Implementation Flashcards
You are installing a new wireless network in your office building and want to ensure it is secure. Which of the following configurations would create the MOST secure wireless network?
WPA2 and RC4
WEP and TKIP
WPA and MAC filtering
WPA2 and AES
WPA2 and AES
Your company has an office in Boston and is worried that its employees may not reach the office during periods of heavy snowfall. You have been asked to select a technology that would allow employees to work remotely from their homes during poor weather conditions. Which of the following should you select?
VPN
IDS
VLAN
NAT
VPN
A firewall administrator has configured a new DMZ to allow public systems to be segmented from the organization’s internal network. The firewall now has three security zones set: Untrusted (Internet) [143.27.43.0/24]; DMZ (DMZ) [161.212.71.0/24]; Trusted (Intranet) [10.10.0.0/24]. The firewall administrator has been asked to enable remote desktop access from a fixed IP on the remote network to a remote desktop server in the DMZ for the Chief Security Officer to work from his home office after hours. The CSO’s home internet uses a static IP of 143.27.43.32. The remote desktop server is assigned a public-facing IP of 161.212.71.14. What rule should the administrator add to the firewall?
Permit 143.27.43.32 161.212.71.14 RDP 3389
Permit 143.27.43.32 161.212.71.0/24 RDP 3389
Permit 143.27.43.0/24 161.212.71.0/24 RDP 3389
Permit 143.27.43.0/24 161.212.71.14 RDP 3389
Permit 143.27.43.32 161.212.71.14 RDP 3389
You want to provide controlled remote access to the remote administration interfaces of multiple servers hosted on a private cloud. What type of segmentation security solution is the best choice for this scenario?
Bastion hosts
Physical
Jumpbox
Airgap
Jumpbox
Which of the following ports should you block at the firewall if you want to prevent a remote login to a server from occurring?
110
23
443
25
23
Which of the following is the LEAST secure wireless security and encryption protocol?
WPA2
WPA
AES
WEP
WEP
Which of the following secure coding best practices ensures special characters like , /, and ‘ are not accepted from the user via a web form?
Session management
Input validation
Output encoding
Error handling
Input validation
Why would a company want to utilize a wildcard certificate for their servers?
To increase the certificate’s encryption key length
To extend the renewal date of the certificate
To reduce the certificate management burden
To secure the certificate’s private key
To reduce the certificate management burden
Your company just installed a new webserver within your DMZ. You have been asked to open up the port for secure web browsing on the firewall. Which port should you set as open to allow users to access this new server?
80
443
21
143
443 (HTTPS)
You received an incident response report indicating a piece of malware was introduced into the company’s network through a remote workstation connected to the company’s servers over a VPN connection. Which of the following controls should be applied to prevent this type of incident from occurring again?
SPF
MAC filtering
NAC
ACL
NAC
You are conducting an incident response and have traced the attack source to some compromised user credentials. After performing log analysis, you discover that the attack was successfully authenticated from an unauthorized foreign country. Your management is now asking for you to implement a solution to help mitigate this type of attack from occurring again. Which of the following should you implement?
Context-based authentication
Single sign-on
Password complexity
Self-service password reset
Context-based authentication
The Pass Certs Fast corporation has recently been embarrassed by several high profile data breaches. The CIO proposes improving the company’s cybersecurity posture by migrating images of all the current servers and infrastructure into a cloud-based environment. What, if any, is the flaw in moving forward with this approach?
This approach assumes that the cloud will provide better security than is currently done on-site
This approach only changes the location of the network and not the attack surface of it
This is a reasonable approach that will increase the security of the servers and infrastructure
The company has already paid for the physical servers and will not fully realize their ROI on them due to the migration
This approach only changes the location of the network and not the attack surface of it
The management at Steven’s work is concerned about rogue devices being attached to the network. Which of the following solutions would quickly provide the most accurate information that Steve could use to identify rogue devices on a wired network?
