fqefqf Flashcards
2. Ahmed is a sales manager with a major insurance company. He has received an email that is encouraging him to click on a link and fill out a survey. He is suspicious of the email, but it does mention a major insurance association, and that makes him think it might be legitimate. Which of the following best describes this attack? A. Phishing B. Social engineering C. Spear phishing D. Trojan horse
C. The correct answer is spear phishing. Spear phishing is targeted to a specific group, in this case insurance professionals. Attackers can find individuals from public sources to target. This is known as open source intelligence.
Option A is incorrect because that is too broad a category.
Option B is incorrect because, though social engineering is a part of every phishing attack, this is more than just social engineering.
Option D is incorrect because this is not a Trojan horse. In fact, malware is not even part of the attack.
6. Frank is deeply concerned about attacks to his company’s e-commerce server. He is particularly worried about cross-site scripting and SQL injection. Which of the following would best defend against these two specific attacks? A. Encrypted web traffic B. Filtering user input C. A firewall D. An IDS
B. The primary and best way to defend against the attacks mentioned is filtering user input.
Option A is incorrect. Encrypting the web traffic will not have any effect on these two attacks.
Option C is incorrect. A web application firewall (WAF) might mitigate these attacks, but it would be secondary to filtering user input.
Option D is incorrect. An IDS will simply detect the attack—it won’t stop it.
16. Jared discovers that attackers have breached his WiFi network. They have gained access via the wireless access point (WAP) administrative panel, and have logged on with the credentials the WAP shipped with. What best describes this issue? A. Default configuration B. Race conditions C. Failure to patch D. Weak encryption
A. Credentials the WAP shipped with are an example of default configuration.
Option B is incorrect. Race conditions involve multithreaded applications accessing shared variables.
Option C is incorrect. Patches won’t change the default password.
Option D is incorrect. Encryption does not affect logging into the administrative screen.
- You are responsible for incident response at a mid-sized bank. You have discovered that someone was able to successfully breach your network and steal data from your database server. All servers are configured to forward logs to a central logging server. However, when you examine that central log, there are no entries after 2:13 a.m. two days ago. You check the servers, and they are sending logs to the right server, but they are not getting there. Which of the following would be most likely to explain this?
A. Your log server has a backdoor.
B. Your log server has been hit with a buffer overflow attack.
C. Your switches have been hit with ARP poisoning.
D. Your IDS is malfunctioning and blocking log transmissions.
C. ARP poisoning is used to change the ARP tables routing data to a different MAC address, which would explain why there were no entries.
Option A is incorrect. A backdoor would not explain that the log entries were sent, but not received.
Option B is incorrect. A buffer overflow would not explain that the log entries were sent but not received.
Option D is incorrect. An IDS would not stop log entries even if it was malfunctioning.
19. Coleen is the web security administrator for an online auction website. A small number of users are complaining that when they visit the website and log in, they are told the service is down and to try again later. Coleen checks and she can visit the site without any problem, even from computers outside the network. She also checks the web server log and there is no record of those users ever connecting. Which of the following might best explain this? A. Typosquatting B. SQL injection C. Cross-site scripting D. Cross-site request forgery
A. From the description it appears that they are not logging into the real web server but rather a fake server. That indicates typosquatting: have a URL that is named very similarly to a real site so that when users mistype the real site’s URL they will go to the fake site.
Options B, C, and D are all incorrect. These are all methods of attacking a website, but in this case, the actual website was not attacked. Instead, some users are visiting a fake site
27. While investigating a malware outbreak on your company network, you discover something very odd. There is a file that has the same name as a Windows system DLL, and even has the same API interface, but handles input very differently, in a manner to help compromise the system, and it appears that applications have been attaching to this file, rather than the real system DLL. What best describes this? A. Shimming B. Trojan horse C. Backdoor D. Refactoring
A. Shimming is when the attacker places some malware between an application and some other file, and intercepts the communication to that file (usually to a library or system API).
Option B is incorrect. A Trojan horse might be used to get the shim onto the system, but that is not described in this scenario.
Option C is incorrect. A backdoor is a means to circumvent system authorization and get direct access to the system.
Option D is incorrect. Refactoring is the process of changing names of variables, functions, etc. in a program.
29. Frank is a network administrator for a small college. He discovers that several machines on his network are infected with malware. That malware is sending a flood of packets to a target external to the network. What best describes this attack? A. SYN flood B. DDoS C. Botnet D. Backdoor
B. His machines are part of a distributed denial-of-service attack.
Option A is incorrect. This scenario describes a generic DDoS, not a specific one like SYN
flood.
Option C is incorrect. These machines could be part of a botnet, or just have a trigger that causes them to launch the attack at a specific time. The real key in this scenario is the DDoS attack.
Option D is incorrect. A backdoor gives an attacker access to the target system.
31. When phishing attacks are so focused that they target a specific individual, they are called what? A. Spear phishing B. Targeted phishing C. Phishing D. Whaling
D. Whaling is targeting a specific individual.
Option A is incorrect. Spear phishing targets a small group.
Option B is incorrect. Targeted phishing is not a term used in the industry.
Option C is incorrect. Phishing is the generic term for a wide range of related attacks.
- You are concerned about a wide range of attacks that could affect your company’s web server. You have recently read about an attack wherein the attacker sends more data to the target than the target is expecting. If done properly, this could cause the target to crash.
What would best prevent this type of attack?
A. An SPI firewall
B. An active IDS/IPS
C. Checking buffer boundaries
D. Checking user input
C. You are concerned about buffer overflows, and thus checking buffer boundaries is the best defense.
Options A and B are incorrect. While these technological solutions can always be a benefit for security, they are unlikely to address buffer overflow attacks effectively.
Option D is incorrect. Checking user input helps defend against SQL injection and crosssite scripting.
38. You have noticed that when in a crowded area, you sometimes get a stream of unwanted text messages. The messages end when you leave the area. What describes this attack? A. Bluejacking B. Bluesnarfing C. Evil twin D. Rogue access point
A. Bluejacking involves sending unsolicited messages to Bluetooth devices when they are in range.
Option B is incorrect. Bluesnarfing involves getting data from the Bluetooth device.
Options C and D are incorrect. Evil twin uses a rogue access point whose name is similar or identical to that of a legitimate access point.
40. You have noticed that when in a crowded area, data from your cell phone is stolen. Later investigation shows a Bluetooth connection to your phone, one that you cannot explain. What describes this attack? A. Bluejacking B. Bluesnarfing C. Evil twin D. RAT
B. Bluesnarfing involves accessing data from a Bluetooth device when it is in range.
Option A is incorrect. Bluejacking involves sending unsolicited messages to Bluetooth devices when they are in range.
Option C is incorrect. Evil twin uses a rogue access point whose name is similar or identical to that of a legitimate access point.
Option D is incorrect. A RAT is a remote-access Trojan. Nothing in this scenario points to a RAT being the cause of the stolen data.
41. Louis is investigating a malware incident on one of the computers on his network. He has discovered unknown software that seems to be opening a port, allowing someone to remotely connect to the computer. This software seems to have been installed at the same time as a small shareware application. Which of the following best describes this malware? A. RAT B. Backdoor C. Logic bomb D. Rootkit
A. This is a remote-access Trojan (RAT), malware that opens access for someone to remotely access the system.
Option B is incorrect. A backdoor does provide access but it is usually in the system due to programmers putting it there, not due to malware on the system.
Option C is incorrect. A logic bomb executes its misdeeds when some logical condition is met.
Option D is incorrect. A rootkit provides root or administrative access to the system.
46. Your wireless network has been breached. It appears the attacker modified a portion of data used with the stream cipher and utilized this to expose wirelessly encrypted data. What is this attack called? A. Evil twin B. Rogue WAP C. IV attack D. WPS Attack
C. Initialization vectors are used with stream ciphers. An IV attack attempts to exploit a flaw to use the IV to expose encrypted data.
Options A and B are incorrect. Nothing in this scenario requires or describes a rogue access point/evil twin.
Option D is incorrect. WiFi protected setup (WPS) uses a PIN to connect to the wireless access point (WAP). The WPS attack attempts to intercept that PIN in transmission, connect to the WAP, and then steal the WPA2 password.
47. John is concerned about disgruntled employees stealing company documents and exfiltrating them from the network. He is looking for a solution that will detect likely exfiltration and block it. What type of system is John looking for? A. IPS B. SIEM C. Honeypot D. Firewall
A. Any of these systems could help with detecting malicious activity by an insider, but the intrusion prevention system will block such activity, if detected.
Option B is incorrect. SIEMs simply aggregate logs.
Option C is incorrect. A honeypot can be useful in trapping a malicious actor but not in stopping data exfiltration.
Option D is incorrect. Firewalls can block traffic, but normally data exfiltration looks like normal traffic and is hard for a firewall to block.
57. When an attacker tries to find an input value that will produce the same hash as a password, what type of attack is this? A. Rainbow table B. Brute force C. Session hijacking D. Collision attack
D. A collision is when two different inputs produce the same hash.
Option A is incorrect. A rainbow table is a table of precomputed hashes.
Option B is incorrect. Brute force attempts every possible random combination to get the password or encryption key.
Option C is incorrect. Session hijacking is when the attacker takes over an authenticated session.
78. Zackary is a malware investigator with a cybersecurity firm. He is investigating malware that is able to compromise a target program by finding null references in the target program and dereferencing them, causing an exception to be generated. What best describes this type of attack? A. DLL injection B. Buffer overflow C. Memory leak D. Pointer dereference
D. This is the definition of pointer dereferencing. It is a somewhat obscure and sophisticated attack on a target program.
Option A is incorrect. In a DLL injection, the malware tries to inject code into the memory process space of a library.
Option B is incorrect. In a buffer overflow, the attacker sends more data to a variable than it can hold.
Option C is incorrect. A memory leak occurs when memory is allocated in some programming function but not deallocated. Each time the function is called, more system memory is used up.
79. Frank has just taken over as CIO of a mid-sized insurance company. One of the first things he does is order a thorough inventory of all network equipment. He discovers two routers that are not documented. He is concerned that if they are not documented, they might not be securely configured, tested, and safe. What best describes this situation? A. Poor user training B. System sprawl C. Failure to patch systems D. Default configuration
B. System sprawl occurs when a system grows and there are devices on the system that are not documented.
Options A, C, and D are all incorrect. While these are all serious security issues, they are unrelated to the scenario presented.
81. Daryl is investigating a recent breach of his company’s web server. The attacker used sophisticated techniques and then defaced the website, leaving messages that were denouncing the company’s public policies. He and his team are trying to determine the type of actor who most likely committed the breach. Based on the information provided,who was the most likely threat actor? A. A script B. A nation-state C. Organized crime D. Hacktivists
D. The fact that the website is defaced in a manner related to the company’s public policies is the definition of hacktivism.
