Exam 1 Flashcards
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
What are the three main goals of information security? (Select the three best answers.) A. Auditing B. Integrity C. Nonrepudiation D. Confidentiality E. Risk assessment F. Availability
Answers: B, D, and F. Confidentiality, Integrity, and Availability
Explanation: Confidentiality, Integrity, and Availability (known as CIA or the CIA triad) are the three main goals of information security. Another goal within information security is Accountability. See the section titled “Security 101” in Chapter 1, “Introduction to Security,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Which of the following describes an application that accepts more input than it was originally expecting? A. Buffer overflow B. Denial of service (DoS) C. Sandbox D. Brute force
Answer: A. Buffer overflow
Explanation: Buffer overflows occur when an application or an operating system accepts more input than it expects. This could cause a radical behavior in applications especially if the affected memory already has other data in it. A denial of service is a network attack perpetuated on servers to stop them from performing their proper functions for users. Sandbox is when a web script runs in its own environment so that it won’t interfere with other processes; this is often used in testing environments. Brute force is a type of password cracking attack. See the section titled “Securing Other Applications” in Chapter 4, “Application Security,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
A security assessment of an existing application has never been made. Which of the following is the best assessment technique to use to identify an application’s security posture? A. Functional testing B. Threat modeling C. Baseline reporting D. Protocol analysis
Answer: C. Baseline reporting
Explanation: Baseline reporting is the best answer for identifying the application’s security posture. A Security Posture Assessment (SPA) is used to find out the baseline security of an application, a system, or a network, as long as the application (or system or network) already exists. By checking past results and comparing them with current (and future) results, a security professional can see whether an application is secure, or has a “secure posture.” Some applications come with built-in baseline reporting tools, which allow you to tell whether a system is compliant and secure. The other three answers don’t (by definition) associate with the “security posture” of an application. Functional testing is a method of verifying a program by inputting information to the program and analyzing the output. Threat modeling defines a set of possible attacks that could exploit a vulnerability. Protocol analysis deals with examining packet streams with a sniffer or protocol analyzer. See the section titled “Using Tools to Monitor Systems and Networks” in Chapter 11, “Monitoring and Auditing,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Why would a system administrator have both a user-level account and an administrator-level account?
A. To prevent privilege escalation
B. To prevent admin account lockout
C. To prevent password sharing
D. To prevent loss of access through implicit deny
Answer: A. To prevent privilege escalation
Explanation: Some organizations that use UAC might employ a policy where all administrators are expected to log on as their standard user account. With UAC enabled, the “administrator” will not be able to accomplish administrative tasks unless he types in his administrator-level account username and password at the UAC prompt. It’s really UAC that is used to prevent privilege escalation for all users. See the section titled “Securing Wired Networks and Devices” in Chapter 7, “Securing Network Media and Devices,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
What is the best reason why security researchers use virtual machines?
A. To offer a secure virtual environment where they can conduct online deployments
B. To offer an environment where they can discuss security research
C. To offer an environment where network applications can be tested
D. To offer an environment where malware might be executed but with minimal risk to equipment
Answer: D. To offer an environment where malware might be executed but with minimal risk to equipment.
