full_offl

Question 1

Front

Answer 1

Back

Question 2

What are the properties of a secure information processing system?

Answer 2

Confidentiality, Integrity, and Availability (and Non-repudiation).

Question 3

What term is used to describe the property of a secure network where a sender cannot deny having sent a message?

Answer 3

Non-repudiation.

Question 4

A multinational company manages a large amount of valuable intellectual property (IP) data, plus personal data for its customers and account holders. What type of business unit can be used to manage such important and complex security requirements?

Answer 4

A security operations center (SOC).

Question 5

A business is expanding rapidly and the owner is worried about tensions between its established IT and programming divisions. What type of security business unit or function could help to resolve these issues?

Answer 5

Development and operations (DevOps) is a cultural shift within an organization to encourage much more collaboration between developers and system administrators. DevSecOps embeds the security function within these teams as well.

Question 6

availability

Answer 6

The fundamental security goal of ensuring that computer systems operate continuously and that authorized persons can access data that they need.

Question 7

CIA triad

Answer 7

The three principles of security control and management. Also known as the information security triad. Also referred to in reverse order as the AIC triad.

Question 8

CISO (Chief Information Security Officer)

Answer 8

Typically the job title of the person with overall responsibility for information assurance and systems security. Sometimes referred to as Chief Information Officer (CIO).

Question 9

confidentiality

Answer 9

The fundamental security goal of keeping information and communications private and protecting them from unauthorized access.

Question 10

CSIRT (Computer Security Incident Response Team)

Answer 10

Team with responsibility for incident response. The CSIRT must have expertise across a number of business domains (IT, HR, legal, and marketing for instance).

Question 11

DevSecOps

Answer 11

A combination of software development, security operations, and systems operations, and refers to the practice of integrating each discipline with the others.

Question 12

integrity

Answer 12

The fundamental security goal of keeping organizational information accurate, free of errors, and without unauthorized modifications.

Question 13

ISSO (Information Systems Security Officer)

Answer 13

Organizational role with technical responsibilities for implementation of security policies, frameworks, and controls.

Question 14

NIST (National Institute of Standards and Technology)

Answer 14

Develops computer security standards used by US federal agencies and publishes cybersecurity best practice guides and research.

Question 15

non-repudiation

Answer 15

The security goal of ensuring that the party that sent a transmission or created data remains associated with that data and cannot deny sending or creating that data.

Question 16

SOC (security operations center)

Answer 16

The location where security professionals monitor and protect critical information assets in an organization.

Question 17

You have implemented a secure web gateway that blocks access to a social networking site. How would you categorize this type of security control?

Answer 17

It is a technical type of control (implemented in software) and acts as a preventive measure.

Question 18

A company has installed motion-activated floodlighting on the grounds around its premises. What class and function is this security control?

Answer 18

It would be classed as a physical control and its function is both detecting and deterring.

Question 19

A firewall appliance intercepts a packet that violates policy. It automatically updates its Access Control List to block all further packets from the source IP. What TWO functions is the security control performing?

Answer 19

Preventive and corrective.

Question 20

If a security control is described as operational and compensating, what can you determine about its nature and function?

Answer 20

That the control is enforced bya person rather than a technical system, and that the control has been developed to replicate the functionality of a primary control, as required by a security standard.

Question 21

If a company wants to ensure it is following best practice in choosing security controls, what type of resource would provide guidance?

Answer 21

A cybersecurity framework and/or benchmark and secure configuration guides.

Question 22

CIS (Center for Internet Security)

Answer 22

A not-for-profit organization (founded partly by SANS). It publishes the well-known “Top 20 Critical Security Controls” (or system design recommendations).

Question 23

Cloud Security Alliance

Answer 23

Industry body providing security guidance to CSPs, including enterprise reference architecture and security controls matrix.

Question 24

compensating control

Answer 24

A security measure that takes on risk mitigation when a primary control fails or cannot completely meet expectations.

Question 25

corrective control

Answer 25

A type of security control that acts after an incident to eliminate or minimize its impact.

Question 26

detective control

Answer 26

A type of security control that acts during an incident to identify or record that it is happening.

Question 27

deterrent control

Answer 27

A type of security control that discourages intrusion attempts.

Question 28

GDPR (General Data Protection Regulation)

Answer 28

Provisions and requirements protecting the personal data of European Union (EU) citizens. Transfers of personal data outside the EU Single Market are restricted unless protected by like-for-like regulations, such as the US’s Privacy Shield requirements.

Question 29

GLBA (Gramm-Leach-Bliley Act)

Answer 29

A law enacted in 1999 that deregulated banks, but also instituted requirements that help protect the privacy of an individual’s financial information that is held by financial institutions.

Question 30

ISO/IEC 27K (International Organization for Standardization 27000 Series)

Answer 30

A comprehensive set of standards for information security, including best practices for security and risk management, compliance, and technical implementation.

Question 31

ISO/IEC 31K (International Organization for Standardization 31000 Series)

Answer 31

A comprehensive set of standards for enterprise risk management.

Question 32

managerial control

Answer 32

A category of security control that gives oversight of the information system.

Question 33

operational control

Answer 33

A category of security control that is implemented by people.

Question 34

OWASP (Open Web Application Security Project)

Answer 34

A charity and community publishing a number of secure application development resources.

Question 35

PCI DSS (Payment Card Industry Data Security Standard)

Answer 35

Information security standard for organizations that process credit or bank card payments.

Question 36

physical control

Answer 36

A type of security control that acts against in-person intrusion attempts.

Question 37

security control

Answer 37

A technology or procedure put in place to mitigate vulnerabilities and risk and to ensure the confidentiality, integrity, and availability (CIA) of information.

Question 38

SOX (Sarbanes-Oxley Act)

Answer 38

A law enacted in 2002 that dictates requirements for the storage and retention of documents relating to an organization’s financial and business operations.

Question 39

SSAE SOC (Statements on Standards for Attestation Engagements Service Organization Control)

Answer 39

Audit specifications designed to ensure that cloud/hosting providers meet professional standards. A SOC2 Type II report is created for a restricted audience, while SOC3 reports are provided for general consumption.

Question 40

technical control

Answer 40

A category of security control that is implemented as a system (hardware, software, or firmware). Technical controls may also be described as logical controls.

Question 41

Which of the following would be assessed by likelihood and impact: vulnerability, threat, or risk?

Answer 41

Risk. To assess likelihood and impact, you must identify both the vulnerability and the threat posed by a potential exploit.

Question 42

True or false? Nation state actors primarily only pose a risk to other states.

Answer 42

False—nation state actors have targeted commercial interests for theft, espionage, and extortion.

Question 43

You receive an email with a screenshot showing a command prompt at one of your application servers. The email suggests you engage the hacker for a day’s consultancy to patch the vulnerability. How should you categorize this threat?

Answer 43

This is either gray hat (semi-authorized) hacking or black hat (non-authorized) hacking. If the request for compensation via consultancy is an extortion threat (if refused, the hacker sells the exploit on the dark web), then the motivation is purely financial gain and can be categorized as black hat. If the consultancy is refused and the hacker takes no further action, it can be classed as gray hat.

Question 44

Which type of threat actor is primarily motivated by the desire for social change?

Answer 44

Hacktivist.

Question 45

Which three types of threat actor are most likely to have high levels of funding?

Answer 45

State actors, criminal syndicates, and competitors.

Question 46

You are assisting with writing an attack surface assessment report for a small company. Following the CompTIA syllabus, which two potential attack vectors have been omitted from the following headings in the report? Direct access, Email, Remote and wireless, Web and social media, Cloud.

Answer 46

Removable media and supply chain.

Question 47

APT (advanced persistent threat)

Answer 47

An attacker’s ability to obtain, maintain, and diversify access to network systems using exploits and malware.

Question 48

attack surface

Answer 48

The points at which a network or application receives external connections or inputs/outputs that are potential vectors to be exploited by a threat actor.

Question 49

attack vector

Answer 49

A specific path by which a threat actor gains unauthorized access to a system. Also referred to as a vector

Question 50

black hat

Answer 50

A hacker operating with malicious intent.

Question 51

criminal syndicates

Answer 51

A type of threat actor that uses hacking and computer fraud for commercial gain. Also referred to as organized crime.

Question 52

gray hat

Answer 52

A hacker who analyzes networks without seeking authorization, but without overtly malicious intent.

Question 53

hacker

Answer 53

Often used to refer to someone who breaks into computer systems or spreads viruses, Ethical Hackers prefer to think of themselves as experts on and explorers of computer security systems.

Question 54

hacktivist

Answer 54

A threat actor that is motivated by a social issue or political cause.

Question 55

insider threat

Answer 55

A type of threat actor who is assigned privileges on the system that cause an intentional or unintentional incident.

Question 56

intentional threat

Answer 56

A threat actor with a malicious purpose.

Question 57

script kiddie

Answer 57

An inexperienced, unskilled attacker that typically uses tools or scripts created by others.

Question 58

shadow IT

Answer 58

Computer hardware, software, or services used on a private network without authorization from the system owner.

Question 59

state actor

Answer 59

A type of threat actor that is supported by the resources of its host country’s military and security services. Also referred to as a nation state actor.

Question 60

supply chain attack

Answer 60

An attack that targets the end-to-end process of manufacturing, distributing, and handling goods and services.

Question 61

threat

Answer 61

The potential for an entity to exercise a vulnerability (that is, to breach security).

Question 62

threat actor

Answer 62

The person or entity responsible for an event that has been identified as a security incident or as a risk.

Question 63

unintentional threat

Answer 63

A threat actor that causes a vulnerability or exposes an attack vector without malicious intent.

Question 64

vulnerability

Answer 64

A weakness that could be triggered accidentally or exploited intentionally to cause a security breach.

Question 65

white hat

Answer 65

A hacker engaged in authorized penetration testing or other security consultancy.

Question 66

You are consulting on threat intelligence solutions for a supplier of electronic voting machines. What type of threat intelligence source would produce the most relevant information at the lowest cost?

Answer 66

For critical infrastructure providers, threat data sharing via an Information Sharing and Analysis Center (ISAC) is likely to be the best option.

Question 67

Your CEO wants to know if the company’s threat intelligence platform makes effective use of OSINT. What is OSINT?

Answer 67

Open-source intelligence (OSINT) is cybersecurity-relevant information harvested from public websites and data records. In terms of threat intelligence specifically, it refers to research and data feeds that are made publicly available.

Question 68

You are assessing whether to join AIS. What is AIS and what protocol should your SIEM support in order to connect to AIS servers?

Answer 68

Automated Indicator Sharing (AIS) is a service offered by the Department of Homeland Security (DHS) for participating in threat intelligence sharing. AIS uses the Trusted Automated eXchange of Indicator Information (TAXII) protocol as a means of transmitting CTI data between servers and clients.

Question 69

AI (artificial intelligence)

Answer 69

The science of creating machines with the ability to develop problem solving and analysis strategies without significant human direction or intervention.

