Everything Flashcards
All in one spot cause I got tired of sorting them by sections.
Which of the following is the BEST approach to perform risk mitigation of user access control rights?
A. Conduct surveys and rank the results.
B. Perform routine user permission reviews.
C. Implement periodic vulnerability scanning.
D. Disable user accounts that have not been used within the last two weeks.
n
Used in conjunction, which of the following are PII? (Select TWO).
A. Marital status B. Favorite movie C. Pet's name D. Birthday E. Full name
n
In a disaster recovery situation, operations are to be moved to an alternate site. Computers and network connectivity are already present; however, production backups are several days out-of- date. Which of the following site types is being described?
A. Cold site
B. High availability site
C. Warm site
D. Hot site
n
Which of the following malware types is an antivirus scanner MOST unlikely to discover? (Select TWO).
A. Trojan B. Pharming C. Worms D. Virus E. Logic bomb
n
Which of the following threats corresponds with an attacker targeting specific employees of a company?
A. Spear phishing
B. Phishing
C. Pharming
D. Man-in-the-middle
n
Which of the following attacks would password masking help mitigate?
A. Shoulder surfing
B. Brute force
C. Tailgating
D. Impersonation
n
If cookies with non-random sequence numbers are issued upon authentication, which of the following attack types can occur?
A. Directory traversal
B. Session hijacking
C. Cross-site scripting
D. SQL injection
n
Two systems are being designed. System A has a high availability requirement. System B has a high security requirement with less emphasis on system uptime. Which of the following configurations BEST fits the need for each system?
A. System A fails open. System B fails closed.
B. System A and System B both fail closed.
C. System A and System B both fail open.
D. System A fails closed. System B fails open.
n
An existing application has never been assessed from a security perspective. Which of the following is the BEST assessment technique in order to identify the application’s security posture?
A. Baseline reporting
B. Protocol analysis
C. Threat modeling
D. Functional testing
n
A security firm has been engaged to assess a software application. A production-like test environment, login details, production documentation and source code have been provided. Which of the following types of testing is being described?
A. White box
B. Gray box
C. Black box
D. Red teaming
n
A user has forgotten their account password. Which of the following is the BEST recovery strategy?
A. Upgrade the authentication system to use biometrics instead.
B. Temporarily disable password complexity requirements.
C. Set a temporary password that expires upon first use.
D. Retrieve the user password from the credentials database.
n
All of the following are valid cryptographic hash functions EXCEPT:
A. RIPEMD.
B. RC4.
C. SHA-512.
D. MD4.
n
When a certificate issuer is not recognized by a web browser, which of the following is the MOST common reason?
A. Lack of key escrow
B. Self-signed certificate
C. Weak certificate pass-phrase
D. Weak certificate cipher
n
Which of the following PKI components identifies certificates that can no longer be trusted?
A. CRL
B. CA public key
C. Escrow
D. Recovery agent
n
Which of the following can prevent an unauthorized person from accessing the network by plugging into an open network jack?
A. 802.1x
B. DHCP
C. 802.1q
D. NIPS
n
MAC filtering is a form of which of the following?
A. Virtualization
B. Network Access Control
C. Virtual Private Networking
D. Network Address Translation
n
Which of the following authentication protocols forces centralized wireless authentication?
A. WPA2-Personal
B. WPA2-Enterprise
C. WPA2-CCMP
D. WPA2-TKIP
n
A company that purchases insurance to reduce risk is an example of which of the following?
A. Risk deterrence
B. Risk acceptance
C. Risk avoidance
D. Risk transference
n
Which of the following is a method to prevent ad-hoc configuration mistakes?
A. Implement an auditing strategy
B. Implement an incident management strategy
C. Implement a patch management strategy
D. Implement a change management strategy
n
Which of the following risks may result from improper use of social networking and P2P software?
A. Shoulder surfing
B. Denial of service
C. Information disclosure
D. Data loss prevention
n
Which of the following malware types is BEST described as protecting itself by hooking system processes and hiding its presence?