Options A, B, and C are incorrect. None of these account for the statements adverse to the company’s policies, which is why hacktivism is the real cause.
- You are investigating a breach of a large technical company. You discover that there have been several different attacks over a period of a year. The attacks were sustained, each lasting several weeks of continuous attack. The attacks were somewhat sophisticated and originated from a variety of IP addresses, but all the IP addresses are within your country.
Which threat actor would you most suspect of being involved in this attack?
A. Nation-state
B. Hacktivist
C. Script kiddie
D. A lone highly skilled hacker
A. The fact that the IP addresses are within your country might make you discard the nation-state attacker, but it is common for nation-state attackers to use compromised IP addresses in the target country from which to attack. The other symptoms—a sophisticated attack, over time—are hallmarks of nation-state attackers.
Option B is incorrect. Nothing in the scenario indicates an ideological motive.
Option C is incorrect. In fact, this attack is the antithesis of the simple attack of a script kiddie.
Option D is incorrect. A lone attacker, no matter how skilled, would have difficulty maintaining sustained attacks over a year.
- Which of the following best describes a zero-day vulnerability?
A. A vulnerability that has been known to the vendor for zero days
B. A vulnerability that has not yet been breached
C. A vulnerability that can be quickly exploited (i.e., in zero days)
D. A vulnerability that will give the attacker brief access (i.e., zero days)
A. This is the definition of a zero-day attack.
Options B, C, and D are incorrect. These do not adequately describe a zero-day attack.
88. Which of the following best describes software that will provide the attacker with remote access to the victim’s machine, but that is wrapped with a legitimate program in an attempt to trick the victim into installing it? A. RAT B. Backdoor C. Trojan horse D. Macro virus
A. A remote access Trojan (RAT) is malware that gives the attacker remote access to the victim machine.
Option B is incorrect. While a backdoor will give access, it is usually something in the system put there by programmers, not introduced by malware.
Option C is incorrect. A RAT is a type of Trojan horse, but Trojan horse is more general than what is described in the scenario.
Option D is incorrect. A macro virus is a virus embedded in a document.
92. You are responsible for technical support at your company. Users are all complaining of very slow Internet connectivity. When you examine the firewall, you find a large number of incoming connections that are not completed, all packets coming from a single IP address. What best describes this attack? A. DDoS B. SYN flood C. Buffer overflow D. ARP poisoning
B. Large, half-open connections are the hallmark of a SYN flood.
Option A is incorrect. These are all coming from a single IP address, so they cannot be a distributed denial-of-service attack.
Option C is incorrect. A buffer overflow seeks to put more data in a variable than it is designed to hold.
Option D is incorrect. ARP poisoning poisons the address resolution table of a switch.
95. Valerie is responsible for security testing applications in her company. She has discovered that a web application, under certain conditions, can generate a memory leak. What, type of attack would this leave the application vulnerable to? A. DoS B. Backdoor C. SQL injection D. Buffer overflow
A. If an attacker can induce the web application to generate the memory leak, then eventually the web application will consume all memory on the web server and the web server will freeze up.
Option B is incorrect. Backdoors are not caused by memory leaks.
Option C is incorrect. SQL injection places malformed SQL into text boxes.
Option D is incorrect. A buffer overflow attempts to put more data in a variable than it can hold.
98. John is responsible for physical security at a large manufacturing plant. Employees all use a smart card in order to open the front door and enter the facility. Which of the following is a common way attackers would circumvent this system? A. Phishing B. Tailgating C. Spoofing the smart card D. RFID spoofing
B. Tailgating involves simply following a legitimate user through the door once he or she
Option A is incorrect. This is unrelated to physical security.
Option C is incorrect. It is possible to generate a fake smartcard, but that is a very uncommon attack.
Option D is incorrect. Again, this is possible but is very uncommon.
99. Which of the following is the term for an attack wherein malware inserts itself as a library, such as a DLL, between an application and the real system library the application is attempting to communicate with? A. Application spoofing B. Jamming C. Evil twin D. Shimming
D. This is the definition of shimming.
Option A is incorrect. Application spoofing is not a term used in the industry.
Options B and C are incorrect. These are both wireless attacks.
100. You are responsible for incident response at Acme Corporation. You have discovered that someone has been able to circumvent the Windows authentication process for a specific network application. It appears that the attacker took the stored hash of the password and sent it directly to the backend authentication service, bypassing the application. What type of attack is this? A. Hash spoofing B. Evil twin C. Shimming D. Pass the hash
D. This scenario is the definition of passing the hash.
Option A is incorrect. A real hash was provided; it was not spoofed.
Option B is incorrect. Evil twin is a wireless attack.
Option C is incorrect. Shimming is inserting malicious code between an application and a library
101. A user in your company reports that she received a call from someone claiming to be from the company technical support team. The caller stated that there was a virus spreading through the company and he needed immediate access to the employee’s computer to stop it from being infected. What social-engineering principles did the caller use to try to trick the employee? A. Urgency and intimidation B. Urgency and authority C. Authority and trust D. Intimidation and authority
B. Claiming to be from tech support is claiming authority, and the story the caller gave indicates urgency.
Option A is incorrect. Yes, this caller used urgency (the virus spread) but did not attempt intimidation.
Option C is incorrect. Authority and trust are closely related, and in this case urgency was the second major factor.
Option D is incorrect. This caller used urgency but not intimidation.
106. Carlos works in incident response for a mid-sized bank. Users inform him that internal network connections are fine, but connecting to the outside world is very slow. Carlos reviews logs on the external firewall and discovers tens of thousands of ICMP packets coming from a wide range of different IP addresses. What type of attack is occurring? A. Smurf B. DoS C. DDoS D. SYN flood
C. The fact that the attack is coming from multiple sources makes this a distributed denial of service.
Option A is incorrect. A Smurf attack involves sending spoofed broadcast packets to the target network’s router.
Option B is incorrect. Yes, this is a denial-of-service attack, but it is distributed.
Option D is incorrect. A SYN flood involves lots of half-open connections
111. Francine is a network administrator for Acme Corporation. She has noticed that one of the servers is now unreachable. After carefully reviewing various logs, she discovers that a large number of broadcast packets were sent to the network router, spoofing the server’s IP address. What type of attack is this? A. SYN flood B. ICMP flood C. Buffer overflow D. Smurf attack
D. The sending of spoofed broadcast messages to the target network router is a Smurf attack.
Option A is incorrect. In a SYN flood, a large number of SYN packets are sent but not responded to. This leads to a large number of half-open connections.
Option B is incorrect. An ICMP flood is a large amount of ICMP (such as ping) packets sent to the target.
Option C is incorrect. In a buffer overflow attack, more data is sent to a variable than it was designed to hold.
125. You are a security administrator for Acme Corporation. You have discovered malware on some of your company’s machines. This malware seems to intercept calls from the web browser to libraries, and then manipulates the browser calls. What type of attack is this? A. Man-in-the-browser B. Man-in-the-middle C. Buffer overflow D. Session hijacking
A. In a man-in-the-browser attack, the malware intercepts calls from the browser to the system, such as system libraries.
Option B is incorrect. Man-in-the-middle involves having some process between the two ends of communication in order to compromise passwords or cryptography keys.
Option C is incorrect. In a buffer overflow attack, more data is put into a variable than the variable was intended to hold.
Option D is incorrect. Session hijacking involves taking over an authenticated session.
- Your company has hired a penetration testing firm to test the company network security.
The penetration tester has just been able to achieve guest-level privileges on one low-security system. What best describes this phase of the test?
A. Vulnerability scanning
B. Initial exploit
C. Black-box testing
D. White-box testing
B. This is the initial exploit, which involves getting initial access to the system.
Option A is incorrect. Vulnerability scanning is an automated process that checks for the presence of known vulnerabilities.
Options C and D are incorrect. These both refer to how much information about the network the tester is given. In both black-box and white-box tests, there will still be an initial exploit.
128. You are responsible for software testing at Acme Corporation. You want to check all software for bugs that might be used by an attacker to gain entrance into the software or your network. You have discovered a web application that would allow a user to attempt to put a 64-bit value into a 4-byte integer variable. What is this type of flaw? A. Memory overflow B. Buffer overflow C. Variable overflow D. Integer overflow
D. Placing a larger integer value into a smaller integer variable is an integer overflow.
Option A is incorrect. Memory overflow is not a term used, and memory leak is about allocating memory and not deallocating it.
Option B is incorrect. Buffer overflows usually involve arrays.
Option C is incorrect. Variable overflow is not a term used in the industry.
129. Which type of virus is most difficult to analyze by reverse engineering? A. Polymorphic B. Macro C. Armored D. Boot sector
C. Armoring can be as simple as very trivial encryption, but any process that makes it difficult to reverse-engineer a virus is armoring.
Option A is incorrect. A polymorphic virus periodically changes itself.
Option B is incorrect. A macro virus is embedded, as a macro, into a document.
Option D is incorrect. A boot sector virus infects the boot sector of a hard drive.
131. John is a network administrator for a large retail chain. He has discovered that his DNS server is being attacked. The attack involves false DNS requests from spoofed IP addresses. The requests are far larger than normal. What type of attack is this? A. Amplification B. DNS poisoning C. DNS spoofing D. Smurf attack
A. Sending fake DNS requests that are overly large is called an amplification attack. It is a highly specialized type of denial of service.
Option B is incorrect. DNS poisoning seeks to put fake DNS records in a DNS server.
Option C is incorrect. DNS spoofing is using fake DNS information.
Option D is incorrect. The Smurf attack is a denial of service.
132. Heidi is a security officer for an investment firm. Many of the employees in her firm travel frequently and access the company intranet from remote locations. Heidi is concerned about users logging in from public WiFi, as well as other people seeing information such as login credentials or customer data. Which of the following is Heidi’s most significant concern? A. Social engineering B. Shoulder surfing C. Man-in-the-middle attack D. CSRF
B. In this scenario, no technical issues are mentioned—just people seeing information. So shoulder surfing best fits the scenario.
Option A is incorrect. No social engineering is involved in this scenario.
Option C is incorrect. Although a man-in-the-middle attack on the wireless access point (WAP) could compromise data, that’s not what is described in this scenario.
Option D is incorrect. Cross-site request forgery is a website attack.