Question 70

AIS (Automated Indicator Sharing)

Answer 70

Threat intelligence data feed operated by the DHS.

Question 71

closed-source intelligence

Answer 71

Information that is obtained through private sources and disseminated through paid-for subscription or membership services.

Question 72

CTI (cyber threat intelligence)

Answer 72

The process of investigating, collecting, analyzing, and disseminating information about emerging threats and threat sources.

Question 73

CVE (Common Vulnerabilities and Exposures)

Answer 73

Scheme for identifying vulnerabilities developed by MITRE and adopted by NIST.

Question 74

dark web

Answer 74

Resources on the Internet that are distributed between anonymized nodes and protected from general access by multiple layers of encryption and routing.

Question 75

IoC (indicator of compromise)

Answer 75

A sign that an asset or network has been attacked or is currently under attack.

Question 76

ISAC (Information Sharing and Analysis Center)

Answer 76

Not-for-profit group set up to share sector-specific threat intelligence and security best practices amongst its members.

Question 77

ML (machine learning)

Answer 77

A component of AI that enables a machine to develop strategies for solving a task given a labeled data set where features have been manually identified but without further explicit instructions.

Question 78

OSINT (open-source intelligence)

Answer 78

Publicly available information plus the tools used to aggregate and search it.

Question 79

reputation data

Answer 79

Block lists of known threat sources, such as malware signatures, IP address ranges, and DNS domains. Also referred to as reputational threat intelligence.

Question 80

STIX (Structured Threat Information eXpression)

Answer 80

A framework for analyzing cybersecurity incidents.

Question 81

TAXII (Trusted Automated eXchange of Indicator Information)

Answer 81

A protocol for supplying codified information to automate incident detection and analysis.

Question 82

threat feed

Answer 82

Signatures and pattern-matching rules supplied to analysis platforms as an automated feed.

Question 83

threat map

Answer 83

Animated map showing threat sources in near real-time.

Question 84

TTP (tactics, techniques, and procedures)

Answer 84

Analysis of historical cyber-attacks and adversary actions.

Question 85

UAT (user acceptance testing)

Answer 85

Usually one of the last stages in software development before release (beta testing), UAT proves that a program is usable and fit-for-purpose in real-world conditions.

Question 86

You suspect that a rogue host is acting as the default gateway for a subnet in a spoofing attack. What command line tool(s) can you use from a Windows client PC in the same subnet to check the interface properties of the default gateway?

Answer 86

Use ipconfig to check the IP addresses of the default gateway and the DHCP server. Use arp to check the MAC addresses associated with those IP addresses and investigate possible spoofing. You could also use the route command to verify the properties of the default route.

Question 87

You suspect the rogue host is modifying traffic before forwarding it, with the side effect of increasing network latency. Which tool could you use to measure latency on traffic routed from this subnet?

Answer 87

From a Windows host, the pathping tool can be used to measure latency along a route.

Question 88

What type of tool could you use to fingerprint the host acting as the default gateway?

Answer 88

This requires a tool that performs fingerprinting—service and version detection—by examining responses to network probes and comparing them to known responses from common platforms. Nmap is very widely used for this task, or you could use hping or Netcat.

Question 89

You are investigating a Linux server that is the source of suspicious network traffic. At a terminal on the server, which tool could you use to check which process is using a given TCP port?

Answer 89

Thenetstatcommand can assist, however, use the more favorable ss command-line utility tool that is faster and more human-readable.

Question 90

What is a zone transfer and which reconnaissance tools can be used to test whether a server will allow one?

Answer 90

A zone transfer is where a domain name server (DNS) allows a client to request all the name records for a domain. nslookup (Windows) and dig (principally Linux) can be used to test whether this query is allowed. You could also mention the dnsenum tool, which will check for zone transfers along with other enumeration tests on DNS infrastructure.

Question 91

What type of organizational security assessment is performed using Nessus?

Answer 91

Nessus is an automated network vulnerability scanner that checks for software vulnerabilities and missing patches.

Question 92

You are developing new detection rules for a network security scanner. Which tool will be of use in testing whether the rules match a malicious traffic sample successfully?

Answer 92

The tcpreplay tool can be used to stream captured traffic from a file to a monitored network interface.

Question 93

What security posture assessment could a pen tester make using Netcat?

Answer 93

Whether it is possible to open a network connection to a remote host over a given port.

Question 94

curl command

Answer 94

Utility for command-line manipulation of URL-based protocol requests.

Question 95

dig

Answer 95

Utility to query a DNS and return information about a particular domain name. Also referred to as domain information groper.

Question 96

DNS harvesting

Answer 96

Using Open Source Intelligence (OSINT) to gather information about a domain (subdomains, hosting provider, administrative contacts, and so on). Also referred to as Domain Name System harvesting.

Question 97

enumeration

Answer 97

When an attacker tries to get a list of resources on the network, host, or system as a whole to identify potential targets for further attack

Question 98

exploitation framework

Answer 98

Suite of tools designed to automate delivery of exploits against common software and firmware vulnerabilities.

Question 99

fingerprinting

Answer 99

Identifying the type and version of an operating system (or server application) by analyzing its responses to network scans.

Question 100

footprinting

Answer 100

The phase in an attack or penetration test in which the attacker or tester gathers information about the target before attacking it.

Question 101

ifconfig command

Answer 101

A UNIX/Linux-based utility used to gather information about the IP configuration of the network adapter or to configure the network adapter. It has been replaced with the ip command in most Linux distributions.

Question 102

ip command

Answer 102

A Linux-based utility used to gather information about the IP configuration of the network adapter or to configure the network adapter. Replaces the older ifconfig command.

Question 103

ipconfig command

Answer 103

A Windows-based utility used to gather information about the IP configuration of a workstation.

Question 104

MAC address (Media Access Control address)

Answer 104

A unique hardware address hard-coded into a network adapter. This provides local addressing on Ethernet and Wi-Fi networks. A MAC address is 48 bits long with the first half representing the manufacturer’s Organizationally Unique Identifier (OUI).

Question 105

Metasploit Framework

Answer 105

A platform for launching modularized attacks against known software vulnerabilities.

Question 106

mtr command (my traceroute command)

Answer 106

Utility combining the ping and traceroute commands.

Question 107

ncat

Answer 107

Utility for reading and writing raw data over a network connection. Also referred to as netcat.

Question 108

Nessus

Answer 108

One of the best-known commercial vulnerability scanners, produced by Tenable Network Security. Also referred to as Tenable.

Question 109

netstat command

Answer 109

Utility to show network information on a machine running TCP/IP, notably active connections and the routing table.

Question 110

network mapping

Answer 110

Software that can scan a network and identify hosts, addresses, protocols, network interconnections, and so on.

Question 111

Nmap

Answer 111

Versatile port scanner used for topology, host, service, and OS discovery and enumeration.

Question 112

nslookup command

Answer 112

Software tool for querying DNS server records.

Question 113

packet analysis

Answer 113

Analysis of the headers and payload data of one or more frames in captured network traffic.

Question 114

packet trace analysis

Answer 114

The act of examining data packet communications to reveal insights without digging into packet content, such as when the packet contents are encrypted. Clues derived from packet trace analysis might help an intruder, but they are also quite useful for defensive monitoring and security intelligence analysis. Also referred to as traffic flow analysis.

Question 115

pathping command

Answer 115

Windows utility for measuring latency and packet loss along a route.

Question 116

PCAP (packet capture)

Answer 116

Standard format for recording packet captures to a file.

Question 117

ping command

Answer 117

Command-line utility for testing an IP packet transmission.

Question 118

port scanning

Answer 118

Enumerating the status of TCP and UDP ports on a target system using software tools.

Question 119

protocol analysis

Answer 119

Analysis of per-protocol utilization statistics in a packet capture or network traffic sampling.

Question 120

route

Answer 120

Command utility to configure and manage the routing table on a Windows or Linux host.

Question 121

scanless

Answer 121

Utility that runs port scans through third-party websites to evade detection.

Question 122

service discovery

Answer 122

The practice of using network scans to discover open TCP and UDP ports, plus information about the servers operating them.

Question 123

sn1per

Answer 123

Software utility designed for penetration testing reporting and evidence gathering that can also run automated test suites.

Question 124

tcpdump command

Answer 124

A command-line packet sniffing utility.

Question 125

tcpreplay command

Answer 125

A command-line utility that replays packets saved to a file back through a network adapter.

Question 126

theHarvester

Answer 126

Utility for gathering results from open source intelligence queries.

Question 127

tracert/traceroute command

Answer 127

Diagnostic utilities that trace the route taken by a packet as it “hops” to the destination host on a remote network. tracert is the Windows implementation, while traceroute runs on Linux.

Question 128

Wireshark

Answer 128

A widely-used packet analyzer.

Question 129

You are recommending that a business owner invest in patch management controls for PCs and laptops. What is the main risk from weak patch management procedures on such devices?

Answer 129

Vulnerabilities in the OS and applications software such as web browsers and document readers or in PC and adapter firmware can allow threat actors to run malware and gain a foothold on the network.

Question 130

You are advising a business owner on security for a PC running Windows XP. The PC runs process management software that the owner cannot run on Windows 10. What are the risks arising from this, and how can they be mitigated?

Answer 130

Windows XP is a legacy platform that is no longer receiving security updates. This means that patch management cannot be used to reduce risks from software vulnerabilities. The workstation should be isolated from other systems to reduce the risk of compromise.

Question 131

As a security solutions provider, you are compiling a checklist for your customers to assess potential weak configuration vulnerabilities, based on the CompTIA Security+ syllabus. From the headings you have added so far, which is missing and what vulnerability does it relate to? Default settings, Unsecured root accounts, Open ports and services, Unsecure protocols, Weak encryption, Errors.

Answer 131

Open permissions refers to misconfigured access rights for data folders, network file shares, and cloud storage.

Question 132

You are advising a customer on backup and disaster recovery solutions. The customer is confused between data breaches and data loss and whether the backup solution will protect against both. What explanation can you give?

Answer 132

Backup solutions mitigate risks from data loss, where files or information is deleted, corrupted, or otherwise destroyed. Backup does not mitigate risks from data breach, where confidential or private data is stolen (exfiltrated) and made public or sold for criminal profit. Mitigating risks of data breach requires effective secure processing, authorization, and authentication security controls.

Question 133

A system integrator is offering a turnkey solution for customer contact data storage and engagement analytics using several cloud services. Does this solution present any supply chain risks beyond those of the system integrator’s consulting company?

Answer 133

Yes, the system integrator is proposing the use of multiple vendors (the cloud service providers), with potentially complex issues for collecting, storing, and sharing customer personal data across these vendors. Each company in the supply chain should be assessed for risk and compliance with cybersecurity and privacy standards.

Question 134

ICMP (Internet Control Message Protocol)

Answer 134

IP-level protocol for reporting errors and status information supporting the function of troubleshooting utilities such as ping.

