Domain 9 - Exam Feedback Flashcards
What are the elements of the Process for Attack Simulation and Threat Analysis (PASTA), a seven-step threat modeling methodology?
The seven steps of PASTA are:
- Definition the Objectives (DO) for the Analysis of Risks,
- Definition of the Technical Scope (DTS),
- Application Decomposition and Analysis (ADA),
- Threat Analysis (TA),
- Weakness and Vulnerability Analysis (WVA),
- Attack Modeling and Simulation (AMS), and
- Risk Analysis and Management (RAM).
Note – Containment and Eradication (CE) is not a step of PASTA. Instead, these are two elements of a typical incident response policy.
UDP is a connectionless protocol that operates at the Transport layer of the OSI model and uses ports to manage simultaneous connections. Which of the following terms also is related to UDP?
Simplex
UDP is a simplex protocol at the Transport layer.
What is the client source port of a secured web communication?
Note – IT is NOT port 443!
A dynamic port
Client source ports are dynamic ports (i.e., randomly selected port number between 1024–65,535) for most Application layer protocols, including secure web communications (i.e., HTTPS).
What’s the difference between a Type I and Type II Hypervisor?
A Type I hypervisor is a native or bare-metal hypervisor. In this configuration, there is no host OS; instead, the hypervisor installs directly onto the hardware where the host OS would normally reside. Type 1 hypervisors are often used to support server virtualization.
A Type II hypervisor is a hosted hypervisor. In this configuration, a standard regular OS is present on the hardware, and then the hypervisor is installed as another software application. Type II hypervisors are often used in relation to desktop deployments, where the guest OSs offer safe sandbox areas to test new code, allow the execution of legacy applications, support apps from alternate OSs, and provide the user with access to the capabilities of a host OS.
In object-oriented programming, what term describes a collection of the common methods from a set of objects that defines the behavior of those objects?
A class is a collection of the common methods from a set of objects that defines the behavior of those objects.
Is it a good idea to power down a compromised system in the detection phase of an incident response?
NO
You should never power down a compromised system during the early stages of incident response because this may destroy valuable evidence stored in volatile memory. The other answers include steps that will isolate a system without destroying evidence in typical scenarios.
What is a primary goal within the detection phase of incident response?
Identification of incidents
A primary goal within the detection phase of incident response is identification of an incident. Restoration of normal activity occurs during the recovery phase. Lessons learned is the final phase of incident response.
What is an access control list (ACL) based on? Subject or Object?
Object
An ACL is based on an object and includes a list of subjects that are granted access. A capability table is focused on a subject and includes a list of objects the subject can access. Roles and accounts are examples of subjects and may be included in an ACL, but they aren’t the focus.
What is the weakest method of authentication?
Strong static passwords
Strong passwords are the weakest form of authentication from the given answers. One-time passwords are stronger than static passwords. Biometric methods such as retina scans are stronger than passwords.
Which security protocol automatically performs reauthentication of the client system throughout the connected session in order to detect session hijacking?
CHAP
CHAP is a security protocol that automatically performs reauthentication of the client system throughout the connected session in order to detect session hijacking.
What term describes the processor mode used to run the system tools used by administrators seeking to make configuration changes to a machine?
User Mode or Supervisory Mode?
User Mode
All user applications, regardless of the security permissions assigned to the user, execute in user mode. Supervisory mode, kernel mode, and privileged mode are all terms that describe the mode used by the processor to execute instructions that originate from the operating system.
What law amended the Health Insurance Portability and Accountability Act to include data breach notification requirements?
HITECH
The Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH) amended HIPAA to include new regulations related to data breach notification and the compliance requirements of covered entity business associates.
What regulation formalizes the prudent man rule that requires senior executives to take personal responsibility for their actions?
Federal Sentencing Guidelines
Which of the following provides the best protection against mishandling media that contains sensitive information?
Marking
Purging
Sanitizing
Retaining?
Marking
Marking (or labeling) media is the best choice of the available answers to protect against mishandling media. When properly marked, personnel are more likely to handle media properly. Purging and sanitizing methods remove sensitive information but do not protect against mishandling. Data retention refers to how long an organization keeps the data, not how it handles the data.
Which one of the following individuals is most likely to cause serious intentional damage to a business’s computing resources?
Malicious insider or Terrorist?
malicious insider
The malicious insider poses the greatest risk to your organization because they might already have access to your systems and a working knowledge of your infrastructure.
Which federal government agency is responsible for ensuring the security of government computer systems that are used to process sensitive and/or classified information?
National Security Agency
The National Security Agency is responsible for managing the security of computer systems that process sensitive and/or classified information. The security of all other federal government systems is entrusted to the National Institute of Standards and Technology.
Once a system is compromised, _______________ is deployed to restore it to its previous known-good state.
Corrective access control
Corrective access control is deployed to restore systems to normal after an unwanted or unauthorized activity has occurred.
What is the biggest problem with computer-based information when used as evidence?
The biggest problem with computer evidence is that some of it may be volatile, meaning it can be lost with the loss of power. Finding and preserving volatile evidence from memory is the most challenging aspect of gathering computer evidence. Although computer evidence is usually considered hearsay, there is an exception to the hearsay rule that makes it admissible (specifically if it was created by a normal business operation and supported by a witness).
_______________ is the process by which a subject provides a username, logon ID, personal identification number, and so on.
Identification, not Authentication
Identification is the process by which a subject professes an identity and accountability is initiated.
Flo and Ricky are sending messages to each other using an asymmetric encryption algorithm. Flo wants to send Ricky a private message. What key should she use to encrypt it?
Ricky’s public key
What is split-DNS?
Dividing internal DNS from external DNS
Which type of control provides extended options to existing controls and aids or supports administrative security policy?
Compensation access control
Compensation access control is deployed to provide various options to existing controls to help enforce and support a security policy.
Subjects can be held accountable for their actions toward other subjects and objects while they are authenticated to a system. What process facilitates this accountability?
Monitoring
Monitoring the activities of subjects and objects, as well as of core system functions that maintain the operating environment and the security mechanisms, helps establish accountability on the system.
What is a directive control?
A directive control is a security tool used to guide the security implementation of an organization.
Among the following choices, what kind of IDS is considered an expert system?
Behavior based or Knowledge based?
Behavior based
A behavior-based intrusion detection system (IDS) can be labeled an expert system or a pseudo-artificial intelligence system because it can learn and make assumptions about events. In other words, the IDS can act like a human expert by evaluating current events against known events.
What attack involves an interruptive malicious user positioned between a client and server attempting to take over?
Man in the middle or Hijacking?
Hijacking
In a hijack attack, which is an offshoot of a man-in-the-middle attack, a malicious user is positioned between a client and server and then interrupts the session and takes it over.
Which is the most common form of perimeter security device or mechanism for any given business?
Fences or lighting?
Lighting
Lighting is by far the most pervasive and basic element of security because it illuminates areas and makes signs of hidden danger visible to all.
John is configuring a router that will stand between the network 10.8.6.0/24 and the Internet. He would like to configure egress filtering rules to minimize the potential of crackers originating a DDoS attack from his network. What type of traffic should be filtered out to help achieve this goal?
Outbound traffic with an address outside the range 10.8.6.0/24
Although it is true that John would probably want to filter out all of these types of traffic for various reasons, he would be specifically interested in filtering out outbound traffic with an address not belonging to his network to achieve his stated goal.
Which of the following is not a benefit of tunneling?
Each encapsulated protocol includes its own error detection, error handling, acknowledgment, and session management features.
Tunneling is generally an inefficient means of communicating because all protocols include their own error detection, error handling, acknowledgment, and session management features, and using more than one protocol at a time just compounds the overhead required to communicate a single message.
Which IPsec mode provides for encryption of complete packets, including header information?
Authentication Header (AH) or Tunnel?
Tunnel
When IPsec is used in tunnel mode, entire packets, rather than just the payload, are encrypted. This mode is designed for use in gateway-to-gateway communications.
Is Daily Workstation change a thing?
Yes
Daily workstation change (i.e., when workers do not have a designated, assigned, or consistent workstation but operate any one that is available) is an effective means of preventing and detecting the presence of unapproved software.
Which of the following can be used to verify the integrity of a received message?
A hash total is a checksum used to verify the integrity of a transmission.
Does data classification provide for non-repudiation?
No
Providing for nonrepudiation is not a reason for data classification.
