finall Flashcards
Refer to the exhibit. A network security specialist issues the command tcpdump to capture events. What does the number 6337 indicate?
the number of transactions currently captured
the process id of the tcpdump command
the port that tcpdump is listening to
the Snort signature id that tcpdump will watch and capture
the process id of the tcpdump command
After the tcpdump command is issued, the device displays the message, [1] 6337. The message indicates that the process with PID 6337was sent to the background.
How do cybercriminals make use of a malicious iFrame?
The iFrame allows multiple DNS subdomains to be used.
The attacker embeds malicious content in business appropriate files.
The iFrame allows the browser to load a web page from another source.
The attacker redirects traffic to an incorrect DNS server.
The iFrame allows the browser to load a web page from another source.
An inline frame or iFrame is an HTML element that allows the browser to load a different web page from another source.
What is a difference between symmetric and asymmetric encryption algorithms?
Symmetric encryption algorithms are used to encrypt data. Asymmetric encryption algorithms are used to decrypt data.
Symmetric algorithms are typically hundreds to thousands of times slower than asymmetric algorithms.
Symmetric encryption algorithms are used to authenticate secure communications. Asymmetric encryption algorithms are used to repudiate messages.
Symmetric encryption algorithms use pre-shared keys. Asymmetric encryption algorithms use different keys to encrypt and decrypt data.
Symmetric encryption algorithms use pre-shared keys. Asymmetric encryption algorithms use different keys to encrypt and decrypt data.
Asymmetric algorithms can use very long key lengths in order to avoid being hacked. This results in the use of significantly increased resources and time compared to symmetric algorithms.
What is a network tap?
a Cisco technology that provides statistics on packets flowing through a router or multilayer switch
a technology used to provide real-time reporting and long-term analysis of security events
a feature supported on Cisco switches that enables the switch to copy frames and forward them to an analysis device
a passive device that forwards all traffic and physical layer errors to an analysis device
a passive device that forwards all traffic and physical layer errors to an analysis device
A network tap is used to capture traffic for monitoring the network. The tap is typically a passive splitting device implemented inline on the network and forwards all traffic, including physical layer errors, to an analysis device.
According to NIST, which step in the digital forensics process involves preparing and presenting information that resulted from scrutinizing data?
examination
reporting
collection
analysis
reporting¨
NIST describes the digital forensics process as involving the following four steps
Collection – the identification of potential sources of forensic data and acquisition, handling, and storage of that data
Examination – assessing and extracting relevant information from the collected data. This may involve decompression or decryption of the data
Analysis – drawing conclusions from the data. Salient features, such as people, places, times, events, and so on should be documented
Reporting – preparing and presenting information that resulted from the analysis. Reporting should be impartial and alternative explanations should be offered if appropriate
A technician notices that an application is not responding to commands and that the computer seems to respond slowly when applications are opened. What is the best administrative tool to force the release of system resources from the unresponsive application?
Event Viewer
System Restore
Add or Remove Programs
Task Manager
Task Manager
Use the Task Manager Performance tab to see a visual representation of CPU and RAM utilization. This is helpful in determining if more memory is needed. Use the Applications tab to halt an application that is not responding.
Which three technologies should be included in a security information and event management system in a SOC? (Choose three.) firewall appliance threat intelligence VPN connection security monitoring vulnerability tracking intrusion prevention
threat intelligence
security monitoring
vulnerability tracking
Technologies in a SOC should include the following:Event collection, correlation, and analysis Security monitoring Security control Log management Vulnerability assessment Vulnerability tracking Threat intelligence Firewall appliances, VPNs, and IPS are security devices deployed in the network infrastructure.
In which situation is an asymmetric key algorithm used?
An office manager encrypts confidential files before saving them to a removable device.
Two Cisco routers authenticate each other with CHAP.
User data is transmitted across the network after a VPN is established.
A network administrator connects to a Cisco router with SSH.
A network administrator connects to a Cisco router with SSH.
The SSH protocol uses an asymmetric key algorithm to authenticate users and encrypt data transmitted. The SSH server generates a pair of public/private keys for the connections. Encrypting files before saving them to a storage device uses a symmetric key algorithm because the same key is used to encrypt and decrypt files. The router authentication with CHAP uses a symmetric key algorithm. The key is pre-configured by the network administrator. A VPN may use both an asymmetric key and a symmetric encryption algorithm. For example in an IPSec VPN implementation, the data transmission uses a shared secret (generated with an asymmetric key algorithm) with a symmetric encryption algorithm used for performance.
Which two statements are characteristics of a virus? (Choose two.)
A virus replicates itself by independently exploiting vulnerabilities in networks.
A virus typically requires end-user activation.
A virus provides the attacker with sensitive data, such as passwords.
A virus can be dormant and then activate at a specific time or date.
A virus has an enabling vulnerability, a propagation mechanism, and a payload.
A virus typically requires end-user activation.
A virus can be dormant and then activate at a specific time or date.
The type of end user interaction required to launch a virus is typically opening an application, opening a web page, or powering on the computer. Once activated, a virus may infect other files located on the computer or other computers on the same network.
Which Windows Event Viewer log includes events regarding the operation of drivers, processes, and hardware?
system logs
application logs
security logs
setup logs
system logs
By default Windows keeps four types of host logs:
Application logs – events logged by various applications
System logs – events about the operation of drivers, processes, and hardware
Setup logs – information about the installation of software, including Windows updates
Security logs – events related to security, such as logon attempts and operations related to file or object management and access
What is the responsibility of the human resources department when handling a security incident?
Perform actions to minimize the effectiveness of the attack and preserve evidence.
Review the incident policies, plans, and procedures for local or federal guideline violations.
Coordinate the incident response with other stakeholders and minimize the damage of the incident.