A physical survey
A discovery scan using a port scanner
Reviewing a central administration tool like a SCCM
Router and switch-based MAC address reporting
Router and switch-based MAC address reporting
You are configuring the ACL for the network perimeter firewall. You have just finished adding all the proper allow and deny rules. What should you place at the end of your ACL rules?
A time of day restriction
A SNMP deny string
An implicit deny statement
An implicit allow statement
An implicit deny statement
Which authentication mechanism does 802.1x usually rely upon?
HOTP
RSA
EAP
TOTP
EAP
Extensible Authentication Protocol - A framework of protocols that allows for numerous methods of authentication including passwords, digital certificates, and public key
infrastructure
You are reviewing a rule within your organization’s IDS. You see the following output:-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET anymsg: “BROWSER-IE Microsoft Internet ExplorerCacheSize exploit attempt”;flow: to_client,established; file_data; content:”recordset”; offset:14; depth:9; content:”.CacheSize”; distance:0; within:100; pcre:”/CacheSize\s=\s/”; byte_test:10,>,0x3ffffffe,0,relative,string; max-detect-ips drop, service http; reference:cve,2016-8077; classtype: attempted-user; sid:65535;rev:1; -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Based on this rule, which of the following malicious packets would this IDS alert on?
Any malicious outbound packets
An malicious inbound TCP packet
Any malicious inbound packets
An malicious outbound TCP packet
In an effort to improve the security of the Dion Training corporate network, a security administrator wants to update the configuration of their wireless network to have IPSec built into the protocol by default. Additionally, the security administrator would like for NAT to no longer be required for extending the number of IP addresses available. What protocol should the administrator implement on the wireless network to achieve their goals?
IPv4
IPv6
WEP
WPA2
IPv6
Which of the following protocols is commonly used to collect information about CPU utilization and memory usage from network devices?
SNMP
MIB
NetFlow
SMTP
MIB (Management Information Base)
Which operating system feature is designed to detect malware that is loaded early in the system startup process or before the operating system can load itself?
Advanced anti-malware
Startup Control
Measured boot
Master Boot Record analytics
Measured boot
A new security appliance was installed on a network as part of a managed service deployment. The vendor is who controls the appliance, and the IT team is not able to log in or configure it. The IT team is concerned about the appliance receiving necessary updates. Which of the following mitigations should be performed to minimize the concern for the appliance and updates?
Vulnerability scanning
Automatic updates
Scan and patch the device
Configuration management
Vulnerability scanning
Which of the following technologies is NOT a shared authentication protocol?
Facebook Connect
OpenID Connect
LDAP
OAuth
LDAP
You need to determine the best way to test operating system patches in a lab environment prior to deploying them to your automated patch management system. Unfortunately, your network has several different operating systems in use, but you only have one machine available to test the patches on. What is the best environment to utilize to perform the testing of the patches prior to deployment?
Virtualization
Bypass testing and deploy patches directly into the production environment
Sandboxing
Purchase additional workstations
Virtualization
You suspect that your server has been the victim of a web-based attack. Which of the following ports would most likely be seen in the logs to indicate the target of the attack?
443
389
3389
21
443
Which of the following access control methods provides the most detailed and explicit type of access control over a resource?
DAC
MAC
ABAC
RBAC
ABAC
Dion Training is using an authentication protocol to connect a network client to a networked file server by providing its authentication credentials. The file server then uses the authentication credentials to issue an authentication request to the server running this protocol. The server then is able to exchange authentication messages with the file server on behalf of the client. Throughout this process, a shared secret is used to protect the communication. Which of the following technologies relies upon the shared secret?
RADIUS
LDAP
PKI
Kerberos
RADIUS
The RADIUS protocol utilizes an obfuscated password that is created from the shared secret and creates a MD5 hash of the authentication request to protect the communications.The RADIUS protocol utilizes an obfuscated password that is created from the shared secret and creates a MD5 hash of the authentication request to protect the communications.