A. Botnet
B. Rootkit
C. Logic bomb
D. Virus
n
A computer is put into a restricted VLAN until the computer’s virus definitions are up-to-date. Which of the following BEST describes this system type?
A. NAT
B. NIPS
C. NAC
D. DMZ
n
Which of the following would be used for secure remote terminal access?
A. SSH
B. TFTP
C. SCP
D. SFTP
n
Without validating user input, an application becomes vulnerable to all of the following EXCEPT:
A. buffer overflow.
B. command injection.
C. spear phishing.
D. SQL injection.
n
After verifying that the server and database are running, Jane, the administrator, is still unable to make a TCP connection to the database. Which of the following is the MOST likely cause for this?
A. The server has data execution prevention enabled
B. The server has TPM based protection enabled
C. The server has HIDS installed
D. The server is running a host-based firewall
n
Which of the following is used to detect unknown security vulnerability?
A. Application fuzzing
B. Application configuration baseline
C. Patch management
D. ID badge
n
Which of the following is a best practice before deploying a new desktop operating system image?
A. Install network monitoring software
B. Perform white box testing
C. Remove single points of failure
D. Verify operating system security settings
n
Securing mobile devices involves which of the following checklists?
A. Key escrow, trust model, CRL
B. Cross-site scripting, XSRF, fuzzing
C. Screen lock, encryption, remote wipe
D. Black box, gray box, white box testing
n
Which of the following steps should follow the deployment of a patch?
A. Antivirus and anti-malware deployment
B. Audit and verification
C. Fuzzing and exploitation
D. Error and exception handling
n
Lack of internal security resources and high availability requirements are factors that may lead a company to consider:
A. patch management.
B. encryption.
C. cloud computing.
D. anti-malware software.
n
Which of the following is the BEST filtering device capable of stateful packet inspection?
A. Switch
B. Protocol analyzer
C. Firewall
D. Router
n
An employee’s workstation is connected to the corporate LAN. Due to content filtering restrictions, the employee attaches a 3G Internet dongle to get to websites that are blocked by the corporate gateway. Which of the following BEST describes a security implication of this practice?
A. A corporate LAN connection and a 3G Internet connection are acceptable if a host firewall is installed.
B. The security policy should be updated to state that corporate computer equipment should be dual-homed.
C. Content filtering should be disabled because it may prevent access to legitimate sites.
D. Network bridging must be avoided, otherwise it may join two networks of different classifications.
n
In order to provide flexible working conditions, a company has decided to allow some employees remote access into corporate headquarters. Which of the following security technologies could be used to provide remote access? (Select TWO).
A. Subnetting B. NAT C. Firewall D. NAC E. VPN
n
If a security issue is resolved, which of the following risk management strategies was used?
A. Deterrence
B. Acceptance
C. Mitigation
D. Avoidance
n
Which of the following would be used when a higher level of security is desired for encryption key storage?
A. TACACS+
B. L2TP
C. LDAP
D. TPM
n
Which of the following is the default port for SCP and SSH?
A. 21
B. 22
C. 404
D. 443
h
Which of the following default ports does the hypertext transfer protocol use for non-secure network connections?
A. 20
B. 21
C. 80
D. 8080
h
Which of the following BEST describes using a smart card and typing in a PIN to gain access to a system?
A. Biometrics
B. PKI
C. Single factor authentication
D. Multifactor authentication
h
Which of the following result types would Jane, a security administrator, MOST likely look for during a penetration test?
A. Inability to gain administrative access
B. Open ports
C. Ability to bypass security controls
D. Incorrect configurations
h
A small business owner has asked the security consultant to suggest an inexpensive means to deter physical intrusions at their place of business. Which of the following would BEST meet their request?
A. Fake cameras
B. Proximity readers
C. Infrared cameras
D. Security guards
h
Employee badges are encoded with a private encryption key and specific personal information. The encoding is then used to provide access to the network. Which of the following describes this access control type?