Explanation: The best reason why security researchers use virtual machines is to offer an environment where malware might be executed but with minimal risk to the equipment. This is because the virtual machine is isolated from the actual operating system, and the virtual machine can simply be deleted if it is affected by viruses or other types of malware. Although the other answers are possible reasons why a security researcher would use a virtual machine, the best answer is that it offers the isolated environment where a malicious activity can occur but be easily controlled and monitored. See the section titled “Virtualization Technology” in Chapter 3, “OS Hardening and Virtualization,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
You need to monitor network devices on your network. Which of the following protocols will best help you complete this task? A. ICMP B. SNMP C. SMTP D. NetBIOS
Answer: B. SNMP
Explanation: The Simple Network Management Protocol (SNMP) is meant to be used within network monitoring programs, which are used to monitor the parameters of devices on your network. ICMP stands for Internet Control Message Protocol, which among other things is an integral part of the ping command. SMTP stands for Simple Mail Transfer Protocol, which is used to send mail. NetBIOS stands for Network Basic Input/Output System and provides name services. See the section titled “Using Tools to Monitor Systems and Networks” in Chapter 11, “Monitoring and Auditing,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
You are configuring an 802.11n wireless network. You need to have the best combination of encryption and authorization. Which of the following options should you select? A. WPA2-PSK B. WEP and 802.1x C. WPA-Enterprise D. WPA and TKIP
Answer: C. WPA-Enterprise
Explanation: WPA-Enterprise offers a decent level of encryption (WPA) as well as a powerful means of authorization (Enterprise). Enterprise usually means you are using a separate RADIUS server or something similar to handle the authorization side of things and are not relying on the wireless device itself. While WPA2-PSK offers a better level of encryption, it does not offer authorization the way an enterprise configuration does. WEP and 802.1x does offer a form of authorization, but WEP is deprecated and is not recommended in any scenario. WPA and TKIP offers the same level of encryption as WPA-Enterprise but does not offer authorization. See the section titled “Securing Wireless Networks and Devices” in Chapter 7, “Securing Network Media and Devices,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Tim needs to collect data from users that utilize an Internet-based application. Which of the following should he reference before doing so? A. Secure code review B. SOX C. Acceptable use policy D. Privacy policy
Answer: D. Privacy policy
Explanation: Tim should refer to his organization’s privacy policy before collecting any data from users of the Internet-based application. This policy will dictate whether he is allowed to collect the information he requires. Secure code reviews check for incorrect and possibly risky coding techniques in applications. SOX stands for Sarbanes-Oxley Act, which sets standards for management and public accounting organizations. Acceptable use policies (AUP) state how a network or system may be used. See the section titled “Legislative and Organizational Policies” in Chapter 15, “Policies, Procedures, and People,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
You have been asked to set up a web server that will service regular HTTP requests as well as HTTP secure requests. Which of the following ports would you use by default? (Select the two best answers.) A. 21 B. 25 C. 80 D. 135 E. 443 F. 445
Answers: C. 80 and E. 443
Explanation: The default port for HTTP requests is port 80. The default port for HTTP Secure (HTTPS) requests is port 443. Port 21 is FTP. Port 25 is SMTP. Port 135 is known as the DCE endpoint manager port or RPC (Remote Procedure Call); it is a DCOM related port that is used to remotely manage services and is generally considered insecure. Port 445 is the Server Message Block (SMB) port that deals with Microsoft directory services. See the section titled “Ports and Protocols” in Chapter 5, “Network Design Elements and Network Threats,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Sandy is comparing six different computers on a network. She wants to know which of the systems is more susceptible to attack. Which is the best tool for her to use? A. Vulnerability scanner B. Port scanner C. Ping scanner D. Baseline reporting
Answer: A. Vulnerability scanner
Explanation: The vulnerability scanner will be able to scan for various vulnerabilities on multiple computers. A port scanner would be the next choice but will only tell Sandy which ports are open, not what vulnerabilities the computers have, and by default it will only work with one computer at a time (although this is configurable). Ping scanners can find out what computers exist on the network but won’t display any vulnerabilities. Baseline reporting is used to compare a system’s current configuration to an older configuration to find out its security posture. See the section titled “Assessing Vulnerability with Security Tools” in Chapter 10, “Vulnerability and Risk Assessment,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Which of the following reduces the chances of a single point of failure on a server when it fails? A. Virtualization B. Clustering C. RAID D. Cold site
Answer: B. Clustering
Explanation: Clustering enables a technician to use two or more servers together. In a failover cluster, a failure on the working server will cause that server to be disabled, but the next server in the cluster will then become active; so most single points of failure can be overcome. Virtualization of a server creates an entirely new server in a virtual machine, but it will have the same possibility of a single point of failure as a physical server. RAID (Redundant Array of Inexpensive Disks) reduces the chances of a server’s single point of failure by allowing for fault tolerant disks—but only for disks, and only certain kinds of RAID. If any other points on the server fail, RAID will not be able to recover. A cold site does not have servers ready to go in the case there is a single point of failure on a particular server. However, hot sites could usually recover from these types of issues, though the users might have to physically go to the building depending on the configuration. See the section titled “Redundancy Planning” in Chapter 14, “Redundancy and Disaster Recovery,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Which of the following statements is true about a certificate revocation list (CRL)? A. It should be kept secret. B. It must be encrypted. C. It should be kept public. D. It should be used to sign other keys.