What is the Delphi technique?
The Delphi technique is a form of qualitative risk analysis that uses an anonymous feedback-and-response process to arrive at a group consensus.
What is confidentiality dependent on?
Availability or integrity?
Integrity
Without object integrity, confidentiality cannot be maintained. In fact, integrity and confidentiality depend on one another.
You are implementing AES encryption for files that your organization plans to store in a cloud storage service and wish to have the strongest encryption possible. What key length should you choose?
256 bits
The strongest keys supported by the Advanced Encryption Standard are 256 bits. The valid AES key lengths are 128, 192, and 256 bits.
Identification is the first step toward what ultimate goal?
A. Accountability
B. Authorization
C. Auditing
D. Nonrepudiation
Accountability, not authorization
Accountability is the ultimate goal of a process started by identification.
A _______________ contains levels with various compartments that are isolated from the rest of the security domain.
Hybrid environment
Hybrid environments combine both hierarchical and compartmentalized environments so that security levels have subcompartments.
What element of security control includes access controls, alarms, CCTV, and monitoring?
Technical physical security control (not just physical security controls)
Technical physical security controls include access controls; intrusion detection; alarms; closed-circuit television (CCTV); monitoring; heating, ventilating, and air conditioning (HVAC); power supplies; and fire detection and suppression.
Abnormal or unauthorized activities detectable to an IDS include which of the following? (Choose all that apply.)
A. External connection attempts
B. Execution of malicious code
C. Access to controlled objects
What are the well-known ports?
0 to 1,023
NIST SP800-53 discusses a set of security controls as what type of security tool?
A baseline
NIST SP 800-53 discusses security control baselines as a list of security controls. CIS releases security baselines, and a baseline is a useful part of a threat management strategy and may contain a list of acceptable configuration items.
What are the four functions of a forensic disk controller?
A forensic disk controller performs four functions.
- One of those, write blocking, intercepts write commands sent to the device and prevents them from modifying data on the device.
- The other three functions include returning data requested by a read operation,
- returning access-significant information from the device, and
- reporting errors from the device back to the forensic host. The controller should not prevent read commands from being sent to the device because those commands may return crucial information.
Which Kerberos service generates a new ticket and session keys and sends them to the client?
TGS
The TGS, or Ticket-Granting Service (which is usually on the same server as the KDC), receives a TGT from the client. It validates the TGT and the user’s rights to access the service they are requesting to use. The TGS then issues a ticket and session keys to the client. The AS serves as the authentication server, which forwards the username to the KDC. It’s worth noting that the client doesn’t communicate with the KDC directly. Instead, it will communicate with the TGT and the AS, which means KDC isn’t an appropriate answer here.
What type of motion detector uses high microwave frequency signal transmissions to identify potential intruders?
Wave pattern
Wave pattern motion detectors transmit ultrasonic or microwave signals into the monitor area, watching for changes in the returned signals bouncing off objects.
Susan sets up a firewall that keeps track of the status of the communication between two systems and allows a remote system to respond to a local system after the local system starts communication. What type of firewall is Susan using?
A stateful packet inspection firewall
Stateful packet inspection firewalls, also known as dynamic packet filtering firewalls, track the state of a conversation and can allow a response from a remote system based on an internal system being allowed to start the communication. Static packet filtering and circuit level gateways only filter based on source, destination, and ports, whereas application-level gateway firewalls proxy traffic for specific applications.
What are the five modes of DES?
The DES modes of operation are :
- Electronic Codebook (ECB),
- Cipher Block Chaining (CBC),
- Cipher Feedback (CFB),
- Output Feedback (OFB), and
- Counter (CTR).
Between the following protocols, which are proprietary AAA packages and which are not?
RADIUS
XTACACS
TACACS+
RADIUS is not proprietary
XTACACS and TACACS+ are both Cisco proprietary protocols.
Kim is the system administrator for a small business network that is experiencing security problems. She is in the office in the evening working on the problem, and nobody else is there. As she is watching, she can see that systems on the other side of the office that were previously behaving normally are now exhibiting signs of infection. What type of malware is Kim likely dealing with?
A worm, because:
- Worms have built-in propagation mechanisms that do not require user interaction, such as scanning for systems containing known vulnerabilities and then exploiting those vulnerabilities to gain access.
- Viruses and Trojan horses typically require user interaction to spread.
- Logic bombs do not spread from system to system but lie in wait until certain conditions are met, triggering the delivery of their payload.
What problem drives the recommendation to physically destroy SSD drives to prevent data leaks when they are retired?
The built-in erase commands are not completely effective on some SSDs.
What are the 7 principles of the EU-U.S. Privacy Shield Framework?
- Notice,
- Choice,
- Accountability for onward transfer,
- Security,
- Data integrity and purpose limitation,
- Access,
- Recourse, Enforcement and Liability
Alex works for the U.S. federal government and is required to ensure that the devices and components he acquires are not compromised. What program will he participate in to help ensure this?
Trusted foundry
The U.S. Trusted Foundry program helps to protect the supply chain for components and devices by ensuring that the companies that produce and supply them are secure. TEMPEST is the name for a program aimed at capturing data from electronic emissions, GovBuy is not a government program or supplier, and MITRE conducts research and development for the U.S. government.
When evaluating biometric devices, what is another term used to describe the equal error rate?
CER
The crossover error rate (CER) is the point where both the false acceptance rate and the false rejection rate cross. CER and ERR, or equal error rate, mean the same thing and are used interchangeably.
What principle states that an individual should make every effort to complete his or her responsibilities in an accurate and timely manner?
Due Diligence
The due care principle states that an individual should react in a situation using the same level of care that would be expected from any reasonable person. It is a very broad standard. The due diligence principle is a more specific component of due care that states an individual assigned a responsibility should exercise due care to complete it accurately and in a timely manner.
When Ben records data and then replays it against his test website to verify how it performs based on a real production workload, what type of performance monitoring is he undertaking?
Proactive
Proactive monitoring, aka synthetic monitoring, uses recorded or generated traffic to test systems and software. Passive monitoring uses a network span, tap, or other device to capture traffic to be analyzed. Reactive and replay are not industry terms for types of monitoring.
What’s wrong with Hand geometry scanners?
Hand geometry scanners assess the physical dimensions of an individual’s hand but do not verify other unique factors about the individual, or even verify if they are alive.
This means that hand geometry scanners should not be implemented as the sole authentication factor for secure environments. Hand geometry scanners do not have an abnormally high FRR and do not stand out as a particular issue from an accessibility standpoint compared to other biometric systems.
Denise is preparing for a trial relating to a contract dispute between her company and a software vendor. The vendor is claiming that Denise made a verbal agreement that amended their written contract. What rule of evidence should Denise raise in her defense?
Parol evidence rule
The parol evidence rule states that when an agreement between two parties is put into written form, it is assumed to be the entire agreement unless amended in writing. The best evidence rule says that a copy of a document is not admissible if the original document is available. Real evidence and testimonial evidence are evidence types, not rules of evidence.
The company Chris works for has notifications posted at each door reminding employees to be careful to not allow people to enter when they do. Which type of controls best describes this?
Directive
Notifications and procedures like the signs posted at the company Chris works for are examples of directive access controls.
If Alex hires a new employee and the employee’s account is provisioned after HR manually inputs information into the provisioning system based on data Alex provides via a series of forms, what type of provisioning has occurred?
Workflow-based account provisioning
Provisioning that occurs through an established workflow, such as through an HR process, is workflow-based account provisioning.
Sally is wiring a gigabit Ethernet network. What cabling choices should she make to ensure she can use her network at the full 1000 Mbps she wants to provide to her users?
Cat 5e and Cat 6
Category 5e and Category 6 UTP cable are both rated to 1000 Mbps. Cat 5 (not Cat 5e) is only rated to 100 Mbps, whereas Cat 7 is rated to 10 Gbps. There is no Cat 4e.
What’s the difference between network latency and jitter?
- Latency is a delay in the delivery of packets from their source to their destination.
- Jitter is a variation in the latency for different packets.
Alan is installing a fire suppression system that will kick in after a fire breaks out and protect the equipment in the data center from extensive damage. What metric is Alan attempting to lower?
Fire suppression systems do not stop a fire from occurring but do reduce the damage that fires cause. This is an example of reducing risk by lowering the impact of an event.
