grheb Flashcards
1
Q
1. You're the chief security contact for MTS. One of your primary tasks is to document everything related to security and to create a manual that can be used to manage the company in your absence. Which documents should be referenced in your manual as the ones that identify the methods used to accomplish a given task? A. Policies B. Standards C. Guidelines D. BIA
A
C
Guidelines help clarify processes to maintain standards. Guidelines tend to be less formal than policies or standards.
2
Q
2. Consider the following scenario. The asset value of your company's primary servers is $2 million, and they are housed in a single office building in Anderson, Indiana. Field offices are scattered throughout the United States, but the workstations located at the field offices serve as thin clients and access data from the Anderson servers. Tornados in this part of the country are not uncommon, and it is estimated that one will level the building every 60 years. Which of the following is the SLE for this scenario? A. $2 million B. $1 million C. $500,000 D. $33,333.33 E. $16,666.67
A
A
It does not matter how frequent a loss is projected (only once every 60 years, in this case). What does matter is that each occurrence will be disastrous: SLE (single loss expectancy) is equal to asset value (AV) times exposure factor (EF). In this case, asset value is $2 million and the exposure factor is 1.
3
Q
3. Consider the following scenario. The asset value of your company’s primary servers is $2 million, and they are housed in a single office building in Anderson, Indiana. Field offices are scattered throughout the United States, but the workstations located at the field offices serve as thin clients and access data from the Anderson servers. Tornados in this part of the country are not uncommon, and it is estimated that one will level the building every 60 years. Which of the following amounts is the ALE for this scenario? A. $2 million B. $1 million C. $500,000 D. $33,333.33 E. $16,666.67
A
D ALE (annual loss expectancy) is equal to the SLE times the annualized rate of occurrence. In this case, the SLE is $2 million and the ARO is 1/60.
4
Q
4. Consider the following scenario. The asset value of your company's primary servers is $2 million, and they are housed in a single office building in Anderson, Indiana. Field offices are scattered throughout the United States, but the workstations located at the field offices serve as thin clients and access data from the Anderson servers. Tornados in this part of the country are not uncommon, and it is estimated that one will level the building every 60 years. Which of the following is the ARO for this scenario? A. 0.0167 B. 1 C. 5 D. 16.7 E. 60
A
A ARO (annualized rate of occurrence) is the frequency (in number of years) that an event can be expected to happen. In this case, ARO is 1/60, or 0.0167.
5
Q
5. Which of the following strategies involves identifying a risk and making the decision to discontinue engaging in the action? A. Risk acceptance B. Risk avoidance C. Risk mitigation D. Risk transference
A
B
Risk avoidance involves identifying a risk and making the decision no longer to engage in the actions associated with that risk
6
Q
6. Which of the following policy statements may include an escalation contact in the event that the person dealing with a situation needs to know who to contact? A. Scope B. Exception C. Overview D. Accountability
A
B
The exception policy statement may include an escalation contact in the event that the person dealing with a situation needs to know who to contact.
7
Q
7.Which of the following policies are designed to reduce the risk of fraud and prevent other losses in an organization? A. Separation of duties B. Acceptable use C. Least privilege D. Physical access control
A
A
A separation of duties policy is designed to reduce the risk of fraud and to prevent other losses in an organization.
8
Q
8. What is the term used for events that were mistakenly flagged although they weren't truly events about which to be concerned? A. Fool's gold B. Non-incidents C. Error flags D. False positives
A
D
False positives are events that were mistakenly flagged and aren’t truly events to be concerned about.
9
Q
9. Which of the following is the structured approach that is followed to secure a company's assets? A. Audit management B. Incident management C. Change management D. Skill management
A
C
Change management is the structured approach that is followed to secure a company’s assets.
10
Q
10. Which of the following strategies involves sharing some of the risk burden with someone else, such as an insurance company? A. Risk acceptance B. Risk avoidance C. Risk deterrence D. Risk mitigation E. Risk transference
A
E
Risk transference involves sharing some of the risk burden with someone else, such as an insurance company.
11
Q
11. The risk assessment component, in conjunction with the \_\_\_\_\_\_\_\_, provides the organization with an accurate picture of the situation facing it. A. RAC B. ALE C. BIA D. RMG
A
C
The risk assessment component, in conjunction with the business impact analysis (BIA), provides an organization with an accurate picture of the situation it faces.
12
Q
12. Which of the following policy statements should address who is responsible for ensuring that the policy is enforced? A. Scope B. Exception C. Overview D. Accountability
A
D
The accountability policy statement should address who is responsible for ensuring that the policy is enforced.
13
Q
13. Which of the following strategies is accomplished any time you take steps to reduce risk? A. Risk acceptance B. Risk avoidance C. Risk transference D. Risk mitigation
A
D
Risk mitigation is accomplished any time you take steps to reduce
14
Q
14. If you calculate the SLE to be $4,000 and that there will be 10 occurrences a year (ARO), then the ALE is: A. $400 B. $4,000 C. $40,000 D. $400,000
A
C
If you calculate the SLE to be $4,000 and that there will be 10 occurrences a year (ARO), then the ALE is $40,000 ($4,000 × 10).
15
Q
15. Which of the following policies describes how the employees in an organization can use company systems and resources, both software and hardware? A. Separation of duties B. Acceptable use C. Least privilege D. Physical access control
A
B
The acceptable use policies describe how the employees in an organization can use company systems and resources, both software and hardware.
16
Q
16. Separation of duties helps to prevent an individual from embezzling money from a company. To embezzle funds successfully, an individual would need to recruit others to commit an act of \_\_\_\_\_\_\_\_\_\_\_\_\_\_ (an agreement between two or more parties established for the purpose of committing deception or fraud). A. Misappropriation B. Misuse C. Collusion D. Fraud
A
C
Collusion is an agreement between two or more parties established for the purpose of committing deception or fraud. Collusion, when part of a crime, is also a criminal act in and of itself.
17
Q
17. Which of the following agreements contains the technical information regarding the technical and security requirements of the interconnection between two or more organizations? A. BPA B. MOA C. ISA D. MOU
A
C The ISA (interconnection security agreement) specifies the technical and security requirements of the interconnection.
18
Q
18. If you calculate SLE to be $25,000 and that there will be one occurrence every four years (ARO), then what is the ALE? A. $6,250 B. $12,500 C. $25,000 D. $100,000
A
A
If you calculate SLE to be $25,000 and that there will be one occurrence every four years (ARO), then the ALE is $6,250 ($25,000 × 0.25).
19
Q
19. Which of the following policies should be used when assigning permissions, giving users only the permissions they need to do their work and no more? A. Separation of duties B. Acceptable use C. Least privilege D. Physical access control
A
C
The principle of least privilege should be used when assigning permissions. Give users only the permissions that they need to do their work and no more.
20
Q
20. Which of the following strategies necessitates an identified risk that those involved understand the potential cost/damage and agree to live with it? A. Risk acceptance B. Risk avoidance C. Risk transference D. Risk mitigation
A
A
Risk acceptance necessitates an identified risk that those involved understand the potential cost or damage and agree to accept it.
21
Q
1.A periodic update that corrects problems in one version of a product is called a(n) \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_. A. Hotfix B. Overhaul C. Service pack D. Security update
A
C
A periodic update that corrects problems in one version of a product is called a service pack. Option A is incorrect; a hotfix is an immediate and urgent fix for a specific problem. Option B is incorrect: overhaul is not a term used in the industry. Option D is incorrect; a patch is done to fix a specific problem.
22
Q
2.Which device monitors network traffic in a passive manner? A. Sniffer B. IDS C. Firewall D. Web browser
A
B
An IDS monitors network traffic, but it does not take any specific action and is therefore considered passive. Option A is incorrect because sniffers tend to be run for a specific period of time by a human operator. Option C is incorrect; a firewall is for blocking traffic, not monitoring, and is not passive. Option D is incorrect; a web browser is for viewing web pages.
23
Q
3.What is a system that is intended or designed to be broken into by an attacker?
A. Honeypot
B. Honeybucket
C. Decoy
D. Spoofing system
E. Deleted if the employee has been terminated
A
A
A honeypot is a system specifically designed to be being broken into. Options B, C, and D are not the terms used in the industry.
24
Q
4.In intrusion detection system vernacular, which account is responsible for setting the security policy for an organization? A. Supervisor B. Administrator C. Root D. Director
A
B
An administrator is the term for someone setting security policy in an IDS. Options A, C, and D are not the terms used in the industry.
25
```
5.You are a junior security administrator for a large bank. You have been asked to make the database servers as secure as they can be. The process of making certain that an entity (operating system, application, and so on) is as secure as it can be is known as which of the following?
A. Stabilizing
B. Reinforcing
C. Hardening
D. Toughening
```
C
Hardening is the term used for making a system as secure as it can be. Answers A, B, and D are not the terms used in the industry.
26
6.John is working on designing a network for the insurance company where he is employed. He wants to put the web server in an area that has somewhat less security so that outside users might access it. But he does not want that to compromise the security of the rest of the network. What would be John's best approach?