Answer: C. It should be kept public.
Explanation: Certificate revocation lists (CRLs) should be published regularly so that users know whether an issuer’s certificate is valid. If the CRL was secret, it would defy its purpose. The CRL is not usually encrypted but will be digitally signed by the certificate authority (CA). The CRL does not sign any keys; instead the CA takes care of this. See the section titled “Public Key Infrastructure” in Chapter 13, “PKI and Encryption Protocols,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
HIDS and NIDS are similar intrusion detection systems. However, one is for individual computers, and the other is for networks. Which of the following would a HIDS be installed to monitor? A. System files B. CPU performance C. Network adapter performance D. Temporary Internet files
Answer: A. System files
Explanation: HIDS, or host-based intrusion detection system, is software installed to an individual computer to monitor important files and watch for intrusions. System files are some of the most important files that will be monitored by a HIDS. Temporary Internet files are not nearly as important and are usually removed automatically by way of a policy in many organizations. CPU and network adapter performance is usually monitored by some type of performance monitoring program; these are often built into the operating system. See the section titled “Implementing Security Applications” in Chapter 2, “Computer Systems Security,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Thumb drives can be used to compromise systems and enable unauthorized access. What kind of malware was most likely installed to the thumb drive? A. Bot B. Logic bomb C. Virus D. Trojan
Answer: D. Trojan
Explanation: Trojans are used to access a system without authorization. They can be installed to USB flash drives, can be remote access programs, or could be unwittingly stumbled upon when accessing disreputable websites. The key phrase here is “unauthorized access”; that is what the Trojan is trying to do. A bot is a computer that performs actions without the user’s consent and is often controlled by a remote master computer. Though the bot doesn’t enable unauthorized access, a Trojan might carry a bot program as part of its payload. Logic bombs are generally a method of transferring malware and are meant to initiate a malicious function at a specific time. Viruses infect a computer but are not used for unauthorized access. See the section titled “Computer Systems Security Threats” in Chapter 2, “Computer Systems Security,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
You are the systems administrator for your organization. You have been tasked to block database ports at the firewall. Which port should you block? A. 3389 B. 1433 C. 443 D. 53
Answer: B. 1433
Explanation: Port 1433 is used by Microsoft SQL Server databases and should be blocked at the firewall if you want to block SQL Server activity. Port 3389 is used by the Remote Desktop Protocol. Port 443 is used by HTTPS. Port 53 is used by DNS. See the section titled “Ports and Protocols” in Chapter 5, “Network Design Elements and Network Threats,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Your boss speculates that an employee in a sensitive position is committing fraud. What is the best way to identify if this is true? A. Mandatory vacations B. Separation of duties C. Due diligence D. Acceptable usage policy
Answer: A. Mandatory vacations
Explanation: Mandatory vacations should be implemented to help detect (and possibly stop) fraud, sabotage, or other malicious activity on the part of a person working in a sensitive position in an organization. Separation of duties (and job rotation) are employed when more than one person is utilized to complete a task. While this might be a way to identify fraud, it does not take into account the possibility that one user is still committing fraud without the other user(s) noticing. It also doesn’t take into account the chance that all users involved in the job rotation system could be committing fraud together. Mandatory vacations are a better method of detecting ongoing fraud. Due diligence ensures that IT risks are known and managed. Acceptable usage policies define the rules that restrict how a system may be used. See the section titled “Legislative and Organizational Policies” in Chapter 15, “Policies, Procedures, and People,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Your organization’s network has a main office and two remote sites that connect back to the main office solely. You have been tasked with blocking TELNET access into the entire network. Which would be the best way to go about this?
