Implementation Flashcards
Which of the following access control models is the most flexible and allow the resources owner to control the access permissions?
(A)DAC
(B)MAC
(C)ABAC
(D)RBAC
(A)DAC(Stresses the importance of the owner. The original creator is considered the owner an can assign permission.)
Chris just downloaded a new third-party email client for his smartphone. When Chris attempts to log in to his email with his username and password the email client generates an error messaging stating that “invalid credentials “ were entered. Chris assumes he must have forgotten his password , so he resets his email username and password and then reenters them into email client. AGAIN, Chris receives an invalid credentials error. What is Most likely causing the Invalid Credentials error regarding Chris email client?
(A)His email account requires a strong password to be used..
(B)His email account is locked out
(C)His email account requires multi factor authentication
(D)His Smartphone has full device encryption enabled
(C)His email account requires Multi-Facor authentication
You received an incident response report indicating apiece of malware was introduced into the company’s network through a remote workstation connected to the company’s servers over a VPN connection. Which of the following controls should be applied to prevent this type of incident from occurring again?
(A)NAC
(B)ACL
(C)MAC Filtering
(D)SPF
(NAC) is an approach to computer security that attempts to unify endpoint security technology.
Your home network is configured with a long, strong, and complex pre shared key for its WPA2 encryption. You noticed that your wireless network has been running slow, so you checked the list of ‘connected client’ and see that ‘Bob’s laptop’ is connected to it. Bob lives downstairs and is the maintenance man for your apartment building. You know that you never gave Bob your password, but somehow he has figured out how to connect to your wireless network. Which of the following actions should you take to prevent anyone from connecting to your wireless network without the proper WPA3 password?
(A)Disable WPS
(B)Disable WPA3
(C)Enable WEP
(D)Disable SSID
(A)Disable WPS(Unfortunately, WPS is vulnerable to a brute-force attack and is easily compromised. Therefore, WPS should be Disabled on all wireless networks. Bob could press WiFi button to connect.
Which mobile device strategy is most likely to introduce vulnerable devices to a corporate network?
(A)COPE
(B)BYOD
(C)MDM
(D)CYOD
BYOD(Brining yor own device that connected to company system opens up to many vulnerabilities)
With of the following features is supported by Kerberos but not RADIUS?
(A)Services for authentication
(B)XML for cross platform interoperability
(C)Tickets used to identify authenticated users
(D)SSO Capabilty
(C)Kerberos is all about tickets. Kerberos uses a system of tickets to allow nodes to communicate over a non-secure network and securely proves their identity.
Why would a company want to utilize a wildcard certificate for their servers?
(A)To reduce the certificate management burden
(B)To secure the certificate private key
(C)To increase the certificate encryption key length
(D)To extend the renewal date of the certificate
(A) To Reduce the certificate management
Burden(Is a public key that saves money and reduce the management burden of managing multiple certificates)
What control provides the best protection against both SQL injection and cross site scripting attacks?
(A)Network layet Firewall
(B)Input Validation
(C)CSRF
(D)Hypervisors
(B)Input Validation prevents the attacker from sending invalid data to an application and is a strong control against both SQL injection and cross site scripting attacks.
A company netflow collection system can handle up to 2 Gbps. Due to excessive load, this excessive load this has begun to approach full utilization at various times of day. If the security team does not have additional money in their budget to purchase a more capable collector, which of the following options could they use to coll useful data?
(A)Enable sampling of the data
(B)Enable full packet capture
(C)Enable Qos
(D)Enable NetFlow compression
(A) Sampling can help them capture network flows that cold be useful without collecting everything passing through the sensor.
A company needs to implement stronger authentication by adding an authentication factor to its wireless system. The wireless system only supports WPA with pre shaved keys, but the backend authentication system supports EAP and TTLS. What should the network administrator implement?
(A)PKI with user authentication
(B)MAC address filtering with IP filtering
(C)802.1x using EAP with MSCAPv2
(D)WPA2 with a complex shared key
(C)Since the backend uses RADIUS server for backend authentication, the network administrator can install 802.1x using EAP with Ms for authentication.
Which of the following would NOT be included in a company’s password policy?
(A)Password Style
(B)Password History
(C)Password Complexity Requirements
(D)Password Age
(A) A Password policy is a set of rules that must be followed for security reasons. A security awareness would include a Password complexity, age, and history requirements.