A. Place the web server in a honeynet.
B. Place the web server on the guest network segment.
C. Place the web server in a DMZ.
D. Place the web server outside his network.
C
DMZs are meant to set public-facing servers. The exterior firewall of the DMZ is more permissive than the interior, making the DMZ somewhat less secure. Option A is incorrect; a honeynet is designed to catch attackers, and it should not be obviously less secure than the actual production network. Option B is incorrect; a guest network is not meant to be accessible from the outside world. Option D is incorrect; it would be completely insecure, not just somewhat less secure.
27
```
7.Tom has been instructed to find a security standard, applicable to the United States, that will help him develop appropriate security policies. He has found a standard that describes 8 principles and 14 practices that can be used to develop security policies. What standard is Tom most likely reviewing?
A. ISO/IEC 27001:2013
B. NIST 800-12
C. NIST 800-14
E. ISA/IEC-62443 4
```
C
The other answers are other standards.
B:An Introduction to Information Security
C:Principles and Practices for Securing IT Systems
28
8.Juanita is implementing a security mechanism that will fully encrypt the hard drive of laptops in her organization. The encryption and decryption will be automatic. What best describes what Juanita is implementing?
A. AES
B. TPM
C. FDE
D. SED
```
D
SED (self-encrypting drive) is described in this scenario. The other options are related to cryptography but are not automatic. For example, FDE (full disk encryption) would fully encrypt the hard drive, but it would not be automatic.
```
29
9.Ahmed has been working to mitigate the threat of malware in his network. He has selected a specific vendor (Vendor ABC) for his antivirus software. He is using ABC products everywhere he needs antivirus software. Is this the correct decision? Why or why not?
A. Yes, consistency is more secure.
B. Yes, this will make the process more affordable.
C. No, this violates control diversity.
D. No, this violates vendor diversity.
D
This violated vendor diversity. He is using the same vendor for all of his antimalware. If there is any flaw in that vendor, or the algorithm used by that vendor misses a specific virus, then it will be missed everywhere.
30
```
10.You are concerned about your backup files becoming infected with malware. Which of the following technologies would be best to protect your backup?
A. Air-gap
B. SPI firewall
C. DMZ
D. VLAN
```
A
An air-gapped backup is not exposed to the network and thus is far less likely to become infected. In fact, the only possibility for infection at the moment is that a backup is transferred to the air-gapped storage. If antivirus is run just prior to this action, then the chances of malware in the backup become extremely small. The other options have nothing to do with protecting backups.
31
```
1.Which of the following devices is the most capable of providing infrastructure security?
A. Hub
B. Switch
C. Router
D. Modem
```
C
Routers can be configured in many instances to act as packet-filtering firewalls. When configured properly, they can prevent unauthorized ports from being opened.
32
2.Upper management has decreed that a firewall must be put in place immediately, before your site suffers an attack similar to one that struck a sister company. Responding to this order, your boss instructs you to implement a packet filter by the end of the week. A packet filter performs which function?
A. Prevents unauthorized packets from entering the network
B. Allows all packets to leave the network
C. Allows all packets to enter the network
D. Eliminates collisions in the network
A
Packet filters prevent unauthorized packets from entering or leaving a network. Packet filters are a type of firewall that blocks specified port traffic.
33
```
3.Which device stores information about destinations in a network (choose the best answer)?
A. Hub
B. Modem
C. Firewall
D. Router
```
D
Routers store information about network destinations in routing tables. Routing tables contain information about known hosts on both sides of the router.
34
```
4.As more and more clients have been added to your network, the efficiency of the network has decreased significantly. You're preparing a budget for next year, and you specifically want to address this problem. Which of the following devices acts primarily as a tool to improve network efficiency?
A. Hub
B. Switch
C. Router
D. PBX
```
B
Switches create virtual circuits between systems in a network. These virtual circuits are somewhat private and reduce network traffic when used.
35
```
5.You've been notified that you'll soon be transferred to another site. Before you leave, you're to audit the network and document everything in use and the reason why it's in use. The next administrator will use this documentation to keep the network running. Which of the following protocols isn't a tunneling protocol but is probably used at your site by tunneling protocols for network security?
A. IPSec
B. PPTP
C. L2TP
D. L2F
```
A
IPSec provides network security for tunneling protocols. IPSec can be used with many different protocols besides TCP/IP, and it has two modes of security.
36
```
6.Which of the following can be implemented as a software or hardware solution and is usually associated with a device—a router, a firewall, NAT, and so on—used to shift a load from one device to another?
A. Proxy
B. Hub
C. Load balancer
D. Switch
```
C
A load balancer can be implemented as a software or hardware solution and is usually associated with a device—a router, a firewall, NAT, and so on. As the name implies, it is used to shift a load from one device to another.
37
```
7.Which of the following are multiport devices that improve network efficiency?
A. Switches
B. Modems
C. Gateways
D. Concentrators
```
A
Switches are multiport devices that improve network efficiency. A switch typically has a small amount of information about systems in a network.
38
```
8.Which IDS system uses algorithms to analyze the traffic passing through the network?
A. Arithmetical
B. Algebraic
C. Statistical
D. Heuristic
```
D
| A heuristic system uses algorithms to analyze the traffic passing through the network.
39
```
9.Which of the following can be used to offload the public-key encryption to a separate hardware plug-in card?
A. SSL accelerator
B. Load balancer
C. Proxy firewall
D. SIEM
```
A
Since encrypting data is very processor intensive, SSL accelerators can be used to offload the public-key encryption to a separate plug-in card.
40
```
10.Which of the following protections implies that information, once written, cannot be modified?
A. DLP
B. ROM
C. WORM
D. NAC
```
```
C
With WORM (write-once-read-many) protection, information, once written, cannot be modified thus assuring that the data cannot be tampered with once it is written to the device.
```
41
```
11.In which two modes can IPSec work?
A. Tunneling and Storing
B. Transport and Storing
C. Tunneling and Transport
D. At-Rest and At-Ease
```
C
IPSec can work in either Tunneling or Transport mode. In Tunneling mode, the data or payload and message headers are encrypted. Transport mode encrypts only the payload.
42
```
12.With which tunnel configuration are only some (usually all incoming) requests routed and encrypted over the VPN?
A. Split
B. Full
C. Partial
D. Hybrid
```
A
With a full tunnel configuration, all requests are routed and encrypted through the VPN, whereas with a split tunnel, only some requests (usually all incoming) are routed and encrypted over the VPN.
43
```
13.With which type of load balance scheduling is the first client request sent to the first group of servers, the second is sent to the second, and so on?
A. Affinity
B. Round-robin
C. Sequential
D. Progressive
```
B
With round-robin load balancing, the first client request is sent to the first group of servers, the second is sent to the second, and so on.
44
```
14.Which type of load balancing configuration means that more than one load balancing server is working at all times to handle the load/requests as they come in?
A. Active-active
B. Cooperative-sharing
C. Equal-partner
D. Proactive-colleague
```
A
An active-active configuration means that more than one load balancing server is working at all times to handle the load/requests as they come in.
45
```
15.Which of the following work by decrypting encrypted traffic (SSL or TLS), inspecting it, and then re-encrypting it before sending it on to its destination?
A. SSL filters
B. SSL gateways
C. SSL accelerators
D. SSL decryptors
```
D
SSL decryptors work by decrypting encrypted traffic (SSL or TLS), inspecting it, and then re-encrypting it before sending it on to its destination.
46
```
16.Which of the following is a chip that can store cryptographic keys, passwords, or certificates?
A. HMP
B. TPM
C. MTP
D. PMH
```
B
TPM (trusted platform module) is the name assigned to a chip that can store cryptographic keys, passwords, or certificates.
Which AP-based technology can increase security dramatically by allowing or denying access based on a client's physical address?
47
```
17.Which AP-based technology can increase security dramatically by allowing or denying access based on a client's physical address?
A. MAC filtering
B. UTM (unified threat management)
C. Round-robin
D. WORM
```
A
| With MAC filtering each host is identified by its MAC address and allowed (or denied) access based on that.
48
```
18.Which network devices are used to divide larger networks into smaller sections by sitting between two physical network segments and managing the flow of data between the two?
A. Accelerators
B. Proxies
C. Bridges
D. Balancers
```
C
Bridges are used to divide larger networks into smaller sections by sitting between two physical network segments and managing the flow of data between the two.
49
```
19.Which problem can occur when more than one bridge or switch is implemented on the network, and the devices confuse each other by leading one another to believe that a host is located on a certain segment when it is not?
A. Backdoors
B. Dead zones
C. Collisions
D. Loops
```
D
Loops can occur when more than one bridge or switch is implemented on the network and the devices confuse each other by leading one another to believe that a host is located on a certain segment when it is not.
50
```
20.To combat the problem described in Question 19(loop problem), which of the following technologies enable bridge/switch interfaces to be assigned a value that is then used to control the learning process and prevent problems?
A. ESSID
B. SSID
C. BRD
D. STP
```
D
To combat the loop problem, technologies such as the Spanning Tree Protocol (STP) enable bridge/switch interfaces to be assigned a value that is then used to control the learning process and prevent loops.
51
1.John is a network administrator for ACME company. He is trying to explain least privileges to a new technician. Which of the following is the basic premise of least privilege?
A. Always assign responsibilities to the administrator who has the minimum permissions required.
B. When assigning permissions, give users only the permissions they need to do their work and no more.
C. Regularly review user permissions and take away one that they currently have to see if they will complain or even notice that it is missing.
D. Do not give management more permissions than users.
B
Least privileges means to grant just enough privileges to do the job and no more. The other answers do not describe least privileges.