Question 135

supply chain

Answer 135

The end-to-end process of supplying, manufacturing, distributing, and finally releasing goods and services to a customer.

Question 136

third-party risks

Answer 136

Vulnerabilities that arise from dependencies in business relationships with suppliers and customers.

Question 137

vendor management

Answer 137

Policies and procedures to identify vulnerabilities and ensure security of the supply chain.

Question 138

zero-day

Answer 138

A vulnerability in software that is unpatched by the developer or an attack that exploits such a vulnerability.

Question 139

You have received an urgent threat advisory and need to configure a network vulnerability scan to check for the presence of a related CVE on your network. What configuration check should you make in the vulnerability scanning software before running the scan?

Answer 139

Verify that the vulnerability feed/plug-in/test has been updated with the specific CVE that you need to test for.

Question 140

You have configured a network vulnerability scanner for an engineering company. When running a scan, multiple sensors within an embedded systems network became unresponsive, causing a production shutdown. What alternative method of vulnerability scanning should be used for the embedded systems network?

Answer 140

A fully non-intrusive solution should be adopted, such as sniffing traffic using a network tap or mirror port. Using the network traffic to detect vulnerabilities rather than actively probing each device will not cause system stability issues (though there is greater risk of false positive and false negative results).

Question 141

A vulnerability scan reports that a CVE associated with CentOS Linux is present on a host, but you have established that the host is not running CentOS. What type of scanning error event is this?

Answer 141

False positive.

Question 142

A small company that you provide security consulting support to has resisted investing in an event management and threat intelligence platform. The CEO has become concerned about an APT risk known to target supply chains within the company’s industry sector and wants you to scan their systems for any sign that they have been targeted already. What are the additional challenges of meeting this request, given the lack of investment?

Answer 142

Collecting network traffic and log data from multiple sources and then analyzing it manually will require many hours of analyst time. The use of threat feeds and intelligence fusion to automate parts of this analysis effort would enable a much swifter response.

Question 143

What term refers to assessment techniques that avoid alerting threat actors?

Answer 143

This can be referred to as maneuver.

Question 144

CVSS (Common Vulnerability Scoring System)

Answer 144

A risk management approach to quantifying vulnerability data and then taking into account the degree of risk to different types of systems or information.

Question 145

intelligence fusion

Answer 145

In threat hunting, using sources of threat intelligence data to automate detection of adversary IoCs and TTPs.

Question 146

maneuver

Answer 146

In threat hunting, the concept that threat actor and defender may use deception or counterattacking strategies to gain positional advantage.

Question 147

passive scan

Answer 147

An enumeration or vulnerability scan that analyzes only intercepted network traffic rather than sending probes to a target. More generally, passive reconnaissance techniques are those that do not require direct interaction with the target.

Question 148

SCAP (Security Content Automation Protocol)

Answer 148

A NIST framework that outlines various accepted practices for automating vulnerability scanning.

Question 149

threat hunting

Answer 149

Cybersecurity technique designed to detect presence of threats that have not been discovered by normal security monitoring.

Question 150

vulnerability assessment

Answer 150

An evaluation of a system’s security and ability to meet compliance requirements based on the configuration state of the system, as represented by information collected from the system.

Question 151

vulnerability feed

Answer 151

A synchronizable list of data and scripts used to check for vulnerabilities. Also referred to as plug-ins or network vulnerability tests (NVTs).

Question 152

vulnerability scanner

Answer 152

Hardware or software configured with a list of known weaknesses and exploits and can scan for their presence in a host OS or particular application.

Question 153

A website owner wants to evaluate whether the site security mitigates risks from criminal syndicates, assuming no risk of insider threat. What type of penetration testing engagement will most closely simulate this adversary capability and resources?

Answer 153

Athreat actor has no privileged information about the website configuration or security controls. This is simulated in a black box (or blind) pen test engagement.

Question 154

You are agreeing a proposal to run a series of team-based exercises to test security controls under different scenarios. You propose using purple team testing, but the contracting company is only familiar with the concept of red and blue teams. What is the advantage of running a purple team exercise?

Answer 154

In a red versus blue team, there is no contact between the teams, and no opportunity to collaborate on improving security controls. In a purple team exercise, there is regular contact and knowledge sharing between the teams throughout the progression of the exercise.

Question 155

Why should an Internet service provider (ISP) be informed before pen testing on a hosted website takes place?

Answer 155

ISPs monitor their networks for suspicious traffic and may block the test attempts. The pen test may also involve equipment owned and operated by the ISP.

Question 156

What tools are used for OSINT?

Answer 156

Open-source intelligence is a reconnaissance activity to gather information about the target from any public source. The basic tool is web searches/queries plus sites that scan/scrape/monitor vulnerabilities in Internet-facing services and devices. There are also specialist OSINT tools, such as theHarvester, that aggregate data from queries for different resources.

Question 157

In the context of penetration testing, what is persistence?

Answer 157

Persistence refers to the tester’s ability to reconnect to the compromised host and use it as a remote access tool (RAT) or backdoor.

Question 158

black box

Answer 158

An assessment methodology where the assessor is given no privileged information about the configuration of the target of assessment.

Question 159

blue team

Answer 159

The defensive team in a penetration test or incident response exercise.

Question 160

bug bounty

Answer 160

Reward scheme operated by software and web services vendors for reporting vulnerabilities.

Question 161

gray box

Answer 161

An assessment methodology that simulates an inside attacker who knows something about a target, but not everything.

Question 162

lateral movement

Answer 162

The process by which an attacker is able to move from one part of a computing environment to another.

Question 163

packet sniffing

Answer 163

Recording data from frames as they pass over network media, using methods such as a mirror port or tap device.

Question 164

penetration testing

Answer 164

A test that uses active tools and security utilities to evaluate security by simulating an attack on a system. A pen test will verify that a threat exists, then will actively test and bypass security controls, and will finally exploit vulnerabilities on the system. Also referred to as pentesting, or pentest.

Question 165

persistence

Answer 165

In cybersecurity, the ability of a threat actor to maintain covert access to a target host or network.

Question 166

persistence (threat)

Answer 166

In threat analysis, the ability of a threat actor to maintain access of a host through system shut down, reboot, or log off events.

Question 167

purple team

Answer 167

A mode of penetration testing where red and blue teams share information and collaborate throughout the engagement.

Question 168

red team

Answer 168

The “hostile” or attacking team in a penetration test or incident response exercise.

Question 169

rules of engagement

Answer 169

Agreeing scope, operational parameters, and reporting requirements for a penetration test.

Question 170

social engineering

Answer 170

An activity where the goal is to use deception and trickery to convince unsuspecting users to provide sensitive data or to violate security guidelines.

Question 171

UAV (unmanned aerial vehicle)

Answer 171

An aircraft or drone that does not require an onboard human pilot.

Question 172

war driving

Answer 172

The practice of using a Wi-Fi sniffer to detect WLANs and then either making use of them (if they are open/unsecured) or trying to break into them (using WEP and WPA cracking tools).

Question 173

white box

Answer 173

An assessment methodology that simulates an inside attacker that knows everything about the target.

Question 174

white team

Answer 174

Staff administering, evaluating, and supervising a penetration test or incident response exercise.

Question 175

credential harvesting

Answer 175

Social engineering techniques for gathering valid credentials to use to gain unauthorized access.

Question 176

dumpster diving

Answer 176

The social engineering technique of discovering things about an organization (or person) based on what it throws away.

Question 177

hoax

Answer 177

A malicious communication that tricks the user into performing undesired actions, such as deleting important system files in an attempt to remove a virus, or sending money or important information.

Question 178

identity fraud

Answer 178

The invention of fake personal information or the theft and misuse of an individual’s personal information.

Question 179

impersonation

Answer 179

Social engineering attack where an attacker pretends to be someone they are not.

Question 180

pharming

Answer 180

An impersonation attack in which a request for a website, typically an e-commerce site, is redirected to a similar-looking, but fake, website.

Question 181

phishing

Answer 181

A type of email-based social engineering attack, in which the attacker sends email from a supposedly reputable source, such as a bank, to try to elicit private information from the victim.

Question 182

shoulder surfing

Answer 182

A social engineering tactic to obtain someone’s password or PIN by observing him or her as he or she types it in.

Question 183

SMiShing

Answer 183

A form of phishing that uses SMS text messages to trick a victim into revealing information.

Question 184

spam

Answer 184

Junk messages sent over email (or instant messaging, which is called spim). It can also be utilized within social networking sites.

Question 185

spear phishing

Answer 185

An email-based or web-based form of phishing which targets specific individuals.

Question 186

SPIM (spam over internet messaging)

Answer 186

A spam attack that is propagated through instant messaging rather than email.

Question 187

spoofing

Answer 187

An attack technique where the attacker disguises their identity.

Question 188

tailgating

Answer 188

Social engineering technique to gain access to a building by following someone who is unaware of their presence.

Question 189

typosquatting

Answer 189

An attack—also called URL hijacking—in which an attacker registers a domain name with a common misspelling of an existing domain, so that a user who misspells a URL they enter into a browser is taken to the attacker’s website.

Question 190

vishing

Answer 190

A human-based attack where the attacker extracts information while speaking over the phone or leveraging IP-based voice messaging services (VoIP).

Question 191

watering hole attack

Answer 191

An attack in which an attacker targets specific groups or organizations, discovers which websites they frequent, and injects malicious code into those sites.

Question 192

whaling

Answer 192

An email-based or web-based form of phishing which targets senior executives or wealthy individuals.

Question 193

The help desk takes a call and the caller states that she cannot connect to the e-commerce website to check her order status. She would also like a user name and password. The user gives a valid customer company name but is not listed as a contact in the customer database. The user does not know the correct company code or customer ID. Is this likely to be a social engineering attempt, or is it a false alarm?

Answer 193

This is likely to be a social engineering attempt. The help desk should not give out any information or add an account without confirming the caller’s identity.

Question 194

Users at an organization frequent a site where browsing a list of products for purchase is possible. Lately, when visiting the site, an unrecognized window opens claiming that anti-malware software has detected files infected with viruses. Instructions in the window indicate the user should click a link to install software that will remove these infections. What type of attack has occurred?

Answer 194

This a watering hole attack, which is an attack in which an attacker targets specific groups or organizations, discovers which websites they frequent, and injects malicious code into those sites.

Question 195

Your CEO calls to request market research data immediately be forwarded to her personal email address. You recognize her voice, but a proper request form has not been filled out, and use of third-party email is prohibited. She states that, normally, she would fill out the form and should not be an exception, but she urgently needs the data to prepare for a round table at a conference she is attending. What type of social engineering techniques could this use, or is it a false alarm?

Answer 195

This could be a social engineering use case where impersonation has occurred. A combination of spear phishing (attack using specific details) and vishing (attack over a voice channel) attacks were used by the impersonator. A type of voice mimicry technology may have been used to sound like the real CEO. A safe approach would be to contact the CEO back on a known mobile number to confirm the request.