135. You lead an incident response team for a large retail chain store. You have discovered what you believe is spyware on the point-of-sale systems. But the malware in question is encrypted, preventing you from analyzing it. What best describes this? A. An armored virus B. Ransomware C. Polymorphic virus D. Trojan horse
A. Encryption is one method for armored viruses.
Option B is incorrect. Ransomware encrypts files but is not encrypted itself.
Option C is incorrect. A polymorphic virus periodically changes itself.
Option D is incorrect. A Trojan horse combines malware with a legitimate program
136. Jared has discovered malware on the workstations of several users. This particular malware provides administrative privileges for the workstation to an external hacker. What best describes this malware? A. Trojan horse B. Logic bomb C. Multipartite virus D. Rootkit
D. This is the definition of a rootkit.
Option A is incorrect. A Trojan horse combines malware with a legitimate program.
Option B is incorrect. A logic bomb performs its malicious activity when some condition
is met.
Option C is incorrect. A multipartite virus infects the boot sector and a file.
137. Users in your company report someone has been calling their extension and claiming to be doing a survey for a large vendor. Based on the questions asked in the survey, you suspect that this is a scam to elicit information from your company’s employees. What best describes this? A. Spear phishing B. Vishing C. War dialing D. Robocalling
B. This is vishing, or using voice calls for phishing.
Option A is incorrect. Spear phishing is targeting a small, specific group.
Option C is incorrect. War dialing is dialing numbers hoping a computer modem answers.
Option D is incorrect. Robocalling is used to place unsolicited telemarketing calls.
138. Cross-site request forgery is an attack on the that is based on the trusting the . A. website, website, user B. user, user website C. website, user, website D. user, website, user
A. Cross-site request forgery is an attack on the website that is based on the website trusting the user.
Options B, C, and D are all incorrect.
- You have just taken over as the CISO for a large bank. You are concerned about making sure all systems are secure. One major concern you have is security misconfiguration.
Which of the following is not a common security misconfiguration?
A. Unpatched operating system
B. Default accounts with passwords
C. Unneeded services running
D. No firewall running
D. A firewall not running is not a configuration issue.
Options A, B, and C are all incorrect. These are all common security misconfiguration issues.
7. ACME Company has several remote offices. The CIO wants to set up permanent secure connections between the remote offices and the central office. What would be the best solution for this? A. L2TP VPN B. IPSEC VPN C. Site-to-site VPN D. Remote-access VPN
C. A site-to-site VPN is a permanent VPN connection between sites. Connecting remote offices is a typical site-to-site VPN implementation.
Option A is incorrect. L2TP is a protocol for VPN and could be used for either site-to-site or remote-access VPNs.
Option B is incorrect. IPSec is a protocol for VPN and could be used for either site-to-site or remote-access VPNs.
Option D is incorrect. A remote-access VPN is used by an individual to remotely access the corporate network.
- Donald is working as a network administrator. He is responsible for the database cluster.
Connections are load-balanced in the cluster by each new connection being simply sent to the next server in the cluster. What type of load-balancing is this?
A. Round-robin
B. Affinity
C. Weighted
D. Rotating
A. Round-robin load balancing simply sends each new connection to the next server in the cluster.
Option B is incorrect. Affinity load balancing ties specific users to specific servers in the cluster.
Option C is incorrect. Weighted load balancing examines the bandwidth utilization for each server and sends the next connection to the server with the least current bandwidth utilization.
Option D is incorrect. Rotating is not a term used in load balancing
12. Mohaned is an IT manager for a hotel. His hotel wants to put wireless access points on each floor. The specifications state that the wireless access points should have minimal functionality, with all the configuration, authentication, and other functionality centrally controlled. What type of wireless access points should Mohaned consider purchasing? A. Fat B. Controller-based C. Stand-alone D. 801.11i
B. Controller-based wireless access points have minimal functionality, with most functions centrally controlled.
Option A is incorrect. A fat wireless access point has all necessary functionality contained in the WAP.
Option C is incorrect. Stand-alone is synonymous with fat WAP.
Option D is incorrect. 802.11i is the wireless security standard.
16. You are responsible for email server security in your company. You want to implement encryption of all emails, using third-party authenticated certificates. What protocol should you implement? A. IMAP B. S/MIME C. PGP D. SMTP-S
B. Secure Multipurpose Internet Mail Extensions (S/MIME) encrypts email using X.509
certificates that are created and authenticated by a trusted third party.
Option A is incorrect. The Internet Message Access Protocol is used for receiving email. It
does not send email and is not natively encrypted.
Option C is incorrect. PGP (Pretty Good Privacy) can be used to encrypt email, but it uses
self-generated certificates that are not authenticated by a third party.
Option D is incorrect. Simple Mail Transfer Protocol Secure is encrypted, but it is only for
sending email, not receiving. It can also be done with S/MIME or PGP.
18. You are responsible for network management at your company. You have been using SNMP for many years. You are currently using SNMP v2. A colleague has recently suggested you upgrade to SNMP v3. What is the primary benefit of SNMP v3? A. It is much faster. B. It integrates with SIEM. C. It uses CHAP authentication. D. It is encrypted.
D. Earlier versions of SNMP sent all traffic in clear text. SNMP v3 sends all data encrypted.
Options A, B, and C are incorrect. They are not features of SNMP v3.
19. Employees in your company are allowed to use tablets. They can select a tablet from four different models approved by the company but purchased by the employee. What best describes this? A. BYOD B. CYOD C. COPE D. BYOE
B. Choose Your Own Device (CYOD) allows employees to bring their own devices to
work, but only if they are chosen from a list of approved models.
Option A is incorrect. Bring Your Own Device (BYOD) allows employees to bring whatever model device they happen to have.
Option C is incorrect. Company-Owned Personally Enabled (COPE) equipment is provided by and owned by the company.
Option D is incorrect. BYOE is not a term used in the industry.
21. You have been assigned to select a backup communication method for your company to use in case of significant disasters that disrupt normal communication. Which option would provide the most reliability? A. Cellular B. WiFi C. SATCOM D. VoI P
C. Satellite communications are most resistant to disasters that disrupt communications.
Option A is incorrect. While cellular is effective and reasonably resilient, it is not as resilient as SATCOM.
Option B is incorrect. WiFi can fail for any number of reasons, and a disaster is very likely to affect it.
Option D is incorrect. If there is any disruption to the network, then VoIP will not function.
- What best describes mobile device content management?
A. Limiting how much content can be stored.
B. Limiting the type of content that can be stored.
C. Blocking certain websites.
D. Digitally signing authorized content.
B. Content management for a mobile device involves limiting what content can be placed on the phone.
Option A is incorrect. Content management is not involved in limiting the amount of data.
Option C is incorrect. In the context of a mobile device, this is not content management.
Option D is incorrect. Digitally signing authorized content could be used in some content management systems, but this is not the best definition of content management.
26. Teresa is responsible for network administration at a health club chain. She is trying for find a communication technology that uses low power and can spend long periods in low-power sleep modes. Which of the following technologies would be the best fit? A. WiFi B. Cellular C. Bluetooth D. ANT
D. ANT is a proprietary wireless network technology that provides low-power modes and
is used in WiFi settings. It has been used in sports-related technologies.
Option A is incorrect. WiFi uses power constantly, whether users connect or not.
Option B is incorrect. Cellular consumes too much power.
Option C is incorrect. The range of Bluetooth is too short.
29. Frank is a network administrator for a small college. The college has implemented a simple NIDS. However, the NIDS seems to only catch well-known attacks. What technology is this NIDS likely missing? A. Heuristic scanning B. Signature scanning C. Passive scanning D. Active scanning
A. Heuristic scanning involves scanning for anomalous behavior that might indicate an attack, even if there is no known attack signature.
Option B is incorrect. Signature scanning can only detect known signatures, and that appears to be what the college is using now.
Options C and D are incorrect. Neither is an IDS term.
30. You are concerned about an attacker enumerating all of your network. What protocol might help at least mitigate this issue? A. HTTPS B. TLS C. IPSec D. LDAPS
D. Lightweight Directory Access Protocol Secure (LDAPS) would at least mitigate the risk. LDAP is a directory of the network (computers, users, etc.). Securing that would help mitigate network enumeration.
Option A is incorrect. HTTPS is for secure web pages.
Option B is incorrect. TLS will help only if applied to a directory protocol, as it is in LDAPS.
Option C is incorrect. A VPN won’t solve this issue.
31. You have been asked to implement a secure protocol for transferring files that uses digital certificates. Which protocol would be the best choice? A. FTP B. SFTP C. FTPS D. SCP
C. FTPS is File Transfer Protocol with SSL/TLS and uses digital certificates to secure file transfer.
Option A is incorrect. File Transfer Protocol is not secure.
Option B is incorrect. SFTP is secure, but it uses SSH for security and does not use digital certificates.
Option D is incorrect. Secure Copy is secure, but it uses SSH for security and does not use digital certificates.
32. Ahmed is responsible for VoIP at his company. He has been directed to ensure that all VoIP calls have the option to be encrypted. What protocol is best suited for security VoIP calls? A. SIP B. TLS C. SRTP D. SSH
C. Secure Real-Time Transport Protocol (SRTP) is used to encrypt and secure RTP. RTP is
the protocol for transmitting VoIP.
Option A is incorrect. Session Initiation Protocol is used to initiate a VoIP call but not to
send the VoIP data.
Option B is incorrect. TLS is used to secure data, but by itself it cannot secure VoIP.
Option D is incorrect. Secure Shell SSH is for remote terminal connection and is not used
in VoI P.
37. Remote employees at your company frequently need to connect to both the secure company network via VPN and open public websites, simultaneously. What technology would best support this? A. Split tunnel B. IPSec C. Full tunnel D. TLS
A. Split tunneling allows a mobile user to access dissimilar security domains like a public network (e.g., the Internet) and a local LAN or WAN at the same time.
Option B is incorrect. IPSec is the protocol for establishing and securing a VPN, rather than connecting to different resources. You can use IPSec in either a split or full tunnel.
Option C is incorrect. A full tunnel is a dedicated tunnel to one single target.
Option D is incorrect. TLS is a protocol that can be used for establishing and securing a VPN, rather than connecting to different resources. You can use TLS in either a split or full tunnel.
40. Derrick is responsible for a web server cluster at his company. The cluster uses various load-balancing protocols. Derrick wants to ensure that clients connecting from Europe are directed to a specific server in the cluster. What would be the best solution to his problem? A. Affinity B. Binding C. Load balancing D. Round-robin
A. Affinity load balancing ties certain users or groups of users to a specific server so they will be routed to that server if possible.
Option B is incorrect. Binding is not a term used in load balancing.
Option C is incorrect. Yes, load balancing is needed, but the question asks what type of load balancing.