52
```
2.The present method of requiring access to be strictly defined on every object is proving too cumbersome for your environment. The edict has come down from upper management that access requirements should be slightly reduced. Which access model allows users some flexibility for information-sharing purposes?
A. DAC
B. MAC
C. RBAC
D. MLAC
```
A
Discretionary access control allows users to define access. Option B is incorrect; this would be more restrictive. Option C is role-based access control. Option D is not an access control mechanism
53
3.Ahmed has been directed to ensure that LDAP on his network is secure. LDAP is an example of which of the following?
A. Directory access protocol
B. IDS
C. Tiered model application development environment
D. File server
A
LDAP, or Lightweight Directory Access Control, is a directory access protocol. The other answers are not related to directory access.
54
```
4.Upper management has suddenly become concerned about security. As the senior network administrator, you are asked to suggest changes that should be implemented. Which of the following access methods should you recommend if the technique to be used is one that is primarily based on preestablished access and can't be changed by users?
A. MAC
B. DAC
C. RBAC
D. Kerberos
```
A
Mandatory access control cannot be modified by users and is considered more secure. Option B is incorrect—DAC provides the users flexibility and is less secure. Option C is incorrect; RBAC is not based on preestablished access, but rather roles. Option D is incorrect; Kerberos is an authentication protocol, not an access method.
55
```
5.Your office administrator is being trained to perform server backups. Which access control method would be ideal for this situation?
A. MAC
B. DAC
C. RBAC
D. Security tokens
```
C
Role-based access control is based on the user's role, in this case the office administrator. Options A and B are incorrect and are not based on user roles. Option D is not related to access.
56
```
6.You've been assigned to mentor a junior administrator and bring her up to speed quickly. The topic you're currently explaining is authentication. Which method uses a KDC to accomplish authentication for users, programs, or systems?
A. CHAP
B. Kerberos
C. Biometrics
D. Smartcards
```
B
| Kerberos uses a KDC (key distribution center). The other options do not.
57
```
7.After a careful risk analysis, the value of your company's data has been increased. Accordingly, you're expected to implement authentication solutions that reflect the increased value of the data. Which of the following authentication methods uses more than one authentication process for a logon?
A. Multifactor
B. Biometrics
C. Smartcard
D. Kerberos
```
A
| Multifactor authentication uses more than one method. Options B, C, and D are all one-factor methods.
58
```
8.Your company provides medical data to doctors from a worldwide database. Because of the sensitive nature of the data, it's imperative that authentication be established on each session and be valid only for that session. Which of the following authentication methods provides credentials that are valid only during a single session?
A. Tokens
B. Certificate
C. Smartcard
D. Kerberos
```
A
| Tokens are secure and can be one-time tokens. Options B, C, and D can all be used more than once.
59
```
9.Which of the following is the term used whenever two or more parties authenticate each other?
A. SSO
B. Multifactor authentication
C. Mutual authentication
D. Tunneling
```
C
| Two parties authenticating each other is mutual authentication. The other options do not describe this.
60
```
10.You have added a new child domain to your network. As a result of this, the child has adopted all of the trust relationships with other domains in the forest that existed for its parent domain. What is responsible for this?
A. LDAP access
B. XML access
C. Fuzzing access
D. Transitive access
```
D
This is a classic example of transitive access. Option A is incorrect; LDAP is a directory access protocol. Options B and C are not access descriptions.
61
```
11.Which of the following is a type of smartcard issued by the Department of Defense as a general identification/authentication card for military personnel, contractors, and non-DoD employees?
A. PIV
B. POV
C. DLP
D. CAC
```
D
| The CAC is the smartcard used by the U.S. Department of Defense.
62
```
12.You are working as a security administrator for a small financial institution. You want to use an authentication method that will periodically reauthenticate clients. Which protocol is best suited for this?
A. PAP
B. SPAP
C. KERBEROS
D. CHAP
```
D
| CHAP periodically reauthenticates. Options A, B, and C are all authentication methods but do not reauthenticate.
63
```
13.Which command most likely produced the output shown in the graphic?
Interface: 192.168.1.104 -- OXc
Internet Address Physical Address Type
192.168.1.1 60-38-e0-6f-c9-d3 dynamic
192.168.1.255 ff-ff-ff-ff-ff-ff static
A. arp -a
B. ping -a
C. netstat
D. nslookup
```
A
| This is the output from arp -a. The other answers will not produce this output.
64
```
14.John is trying to determine the origin of an email. He has captured the email headers and knows the IP address of the originating email server. What command would show John the complete path to that IP address?
A. ping -a
B. arp
C. tracert
D. nslookup
```
C
tracert (or traceroute in Linux) will show the complete path to the IP address. Option A is incorrect—ping shows if a site is reachable but not the path to it. Option B is incorrect—arp shows address resolution protocol tables. Option D is incorrect; nslookup is used with DNS.
65
15.Juanita is the security administrator for a large university. She is concerned about copyright issues and wants to ensure that her university does not violate copyrights. What would be her main concern regarding unauthorized software?
A. It might be copyrighted.
B. It might be used to circumvent copyright protection.
C. That should not be a copyright concern.
D. It is not a concern if she has a least one license for the software.
A
| Software is subject to copyright, and unauthorized software might be copyrighted software.
66
```
16.Terrance is examining an authentication system that was developed at MIT and uses tickets for authentication. What system is Terrance most likely examining?
A. CHAP
B. MS-CHAP
C. KERBEROS
D. OATH
```
C
Kerberos was invented at MIT and uses tickets for authentication. Options A and B are Challenge Handshake Authentication Protocol, which does not use tickets. Option D also is an authentication protocol that does not use tickets.
67
```
17.Melissa is planning on implementing biometric authentication on her network. Which of the following should be a goal for any biometric solution she selects?
A. High FRR, low FAR
B. High FAR, low FRR
C. Low CER
D. High CER
```
C
| You want a crossover error rate, also called equal error rate, and you want it to be low.
68
```
18.Jarod is evaluating web-based, single sign-on solutions. Which of the following technologies is most associated with web page authorization?
A. SAML
B. PIV
C. CHAP
D. RBAC
```
A
SAML is used with web page authorization. Option B is incorrect—PIV is a type of smartcard. Option C is incorrect—CHAP is a type of authentication protocol. Option D is incorrect—RBAC is an access control protocol.
69
```
19.You are a network administrator for ACME Corporation. You want to implement a new access control mechanism. The mechanism you are considering takes into account the entire environment/scenario of the access request. What does this describe?
A. MAC
B. DAC
C. RBAC
D. ABAC
```
D
Attribute-based authentication control looks at the entire environment. Options A, B, and C are all access control methods but do not consider the entire environment.
70
```
20.Dennis has implemented an authentication system that uses a password, a PIN, and the user's birthday. What best describes this system?
A. Single factor
B. Two factor
C. Three factor
D. Strong authentication
```
A
Although three items are used, they are all Type I, something you know. Two-factor or strong authentication requires two authentication methods from two different categories (Type I, II, or III).
71
```
1.An IV attack is usually associated with which of the following wireless protocols?
A. WEP
B. WAP
C. WPA
D. WPA2
```
A
| An IV attack is usually associated with the WEP wireless protocol.
72
```
2.What is the size of the initialization vector (IV) that WEP uses for encryption?
A. 6-bit
B. 24-bit
C. 56-bit
D. 128-bit
```
B
| The initialization vector (IV) that WEP uses for encryption is 24-bit.
73
```
3.What is the size of the wrapper TKIP places around the WEP encryption with a key that is based on things such as the MAC address of your machine and the serial number of the packet?
A. 128-bit
B. 64-bit
C. 56-bit
D. 12-bit
```
A
TKIP places a 128-bit wrapper around the WEP encryption with a key that is based on things such as the MAC address of the host device and the serial number of the packet.
74
```
4.hat technology is used to send data between phones that are in close proximity to each other?
A. NFC
B. IBI
C. IBJ
D. IFNC
```
A
| Near field communication (NFC) is used to send data between phones that are in close proximity.
75
```
5.What technology is used to simplify network setup by allowing a router to have the administrator push a button on it to allow a new host to join?
A. WEP
B. WPA
C. WTLS
D. WPS
```
```
D
WPS (Wi-Fi Protected Setup) is intended to simplify network setup for home and small offices.
```
76
```
6.Which of the following technologies is used to identify and track tags attached to objects?
A. NFC
B. RFID
C. IV
D. DSC
```
B
| RFID (radio frequency identification) technology is used to identify and track tags attached to objects.
77
```
7.What type of attack captures portions of a session to play back later to convince a host that it is still talking to the original connection?
A. Replay
B. Echo
C. Duplication
D. Reprise
```
A
A replay attack captures portions of a session to play back later to convince a host that it is still talking to the original connection.
78
```
8.Which standard defines port-based security for wireless network access control?
A. 802.1n
B. 802.1g
C. 802.1x
D. 802.1s
```
C
| The 802.1x standard defines port-based security for wireless network access control.
79
```
9.Which of the following types of attacks involves the sending of unsolicited messages over a Bluetooth connection?
A. Bluesmurfing
B. Bluesnarfing
C. Bluewhaling
D. Bluejacking
```
D
| Bluejacking is the sending of unsolicited messages over a Bluetooth connection.