Whay type of wireless security measures can easily be defeated by a hacker by spoofing their network interface card’s hardware address?
(A)Disable SSID braodcadt
(B)WPS
(C)MAC filtering
(D)WEP
(C) WAP uses Mac Filtering to ensure only known network interface cards are allowed to connect to the network.
Which type of threat will patches NOT effectively combat as a security control?
(A)Zero Day Attack
(B)Malware with defined indicator
(C)Discovered Software Bugs
(D)Known Vulnerability
A Zero Day Attack
Which of the following describes the security method used when users enters their username and password only once and can access multiple application?
(A)Inheritance
(B)Mulfifactor Authentication
(C)SSO
(D)Permission Propagation
(C)SSO allows you to access multiple systems with one sign on.
The email client on a desktop workstation is acting strangely. Evertimethe user opens an email with an image embedded within it, is not displayed on their screen. Which of the following is the MOST likely causes of this issue?
(A)Incorrect email settings in the anti-virus software
(B)Incorrect settings in the host based firewall
(C)Incorrect settings in your email proxy server
(D)Incorrt setting in your web browsers trusted site configuration
(E)Incorrect security settings in the email client
(E) This is a security setting on the mail client to prevent malicious malware and viruses from entering you environment.
David Noticed that port 3389 was open on one of the POS terminals in a store during a scheduled PCI compliance scan. Based on the scan results, what service should he expect to find enabled on this terminal?
(A)RDP
(B)IMAP
(C)MYSQL
(D)LDAP
(A)RDP(Port 3389 is an RDP used for Remote Desktop Protocal.)
Which of the following types of digital forensic investigation is the most challenging due to the on demand nature of the analyzed assets?
(A)On Premise Servers
(B)Cloud Service
(C)mobile Device
(D)Employee Workstation
(B)Cloud Sevice( The on demand nature of Cloud Services means that instance are often created and destroyed again, with no real opportunity for forensic recovery of any data)
Ryan needs to verify the installation of a critical Windows patch on his organization workstation. Which method would be the most efficient to validate the current patch status for all of the organization Windows 10 Workstation?
A. Check the update History Manually
B. Conduct a registry scan off each workstation to validate the patch was installed
C. Create and run owerShell script to search for the specific patch in question
D. Use an Endpoint manager to validate patch Status for each machine on the domain
D. Use an endpoint manager to validate patch status for each machine on the domain
You are reviewing a rule within your organization’s IDS. You see the following output: Based on this rule, which of the following malicious packets would this IDS alert on?
A. A malicious outbound TCP Packet
B. A malicious outbound packets
C. A malicious inbound TCP Packet
D. A malicious inbound packets
C. A malicious inbound TCP Packet
OBJ-3.3: The rule header is set to alert only on TCP packets based on this IDS rule’s first line. The flow condition is set as “to_client, established,” which means that only inbound traffic will be analyzed against this rule and only inbound traffic for connections that are already established. Therefore, this rule will alert on an inbound malicious TCP packet only when the packet matches all the conditions listed in this rule. This rule is an example of a Snort IDS rule. For the exam, you do not need to create your own IDS rules, but you should be able to read them and pick out generic content like the type of protocol covered by the signature, the port to be analyzed, and the direction of flow.
(Sample Simulation – On the real exam for this type of question, you would have to rearrange the ports into the proper order by dragging and dropping them into place.) Using the image provided, place the port numbers in the correct order with their associated protocols:
A. 389,88,1701,3389
B.1701,3389,88,389
C.3389,1701,389,88
D.88,389,3389,1701
C.3389,1701,389,88
OBJ-3.1: For the exam, you need to know your ports and protocols. The Remote Desktop Protocol (RDP) operates over port 3389. Layer 2 Tunneling Protocol (L2TP) operates over port 1701. The Lightweight Directory Access Protocol (LDAP) operates over port 389. Kerberos operates over port 88.
The Pass Certs Fast corporation has recently been embarrassed by several high-profile data breaches. The CIO proposes improving the company’s cybersecurity posture by migrating images of all the current servers and infrastructure into a cloud-based environment. What, if any, is the flaw in moving forward with this approach?