Option D is incorrect. Round-robin simply goes to the next available server
41. Teresa is responsible for WiFi security in her company. Her main concern is that there are many other offices in the building her company occupies and that someone could easily attempt to breach their WiFi from one of these locations. What technique would be best in alleviating her concern? A. Using thin WAPs B. Geofencing C. Securing the Admin screen D. WAP placement
D. Placing the WAPs carefully so as to provide the best coverage for the company, with minimum overlap outside the company, will be the best way to keep those in adjacent offices from attempting to breach the WiFi. When placing WAPs for the best coverage, one needs to focus on signal strength to ensure there is no gaps between WPAs.
Option A is incorrect. Thin versus fat WAP refers to the functionality in the WAP and won’t have any effect on the ability of nearby people to breach the WAP.
Option B is incorrect. Geofencing is used to limit the area in which a mobile device can be used.
Option C is incorrect. Securing the admin screen is a great idea and should be done, but it won’t address the issue of nearby tenants attempting to breach the WiFi.
- Shelly is very concerned about unauthorized users connecting to the company routers.
She would like to prevent spoofing. What is the most essential antispoofing technique for routers?
A. ACL
B. Logon
C. NIPS
D. NIDS
A. Access control lists are Cisco’s primary recommendation to prevent spoofing on routers. ACLs limit access to the router and its functionality.
Option B is incorrect. A login for accessing a router is often not practical because the router access may be needed when a user is not present to log on.
Option C is incorrect. A network intrusion prevention system is a good idea, but it won’t prevent spoofing.
Option D is incorrect. A network intrusion detection system is a good idea, but it won’t prevent spoofing.
- Terrance is trying to get all of his users to connect to a certificate server on his network.
However, some of the users are using machines that are incompatible with the certificate server, and changing those machines is not an option. Which of the following would be the best solution for Terrance?
A. Use an application proxy for the certificate server.
B. Use NAT with the certificate server.
C. Change the server.
D. Implement a protocol analyzer.
A. An application proxy server is often used when the client and the server are incompatible for direct connection with the server.
Option B is incorrect. Network address translation involves translating a private IP address to a public IP address.
Option C is incorrect. Changing the server is a drastic measure. It is assumed that this server is being used for some valid reason.
Option D is incorrect. A protocol analyzer is essentially a packet sniffer.
- John is implementing virtual IP load-balancing. He thinks this might alleviate network slowdowns, and perhaps even mitigate some of the impact of a denial-of-service attack.
What is the drawback of virtual IP load-balancing?
A. It is resource-intensive.
B. Most servers don’t support it.
C. It is connection-based, not load-based.
D. It works only on Unix/Linux servers.
C. Virtual IP load balancing does not take the load of each interface into account and assumes all loads are essentially similar.
Option A is incorrect. This load balancing is not resource intensive.
Option B is incorrect. Most servers do support virtual IP load-balancing.
Option D is incorrect. Windows will also support virtual IP load-balancing.
50. You are a security officer for a large law firm. You are concerned about data loss prevention. You have limited the use of USBs and other portable media, you use an IDS to look for large volumes of outbound data, and a guard searches all personnel and bags before they leave the building. What is a key step in DLP that you have missed? A. Portable drives B. Email C. Bluetooth D. Optical media
B. An insider could send out data as an email attachment.
Option A is incorrect. Portable devices usually connect via USB, which is blocked, and if they don’t, they will likely be found on the exit search.
Option C is incorrect. The range of Bluetooth is 10 meters. That makes it ineffective for data exfiltration.
Option D is incorrect. Optical media is a type of portable media.
51. Which of the following email security measures would have the most impact on phishing emails? A. Email encryption B. Hardening the email server C. Digitally signing email D. Spam filter
D. Phishing emails are often sent out to masses of people and a spam filter would block at least some of that, thus reducing the phishing email attacks.
Option A is incorrect. Although email encryption is a good idea, it will do nothing to stop phishing.
Option B is incorrect. Hardening all servers is a good security practice, but it has no impact on phishing emails.
Option C is incorrect. Although digitally signing email is a good idea, it cannot stop phishing or even reduce it significantly. It might mitigate phishing emails that claim to come from a company employee, but it won’t impact other phishing emails.
- Joanne has implemented TLS for communication with many of her networks servers. She wants to ensure that the traffic cannot be sniffed. However, users now complain that this is slowing down connectivity. Which of the following is the best solution?
A. Increase RAM on servers.
B. Change routers to give more bandwidth to traffic to these servers.
C. Implement TLS accelerators.
D. Place all servers in clusters with extensive load-balancing.
C. A TLS accelerator is a processor that handles processing, specifically processor-intensive public-key encryption for Transport Layer Security (TLS). This should significantly
improve server responsiveness.
Option A is incorrect. Increasing RAM will have only a minimal effect on network responsiveness.
Option B is incorrect. From the question, there is no indication that the servers were not performing fine before TLS implementation, so addressing the TLS issues is the best solution.
Option D is incorrect. Setting up clustering is a rather significant step, and not the first
thing that should be considered. Implementation of TLS accelerators is a better option.
61. You are responsible for security at Acme Company. Recently, 20 new employee network accounts were created, with the default privileges for the network. You have discovered that eight of these have privileges that are not needed for their job tasks. Which security principle best describes how to avoid this problem in the future? A. Least privileges B. Separation of duties C. Implicit deny D. Weakest link
C. The security concept of implicit deny states that any new access account will by default be denied all access. When a request is made for specific privileges for that account, then the privileges are explicitly applied. This means that by default all privileges are implicitly denied.
Option A is incorrect. Least privileges are what every account should have, but in this scenario the accounts were all given default privileges. The concept of implicit deny is a better answer.
Option B is incorrect. Separation of duties is used to prevent any one person from executing any action that might have significant security ramifications for the company.
Option D is incorrect. It is true that your network is only as secure as its weakest link, but that is not the best description of this scenario.
- Mary is concerned that SIEM logs at her company are not being stored long enough, or securely enough. She is aware that it is possible a breach might not be discovered until long after it occurs. This would require the company to analyze older logs. It is important that Mary find an SIEM log backup solution that can a) handle all the aggregate logs of the SIEM, b) be maintained for a long period of time, and c) be secure. What solution would be best for her?
A. Back up to large-capacity external drives.
B. Back up to large-capacity backup tapes.
C. Back up to WORM storage.
D. Back up to tapes that will be stored off-site.
C. Write once, read many (WORM) storage is a type of high-capacity storage wherein once the data is written to the storage, it cannot be edited. It provides both high-capacity storage and secure storage, since the backups cannot be tampered with.
Option A is incorrect. Large-capacity external drives would need to be stored in a secure place, and they can be edited and are thus not secure. You could secure one with encryption, but the question does not mention encrypted drives.
Option B is incorrect. Backup tapes are older technology. Tapes frequently have issues, and data can become irretrievable.
Answer D is incorrect. Backup media should always be stored off-site, but there is the issue that tapes can easily be damaged or corrupted, which is unacceptable for long-term storage.
64. You are responsible for network security at a university. Faculty members are issued laptops. However, many of the faculty members leave the laptops in their offices most of the time (sometimes even for weeks). You are concerned about theft of laptops. In this scenario, what would be the most cost-effective method of securing the laptops? A. FDE(Full-disk encryption) B. GPS tagging C. Geofencing D. Tethering
D. Tethering is usually inexpensive, and simply tethering a portable device to a desk makes it difficult to steal the device. No antitheft method is foolproof, but tethering is simple, cost effective, and reasonably effective.
Option A is incorrect. Full-disk encryption (FDE) can be a good idea and will protect the data on the laptop. However, the laptop can still be stolen, the drive wiped, and the laptop reused or sold.
Option B is incorrect. GPS tagging may allow you to locate a stolen laptop, but it is usually more expensive than tethering.
Option C is incorrect. Geofencing just limits where the device will work—it does not prevent theft of the device.
65. You work at a defense contracting company. You are responsible for mobile device security. Some researchers in your company use company-issued tablets for work. These tablets may contain sensitive, even classified data. What is the most important security measure for you to implement? A. FDE B. GPS tagging C. Geofencing D. Content management
A. Full-disk encryption (FDE) is the best way to protect data on any device. In this scenario, the sensitive data on the tablets is the most important concern; therefore, securing that data with FDE is the most important security measure to take.
Option B is incorrect. GPS tagging might be a good idea—it would help locate lost or stolen devices. However, it is less important than FDE.
Option C is incorrect. Geofencing limits where a device can be used, and it does not address the issues presented in this scenario.
Option D is incorrect. Content management is always a good idea. But in this case, it won’t address the most important security concern.
- When using any HIDS/HIPS or NIDS/NIPS, the output is specific to the vendor. However, what is the basic set of information that virtually all HIDSs/HIPSs or NIDSs/NIPSs provide?
A. IP addresses (sender and receiver), ports (sender and receiver), and protocol
B. IP addresses (sender and receiver), ports (sender and receiver), and attack type
C. IP addresses (sender and receiver), ports (sender and receiver), usernames, and machine names
D. Usernames, machine names, and attack type
A. HIDSs/HIPSs and NIDSs/NIPSs each have output that the vendor specifies. But all such devices will output what protocol the traffic was, the source and destination IP addresses, as well as the source and destination port. More information may be provided, but this is the essential basic information all IDSs/IPSs display.
Option B is incorrect. Many of these devices won’t display the suspected attack type. The person operating the device should recognize that a flood of SYN packets on a given port is a SYN flood.
Option C is incorrect. Usernames and machine names may or may not be included, but IP addresses will be.
Option D is incorrect. Usernames and machine names may or may not be included, but IP addresses will be.
68. Teresa is responsible for incident response at ACME Company. There was a recent breach of the network. The breach was widespread and affected many computers. As part of the incident response process, Teresa will collect the logs from the SIEM, which aggregates logs from 20 servers. Which of the following should she do first? A. Event de-duplication B. Log forwarding C. Identify the nature of the attack D. Identify the source IP of the attack
A. Since 20 servers send logs to the SIEM, de-duplicating events will be important.
Option B is incorrect. An SIEM is a log aggregation and analysis tool. Log forwarding was established before the incident.
Option C is incorrect. This is certainly something to do at some point, but it won’t be the first action.
Option D is incorrect. This is certainly something to do at some point, but it won’t be the first action.
69. Hector is responsible for NIDS/NIPS in his company. He is configuring a new NIPS solution. What part of the NIPS collects data? A. Sensor B. Data source C. Manager D. Analyzer
A. In any IDS (HIDS/HIPS; NIDS/NIPS), the sensors collect data from the network segment they are on and forward that information to the analyzer.