You are installing a new wireless network in your office building and want to ensure it is secure. Which of the following configurations would create the MOST secure wireless network?
WPA2 and AES
WEP and TKIP
WPA and MAC filtering
WPA2 and RC4
WPA2 and AES
A company needs to implement stronger authentication by adding an authentication factor to its wireless system. The wireless system only supports WPA with pre-shared keys, but the backend authentication system supports EAP and TTLS. What should the network administrator implement?
WPA2 with a complex shared key
MAC address filtering with IP filtering
802.1x using EAP with MSCHAPv2
PKI with user authentication
802.1x using EAP with MSCHAPv2
A user reports that every time they try to access https://www.diontraining.com, they receive an error stating “Invalid or Expired Security Certificate”. The technician attempts to connect to the same site from other computers on the network, and no errors or issues are observed. Which of the following settings needs to be changed on the user’s workstation to fix the “Invalid or Expired Security Certificate” error?
UEFI boot mode
Date and time
User access control
Logon times
Date and time
Your organization has recently suffered a data breach due to a server being exploited. As a part of the remediation efforts, the company wants to ensure that the default administrator password on each of the 1250 workstations on the network is changed. What is the easiest way to perform this password change requirement?
Utilize the key escrow process
Revoke the digital certificate
Deploy a new group policy
Create a new security group
Deploy a new group policy
William would like to use full-disk encryption on his laptop. He is worried about slow performance, though, so he has requested that the laptop have an onboard hardware-based cryptographic processor. Based on this requirement, what should William ensure the laptop contains?
AES
PAM
FDE
TPM
Trusted Platform Module (TPM) is a hardware-based cryptographic processing component that is a part of the motherboard.
Which of the following functions is not provided by a TPM?
User authentication
Secure generation of cryptographic keys
Binding
Sealing
Random number generation
Remote attestation
User authentication
Which of the following tools could be used to detect unexpected output from an application being managed or monitored?
A log analysis tool
A signature-based detection tool
Manual analysis
A behavior-based analysis tool
A behavior-based analysis tool
Your firewall is blocking outbound email traffic that is attempting to be sent. Which port should you verify is set to ALLOW in the firewall to ensure your emails are being sent?
80
143
25
22
25
Email servers rely on port 25 to send emails out of the network. Port 25 must be set to OPEN or ALLOW in the firewall in order for SMTP (sendmail transfer protocol) to function properly. Port 22 is SSH, Port 80 is HTTP, and Port 143 is IMAP.
Users connecting to an SSID appear to be unable to authenticate to the captive portal. Which of the following is the MOST likely cause of the issue?
SSL certificates
RADIUS
CSMA/CA
WPA2 security key
RADIUS
Captive portals usually rely on 802.1x, and 802.1x uses RADIUS for authentication.
What tool is used to collect wireless packet data?
John the Ripper
Nessus
Aircrack-ng
Netcat
Aircrack-ng
Aircrack-ng is a complete suite of wireless security assessment and exploitation tools that includes monitoring, attacking, testing, and cracking of wireless networks
A hacker successfully modified the sale price of items purchased through your company’s web site. During the investigation that followed, the security analyst has verified the web server, and the Oracle database was not compromised directly. The analyst also found no attacks that could have caused this during their log verification of the Intrusion Detection System (IDS). What is the most likely method that the attacker used to change the sale price of the items purchased?
Cross-site scripting
Changing hidden form values
SQL injection
Buffer overflow attack
Changing hidden form values
Tim, a help desk technician, receives a call from a frantic executive who states that their company-issued smartphone was stolen during their lunch meeting with a rival company’s executive. Tim quickly checks the MDM administration tool and identifies that the user’s smartphone is still communicating with the MDM and displays the location of the device on a map. What should Tim do next to ensure the data on the stolen device remains confidential and inaccessible to the thief?