80
```
10.Karl has checked into a hotel after a long day of travel. He is attempting to check his daily deluge of email messages using the free in-room Wi-Fi, but it keeps losing the connection. When he calls the front desk, they suggest that he might want to use the premium the Wi-Fi (which costs more) to get a better connection. What type of attack could this scenario represent?
A. Upselling
B. Cross-selling
C. Disassociation
D. Imitation
```
C
With a disassociation attack, the intruder sends a frame to the AP with a spoofed address to make it look like it came from the victim and disconnects them from the network.
81
```
11.Frustrated with the low signal that the devices in his cubicle receive, Spencer brings in his own access point and creates his own network. Kristin, a co-worker, tells him that if the boss finds out about this it is grounds for immediate dismissal, and he should read the employee handbook if he has any questions. Setting up your own access point represents which of the following?
A. Degenerate
B. Rogue
C. Corporeal
D. Temporal
```
B
| A rogue access point is any unauthorized wireless access point on a network.
82
```
12.During the authentication part of setting up his small office access point, Wolfgang was required to enter a PIN within 60 seconds. This process is known as:
A. Wired Equivalent Privacy
B. WiFi Protected Access
C. WiFi Protected Setup
D. WiFi Authentication Protection
```
C
An authentication process that requires the user to do something in order to complete the enrollment process is known as WiFi Protected Setup (WPS).
83
```
13.Which security protocol for wireless networks attempts to establish the same security for them as would be present in a wired network?
A. WEP
B. WEB
C. WELL
D. WALL
```
A
Wired Equivalent Privacy (WEP) is a security protocol for 802.11b (wireless) networks that attempts to establish the same security for them as would be present in a wired network.
84
```
14.Evan fears that the tenant in the office next door is using RF interference to try to force his small company to vacate the building in frustration. Purposely obstructing or interfering with a signal is known as which of the following?
A. Shoving
B. Jamming
C. Cramming
D. Blocking
```
B
| Jamming is purposely obstructing or interfering with a signal.
85
```
15.What is a disassociation attack more commonly known as?
A. Decertification attack
B. Disconfirmation attack
C. Deauthentication attack
D. Denial attack
```
C
| A disassociation attack is commonly referred to as a deauthentication attack.
86
```
16.With near field communication (NFC) technology, the industry tends to use what distance as “near”?
A. 1 inch
B. 1.2 inches
C. 1.6 inches
D. 2 inches
```
C
| While there is no hardcoded standard defining “near,” the industry tends to use 4cm (1.6 inches) as the distance.
87
```
17.With Bluetooth devices suddenly popping up everywhere in your network, you want to secure as many of them as possible. One of the simplest methods of securing these devices is not to set their attribute to:
A. Discoverable
B. Transmit
C. Announce
D. Communicate
```
A
| One of the simplest ways to secure Bluetooth devices is not to set their attribute to Discoverable.
88
```
18.Which of the following is the gaining of unauthorized access through a Bluetooth connection?
A. Bluejumping
B. Bluesnarfing
C. Bluerunning
D. Bluelining
```
B
| Bluesnarfing is the gaining of unauthorized access through a Bluetooth connection.
89
```
19.A client calls you and says that he wants to turn off the SSID broadcast on his small network because he is afraid that those simply scanning for a network are finding it and trying to connect to it. You inform him that this is a very weak form of security and suggest some other options, but he is insistent on this being done. What is this form of hiding the router known as?
A. Veiling
B. Masking
C. Shrouding
D. Cloaking
```
D
Cloaking is a method of protecting the network that involves turning off the SSID broadcast. The access point is still there and accessible by those who know of its existence, but it prevents those who are just scanning from finding it.
90
```
20.Which of the following is attack in which a rogue wireless access point poses as a legitimate wireless service provider to intercept information that users transmit?
A. Collision
B. Evil twin
C. NFC
D. WPS
```
B
In an evil twin attack, a rogue wireless access point poses as a legitimate wireless service provider to intercept information that users transmit.
91
```
1.In which cloud service model can the consumer “provision” and “deploy and run”?
A. SaaS
B. PaaS
C. IaaS
D. CaaS
```
C
In the Infrastructure as a Service (IaaS) model, the consumer can “provision” and is able to “deploy and run,” but they still do not “manage or control” the underlying cloud infrastructure.
92
```
2. Which cloud delivery model is implemented by a single organization, enabling it to be implemented behind a firewall?
A. Private
B. Public
C. Community
D. Hybrid
```
A
| A private cloud delivery model is implemented by a single organization, and it can be implemented behind a firewall.
93
```
3. Which cloud service model provides the consumer with the infrastructure to create applications and host them?
A. SaaS
B. PaaS
C. IaaS
D. CaaS
```
B
| In the Platform as a Service (PaaS) model, the consumer has the ability to create applications and host them.
94
4. Which cloud delivery model could be considered a pool of services and resources delivered across the Internet by a cloud provider?
A. Private
B. Public
C. Community
D. Hybrid
B
A public delivery model could be considered a pool of services and resources delivered across the Internet by a cloud provider.
95
```
5. Which cloud service model gives the consumer the ability to use applications provided by the cloud provider over the Internet?
A. SaaS
B. PaaS
C. IaaS
D. CaaS
```
A
In the Software as a Service (SaaS) model, the consumer has the ability to use applications provided by the cloud provider over the Internet.
96
```
6. Which cloud delivery model has an infrastructure shared by several organizations with shared interests and common IT needs?
A. Private
B. Public
C. Community
D. Hybrid
```
C
A community delivery model has an infrastructure shared by several organizations with shared interests and common IT needs.
97
7. Which cloud delivery model could be considered an amalgamation of other types of delivery models?
A. Private
B. Public
C. Community
D. Hybrid
D
| The hybrid delivery model can be considered an amalgamation of other types of delivery models.
98
```
8. With which of the following subscription-based models is security more cost effective than individuals or smaller corporations could ever get on their own?
A. SECaaS
B. PaaS
C. XaaS
D. WaaS
```
A
Security as a Service (SECaaS) is a subscription-based business model intended to be more cost effective than individuals or smaller corporations could ever get on their own.
99
```
9. Which of the following are on-premise or cloud-based security policy enforcement points?
A. Feature slugs
B. Flood guards
C. VDI/VDEs
D. Cloud access security brokers
```
D
| Cloud access security brokers are on-premise or cloud-based security policy enforcement points.
100
```
10. Which feature of cloud computing involves dynamically provisioning (or deprovisioning) resources as needed?
A. Multitenancy
B. Elasticity
C. CMDB
D. Sandboxing
```
B
101
```
11. What is the term for restricting an application to a safe/restricted resource area?
A. Multitenancy
B. Fencing
C. Securing
D. Sandboxing
```
D
| Sandboxing is the term used for restricting an application to a safe/restricted resource area.
102
```
12. Which of the following terms implies hosting data from more than one consumer on the same equipment?
A. Multitenancy
B. Duplexing
C. Bastioning
D. Fashioning
```
A
| Multitenancy implies hosting data from more than one consumer on the same equipment.
103
13. When going with a public cloud delivery model, who is accountable for the security and privacy of the outsourced service?
A. The cloud provider and the organization
B. The cloud provider
C. The organization
D. No one
C
Ultimately, the organization is accountable for the choice of public cloud and the security and privacy of the outsourced service.
104
```
14. When your company purchased a virtual datacenter provider, you inherited a mess. The employees working there had to respond regularly to requests to create virtual machines without the disciplines and controls normally found in the physical world. This resulted in machines being over-provisioned (too much CPU, memory, or disk) and consuming resources long after they were no longer required. What type of problem is this?
A. VM escape
B. VM digress
C. VM sprawl
D. VM Type I
```
C
VM sprawl can be a result of creating virtual machines without the disciplines and controls of the physical world. This can result in over-provisioning (too much CPU, memory, or disk), or consuming resources after they are no longer required.
105
```
15. Although a hybrid cloud could be any mixture of cloud delivery models, it is usually a combination of which of the following?
A. Public and community
B. Public and private
C. Private and community
D. Two or more communities
```
B
Although a hybrid cloud could be any mixture of cloud delivery models, it is usually a combination of public and private.
106
```
16. Which type of hypervisor implementation is known as “bare metal”?
A. Type I
B. Type II
C. Type III
D. Type IV
```
A
| Type I hypervisor implementations are known as “bare metal.”
107
```
17. Which type of hypervisor implementation is known as “hosted”?
A. Type I
B. Type II
C. Type III
D. Type IV
```
B
| Type II hypervisor implementations are known as “hosted.”
108
```
18. When your servers become too busy, you can offload traffic to resources from a cloud provider. This is known as which of the following?
A. Latency
B. Cloud bursting
C. Multitenancy
D. Peaking
```
B
| Cloud bursting means that when your servers become too busy, you can offload traffic to resources from a cloud provider.
109
```
19. What protocol is used by technologies for load balancing/prioritizing traffic?
A. ESX
B. QoS
C. IBJ
D. IFNC
```
B
| QoS (Quality of Service) makes load balancing/prioritizing possible.
110
```
20. What is the machine on which virtualization software is running known as?
A. Node
B. Workstation
C. Host
D. Server
```
C
The machine on which virtualization software is running is known as a host, whereas the virtual machines are known as guests.