Option B is incorrect. A data source is any source of information for the IDS.
Option C is incorrect. The manager is the interface that a human operator uses to interact with the NIDS/NIPS or HIDS/HIPS.
Option D is incorrect. The analyzer takes data sent to it from the sensors and analyzes the data looking for indicators of an attack.
74. Lars is responsible for incident response at ACME Company. He is particularly concerned about the network segment that hosts the corporate web servers. He wants a solution that will detect potential attacks and notify the administrator so the administrator can take whatever action he or she deems appropriate. Which of the following would be the best solution for Lars? A. HIDS B. HIPS C. NIDS D. NIPS
C. A network intrusion detection system (NIDS) will detect suspected attacks on a given network segment and notify the administrator. For example, in an anomaly detection, the administrator will be notified if there are any deviation from an expected pattern or behavior.
Option A is incorrect. A host intrusion detection system (HIDS) only detects intrusions for a single host.
Option B is incorrect. A host intrusion prevention system (HIPS) only detects intrusions on a single host, and it blocks suspected intrusions.
Option D is incorrect. A network intrusion prevention system (NIPS) will check the entire network segment, but rather than simply notify the administrator for him or her to take action, the NIPS will block the suspected traffic.
76. Abigail is a security manager for a small company. Many employees want to use handheld devices, such as smartphones and tablets. The employees want to use these devices both for work and outside of work. Abigail is concerned about security issues. Which of the following would be the most secure solution? A. COPE B. CYOD C. Geotaggin D. BYOD
A. Company-Provided Equipment provides the most security because the company owns and provides the equipment to employees. This allows the company to fully control security, such as preventing carrier unlocking, disable recording microphone, prevent WiFi direct and WiFi ad-hoc.
Option B is incorrect. Choose Your Own Device (CYOD) would have the employees choose any device they wish from a set of options selected by the company. But these would still be employee-owned and -controlled devices.
Option C is incorrect. Geotagging simply allows you to locate a device.
Option D is incorrect. Bring Your Own Device (BYOD) allows employees to bring whatever device they have to work. This is a security concern.
77. You are responsible for always-on VPN connectivity for your company. You have been told that you must use the most secure mode for IPSec that you can. Which of the following would be the best for you to select? A. Tunneling B. AH C. IKE D. Transport
A. A tunneling mode is the mode wherein IPSec encrypts the entire packet, header, and data. This prevents someone sniffing traffic from gathering metadata about the traffic.
Option B is incorrect. Authentication Header (AH) provides authentication and integrity but no encryption, so it cannot be the most secure mode.
Option C is incorrect. Internet Key Exchange (IKE) is used in setting up security associations in IPSec.
Option D is incorrect. Transport mode encrypts only the data, not the header. This allows metadata about traffic to be sniffed by an attacker. Therefore, this cannot be the most secure mode.
78. Debra is the network administrator for her company. Her company’s web servers are all in a cluster. Her concern is this: if one of the servers in the cluster fails, will the backup server be capable of running for a significant amount of time? She wants to make sure that the backup won’t soon fail. What would be her best choice in clustering? A. Active-active B. Round-robin C. Affinity D. Active-passive
D. An active-passive cluster has backup servers that are not handling any workload. They are brought into action if the primary server fails. This means the backup server will not have been subjected to any workload and is effectively a new machine.
Option A is incorrect. An active-active cluster has all servers working, with the load balanced between them. Should a primary server fail, there is some chance the backup might fail in the near future.
Options B and C are incorrect. Round-robin and affinity describe how connections are routed in the cluster, not how failover functions.
82. Sarah is the CIO for a small company. She recently had the entire company’s voice calls moved to VoIP. Her new VoIP system is using SIP with RTP. What might be the concern with this? A. SIP is not secure. B. RTP is not secure. C. RTP is too slow. D. SIP is too slow.
B. Real-time Transport Protocol (RTP) is used to transport VoIP and video signals, but it is not encrypted. Secure Real-time Transport Protocol (SRTP) should be used.
Option A is incorrect. Session Initiation Protocol (SIP) is used to initiate a VoIP call but not to send the VoIP data.
Option C is incorrect. The speed is not the issue.
Option D is incorrect. The speed is not the issue.
85. Elizabeth is responsible for security at a defense contracting company. She is concerned about users within her network exfiltrating data by attaching sensitive documents to emails. What solution would best address this concern? A. Email encryption B. USB blocking C. NIPS D. Content filtering
D. While most people think of content filtering in regard to filtering content you view, it can also be thought of in terms of content that is sent out. Implementing content filtering ensures that the problem of data exfiltration via email will be mitigated.
Option A is incorrect. Email encryption would actually make it easier to exfiltrate data, since the data would be hidden from any analysis.
Option B is incorrect. USB blocking won’t affect email filtration.
Option C is incorrect. A network-based intrusion prevention system (NIPS) cannot stop email attachments.
87. Gabriel is using nmap to scan one of his servers whose IP address is 192.168.1.1. He wants to perform a ping scan, but the network blocks ICMP, so he will try a TCP ping scan and do so very slowly. Which of the following would accomplish that? A. nmap -O -PT -T1 192.168.1.1 B. nmap -O – T3 192.168.1.1 C. nmap -T -T1 192.168.1.1 D. nmap -PT -T5 192.168.1.1
A. The nmap -Oflag indicates that you want to guess the operating system. The -PTscan means do a ping with TCP. The -T1is a very slow scan.
Options B, C, and D are all incorrect. The ping scan variations all start with -P(-PT TCPping, -TS SYNping, etc.), the -Tis timing, and the options are T1(slowest) to T5(fastest).
94. Frank is a web server administrator for a large e-commerce company. He is concerned about someone using netcat to connect to the company web server and retrieving detailed information about the server. What best describes his concern? A. Passive reconnaissance B. Active reconnaissance C. Banner grabbing D. Vulnerability scanning
C. Banner grabbing is a process whereby someone connects to a target web server and attempts to gather information, literally grabbing the web services “banner.” This is often done by telnetting into the web server. It can also be done with netcat, using an HTTP request.
Option A is incorrect. Passive reconnaissance would not involve active connections to the server.
Option B is incorrect. Although this is active reconnaissance, it is more accurately described as banner grabbing.
Option D is incorrect. This scenario is not describing vulnerability scanning.
95. Mike is responsible for testing security at his company. He is using a tool that identifies vulnerabilities and provides mechanisms to test them by attempting to exploit them. What best describes this type of tool? A. Vulnerability scanner B. Exploit framework C. Metasploit D. Nessus
B. Exploit frameworks are tools that provide a framework for finding vulnerabilities and then attempting to exploit those vulnerabilities. These tools are an important part of network security testing.
Option A is incorrect. A vulnerability scanner would only identify the vulnerabilities; it would not provide a means to use the vulnerability.
Option C is incorrect. Metasploit is a popular exploit framework, but the question asked about the class of tools, not about identifying a specific tool.
Option D is incorrect. Nessus is a well-known vulnerability scanner.
96. William is a security officer for a large bank. When executives’ laptops are decommissioned, he wants to ensure that the data on those laptops is completely wiped so that it cannot be recovered, even using forensic tools. How many times should William wipe a hard drive? A. 1 B. 3 C. 5 D. 7
D. US DoD data sanitization standard DoD 5220.22-M recommends an average of 7 complete wipes to wipe data. The standard has a matrix wherein you match the sensitivity of the data to a specific number of wipes, but the general rule is 7.
Options A, B, and C are all incorrect. Less than 7 wipes are considered inadequate to prevent data recovery tools from recovering the data.
102. Mark is responsible for security for a small bank. He has a firewall at the gateway as well as one at each network segment. Each firewall logs all accepted and rejected traffic. Mark checks each of these logs regularly. What is the first step Mark should take to improve his firewall configuration? A. Integrate with SIEM. B. Add a honeypot. C. Integrate with AD. D. Add a honeynet.
A. Each of these firewalls is logging all activity, but the logs are not centralized. This makes it quite difficult to monitor all logs. By integrating with an SIEM, all logs are centralized and Mark can get alerts for issues.
Options B and D are incorrect. A honeypot or honeynet might be a good idea, but neither is the next logical step or part of firewall configuration.
Option C is incorrect. Integrating with Active Directory (AD) may or may not be a good choice for Mark, but it won’t improve his firewall configuration.
106. Your company is issuing portable devices to employees for them to use for both work and personal use. This is done so the company can control the security of the devices. What, if anything, is an issue this process will cause? A. Personal information being exposed B. Company data being exfiltrated C. Devices being insecurely configured D. No issues
A. Since employees use the Company-Owned Personally Enabled (COPE) device for personal use, the devices will have the employee’s personal information. This can lead to personal and private data being exposed to the company.
Option B is incorrect. Any portable device has the chance of being used for data exfiltration, but COPE is no more susceptible than other configurations such as BYOD.
Option C is incorrect. In fact, the opposite is true. It is less likely that devices will be improperly configured because the company controls configuration.
Option D is incorrect. There are issues with this option.
107. Marsha is responsible for mobile device security. Her company uses COPE(Corporate-Owned Personally-Enabled) for mobile devices. All phones and tablets have a screen lock and GPS tagging. What is the next, most important step for Marsha to take to secure the phones? A. Implement geofencing. B. Implement application management. C. Implement geolocation. D. Implement remote wipe.
B. Application management is primarily concerned with ensuring only authorized and approved applications are installed on mobile devices. This would be the next logical step to perform. Control of which applications are allowed on the device is central to basic security.
Option A is incorrect. Geofencing may or may not even be appropriate for every company.
Option C is incorrect. Geolocation is useful to locating stolen devices, but it is not the next step to take in security.
Option D is incorrect. Remote wipe can be useful should a device be lost or stolen, but it is not the next step to take in security.
- You are responsible for DLP at a large company. Some employees have COPE and others BYOD. What DLP issue might these devices present?
A. COPE can be USB OTG.
B. BYOD can be USB OTG.
C. COPE and BYOD can be USB OTG.
D. Only jailbroken COPE or BYOD can be USB OTG.
C. Whether the device is Company-Owned and Personally Enabled (COPE) or Bring Your Own Device (BYOD), any mobile device can be a USB On-the-Go (OTG) device. This means the device itself serves as a mass storage USB drive, and data can be exfiltrated on the device. This is a concern for data loss prevention (DLP).
Options A and B are incorrect. Any device can be USB OTG.
Option D is incorrect. You need not jailbreak a phone or tablet in order to use it as USB OTG.
- Frank is concerned about DHCP starvation attacks. He is even more worried since he learned that anyone can download software called a “gobbler” and execute a DHCP starvation attack. What technology would most help him mitigate this risk?