A. Block port 25 on the main office’s firewall
B. Block port 25 on each of the L2 switches at the remote sites
C. Block port 23 on each of the L2 switches at the remote sites
D. Block port 23 on the main office’s firewall
Answer: D. Block port 23 on the main office’s firewall
Explanation: You should block port 23 on the main office’s firewall because by default TELNET uses port 23. Port 25 is used by SMTP. By blocking port 23 on the main office’s firewall you will by default be blocking it for the entire network in the scenario. L2 (layer 2) switches deal with MAC addresses and other principles of the Data Link Layer of the OSI Model. They do not usually have the option to block particular TCP/IP ports. See the section titled “Ports and Protocols” in Chapter 5, “Network Design Elements and Network Threats,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Tom is getting reports from several users that they are unable to download specific items from particular websites although they can access other pages of those websites. Also, they can download information from other websites just fine. Tom’s IDS is also sending him alarms about possible malicious traffic on the network. What is the most likely cause why the users cannot download the information they want?
A. The firewall is blocking web activity.
B. The NIDS is blocking web activity from those specific websites.
C. The NIPS is blocking web activity from those specific websites.
D. The router is blocking web activity.
Answer: C. The NIPS is blocking web activity from those specific websites.
Explanation: The most likely answer is that the network intrusion prevention system (NIPS) is blocking the specific traffic because it has detected that particular downloads could be malicious. A NIDS would only detect this and send alarms to Tom; it would not prevent the traffic. The firewall will usually block entire websites from being accessed, not just prevent specific downloads. The router will not block web activity, although it could block access to particular IP addresses. However, if this was the case, the users would not be able to access the website in question at all. See the section titled “NIDS Versus NIPS” in Chapter 6, “Network Perimeter Security,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Users on your network are identified with tickets. Which of the following systems is being used? A. Kerberos B. RADIUS C. TACACS+ D. LDAP
Answer: A. Kerberos
Explanation: Kerberos is the only authentication system listed that uses tickets to identify users—the ticketing system proves the identity of users. RADIUS uses authentication schemes such as CHAP and EAP. RADIUS and TACACS+ are normally used for remote authentication of users, whereas Kerberos is used in Domains. TACACS+ uses TCP, and RADIUS uses UDP for connections. LDAP is used for accessing and modifying directory services data. See the section titled “Authentication Models and Components” in Chapter 8, “Physical Security and Authentication Models,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Which of the following invalidates SQL injection attacks that were launched from a lookup field of a web server? A. Input validation B. Security template C. NIDS D. Buffer overflow protection
Answer: A. Input validation.
Explanation: Input validation is a process that ensures the correct usage of data. It is important when dealing with any types of forms on a web server. Because these forms can be compromised by various attacks, forms should be coded in such a way where any input from the user will be validated by the web page before it is accepted. For example, if you were to type in six digits in a ZIP code field when it expects only a maximum of five digits, input validation should deny that entry, and if coded properly will ask the user to re-enter the information. Security templates import many secure policies at one time. A NIDS protects an entire network from intrusion. Buffer overflow protection ensures that memory is storing data the way that the developer intended. Input validation also prevents buffer overflow attacks in addition to other types of attacks such as SQL injection attacks. See the section titled “Securing Other Applications” in Chapter 4, “Application Security,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
You want to curtail users from e-mailing confidential data outside your organization. Which of the following would be the best method?
A. Block port 110 on the firewall.
B. Prevent the usage of USB flash drives.
C. Install a network-based DLP device.
D. Implement PGP.
Answer: C. Install a network-based DLP device.