A. Smartcard
B. Token
C. Discretionary access control
D. Mandatory access control
h
Which of the following devices would MOST likely have a DMZ interface?
A. Firewall
B. Switch
C. Load balancer
D. Proxy
h
Which of the following is used to digitally sign an email?
A. Private key
B. Public key
C. Sender’s IP
D. Sender’s MAC address
h
Pete, the company Chief Information Officer (CIO), has been receiving numerous emails from the help desk directing Pete to a link to verify credentials. Which of the following attacks is underway?
A. Replay attack
B. Pharming
C. Privilege escalation
D. Spear phishing
h
Pete, a security administrator, noticed that the network analyzer is displaying packets that have all the bits in the option field turned on. Which of the following attacks is underway?
A. X-mas
B. DDoS
C. Birthday
D. Smurf
h
Which of the following tools would Matt, a security administrator, MOST likely use to analyze a malicious payload?
A. Vulnerability scanner
B. Fuzzer
C. Port scanner
D. Protocol analyzer
h
Which of the following is Jane, a security administrator, MOST likely to install in order to capture and analyze zero day exploits?
A. Honeypot
B. Antivirus
C. IPS
D. IDS
h
Which of the following can be implemented to detect file system variations?
A. EXT3
B. Hashing
C. Encryption
D. NIDS
h
Which of the following threats is MOST likely to be mitigated by implementing cross-site scripting prevention tools?
A. Resource starvation
B. Insider threat
C. Spear phishing
D. Session hijacking
h
An attacker has gained access to the corporate network and is attempting to brute force a password to gain access to the accounting system. Which of the following, if implemented, will protect the server?
A. Single sign-on
B. Password history
C. Limit logon attempts
D. Directory services
h
Pete, a security administrator, wants to check user password complexity. Which of the following is the BEST tool to use?
A. Password history
B. Password logging
C. Password cracker
D. Password hashing
h
Which of the following can hide confidential or malicious data in the whitespace of other files (e.g. JPEGs)?
A. Hashing
B. Transport encryption
C. Digital signatures
D. Steganography
D
Certificates are used for: (Select TWO).
A. client authentication. B. WEP encryption. C. access control lists. D. code signing. E. password hashing.
h
When implementing SSL VPN, which of the following is the FASTEST cipher that Pete, an administrator, can use?
A. 3DES
B. AES
C. DES
D. RC4
h
Which of the following network devices will prevent port scans?
A. Firewall
B. Load balancers
C. NIDS
D. Sniffer
h
Which of the following is an operational control?
A. Concurrent session control
B. System security categorization
C. Contingency planning
D. Session locks
h
Which of the following is a hardware based encryption device?
A. EFS
B. TrueCrypt
C. TPM
D. SLE
h
List the Hardware Decrytion devices
h
Which of the following is the MOST important step for preserving evidence during forensic procedures?
A. Involve law enforcement
B. Chain of custody
C. Record the time of the incident
D. Report within one hour of discovery
h
Employees of a company have received emails that fraudulently claim to be from the company’s security department. The emails ask the employees to sign-on to an Internet website to verify passwords and personal information. This is an example of which type of attack?
A. Phishing
B. Pharming
C. Man-in-the-middle
D. Vishing
h
A company has implemented software to enforce full disk and removable media encryption for all computers. Which of the following threats can still expose sensitive data on these computers?
A. Spam
B. Botnet infection
C. Stolen laptop
D. Header manipulation
h
Which of the following MOST interferes with network-based detection techniques?
A. Mime-encoding
B. SSL
C. FTP
D. Anonymous email accounts
h
Which of the following secure coding concepts can prevent the unintentional execution of malicious code entered in place of proper commands?
A. Patch management
B. Proper exception handling
C. Code reviews
D. Input validation
h
A certificate authority takes which of the following actions in PKI?