Alan’s Wrenches recently developed a new manufacturing process for its product. They plan to use this technology internally and not share it with others. They would like it to remain protected for as long as possible. What type of intellectual property protection is best suited for this situation?
Trade secret
Patents and trade secrets can both protect intellectual property in the form of a process. Patents require public disclosure and have expiration dates while trade secrets remain in force for as long as they remain secret. Therefore, trade secret protection most closely aligns with the company’s goals.
Ben wants to interface with the National Vulnerability Database using a standardized protocol. What option should he use to ensure that the tools he builds work with the data contained in the NVD?
SCAP
The Security Content Automation Protocol (SCAP) is a suite of specifications used to handle vulnerability and security configuration information.
The National Vulnerability Database (NVD) provided by NIST uses SCAP. XACML is the eXtensible Access Control Markup Language, an OASIS standard used for access control decisions, and neither VSML nor SCML are industry terms.
Kolin is searching for a network security solution that will allow him to help reduce zero-day attacks while using identities to enforce a security policy on systems before they connect to the network. What type of solution should Kolin implement?
A NAC system
Network Access Control (NAC) systems can be used to authenticate users and then validate their system’s compliance with a security standard before they are allowed to connect to the network. Enforcing security profiles can help reduce zero-day attacks, making NAC a useful solution. A firewall can’t enforce system security policies, whereas an IDS can only monitor for attacks and alarm when they happen. Thus, neither a firewall nor an IDS meets Kolin’s needs. Finally, port security is a MAC address–based security feature that can only restrict which systems or devices can connect to a given port.
Which of the following tools is best suited to the information gathering phase of a penetration test?
Whois
During the information gathering and discovery phase of a penetration test, testers will gather information about the target. Whois can provide information about an organization, including IP ranges, physical addresses, and staff contacts. Nessus would be useful during a vulnerability detection phase, and Metasploit would be useful during exploitation. zzuf is a fuzzing tool and is less likely to be used during a penetration test.
Why does Nikto identify directory indexing as an issue?
Directory indexing may not initially seem like an issue during a penetration test, but simply knowing the name and location of files can provide an attacker with quite a bit of information about an organization, as well as a list of potentially accessible files. XDRF is not a type of attack, and indexing is not a denial-of-service attack vector. Directory indexing being turned on is typically either due to misconfiguration or design, or because the server was not properly configured at setup, rather than being a sign of attack.
Nikto lists OSVDB-877, noting that the system may be vulnerable to XST. What would this type of attack allow an attacker to do?
Steal a user’s cookies.
Cross-site tracing (XST) leverages the HTTP TRACE or TRACK methods and could be used to steal a user’s cookies via cross-site scripting (XSS). The other options are not industry terms for web application or web server attacks or vulnerabilities.
What is an APIPA address and what is its address range?
APIPA addresses are assigned between 169.254.0.01 and 169.254.255.254,
Automatic Private IP Addressing (APIPA) is Microsoft’s terminology for address autoconfiguration in the Windows 98, ME, 2000 and XP OSs. APIPA allows a local area network (LAN) computer to give itself a unique IP address when Dynamic Host Configuration Protocol (DHCP) is unavailable. APIPA is sometimes known as auto-IP.
What is crystal box testing?
Crystal box penetration testing, which is also sometimes called white box penetration testing
Application banner information is typically recorded during what penetration testing phase?
Discovery
The discovery phase includes activities like gathering IP addresses, network ranges, and hostnames, as well as gathering information about employees, locations, systems, and of course, the services those systems provide. Banner information is typically gathered as part of discovery to provide information about what version and type of service is being provided.
Banner grabbing is the act of capturing the information provided by banners, configurable text-based welcome screens from network hosts that generally display system information. Banners are intended for network administration.
Jim has been asked to individually identify devices that users are bringing to work as part of a new BYOD policy. The devices will not be joined to a central management system like Active Directory, but he still needs to uniquely identify the systems. Which of the following options will provide Jim with the best means of reliably identifying each unique device?
Device fingerprinting via a web portal can require user authentication and can gather data like operating systems, versions, software information, and many other factors that can uniquely identify systems. Using an automated fingerprinting system is preferable to handling manual registration, and pairing user authentication with data gathering provides more detail than a port scan. MAC addresses can be spoofed, and systems may have more than one depending on how many network interfaces they have, which can make unique identification challenging.
What two types of attacks are VoIP call managers and VoIP phones most likely to be susceptible to?
DoS and OS attacks
Call managers and VoIP phones can be thought of as servers or appliances and embedded or network devices. That means that the most likely threats that they will face are denial-of-service (DoS) attacks and attacks against the host operating system. Malware and Trojans are less likely to be effective against a server or embedded system that doesn’t browse the Internet or exchange data files; buffer overflows are usually aimed at specific applications or services.
What type of error occurs when a valid subject using a biometric authenticator is not authenticated?
Type 1 error
Type 1 errors occur when a valid subject is not authenticated.
Type 2 errors occur when an invalid subject is incorrectly authenticated.
Type 3 and Type 4 errors are not associated with biometric authentication.
George is assisting a prosecutor with a case against a hacker who attempted to break into the computer systems at George’s company. He provides system logs to the prosecutor for use as evidence, but the prosecutor insists that George testify in court about how he gathered the logs. What rule of evidence requires George’s testimony?
The hearsay rule
The hearsay rule says that a witness cannot testify about what someone else told them, except under very specific exceptions. The courts have applied the hearsay rule to include the concept that attorneys may not introduce logs into evidence unless they are authenticated by the system administrator. The best evidence rule states that copies of documents may not be submitted into evidence if the originals are available. The parol evidence rule states that if two parties enter into a written agreement, that written document is assumed to contain all of the terms of the agreement. Testimonial evidence is a type of evidence, not a rule of evidence.
Which one of the following malware types uses built-in propagation mechanisms that exploit system vulnerabilities to spread?
Worm
Worms have built-in propagation mechanisms that do not require user interaction, such as scanning for systems containing known vulnerabilities and then exploiting those vulnerabilities to gain access. Viruses and Trojan horses typically require user interaction to spread. Logic bombs do not spread from system to system but lie in wait until certain conditions are met, triggering the delivery of their payload.
Don’s company is considering the use of an object-based storage system where data is placed in a vendor-managed storage environment through the use of API calls. What type of cloud computing service is in use?
In this scenario, the vendor is providing object-based storage, a core infrastructure service. Therefore, this is an example of infrastructure as a service (IaaS).
Harry is concerned that accountants within his organization will use data diddling attacks to cover up fraudulent activity in accounts that they normally access. Which one of the following controls would best defend against this type of attack?
Integrity verification
Encryption, access controls, and firewalls would not be effective in this example because the accountants have legitimate access to the data. Integrity verification software would protect against this attack by identifying unexpected changes in protected data.
What is Data diddling
Data diddling is a type of cybercrime in which data is altered as it is entered into a computer system, most often by a data entry clerk or a computer virus. Computerized processing of the altered data results in a fraudulent benefit.
Bell-LaPadula is an example of what type of access control model?
MAC
Bell-LaPadula uses security labels on objects and clearances for subjects, and is therefore a MAC model. It does not use discretionary, rule-based, role-based, or attribute-based access control.
What is FERPA?
The Family Educational Rights and Privacy Act (FERPA) protects the privacy of students in any educational institution that accepts any form of federal funding.
Which one of the following techniques can an attacker use to exploit a TOC/TOU vulnerability?
Algorithmic complexity or concurrency control
Attackers may use algorithmic complexity as a tool to exploit a TOC/TOU race condition. By varying the workload on the CPU, attackers may exploit the amount of time required to process requests and use that variance to effectively schedule the exploit’s execution. File locking, exception handling, and concurrency controls are all methods used to defend against TOC/TOU attacks.
What type of firewall uses multiple proxy servers that filter traffic based on analysis of the protocols used for each service?
Application-level gateway firewall or stateful inspection firewall?
Application-level gateway firewall
An application-level gateway firewall uses proxies for each service it filters. Each proxy is designed to analyze traffic for its specific traffic type, allowing it to better understand valid traffic and to prevent attacks. Static packet filters and circuit-level gateways simply look at the source, destination, and ports in use, whereas a stateful packet inspection firewall can track the status of communication and allow or deny traffic based on that understanding.
Which one of the following computing models allows the execution of multiple processes on a single processor by having the operating system switch between them without requiring modification to the applications?