A. Encrypt all DHCP communication with TLS.
B. FDE on the DHCP server
C. Network Address Allocation
D. IPSec for all DHCP communications
C. Network Address Allocation is the process of allocating network addresses. In a DHCP environment, this can be done to limit how many IP addresses are requested from a single network segment. For example, if a network segment has only 30 nodes, then no more than 30 addresses can be allocated to that segment. This would mitigate DHCP starvation.
Option A is incorrect. Encrypting communications is often a good idea, but it won’t mitigate this issue.
Option B is incorrect. Full-disk encryption (FDE) is often a good idea but won’t mitigate this issue.
115. Lydia is trying to reduce costs at her company and at the same time centralize network administration and maintain direct control of the network. Which of the following solutions would provide the most network administration centralization and control while reducing costs? A. Outsourcing network administration B. IaaS C. PaaS D. Moving all OSs to open source
B. Infrastructure as a Service (IaaS) uses a third-party service and templates to provide the network infrastructure in a virtualized manner, but the client company still administers the network. By moving to a virtualized solution, administration is very centralized. By using IaaS, Lydia will reduce costs, but she will still maintain direct control.
Option A is incorrect. Outsourcing will remove control of the network to a third party.
Option C is incorrect. Platform as a Service (PaaS) can only provide operating systems.
Option D is incorrect. Open source won’t help centralized administration, and the total cost of ownership may not actually be less.
116. You are investigating a remote access protocol for your company to use. The protocol needs to fully encrypt the message, use reliable transport protocols, and support a range of network protocols. Which of the following would be the best choice? A. RADIUS B. Diameter C. TACACS + D. IPSec
C. Terminal Access Controller Access Control System+ (TACACS+) is a remote access protocol. It uses TCP, which is a reliable transport protocol, and it fully encrypts the messages. TACACS+ also supports a range of network protocols.
Option A is incorrect. Remote Authentication Dial-In User Service (RADIUS) uses UDP, which is not a reliable transport protocol and does not support many networking protocols.
Option B is incorrect. Diameter (not an acronym) does support TCP, but it does not fully encrypt the messages.
Option D is incorrect. IPSec is a VPN protocol, not a remote access and authentication protocol.
118. John is setting up all the database servers on their own subnet. He has placed them on 10.10.3.3/29. How many nodes can be allocated in this subnet? A. 32 B. 16 C. 8 D. 6
D. Classless Inter-Domain Routing (CIDR) notation provides the number of bits that are masked for the network. Remaining bits are used for nodes. To determine the size of a subnet based in CIDR notation (/N), the formula is simple: [2 ^ (32 –N)] – 2. In this case, that is [2 ^ (32 – 29)] – 2, or (2 ^ 3) – 2, or 8 – 2, or 6 nodes.
Options A, B, and C are incorrect. The most common wrong answer is C, which would be the result if you forgot to subtract 2 at the end of the calculation.
- You are responsible for mobile device security in your company. Employees have COPE devices. Many employees only enter the office infrequently, and you are concerned that their devices are not receiving firmware updates on time. What is the best solution for this problem?
A. Scheduled office visits for updates
B. OTA updates
C. Moving from COPE to BYOD
D. A policy that requires users to update their firmware regularly
B. Over-the-air (OTA) updates are accomplished wirelessly. This can be done over a cellular network, wherever the device is. Using OTA updates for the mobile devices is the most efficient solution.
Option A is incorrect. This would work but would interrupt the employees’ normal work schedules and be inefficient.
Option C is incorrect. Moving from Company-Owned and Personally Enabled to Bring Your Own Device (BYOD) would actually make the situation worse, but doing so would absolve the company of the responsibility of managing updates.
Option D is incorrect. Policies require a mechanism for implementation. OTA is such a mechanism.
126. Frank is looking for a remote authentication and access protocol. It must be one that uses UDP due to firewall rules. Which of the following would be the best choice? A. RADIUS B. Diameter C. TACACS + D. IPSec
A. Remote Authentication Dial-In User Service (RADIUS) is an older authentication and access control protocol, but it uses UDP. The other options mentioned do not use UDP.
Options B and C are incorrect. Both Diameter and TACACS+ are newer protocols, but both use TCP.
Option D is incorrect. IPSec is a VPN protocol, not a remote authentication and access control protocol.
130. You are configuring BYOD access for your company. You want the absolute most robust security for the BYOD on your network. What would be the best solution? A. Agentless NAC B. Agent NAC C. Digital certificate authentication D. Two-factor authentication
B. Network Access Control (NAC) allows the network to enforce a level of host health checks on devices before allowing it to connect. With agent NAC, a software agent is installed on any device that wishes to connect to the network. That agent can do a much
more thorough systems health check of the BYOD.
Option A is incorrect. Agentless NAC can be useful but is less effective than agent NAC.
Options C and D are incorrect. Stronger authentication is a good security measure but won’t address the issue of scanning BYOD to ensure compliance with security rules.
131. You work for a large law firm and are responsible for network security. It is common for guests to come to the law firm (clients, expert witnesses, etc.) who need to connect to the firm’s WiFi. You wish to ensure that you provide the maximum security when these guests connect with their own devices, but you also wish to provide assurance to the guest that you will have minimal impact on their device. What is the best solution? A. Permanent NAC agent B. Agentless NAC C. Dissolvable NAC agent D. Implement COPE
C. Network Access Control (NAC) performs a systems health check on devise and validates that the device meets minimum security standards before allowing it to connect. An agent-based NAC is more thorough in scanning the device. However, that leaves an agent on the visitor’s device. A dissolvable agent will delete after a period of time.
Option A is incorrect. A permanent NAC would have an impact on visitors’ devices.
Option B is incorrect. Agentless NAC would have less impact, and would also be less thorough and thus less secure.
Option D is incorrect. Company-Owned Personally Enabled (COPE) devices are not possible for guests.
- Mary works for a large insurance company and is responsible for cybersecurity. She is concerned about insiders and wants to detect malicious activity on the part of insiders.
But she wants her detection process to be invisible to the attacker. What technology best fits these needs?
A. Hybrid NIDS
B. Out-of-band NIDS
C. NIPS
D. NNIDS
B. An out-of-band network intrusion detection system (NIDS) places the management portion on a different network segment, making detection of the NIDS more difficult.
Option A is incorrect. A hybrid NIDS combines a network node IDS with a host IDS.
Option C is incorrect. A network intrusion prevention system (NIPS) is usually quite detectable, by its very nature. By blocking offending traffic, it will absolutely be noticed.
Option D is incorrect. A network node IDS (NNIDS) uses a network approach, but it delegates the IDS functions to individual hosts.
135. You want to allow a media gateway to be accessible through your firewall. What ports should you open? (Choose two.) A. 2427 B. 1707 C. 2727 D. 1727
A, C. One for the gateway and one for the call agent. From the call agent to the gateway is using UDP port 2427, and if it’s from the gateway to the call agent, it uses UDP port 2727.
Options B and D are incorrect. 1707 is L2TP, and 1727 is PPTP.
- Dennis is implementing wireless security throughout his network. He is using WPA2.
However, there are some older machines that cannot connect to WPA2—they only support WEP. At least for now, he must keep these machines. What is the best solution for this problem?
A. Put those machines on a different VLAN.
B. Deny wireless capability for those machines.
C. Put those machines on a separate wireless network with separate WAP.
D. Encrypt their traffic with TLS.
C. When you must support machines that cannot connect to newer, more secure WiFi protocols, then put those machines on a separate WiFi network. That won’t prevent them from being breached, but it will prevent that breach from exposing your entire network.
Option A is incorrect. A VLAN is not applicable to this scenario.
Option B is incorrect. Denying wireless access is not necessary.
Option D is incorrect. Although encrypting network traffic is often a good idea, it won’t solve this problem.
138. You are a security administrator for Acme Company. Employees in your company routinely upload and download files. You are looking for a method that allows users to remotely upload or download files in a secure manner. The solution must also support more advanced file operations such as creating directories, deleting files, and so forth. What is the best solution for this? A. SFTP B. SSH C. SCP D. IPSec
A. Secure File Transfer Protocol (SFTP) is a protocol based on Secure Shell, and it provides directory listing, remote file deletion, and other file management abilities. It is also secure.
Option B is incorrect. Secure Shell (SSH) provides a secure terminal connection.
Option C is incorrect. Secure Copy (SCP) is based on SSH and does allow file transfer. But it does not support other file management capabilities.
Option D is incorrect. IPSec is a VPN protocol.
- John is the CISO for a small company. The company has password policies, but John is not sure the policies are adequate(enough). He is concerned that someone might be able to “crack” company passwords. What is the best way for John to determine whether his passwords are vulnerable?
A. Run a good vulnerability scan.
B. Perform a password policy audit.
C. Use one or more password crackers himself.
D. Ensure that passwords are stored as a hash.
C. The best way to see if passwords are crackable is to attempt to crack them. This is done by using one or more well-known and reliable password crackers. If you are able to crack your passwords, that demonstrates they are not adequate.
Option A is incorrect. Many vulnerability scanners don’t check passwords, and those that do only check rudimentary requirements.
Option B is incorrect. The concern is that the policies may not be adequate. So, an audit will only show if people are complying with the policy, not whether the policy itself is adequate.
Option D is incorrect. Passwords are usually stored as a hash. This does not prevent tools, like rainbow tables, from cracking passwords.
143. Gianna is evaluating the security of her company. The company has a number of mobile apps that were developed in house for use on COPE devices. She wants to ensure that these apps are updated as soon as an update is available. What should she ensure is being used? A. Firmware OTA B. Push notifications C. Scheduled updates D. A policy against custom firmware
B. Push notifications are used to send out updates when they are ready. With push notifications, you do not wait for the user to check for an update; the update is sent as soon as it is ready.
Option A is incorrect. Firmware Over-the-Air (OTA) updates are a good idea, but this question is about custom apps, not firmware.
Option C is incorrect. This issue in this question is not if updates are being scheduled but if they are being applied.
Option D is incorrect. A policy against custom firmware is a good security policy. However, this question is about custom apps, not firmware.
145. Heidi works for a large company that issues various mobile devices (tablets and phones) to employees. She is concerned about unauthorized access to mobile devices. Which of the following would be the best way to mitigate that concern? A. Biometrics B. Screen lock C. Context-aware authentication D. Storage segmentation
A. Biometrics, type III authentication, are very robust. Biometrics are based on a biological part of the authorized user, so they are very difficult to fake and impossible for the user to lose.
Option B is incorrect. Screen locks are necessary, but they are only a rudimentary security measure.
