Mitigating Security Threats Flashcards
The web developers at your company are testing their latest web site code before going live to ensure that it is robust and secure. During their testing, they provide malformed URLs with additional abnormal parameters as well as an abundance of random data. What term describes their actions?
Cross-site scripting
Fuzzing
Patching
Fuzzing
Fuzzing is a means of injecting data into an application that it does not expect in order to ensure that there are no weaknesses by using proper input validation
The process of disabling unneeded network services on a computer is referred to as what?
Patching
Fuzzing
Hardening
Hardening
Hardening includes actions such as disabling unneeded services to make a system more secure
You are on a conference call with your developers, Serena and Thomas, discussing the security of your new travel site. You express concern over a recent article describing how user submissions to web sites may contain malicious code that runs locally when others simply read the post. Serena suggests validating user input before allowing the user submissions. Which problem might validation solve?
Cross-site scripting
Fuzzing
Hardening
Cross-site scripting
Cross-site scripting attacks take advantage of dynamically generated web pages on sites that allow unvalidated user input. User submissions can be validated to ensure that malicious scripts do not exist on the site
Which of the following lessens the success of dictionary password attacks?
Password complexity requirements
Account lockout threshold
Password hints
Password complexity requirements
Complex password enforcement means dictionary words or username variations, to name just a few, cannot be used as passwords
A RADIUS server is used to authenticate your wireless network users. While creating a new user account, you notice there are many more user accounts than actual users. What should be done?
Disable all accounts not linked to a user.
Verify how accounts are used and then delete unnecessary accounts.
Verify how accounts are used and then disable unnecessary accounts.
Verify how accounts are used and then disable unnecessary accounts.
Disable only those accounts that are not required; the account may be needed later. Further investigation is needed to determine whether any accounts are used by network services and not users
The 802.11n wireless network in your department must be layer 2 secured. You would like to control which specific wireless devices are allowed to connect. How can you do this?
SIM card
NetBIOS computer name
MAC address
MAC address
The MAC address is an OSI layer 2 (Data Link layer) 48-bit unique hexadecimal address assigned to all network cards and is often used to restrict connecting wireless clients
What is the best definition of the IEEE 802.1x standard?
It defines the Ethernet standard.
It defines network access control only for wireless networks.
It defines network access control for wired and wireless networks.
It defines network access control for wired and wireless networks.
802.1x applies to wired and wireless networks. 802.1x connectivity devices forward authentication requests to an authentication server before allowing access to a network
You are hardening a Linux computer and have disabled SSH in favor of Telnet. You ensure that passwords are required for Telnet access. Identify your error.
Secure Telnet should have public key authentication enabled.
Only strong passwords should be used with Telnet.
SSH should have been used instead of Telnet.
SSH should have been used instead of Telnet.
Secure Shell (SSH) encrypts all packet payloads unlike Telnet and therefore should be used when hardening
As the IT director of a high school using Group Policy and Active Directory, you plan the appropriate standard security settings for newly deployed Windows 10 workstations. Some teachers require modifications to these settings because of the specialized software they use. Which term refers to the standardized security parameters?
Initial baseline configuration
Principle of least privilege
Sysprepped image
Initial baseline configuration
The initial baseline configuration implies blanket security settings that are the minimum standard
The periodic assessment of security policy compliance is referred to as what?
Remediation
Hardening
Continuous security monitoring
Continuous security monitoring
Continuous security monitoring ensures that security policies are adhered to and enforced
You are a Windows Server 2016 administrator. You install and configure the Network Policy Server (NPS) role and configure health policies that require all connecting clients to have firewall and spyware software enabled. Clients violating these health policies will receive an IP address placing them on a restricted subnet containing servers with client firewall and spyware software to install. What term accurately refers to the role the servers on this restricted subnet play?
Isolation
Remediation
Validation
Remediation
Remediation servers provide a method of correcting security deficiencies
IT security personnel respond to the repeated misuse of an authenticated user’s session cookie on an e-commerce web site. The affected user reports that he occasionally uses the site but not for the transactions in question. The security personnel decide to reduce the amount of time an authentication cookie is valid. What type of attack have they responded to?
Dictionary
Privilege escalation
Cross-site request forgery
Cross-site request forgery
Cross-site request forgeries involve the malicious use of a trusted party’s cookie against a web site
A network administrator places a network appliance on the DMZ network and configures it with various security thresholds, each of which will notify the IT group via e-mail. The IT group will then adhere to the incident response policy and take action. What will be triggered when any of these thresholds is violated?
Alarm
Alert
Remediation
Alarm
An alarm is a warning of danger that requires action (adherence to an incident response policy), such as a security threshold that might warn of excessive types of network traffic (which could imply a denial-of-service attack)
A user reports repeated instances of Windows 10 slowing down to the point where she can no longer be productive. You view the Windows Event Viewer logs for the past month and notice an exorbitant amount of SMTP traffic leaving the local machine each morning between 10 a.m. and 11 a.m. What type of analysis was performed to learn of this anomaly?