Explanation: A network-based data loss prevention (DLP) device is the best solution listed. This device normally sits on the perimeter of the network and can be configured to analyze traffic for confidential information and prevent it from going outside the network. DLP devices can also be storage-based and endpoint-based, but in this case the network-based DLP would be best. Blocking port 110 on the firewall might stop all outbound POP3 e-mails from leaving the network, and while that would probably stop confidential e-mails from going out, it would cause a whole slew of other problems—as you might imagine! Preventing the usage of flash drives probably wouldn’t affect the scenario either way. PGP is used to encrypt and digitally sign e-mails, which is a decent option when attempting to keep data confidential but won’t help when you want to keep that confidential data from leaving the network. See the section titled “Firewalls and Network Security” in Chapter 6, “Network Perimeter Security,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
What should be incorporated with annual awareness security training? A. Signing of a user agreement B. Implementation of security controls C. User rights and permissions review D. Succession planning
Answer: A. Signing of a user agreement
Explanation: Security awareness training should be coupled with the signing of a user agreement. This agreement states that the user acknowledges and accepts specific rules of behavior, conduct, and nondisclosure of the training. Some organizations might add other policies that the user must agree to as well. Security controls deal with the proper implementation of a security plan. User rights and permissions reviews are part of security audits. Succession planning is the process of developing and readying new servers and other equipment in the case that the current equipment fails, is compromised, or becomes outdated. See the section titled “Legislative and Organizational Policies” in Chapter 15, “Policies, Procedures, and People,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
A critical system in the server room was never connected to a UPS. The security administrator for your organization has initiated an authorized service interruption of the server to fix the problem. Which of the following best describes this scenario? A. Succession planning B. Fault tolerance C. Continuity of operations D. Disaster recovery
Answer: B. Fault tolerance
Explanation: Because the security administrator is deliberately interrupting service in a proactive effort to fix the problem, this scenario would be best described as fault tolerance. Also, the fact that a UPS is being installed to make the system tolerant of power loss lends to the fault tolerance answer. If the administrator was planning how a new server was to be implemented, then it would be succession of planning. Continuity of operations and disaster recovery deal with the scenario of an actual disaster and the planning for recovery from that disaster. See the section titled “Redundancy Planning” in Chapter 14, “Redundancy and Disaster Recovery,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Which of the following devices is used to optimize and distribute data workloads across multiple computers or networks? A. VPN concentrator B. Protocol analyzer C. Proxy server D. Load balancer
Answer: D. Load balancer
Explanation: A load balancer is used to distribute workload across multiple computers or a computer cluster. It could be done by a dedicated hardware or software. VPN concentrators are devices used for remote access. Protocol analyzers are used to examine packets of information that are captured from a computer. Proxy servers act as go-betweens for client computers and the Internet and often cache information that comes from websites. See the section titled “Redundancy Planning” in Chapter 14, “Redundancy and Disaster Recovery,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Which of the following is used to cache content? A. Firewall B. Load balancer C. Proxies D. VPN concentrator
Answer: C. Proxies
Explanation: A proxy is used to cache or store content for later use. An example of this would be an HTTP proxy that remembers the content of a web page that a client computer accessed. This information can then be accessed by other client computers without the computer having to access the Internet. Firewalls are used to protect a network and secure ports. Load balancers are used to distribute workload across two or more computers or networks. VPN concentrators allow for secure encrypted remote access. See the section titled “Firewalls and Network Security” in Chapter 6, “Network Perimeter Security,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Which of the following enables a person to view the IP headers on a data packet? A. Protocol analyzer B. NIDS C. Firewall D. L2 switch
Answer: A. Protocol analyzer
Explanation: A protocol analyzer (or packet sniffer) allows a person to break down a packet and view its contents including IP headers. Network intrusion detection systems (NIDS) detect malicious activity on a network. Firewalls are used to protect the entire network from malicious activity by closing and securing ports. L2 switches are used as central connecting devices for computers on a LAN—they identify each computer by its MAC address. See the section titled “Assessing Vulnerability with Security Tools” in Chapter 10, “Vulnerability and Risk Assessment,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
A programmer wants to prevent cross-site scripting. Which of the following should the programmer implement?
A. Validation of input to remove bit code
B. Validation of input to remove shell scripts
C. Validation of input to remove batch files
D. Validation of input to remove hypertext
Answer: D. Validation of input to remove hypertext
Explanation: Cross-site scripting (XSS) is a vulnerability to web applications. For example, a malicious attacker might attempt to inject hypertext into a standard text-based web form. Shell scripts, batch files, and Java bit code are not associated with XSS attacks. See the section titled “Secure Programming” in Chapter 4, “Application Security,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
You have been asked by your boss to protect the confidentiality of sensitive data entered into a database table. What is the best method to use? A. Encryption B. Hashing C. Secure Copy D. Biometrics
Answer: B. Hashing
Explanation: Hashing is used in databases for indexing and file retrieval and is used to protect the confidentiality of data in database tables. It is faster and easier to use than encryption methods. Secure Copy (SCP) is used to securely transfer files between two computers. Biometrics is the science of identifying humans from their physical characteristics. See the section titled “Hashing Basics” in Chapter 12, “Encryption and Hashing Concepts,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Jane is a systems administrator and must revoke the access of a user who has been terminated. Which policy must she implement? A. Password recovery B. Password expiration C. Account disablement D. Account lockout
Answer: C. Account disablement
Explanation: If an employee is terminated, the employee’s account should be disabled. This way, the employee will not be able to log in to the system, but the history of the user account is still intact and can be viewed by administrators if necessary. There is no need to modify the password recovery or expiration settings. The password will no longer do the user any good, and the administrator should be able to access anything the employee did. Even if the user password is required, it can be reset by the administrator. It would be unwise to lock out the user, because many policies have a timeout on the lockout, thus allowing the user to log back in later on. See the section titled “Rights, Permissions, and Policies” in Chapter 9, “Access Control Methods and Models,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
What is one reason to implement security logging on a DNS server?