A. Signs and verifies all infrastructure messages
B. Issues and signs all private keys
C. Publishes key escrow lists to CRLs
D. Issues and signs all root certificates
h
To ensure the security of a PKI, security technicians should regularly update which of the following, by checking with the CA for newer versions?
A. CRLs
B. Expiration lists
C. Preshared keys
D. Public keys
h
Use of a smart card to authenticate remote servers remains MOST susceptible to which of the following attacks?
A. Malicious code on the local system
B. Shoulder surfing
C. Brute force certificate cracking
D. Distributed dictionary attacks
n
An administrator is provided two accounts: one with administrative access but not network services, and the other account with other network services but no administrative access. Which of the following describes this scenario?
A. Least privilege
B. Mandatory access control
C. Multifactor authentication
D. Separation of duties
n
Separation of duties is often implemented between developers and administrators in order to separate which of the following?
A. More experienced employees from less experienced employees
B. Changes to program code and the ability to deploy to production
C. Upper level management users from standard development employees
D. The network access layer from the application access layer
n
Which of the following will require exceptions when considering the use of 802.1x port security?
A. Switches
B. Printers
C. Laptops
D. Desktops
n
Which of the following may cause Jane, the security administrator, to seek an ACL work around?
A. Zero day exploit
B. Dumpster diving
C. Virus outbreak
D. Tailgating
n
Which of the following is MOST likely to lead to a breach of security in which Matt, an unauthorized employee, accidently views sensitive data?
A. Lack of business continuity plan
B. Lack of logging and auditing access to files
C. Lack of chain of custody procedure
D. Lack of data labeling, handling, and disposal policies
n
A security administrator needs to update the OS on all the switches in the company. Which of the following MUST be done before any actual switch configuration is performed?
A. The request needs to be sent to the incident management team.
B. The request needs to be approved through the incident management process.
C. The request needs to be approved through the change management process.
D. The request needs to be sent to the change management team.
n
Jane, an individual, has recently been calling various financial offices pretending to be another person to gain financial information. Which of the following attacks is being described?
A. Phishing
B. Tailgating
C. Pharming
D. Vishing
n
The security administrator wants each user to individually decrypt a message but allow anybody to encrypt it. Which of the following MUST be implemented to allow this type of authorization?
A. Use of CA certificate
B. Use of public keys only
C. Use of private keys only
D. Use of public and private keys
n
Jane, a user in the company, is in charge of various financial roles but needs to prepare for an upcoming audit. She uses the same account to access each financial system. Which of the following security controls will MOST likely be implemented within the company?
A. Account lockout policy
B. Account password enforcement
C. Password complexity enabled
D. Separation of duties
n
Pete, an employee, is granted access to only areas of a network folder needed to perform his job. Which of the following describes this form of access control?
A. Separation of duties
B. Time of day restrictions
C. Implicit deny
D. Least privilege
n
A security administrator notices unusual activity from a default account when reviewing system logs and finds the account has been compromised. After investigating the incident, the administrator determines the account can be disabled to prevent any further incidents because the account was not necessary for any job functions. Which of the following could have prevented this incident?
A. Enhanced password complexity
B. Disabling unnecessary accounts
C. Reviewing centralized logs
D. Disabling unnecessary services
n
A CRL is comprised of:
A. malicious IP addresses.
B. trusted CA’s.
C. untrusted private keys.
D. public keys.
n
Which of the following can be implemented to prevent Matt, a user, from connecting a hub or switch to a single switch port to access network resources with multiple devices? (Select TWO).
A. Subnetting B. NAC C. VLAN D. DMZ E. Port security
n
Which of the following devices utilizes behavior heuristics to detect or prevent intrusion into network resources?
A. NIPS
B. VPN concentrators
C. NAT router
D. Flood guard
n
Which of the following may significantly reduce data loss if multiple drives fail at the same time?
A. Virtualization
B. RAID
C. Load balancing
D. Server clustering
n
Which of the following would MOST likely belong in the DMZ? (Select TWO).