A. The attack assumes that the on-site admin will provide better security then the cloud provider.
B. This approach only changes the location of the network and not the network’s attack surface.
C. This is a reasonable approach that will increase the security of the servers and infrastructure
D. The company has already paid for the physical server and will not fully realize their ROI on them do to the mitigation.
B. This approach only changes the location of the network and not the network’s attack suface.
Your company just launched a new invoicing website for use by your five largest vendors. You are the cybersecurity analyst and have been receiving numerous phone calls that the webpage is timing out, and the website overall is performing slowly. You have noticed that the website received three million requests in just 24 hours, and the service has now become unavailable for use. What do you recommend should be implemented to restore and maintain the availability of the new invoicing system?
A. Implement an allow list
B.VPN
C. Intrusion Detection System
D.MAC Filtering
A. Implement an allow list
Which of the following ports should you block at the firewall if you want to prevent a remote login to a server from occurring?
A. 80
B. 143
C. 22
D. 21
C.22
Your organization has recently suffered a data breach due to a server being exploited. As a part of the remediation efforts, the company wants to ensure that the default administrator password on each of the 1250 workstations on the network is changed. What is the easiest way to perform this password change requirement?
A. Utilize the escrow process
B. Deploy a new group policy
C. Create a new security group
D. Revoke the digital certificate
B. Deploy a new group policy
Dion Training utilizes a wired network throughout the building to provide network connectivity. Jason is concerned that a visitor might plug their laptop into a CAT 5e wall jack in the lobby and access the corporate network. What technology should be utilized to prevent users from gaining access to network resources if they can plug their laptops into the network?
A. VPN
B. DMZ
C. UTM
D. NAC
D. NAC
Your company has an office in Boston and is worried that its employees may not reach the office during periods of heavy snowfall. You have been asked to select a technology that would allow employees to work remotely from their homes during poor weather conditions. Which of the following should you select?
A. IDS
B. NAT
C. VLAN
D. VPN
D. VPN
A corporate workstation was recently infected with malware. The malware was able to access the workstation’s credential store and steal all the usernames and passwords from the machine. Then, the malware began to infect other workstations on the network using the usernames and passwords it stole from the first workstation. The IT Director has directed its IT staff to develop a plan to prevent this issue from occurring again. Which of the following would BEST prevent this from reoccurring?
A. Monitor all workstation
B. Install a host-based detection
C. Install a unified Threat Management
D. Install a anti-virus or anti-malware
D. Install a anti-virus or anti-malware
Which of the following is not normally part of an endpoint security suite?
A. Software Firewall
B. IPS
C. VPN
D. Anti-Virus
C. VPN
You are working for a government contractor who requires all users to use a PIV device when sending digitally signed and encrypted emails. Which of the following physical security measures is being implemented?
A. Biometric Reader
B. Cable Lock
C. Smart Card
D. Key Fob
C. Smart Card
Which of the following technologies is NOT a shared authentication protocol?
A. Facebook Content
B. QAuth
C. OpenID Connect
D. LDAP
D. LDAP
William would like to use full-disk encryption on his laptop. He is worried about slow performance, though, so he has requested that the laptop have an onboard hardware-based cryptographic processor. Based on this requirement, what should William ensure the laptop contains?
A. PAM
B. TPM
C. AES
D.FDE
B. TPM
You have just finished running a Nmap scan on a server are see the following output:
Based on the output above, which of the following ports listed as open represents the most significant security vulnerability to your network?
A.443
B.23
C.22
D.53
B.23
OBJ-3.1: Port 23 is used by telnet and is not considered secure because it sends all of its data in cleartext, including authentication data like usernames and passwords. As an analyst, you should recommend that telnet be disabled and blocked from use. The other open ports are SSH (port 22), DNS (port 53), and HTTPS (port 443).
Your team is developing an update to a piece of code that allows customers to update their billing and shipping addresses in the web application. The shipping address field used in the database was designed with a limit of 75 characters. Your team’s web programmer has brought you some algorithms that may help prevent an attacker from trying to conduct a buffer overflow attack by submitting invalid input to the shipping address field. Which pseudo-code represents the best solution to prevent this issue?
A. if(shippingAddress <=75){update field} else exit
B. if(shippingAddress !=75){update field} else exit
C. if(shippingAddress =75){update field} else exit
D. if(shippingAddress >=75){update field} else exit
if(shippingAddress <=75){update field} else exit
Which of the following policies should contain the requirements for removing a user’s access when an employee is terminated?