Option C is incorrect. In combination with the username and password, context-aware authentication examines the user’s location, the time of day the user is logging in, the computer that the user is logging in from, what the user is trying to do, the context, and so forth. This is a very good authentication method, but biometrics can still be more effective and more user-friendly.
Option D is incorrect. Storage segmentation is very good for separating user personal data from company data, but it won’t address unauthorized access.
146. You are looking for a point-to-point connection method that would allow two devices to synchronize data. The solution you pick should not be affected by EMI (electromagnetic interference) and should be usable over distances exceeding 10 meters, provided there is a line-of-sight connection. What would be the best solution? A. Bluetooth B. WiFi C. Infrared D. RF
C. Infrared uses a wavelength of light that is not visible to humans. Since it is light, it is
not susceptible to EMI. It can be used over most distances, provided there is a line of sight.
The disadvantage is that any break in the line of sight breaks communication.
Option A is incorrect. Bluetooth has a range of only 10 meters.
Option B is incorrect. WiFi is susceptible to EMI.
Option D is incorrect. RF is susceptible to EMI.
- Ethan has noticed some users on his network accessing inappropriate videos. His network uses a proxy server that has content filtering with blacklisting. What is the most likely cause of this issue?
A. Sites not on the blacklist
B. Misconfigured content filtering
C. Misconfigured proxy server
D. Someone circumventing the proxy server
A. Blacklisting blocks any sites or content specifically on the blacklist. However, it is impossible to list every inappropriate site on the Internet, so some are not going to be listed and thus are accessible.
Option B is incorrect. You could argue that this issue is due to misconfiguration, but that
is most likely cause.
Option C is incorrect. The proxy server as a whole is not the issue. It is the content filtering that is at issue.
Option D is incorrect. While this is possible, it is not the most likely explanation.
- Logan is responsible for enforcing security policies in his company. There are a number of policies regarding the proper configuration of public-facing servers. Which of the following would be the best way for Logan to check to see if such policies are being enforced?
A. Periodically audit selected servers.
B. Implement a configuration compliance scanning solution.
C. Conduct routine penetration tests of those servers.
D. Implement a vulnerability scanning solution.
B. Configuration compliance scanning solutions take the configuration settings that the administrator provides and scans targeted devices and computers to see whether they comply. This is an effective method for checking compliance.
Options A, C, and D are all incorrect. Each of these would uncover at least some configuration compliance issues but would be less effective and/or more cumbersome than configuration compliance scanning.
2. You are responsible for network security at an e-commerce company. You want to ensure that you are using best practices for the e-commerce website your company hosts. What standard would be the best for you to review? A. OWASP B. NERC C. NIST D. ISA/IEC
A. The correct answer is the Open Web Application Security Project. It is the de facto standard for web application security.
Option B is incorrect. The North American Electric Reliability Corporation is concerned with electrical power plant security.Option C is incorrect. The National Institute of Standards does not, as of this writing, publish web application standards.
Option D is incorrect. ISA/IEC standards are for securing industrial automation and control systems (IACSs).
- Maria is a security administrator for a large bank. She is concerned about malware, particularly spyware that could compromise customer data. Which of the following would be the best approach for her to mitigate the threat of spyware?
A. Computer usage policies, network antimalware, and host antimalware
B. Host antimalware and network antimalware
C. Host and network antimalware, computer usage policies, and website whitelisting
D. Host and network antimalware, computer usage policies, and employee training
D. Control diversity means utilizing different controls to mitigate the same threat. For malware, the use of technical controls, such as anti-malware, is critical. But it is also important to have administrative controls, such as good policies, and to ensure employees are properly trained.
Option A is incorrect. This approach ignores training employees. Policies are only useful if employees are properly trained.
Option B is incorrect. This approach uses only one type of control: technical controls.
Option C is incorrect. This approach ignores training employees. Policies are useful only if employees are properly trained. Furthermore, website whitelisting can be beneficial but leaves many websites unchecked, each of which could be hosting malware.
- You are the network administrator for a large company. Your company frequently has nonemployees in the company such as clients and vendors. You have been directed to provide these nonemployees with access to the Internet. Which of the following is the best way to implement this?
A. Establish a guest network.
B. Allow nonemployees to connect only to the DMZ.
C. Allow nonemployees to connect only to the intranet.
D. Establish limited accounts on your network for nonemployees to use.
A. A guest network is separate from your production network; therefore, even if there is some breach of that network, it won’t affect your production network. It is a common security practice to establish a guest network so that guests can access the Internet, without providing them with access to the corporate network resources.
Option B is incorrect. A DMZ is used to locate public-facing servers such as web servers.
Option C is incorrect. An intranet consists of internal web-based resources for employees.
Option D is incorrect. This would provide nonemployees with access to the corporate network
- John works for an insurance company. His company uses a number of operating systems, including Windows and Linux. In this mixed environment, what determines the network operating system?
A. The OS of the DNS server
B. The OS of the domain controller
C. The OS of the majority of servers
D. The OS of the majority of client computers
B. The network operating system is determined by the operating system running on a domain controller. A network could be mostly Windows, but as long as the domain controller is Unix, the network operating system is Unix.
Options A, C, and D are all correct. These items do not determine the network operating system.
14. Juanita is implementing virtualized systems in her network. She is using Type I hypervisors. What operating system should be on the machines for her to install the hypervisor? A. None B. Windows C. Any operating system D. Windows or Linux
A. A Type I hypervisor is also known as a bare-metal hypervisor. It installs directly onto hardware and does not require an operating system to be installed first.
Options B, C, and D are all incorrect. Type I hypervisors do not require a preinstalled operating system.
15. You are responsible for security at your company. You want to improve cloud security by following the guidelines of an established international standard. What standard would be most helpful? A. NIST 800-14 B. NIST 800-53 C. ISO 27017 D. ISO 27002
C. ISO 27017 is an international standard for cloud security.
Option A is incorrect. NIST 800-14 describes common security principles that should be addressed within security policies.
Option B is incorrect. NIST 800-53 organizes security measures into families of controls, such as risk assessment, access control, incident response, and others.
Option D is incorrect. ISO 27002 recommends best practices for initiating, implementing, and maintaining information security management systems (ISMSs).
22. Which type of firewall examines the content and context of each packet it encounters? A. Packet filtering firewall B. Stateful packet filtering firewall C. Application layer firewall D. Gateway firewall
B. A stateful inspection firewall examines the content and context of each packet it encounters. This means that an SPI firewall understands the preceding packets that came from the same IP address. This makes certain attacks, like a SYN flood, almost impossible.
Option A is incorrect. Packet filtering firewalls examine each packet, but not the context.
Option C is incorrect. Application layer firewalls can use SPI or simple packet filtering, but their primary role is to examine application-specific issues. A classic example is a web application firewall.
Option D is incorrect. A gateway firewall is simply a firewall at the network gateway. This does not tell us whether it is packet filtering or SPI.
28. Suzan is responsible for application development in her company. She wants to have all web applications tested prior to being deployed live. She wants to use a test system that is identical to the live server. What is this called? A. Production server B. Development server C. Test server D. Predeployment server
C. A test server should be identical to the production server. This can be used for functional testing as well as security testing, prior to deploying the application.
Option A is incorrect. The production server is the live server.
Option B is incorrect. A development server would be one the programmers use during development of a web application.
Option D is incorrect. Predeployment server is not a term used in the industry.
30. You are responsible for BIOS security in your company. Which of the following is the most fundamental BIOS integrity technique? A. Verifying the BIOS version B. Using a TPM C. Managing BIOS passwords D. Backing up the BIOS
C. BIOS password management is the most basic security measure for the BIOS. Without this fundamental step, any other steps will be far less effective.
Options A and B are incorrect. NIST 800-155 does list both of these as BIOS integrity
measures, but they are not the most fundamental measures—passwords are.
Option D is incorrect. Backing up the BIOS is not a common security measure, and it certainly would not be the most fundamental step.
33. John is installing an HVAC system in his datacenter. What will this HVAC have the most impact on? A. Confidentiality B. Availability C. Fire suppression D. Monitoring access to the datacenter
B. A heating, ventilation, and air conditioning system will affect availability. By maintaining temperature and humidity, the servers in the datacenter are less likely to crash and thus be more available.
Option A is incorrect. HVACs have no effect on data confidentiality.
Option C is incorrect. HVACs are not fire suppression systems.
Option D is incorrect. HVACs are not monitoring systems.
- Maria is a security engineer with a manufacturing company. During a recent investigation, she discovered that an engineer’s compromised workstation was being used to connect to SCADA systems while the engineer was not logged in. The engineer is responsible for administering the SCADA systems and cannot be blocked from connecting to them.
What should Maria do to mitigate this threat?
A. Install host-based antivirus software on the engineer’s system.
B. Implement account usage auditing on the SCADA system.
C. Implement an NIPS on the SCADA system.
D. Use FDE on the engineer’s system.
B. Maria should implement ongoing auditing of the account usage on the SCADA system.
This will provide a warning that someone’s account is being used when they are not actually using it.
Option A is incorrect. Host based antivirus is almost never a bad idea. But this scenario did not indicate that the compromise was due to malware, so anti-malware may not address the threat.
Option C is incorrect. Since the engineer has access to the SCADA system, a NIPS is unlikely to block him from accessing the system.
Option D is incorrect. Full disk encryption will not mitigate this threat.
- Gerard is responsible for secure communications with his company’s e-commerce server.
All communications with the server use TLS. What is the most secure option for Gerard to store the private key on the e-commerce server?
A. HSM
B. FDE
C. SED
D. SDN
A. A hardware security module (HSM) is the most secure way to store private keys for the e-commerce server. An HSM is a physical device that safeguards and manages digital keys.
Option B is incorrect. Full disk encryption will protect the data on the e-commerce server, but it won’t help store the key. It is also difficult to fully encrypt the e-commerce server drive, since the drive will need to be in use for the e-commerce to function.
Option C is incorrect. A self-encrypting drive (SED) is just an automatic full disk encryption.
Option D is incorrect. Software-defined networking won’t address the issues in this scenario.
38. Web developers in your company currently have direct access to the production server and can deploy code directly to it. This can lead to unsecure code, or simply code flaws being deployed to the live system. What would be the best change you could make to mitigate this risk? A. Implement sandboxing. B. Implement virtualized servers. C. Implement a staging server. D. Implement deployment policies.
C. You should implement a staging server so that code can be deployed to an intermediate staging environment. This will allow testing of security features, as well as checking to see that the code integrates with the entire system. Using third-party libraries and SDKs can help reduce errors and vulnerabilities in the code.
Option A is incorrect. Sandboxing is used to isolate a particular environment.