A. Finance servers B. Backup servers C. Web servers D. SMTP gateways E. Laptops
n
Which of the following protocols would MOST likely be implemented if Pete, a user, wants to transfer files reliably from one location to another?
A. SNMP
B. SSH
C. ICMP
D. SFTP
n
Which of the following is a strong cryptographic system used by Windows based systems for authentication?
A. SSO
B. DES
C. NTLMv2
D. LANMAN
n
Which of the following algorithms has well documented collisions? (Select TWO).
A. AES B. MD5 C. SHA D. SHA-256 E. RSA
n
Which of the following describes common concerns when implementing IPS?
A. Legitimate traffic will be incorrectly blocked
B. False negatives will disrupt network throughput
C. Incompatibilities with existing routers will result in a DoS
D. Security alerts will be minimal until adequate traffic is collected
n
Which of the following describes an issue encountered when reconstructing a security incident through the examination of security logs collected from multiple servers?
A. Proprietary log formats prevent review of security alerts
B. Some operating systems do not natively export security logs
C. Security logs are often encrypted
D. Inconsistent time settings interfere with sequential event analysis
n
When verifying file integrity on a remote system that is bandwidth limited, which of the following tool combinations provides the STRONGEST confidence?
A. MD5 and 3DES
B. MD5 and SHA-1
C. SHA-256 and RSA
D. SHA-256 and AES
n
Jane, the security administrator, needs to be able to test malicious code in an environment where it will not harm the rest of the network. Which of the following would allow Jane to perform this kind of testing?
A. Local isolated environment
B. Networked development environment
C. Infrastructure as a Service
D. Software as a Service
n
A company is sending out a message to all users informing them that all internal messages need to be digitally signed. This is a form of which of the following concepts?
A. Availability
B. Non-repudiation
C. Authorization
D. Cryptography
n
While performing basic forensic analysis of a hard drive in Sara’s, the security administrator, possession, which of the following should be verified during the analysis?
A. Witness statements
B. Image hashes
C. Chain of custody
D. Order of volatility
n
A server containing critical data will cost the company $200/hour if it were to be unavailable due to DoS attacks. The security administrator expects the server to become unavailable for a total of two days next year. Which of the following is true about the ALE?
A. The ALE is $48.
B. The ALE is $400.
C. The ALE is $4,800.
D. The ALE is $9,600.
n
Jane, a user, installs software downloaded from a trusted website. The installed software causes unwanted pop-ups for pharmaceuticals. Which of the following BEST describes the type of threat?
A. Trojan
B. Backdoor
C. Spyware
D. Adware
n
Sara, a security administrator, notices a number of ports being scanned on the perimeter firewall. At first the scanning appears random, but after monitoring the logs for 30 minutes, she determines that the whole port range is being scanned and all TCP flags are being turned on. Which of the following BEST describes this type of threat?
A. Smurf attack
B. X-mas attack
C. Spoofing
D. Malicious insider threat
n
The Chief Information Officer (CIO) receives a call from an individual who states they are from the IT department. The caller wants to know the CIOs ID and password to validate their account as part of a yearly account revalidation process. Which of the following BEST describes this scenario?
A. Spam
B. Hoax
C. Spoofing
D. Vishing
n
To reduce an organization’s risk exposure by verifying compliance with company policy, which of the following should be performed periodically?
A. Qualitative analysis
B. Quantitative analysis
C. Routine audits
D. Incident management
n
Which of the following can be implemented if a security administrator wants only certain devices connecting to the wireless network?
A. Disable SSID broadcast
B. Install a RADIUS server
C. Enable MAC filtering
D. Lowering power levels on the AP
n
A system administrator decides to use SNMPv3 on the network router in AuthPriv mode. Which of the following algorithm combinations would be valid?
A. AES-RC4
B. 3DES-MD5
C. RSA-DSA
D. SHA1-HMAC
n
Which of the following are encryption algorithms that can use a 128-bit key size? (Select TWO).