Multi-tasking or multi-processing?
Multitasking
Multitasking handles multiple processes on a single processor by switching between them using the operating system. Multiprocessing uses multiple processors to perform multiple processes simultaneously. Multiprogramming requires modifications to the underlying applications. Multithreading runs multiple threads within a single process.
What activity is being performed when you apply security controls based on the specific needs of the IT system that they will be applied to?
Scopingn or Tailoring?
Scoping
Scoping is the process of reviewing and selecting security controls based on the system that they will be applied to. Tailoring is the process of matching a list of security controls to the mission of an organization. Baselines are used as a base set of security controls, often from a third-party organization that creates them. Standardization isn’t a relevant term here.
During what phase of the electronic discovery process does an organization perform a rough cut of the information gathered to discard irrelevant information?
Collection or processing?
Processing
During the preservation phase, the organization ensures that information related to the matter at hand is protected against intentional or unintentional alteration or deletion. The identification phase locates relevant information but does not preserve it. The collection phase occurs after preservation and gathers responsive information. The processing phase performs a rough cut of the collected information for relevance.
Ben’s job is to ensure that data is labeled with the appropriate sensitivity label. Since Ben works for the U.S. government, he has to apply the labels Unclassified, Confidential, Secret, and Top Secret to systems and media. If Ben is asked to label a system that handles Secret, Confidential, and Unclassified information, how should he label it?
Mixed or Secret?
Secret
Systems and media should be labeled with the highest level of sensitivity that they store or handle. In this case, based on the U.S. government classification scheme, the highest classification level in use on the system is Secret. Mixed classification provides no useful information about the level, whereas Top Secret and Confidential are too high and too low, respectively.
Renee is using encryption to safeguard sensitive business secrets when in transit over the Internet. What risk metric is she attempting to lower?
Likelihood or impact
Likelihood
Using encryption reduces risk by lowering the likelihood that an eavesdropper will be able to gain access to sensitive information.
The removal of a hard drive from a PC before it is retired and sold as surplus is an example of what type of action?
Purging or Sanitizing?
Sanitization
Sanitization includes steps like removing the hard drive and other local storage from PCs before they are sold as surplus. Degaussing uses magnetic fields to wipe media; purging is an intense form of clearing used to ensure that data is removed and unrecoverable from media; and removing does not necessarily imply destruction of the drive.
Michelle is in charge of her organization’s mobile device management efforts and handles lost and stolen devices. Which of the following recommendations will provide the most assurance to her organization that data will not be lost if a device is stolen?
Remote wiping and GPS tracking or
Full device encryption and mandatory passcodes
While full device encryption doesn’t guarantee that data cannot be accessed, it provides Michelle’s best option for preventing data from being lost with a stolen device when paired with a passcode. Mandatory passcodes and application management can help prevent application based attacks and unwanted access to devices, but won’t keep the data secure if the device is lost. Remote wipe and GPS location is useful if the thief allows the device to connect to a cellular or wifi network. Unfortunately, many modern thieves immediately take steps to ensure that the device will not be trackable or allowed to connect to a network before they capture data or wipe the device for re-sale.
Susan’s SMTP server does not authenticate senders before accepting and relaying email. What is this security configuration issue known as?
Open Relay
SMTP servers that don’t authenticate users before relaying their messages are known as open relays. Open relays that are Internet exposed are typically quickly exploited to send email for spammers.
What is PAT and what is it used for?
Port Address Translation (PAT) is used to allow a network to use any IP address set inside without causing a conflict with the public Internet. PAT is often confused with Network Address Translation (NAT), which maps one internal address to one external address. IPsec is a security protocol suite, software-defined networking (SDN) is a method of defining networks programmatically, and IPX is a non-IP network protocol.
Q - Ed’s organization has 5 IP addresses allocated to them by their ISP but needs to connect over 100 computers and network devices to the Internet. What technology can he use to connect his entire network via the limited set of IP addresses he can use?
A - PAT
Fred’s organization needs to use a non-IP protocol on their VPN. Which of the common VPN protocols should he select to natively handle non-IP protocols?
L2TP is the only one of the four common VPN protocols that can natively support non-IP protocols. PPTP, L2F, and IPsec are all IP-only protocols.
Residual data is another term for what type of data left after attempts have been made to erase it?
Remnant data is data that is left after attempts have been made to remove or erase it. Bitrot is a term used to describe aging media that decays over time. MBR is the master boot record, a boot sector found on hard drives and other media. Leftover data is not an industry term.
Which one of the following is not one of the canons of the (ISC)2 Code of Ethics?
Maintain compentent records of all investigations and assessments.
The four canons of the (ISC)2 code of ethics are
- To protect society, the common good, necessary public trust and confidence, and the infrastructure;
- Act honorably, honestly, justly, responsibly, and legally;
- Provide diligent and competent service to principals; and
- Advance and protect the profession.
What is the minimum interval at which an organization should conduct business continuity plan refresher training for those with specific business continuity roles?
Annually
Individuals with specific business continuity roles should receive training on at least an annual basis.
What is the minimum number of cryptographic keys necessary to achieve strong security when using the 3DES algorithm?
2
Triple DES functions by using either two or three encryption keys. When used with only one key, 3DES produces weakly encrypted ciphertext that is the insecure equivalent of DES.
What is an APIPA IP Address used for and what is its range?
APIPA addresses are assigned between 169.254.0.01 and 169.254.255.254,
APIPA. (Automatic Private IP Addressing) The Windows function that provides DHCP autoconfiguration addressing. APIPA assigns a class B IP address from 169.254. 0.0 to 169.254. 255.255 to the client when a DHCP server is either permanently or temporarily unavailable.
Lauren wants to monitor her LDAP servers to identify what types of queries are causing problems. What type of monitoring should she use if she wants to be able to use the production servers and actual traffic for her testing?
Active or Passive?
Passive
Since Lauren wants to monitor her production server, she should use passive monitoring by employing a network tap, span port, or other means of copying actual traffic to a monitoring system that can identify performance and other problems. This will avoid introducing potentially problematic traffic on purpose while capturing actual traffic problems. Active monitoring relies on synthetic or previously recorded traffic, and both replay and real time are not common industry terms used to describe types of monitoring.
Susan wants to monitor traffic between systems in a VMWare environment. What solution would be her best option to monitor that traffic?
Set up a virtual span port and capture data using a VM IDS
Using a virtual machine to monitor a virtual span port allows the same type of visibility that it would in a physical network if implemented properly. Installing Wireshark would allow monitoring on each system but doesn’t scale well. A physical appliance would require all traffic to be sent out of the VM environment, losing many of the benefits of the design. Finally, netcat is a network tool used to send or receive data, but it isn’t a tool that allows packet capture of traffic between systems.
What is a SPAN port and what is it used for?
SPAN [Switch Port Analyzer]
Port Mirroring also known as SPAN (Switched Port Analyzer), sends a copy of all network packets seen on one port (or an entire VLAN) to another port, where the packets can be analyzed.
Which of the following types of controls does not describe a mantrap?
Preventive or Compensating?
Compensating
A mantrap, which is composed of a pair of doors with an access mechanism that allows only one door to open at a time, is an example of a preventive access control because it can stop unwanted access by keeping intruders from accessing a facility due to an opened door or following legitimate staff in. It can serve as a deterrent by discouraging intruders who would be trapped in it without proper access, and of course, doors with locks are an example of a physical control. A compensating control attempts to make up for problems with an existing control or to add additional controls to improve a primary control.
What is a land attack?
In a land attack, the attacker sends a packet that has identical source and destination IP addresses in an attempt to crash systems that are not able to handle this out-of-specification traffic.
What’s the difference between Nikto and QualysGuard?
QualysGuard: Network vulnerability scanning.
Nikto: Web vulnerability scanning.
Alice would like to add another object to a security model and grant herself rights to that object. Which one of the rules in the Take-Grant protection model would allow her to complete this operation?
Take rule?
Grant rule?
Create rule?
create rule
The create rule allows a subject to create new objects and also creates an edge from the subject to that object, granting rights on the new object.
Which of the following concerns should not be on Lauren’s list of potential issues when penetration testers suggest using Metasploit during their testing?