Question 196

A company that manages marketing data and private information for many high-profile clients hosts a public event for prospective employees. With the possibility of social engineering attacks in mind, what precautions should employees take when the guests are being shown around the office?

Answer 196

Employees should specifically be wary of shoulder surfing attempts to observe passwords and the like.

Question 197

abnormal process behavior

Answer 197

Indicators that a legitimate process has been corrupted with malicious code for the purpose of damaging or compromising the system.

Question 198

adware

Answer 198

Software that records information about a PC and its user. Adware is used to describe software that the user has acknowledged can record information about their habits.

Question 199

anomaly analysis

Answer 199

A network monitoring system that uses a baseline of acceptable outcomes or event patterns to identify events that fall outside the acceptable range. Also referred to as anomaly-based detection

Question 200

A-V (antivirus scanner)

Answer 200

Software capable of detecting and removing virus infections and (in most cases) other types of malware, such as worms, Trojans, rootkits, adware, spyware, password crackers, network mappers, DoS tools, and so on.

Question 201

backdoor

Answer 201

A mechanism for gaining access to a computer that bypasses or subverts the normal method of authentication.

Question 202

beaconing

Answer 202

A means for a network node to advertise its presence and establish a link with other nodes, such as the beacon management frame sent by an AP. Legitimate software and appliances do this but it is also associated with Remote Access Trojans (RAT) communicating with a Command & Control server.

Question 203

botnet

Answer 203

A set of hosts that has been infected by a control program called a bot that enables attackers to exploit the hosts to mount attacks.

Question 204

C&C (command and control)

Answer 204

An infrastructure of hosts and services with which attackers direct, distribute, and control malware over botnets. Also referred to as C2.

Question 205

commodity malware

Answer 205

Malicious software applications that are widely available for sale or easily obtainable and usable.

Question 206

covert channel

Answer 206

A type of attack that subverts network security systems and policies to transfer data without authorization or detection.

Question 207

Cuckoo

Answer 207

Implementation of a sandbox for malware analysis.

Question 208

IRC (internet relay chat)

Answer 208

A group communications protocol that enables users to chat, send private messages, and share files.

Question 209

keylogger

Answer 209

Malicious software or hardware that can record user keystrokes.

Question 210

logic bomb

Answer 210

A malicious program or script that is set to run under particular circumstances or in response to a defined event.

Question 211

malicious process

Answer 211

A process executed without proper authorization from the system owner for the purpose of damaging or compromising the system.

Question 212

PUP (potentially unwanted program)

Answer 212

Software that cannot definitively be classed as malicious, but may not have been chosen by or wanted by the user.

Question 213

ransomware

Answer 213

A type of malware that tries to extort money from the victim..

Question 214

RAT (remote access Trojan)

Answer 214

Malware that creates a backdoor remote administration channel to allow a threat actor to access and control the infected host.

Question 215

rootkit

Answer 215

A class of malware that modifies system files, often at the kernel level, to conceal its presence.

Question 216

shellcode

Answer 216

Lightweight block of malicious code that exploits a software vulnerability to gain initial access to a victim system.

Question 217

spyware

Answer 217

Software that records information about a PC and its users, often installed without the user’s consent.

Question 218

Sysinternals

Answer 218

A suite of tools designed to assist with troubleshooting issues with Windows.

Question 219

Trojan

Answer 219

A malicious software program hidden within an innocuous-seeming piece of software. Usually, the Trojan is used to try to compromise the security of the target computer.

Question 220

virus

Answer 220

Code designed to infect computer files (or disks) when it is activated.

Question 221

worm

Answer 221

A type of malware that replicates in system memory and can spread over network connections rather than infecting files.

Question 222

cookie

Answer 222

Text file used to store information about a user when they visit a website. Some sites use cookies to support user sessions.

Question 223

You are troubleshooting a user’s workstation. At the computer, an app window displays on the screen claiming that all of your files are encrypted. The app window demands that you make an anonymous payment if you ever want to recover your data. What type of malware has infected the computer?

Answer 223

This is some type of ransomware, but it will take more investigation whether it is actually crypto-malware or not.

Question 224

You are recommending different antivirus products to the CEO of small travel services firm. The CEO is confused, because they had heard that Trojans represent the biggest threat to computer security these days. What explanation can you give?

Answer 224

While antivirus (A-V) remains a popular marketing description, all current security products worthy of consideration will try to provide protection against a full range of malware and potentially unwanted program (PUP) threats.

Question 225

You are writing a security awareness blog for company CEOs subscribed to your threat platform. Why are backdoors and Trojans different ways of classifying and identifying malware risks?

Answer 225

A Trojan means a malicious program masquerading as something else; a backdoor is a covert means of accessing a host or network. A Trojan need not necessarily operate a backdoor and a backdoor can be established by exploits other than using Trojans. The term remote access trojan (RAT) is used for the specific combination of Trojan and backdoor.

Question 226

You are investigating a business email compromise (BEC) incident. The email account of a developer has been accessed remotely over webmail. Investigating the developer’s workstation finds no indication of a malicious process, but you do locate an unknown USB extension device attached to one of the rear ports. Is this the most likely attack vector, and what type of malware would it implement?

Answer 226

It is likely that the USB device implements a hardware-based keylogger. This would not necessarily require any malware to be installed or leave any trace in the file system.

Question 227

A user’s computer is performing extremely slowly. Upon investigating, you find that a process named n0tepad.exe is utilizing the CPU at rates of 80-90%. This is accompanied by continual small disk reads and writes to a temporary folder. Should you suspect malware infection and is any particular class of indicated?

Answer 227

Yes, this is malware as the process name is trying to masquerade as a legitimate process. It is not possible to conclusively determine the type without more investigation, but you might initially suspect a crypto-miner/crypto-jacker.

Question 228

Is Cuckoo a type of malware or a security product?

Answer 228

Cuckoo is a security product designed to analyze malware as it runs in an isolated sandbox environment.

Question 229

AES (Advanced Encryption Standard)

Answer 229

A symmetric 128-, 192-, or 256-bit block cipher based on the Rijndael algorithm developed by Belgian cryptographers Joan Daemen and Vincent Rijmen and adopted by the U.S. government as its encryption standard to replace DES.

Question 230

algorithm

Answer 230

Any defined method of performing a process, but in encryption, the term specifically refers to the technique used to encrypt a message. Also referred to as Cipher

Question 231

asymmetric algorithm

Answer 231

A cipher that uses public and private keys. The keys are mathematically linked, using either Rivel, Shamir, Adleman (RSA) or elliptic curve cryptography (ECC) alogrithms, but the private key is not derivable from the public one. An asymmetric key cannot reverse the operation it performs, so the public key cannot decrypt what it has encrypted, for example.

Question 232

block cipher

Answer 232

A type of symmetric encryption that encrypts data one block at a time. It is usually more secure, but is also slower, than stream ciphers.

Question 233

ciphertext

Answer 233

Data that has been enciphered and cannot be read without the cipher key.

Question 234

cleartext

Answer 234

Unencrypted data that is meant to be encrypted before it is transmitted, or the result of decryption of encrypted data. Also referred to as plaintext.

Question 235

cryptanalysis

Answer 235

The science, art, and practice of breaking codes and ciphers.

Question 236

cryptography

Answer 236

The science and practice of altering data to make it unintelligible to unauthorized parties.

Question 237

ECC (elliptic curve cryptography)

Answer 237

An asymmetric encryption algorithm that leverages the algebraic structures of elliptic curves over finite fields to derive public/private key pairs.

Question 238

hashing

Answer 238

A function that converts an arbitrary length string input to a fixed length string output. A cryptographic hash function does this in a way that reduces the chance of collisions, where two different inputs produce the same output. Also referred to as message digest.

Question 239

key

Answer 239

In cryptography, a specific piece of information that is used in conjunction with an algorithm to perform encryption and decryption.

Question 240

MD5 (Message Digest Algorithm v5)

Answer 240

A cryptographic hash function producing a 128-bit output.

Question 241

private key

Answer 241

In asymmetric encryption, the private key is known only to the holder and is linked to, but not derivable from, a public key distributed to those with which the holder wants to communicate securely. A private key can be used to encrypt data that can be decrypted by the linked public key or vice versa.

Question 242

public key

Answer 242

During asymmetric encryption, this key is freely distributed and can be used to perform the reverse encryption or decryption operation of the linked private key in the pair.

Question 243

RC4 (Rivest Cipher #4)

Answer 243

A symmetric stream cipher generally considered obsolete, as it does not support large key sizes and is vulnerable to several attacks.

Question 244

RSA (Rivest Shamir Adelman)

Answer 244

Named for its designers, Ronald Rivest, Adi Shamir, and Len Adelman, the first successful algorithm for public key encryption with a variable key length and block size.

Question 245

SHA (Secure Hash Algorithm)

Answer 245

A cryptographic hashing algorithm created to address possible weaknesses in MDA. The current version is SHA-2.

Question 246

stream cipher

Answer 246

A type of symmetric encryption that combines a stream of plaintext bits or bytes with a pseudorandom stream initialized by a secret key.

Question 247

symmetric encryption

Answer 247

A two-way encryption scheme in which encryption and decryption are both performed by the same key. Also known as shared-key encryption.

Question 248

trapdoor functions

Answer 248

Mathematical ciphers that use an operation which is simple to perform one way when all of the values are known, but is difficult to reverse.

Question 249

Which part of a simple cryptographic system must be kept secret—the cipher, the ciphertext, or the key?

Answer 249

In cryptography, the security of the message is guaranteed by the security of the key. The system does not depend on hiding the algorithm or the message (security by obscurity).

Question 250

Considering that cryptographic hashing is one-way and the digest cannot be reversed, what makes hashing a useful security technique?

Answer 250

Because two parties can hash the same data and compare checksums to see if they match, hashing can be used for data verification in a variety of situations, including password authentication. Hashes of passwords, rather than the password plaintext, can be stored securely or exchanged for authentication. A hash of a file or a hash code in an electronic message can be verified by both parties.

Question 251

Which security property is assured by symmetric encryption?

Answer 251

Confidentiality—symmetric ciphers are generally fast and well suited to bulk encrypting large amounts of data.

Question 252

What are the properties of a public/private key pair?

Answer 252

Each key can reverse the cryptographic operation performed by its pair but cannot reverse an operation performed by itself. The private key must be kept secret by the owner, but the public key is designed to be widely distributed. The private key cannot be determined from the public key, given a sufficient key size.

Question 253

CBC (cipher block chaining)

Answer 253

An encryption mode of operation where an exclusive or (XOR) is applied to the first plaintext block.

Question 254

CCMP (counter mode with cipher block chaining message authentication code protocol)

Answer 254

An encryption protocol used for wireless LANs that addresses the vulnerabilities of the WEP protocol.

Question 255

cipher suite

Answer 255

Lists of cryptographic algorithms that a server and client can use to negotiate a secure connection.