A. Account Management Policy
B. Data Ownership Policy
C. Data Retention Policy
D. Data Classification Policy
A. Account Management Policy
What tool is used to collect wireless packet data?
A. Netcat
B. John the Ripper
C. Aircrack-ng
D. Nessus
C. Aircrack-ng
A firewall administrator has configured a new screened subnet to allow public systems to be segmented from the organization’s internal network. The firewall now has three security zones set: Untrusted (Internet) [143.27.43.0/24]; DMZ (Screened Subnet) [161.212.71.0/24]; Trusted (Intranet) [10.10.0.0/24]. The firewall administrator has been asked to enable remote desktop access from a fixed IP on the remote network to a remote desktop server in the screened subnet for the Chief Security Officer to work from his home office after hours. The CSO’s home internet uses a static IP of 143.27.43.32. The remote desktop server is assigned a public-facing IP of 161.212.71.14. What rule should the administrator add to the firewall?
A. Permit 143.27.43.32 161.212.71.14 RDP 3389
B. Permit 143.27.43.0/24 161.212.71.14 RDP 3389
C. Permit 143.27.43.32 161.212.71.0/24 RDP 3389
D. Permit 143.27.43.0/24 161.212.71.0/24 RDP 3389
D. Permit
A. Permit 143.27.43.32 161.212.71.14 RDP 3389
Which of the protocols listed is NOT likely to trigger a vulnerability scan alert when used to support a virtual private network (VPN)?
A. SSLv2
B. PPTP
C. IPsec
D. SSLv3
C. IPsec
You need to determine the best way to test operating system patches in a lab environment before deploying them to your automated patch management system. Unfortunately, your network has several different operating systems in use, but you only have one machine available to test the patches on. What is the best environment to utilize to perform the testing of the patches before deployment?
A. Bypass testing and deploy
B. Virtualization
C. Sandboxing
D. Purchase additional workstation
B. Virtualization
A financial services company wants to donate some old hard drives from their servers to a local charity. The hard drives used in the servers are self-encrypting drives. Still, they are concerned about the possibility of residual data being left on the drives. Which of the following secure disposal methods would you recommend the company use?
A. Overwrite
B. Zero-fill
C. Secure erase
D. Cryptographic erase
D. Cryptographic Erase
A hacker successfully modified the sale price of items purchased through your company’s website. During the investigation that followed, the security analyst has verified the web server, and the Oracle database was not compromised directly. The analyst also found no attacks that could have caused this during their log verification of the Intrusion Detection System (IDS). What is the most likely method that the attacker used to change the items’ sale price?
A. Cross- Site Scripting
B. SQL Injection
C. Buffer Overflow attack
D. Changing hidden form values
D. Changing hidden form values
Which of the following access control methods utilizes a set of organizational roles in which users are assigned to gain permissions and access rights?
A. RBAC
B. ABAC
C. DAC
D. MAC
A. RBAC
Windows file servers commonly hold sensitive files, databases, passwords, and more. What common vulnerability is usually used against a Windows file server to expose sensitive files, databases, and passwords?
A. CRTL Injection
B. Missing Patches
C. Cross Site Scripting
D. SQL Injection
B. Missing Patches
Jason has installed multiple virtual machines on a single physical server. He needs to ensure that the traffic is logically separated between each virtual machine. How can Jason best implement this requirement?
A. Configure a switch on physical server
B. Install a virtual firewall
C. Create a virtual router
D. Create a system partitioning
A. Configure a switch on physical server
While working as a security analyst, you have been asked to monitor the SIEM. You observed network traffic going from an external IP to an internal host’s IP within your organization’s network over port 443. Which of the following protocols would you expect to be in use?
A. SSH
B. TLS
C. TFTP
D. HTTP
B. TLS
Which of the following protocols could be used inside a virtual system to manage and monitor the network?
A. SMTP
B. SNMP
C. BGP
D. EIGP
SNMP
(Sample Simulation – On the real exam for this type of question, you would have to rearrange the ports into the proper order by dragging and dropping them into place.) Using the image provided, place the port numbers in the correct order with their associated protocols:
A. 23,110,22,161
B. 22,110,23,161
C. 22,110,161,23
D. 22,23,110,161
C. 22,110,161,23
OBJ-3.1: For the exam, you need to know your ports and protocols. The Secure Copy (SCP) operates over port 22. Telnet operates over port 23. The Simple Network Management Protocol (SNMP) operates over port 161. The Post Office Protocol 3 (POP3) operates over port 110.