Apply disciplinary measures if an incident is caused by an employee.
Apply disciplinary measures if an incident is caused by an employee.
The human resources department may be called upon to perform disciplinary measures if an incident is caused by an employee.
Which two net commands are associated with network resource sharing? (Choose two.)
net use net start net share net stop net accounts
net use
net share
A network security professional has applied for a Tier 2 position in a SOC. What is a typical job function that would be assigned to a new employee?
monitoring incoming alerts and verifying that a true security incident has occurred
hunting for potential security threats and implementing threat detection tools
further investigating security incidents
serving as the point of contact for a customer
further investigating security incidents
In a typical SOC, the job of a Tier 2 incident responder involves deep investigation of security incidents.
What are three responsibilities of the transport layer? (Choose three.)
meeting the reliability requirements of applications, if any
identifying the applications and services on the client and server that should handle transmitted data
multiplexing multiple communication streams from many users or applications on the same network
directing packets towards the destination network
formatting data into a compatible form for receipt by the destination devices
conducting error detection of the contents in frames
meeting the reliability requirements of applications, if any
identifying the applications and services on the client and server that should handle transmitted data
multiplexing multiple communication streams from many users or applications on the same network
Which technique is necessary to ensure a private transfer of data using a VPN? scalability authorization virtualization encryption
encryption
Confidential and secure transfers of data with VPNs require data encryption.
As described by the SANS Institute, which attack surface includes the use of social engineering? Internet attack surface software attack surface human attack surface network attack surface
human attack surface
The SANS Institute describes three components of the attack surface:
Network Attack Surface – exploitation of vulnerabilities in networks
Software Attack Surface – exploitation of vulnerabilities in web, cloud, or host-based software applications
Human Attack Surface – exploitation of weaknesses in user behavior
Which scenario is probably the result of activities by a group of hacktivists?
The major power grid in a country is experiencing frequent attacks from another country.
The central database of student grades is accessed and a few grades are modified illegally.
The sales record files of recent years in a large company suddenly cannot be opened and an offer comes forward promising that the data could be restored for a hefty fee.
The internal emails related to the handling of an environmental disaster by a petroleum company appear on multiple websites.
The internal emails related to the handling of an environmental disaster by a petroleum company appear on multiple websites.
Hacktivists are typically hackers who protest against a variety of political and social ideas. Hacktivists publicly protest against organizations or governments by posting articles and leaking sensitive information. Accessing school database and changing grades is probably made by a few script kiddies. Offers from someone to restore data for a hefty fee is a ransomware attack. Attacking the major power grid is typically conducted by a government.
Which scenario is probably the result of activities by a group of hacktivists?
The major power grid in a country is experiencing frequent attacks from another country.
The central database of student grades is accessed and a few grades are modified illegally.
The sales record files of recent years in a large company suddenly cannot be opened and an offer comes forward promising that the data could be restored for a hefty fee.
The internal emails related to the handling of an environmental disaster by a petroleum company appear on multiple websites.
The internal emails related to the handling of an environmental disaster by a petroleum company appear on multiple websites.
Hacktivists are typically hackers who protest against a variety of political and social ideas. Hacktivists publicly protest against organizations or governments by posting articles and leaking sensitive information. Accessing school database and changing grades is probably made by a few script kiddies. Offers from someone to restore data for a hefty fee is a ransomware attack. Attacking the major power grid is typically conducted by a government.
What are two advantages of the NTFS file system compared with FAT32? (Choose two.)
NTFS is easier to configure.
NTFS provides more security features.
NTFS allows the automatic detection of bad sectors.
NTFS supports larger partitions.
NTFS allows faster access to external peripherals such as a USB drive.
NTFS allows faster formatting of drives.
NTFS provides more security features.
NTFS supports larger partitions.
The file system has no control over the speed of access or formatting of drives, and the ease of configuration is not file system-dependent.
What two assurances does digital signing provide about code that is downloaded from the Internet? (Choose two.)
The code is authentic and is actually sourced by the publisher.
The code contains no errors.
The code has not been modified since it left the software publisher.
The code contains no viruses.
The code was encrypted with both a private and public key.
The code is authentic and is actually sourced by the publisher.
The code has not been modified since it left the software publisher.
Digitally signing code provides several assurances about the code:
The code is authentic and is actually sourced by the publisher.
The code has not been modified since it left the software publisher.
The publisher undeniably published the code. This provides nonrepudiation of the act of publishing.
Which statement identifies an important difference between the TACACS+ and RADIUS protocols?
TACACS+ provides extensive accounting capabilities when compared to RADIUS.
RADIUS can cause delays by establishing a new TCP session for each authorization request.
The RADIUS protocol encrypts the entire packet transmission.
The TACACS+ protocol allows for separation of authentication from authorization.
The TACACS+ protocol allows for separation of authentication from authorization.
One key difference between TACACS+ and RADIUS protocols is that TACACS+ provides flexibility by separating authentication and authorization processes. RADIUS, on the other hand, combines authentication and authorization as one process.
What is a function of SNMP?
synchronizes the time across all devices on the network
provides a message format for communication between network device managers and agents
captures packets entering and exiting the network interface card
provides statistical analysis on packets flowing through a Cisco router or multilayer switch
provides a message format for communication between network device managers and agents
SNMP is an application layer protocol that allows administrators to manage devices on the network by providing a messaging format for communication between network device managers and agents.
What is a function of SNMP?
synchronizes the time across all devices on the network
provides a message format for communication between network device managers and agents
captures packets entering and exiting the network interface card
provides statistical analysis on packets flowing through a Cisco router or multilayer switch
provides a message format for communication between network device managers and agents
SNMP is an application layer protocol that allows administrators to manage devices on the network by providing a messaging format for communication between network device managers and agents.