A. To perform penetration testing on the server
B. To prevent DNS DoS
C. To watch for unauthorized zone transfers
D. To measure server performance
Answer: C. To watch for unauthorized zone transfers.
Explanation: It is important to log your DNS server to monitor for unauthorized zone transfers. This type of logging can only let you know if an unauthorized zone transfer has occurred; it will not prevent it, nor will it prevent any types of denial of service (DoS) attacks. Penetration testing is usually done with some type of vulnerability scanning software, and performance measuring is usually done with some type of performance monitoring software. See the section titled “Malicious Attacks” in Chapter 5, “Network Design Elements and Network Threats,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
What is the best way to prevent ARP poisoning across a network? A. MAC flooding B. Log analysis C. Loop protection D. VLAN segregation
Answer: D. VLAN segregation
Explanation: By segregating a network into multiple virtual LANs, ARP poisoning attacks will hopefully falter when trying to cross from one VLAN to the next. This isn’t always successful, but it is one smart way to try to avoid ARP poisoning attacks. A MAC flood is an attack where numerous packets are sent to a switch, each with a different MAC address. Log analysis is used to determine what happened at a specific time on a particular system. Loop protection can be enabled on some switches, which protects from a person connecting both ends of a patch cable to two different switch ports on a switch. See the section titled “Malicious Attacks” in Chapter 5, “Network Design Elements and Network Threats,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Stephen has been instructed to update all three routers’ firmware for his organization. Where should he document his work? A. Change management system B. Router system log C. Event Viewer D. Chain of custody
Answer: A. Change management system
Explanation: Change management is the structured way of making changes to systems and devices. It includes implementation, testing, monitoring, and documentation. Routers will have logs, not necessarily called a system log, which can be used to identify what has happened on the router in the past, but these aren’t used to document work done to the router. The Event Viewer contains the log files in Microsoft operating systems. A chain of custody is the chronological documentation of evidence but does not include work done on a regular basis to routers or other equipment. See the section titled “Legislative and Organizational Policies” in Chapter 15, “Policies, Procedures, and People,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Which of the following would be installed on a single computer to prevent intrusion? A. Network firewall B. Host-based firewall C. Host intrusion detection system D. VPN concentrator
Answer: B. Host-based firewall
Explanation: Firewalls are designed to prevent intrusion. To prevent intrusion on a single computer, install a host-based firewall. Another viable option would be to install a host-based intrusion prevention system (HIPS) but not a host-based intrusion detection system (HIDS) since the HIDS will only detect the intrusion, not prevent it. A VPN concentrator is used to enable secure remote connections between hosts and networks. See the section titled “Implementing Security Applications” in Chapter 2, “Computer Systems Security,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
One of the users in your organization informs you that her 802.11n network adapter is connecting and disconnecting to and from an access point that was recently installed. The user has Bluetooth enabled on the laptop. A neighboring company had its wireless network compromised last week. Which of the following is the most likely cause of the disconnections?
A. The attacker that compromised the neighboring company is running a wardriving attack.
B. A Bluetooth device is interfering with the user’s laptop.
C. An attacker in your organization is attempting a bluejacking attack.
D. The new access point was not properly configured and is interfering with another access point.
Answer: D. The new access point was not properly configured and is interfering with another access point.