Question 256

counter mode

Answer 256

An encryption mode of operation where a numerical counter value is used to create a constantly changing IV. Also referred to as CTM (counter mode) and CM (counter mode).

Question 257

DH (Diffie-Hellman)

Answer 257

A cryptographic technique that provides secure key exchange.

Question 258

DHE (Diffie-Hellman Ephemeral)

Answer 258

A cryptographic protocol that is based on Diffie-Hellman and that provides for secure key exchange by using ephemeral keys.

Question 259

digital signature

Answer 259

A message digest encrypted using the sender’s private key that is appended to a message to authenticate the sender and prove message integrity.

Question 260

DSA (Digital Signature Algorithm)

Answer 260

public key encryption standard used for digital signatures that provides authentication and integrity verification for messages.

Question 261

ECDHE (Elliptic Curve Diffie-Hellman Ephemeral)

Answer 261

A cryptographic protocol that is based on Diffie-Hellman and that provides for secure key exchange by using ephemeral keys and elliptic curve cryptography.

Question 262

ECDSA (Elliptic Curve Digital Signature Algorithm)

Answer 262

Implementation of the DSA cipher that uses the ECC algorithm.

Question 263

echo

Answer 263

Command-line utility used to display messages and turn command echoing on or off.

Question 264

ephemeral

Answer 264

In cryptography, a key that is used within the context of a single session only.

Question 265

GCM (Galois/Counter Mode)

Answer 265

A mode of block chained encryption that provides message authenticity for each block.

Question 266

HMAC (hash-based message authentication code)

Answer 266

A method used to verify both the integrity and authenticity of a message by combining a cryptographic hash of the message with a secret key.

Question 267

key exchange

Answer 267

Any method by which cryptographic keys are transferred among users, thus enabling the use of a cryptographic algorithm.

Question 268

mode of operation

Answer 268

Implementation of a block symmetric cipher, with some modes allowing secure encryption of a stream of data, with or without authentication for each block.

Question 269

PFS (perfect forward secrecy)

Answer 269

A characteristic of transport encryption that ensures if a key is compromised the compromise will only affect a single session and not facilitate recovery of plaintext data from other sessions.

Question 270

XOR (exclusive OR)

Answer 270

An operation that outputs to true only if one input is true and the other input is false.

Question 271

What is the process of digitally signing a message?

Answer 271

A hashing function is used to create a message digest. The digest is then signed using the sender’s private key. The resulting signature can be decrypted by the recipient using the sender’s public key and cannot be modified by any other agency. The recipient can calculate his or her own digest of the message and compare it to the signed hash to validate that the message has not been altered.

Question 272

In a digital envelope, which key encrypts the session key?

Answer 272

The recipient’s public key (typically from the server’s key pair).

Question 273

True or False? Perfect forward secrecy (PFS) ensures that a compromise of a server’s private key will not also put copies of traffic sent to that server in the past at risk of decryption.

Answer 273

True. PFS ensures that ephemeral keys are used to encrypt each session. These keys are destroyed after use.

Question 274

Why does Diffie-Hellman underpin perfect forward secrecy (PFS)?

Answer 274

Diffie-Hellman allows the sender and recipient to derive the same value (the session key) from some other pre-agreed values. Some of these are exchanged, and some kept private, but there is no way for a snooper to work out the secret just from the publicly exchanged values. This means session keys can be created without relying on the server’s private key, and that it is easy to generate ephemeral keys that are different for each session.

Question 275

What type of bulk encryption cipher mode of operation offers the best security?

Answer 275

Generally, counter modes implementing Authenticated Encryption with Additional Data (AEAD). Specific examples include AES-GCM and ChaCha20-Poly1305.

Question 276

birthday attack

Answer 276

A type of password attack that exploits weaknesses in the mathematical algorithms used to encrypt passwords, in order to take advantage of the probability of different password inputs producing the same encrypted output.

Question 277

collision

Answer 277

In cryptography, the act of two different plaintext inputs producing the same exact ciphertext output.

Question 278

cryptographic primitive

Answer 278

A single hash function, symmetric cipher, or asymmetric cipher.

Question 279

downgrade attack

Answer 279

A cryptographic attack where the attacker exploits the need for backward compatibility to force a computer system to abandon the use of encrypted messages in favor of plaintext messages.

Question 280

entropy

Answer 280

A measure of disorder. Cryptographic systems should exhibit high entropy to better resist brute force attacks.

Question 281

key stretching

Answer 281

A technique that strengthens potentially weak input for cryptographic key generation, such as passwords or passphrases created by people, against bruteforce attacks.

Question 282

MAC (Message Authentication Code)

Answer 282

Proving the integrity and authenticity of a message by combining its hash with a shared secret.

Question 283

nonce

Answer 283

An arbitrary number used only once in a cryptographic communication, often to prevent replay attacks.

Question 284

PBKDF2 (Password-Based Key Derivation Function #2)

Answer 284

Implementation of key stretching to make potentially weak input used to derive a cryptographic key, such as short passwords, less susceptible to brute force attacks.

Question 285

PRNG (pseudorandom number generator)

Answer 285

The process by which an algorithm produces numbers that approximate randomness without being truly random.

Question 286

RNG (random number generator)

Answer 286

A hardware or software component that can create values that are evenly spread over all possible values, each value being independent of any other generated values.

Question 287

salt

Answer 287

A security countermeasure that mitigates the impact of a rainbow table attack by adding a random value to (“salting”) each plaintext input.

Question 288

TRNG (true random number generator)

Answer 288

A method of generating random values by sampling physical phenomena that has a high rate of entropy.

Question 289

True or false? Cryptography is about keeping things secret so they cannot be used as the basis of a non-repudiation system.

Answer 289

False—the usages are not exclusive. There are different types of cryptography and some can be used for non-repudiation. The principle is that if an encryption method (cipher and key) is known only to one person, that person cannot then deny having composed a message. This depends on the algorithm design allowing recipients to decrypt the message but not encrypt it.

Question 290

How can cryptography support high resiliency?

Answer 290

A complex system might have to support many inputs from devices installed to potentially unsecure locations. Such a system is resilient if compromise of a small part of the system is prevented from allowing compromise of the whole system. Cryptography assists this goal by ensuring the authentication and integrity of messages delivered over the control system.

Question 291

For which types of system will a cipher suite that exhibits high latency be problematic?

Answer 291

High latency is not desirable in any system really, but it will affect real-time protocols that exchange voice or video most. In network communications, latency makes the initial protocol handshake longer, meaning delay for users and possible application timeout issues.

Question 292

What is the relevance of entropy to cryptographic functions?

Answer 292

Entropy is a measure of how disordered something is. A disordered ciphertext is desirable, because remaining features of order from the plaintext make the ciphertext vulnerable to analysis. Identical plaintexts need to be initialized with random or counter values when encrypted by the same key, and the cryptosystem needs a source of randomness to generate strong keys.

Question 293

Your company creates software that requires a database of stored encrypted passwords. What security control could you use to make the password database more resistant to brute force attacks?

Answer 293

Using a key stretching password storage library, such as PBKDF2, improves resistance to brute-force cracking methods. You might also mention that you could use policies to make users choose longer, non-trivial passwords.

Question 294

blockchain

Answer 294

A concept in which an expanding list of transactional records listed in a public ledger is secured using cryptography.

Question 295

homomorphic encryption

Answer 295

Method that allows computation of certain fields in a data set without decrypting it.

Question 296

lightweight cryptography

Answer 296

Cryptographic algorithms with reduced compute requirements that are suitable for use in resource-constrained environments, such as battery-powered devices.

Question 297

post-quantum

Answer 297

Anticipating challenges to current cryptographic implementations and general security issues in a world where threat actors have accesss to significant quantum processing capability.

Question 298

quantum cryptography

Answer 298

Using quantum computing for cryptographic tasks, such as distributing keys or cracking (traditional) cryptographic systems. Quantum computing works on the principle that its units (qubits) have more properties than the bits used in “classical” computers, notably (and very crudely) that a qubit can have a probability of being 1 or 0 and that inspecting the value of one qubit can instantly determine that of others (entanglement).

Question 299

steganography

Answer 299

A technique for obscuring the presence of a message, often by embedding information within a file or other entity.

Question 300

Which cryptographic technology is most useful for sharing medical records with an analytics company?

Answer 300

Homomorphic encryption allows calculations to be performed while preserving privacy and confidentiality by keeping the data encrypted.

Question 301

You are assisting a customer with implementing data loss prevention (DLP) software. Of the two products left in consideration, one supports steganalysis of image data, but the other does not. What is the risk of omitting this capability?

Answer 301

A threat actor could conceal information within an image file and use that to bypass the DLP system. One thing to note is that attackers could find other ways to implement covertexts (audio or video, for instance) or abuse protocol coding. There are many things that steganalysis needs to be able to scan for! You might also note that steganography is not only a data exfiltration risk. It can also be used to smuggle malicious code into a host system.

Question 302

CA (certificate authority)

Answer 302

A server that guarantees subject identities by issuing signed digital certifcate wrappers for their public keys.

Question 303

certificate

Answer 303

An X.509 digital certificate is issued by a Certificate Authority (CA) as a guarantee that a public key it has issued to an organization to encrypt messages sent to it genuinely belongs to that organization.

Question 304

certificate extensions

Answer 304

A certificate field defined by version 3 of the X.509 standard that enables additional information to be included about a certificate.

Question 305

certificate policy

Answer 305

A document that defines the different types of certificates issued by a CA.

Question 306

CN (common name)

Answer 306

An X500 attribute expressing a host or user name, also used as the subject identifier for a digital certificate.

Question 307

code signing

Answer 307

The method of using a digital signature to ensure the source and integrity of programming code.

Question 308

CSR (certificate signing request)

Answer 308

A Base64 ASCII file that a subject sends to a CA to get a certificate.

Question 309

digital certificate

Answer 309

An X.509 digital certificate is issued by a Certificate Authority (CA) as a guarantee that a public key it has issued to an organization to encrypt messages sent to it genuinely belongs to that organization.

Question 310

offline CA (offline certificate authority)

Answer 310

In PKI, a CA (typically the root CA) that has been disconnected from the network to protect it from compromise.

Question 311

online CA (online certificate authority)

Answer 311

In PKI, a CA that is available to accept and process certificate signing requests, publish certificate revocation lists, and perform other certificate management tasks.

Question 312

PKCS (public key cryptography standards)

Answer 312

Series of standards defining the use of certificate authorities and digital certificates.

Question 313

PKI (public key infrastructure)

Answer 313

Framework of certificate authorities, digial certificates, software, services, and other cryptographic components deployed for the purpose of validating subject identities.

Question 314

RA (registration authority)

Answer 314

In PKI, an authority that accepts requests for digital certificates and authenticates the entities making those requests.

Question 315

root CA (root certificate authority)

Answer 315

In PKI, a CA that issues certificates to intermediate CAs in a hierarchical structure.