111
```
1.Which of the following terms refers to the process of establishing a standard for security?
A. Baselining
B. Security evaluation
C. Hardening
D. Methods research
```
A
| Baselining is the term for establishing a standard for security.
112
```
2. You've been chosen to lead a team of administrators in an attempt to increase security. You're currently creating an outline of all the aspects of security that will need to be examined and acted on. Which of the following terms describes the process of improving security in a network operating system (NOS)?
A. Common criteria
B. Hardening
C. Encryption
D. Networking
```
B
| Hardening is the process of improving security in a network operating system, or any operating system.
113
```
3. John is responsible for application security at his company. He is concerned that the application reacts appropriately to unexpected input. What type of testing would be most helpful to him?
A. Unit testing
B. Integration testing
C. Stress testing
D. Fuzzing
```
D
| Fuzzing is testing by entering incorrect data to test the applications response.
114
```
4. Myra is concerned about database security. She wants to begin with a good configuration of the database. Which of the following is a fundamental issue with database configuration?
A. Normalization
B. Input validation
C. Fuzz testing
D. Stress testing
```
A
| Normalization is one of the most fundamental aspects of database configuration.
115
```
5. Which of the following is the technique of providing unexpected values as input to an application to try to make it crash?
A. DLP
B. Fuzzing
C. Stress testing
D. HSM
```
B
| This is fuzzing or fuzz testing.
116
```
6. Mary is responsible for website security in her company. She wants to address widely known and documented web application vulnerabilities. Which resource would be most helpful?
A. OWASP
B. CERT
C. NIST
D. ISO
```
A
| Open Web Application Security Project (OWASP).
117
```
7. You're redesigning your network in preparation for putting the company up for sale. The network, like all aspects of the company, needs to perform at its best in order to benefit the sale. Which model is used to provide an intermediary server between the end user and the database?
A. One-tiered
B. Two-tiered
C. Three-tiered
D. Relational database
```
C
| A three-tiered architecture has an intermediary server.
118
```
8. The administrator at MTS was recently fired, and it has come to light that he didn't install updates and fixes as they were released. As the newly hired administrator, your first priority is to bring all networked clients and servers up to date. What is a bundle of one or more system fixes in a single product called?
A. Service pack
B. Hotfix
C. Patch
D. System install
```
A
| A service pack is a bundle of patches and hot fixes.
119
```
9. Your company does electronic monitoring of individuals under house arrest around the world. Because of the sensitive nature of the business, you can't afford any unnecessary downtime. What is the process of applying a repair to an operating system while the system stays in operation?
A. Upgrading
B. Service pack installation
C. Hotfix
D. File update
```
C
| Hotfixes usually can be installed without rebooting the machine.
120
```
10. Juan has just made a minor change to the company's e-commerce application. The change works as expected. What type of testing is most important for him to perform?
A. Unit testing
B. Regression testing
C. Static testing
D. Stress testing
```
B
| Regression testing tests to see if the change caused any other problems.
121
```
11.Your company has grown at a tremendous rate, and the need to hire specialists in various IT areas has become apparent. You're helping to write an online advertisement that will be used to recruit new employees, and you want to make certain that applicants possess the necessary skills. One knowledge area in which your organization is weak is database intelligence. What is the primary type of database used in applications today that you can mention in the ads?
A. Hierarchical
B. Relational
C. Network
D. Archival
```
B
| Relational.
122
```
12.What is the process of applying manual changes to a program called?
A. Hotfix
B. Service pack
C. Patching
D. Replacement
```
C
| Patching.
123
```
13. You want to assign privileges to a user so that she can delete a file but not be able to assign privileges to others. What permissions should you assign?
A. Full Control
B. Delete
C. Administrator
D. Modify
```
B
| Always apply least privileges, and in this case that is Delete.
124
```
14. Ahmed is responsible for security of a SCADA system. If availability is his biggest concern, what is the most important thing for him to implement?
A. SIEM
B. IPS
C. Automated patch control
D. Log monitoring
```
B
| An IPS will stop many attacks thus keeping the system online.
125
```
15. Gerard is concerned about SQL injection attacks on his company's e-commerce server. What security measure would be most important for him to implement?
A. Stress testing
B. Input validation
C. IPS
D. Agile programming
```
B
| Input validation can stop most SQL injection attacks.
126
6. Elizabeth works for a company that manufactures portable medical devices, such as insulin pumps. She is concerned about security for the device. Which of the following would be the most helpful in securing these devices?
A. Ensure that all communications with the device are encrypted.
B. Ensure that the devices have FDE.
C. Ensure that the devices have been stress tested.
D. Ensure that the devices have been fuzz tested.
A
| Encrypt all transmissions.
127
17. Vincent is a programmer working on an e-commerce site. He has conducted a vulnerability scan and discovered a flaw in a third-party module. There is an update available for this module that fixes the flaw. What is the best approach for him to take to mitigate this threat?
A. Submit an RFC.
B. Immediately apply the update.
C. Place the update on a test server, then if it works apply it to the production server.
D. Document the issue.
A
| Always use change management.
128
```
18. Which of the following would be the most secure way to deploy a legacy application that requires a legacy operating system?
A. Sandboxing
B. Stress testing
C. Dynamic testing
D. Placing it on an encrypted drive
```
A
| Sandboxing the application would be the most secure.
129
19. Denish is testing an application that is multithreaded. Which of the following is a specific concern for multithreaded applications?
A. Input validation
B. Memory overflow
C. Race conditions
D. Unit testing
C
| Race conditions.
130
```
20. Gertrude is managing a new software project. The project has very clearly defined requirements that are not likely to change. Which of the following is the most appropriate development model for her?
A. Agile
B. XP Programming
C. Waterfall
D. Scrum
```
C
| Waterfall is a good approach when the requirements are firm.
131
1. Which of the following does not apply to a hashing algorithm?
A. One-way
B. Long key size
C. Variable-length input with fixed-length output
D. Collision resistance
B
| Long key sizes are not applicable to hashing algorithms.
132
```
2. During a training session, you want to impress upon users the serious nature of security and, in particular, cryptography. To accomplish this, you want to give them as much of an overview about the topic as possible. Which government agency should you mention is primarily responsible for establishing government standards involving cryptography for general-purpose government use?
A. NSA
B. NIST
C. IEEE
D. ITU
```
A
The National Security Administration is responsible for cryptography in the U.S. government, even though those standards by then become NIST standards.
133
```
3. You are responsible for e-commerce security at your company. You want to use the most widely implemented asymmetric algorithm available today. Which of the following is the most widely used asymmetric algorithm today?
A. RSA
B. AES
C. 3DES
D. SHA
```
A
| RSA is the most widely used asymmetric cipher today, though ECC is quickly becoming more widely used.
134
```
4. You're a member of a consortium wanting to create a new standard that will effectively end all spam. After years of meeting, the group has finally come across a solution and now wants to propose it. The process of proposing a new standard or method on the Internet is referred to by which acronym?
A. WBS
B. X.509
C. RFC
D. IEEE
```
C
| The request for comment is how you propose a new standard.
135
```
5. Mary claims that she didn't make a phone call from her office to a competitor and tell them about developments at her company. Telephone logs, however, show that such a call was placed from her phone, and time clock records show that she was the only person working at the time. What do these records provide?
A. Integrity
B. Confidentiality
C. Authentication
D. Nonrepudiation
```
D
| This is nonrepudiation.
136
```
6. Mercury Technical Solutions has been using SSL in a business-to-business environment for a number of years. Despite the fact that there have been no compromises in security, the new IT manager wants to use stronger security than SSL can offer. Which of the following protocols is similar to SSL but offers the ability to use additional security protocols?
A. TLS
B. SSH
C. RSH
D. X.509
```
A
| TLS is the replacement for SSL.
137
```
7. MAC is an acronym for what as it relates to cryptography?
A. Media access control
B. Mandatory access control
C. Message authentication code
D. Multiple advisory committees
```
C
| In this case, MAC stands for message authentication code.
138
```
8. You've been brought in as a security consultant for a small bicycle manufacturing firm. Immediately, you notice that they're using a centralized key-generating process and you make a note to dissuade them from that without delay. What problem is created by using a centralized key-generating process?
A. Network security
B. Key transmission
C. Certificate revocation
D. Private key security
```
B
| Key transmission is a concern.
139
```
9. You need to encrypt your hard drive. Which of the following is the best choice?
A. DES
B. RSA
C. AES
D. SHA
```
C
| For a hard drive, you want a symmetric cipher and AES is more secure than DES.
140
```
10. As the head of IT for MTS, you're explaining some security concerns to a junior administrator who has just been hired. You're trying to emphasize the need to know what is important and what isn't. Which of the following is not a consideration in key storage?
A. Environmental controls
B. Physical security
C. Hardened servers
D. Administrative controls
```
A
| Environmental controls would be the least important issue.
141
```
11. What is the primary organization for maintaining certificates called?
A. CA
B. RA
C. LRA
D. CRL
```
A
| This is a certificate authority.
142
```
12. Due to a breach, a certificate must be permanently revoked and you don't want it to ever be used again. What is often used to revoke a certificate?
A. CRA
B. CYA
C. CRL
D. PKI
```
C
| A certificate revocation list should be used.