Forensic
Trend
Network statistical
Trend
A trend analysis seeks patterns within data sets, such as events happening around the same time each day
Roman is developing an application that controls the lighting system in a large industrial complex. A piece of code calls a function that controls a custom-built circuit board. While running his application, Roman’s application fails repeatedly because of unforeseen circumstances. Which secure coding guideline did Roman not adhere to?
Packet encryption
Digital signatures
Error handling
Error handling
Error handling is a secure coding guideline that requires developers to write code that will capture any unforeseen situations instead of allowing applications to fail
What can be done to harden the Windows operating system? (Choose three.)
Disable system restore points.
Disable unnecessary services.
Patch the operating system.
Configure EFS.
Disable Group Policy.
Disable unnecessary services.
Patch the operating system.
Configure EFS.
Hardening is defined as making hardware or software less vulnerable to security breaches. Disabling unnecessary services reduces the potential attack surface of an operating system. Patching applies solutions for known flaws and weaknesses. Encrypting File System (EFS) protects files and folders by encrypting them in such a way that parties without the decryption keys cannot decrypt the data
You are configuring a fleet of Windows laptops for traveling employees, some of whom prefer using USB mice. It is critical that the machines are as secure as possible. What should you configure? (Choose three.)
Disable USB ports.
Require USB device encryption.
Enable and configure the Windows firewall.
Install and configure antivirus software.
Enable a power management scheme.
Require USB device encryption.
Enable and configure the Windows firewall.
Install and configure antivirus software.
USB device encryption can be enforced, which disallows copying of data to USB drives unless the USB device is encrypted. This ensures copied data remains confidential even if the USB drive is lost. The Windows firewall is critical in controlling inbound and outbound network traffic. For example, when connected to public networks, the firewall might block all incoming traffic, but when connected to the Active Directory domain network, the firewall might allow inbound remote control. Antivirus software is always essential to protecting operating systems from the enormous amount of known malware
A shipment of new Windows computers has arrived for Accounting department employees. The computers have the operating system preinstalled but will require additional financial software. In which order should you perform all of the following?
Join the Active Directory domain.
Apply all operating system patches.
Ensure the virus scanner is up to date.
Log in to the Active Directory domain to receive Group Policy security settings.
Install the additional financial software.
Ensure the virus scanner is up to date.
Apply all operating system patches.
Join the Active Directory domain.
Log in to the Active Directory domain to receive Group Policy security settings.
Install the additional financial software.
The virus scanner must first be updated either manually or automatically to protect against malicious code while the system is updating. Applying operating system patches is the second thing to do to ensure that any software and security flaws are addressed. Next you would join the computer to the domain, but only after patching and ensuring that there are no viruses. Once the computer is joined to the domain, you would log in to ensure Group Policy security settings are applied. Finally, the financial software required by Accounting department employees should be installed and tested
Which of the following items can help prevent ARP cache poisoning? (Choose three.)
Use 802.1x security.
Disable ARP.
Patch the operating system.
Configure the use of digital signatures for all network traffic.
Disable unused switch ports.
Use 802.1x security.
Configure the use of digital signatures for all network traffic.
Disable unused switch ports.
ARP cache poisoning is a process by which a malicious device sends unsolicited broadcasts including its MAC address and another node’s IP address, thus redirecting traffic through itself instead of to that other node. This can happen only if network access is granted. Unused switch ports should be disabled to prevent unauthorized access to the network. 802.1x security requires device authentication before allowing network access. Unauthorized computers should not be able to authenticate to the network. ARP cache poisoning requires having network access to transmit forged ARP broadcast packets. Digital signatures assure the recipient of a transmission that the sender is valid. This can be done in many ways, such as by using Internet Protocol Security (IPSec), which can require that computers first authenticate to Active Directory before they can participate in secure transmissions
our intranet provides employees with the ability to search through an SQL database for their past travel expenses once they have logged in. One employee from the IT department discovers that if she enters an SQL string such as SELECT * FROM EXPENSES WHERE EMPID = ‘x’=’x’;, it returns all employee travel expense records. What secure coding guideline was ignored?
SQL injection prevention
Input validation
Disabling of SQL indexes
Input validation
Had the SQL query string been properly validated, returning all records would have been prevented
You capture and examine network traffic weekly to ensure that the network is being used properly. In doing so, you notice traffic to TCP port 53 on your server from an unknown IP address. After reviewing your server logs, you notice repeated failed attempts to execute a zone transfer to your server. What type of attack was attempted?
ARP poisoning
Cross-site scripting
DNS poisoning
DNS poisoning
Domain Name Service (DNS) poisoning means including incorrect name resolution data with the intent of secretly redirecting users to malicious hosts. TCP port 53 is used by DNS servers to synchronize DNS records and, in this case, to, and not from, your server