Option B is incorrect. Virtualization will not mitigate this risk. Even if the production server is virtualized, the risks are the same.
Option D is incorrect. Deployment policies are a good idea, but they are not the most effective way to mitigate this particular risk.
39. Denish is concerned about the security of embedded devices in his company. He is most concerned about the operating system security for such devices. Which of the following would be the best option for mitigating this threat? A. RTOS B. SCADA C. FDE D. TPM
A. A real-time operating system is a secure system used for embedded devices. RTOSs were originally developed for military applications but were not available to the public.
Option B is incorrect. Although SCADA systems can sometimes be embedded systems, this won’t address the security concerns.
Option C is incorrect. Full drive encryption won’t address issues with the security of the operating system.
Option D is incorrect. A trusted platform module can be very useful for cryptographic applications, but it will not address the security of the operating system.
41. Teresa is responsible for WiFi security in her company. Which wireless security protocol uses TKIP? A. WPA B. CCMP C. WEP D. WPA2
A. The encryption technology associated with WPA is TKIP.
Option B is incorrect. CCMP is the technology used in WPA2. It combines AES in cipherblock chaining mode with a message authentication code.
Option C is incorrect. WEP uses RC4.
Option D is incorrect. WPA2 uses CCMP.
43. Which cloud service model provides the consumer with the infrastructure to create applications and host them? A. SaaS B. PaaS C. IaaS D. CaaS
B. In the Platform as a Service (PaaS) model, the consumer has access to the infrastructure to create applications and host them.
Option A is incorrect. Software as a Service simply supplies a particular application.
Option C is incorrect. Infrastructure as a Service provides entire network infrastructure.
Option D is incorrect. Cloud as a Service provides access to cloud storage
46. Which type of hypervisor implementation is known as “bare metal”? A. Ty pe I B. Ty pe II C. Type III D. Ty pe IV
A. Type I hypervisor implementations are known as “bare metal.”
Option B is incorrect. Type II hypervisors have to be installed on an underlying operating system.
Options C and D are incorrect. These are not valid hypervisor types.
- Mark is responsible for cybersecurity at a small college. There are many computer labs that are open for students to use. These labs are monitored only by a student worker, who may or may not be very attentive. Mark is concerned about the theft of computers. Which of the following would be the best way for him to mitigate this threat?
A. Cable locks
B. FDE on the lab computers
C. Strong passwords on the lab computers
D. Having a lab sign-in sheet
A. The correct answer is to attach cable locks to the computers that lock them to the table.
This makes it more difficult for someone to steal a computer.
Option B is incorrect. Full disk encryption won’t stop someone from stealing the computer.
Option C is incorrect. Strong passwords won’t stop someone from stealing a computer.
Option D is incorrect. A sign-in sheet is a good idea and may deter some thefts. But it is not the best approach to stopping theft.
56. Isabella is responsible for database management and security. She is attempting to remove redundancy in the database. What is this process called? A. Integrity checking B. Deprovisioning C. Baselining D. Normalization
D. Normalization is the process of removing duplication or redundant data from a database. There are typically four levels of normalization ranging from 1N at the lowest (i.e., the most duplication) to 4N at the highest (i.e., the least duplication).
Option A is incorrect. Although database integrity is important, that is not what is described in the question. Furthermore, integrity checking usually refers to checking the integrity of files.
Option B is incorrect. Deprovisioning is a virtualization term for removing a virtual system (server, workstation, etc.) and reclaiming those resources.
Option C is incorrect. Baselining involves setting security standards.
- Hans is a security administrator for a large company. Users on his network visit a wide range of websites. He is concerned they might get malware from one of these many websites. Which of the following would be his best approach to mitigate this threat?
A. Implement host-based antivirus.
B. Blacklist known infected sites.
C. Set browsers to allow only signed components.
D. Set browsers to block all active content (ActiveX, JavaScript, etc.).
C. The correct answer is to only allow signed components to be loaded in the browser.
Code signing verifies the originator of the component (such as an ActiveX component) and thus makes malware far less likely.
Option A is incorrect. Although host-based anti-malware is a good idea, it is not the best remedy for this specific threat.
Option B is incorrect. Blacklists cannot cover all sites that are infected, just the sites you know about. And given that users on Hans’s network visit a lot of websites, blacklisting is likely to be ineffective.
Option D is incorrect. If you block all active content, many websites will be completely unusable.
61. You are responsible for database security at your company. You are concerned that programmers might pass badly written SQL commands to the database, or that an attacker might exploit badly written SQL in applications. What is the best way to mitigate this threat? A. Programmer training B. Programming policies C. Agile programming D. Stored procedures
D. Stored procedures are the best way to have standardized SQL. Rather than programmers writing their own SQL commands, they simply call the stored procedures that the database administrator creates.
Options A and B are both incorrect. Although these are good ideas, they are not as effective as stored procedures in addressing concerns about bad SQL commands.
Option C is incorrect. Agile programming is a method for developing applications rapidly and won’t determine how SQL commands are created.
- Mary is concerned about application security for her company’s application development.
Which of the following is the most important step for addressing application security?
A. Proper error handling
B. Regular data backups
C. Encrypted data transmission
D. Strong authentication
A. Proper error handling is the most fundamental item to address in application development. Robust and thorough error handling will mitigate many security risks.
Options B, C, and D are all incorrect. Each of these is a good security measure but not the most important step for Mary to take.
- Farès is responsible for managing the many virtual machines on his company’s networks.
Over the past two years, the company has increased the number of virtual machines significantly. Farès is no longer able to effectively manage the large number of machines.
What is the term for this situation?
A. VM overload
B. VM sprawl
C. VM spread
D. VM zombies
B. When virtualization reaches the point that IT can no longer effectively manage it, the condition is known as VM sprawl.
Options A and C are incorrect. These are not the terms used in industry.
Option D is incorrect. VM zombie is a term for a virtual machine that is running and consuming resources but no longer has a purpose.
66. Juan is responsible for the physical security of the company server room. He has been asked to recommend a type of fire suppression system for the server room. Which of the following would be the best choice? A. Wet pipe B. Deluge C. Pre-action D. Halon
C. Pre-action fire suppression is ideal for computers. The pipes have no water in them during normal operations. When the temperature rises to a certain level, water fills the pipes.
Then if the temperature continues to rise, the fire suppression system activates. This provides time to stop the fire before the servers are soaked with water.
Option A is incorrect. Wet pipes have water in them at all times. If a pipe freezes and/or bursts, then the servers will be damaged.
Option B is incorrect. Deluge fire suppression, as the name suggests, uses a very large amount of water. This is not appropriate for computers.
Option D is incorrect. Halon is now banned.
- You are responsible for server room security for your company. You are concerned about physical theft of the computers. Which of the following would be best able to detect theft or attempted theft?
A. Motion sensor–activated cameras
B. Smart card access to the server rooms
C. Strong deadbolt locks for the server rooms
D. Logging everyone who enters the server room
A. The correct answer is to have a motion-activated camera that records everyone who enters the server room.
Options B, C, and D are all incorrect. These are all good security measures but won’t detect theft.
68. Teresa has deployed session tokens on her network. These would be most effective against which of the following attacks? A. DDoS B. Replay C. SYN flood D. Malware
B. Session tokens are used to authenticate sessions. These can be effective against replay attacks and session hijacking.
Options A, C, and D are all incorrect. Session tokens will not be effective in mitigating these attacks.
69. Hector is using infrared cameras to verify that servers in his datacenter are being properly racked. Which of the following datacenter elements is he concerned about? A. EMI blocking B. Humidity control C. Hot and cold aisles D. HVAC
C. Hot aisle/cold aisle is a layout design for server racks and other computing equipment in a data center. The goal of a hot aisle/cold aisle configuration is to conserve energy and lower cooling costs by managing airflow. An infrared camera will detect heat levels on the aisles.
Options A, B, and D are all incorrect. Although these are issues to be concerned about in a data center, the infrared camera is not an appropriate way to monitor them.
- Mark is an administrator for a health care company. He has to support an older, legacy application. He is concerned that this legacy application might have vulnerabilities that would affect the rest of the network. What is the most efficient way to mitigate this?
A. Use an application container.
B. Implement SDN.
C. Run the application on a separate VLAN.
D. Insist on an updated version of the application.
A. The correct answer is to use an application container to isolate that application from the host operating system. Applications containers provide a virtualized environment in which to run an application.
Option B is incorrect. Moving to software-defined networking is a very involved process and does not provide an efficient solution.
Option C is incorrect. Not only will this not separate the application from the host operating system; it might not solve the problem.
Option D is incorrect. This is not an option in this question. Mark must support the legacy application.
73. Lars is auditing the physical security of a company. The company uses chain-link fences on its perimeter. The fence is over pavement, not soft ground. How close to the ground should the bottom of the fence be? A. Touching the ground B. Within 4 inches C. There is no standard for this. D. Within 2 inches
D. The fence should reach within 2 inches of hard surfaces like pavement or concrete. For soft dirt it should actually go into the ground.
Options A and B are incorrect. These are not the correct measurements.
Option C is incorrect. Per the standard, chain-link fence should reach within 2 inches of hard surfaces like pavement or concrete. For soft dirt, it should actually go into the ground.
- Mia has to deploy and support a legacy application. The configuration for this application and the OS it runs on are very specific and cannot be changed. What is the best approach for her to deploy this?
A. Use an immutable server.
B. Use a VM.
C. Set permissions on the application so it cannot be changed.
D. Place the application on a separate VLAN.
A. An immutable(不可變) server’s configuration cannot be changed.
Option B is incorrect. A virtual machine won’t stop the application or the OS from being altered.
Option C is incorrect. This won’t prevent the OS from being altered.
Option D is incorrect. Segregating the application on a separate VLAN won’t address the issues.
- Abigail is responsible for datacenters in a large, multinational company. She has to support multiple datacenters in diverse geographic regions. What would be the most effective way for her to manage these centers consistently across the enterprise?
A. Hire datacenter managers for each center.
B. Implement enterprise-wide SDN.
C. Implement Infrastructure as Code (IaC).
D. Automate provisioning and deprovisioning.
C. The correct answer is to implement IaC. Infrastructure as Code (IaC) is the process of managing and provisioning computer datacenters through machine-readable definition files, rather than physical hardware configuration or interactive configuration tools.
Whether the data center(s) use physical machines or virtual machines, this is an effective way to manage the data centers.
Option A is incorrect. Although data center managers may be needed, that won’t necessarily provide consistent management across the enterprise.
Option B is incorrect. Software-defined networking will not fix this problem.
Option D is incorrect. The issue is not just provisioning; it is management.
