Lesson 17: Managing Security Settings Flashcards
True or false? An organization should rely on automatic screen savers to prevent ‘lunchtime’ attacks.
False.
A ‘lunchtime’ attack is where a threat actor gains access to a ‘signed-in user’ account because the desktop has not locked. While an automatic screensaver lock provides some protection, there may still be a window of opportunity for a threat actor between the user leaving the workstation unattended and the screensaver activating. Users must lock the workstation manually when leaving it unattended.
What type of ‘account management’ policy can protect against ‘password-guessing’ attacks?
A ‘lockout’ policy.
A ‘lockout’ policy disables the account after a number of incorrect sign-in attempts.
A security consultant has recommended more frequent monitoring of the antivirus software on workstations. What sort of checks should this monitoring perform?
That the antivirus is enabled, is up to date with scan engine components and definitions, and has only authorized exclusions configured.
You are completing a checklist of security features for workstation deployments. Following the CompTIA A+ objectives, what additional item should you add to the following list, and what recommendation for a built-in Windows feature or features can you recommend be used to
implement it?
- Password best practices
- End-user best practices
- Account management
- Change default administrator’s user account/password
- Disable ‘AutoRun/AutoPlay’
- Enable ‘Windows Update’, ‘Windows Defender Antivirus’, and ‘Windows Defender Firewall’
‘Data-at-rest’ encryption.
Examples of data at rest might include vital corporate files stored on the hard drive of an employee’s computer, files on an External hard drive, data left in a storage area network (SAN) or files on the servers of an offsite backup service provider.
In Windows, this can be configured at file level via the ‘Encrypting File System’ (EFS) or at disk level via ‘BitLocker’.
A company must deploy custom browser software to employees’ workstations. What method can be used to validate the download and installation of this custom software?
The package can be signed using a developer certificate issued by a trusted certificate authority. Alternatively, a cryptographic hash of the installer can be made, and this value can be given to each support technician. When installing the software, the technician can make his or her own hash of the downloaded installer and compare it to the reference hash.
A security consultant has recommended blocking ‘end-user’ access to the ‘chrome://flags’ browser page. Does this prevent a user from changing any browser settings?
No.
The ‘chrome://flags’ page is for advanced configuration settings. General user, security, and privacy settings are configured via ‘chrome://settings’.
What primary indicator must be verified in the browser before using a web form?
That the browser address bar displays the ‘lock’ icon to indicate that the site uses a trusted certificate.
This validates the site identity and protects information submitted via the form from interception.
True or false? Using a browser’s incognito mode will prevent sites from recording the user’s IP address.
False.
Incognito mode can prevent the use of cookies but cannot conceal the user’s source IP address. You do not need to include this in your answer, but the main way to conceal the source IP address is to connect to sites via a ‘virtual private network’ (VPN).
Why might a PC infected with malware display no obvious symptoms?
If the malware is used with the intent to steal information or record behavior, it will not try to make its presence obvious. A ‘rootkit’ may be very hard to detect even when a rigorous investigation is made.
Rootkits can enter computers when users open spam emails and inadvertently download malicious software. Rootkits also use keyloggers that capture user login information. Once installed, a rootkit can give hackers access to sensitive user information and take control of computer OSes.
Why might you need to use a virus encyclopedia?
To verify symptoms of infection.
Also, if a virus cannot be removed automatically, you might want to find a manual removal method. You might also want to identify the consequences of infection whether the virus might have stolen passwords, and so on.
Early in the day, a user called the help desk saying that his computer is running slowly and freezing up. Shortly after this user called, other help desk technicians who overheard your call also received calls from users who report similar symptoms. Is this likely to be a malware infection?
It is certainly possible.
Software updates are often applied when a computer is started in the morning, so that is another potential cause, but you should investigate and log a warning so that all support staff are alerted. It is very difficult to categorize malware when the only symptom is performance issues. However, performance issues could be a result of a badly written Trojan, or a Trojan / backdoor application might be using resources maliciously (for DDoS, Bitcoin mining, spam, and so on).
You receive a support call from a user who is ‘stuck’ on a web page. She is trying to use the Back button to return to her search results, but the page just displays again with a pop-up message. Is her computer infected with malware?
If it only occurs on certain sites, it is probably part of the site design. A script running on the site can prevent use of the Back button. It could also be a sign of ‘adware’ or ‘spyware’ though, so it would be safest to scan the computer using ‘up-to-date anti-malware’ software.
Another user calls to say he is trying to sign-on to his online banking service, but the browser reports that the certificate is invalid. Should the bank update its certificate, or do you suspect another cause?
It would be highly unlikely for a commercial bank to allow its website certificates to run out of date or otherwise be misconfigured. You should strongly suspect redirection by malware or a ‘phishing / pharming’
scam.
Why is DNS configuration a step in the ‘malware remediation’ process?
Compromising ‘domain-name’ resolution is a very effective means of redirecting users to malicious websites. Following malware infection, it is important to ensure that DNS is being performed by valid servers.
A security manager wants to set up a program where they can proactively mitigate malware infection as much as possible. Which of the following is least helpful in this endeavor?
A. User training
B. Scheduled scans
C. Update trusted root certificates
D. On-access scanning
C. Update trusted root certificates
Updating trusted root certificates is helpful in the overall defense-in-depth security strategy, but is least helpful in this scenario in preventing malware. It does play its part though.
An essential malware prevention follow-up action is effective user training. Untrained users represent a serious vulnerability because they are susceptible to social engineering and phishing attacks.
All security software supports scheduled scans. These scans can impact performance, however, so it is best to run them when the computer is otherwise unused.
Almost all security software is now configured to scan on-access. On-access means that the antivirus (A-V) software intercepts an operating system (OS) call to open a file and scans the file before allowing or preventing it from being opened.