(Sample Simulation – On the real exam for this type of question, you would have to rearrange the steps into the proper order by dragging and dropping them into place.) Using the image provided, place the port numbers in the correct order with their associated protocols.
A. 25,80,53,69
B. 80,53,69,25
C. 69,25,80,53
D. 53,69,25,80
C. 69,25,80,53
OBJ-3.1: For the exam, you need to know your ports and protocols. The Trivial File Transfer Protocol (TFTP) uses port 69. The Simple Mail Transfer Protocol (SMTP) uses port 25. The Hypertext Transfer Protocol (HTTP) uses port 80. The Domain Name Service (DNS) protocol uses port 53.
Review the network diagram provided. Which of the following ACL entries should be added to the firewall to allow only the system administrator’s computer (IT) to have SSH access to the FTP, Email, and Web servers in the DMZ?
(Note: The firewall in this network is using implicit deny to maintain a higher level of security. ACL entries are in the format of Source IP, Destination IP, Port Number, TCP/UDP, Allow/Deny.)
A. 192.168.0.0/24, 172.16.1.4, TCP, ALLOW
B. 172.16.1.4, 192.168.0.0/24, 22, TCP, ALLOW
C. 172.16.1.4, 192.168.0.0/24, ANY, TCP, ALLOW
D. 192.168.0.0/24, 172.16.1.4, ANY, TCP, ALLOW
B. 172.16.1.4, 192.168.0.0/24, 22, TCP, ALLOW
OBJ-3.3: The ACL should be created with 172.16.1.3 as the Source IP, 192.168.1.12 as the Destination IP, 445 as the port number operating over TCP, and the ALLOW condition set. This is the most restrictive option presented (only the HR and Files server are used), and the minimal number of ports are opened to accomplish our goal (only port 445 for the SMB service).
(Sample Simulation – On the real exam for this type of question, you would have to fill in the blanks by dragging and dropping them into place.) Using the image provided, select four security features that you should use with a workstation or laptop within your organization?
A. CAT5e STP, Location Tracking, Host Based firewall, Remote Wipe
B. Host Based firewall, Network Sniffer, Cable Lock, CAT5e STP
C. Cable Lock, Network Sniffer, Host Based firewall, Remote wipe
D. Remote Wipe, Location Tracking, Host Based firewall, CableLock
B. Host Based firewall, Network Sniffer, Cable Lock, CAT5e STP
OBJ-3.5: Host-based firewall, Network sniffer, a Cable lock, and CAT5e STP cables are appropriate security features to use with a corporate workstation or laptop. Using a host-based firewall (such as Windows Firewall), you can configure the workstation or laptop to block incoming or outgoing data from the device’s network connection. If you install a network sniffer, you will be able to capture any network traffic used on the network for later analysis. If you use a cable lock, it will lock the workstation or laptop to a desk and prevent theft of the device. If you use a CAT 5e STP cable for your network connection, you will minimize EMI risk and reduce data emanations.
(Sample Simulation – On the real exam for this type of question, you would have to fill in the blanks by dragging and dropping them into place.) Using the image provided, select four security features that you should use with a smartphone provided through a COPE policy in your organization?
A. Remote Wipe, Location Tracking, Host Based Firewall, Cable Lock
B. Cellular data, Remote Wipe, Location Tracking, MDM
C. MDM, Location Tracking, Host Based Firewall, Remote Wipe
D. Cable Lock, Network Sniffer, Cellular data, Remote Wipe
B. Cellular data, Remote Wipe, Location Tracking, MDM
OBJ-3.5: Cellular data, Remote wipe, Location tracking, and MDM are all appropriate security features to use with a company-provided laptop. By using cellular data, your users will be able to avoid connecting to WiFi networks for connectivity. Remote wipe enables the organization to remotely erase the device’s contents if it is lost or stolen. Location tracking uses the smart phone’s GPS coordinates for certain apps, location-based authentication, and to track down a device if it is lost or stolen. Mobile device management (MDM) programs enable the administrators to remotely push software updates, security policies, and other security features to the device from a centralized server.