Metasploit can only test vulnerabilities it has plug-ins for
Metasploit provides an extensible framework, allowing penetration testers to create their own exploits in addition to those that are built into the tool. Unfortunately, penetration testing can only cover the point in time when it is conducted. When conducting a penetration test, the potential to cause a denial of service due to a fragile service always exists, but it can test process and policy through social engineering and operational testing that validates how those processes and policies work.
What type of websites are regulated under the terms of COPPA?
The Children’s Online Privacy Protection Act (COPPA) regulates websites that cater to children or knowingly collect information from children under the age of 13.
What key assumption made by EAP can be remedied by using PEAP?
Extensible Authentication Protocol (EAP) was originally intended to be used on physically isolated network channels and did not include encryption.
Fortunately, it was designed to be extensible, and PEAP (Protected Extensible Authentication Protocol) can provide TLS encryption. EAP isn’t limited to PEAP as an option as EAP-TLS also exists, providing an EAP TLS implementation, and the same extensibility allows a multitude of other authentication methods.
What are the four key elements of Kerberos?
Key Distribution Center The key distribution center (KDC) is the trusted third party that provides authentication services. Kerberos uses symmetric-key cryptography to authenticate clients to servers. All clients and servers are registered with the KDC, and it maintains the secret keys for all network members.
Kerberos Authentication Server The authentication server hosts the functions of the KDC: a ticket-granting service (TGS) and an authentication service (AS). However, it is possible to host the ticket-granting service on another server. The authentication service verifies or rejects the authenticity and timeliness of tickets. This server is often called the KDC.
Ticket-Granting Ticket A ticket-granting ticket (TGT) provides proof that a subject has authenticated through a KDC and is authorized to request tickets to access other objects. A TGT is encrypted and includes a symmetric key, an expiration time, and the user’s IP address. Subjects present the TGT when requesting tickets to access objects.
Ticket A ticket is an encrypted message that provides proof that a subject is authorized to access an object. It is sometimes called a service ticket (ST). Subjects request tickets to access objects, and if they have authenticated and are authorized to access the object, Kerberos issues them a ticket. Kerberos tickets have specific lifetimes and usage parameters. Once a ticket expires, a client must request a renewal or a new ticket to continue communications with any server.
What are the strengths and weaknesses of Kerberos?
Strengths - Kerberos is a versatile authentication mechanism that works over local LANs, remote access, and client-server resource requests.
Weaknesses - Kerberos presents a single point of failure—the KDC. If the KDC is compromised, the secret key for every system on the network is also compromised. Also, if a KDC goes offline, no subject authentication can occur.
It also has strict time requirements and the default configuration requires that all systems be time-synchronized within five minutes of each other. If a system is not synchronized or the time is changed, a previously issued TGT will no longer be valid and the system will not be able receive any new tickets. In effect, the client will be denied access to any protected network resources.
What is a simple diagram of the kerberos process
What is Nikto
Nikto Web Scanner is a Web server scanner that tests Web servers for dangerous files/CGIs, outdated server software and other problems. It performs generic and server type specific checks. It also captures and prints any cookies received.
What does CGI stand for and what are the risks associated with CGI scripts?
CGI stands for Common Gateway Interface, which is a standard for a gateway, or interface, between clients and web servers.
CGI scripts are potential security holes even though you run your server as “nobody”. A subverted CGI script running as “nobody” still has enough privileges to mail out the system password file, examine the network information maps, or launch a log-in session on a high numbered port (it just needs to execute a few commands in Perl to accomplish this).
What is e-Discovery and what are the eight steps associated with it?
e-Discovery of electronically stored information (ESI) is the process of producing for a court or external attorney all ESI pertinent to a legal proceeding. The Electronic Discovery Reference Model identifies 8 steps:
- Identification
- Preservation
- Collection
- Processing
- Review
- Analysis
- Production
- Presentation
What’s the formula for determining the number of keys needed for everyone to communicate via symmetric keys?
The formula for determining the number of encryption keys required by a symmetric algorithm is ((n*(n-1))/2). With six users, you will need ((6*5)/2), or 15 keys
What is TKIP and where was it used?
TKIP
Temporal Key Integrity Protocol (TKIP) was designed as the replacement for WEP without requiring replacement of legacy wireless hardware. TKIP was implemented into 802.11 wireless networking under the name WPA (Wi-Fi Protected Access). TKIP improvements include a key-mixing function that combines the initialization vector (IV) (i.e., a random number) with the secret root key before using that key with RC4 to perform encryption; a sequence counter is used to prevent packet replay attacks; and a strong integrity check named Michael is used.
TKIP and WPA were officially replaced by WPA2 in 2004. Additionally, attacks specific to WPA and TKIP (i.e., coWPAtty and a GPU-based cracking tool) have rendered WPA’s security unreliable.
What are the five steps of penetration testing?
- Discovery - Footprinting and gathering information about the target
- Enumeration - Performaing port scans and resource identification methods
- Vulnerability mapping – Identifying vulnerabiliites in identified systems and resources
- Exploitation - Attempting to gain unauthorized access by exploiting vulnerabilities
- Report to management - Delivering to management documentation test findings along with suggested countermeasures
What are the 4 types of fires and their suppression mechanisms?
What’s the difference between a SOC1 security Audit and a SOC2 Security Audit?
The SOC1 audit focuses on a description of security mechanisms to assess their suitability.
The SOC2 audit focuses on implemented security controls in relation to availability, security, integrity, privacy, and confidentiality.
What is a SOC2 Type 1 Report?
With a SOC2 / Type 1 report, your organization’s controls are assessed at a specific point in time. This report acts as a snapshot of your environment to determine and demonstrate if the controls are suitably designed and in place. For example, we will take an example terminated employee and confirm that their access was properly revoked and documented via a ticketing system.
A Type 1 report has the following characteristics:
Description of your organization’s system as a whole
Assesses the design of your organization’s internal controls
Tests a specific point in time
What is a SOC2 Type 2 report?
Type 2 Report
For a Type 2 report, your organization’s controls are assessed over a period of time, typically a twelve-month review period. Unlike a Type 1 report, Type 2 acts as a historical review of your environment to determine and demonstrate if the controls are suitably designed and in place, as well as operating effectively over time. The audit process will include sample testing within the review period to determine if your organization’s controls are operating effectively. For instance, we will take a sample of employees from the population of terminated personnel and confirm that their access was properly revoked and documented via ticketing system during the agreed-upon review period.
A Type 2 report has the following characteristics:
Description of your organization’s system as a whole
Assesses the design of your organization’s controls, as well as their operating effectiveness
Focuses on a period of time in which the controls are operating
Features detailed descriptions of the auditor’s tests and test results of the controls
Since a Type 2 report is more granular and comprehensive than a Type 1 report, it often provides your clients with a higher level of assurance.
What’s the difference between IPSec transport mode vs. tunnel mode?
ESP’s Transport mode encrypts IP packet data but leaves the packet header unencrypted.
ESP Tunnel mode encrypts the entire packet and adds a new header to support transmission through the tunnel.
How does Software Subcontract Management fit in to the SW-CMM?
It’s part of level 2 - Repeatable
What’s the difference between KPI’s and KRI’s?
Key risk indicators (KRIs) are often used to monitor risk for organizations that establish an ongoing risk management program. Using automated data gathering and tools that allow data to be digested and summarized can provide predictive information about how organizational risks are changing.
KPIs are key performance indicators, which are used to assess how an organization is performing. Quantitative risk assessments are good for point-in-time views with detailed valuation and measurement-based risk assessments, whereas a penetration test would provide details of how well an organization’s security controls are working.
What are the four commercial data classifications?
The commercial classification scheme discussed by (ISC)2 includes four primary classification levels:
- confidential,
- private,
- sensitive,
- public.
Secret is a part of the military classification scheme.
Danielle is testing tax software, and part of her testing process requires her to input a variety of actual tax forms to verify that the software produces the right answers. What type of testing is Danielle performing?
Use Case Testing
Testing for desired functionality is use case testing. Dynamic testing is used to determine how code handles variables that change over time. Misuse testing focuses on how code handles examples of misuse, and fuzzing feeds unexpected data as an input to see how the code responds.
What are the 3 sets of private addresse ranges per RCF 1918?
Also, what is the microsoft private address range?
- Class A: 10.0.0.0 to 10.255.255.255,
- Class B: 172.16.0.0 to 172.31.255.255,
- Class C: 192.168.0.0 to 196.168.255.255
These should never be routable on the public Internet.