A. AES B. RC4 C. Twofish D. DES E. SHA2
n
Unsolicited address items and messages are discovered on a Chief Information Officer’s (CIO’s) smartphone. Additionally, files on an administrator’s smartphone are changed or missing. Which of the following BEST describes what may have happened?
A. The CIO and the Administrator were both bluesnarfed.
B. The CIO and the Administrator were both bluejacked.
C. The CIO was bluejacked and the Administrator was bluesnarfed.
D. The CIO was bluesnarfed and the Administrator was bluejacked.
n
Which of the following devices, connected to an IDS, would allow capture of the MOST traffic?
A. Switch
B. Router
C. Firewall
D. Hub
n
Encryption is used provide which of the following?
a. Integrity
b. Authentication
c. Confidentiality
d. Authorization
C
A biometric fingerprint scanner is an example of which of the following?
a. Two-factor authentication
b. Single Sign On
c. Single-factor authorization
d. Single-factor authentication
D
A user name, PIN, and a palm scan are all required to authenticate a system. Which of the following is this an example of?
a. SSO
b. Two-factor authentication
c. Single-factor authentication
d. Three-factor authentication
B
A user sees an MD5 hash number beside a file that they wish to download. Which of the following BEST describes a hash?
a. A hash is a unique number that is generated based upon the TCP/IP transmission header and should be verified before download.
b. A hash is a unique number that is generated based upon the files contents and used as the SSL key during download.
c. A hash is a unique number that is generated after the file has been encrypted and used as the SSL key during download.
d. A hash is a unique number that is generated based upon the files contents and should be verified after download.
D
Bob is looking for a biometric authentication system that offers the highest possible level of security even if this increases possible inconvenience for the users. Which of the following factors should be minimized?
a. FRR
b. FAR
c. CER
d. False Negatives
B
In Kerberos what is issued to a user by the KDC when the user successfully logs on?
a. Ticket granting ticket
b. Service ticket
c. Asymmetric key
d. Symmetric key
A
Which of the following security steps must a user complete before access is given to the network?
a. Authentication and password
b. Identification and authentication
c. Identification and authorization
d. Authentication and authorization
B
LDAP is a protocol which enables which of the following?
a. Secure logon to a federated database
b. VPN access to a remote network
c. Transmission of encrypted keys
d. Queries to a directory service
D
Which of the following is the improvement of MS-CHAPv2 over MS-CHAP?
a. Encrypted logon
b. Asymmetric key exchange
c. Mutual authentication
d. SSO
C
What is a difference between TACACS+ and RADIUS
a. RADIUS is a AAA provider
b. TACACS+ is a AAA provider
c. RADIUS encrypts the entire authentication process
d. TACACS+ encrypts the entire authentication process
D
Which of the following is an example of a technical control?
a. Least Privilege
b. Vulnerability assessments
c. Configuration management
d. Media protection
A
Which of the following is an example of a detective control?
a. System backups
b. Change management
c. System hardening
d. Security guard
D
Which access control method provides the highest level of security ?
a. Mandatory
b. Discretionary
c. Role based
d. Rule based
A
RBAC is based on what?
a. Job functions
b. Labels
c. ACL’s
d. Lattice
A
Which access control model is used by NTFS?
a. MAC
b. DAC
c. RBAC
d. DACL
B
An inherent flaw associated with DAC is what?
a. Susceptibility to worms
b. Difficulty of administration
c. Susceptibility to Trojans
d. Weak encryption keys
C
In which access control model does the object owner establish access?
a. MAC
b. RBAC
c. Rule based
d. DAC
D
Which of the following is usually not allowed when conducting video surveillance?
a. Recording audio
b. Recording in low light conditions
c. Recording in color
d. Recording in public areas
A
Which network protocol provides for guaranteed delivery of packets
a. UDP
b. ARP
c. FTP
d. TCP
D
Which packet is withheld in a SYN flood attack?