143
```
13. Which organization can be used to identify an individual for certificate issue in a PKI environment?
A. RA
B. LRA
C. PKE
D. SHA
```
A
| The registration authority identifies an individual for issuing a certificate by a certificate authority.
144
14. Kristin from Payroll has left the office on maternity leave and won't return for at least six weeks. You've been instructed to suspend her key. Which of the following statements is true?
A. In order to be used, suspended keys must be revoked.
B. Suspended keys don't expire.
C. Suspended keys can be reactivated.
D. Suspending keys is a bad practice.
C
| The key will have to be reactivated.
145
```
15. What document describes how a CA issues certificates and for what they are used?
A. Certificate policies
B. Certificate practices
C. Revocation authority
D. CRL
```
A
| The certificate policy describes how a certificate can be used.
146
```
16. Your company has implemented email encryption throughout the enterprise. You are concerned that someone might lose their cryptographic key. You want to implement some mechanism for storing copies of keys and recovering them. What should you implement?
A. Key escrow
B. Key archival
C. Key renewal
D. Certificate rollover
```
A
| A key escrow should be used.
147
```
17. The CRL takes time to be fully disseminated. Which protocol allows a certificate's authenticity to be immediately verified?
A. CA
B. CP
C. CRC
D. OCSP
```
D
| Online Certificate Status Protocol is done in real time.
148
```
18. John is concerned about message integrity. He wants to ensure that message integrity cannot be compromised no matter what the threat. What would best help him accomplish this goal?
A. SHA2
B. MD5
C. AES
D. MAC
```
D
| A message authentication code will reveal any tampering, accidental or intentional.
149
```
19. Which of the following is similar to Blowfish but works on 128-bit blocks?
A. Twofish
B. IDEA
C. CCITT
D. AES
```
A
| Twofish.
150
```
20. Your IT manager has stated that you need to select an appropriate tool for email encryption. Which of the following would be the best choice?
A. MD5
B. IPSEC
C. TLS
D. PGP
```
D
| PGP is an excellent choice for email security.
151
```
1. As the security administrator for your organization, you must be aware of all types of attacks that can occur and plan for them. Which type of attack uses more than one computer to attack the victim?
A. DoS
B. DDoS
C. Worm
D. UDP attack
```
B
| A DDoS attack uses multiple computer systems to attack a server or host in the network.
152
```
2. An alert signals you that a server in your network has a program running on it that bypasses authorization. Which type of attack has occurred?
A. DoS
B. DDoS
C. Backdoor
D. Social engineering
```
C
| In a backdoor attack, a program or service is placed on a server to bypass normal security procedures.
153
```
3. An administrator at a sister company calls to report a new threat that is making the rounds. According to him, the latest danger is an attack that attempts to intervene in a communications session by inserting a computer between the two systems that are communicating. Which of the following types of attacks does this constitute?
A. Man-in-the-middle attack
B. Backdoor attack
C. Worm
D. TCP/IP hijacking
```
A
A man-in-the-middle attack attempts to fool both ends of a communications session into believing that the system in the middle is the other end.
154
```
4. You've discovered that an expired certificate is being used repeatedly to gain logon privileges. Which type of attack is this most likely to be?
A. Man-in-the-middle attack
B. Backdoor attack
C. Replay attack
D. TCP/IP hijacking
```
C
| A replay attack attempts to replay the results of a previously successful session to gain access.
155
```
5. Which type of attack denies authorized users access to network resources?
A. DoS
B. Worm
C. Logic bomb
D. Social engineering
```
A
| A DoS attack is intended to prevent access to network resources by overwhelming or flooding a service or network.
156
```
6. Your system has just stopped responding to keyboard commands. You noticed that this occurred when a spreadsheet was open and you connected to the Internet. Which kind of attack has probably occurred?
A. Logic bomb
B. Worm
C. Virus
D. ACK attack
```
A
A logic bomb notifies an attacker when a certain set of circumstances has occurred. This may in turn trigger an attack on your system.
157
```
7. You're explaining the basics of security to upper management in an attempt to obtain an increase in the networking budget. One of the members of the management team mentions that they've heard of a threat from a virus that attempts to mask itself by hiding code from antivirus software. What type of virus is she referring to?
A. Armored virus
B. Malevolent virus
C. Worm
D. Stealth virus
```
A
An armored virus is designed to hide the signature of the virus behind code that confuses the antivirus software or blocks it from detecting the virus.
158
```
8. What kind of virus could attach itself to the boot sector of your disk to avoid detection and report false information about file sizes?
A. Trojan horse virus
B. Stealth virus
C. Worm
D. Polymorphic virus
```
B
A stealth virus reports false information to hide itself from antivirus software. Stealth viruses often attach themselves to the boot sector of an operating system.
159
```
9. What is it known as when an attacker manipulates the database code to take advantage of a weakness in it?
A. SQL tearing
B. SQL manipulation
C. SQL cracking
D. SQL injection
```
D
| SQL injection occurs when an attacker manipulates the database code to take advantage of a weakness in it.
160
```
10. What term describes when the item used to validate a user's session, such as a cookie, is stolen and used by another to establish a session with a host that thinks it is still communicating with the first party?
A. Patch infiltration
B. XML injection
C. Session hijacking
D. DTB exploitation
```
C
Session hijacking occurs when the item used to validate a user's session, such as a cookie, is stolen and used by another to establish a session with a host that thinks it is still communicating with the first party.
161
```
11. Which of the following involves unauthorized commands coming from a trusted user to the website?
A. ZDT
B. HSM
C. TT3
D. XSRF
```
D
XSRF involves unauthorized commands coming from a trusted user to the website. This is often done without the user's knowledge, and it employs some type of social networking to pull it off.
162
12. When a hole is found in a web browser or other software, and attackers begin exploiting it before the developer can respond, what type of attack is it known as?
A. Polymorphic
B. Xmas
C. Malicious insider
D. Zero-day
D
When a hole is found in a web browser or other software, and attackers begin exploiting it the very day it is discovered by the developer (bypassing the one-to-two-day response time that many software providers need to put out a patch once the hole has been found), it is known as a zero-day attack.
163
```
13. Which of the following is a small library that is created to intercept API calls transparently?
A. Chock
B. Wedge
C. Refactor
D. Shim
```
D
| A shim is a small library that is created to intercept API calls transparently.
164
```
14. The new head of software engineering has demanded that all code be tested to identify the design flow and then modified, as needed, to clean up routines without changing the code's visible behavior. What is this process known as?
A. Straightening
B. Sanitizing
C. Refactoring
D. Uncluttering
```
C
Refactoring involves testing to identify the design flow and then modifying, as needed, to clean up routines without changing the code's visible behavior.
165
```
15. Karl from Accounting is in a panic. He is convinced that he has identified malware on the servers—a type of man-in-the-middle attack in which a Trojan horse manipulates calls between the browser and yet still displays back the user's intended transaction. What type of attack could he have stumbled on?
A. Man-in-the-browser
B. Man-in-the-castle
C. Man-in-the-code
D. Man-in-the-business
```
A
Man-in-the-browser is a type of man-in-the-middle attack in which a Trojan horse manipulates calls between the browser and its security mechanisms yet still displaying back the user's intended transaction.
166
```
16. Pass-the-hash attacks take advantage of a weak encryption routine associated with which protocols?
A. NetBEUI and NetBIOS
B. NTLM and LanMan
C. Telnet and TFTP
D. Chargen and DNS
```
B
| Pass-the-hash attacks take advantage of a weak encryption routine associated with NTLM and LanMan protocols.
167
```
17. The command monlist can be used with which protocol as part of an amplification attack?
A. SMTP
B. NTP
C. SNMP
D. ICMP
```
B
The command monlist can be used with an NTP amplification attack to send details of the last 600 people who requested network time.
MONLIST指令屬於NTP伺服器的管理人員測試指令，主要目的在於查看NTP伺服器的連線狀況，並回傳服務伺服器中近期與其他HOST端的連線IP，供管理人員作為分析依據。
MONLIST指令一次最多能回傳600組IP連線資訊，透過UDP封包一次回傳6組IP的方式，如下圖所示，最多能回傳100個UDP封包。而攻擊者正是利用該特性，只要執行一個指令也就是傳送一個封包，就能產生100個封包的放大效果[5]，再配合UDP因無檢查機制，能任意假造來源IP，攻擊者便能指定任意欲攻擊的主機，若有上百台主機甚至更多，DDoS放大攻擊效益便可輕易達成。
http://www.cc.ntu.edu.tw/chinese/epaper/0045/20180620_4509.html
168
```
18. An attacker has placed an opaque layer over the Request A Catalog button on your web page. This layer tricks visitors into going to a form on a different website and giving their contact information to another party when their intention was to give it to you. What type of attack is this known as?
A. Clickjacking
B. Man-in-the-middle
C. XSRF
D. Zero-day
```
A
Clickjacking involves an attacker using multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the top-level page.
169
```
19. With which of the following is the DNS server given information about a name server that it thinks is legitimate when it isn't?
A. DNS tagging
B. DNS kiting
C. DNS poisoning
D. DNS foxing
```
C
With DNS poisoning, also known as DNS spoofing, the DNS server is given information about a name server that it thinks is legitimate when it isn't.
170
```
20. It has been brought to your attention that a would-be attacker in Indiana has been buying up domains based on common misspellings of your company's name with the sole intent of creating websites that resemble yours and prey on those who mistakenly stumble onto these pages. What type of attack is this known as?