Microsoft APIPA address between 169.254.0.1 and 169.254.255.254
What is the minimum number of people who should be trained on any specific business continuity plan implementation task?
2
Organizations should train at least two individuals on every business continuity plan task. This provides a backup in the event the primary responder is not available.
What’s the relationship between rights, permissions, privileges and roles?
Typically:
- Permissions include both the access and actions that you can take on an object.
- Rights usually refer to the ability to take action on an object, and don’t include the access to it.
- Privileges combine rights and permissions,
- Roles describe sets of privileges based on job tasks or other organizational artifacts.
Name Two TCP header flags that are rarely used.
- CWR and ECE
Congestion Window Reduced (CWR) and ECN-Echo (ECE) are used to manage transmission over congested links, and are rarely seen in modern TCP networks.
What’s the difference between a power Fault, Blackout, Sag and Brownout?
- Fault is a momentary loss of power.
- Blackouts are sustained complete losses of power.
- Sags and Brownouts are not complete power disruptions but rather periods of low voltage conditions.
Lauren’s team of system administrators each deal with hundreds of systems with varying levels of security requirements and find it difficult to handle the multitude of usernames and passwords they each have. What type of solution should she recommend to ensure that passwords are properly handled and that features like logging and password rotation occur?
Lauren’s team would benefit from a credential management system. Credential management systems offer features like password management, multifactor authentication to retrieve passwords, logging, audit, and password rotation capabilities. A strong password policy would only make maintenance of passwords for many systems a more difficult task if done manually. Single sign-on would help if all of the systems had the same sensitivity levels, but different credentials are normally required for higher sensitivity systems.
There is a significant conflict between the drive for profit and the security requirements that Olivia’s organization has standardized. Olivia’s role means that decreased usability and loss of profit due to her staff’s inability to use the system is her major concern. What is the most likely role that Olivia plays in her organization?
Business Manager or Mission owner?
The business or mission owner’s role is responsible for making sure systems provide value. When controls decrease the value that an organization gets, the business owner bears responsibility for championing the issue to those involved. There is not a business manager or information security analyst role in the list of NIST-defined data security roles. A data processor is defined but acts as a third-party data handler and would not have to represent this issue in Olivia’s organization.
In the ring protection model, what’s in each ring?
What runs in user mode, what runs in privileged mode?
- Ring 0 The kernel lies within the central ring, Ring 0.
- Ring 1 contains other operating system components.
- Ring 2 is used for drivers and protocols.
- Ring 3 - User-level programs and applications run at Ring 3.
Rings 0–2 run in privileged mode whereas Ring 3 runs in user mode.
Metrics like the attack vector, complexity, exploit maturity, and how much user interaction is required are all found in what scoring system?
CVSS
- CVSS - The Common Vulnerability Scoring System (CVSS) uses measures such as attack vector, complexity, exploit maturity, and how much user interaction is required as well as measures suited to local concerns.
- CVE is the Common Vulnerabilities and Exposures dictionary,
- CNA is the CVE Numbering Authority, and
- NVD is the National Vulnerability Database.
In which of the following circumstances does an individual not have a reasonable expectation of privacy?
Placing a telephone call on cell phone?
Sending email at work?
An individual does not have a reasonable expectation of privacy when any communication takes place using employer-owned communications equipment or accounts.
What are the characteristics of the 4 DR tests/reviews?
- Checklist review - the checklist review is the least disruptive type of disaster recovery test. During a checklist review, team members each review the contents of their disaster recovery checklists on their own and suggest any necessary changes.
- TableTop exercise - During a tabletop exercise, team members come together and walk through a scenario without making any changes to information systems.
- Parallel Test During a parallel test, the team actually activates the disaster recovery site for testing but the primary site remains operational.
- Full interruption test, the team takes down the primary site and confirms that the disaster recovery site is capable of handling regular operations. The full interruption test is the most thorough test but also the most disruptive.
What are the maximum cabling distances for:
Cat 5e Ethernet
Coax (RG-58)
Fiber optic
1Category 5e: B. 300 feet.
Coaxial (RG-58): A. 500 feet.
Fiber optic: C. 1+ Kilometers.
What are the Four US government data classifications and what are the characteristics of each?
- Unclassified
- Sensitive, but unclassified
- Confidential data could be expected to cause damage.
- Secret - The U.S. government classifies data that could reasonably be expected to cause damage to national security if disclosed, and for which the damage can be identified or described, as Secret. The U.S. government does not use Classified in its formal four levels of classification.
- Top Secret - Top Secret data could cause exceptionally grave damage,
What are the four common level of sensitivity for Commercial Business?
- Public
- Sensitive
- Private
- Confidential
What’s the purpose of a digital certificate?
The purpose of a digital certificate is to provide the general public with an authenticated copy of the certificate subject’s public key.
When the certificate authority created Renee’s digital certificate, what key did it use to digitally sign the completed certificate?
CA’s private key
The last step of the certificate creation process is the digital signature. During this step, the certificate authority signs the certificate using its own private key.
When Mike receives Renee’s digital certificate, what key does he use to verify the authenticity of the certificate?
CA’s public key
When an individual receives a copy of a digital certificate, he or she verifies the authenticity of that certificate by using the CA’s public key to validate the digital signature contained on the certificate.
Andrew believes that a digital certificate belonging to his organization was compromised and would like to add it to a Certificate Revocation List. Who must add the certificate to the CRL?
Certificates may only be added to a Certificate Revocation List by the certificate authority that created the digital certificate.
What’s the difference between:
- Electronic vaulting
- Transaction logging
- Remote mirroring
- Remote journaling
- Remote journaling transfers transaction logs to a remote site on a more frequent basis than electronic vaulting, typically hourly.
- Transaction logging is not a recovery technique alone; it is a process for generating the logs used in remote journaling.
- Electronic valuting - in an electronic vaulting approach, automated technology moves database backups from the primary database server to a remote site on a scheduled basis, typically daily.
- Remote mirroring maintains a live database server at the backup site and mirrors all transactions at the primary site on the server at the backup site.
Give a brief description of:
- SOC 1, Type 1
- SOC 1, Type 2
- SOC 2
- SOC 3
- SOC 1, Type 1 - A report that provides the auditor’s opinions of financial statements about controls at the service organization and that includes a report on the opinion on the presentation of the service organization’s system as well as suitability of the controls.
- SOC 1, Type 2 - A report that provides an assessment of the risk of material misstatement of financial statement assertions affected by the service organization’s processing and that includes a description of the service auditor’s tests of the controls and the results of the tests and their effectiveness.
- SOC 2 - A report that provides predefined, standard benchmarks for controls involving confidentiality, availability, integrity, and privacy of a system and the information it contains, generally for restricted use.
- SOC 3 - A general use report that reports on controls related to compliance and/or operations.
Jim starts a new job as a system engineer, and his boss provides him with a document entitled “Forensic Response Guidelines.” Which one of the following statements is not true?
Jim must comply with the informatin in this document
Guidelines provide advice based on best practices developed throughout industry and organizations, but they are not compulsory. Compliance with guidelines is optional.
Which one of the following categories of secure data removal techniques would include degaussing?
Purge
The three categories of data destruction are clear (overwriting with nonsensitive data), purge (removing all data), and destroy (physical destruction of the media). Degaussing is an example of a purging technique.
What UDP port is typically used by the syslog service?
514
Fred finds a packet that his protocol analyzer shows with both PSH and URG set. What type of packet is he looking at, and what do the flags mean?
PSH is a TCP flag used to clear the buffer, resulting in immediately sending data, and URG is the TCP urgent flag. These flags are not present in UDP headers.
After you do automated functional testing with 100 percent coverage of an application, what type of error is most likely to remain?
Business Logic Errors
How CISSP exam thinks:
Business logic errors are most likely to be missed by automated functional testing. If a complete coverage code test was conducted, runtime, input validation, and error handling issues are likely to have been discovered by automated testing. Any automated system is more likely to miss business logic errors, because humans are typically necessary to understand business logic issues.
Linda is selecting a disaster recovery facility for her organization, and she wishes to retain independence from other organizations as much as possible. She would like to choose a facility that balances cost and recovery time, allowing activation in about one week after a disaster is declared. What type of facility should she choose?