a. SYN
b. ACK
c. SYN/ACK
d. Broadcast
B
ARP is used to determine which type of address?
a. Logical
b. Network
c. IP
d. Physical
D
Secure LDAP uses which port?
a. 443
b. 389
c. 636
d. 143
C
Which of the following addresses is on the same subnet with 163.252.50.57/22 00110010 ?
a. 163.252.100.71
b. 163.252.47.12
c. 163.252.80.78
d. 163.252.48.90
D
Which device does not understand physical addresses but sends all packets out all its ports?
a. Hub
b. Switch
c. Router
d. VLAN
A
Loop protection on a switch may be provided by what?
a. RTP
b. STP
c. FTP
d. TACACS+
B
Matt, an administrator, notices a flood fragmented packet and retransmits from an email server. After disabling the TCP offload setting on the NIC, Matt sees normal traffic with packets flowing in sequence again. Which of the following utilities was the MOST likely using to view this issue?
A. Spam filter
B. Protocol analyzer
C. Web application firewall
D. Load balancer
n
Which of the following devices can be used to terminate remote user’s established SSL or IPSec tunnels?
(Select TWO).
A. NIDS B. HIPS C. VPN concentrator D. Hub E. Firewall
n
Jane, a user, brings in a laptop from home and gets certificate warnings when connecting to corporate intranet sites. These warnings do not occur when using any of the companies’ workstations. Which of the following is MOST likely the issue?
A. The laptop needs to VPN to bypass the NAC.
B. The corporate intranet servers do not trust the laptop.
C. The laptop’s CRL enrollment has expired.
D. The user’s certificate store does not trust the C A.
n
Which of the following mitigates the loss of a private key in PKI? (Select TWO).
A. Certificate reissue B. Key rotation C. Key escrow D. Auto enrollment E. Recovery agent
n
Which of the following specifications would Sara, an administrator, implement as a network access control?
A. 802.1q
B. 802.3
C. 802.11n
D. 802.1x
n
Which of the following malware types propagates automatically, does not typically hide, requires user interaction, and displays marketing ads?
A. Logic bombs
B. Rootkits
C. Spyware
D. Worms
n
Which of the following malware types typically disguises itself within another piece of software, requires user interaction, and does not execute on a specific date?
A. Logic Bomb
B. Trojan
C. Worm
D. Botnet
n
Which of the following is MOST commonly identified as an ARP spoofing attack where no email is sent, and flags within the TCP packet are irrelevant?
A. Xmas attack
B. Spam attack
C. Man-in-the-middle attack
D. DDoS attack
n
Which of the following is characterized by an attacker attempting to map out an organization’s staff hierarchy in order to send targeted emails?
A. Whaling
B. Impersonation
C. Privilege escalation
D. Spear phishing
n
Which of the following is an attack where Pete spreads USB thumb drives throughout a bank’s parking lot in order to have malware installed on the banking systems?
A. Tailgating
B. Replay attack
C. Virus
D. Social engineering
n
Which of the following attacks significantly relies on staff members wanting to be helpful and supportive of each other?
A. Spoofing
B. Tailgating
C. Dumpster diving
D. Xmas attack
n
Which of the following is an attacker attempting to discover open wireless access points?
A. War driving
B. Packet sniffing
C. War chalking
D. Initialization vector
n
Which of the following protocols provides Pete, an administrator, with the HIGHEST level of security for device traps?
A. ICMP
B. SNMPv3
C. SSH
D. IPSec
n
Which of the following is designed to serve as a risk mitigation strategy?
A. Personally owned devices
B. Disaster recovery plan
C. Calculate proper ROI
D. Zero day exploits
n
Who should be contacted FIRST in the event of a security breach?
A. Forensics analysis team
B. Internal auditors
C. Incident response team
D. Software vendors
n
Which process will determine maximum tolerable downtime?