Explanation: The most likely cause is that the new access point that the laptop is connecting to was not configured properly. Perhaps the antennae were not set to a high enough power level, or the placement of the AP is not close enough to the laptop. Less likely is the possibility that an attacker is running a wardriving attack against your network. It is possible that a Bluetooth device is causing interference (since both share the 2.4 GHz spectrum), but it is also less likely. A bluejacking attack (if successful) would probably not affect the ability for an 802.11n network adapter to connect with an access point. See the section titled “Securing Wireless Networks” in Chapter 7, “Securing Network Media and Devices,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
You have critical backups that are made at night and taken to an offsite location. Which of the following would allow for a minimal amount of downtime in the case of a disaster?
A. Have a backup server at the offsite location
B. Make the offsite location into a hot site
C. Make the offsite location into a warm site
D. Make the offsite location into a cold site
Answer: B. Make the offsite location into a hot site
Explanation: A hot site would be the best option in the case of a disaster because it can be up and running faster than any of the other answers listed. A backup server is only a single facet of many organizations’ disaster recovery plans. Warm sites and cold sites do not offer as little downtime as a hot site does. See the section titled “Redundancy Planning” in Chapter 14, “Redundancy and Disaster Recovery,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
What is the purpose of LDAP authentication services?
A. To prevent multifactor authentication
B. To act as a single point of management
C. To implement MAC
D. To issue one-time passwords
Answer: B. To act as a single point of management
Explanation: LDAP (Lightweight Directory Access Protocol) contains the directory for a network and allows for a single point of user management of that directory. Multifactor authentication is when more than one type of identification is required to gain access to a system, network or building. MAC (Mandatory Access Control) is a type of access control system not usually associated with LDAP. One-time passwords can be issued by several technologies including RSA tokens. See the section titled “Authentication Models and Components” in Chapter 8, “Physical Security and Authentication Models,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Where would you store a revoked certificate? A. Key escrow B. Recovery agent C. CRL D. PKI
Answer: C. CRL
Explanation: The CRL (certificate revocation list) is where revoked certificates should be stored. Key escrow is when certificate keys are held in the case that third parties need to access information. The recovery agent is used to recover lost keys. PKI stands for Public Key Infrastructure, which is the entire system of parts that allows for certificates, certificate authorities, and so on. See the section titled “Public Key Infrastructure” in Chapter 13, “PKI and Encryption Protocols,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
An attacker uses a method that is meant to obtain information from a specific person. What type of attack is this? A. Spear phishing B. DNS poisoning C. Pharming D. Fraggle
Answer: A. Spear phishing
Explanation: Spear phishing is the attempt at fraudulently obtaining information from specific individuals—usually done through e-mail. DNS poisoning is a compromise of a DNS server’s name cache database. Pharming is an attack that redirects a website’s traffic to another illegitimate website. A Fraggle attack contains UDP traffic sent to port 7 and 19—it is a type of DoS attack. See the section titled “Social Engineering” in Chapter 15, “Policies, Procedures, and People,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Which of the following is a type of photo ID that is used by government officials to gain access to secure locations? A. Biometrics B. DAC C. RSA tokens D. CAC
Answer: D. CAC
Explanation: CAC (Common Access Card) is a smart card used by the DoD to identify military personnel, government employees, and so on. Biometrics is the science of using a human’s physical characteristics for identification. DAC is the Discretionary Access Control method. RSA tokens allow for rolling one-time passwords. See the section titled “Physical Security” in Chapter 8, “Physical Security and Authentication Models,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Which of following best describes a NIDS?
A. Used to attract and trap potential attackers
B. Filters out various types of Internet activities such as websites accessed
C. Detects malicious network activities such as port scans and DoS attacks
D. Redirects malicious traffic
Answer: C. Detects malicious network activities such as port scans and DoS attacks
Explanation: NIDS, or network intrusion detection system, detects malicious network activities such as port scans and DoS attacks. A honeypot or honeynet is used to attract and trap potential attackers. An Internet filter filters out various types of Internet activities such as websites accessed. A NIPS, or network intrusion prevention system, removes, detains, or redirects malicious traffic. See the section titled “NIDS Versus NIPS” in Chapter 6, “Network Perimeter Security,” for more information.