A. Watering hole
B. Poisoned well
C. Faulty tower
D. Typo squatting
```
D
| Typo squatting involves creating domains that are based on the misspelling of another.
171
```
1. As part of your training program, you're trying to educate users on the importance of security. You explain to them that not every attack depends on implementing advanced technological methods. Some attacks take advantage of human shortcomings to gain access that should otherwise be denied. What term do you use to describe attacks of this type?
A. Social engineering
B. IDS system
C. Perimeter security
D. Biometrics
```
A
Social engineering attacks take advantage of our inherent trust as human beings, as opposed to technology, to gain access to your environment.
172
```
2. Which of the following is another name for social engineering?
A. Social disguise
B. Social hacking
C. Wetware
D. Wetfire
```
C
| Wetware is another name for social engineering.
173
3. Which of the following is the best description of tailgating?
A. Following someone through a door they just unlocked
B. Figuring out how to unlock a secured area
C. Sitting close to someone in a meeting
D. Stealing information from someone's desk
A
| Tailgating is best defined as following someone through a door they just unlocked.
174
```
4. What is the form of social engineering in which you simply ask someone for a piece of information that you want by making it look as if it is a legitimate request?
A. Hoaxing
B. Swimming
C. Spamming
D. Phishing
```
D
Phishing is the form of social engineering in which you simply ask someone for a piece of information that you want by making it look as if it is a legitimate request.
175
```
5. When you combine phishing with Voice over IP, it is known as:
A. Spoofing
B. Spooning
C. Whaling
D. Vishing
```
D
| Vishing involves combining phishing with Voice over IP.
176
6. Which of the following is the best description of shoulder surfing?
A. Following someone through a door they just unlocked
B. Figuring out how to unlock a secured area
C. Watching someone enter important information
D. Stealing information from someone's desk
C
| Shoulder surfing is best defined as watching someone enter important information.
177
```
7. Which of the following is an intermediate access control mechanism used in a high-security installation that requires visual identification, as well as authentication, to gain access?
A. Mantrap
B. Fencing
C. Proximity reader
D. Hot aisle
```
A
High-security installations use a type of intermediate access control mechanism called a mantrap. Mantraps require visual identification, as well as authentication, to gain access. A mantrap makes it difficult for a facility to be accessed by a large number of individuals at once because it allows only one or two people into a facility at a time.
178
```
8. You've been drafted for the safety committee. One of your first tasks is to inventory all the fire extinguishers and make certain that the correct types are in the correct locations throughout the building. Which of the following categories of fire extinguisher is intended for use on electrical fires?
A. Type A
B. Type B
C. Type C
D. Type D
```
C
You Answered Correctly!
Type C fire extinguishers are intended for use in electrical fires.
179
```
9. Which of the following will not reduce EMI?
A. Physical shielding
B. Humidity control
C. Physical location
D. Overhauling worn motors
```
B
| Electrical devices, such as motors, that generate magnetic fields cause EMI. Humidity control does not address EMI.
180
```
10. Which of the following is the best example of perimeter security?
A. Chain link fence
B. Video camera
C. Elevator
D. Locked computer room
```
A
Perimeter security involves creating a perimeter or outer boundary for a physical space. Video surveillance systems wouldn't be considered a part of perimeter security, but they can be used to enhance physical security monitoring.
181
```
11. You're the leader of the security committee at ACME Company. After a move to a new facility, you're installing a new security monitoring system throughout. Which of the following categories best describes a motion detector mounted in the corner of a hallway?
A. Perimeter security
B. Partitioning
C. Security zone
D. IDS system
```
C
A security zone is an area that is a smaller component of the entire facility. Security zones allow intrusions to be detected in specific parts of the building.
182
```
12. Which technology uses a physical characteristic to establish identity?
A. Biometrics
B. Surveillance
C. Smart card
D. CHAP authenticator
```
A
Biometrics is a technology that uses personal characteristics, such as a retinal pattern or fingerprint, to establish identity.
183
```
13. The process of reducing or eliminating susceptibility to outside interference is called what?
A. Shielding
B. EMI
C. TEMPEST
D. Desensitization
```
A
| Shielding keeps external electronic signals from disrupting operations.
184
```
14. You work for an electronics company that has just created a device that emits less RF than any competitor's product. Given the enormous importance of this invention and of the marketing benefits it could offer, you want to have the product certified. Which certification is used to indicate minimal electronic emissions?
A. EMI
B. RFI
C. CC EAL 4
D. TEMPEST
```
D
TEMPEST is the certification given to electronic devices that emit minimal RF. The TEMPEST certification is difficult to acquire, and it significantly increases the cost of systems.
185
```
15. Due to growth beyond current capacity, a new server room is being built. As a manager, you want to make certain that all the necessary safety elements exist in the room when it's finished. Which fire-suppression system works best when used in an enclosed area by displacing the air around a fire?
A. Gas-based
B. Water-based
C. Fixed system
D. Overhead sprinklers
```
A
Gas-based systems work by displacing the air around a fire. This eliminates one of the three necessary components of a fire: oxygen.
186
```
16. Type K fire extinguishers are intended for use on cooking oil fires. This type is a subset of which other type of fire extinguisher?
A. Type A
B. Type B
C. Type C
D. Type D
```
B
| Type K fire extinguishers are a subset of Type B fire extinguishers.
187
17. In a hot and cold aisle system, what is the typical method of handling cold air?
A. It is pumped in from below raised floor tiles.
B. It is pumped in from above through the ceiling tiles.
C. Only hot air is extracted, and cold air is the natural result.
D. Cold air exists in each aisle.
C
| With hot and cold aisles, cold air is pumped in from below raised floor tiles.
188
```
18. If RF levels become too high, it can cause the receivers in wireless units to become deaf. This process is called:
A. Clipping
B. Desensitizing
C. Distorting
D. Crackling
```
A
If RF levels become too high, it can cause the receivers in wireless units to become deaf, and it is known as desensitizing. This occurs because of the volume of RF energy present.
189
```
19. RFI is the byproduct of electrical processes, similar to EMI. The major difference is that RFI is usually projected across which of the following?
A. Network medium
B. Electrical wiring
C. Radio spectrum
D. Portable media
```
B
RFI is the byproduct of electrical processes, similar to EMI. The major difference is that RFI is usually projected across a radio spectrum. Motors with defective brushes can generate RFI, as can a number of other devices.
190
```
20. Repeatedly sending ICMP echoes to a single address to the point of overload can be categorized as what type of attack?
A. Spoofing
B. Replay
C. DoS
D. DDoS
```
C
A denial-of-service (DoS) attack prevents others from receiving service by tying up the resources of the attacked provider.
191
```
1. John is looking for a solution for his company that will give the company the most control over mobile devices, while still having the employees purchase their own devices. Which of the following solutions should he select?
A. BYOD
B. COPE
C. CYOD
D. BBBA
```
C
Choose Your Own Device has employees select from a list of approved devices. COPE has the company buy the devices, and BYOD provides very little control. BBBA is not a term used in this context.
192
```
2. Employees in your company are provided smartphones by the company. Which of the following best describes this?
A. BYOD
B. CYOD
C. COPE
D. BYOE
```
C
Company Owned and Provided Device describes company provided cell phones. The other acronyms/answers refer to other approaches to mobile devices.
193
```
3. Which of the following would be most effective in preventing a thief from using a mobile device stolen from your company?
A. GPS tracking
B. WPA2
C. COPE
D. Geofencing
```
D
Geofencing prevents a device from working outside a geographic area. WPA2 is a wireless security technology. Company Owned and Provided Equipment has the company buying devices, and Geotracking simply locates the device.
194
```
4. Ahmed is a network administrator for an insurance company. He is concerned about users storing company data on their smartphones to exfiltrate that data. Which of the following best describes this?
A. BYOD
B. Bluejacking
C. USB OTG
D. CYOD
```
C
USB On The Go is the use of portable devices as USB. Bring Your Own Device is simply a method for allowing employees to bring their devices to the company network. Blue Jacking is a Bluetooth attack. Choose Your Own Device allows employees to select a device from a pre-approved list.
195
```
5. Using Bluetooth to extract data from a victim's phone is best described as which of the following?
A. Bluesnarfing
B. Bluejacking
C. CYOD
D. Jailbreaking
```
A
Bluesnarfing extracts data via Bluetooth. Bluejacking simply sends messages to the device. Choose Your Own Device allows employees to select a device from a pre-approved list. Jailbreaking refers to gaining root or admin access.
196
```
6. What principle is most important in setting up network accounts?
A. Least privileges
B. Password expiration
C. Password complexity
D. Separation of duties
```
A
Least privileges is the most critical principle in account management. The other options are all important, but not as critical as least privileges.
197
```
7. Tom is responsible for account management in his company. For user John Smith who is an administrator, which of the following would be the best name for him to choose?
A. Admin001
B. Admjsmith
C. Ajsmith
D. jsmith
```
D
This is the only name choice that does not give any hint as to the role of that user. The others all reveal, or suggest the users role.
198
```
8. Juanita is responsible for setting up network accounts for her company. She wants to establish an account for the SQL Server service. Which of the following would be the best type of account for her to use?