Question 316

SAN (subject alternative name)

Answer 316

Field in a digital certificate allowing a host to be identified by multiple host names/subdomains.

Question 317

self-signed certificate

Answer 317

A digital certificate that has been signed by the entity that issued it, rather than by a CA.

Question 318

server certificate

Answer 318

A digital certificate that guarantees the identity of e-commerce sites and other websites that gather and store confidential information.

Question 319

What is the main weakness of a hierarchical trust model?

Answer 319

The structure depends on the integrity of the root CA.

Question 320

How does a subject go about obtaining a certificate from a CA?

Answer 320

In most cases, the subject generates a key pair then adds the public key along with subject information and certificate type in a certificate signing request (CSR) and submits it to the CA. If the CA accepts the request, it generates a certificate with the appropriate key usage and validity, signs it, and transmits it to the subject.

Question 321

What cryptographic information is stored in a digital certificate?

Answer 321

The subject’s public key and the algorithms used for encryption and hashing. The certificate also stores a digital signature from the issuing CA, establishing the chain of trust.

Question 322

What does it mean if a certificate extension attribute is marked as critical?

Answer 322

That the application processing the certificate must be able to interpret the extension correctly. Otherwise, it should reject the certificate.

Question 323

You are developing a secure web application. What sort of certificate should you request to show that you are the publisher of a program?

Answer 323

A code signing certificate. Certificates are issued for specific purposes. A certificate issued for one purpose should not be reused for other functions.

Question 324

What extension field is used with a web server certificate to support the identification of the server by multiple specific subdomain labels?

Answer 324

The subject alternative name (SAN) field. A wildcard certificate will match any subdomain label.

Question 325

ASCII

Answer 325

7-bit code page mapping binary values to character glyphs. Standard ASCII can represent 127 characters, though some values are reserved for non-printing control characters.

Question 326

CRL (certificate revocation list)

Answer 326

A list of certificates that were revoked before their expiration date.

Question 327

DER (distinguished encoding rules)

Answer 327

The binary format used to structure the information in a digital certificate.

Question 328

escrow

Answer 328

In key management, the storage of a backup key with a third party.

Question 329

M-of-N control

Answer 329

A means of limiting access to critical encryption keys such as the private key of a root CA. At least M of the total number (N) of authorized individuals must be present to access the key.

Question 330

OCSP (online certificate status protocol)

Answer 330

Allows clients to request the status of a digital certificate, to check whether it is revoked.

Question 331

P12 (Public Key Cryptography Standard #12)

Answer 331

Format that allows a private key to be exported along with its digital certificate.

Question 332

P7B

Answer 332

File format for transmitting a chain of digital certificates, using PKCS#7.

Question 333

PEM (privacy-enhanced mail)

Answer 333

Base64 encoding scheme used to store certificate and key data as ASCII text.

Question 334

PFX (personal information exchange)

Answer 334

Windows file format for storing a private key and certificate data. The file can be password-protected.

Question 335

pinning

Answer 335

A deprecated method of trusting digital certificates that bypasses the CA hierarchy and chain of trust to minimize man-in-the-middle attacks.

Question 336

RA (recovery agent)

Answer 336

In PKI, an account or combination of accounts that can copy a cryptographic key from backup or escrow and restore it to a subject host or user.

Question 337

stapling

Answer 337

Mechanism used to mitigate performance and privacy issues when requesting certificate status from an OCSP responder.

Question 338

What are the potential consequences if a company loses control of a private key?

Answer 338

It puts both data confidentiality and identification and authentication systems at risk. Depending on the key usage, the key may be used to decrypt data with authorization. The key could also be used to impersonate a user or computer account.

Question 339

You are advising a customer about encryption for data backup security and the key escrow services that you offer. How should you explain the risks of key escrow and potential mitigations?

Answer 339

Escrow refers to archiving the key used to encrypt the customer’s backups with your company as a third party. The risk is that an insider attack from your company may be able to decrypt the data backups. This risk can be mitigated by requiring M-of-N access to the escrow keys, reducing the risk of a rogue administrator.

Question 340

What mechanism informs clients about suspended or revoked keys?

Answer 340

Either a published Certificate Revocation List (CRL) or an Online Certificate Status Protocol (OCSP) responder.

Question 341

What mechanism does HPKP implement?

Answer 341

HTTP Public Key Pinning (HPKP) ensures that when a client inspects the certificate presented by a server or a code-signed application, it is inspecting the proper certificate by submitting one or more public keys to an HTTP browser via an HTTP header.

Question 342

What type of certificate format can be used if you want to transfer your private key and certificate from one Windows host computer to another?

Answer 342

PKCS #12 / .PFX / .P12.

Question 343

What type of operation is being performed by the following command? openssl req -nodes -new -newkey rsa:2048 -out my.csr -keyout mykey.pem

Answer 343

This generates a new RSA key pair plus a certificate signing request.

Question 344

AAA (authentication, authorization, and accounting)

Answer 344

A security concept where a centralized platform verifies subject identification, ensures the subject is assigned relevant permissions, and then logs these actions to create an audit trail.

Question 345

authentication

Answer 345

A method of validating a particular entity’s or individual’s unique credentials.

Question 346

accounting

Answer 346

Tracking authorized usage of a resource or use of rights by a subject and alerting when unauthorized use is detected or attempted.

Question 347

authorization

Answer 347

The process of determining what rights and privileges a particular entity has.

Question 348

IAM (identity and access management)

Answer 348

A security process that provides identification, authentication, and authorization mechanisms for users, computers, and other entities to work with organizational assets like networks, operating systems, and applications.

Question 349

identification

Answer 349

The process by which a user account (and its credentials) is issued to the correct person. Sometimes referred to as enrollment.

Question 350

MFA (multifactor authentication)

Answer 350

An authentication scheme that requires the user to present at least two different factors as credentials, from something you know, something you have, something you are, something you do, and somewhere you are. Specifying two factors is known as 2FA.

Question 351

PIN (personal identification number)

Answer 351

Number used in conjunction with authentication devices such as smart cards; as the PIN should be known only to the user, loss of the smart card should not represent a security risk.

Question 352

What is the difference between authorization and authentication?

Answer 352

Authorization means granting the account that has been configured for the user on the computer system the right to make use of a resource. Authorization manages the privileges granted on the resource. Authentication protects the validity of the user account by testing that the person accessing that account is who she/he says she/he is.

Question 353

What steps should be taken to enroll a new employee on a domain network?

Answer 353

Perform checks to confirm the user’s identity, issue authentication credentials securely, assign appropriate permissions/privileges to the account, and ensure accounting mechanisms to audit the user’s activity.

Question 354

True or false? An account requiring a password, PIN, and smart card is an example of three-factor authentication.

Answer 354

False—Three-factor authentication also includes a biometric-, behavioral-, or location-based element. The password and PIN elements are the same factor (something you know).

Question 355

What methods can be used to implement location-based authentication?

Answer 355

You can query the location service running on a device or geolocation by IP. You could use location with the network, based on switch port, wireless network name, virtual LAN (VLAN), or IP subnet.

Question 356

brute force attack

Answer 356

A type of password attack where an attacker uses an application to exhaustively try every possible alphanumeric combination to crack encrypted passwords.

Question 357

CHAP (Challenge Handshake Authentication Protocol)

Answer 357

Authentication scheme developed for dial-up networks that uses an encrypted three-way handshake to authenticate the client to the server. The challenge-response is repeated throughout the connection (though transparently to the user) to guard against replay attacks.

Question 358

credential stuffing

Answer 358

Brute force attack in which stolen user account names and passwords are tested against multiple websites.

Question 359

dictionary attack

Answer 359

A type of password attack that compares encrypted passwords against a predetermined list of possible password values.

Question 360

hashcat

Answer 360

Command-line tool used to perform brute force and dictionary attacks against password hashes.

Question 361

hybrid password attack

Answer 361

An attack that uses multiple attack methods, such as dictionary and brute force attacks, when trying to crack a password.

Question 362

KDC (key distribution center)

Answer 362

Component of Kerberos that authenticates users and issues tickets (tokens).

Question 363

Kerberos

Answer 363

A single sign-on authentication and authorization service that is based on a time-sensitive ticket-granting system.

Question 364

masked attack

Answer 364

A type of brute-force password cracking that uses placeholders for predictable values based on typical user behavior when it comes to designing passwords.

Question 365

MSCHAP (Microsoft Challenge Handshake Authentication Protocol)

Answer 365

Implementation of CHAP created by Microsoft for use in its products.

Question 366

NTLM authentication (NT LAN Manager authentication)

Answer 366

A challenge-response authentication protocol created by Microsoft for use in its products.

Question 367

PAM (pluggable authentication module)

Answer 367

Framework for implementing authentication providers in Linux.

Question 368

PAP (Password Authentication Protocol)

Answer 368

Obsolete authentication mechanism used with PPP. PAP transfers the password in plaintext and so is vulnerable to eavesdropping.

Question 369

password cracking

Answer 369

Password guessing software can attempt to crack captured hashes of user credentials by running through all possible combinations (brute force). This can be made less computationally intensive by using a dictionary of standard words or phrases.

Question 370

password spraying

Answer 370

Brute force attack in which multiple user accounts are tested with a dictionary of common passwords.

Question 371

rainbow table

Answer 371

Tool for speeding up attacks against Windows passwords by precomputing possible hashes.

Question 372

SSO (single sign-on)

Answer 372

An authentication technology that enables a user to authenticate once and receive authorizations for multiple services.

Question 373

TGT (ticket granting ticket)

Answer 373

In Kerberos, a token issued to an authenticated account to allow access to authorized application servers.

Question 374

Why might a PIN be a particularly weak type of something you know authentication?

Answer 374

A long personal identification number (PIN) is difficult for users to remember, but a short PIN is easy to crack. A PIN can only be used safely where the number of sequential authentication attempts can be strictly limited.

Question 375

In what scenario would PAP be considered a secure authentication method?

Answer 375

PAP is a legacy protocol that cannot be considered secure because it transmits plaintext ASCII passwords and has no cryptographic protection. The only way to ensure the security of PAP is to ensure that the endpoints established a secure tunnel (using IPSec, for instance).

Question 376

True or false? In order to create a service ticket, Kerberos passes the user’s password to the target application server for authentication.

Answer 376

False—only the KDC verifies the user credential. The Ticket Granting Service (TGS) sends the user’s account details (SID) to the target application for authorization (allocation of permissions), not authentication.

Question 377

A user maintains a list of commonly used passwords in a file located deep within the computer’s directory structure. Is this secure password management?

Answer 377

No. This is security by obscurity. The file could probably be easily discovered using search tools.

Question 378

Which property of a plaintext password is most effective at defeating a brute-force attack?

Answer 378

The length of the password. If the password does not have any complexity (if it is just two dictionary words, for instance), it may still be vulnerable to a dictionary-based attack. A long password may still be vulnerable if the output space is small or if the mechanism used to hash the password is faulty (LM hashes being one example).