Warm Site - assume about a week after the disaster
Linda should choose a warm site. This approach balances cost and recovery time. Cold sites take a very long time to activate, measured in weeks or months. Hot sites activate immediately but are quite expensive. Mutual assistance agreements depend on the support of another organization.
What’s the difference between test coverage and code coverage?
Test coverage is computed using the formula test coverage = number of use cases tested/total number of use cases.
Code coverage is assessed by the other formulas, including function, conditional, and total code coverage.
In what type of trusted recovery process is the system able to recover without administrator intervention but the system may suffer some loss of data?
Automated recovery
Automated recovery - In an automated recovery, the system can recover itself against one or more failure types.
Manual Recovery - In a manual recovery approach, the system does not fail into a secure state but requires an administrator to manually restore operations.
In an automated recovery without undue loss, the system can recover itself against one or more failure types and also preserve data against loss.
In function recovery, the system can restore functional processes automatically.
What is the main requirement of the California Online Privacy Protection Act (CalOPPA) ?
California Online Privacy Protection Act (CalOPPA) requires a conspicuously posted privacy policy for any commercial websites or online services that collect personal information on California residents.
What advantage do iris scans have over most other types of biometric factors?
Irises don’t change as much as other factors.
Iris scans have a longer useful life than many other types of biometric factors because they don’t change throughout a person’s lifespan (unless the eye itself is damaged). Iris scanners can be fooled in some cases by high-resolution images of an eye, and iris scanners are not significantly cheaper than other scanners.
Is the Gramm Leach Bliley Act civil or criminal law?
Civil law
Bethany received an email from one of her colleagues with an unusual attachment named smime.p7s. She does not recognize the attachment and is unsure what to do. What is the most likely scenario?
This is an encrypted email message.
The S/MIME secure email format uses the P7S format for encrypted email messages. If the recipient does not have a mail reader that supports S/MIME, the message will appear with an attachment named smime.p7s.
How do you differentiate between an aggregation issue and an inference issue?
Aggregation - is a security issue that arises when a collection of facts has a higher classification than the classification of any of those facts standing alone.
An inference problem occurs when an attacker can pull together pieces of less sensitive information from multiple sources and use them to derive information of greater sensitivity.
In cases where only a single source was used, it will be an aggregation issue.
What’s the difference between a candidate key and a primary key?
Candidate Key - Super key is a set of one or multiple attributes which can uniquely identify a record in a table. A candidate key is a key selected from the set of super keys. Furthermore, the candidate key should not have any redundant attributes.
Primary Key - A primary key is a candidate key. It is considered as the main key for any table. It helps to uniquely identify each row or a record of the table.
Note - Any primary key is, by definition, also a candidate key.
NIST Special Publication 800-53A describes four types of objects that can be assessed. If Ben is reviewing a password standard, which of the four types of objects is he assessing?
A Specification
- Specifications are document-based artifacts like policies or designs.
- Activities are actions that support an information system that involves people.
- Mechanisms are the hardware-, software-, or firmware-based controls or systems in an information system, and an
- Individual is one or more people applying specifications, mechanisms, or activities.
Colleen is conducting a software test that is evaluating code for both security flaws and usability issues. She is working with the application from an end-user perspective and referencing the source code as she works her way through the product. What type of testing is Colleen conducting?
Gray box
In a gray box test, the tester evaluates the software from a user perspective but has access to the source code as the test is conducted. White box tests also have access to the source code but perform testing from a developer’s perspective. Black box tests work from a user’s perspective but do not have access to source code. Blue boxes are a telephone hacking tool and not a software testing technique.
NIST Special Publication 800-92, the Guide to Computer Security Log Management, describes four types of common challenges to log management:
- Many log sources
- Inconsistent log content
- Inconsistent timestamps
- Inconsistent log formats
Which of the following solutions is best suited to solving these issues?
Implement a SIEM
A Security Information and Event Management (SIEM) tool is designed to centralize logs from many locations in many formats and to ensure that logs are read and analyzed despite differences between different systems and devices.
Bryan has a set of sensitive documents that he would like to protect from public disclosure. He would like to use a control that, if the documents appear in a public forum, may be used to trace the leak back to the person who was originally given the document copy. What security control would best fulfill this purpose?
Watermarking
Watermarking alters a digital object to embed information about the source, either in a visible or hidden form. Digital signatures may identify the source of a document but they are easily removed. Hashing would not provide any indication of the document source, since anyone could compute a hash value. Document staining is not a security control.
Carlos is planning a design for a data center that will be constructed within a new four-story corporate headquarters. The building consists of a basement and three above-ground floors. What is the best location for the data center?
A. Basement
B.First floor
C. Second floor
D. Third floor
Second floor
Data centers should be located in the core of a building. Locating it on lower floors makes it susceptible to flooding and physical break-ins. Locating it on the top floor makes it vulnerable to wind and roof damage.
Which one of the following backup types does not alter the status of the archive bit on a file?
A.Full backup
B. Incremental backup
C. Partial backup
D. Differential backup
Differential backups do not alter the archive bit on a file,
whereas incremental and full backups reset the archive bit to 0 after the backup completes.
Partial backups are not a backup type.
The Open Shortest Path First (OSPF) protocol is a routing protocol that keeps a map of all connected remote networks and uses that map to select the shortest path to a remote destination. What type of routing protocol is OSPF?
Link state or Distance vector?
Link State
OSPF is a link state protocol. Link state protocols maintain a topographical map of all connected networks and preferentially select the shortest path to remote networks for traffic. A distance vector protocol would map the direction and distance in hops to a remote network, whereas shortest path first and link mapping are not types of routing protocols.
Fred’s company wants to ensure the integrity of email messages sent via their central email servers. If the confidentiality of the messages is not critical, what solution should Fred suggest?
Digital Signature
Fred’s company needs to protect integrity, which can be accomplished by digitally signing messages. Any change will cause the signature to be invalid. Encrypting isn’t necessary because the company does not want to protect confidentiality. TLS can provide in-transit protection but won’t protect integrity of the messages, and of course a hash used without a way to verify that the hash wasn’t changed won’t ensure integrity either.
The web application that Saria’s development team is working on needs to provide secure session management that can prevent hijacking of sessions using the cookies that the application relies on. Which of the following techniques would be the best for her to recommend to prevent this?
Set the Secure attribute for the cookies, thus forcing TLS.
Setting the Secure cookie will only allow cookies to be sent via HTTPS TLS or SSL sessions, preventing man-in-the-middle attacks that target cookies. The rest of the settings are problematic: Cookies are vulnerable to DNS spoofing. Domain cookies should usually have the narrowest possible scope, which is actually accomplished by not setting the Domain cookie. This allows only the originating server to access the cookie. Cookies without the Expires or Max-age attributes are ephemeral and will only be kept for the session, making them less vulnerable than stored cookies. Normally, the HTTPOnly attribute is a good idea, but it prevents scripting rather than requiring unencrypted HTTP sessions.
Chris uses a packet sniffer to capture traffic from a TACACS+ server. What protocol should he monitor, and what data should he expect to be readable?
TCP; none—TACACS+ encrypts the full session
TACACS+ uses TCP, and encrypts the entire session, unlike RADIUS, which only encrypts the password and operates via UDP.
In a Kerberos context, what system or systems does the service that is being accessed use to validate the ticket?
The client workstation supplies it in the form of a client-to-server ticket and an authenticator.
When a client connects to a service server (SS), it sends the following two messages:
- The client-to-server ticket, encrypted using service’s secret key
- A new authenticator, including the client ID and timestamp that is encrypted using the Client/Server session key.
The server or service that is being accessed receives all of the data it needs in the service ticket. To do so, the client uses a client-to-server ticket received from the Ticket Granting Service.
CDMA, GSM, and IDEN are all examples of what generation of cellular technology?
2G
- 2G Technologies - CDMA, GSM, and IDEN are all 2G technologies.
- 3G Technologies - EDGE, DECT, and UTMS
- 4G technologies include WiMax, LTE, and IEE 802.20 mobile broadband.
Which one of the following fire suppression systems poses the greatest risk of accidental discharge that damages equipment in a data center?
Closed Head
Dry pipe, deluge, and preaction systems all use pipes that remain empty until the system detects signs of a fire. Closed-head systems use pipes filled with water that may damage equipment if there is damage to a pipe.
Saria is the system owner for a healthcare organization. What responsibilities does she have related to the data that resides on or is processed by the systems she owns?
