. Interface testing involves testing system or application components to ensure that they work properly together. Misuse case testing focuses on how an attacker might misuse the application and would not test normal cases. Fuzzing attempts to send unexpected input and might be involved in interface testing, but it won't cover the full set of concerns. Regression testing is conducted when testing changes and is used to ensure that the application or system functions as it did before the update or change.

Question 88

Jim is designing his organization's log management systems and knows that he needs to carefully plan to handle the organization's log data. Which of the following is not a factor that Jim should be concerned with? A. The volume of log data B. A lack of sufficient log sources C. Data storage security requirements D. Network bandwidth

Answer 88

B. Not having enough log sources is not a common consideration in log management system design, although it may be a worry for security managers who can't capture the data they need. Log management system designs must take into account the volume of log data and the network bandwidth it consumes, the security of the data, and the amount of effort required to analyze the data.

Question 89

Ryan's organization wants to ensure that proper account management is occurring but does not have a central identity and access management tool in place. Ryan has a limited amount of time to do his verification process. What is his best option to test the account management process as part of an internal audit? A. Validate all accounts changed in the past 90 days. B. Select high-value administrative accounts for validation. C. Validate all account changes in the past 180 days. D. Validate a random sample of accounts.

Answer 89

D. Random sampling of accounts is the recommended best practice if all accounts cannot be validated. Selecting only recently changed accounts will not identify long-term issues or historic issues, and checking only high-value accounts will not show if there are issues or bad practices with other account types.

Question 90

When a Windows system is rebooted, what type of log is generated? A. Error B. Warning C. Information D. Failure audit

Answer 90

C. Rebooting a Windows machine results in an information log entry. Windows defines five types of events: errors, which indicate a significant problem; warnings, which may indicate future problems; information, which describes successful operation; success audits, which record successful security accesses; and failure audits, which record failed security access attempts.

Question 91

During a review of access logs, Alex notices that Michelle logged into her workstation in New York at 8 a.m. daily, but then she was recorded as logging into her department's main web application shortly after 3 a.m. daily. What common logging issue has Alex likely encountered? A. Inconsistent log formatting B. Modified logs C. Inconsistent timestamps D. Multiple log sources

Answer 91

C. Inconsistent timestamps are a common problem, often caused by improperly set time zones or due to differences in how system clocks are set. In this case, a consistent time difference often indicates that one system uses local time, and the other is using Greenwich mean time (GMT). Logs from multiple sources tend to cause problems with centralization and collection, whereas different log formats can create challenges in parsing log data. Finally, modified logs are often a sign of intrusion or malicious intent.

Question 92

What type of vulnerability scan accesses configuration information from the systems it is run against as well as information that can be accessed via services available via the network? A. Authenticated scans B. Web application scans C. Unauthenticated scans D. Port scans

Answer 92

A. Authenticated scans use a read-only account to access configuration files, allowing more accurate testing of vulnerabilities. Web application scans, unauthenticated scans, and port scans don't have access to configuration files unless they are inadvertently exposed.

Question 93

Brian has discovered a vulnerability in a website and has notified the company that owns the website about the issue. What has he done? A. A penetration test B. Ethical disclosure C. A web application test D. OSINT

Answer 93

B. Notifying third parties of security issues and vulnerabilities in a confidential manner to allow them to address the issues is considered ethical disclosure. There is not enough information in the question to determine how it was found, and disclosure is not necessarily part of either penetration tests or application tests. How the information as found is not listed, so OSINT is not a useful answer either.