Question 379

authenticator

Answer 379

A PNAC switch or router that activates EAPoL and passes a supplicant’s authentication data to an authenticating server, such as a RADIUS server.

Question 380

EAP (Extensible Authentication Protocol)

Answer 380

Framework for negotiating authentication methods that enables systems to use hardware-based identifiers, such as fingerprint scanners or smart card readers, for authentication.

Question 381

EAPoL (Extensible Authentication Protocol over LAN)

Answer 381

A port-based network access control (PNAC) mechanism that allows the use of EAP authentication when a host connects to an Ethernet switch.

Question 382

HOTP (HMAC-based One-time Password)

Answer 382

An algorithm that generates a one-time password using a hash-based authentication code to verify the authenticity of the message.

Question 383

HSM (hardware security module)

Answer 383

An appliance for generating and storing cryptographic keys. This sort of solution may be less susceptible to tampering and insider threats than software-based storage.

Question 384

IEEE 802.1X

Answer 384

A standard for encapsulating EAP communications over a LAN (EAPoL) to implement port-based authentication.

Question 385

key fob

Answer 385

A chip implanted in a plastic fob. The chip can store authentication data (such as a digital certificate) that can be read when put in proximity with a suitable scanner. Another use for fobs is to generate a One Time Password, valid for a couple of minutes only and mathematically linked to a code generated on a server.

Question 386

OATH (Initiative for Open Authentication)

Answer 386

An industry body comprising the main PKI providers, such as Verisign and Entrust, that was established with the aim of developing an open, strong authentication framework.

Question 387

OTP (one-time password)

Answer 387

A password that is generated for use in one specific session and becomes invalid after the session ends.

Question 388

password sniffing

Answer 388

Monitoring network transmissions for user credentials sent as cleartext or as cryptographic hashes.

Question 389

PNAC (port-based network access control)

Answer 389

A switch (or router) that performs some sort of authentication of the attached device before activating the port.

Question 390

RADIUS (Remote Authentication Dial-in User Service)

Answer 390

A standard protocol used to manage remote and wireless authentication infrastructures.

Question 391

smart card

Answer 391

A device similar to a credit card that can store authentication information, such as a user’s private key, on an embedded microchip.

Question 392

supplicant

Answer 392

In EAP architecture, the device requesting access to the network.

Question 393

TACACS+ (Terminal Access Controller Access Control System Plus)

Answer 393

An AAA protocol developed by Cisco that is often used to authenticate to administrator accounts for network appliance management.

Question 394

token

Answer 394

A physical or virtual item that contains authentication and/or authorization data, commonly used in multifactor authentication.

Question 395

TOTP (Time-based One-time Password)

Answer 395

An improvement on HOTP that forces one-time passwords to expire after a short period of time.

Question 396

True or false? When implementing smart card logon, the user’s private key is stored on the smart card.

Answer 396

True. The smart card implements a cryptoprocessor for secure generation and storage of key and certificate material.

Question 397

You are providing consultancy to a firm to help them implement smart card authentication to premises networks and cloud services. What are the main advantages of using an HSM over server-based key and certificate management services?

Answer 397

A hardware security module (HSM) is optimized for this role and so present a smaller attack surface. It is designed to be tamper-evident to mitigate against insider threat risks. It is also likely to have a better implementation of a random number generator, improving the security properties of key material.

Question 398

Which network access control framework supports smart cards?

Answer 398

Local logon providers, such as Kerberos, support smart cards, but this is not network access control as the device has already been allowed on the network. The IEEE 802.1X framework means that network access servers (switches, access points, and VPN gateways) can accept Extensible Authentication Protocols (EAP) credentials, but block any other type of network access. They act as pass-thru for an authentication server, which stores and validates the credentials. Some EAP types support smart card or machine authentication.

Question 399

What is a RADIUS client?

Answer 399

A device or server that accepts user connections, often referred to as a network access server (NAS) or as the authenticator. Using RADIUS architecture, the client does not need to be able to perform authentication itself; it performs pass-thru to an AAA server.

Question 400

What is EAPoL?

Answer 400

A network access server that supports 802.1X port-based access control can enable a port but allow only the transfer of Extensible Authentication Protocol over LAN (EAPoL) traffic. This allows the supplicant and authentication server to perform the authentication process, with the network access server acting as a pass-thru.

Question 401

How does OTP protect against password guessing or sniffing attacks?

Answer 401

A one-time password mechanism generates a token that is valid only for a short period (usually 60 seconds), before it changes again.

Question 402

biometric authentication

Answer 402

Physical characteristics stored as a digital data template can be used to authenticate a user. Typical features used include facial pattern, iris, retina, or fingerprint pattern, and signature recognition.

Question 403

crossover error rate

Answer 403

Biometric evaluation factor expressing the point at which FAR and FRR meet, with a low value indicating better performance.

Question 404

FAR (false acceptance rate)

Answer 404

Biometric assessment metric that measures the number of unauthorized users who are mistakenly allowed access.

Question 405

fingerprint scanner

Answer 405

Biometric authentication device that can produce a template signature of a user’s fingerprint then subsequently compare the template to the digit submitted for authentication.

Question 406

FRR (false rejection rate)

Answer 406

Biometric assessment metric that measures the number of valid subjects who are denied access.

Question 407

gait analysis

Answer 407

Biometric mechanism that identifies a subject based on movement pattern.

Question 408

Apart from cost, what would you consider to be the major considerations for evaluating a biometric recognition technology?

Answer 408

Error rates (false acceptance and false rejection), throughput, and whether users will accept the technology or reject it as too intrusive or threatening to privacy.

Question 409

How is a fingerprint reader typically implemented as hardware?

Answer 409

As a capacitive cell.

Question 410

Which type of eye recognition is easier to perform: retinal or iris scanning?

Answer 410

Iris scans are simpler.

Question 411

What two ways can biometric technologies be used other than for logon authentication?

Answer 411

For identification based on biometric features and in continuous authentication mechanisms.

Question 412

default account

Answer 412

Default administrative and guest accounts configured on servers and network devices are possible points of unauthorized access.

Question 413

group account

Answer 413

A group account is a collection of user accounts that are useful when establishing file permissions and user rights because when many individuals need the same level of access, a group could be established containing all the relevant users.

Question 414

job rotation

Answer 414

The policy of preventing any one individual performing the same role or tasks for too long. This deters fraud and provides better oversight of the person’s duties.

Question 415

least privilege

Answer 415

A basic principle of security stating that something should be allocated the minimum necessary rights, privileges, or information to perform its role.

Question 416

mandatory vacations

Answer 416

The principle that states when and how long an employee must take time off from work so that their activities may be subjected to a security review.

Question 417

NDA (non-disclosure agreement)

Answer 417

An agreement that stipulates that entities will not share confidential information, knowledge, or materials with unauthorized third parties.

Question 418

offboarding

Answer 418

The process of ensuring that all HR and other requirements are covered when an employee leaves an organization. Also referred to as an exit interview.

Question 419

onboarding

Answer 419

The process of bringing in a new employee, contractor, or supplier.

Question 420

privilege access management

Answer 420

The use of authentication and authorization mechanisms to provide an administrator with centralized or decentralized control of user and group role-based entitlement.

Question 421

separation of duties

Answer 421

A concept that states that duties and responsibilities should be divided among individuals to prevent ethical conflicts or abuse of powers.

Question 422

service account

Answer 422

A host or network account that is designed to run a background service, rather than to log on interactively.

Question 423

shared account

Answer 423

An account with no credential (guest) or one where the credential is known to multiple persons.

Question 424

You are consulting with a company about a new approach to authenticating users. You suggest there could be cost savings and better support for multifactor authentication (MFA) if your employees create accounts with a cloud provider. That allows the company’s staff to focus on authorizations and privilege management. What type of service is the cloud vendor performing?

Answer 424

The cloud vendor is acting as the identity provider.

Question 425

What is the process of ensuring accounts are only created for valid users, only assigned the appropriate privileges, and that the account credentials are known only to the valid user?

Answer 425

Onboarding.

Question 426

What is the policy that states users should be allocated the minimum sufficient permissions?

Answer 426

Least privilege.

Question 427

What is an SOP?

Answer 427

A standard operating procedure (SOP) is a step-by-step listing of the actions that must be completed for any given task.

Question 428

What type of organizational policies ensure that at least two people have oversight of a critical business process?

Answer 428

Shared authority, job rotation, and mandatory enforced vacation/holidays.

Question 429

Recently, attackers were able to compromise the account of a user whose employment had been terminated a week earlier. They used this account to access a network share and delete important files. What account vulnerability enabled this attack?

Answer 429

While it’s possible that lax password requirements and incorrect privileges may have contributed to the account compromise, the most glaring problem is that the terminated employee’s account wasn’t disabled. Since the account was no longer being used, it should not have been left active for a malicious user to exploit.

Question 430

For what type of account would interactive logon be disabled?

Answer 430

Interactive logon refers to starting a shell. Service accounts do not require this type of access. Default superuser accounts, such as Administrator and root, may also be disabled, or limited to use in system recovery or repair.

Question 431

What type of files most need to be audited to perform third-party credential management?

Answer 431

SSH and API keys are often unsecurely embedded in computer code or uploaded mistakenly to repositories alongside code. Also, managing shared credentials can be difficult, and many sites resort to storing them in a shared spreadsheet.

Question 432

account expiration

Answer 432

The specified amount of time when an account expires to eliminate the possibility that it will be forgotten about and act as possible system backdoors.

Question 433

account policies

Answer 433

A set of rules governing user security information, such as password expiration and uniqueness, which can be set globally.

Question 434

GPO (Group Policy Object)

Answer 434

On a Windows domain, a way to deploy per-user and per-computer settings such as password policy, account restrictions, firewall status, and so on.

Question 435

SID (security identifier)

Answer 435

The value assigned to an account by Windows and that is used by the operating system to identify that account.

Question 436

time of day restrictions

Answer 436

Policies or configuration settings that limit a user’s access to resources.

Question 437

What container would you use if you want to apply a different security policy to a subset of objects within the same domain?

Answer 437

Organization Unit (OU).

Question 438

Why might forcing users to change their password every month be counterproductive?

Answer 438

More users would forget their password, try to select unsecure ones, or write them down/record them in a non-secure way (like a sticky note).

Question 439

What is the name of the policy that prevents users from choosing old passwords again?

Answer 439

Enforce password history.

Question 440

In what two ways can an IP address be used for context-based authentication?

Answer 440

An IP address can represent a logical location (subnet) on a private network. Most types of public IP address can be linked to a geographical location, based on information published by the registrant that manages that block of IP address space.

Question 441

How does accounting provide non-repudiation?

Answer 441

A user’s actions are logged on the system. Each user is associated with a unique computer account. As long as the user’s authentication is secure and the logging system is tamper-proof, they cannot deny having performed the action.