A. Business Continuity Planning
B. Contingency Planning
C. Business Impact Analysis
D. Disaster Recovery Plan
n
Which of the following provides the MOST protection against zero day attacks via email attachments?
A. Anti-spam
B. Anti-virus
C. Host-based firewalls
D. Patch management
n
Which of the following access controls enforces permissions based on data labeling at specific levels?
A. Mandatory access control
B. Separation of duties access control
C. Discretionary access control
D. Role based access control
n
A username provides which of the following?
A. Biometrics
B. Identification
C. Authorization
D. Authentication
n
Use of group accounts should be minimized to ensure which of the following?
A. Password security
B. Regular auditing
C. Baseline management
D. Individual accountability
n
Privilege creep among long-term employees can be mitigated by which of the following procedures?
A. User permission reviews
B. Mandatory vacations
C. Separation of duties
D. Job function rotation
n
In which of the following scenarios is PKI LEAST hardened?
A. The CRL is posted to a publicly accessible location.
B. The recorded time offsets are developed with symmetric keys.
C. A malicious CA certificate is loaded on all the clients.
D. All public keys are accessed by an unauthorized user.
n
A database server has been compromised via an unpatched vulnerability. An investigation reveals that an application crashed at the time of the compromise. Unauthorized code appeared to be running, although there were no traces of the code found on the file system. Which of the following attack types has MOST likely occurred?
A. Zero day exploit
B. SQL injection
C. LDAP injection
D. Buffer overflow
n
Which of the following would Sara, a security administrator, utilize to actively test security controls within an organization?
A. Penetration test
B. Baselining
C. Code review
D. Vulnerability scan
n
Which of the following assessments would Pete, the security administrator, use to actively test that an application’s security controls are in place?
A. Code review
B. Penetration test
C. Protocol analyzer
D. Vulnerability scan
n
Which of the following would Jane, a security administrator, take advantage of to bypass security controls and gain unauthorized remote access into an organization?
A. Vulnerability scan
B. Dumpster diving
C. Virtualization
D. Penetration test
n
Which of the following would be used to identify the security posture of a network without actually exploiting any weaknesses?
A. Penetration test
B. Code review
C. Vulnerability scan
D. Brute Force scan
n
The finance department is growing and needs additional computers to support growth. The department also needs to ensure that their traffic is separated from the rest of the network. Matt, the security administrator, needs to add a new switch to accommodate this growth. Which of the following MUST Matt configure on the switch to ensure proper network separation?
A. Implicit deny
B. VLAN management
C. Access control lists
D. Flood guards
n
Pete, the security administrator, wants to ensure that only secure protocols are being used to transfer and copy files. Which of the following protocols should he implement?
A. SMTP
B. SCP
C. FTP
D. HTTPS
n
Sara, a security administrator, has recently implemented a policy to ban certain attachments from being sent through the corporate email server. This is an example of trying to mitigate which of the following?
A. SQL injection
B. LDAP injection
C. Cross-site scripting
D. Malicious add-ons
n
Jane, the security administrator, sets up a new AP but realizes too many outsiders are able to connect to that AP and gain unauthorized access. Which of the following would be the BEST way to mitigate this issue and still provide coverage where needed? (Select TWO).
A. Disable the wired ports B. Use channels 1, 4 and 7 only C. Enable MAC filtering D. Disable SSID broadcast E. Switch from 802.11a to 802.11b
n
In the initial stages of an incident response, Matt, the security administrator, was provided the hard drives in question from the incident manager. Which of the following incident response procedures would he need to perform in order to begin the analysis?(Select TWO).
A. Take hashes B. Begin the chain of custody paperwork C. Take screen shots D. Capture the system image E. Decompile suspicious files
n
Which of the following is used to certify intermediate authorities in a large PKI deployment?
A. Root CA
B. Recovery agent
C. Root user
D. Key escrow
n
Which of the following components MUST be trusted by all parties in PKI?
A. Key escrow
B. CA
C. Private key
D. Recovery key
n