Remotely encrypt the device
Identify the IP address of the smartphone
Reset the device’s password
Perform a remote wipe of the device
Perform a remote wipe of the device
You conducted a security scan and found that port 389 is being used when connecting to LDAP for user authentication instead of port 636. The security scanning software recommends that you remediate this by changing user authentication to port to 636 wherever technically possible. What should you do?
Conduct remediation actions to update encryption keys on each server to match port 636
Change all devices and servers that support it to port 636 since encrypted services run by default on port 636
Change all devices and servers that support it to port 636 since port 389 is a reserved port that requires root access and can expose the server to privilege escalation attacks
Mark this as a false positive in your audit report since the services that typically run on ports 389 and 636 are identical
Change all devices and servers that support it to port 636 since encrypted services run by default on port 636
What technology is NOT PKI x.509 compliant and cannot be used in a variety of secure functions?
Blowfish
SSL/TLS
PKCS
AES
Blowfish
You have been asked to recommend a capability to monitor all of the traffic entering and leaving the corporate network’s default gateway. Additionally, the company’s CIO requests the ability to block certain types of content before it leaves the network based on operational priorities. Which of the following solution should you recommend to meet these requirements?
Install a NIPS on the internal interface and a firewall on the external interface of the router
Install a firewall on the router’s internal interface and a NIDS on the router’s external interface
Installation of a NIPS on both the internal and external interfaces of the router
Configure IP filtering on the internal and external interfaces of the router
Install a NIPS on the internal interface and a firewall on the external interface of the router
Which of the following identity and access management controls relies upon using a certificate-based authentication mechanism?
HOTP
TOTP
Smart card
Proximity card
Smart card
You want to provide controlled remote access to the remote administration interfaces of multiple servers hosted on a private cloud. What type of segmentation security solution is the best choice for this scenario?
Airgap
Jumpbox
Physical
Bastion hosts
Jumpbox
Which protocol relies on mutual authentication of the client and the server for its security?
RADIUS
Two-factor authentication
LDAPS
CHAP
LDAPS
The Lightweight Directory Access Protocol (LDAP) uses a client-server model for mutual authentication. LDAP is used to enable access to a directory of resources (workstations, users, information, etc). TLS provides mutual authentication between clients and servers. Since Secure LDAP (LDAPS) uses TLS, it provides mutual authentication.
Your home network is configured with a long, strong, and complex pre-shared key for its WPA2 encryption. You noticed that your wireless network has been running slow, so you checked the list of “connected clients” and see that “Bob’s Laptop” is connected to it. Bob lives downstairs and is the maintenance man for your apartment building. You know that you never gave Bob your password, but somehow he has figured out how to connect to your wireless network. Which of the following actions should you take to prevent anyone from connecting to your wireless network without the WPA2 password?
Disable WPA2
Disabled WPS
Enable WPA
Disable SSID broadcast
Disabled WPS
WPS was created to ease the setup and configuration of new wireless devices by allowing the router to automatically configure them after a short eight-digit PIN was entered. Unfortunately, WPS is vulnerable to a brute-force attack and is easily compromised. Therefore, WPS should be disabled on all wireless networks
While working as a security analyst, you have been asked to monitor the SIEM. You observed network traffic going from an external IP to an internal host’s IP within your organization’s network over port 443. Which of the following protocols would you expect to be in use?
TLS
TFTP
SSH
HTTP
TLS
Transport Layer Security (TLS) is used to secure web connections over port 443. Since port 443 was in use, you should expect either HTTPS, SSL, or TLS to be used as the protocol. If not, this would be suspicious activity and should be investigated. In fact, since this was a connection from the external IP to an internal host over port 443, this is suspicious and could be indicative of a remote access trojan on your host.
A cybersecurity analyst has deployed a custom DLP signature to alert on any files that contain numbers in the format of a social security number (xxx-xx-xxxx). Which of the following concepts within DLP is being utilized?
Document matching
Statistical matching
Exact data match
Classification
Exact data match
Port 22
SCP
Port 110
POP3