She has to make sure that appropriate security controls are in place to protect the data.
- System owners have to ensure that the systems they are responsible for are properly labeled based on the highest level of data that their system processes, and they have to ensure that appropriate security controls are in place on those systems.
- Data owners own the classification process.
When a vendor develops a product that they wish to submit for Common Criteria evaluation, what do they complete to describe the claims of security for their product?
PP or ST?
ST
Vendors complete security targets (STs) to describe the controls that exist within their product. During the review process, reviewers compare those STs to the entity’s
Protection Profile (PP) to determine whether the product meets the required security controls.
In what type of trusted recovery process does the system recover against one or more failure types without administrator intervention while protecting itself against data loss?
Automated recovery or Automated recovery without undue data loss?
Automated recovery without undue data loss
In an automated recovery, the system can recover itself against one or more failure types. In an automated recovery without undue loss, the system can recover itself against one or more failure types and also preserve data against loss. In function recovery, the system can restore functional processes automatically. In a manual recovery approach, the system does not fail into a secure state but requires an administrator to manually restore operations.
What three important items should be considered if you are attempting to control the strength of signal for a wireless network as well as where it is accessible?
Antenna placement, antenna type, and antenna power levels
Antenna placement, antenna design, and power level control are the three important factors in determining where a signal can be accessed and how usable it is. A captive portal can be used to control user logins, and antenna design is part of antenna types. The FCC does provide maximum broadcast power guidelines but does not require a minimum power level.
Which one of the following metrics specifies the amount of time that business continuity planners find acceptable for the restoration of service after a disaster?
MTD or RTO?
RTO
The recovery time objective (RTO) is the amount of time that it may take to restore a service after a disaster without unacceptable impact on the business. The RTO for each service is identified during a business impact assessment.
What protocol takes the place of certificate revocation lists and adds real-time status verification?
OCSP
The Online Certificate Status Protocol (OCSP) eliminates the latency inherent in the use of certificate revocation lists by providing a means for real-time certificate verification.
What process makes TCP a connection-oriented protocol?
- It works via network connections.
- It uses a handshake.
- It monitors for dropped connections.
- It uses a complex header.
It uses a handshake.
TCP’s use of a handshake process to establish communications makes it a connection-oriented protocol. TCP does not monitor for dropped connections nor does the fact that it works via network connections make it connection-oriented.
What LDAP operation includes authentication to the LDAP server?
Bind
Which one of the following statements about the SDLC is correct?
The waterfall methodology is compatible with the SDLC.
SDLC approaches include steps to provide operational training for support staff as well as end-user training. The SDLC may use one of many development models, including the waterfall and spiral models. The SDLC does not mandate the use of an iterative or sequential approach; it allows for either approach.
The TCP header is made up of elements such as the source port, destination port, sequence number, and others. How many bytes long is the TCP header?
TCP headers can be 20 to 60 bytes long depending on options that are set.
What security considerations should Fred’s company require for sending sensitive data over the cellular network?
They should use the same requirements as data over any public network.
Cellular networks have the same issues that any public network does. Encryption requirements should match those that the organization selects for other public networks like hotels, conference Wi-Fi, and similar scenarios. Encrypting all data is difficult, and adds overhead, so it should not be the default answer unless the company specifically requires it. WAP is a dated wireless application protocol and is not in broad use; requiring it would be difficult. WAP does provide TLS, which would help when in use.
Fred intends to attend a major hacker conference this year. What should he do when connecting to his cellular provider’s 4G network while at the conference?
Connect to his company’s encrypted VPN service.
NIST Special Publication 800-53, revision 4, describes two measures of assurance. Which measure of developmental assurance is best described as measuring “the rigor, level of detail, and formality of the artifacts produced during the design and development of the hardware, software, and firmware components of information systems (e.g., functional specifications, high-level design, low-level design, source code)”?
Depth
NIST Special Publication 800-53 describes depth and coverage. Depth is the level of detail, rigor, and formality of artifacts produced during design and development. Coverage is the breadth and scope of the assessment conducted. If you encounter a question like this and are not familiar with the details of a standard like NIST 800-53, or may not remember them, focus on the meanings of each word and the details of the question. We can easily rule out affirmation, which isn’t a measure. Suitability is a possibility, but depth fits better than suitability or coverage.
Uptown Records Management recently entered into a contract with a hospital for the secure storage of medical records. The hospital is a HIPAA-covered entity. What type of agreement must the two organizations sign to remain compliant with HIPAA?
NDA or BAA?
BAA
HIPAA requires that anyone working with personal health information on behalf of a HIPAA-covered entity be subject to the terms of a business associates agreement (BAA).
What layer of the OSI model is associated with datagrams?
When data reaches the Transport layer, it depends on whether it’s TCP or UDP.
- TCP sends segments
- UDP sends datgrams
Above the Transport layer, data becomes a data stream, while below the Transport layer they are converted to packets at the Network layer, frames at the Data Link layer, and bits at the Physical layer.
What does PGP stand for, what domain is it used in and what protocols does it use?
PGP stands for pretty good privacy
Pretty Good Privacy (PGP) is an encryption program that provides cryptographic privacy and authentication for data communication. PGP is used for signing, encrypting, and decrypting texts, e-mails, files, directories, and whole disk partitions and to increase the security of e-mail communications.
The PGP email system, invented by Phil Zimmerman, uses the “web of trust” approach to secure email. The commercial version uses RSA for key exchange, IDEA for encryption/decryption, and MD5 for message digest production. The freeware version uses Diffie-Hellman key exchange, the Carlisle Adams/Stafford Tavares (CAST) encryption/decryption, and SHA hashing.
On what port do DHCP clients request a configuration?
Dynamic Host Configuration Protocol (DHCP) uses port 68 for client request broadcast and port 67 for server point-to-point response.
What is the popular name for 802.15?
Bluetooth
What Internet standard does all public email comply with?
Internet email must comply with the X.400 standard.
A tunnel mode VPN is used to connect which types of systems?
Hosts and networks
Tunnel mode VPNs are used to connect networks to networks or networks to hosts. Transport mode is used to connect hosts to hosts. Host, server, client, terminal, and domain controller are all synonyms.
Which VPN protocol can be implemented as the payload encryption mechanism when L2TP is used to craft the VPN connection for an IP communication?
IPSec
IPsec is a VPN protocol that can be implemented as the payload encryption mechanism when L2TP is used to craft the VPN connection for an IP communication.
Which type of connection created by a packet-switching networking system reuses the same basic parameters or virtual pathway each time it connects?
Permanent virtual circuit
A PVC reestablishes a link using the same basic parameters or virtual pathway each time it connects. SVCs use unique settings each time. Bandwidth on demand links can be either PVCs or SVCs.
Compare / Contrast the various mobile technologies 1G - 4G
What’s the differene between:
- Strategic planning
- Tactical Planning
- Operational Planning
- Strategic Plan A strategic plan is a long-term plan that is fairly stable. It defines the organization’s security purpose.
- Tactical Plan The tactical plan is a midterm plan developed to provide more details on accomplishing the goals set forth in the strategic plan or can be crafted ad hoc based upon unpredicted events. A tactical plan is typically useful for about a year and often prescribes and schedules the tasks necessary to accomplish organizational goals.
- Operational Plan An operational plan is a short-term, highly detailed plan based on the strategic and tactical plans. It is valid or useful only for a short time. Operational plans must be updated often (such as monthly or quarterly)
What is the main Risk Management Framework that the CISSP exam cares about?
What are its 6 steps?
NIST Special Publication 800-37. There are 6 steps to the Risk Management Framework (RMF).
- Categorize the information system and the information processed, stored, and transmitted by that system based on an impact analysis.
- Select an initial set of baseline security controls for the information system based on the security categorization; tailoring and supplementing the security control baseline as needed based on an organizational assessment of risk and local conditions.
- Implement the security controls and describe how the controls are employed within the information system and its environment of operation.
- Assess the security controls using appropriate assessment procedures to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system.
- Authorize information system operation based on a determination of the risk to organizational operations and assets, individuals, other organizations, and the Nation resulting from the operation of the information system and the decision that this risk is acceptable.
- Monitor the security controls in the information system on an ongoing basis including assessing control effectiveness, documenting changes to the system or its environment of operation, conducting security impact analyses of the associated changes, and reporting the security state of the system to designated organizational officials.”