A. A user/service account
B. Domain admin account
C. Guest account
D. Shared account
```
A
| All services should be assigned a service account. The other options are not secure.
199
```
9. Which of the following fully implements the 802.11i security standards?
A. WEP
B. WPA
C. WPA2
D. WAP
```
C
| WPA2 fully implements 802.11i. WEP and WPA do not. WAP is Wireless Access Point and is not a security mechanism.
200
```
10. Which of the following would be best at preventing a thief from accessing the data on a stolen phone?
A. Geotagging
B. Remote wipe
C. Geofencing
D. Segmentation
```
B
Remote wiping would allow you to remove all data from a stolen phone. Geotagging would merely allow you to locate the phone. Geofencing would prevent it from working, but not prevent access of the data. Segmentation is used to separate user data from company data.
201
```
11. anet is a network administrator for a small company. Users have been reporting that personal data is being stolen when using the wireless network. They all insist that they only connect to the corporate wireless access point. Reviewing the logs for the WAP shows that these users have not connected to it. Which of the following could best explain this situation?
A. Bluesnarfing
B. Rouge access point
C. Jamming
D. Bluejacking
```
B
| This is a classic example of a rogue access point. None of the other attacks would explain this scenario.
202
```
12. You find that users on your network are getting dropped from the wireless connection. When you check the logs for the wireless access point, you find that a deauthentication packet has been sent to the WAP from the users’ IP addresses. What seems to be happening here?
A. Bluesnarfing
B. Bluejacking
C. Session hijacking
D. Disassociation attack
```
D
This is a disassociation attack. Blue snarfing and blue jacking are Bluetooth attacks. And this does not describe session hijacking.
203
```
13. What is the primary weakness of infrared communications?
A. Line of sight
B. Low bandwidth
C. Poor authentication
D. Cannot be encrypted
```
A
Line of sight is the primary weakness. All of the other answers are not true. Infrared connections can support each of these.
204
```
14. Which wireless technology uses TKIP?
A. WEP
B. WPA
C. WPA2
D. WAP
```
B
| WPA uses Temporal Key Integrity Protocol. WEP and WPA2 do not. WAP is a Wireless Access Point
205
```
15. Which acronym describes devices provided by the company?
A. BYOD
B. COPE
C. CYOD
D. CYOP
```
B
Company Owned and Provided Equipment. BYOD or Bring Your Own Device as well as CYOD or Choose Your Own Device are both employee owned equipment. CYOP is not a real acronym for portable devices.
206
```
1. Which plan or policy helps an organization determine how to relocate to an emergency site?
A. Disaster-recovery plan
B. Backup site plan
C. Privilege management policy
D. Privacy plan
```
A
| The disaster-recovery plan deals with site relocation in the event of an emergency, natural disaster, or service outage.
207
```
2. Although you're talking to her on the phone, the sound of the administrative assistant's screams of despair can be heard down the hallway. She has inadvertently deleted a file that the boss desperately needs. Which type of backup is used for the immediate recovery of a lost file?
A. Onsite storage
B. Working copies
C. Incremental backup
D. Differential backup
```
B
Working copies are backups that are usually kept in the computer room for immediate use in recovering a system or lost file.
208
```
3. You're trying to rearrange your backup procedures to reduce the amount of time they take each evening. You want the backups to finish as quickly as possible during the week. Which backup system backs up only the files that have changed since the last backup?
A. Full backup
B. Incremental backup
C. Differential backup
D. Backup server
```
B
| An incremental backup backs up files that have changed since the last full or partial backup.
209
```
4. Which backup system backs up all the files that have changed since the last full backup?
A. Full backup
B. Incremental backup
C. Differential backup
D. Archival backup
```
C
| A differential backup backs up all of the files that have changed since the last full backup.
210
```
5. You're a consultant brought in to advise MTS on its backup procedures. One of the first problems you notice is that the company doesn't use a good tape-rotation scheme. Which backup method uses a rotating schedule of backup media to ensure long-term information storage?
A. Grandfather, Father, Son method
B. Full Archival method
C. Backup Server method
D. Differential Backup method
```
A
The Grandfather, Father, Son backup method is designed to provide a rotating schedule of backup processes. It allows for a minimum usage of backup media, and it still allows for long-term archiving.
211
```
6. Which site best provides limited capabilities for the restoration of services in a disaster?
A. Hot site
B. Warm site
C. Cold site
D. Backup site
```
B
Warm sites provide some capabilities in the event of a recovery. The organization that wants to use a warm site will need to install, configure, and reestablish operations on systems that may already exist at the warm site.
212
```
7. You're the head of information technology for MTS and have a brother in a similar position for ABC. The companies are approximately the same size and are located several hundred miles apart. As a benefit to both companies, you want to implement an agreement that would allow either company to use resources at the other site should a disaster make a building unusable. What type of agreement between two organizations provides mutual use of their sites in the event of an emergency?
A. Backup-site agreement
B. Warm-site agreement
C. Hot-site agreement
D. Reciprocal agreement
```
D
| A reciprocal agreement is between two organizations and allows one to use the other's site in an emergency.
213
```
8. The process of automatically switching from a malfunctioning system to another system is called what?
A. Fail-safe
B. Redundancy
C. Failover
D. Hot site
```
C
Failover occurs when a system that is developing a malfunction automatically switches processes to another system to continue operations.
214
```
9. Which of the following types of penetration testing focuses on the system, using techniques such as port scans, traceroute information, and network mapping to find weaknesses?
A. Active reconnaissance
B. Passive reconnaissance
C. Operational reconnaissance
D. Constricted reconnaissance
```
A
Active reconnaissance is a type of penetration testing that focuses on the system, using techniques such as port scans, traceroute information, and network mapping to find weaknesses.
215
```
10. Your company is about to invest heavily in a new server farm and have made an attractive offer for a parcel of land in another country. A consultant working on another project hears of this and suggests that you get the offer rescinded because the laws in that country are much more stringent than where you currently operate. Which of the following is the concept that data is subject to the laws of where it is stored?
A. Data sovereignty
B. Data subjugation
C. Data dominion
D. Data protectorate
```
A
| Data sovereignty is the concept that data is subject to the laws of where it is stored.
216
11. Which of the following would normally not be part of an incident response policy?
A. Outside agencies (that require status)
B. Outside experts (to resolve the incident)
C. Contingency plans
D. Evidence collection procedures
C
A contingency plan wouldn't normally be part of an incident response policy. It would be part of a disaster-recovery plan.
217
```
12. Which of the following is the process used during data acquisition for the preservation of all forms of relevant information when litigation is reasonably anticipated?
A. Chain of custody
B. Order of volatility
C. Legal hold
D. Strategic intelligence gathering
```
C
The process that is used during data acquisition for the preservation of all forms of relevant information when litigation is reasonably anticipated is known as legal hold.
當訴訟被或應該被合理的預期時，你的業務就有保存相關證據的法律義務。
http://www.deepnfar.com.tw/chiness/monthly/DFMAG259/DEEP259-316-n.htm
218
```
13. Which of the following types of vulnerability scans uses actual network authentication to connect to systems and scan for vulnerabilities?
A. Credentialed
B. Validated
C. Endorsed
D. Confirmed
```
A
| A credentialed vulnerability scan uses actual network credentials to connect to systems and scan for vulnerabilities.
219
```
14. What is another name for working copies?
A. Functional copies
B. Running copies
C. Operating copies
D. Shadow copies
```
D
| Working copies are also known as shadow copies.
220
```
15. Which of the following is a reversion from a change that had negative consequences?
A. Backup
B. ERD
C. Backout
D. DIS
```
C
| A backout is a reversion from a change that had negative consequences.
221
```
16. Karl is conducting penetration testing on the Pranks Anonymous servers and having difficulty finding a weakness. Suddenly, he discovers that security on a different company's server—a vendor to Pranks Anonymous—can be breached. Once he has compromised the completely different company's server, he can access the Pranks Anonymous servers and then launch an attack. What is this weakness/exploit known as?
A. Fulcrum
B. Pivot
C. Swivel
D. Twirl
```
B
In the realm of penetration testing, using a weakness in another—usually trusted—entity to launch an attack against a site/server is known as a pivot.
222
```
17. According to CERT, which of the following would be a formalized or an ad hoc team you can call upon to respond to an incident after it arises?
A. CSIRT
B. CIRT
C. IRT
D. RT
```
A
| A CSIRT is a formalized or an ad hoc team that you can call upon to respond to an incident after it arises.
223
```
18. Which of the following is a concept that works on the assumption that any information created on any system is stored forever?
A. Cloud computing
B. Warm site
C. Big data
D. Full archival
```
D
| Full archival is a concept that works on the assumption that any information created on any system is stored forever.
224
```
19. Which of the following is a newer backup type that provides continuous online backup by using optical or tape jukeboxes and can be configured to provide the closest version of an available real-time backup?
A. TPM
B. HSM
C. SAN
D. NAS
```
B
HSM is a newer backup type that provides continuous online backup by using optical or tape jukeboxes. It appears as an infinite disk to the system, and it can be configured to provide the closest version of an available real-time backup.
225
```
20. Which type of penetration-style testing involves actually trying to break into the network?
A. Discreet
B. Indiscreet
C. Nonintrusive
D. Intrusive
```
D
Intrusive testing involves actually trying to break into the network. Non-intrusive testing takes more of a passive approach.