Question 442

Which information resource is required to complete usage auditing?

Answer 442

Usage events must be recorded in a log. Choosing which events to log will be guided by an audit policy.

Question 443

What is the difference between locked and disabled accounts?

Answer 443

An account enters a locked state because of a policy violation, such as an incorrect password being entered incorrectly. Lockout is usually applied for a limited duration. An account is usually disabled manually, using the account properties. A disabled account can only be re-enabled manually.

Question 444

PAM (privileged access management)

Answer 444

Policies, procedures, and support software for managing accounts and credentials with administrative permissions.

Question 445

ABAC (attribute-based access control)

Answer 445

An access control technique that evaluates a set of attributes that each subject possesses to determine if access should be granted.

Question 446

ACL (Access Control List)

Answer 446

A collection of access control entries (ACEs) that determines which subjects (user accounts, host IP addresses, and so on) are allowed or denied access to the object and the privileges given (read only, read/write, and so on).

Question 447

chmod

Answer 447

Linux command for managing file permissions.

Question 448

DAC (discretionary access control)

Answer 448

Access control model where each resource is protected by an Access Control List (ACL) managed by the resource’s owner (or owners).

Question 449

directory service

Answer 449

A network service that stores identity information about all the objects in a particular network, including users, groups, servers, client computers, and printers.

Question 450

federation

Answer 450

A process that provides a shared login capability across multiple systems and enterprises. It essentially connects the identity management services of multiple systems.

Question 451

IdP (identity provider)

Answer 451

In a federated network, the service that holds the user account and performs authentication.

Question 452

MAC (Mandatory Access Control)

Answer 452

Access control model where resources are protected by inflexible, system defined rules. Resources (objects) and users (subjects) are allocated a clearance level (or label).

Question 453

OAuth (Open Authorization)

Answer 453

Standard for federated identity management, allowing resource servers or consumer sites to work with user accounts created and managed on a separate identity provider.

Question 454

OICD (OpenID Connect)

Answer 454

An authentication layer that sits on top of the OAuth 2.0 authorization protocol.

Question 455

permissions

Answer 455

Security settings that control access to objects including file system items and network resources.

Question 456

RBAC (role-based access control)

Answer 456

An access control model where resources are protected by ACLs that are managed by administrators and that provide user permissions based on job functions.

Question 457

rule-based access control

Answer 457

A non-discretionary access control technique that is based on a set of operational rules or restrictions to enforce a least privileges permissions policy.

Question 458

SAML (Security Assertion Markup Language)

Answer 458

An XML-based data format used to exchange authentication information between a client and a service.

Question 459

What are the advantages of a decentralized, discretionary access control policy over a mandatory access control policy?

Answer 459

It is easier for users to adjust the policy to fit changing business needs. Centralized policies can easily become inflexible and bureaucratic.

Question 460

What is the difference between security group- and role-based permissions management?

Answer 460

A group is simply a container for several user objects. Any organizing principle can be applied. In a role-based access control system, groups are tightly defined according to job functions. Also, a user should (logically) only possess the permissions of one role at a time.

Question 461

In a rule-based access control model, can a subject negotiate with the data owner for access privileges? Why or why not?

Answer 461

This sort of negotiation would not be permitted under rule-based access control; it is a feature of discretionary access control.

Question 462

What is the purpose of directory services?

Answer 462

To store information about network resources and users in a format that can be accessed and updated using standard queries.

Question 463

True or false? The following string is an example of a distinguished name: CN=ad, DC=classroom,DC=com

Answer 463

True.

Question 464

You are working on a cloud application that allows users to log on with social media accounts over the web and from a mobile application. Which protocols would you consider and which would you choose as most suitable?

Answer 464

Security Assertion Markup Language (SAML) and OAuth + OpenID Connect (OIDC). OAuth with OIDC as an authentication layer offers better support for native mobile apps so is probably the best choice.

Question 465

AUP (acceptable use policy)

Answer 465

A policy that governs employees’ use of company equipment and Internet services. ISPs may also apply AUPs to their customers. Also referred to as fair use policy.

Question 466

capture the flag

Answer 466

Training event where learners must identify a token within a live network environment.

Question 467

CBT (computer-based training)

Answer 467

Training and education programs delivered using computer devices and e-learning instructional models and design.

Question 468

clean desk policy

Answer 468

An organizational policy that mandates employee work areas be free from potentially sensitive information; sensitive documents must not be left out where unauthorized personnel might see them.

Question 469

code of conduct

Answer 469

Professional behavior depends on basic ethical standards, such as honesty and fairness. Some professions may have developed codes of ethics to cover difficult situations; some businesses may also have a code of ethics to communicate the values it expects its employees to practice.

Question 470

Your company has been the victim of several successful phishing attempts over the past year. Attackers managed to steal credentials from these attacks and used them to compromise key systems. What vulnerability contributed to the success of these social engineers, and why?

Answer 470

A lack of proper user training directly contributes to the success of social engineering attempts. Attackers can easily trick users when those users are unfamiliar with the characteristics and ramifications of such deception.

Question 471

Why should an organization design role-based training programs?

Answer 471

Employees have different levels of technical knowledge and different work priorities. This means that a “one size fits all” approach to security training is impractical.

Question 472

You are planning a security awareness program for a manufacturer. Is a pamphlet likely to be sufficient in terms of resources?

Answer 472

Using a diversity of training techniques will boost engagement and retention. Practical tasks, such as phishing simulations, will give attendees more direct experience. Workshops or computer-based training will make it easier to assess whether the training has been completed.

Question 473

bastion host

Answer 473

A server typically found in a DMZ that is configured to provide a single service to reduce the possibility of compromise.

Question 474

DMZ (demilitarized zone)

Answer 474

A segment isolated from the rest of a private network by one or more firewalls that accepts connections from the Internet over designated ports.

Question 475

east-west traffic

Answer 475

Design paradigm accounting for the fact that data center traffic between servers is greater than that passing in and out (north-south).

Question 476

extranet

Answer 476

A private network that provides some access to outside parties, particularly vendors, partners, and select customers.

Question 477

Internet Zone

Answer 477

A zone permitting anonymous access (or perhaps a mix of anonymous and authenticated access) by untrusted hosts over the Internet.

Question 478

intranet

Answer 478

A private network that is only accessible by the organization’s own personnel.

Question 479

packet crafting

Answer 479

A method of manually generating packets (instead of modifying existing network traffic) to test the behavior of network devices, enabling a hacker to enumerate firewall or intrusion detection rules that are in place.

Question 480

router

Answer 480

A network device that links dissimilar networks and can support multiple alternate paths between location-based parameters such as speed, traffic loads, and price.

Question 481

screened host

Answer 481

A dual-homed proxy/gateway server used to provide Internet access to other network nodes, while protecting them from external attack.

Question 482

segment

Answer 482

A portion of a network where all attached hosts can communicate freely with one another.

Question 483

switch

Answer 483

In Ethernet, a networking device that receives incoming data, reviews the destination MAC address against an internal address table, and sends the data out through the port that contains the destination MAC address.

Question 484

VLAN (virtual local area network)

Answer 484

A logically separate network, created by using switching technology. Even though hosts on two VLANs may be physically connected to the same cabling, local traffic is isolated to each VLAN so they must use a router to communicate.

Question 485

zero trust

Answer 485

Security design paradigm where any request (host-to-host or container-to-container) must be authenticated before being allowed.

Question 486

zone

Answer 486

In networking infrastructure, an area of a network where the security configuration is the same for all hosts within it. In physical security, an area separated by barriers that control entry and exit points.

Question 487

routing protocols

Answer 487

Allows a router to perform dynamic updates to its routing table based on route data exchanged with other routers.

Question 488

A recent security evaluation concluded that your company’s network design is too consolidated. Hosts with wildly different functions and purposes are grouped together on the same logical area of the network. In the past, this has enabled attackers to easily compromise large swaths of network hosts. What technique(s) do you suggest will improve the security of the network’s design, and why?

Answer 488

In general, you should start implementing some form of network segmentation to put hosts with the same security requirements within segregated zones. For example, the workstations in each business department can be grouped in their own subnets to prevent a compromise of one subnet from spreading to another. Likewise, with VLANs, you can more easily manage the logical segmentation of the network without disrupting the physical infrastructure (i.e., devices and cabling).

Question 489

You are discussing a redesign of network architecture with a client, and they want to know what the difference between an extranet and Internet is. How can you explain it?

Answer 489

The Internet is an external zone where none of the hosts accessing your services can be assumed trusted or authenticated. An extranet is a zone allowing controlled access to semi-trusted hosts, implying some sort of authentication. The hosts are semi-trusted because they are not under the administrative control of the organization (as they are owned by suppliers, customers, business partners, contractors, and so on).

Question 490

Why is subnetting useful in secure network design?

Answer 490

Subnet traffic is routed, allowing it to be filtered by devices such as a firewall. An attacker must be able to gather more information about the configuration of the network and overcome more barriers to launch successful attacks.

Question 491

How can an enterprise DMZ be implemented?

Answer 491

By using two firewalls (external and internal) around a screened subnet, or by using a triple-homed firewall (one with three network interfaces).

Question 492

What type of network requires the design to account for east-west traffic?

Answer 492

This is typical of a data center or server farm, where a single external request causes multiple cascading requests between servers within the data center. This is a problem for a perimeter security model, as funneling this traffic up to a firewall and then back to a server creates a performance bottleneck.

Question 493

ARP (Address Resolution Protocol)

Answer 493

The broadcast mechanism by which individual hardware MAC addresses are matched to an IP address on a local network segment.

Question 494

ARP inspection

Answer 494

An optional security feature of a switch that prevents excessive ARP replies from flooding a network segment.

Question 495

ARP poisoning

Answer 495

A network-based attack where an attacker with access to the target local network segment redirects an IP address to the MAC address of a computer that is not the intended recipient. This can be used to perform a variety of attacks, including DoS, spoofing, and Man-in-the-Middle. Sometimes referred to as ARP spoofing.

Question 496

BGP (Border Gateway Protocol)

Answer 496

A path vector routing protocol used by ISPs to establish routing between one another. Also referred to as Autonomous System (AS)

Question 497

BPDU guard (Bridge Protocol Data Unit guard)

Answer 497

A switch port security feature that disables a port. It is configured on access ports where any BPDU frames are likely to be malicious. Bridge Protocol Data Units (BPDUs) are used to communicate information about the topology and are not expected on access ports, so BPDU Guard protects against misconfiguration or a possible malicious attack.

Question 498

broadcast storm

Answer 498

Traffic that is recirculated and amplified by loops in a switching topology, causing network slowdowns and crashing switches.

Question 499

DHCP snooping

Answer 499

A configuration option that enables a switch to inspect DHCP traffic to prevent MAC spoofing.

Question 500

eavesdropping

Answer 500

Some transmission media are susceptible to eavesdropping (listening in to communications sent over the media). To secure transmissions, they must be encrypted.