Module 4: Endpoint & Application Development Security Q Flashcards
While going through the network log, Sarah, a network security administrator, noticed substantial outbound network traffic. Which activity did Sarah perform?
IOC
Indicator of compromise (IOC) shows suspected malicious activity occurring on the network
A company monitors the network activity of the organization and stores the logs in a database. You have been asked to identify whether there are any malicious activities in the network. Which of the following can denote the upper and lower bounds of their various network activities?
KRI
A key risk indicator (KRI) is a matrix, stored in the logs, of upper and lower bounds of specific activity occurring across the network. This is a metric used to measure the probability of an event or threat in the network
A company has its network compromised. As an expert professional, the organization has hired you to identify the probable cause of the attack and fix it. As a security professional, you have noticed the pattern of compromise is unlike anything previously seen. You are looking to find new information on vulnerabilities like the attack that occurred.
Which of the following actions would help achieve this objective?
Checking the dark web
Security professionals can identify the nature of attacks using the dark web by checking the information or software exchanges by cybercriminals
Which of the following can be used to mitigate a limitation of public sharing centers in OSINT?
AIS
Automated indicator sharing (AIS) can be used to exchange cybersecurity threats between computers through computer-to-computer communication. This mitigates the limitation on the speed of sharing information through public sharing centers in open source intelligence
Which HTTP response header should be used to prevent attackers from displaying their content on a website?
X-Frame-Option
The X-Frame-Option response header from the server tells the browser whether it should allow rendering a new page in a <frame>, <iframe>, <embed></embed>, or <object></object></frame>
An organization is planning a revamp of the existing computer hardware with new ones. The IT manager has informed department heads that some computers have faced BIOS attacks in the past. He has requested help in preventing future BIOS attacks.
As an expert, which of these solutions can you use to effectively improve boot security when the new computers are implemented in the network?
Implement measured boot with UEFI
A measured boot with UEFI provides the highest degree of security. The operating system sends the boot process log to the server every time the system starts to confirm the secure start process
What additional measure should be enacted to increase the security on a computer network after secure boot, protective measures from attacks like antimalware, and intrusion detection systems are implemented in all the computers on the network?
Implement hardening at endpoints with patch management and operating system safeguards
Patches are normally software codes that arrest identified vulnerabilities in the operating system codes. Updating the patches along with operating system safeguards hardens the protective cover for the network and computers
What is meant by “the chain of trust” in boot security?
Each step in the boot sequence relies on the confirmation from the previous boot sequence step
Confirmation from each sequence in secure booting confirms the entire boot sequence has been completed securely as a chain of trust passed from one sequence to the other
Which of the following is a disadvantage of the secure boot process?
It makes third party non-vendor-approved software difficult to implement
In a secure boot process, nonsystem vendor-approved hardware or software would not be initialized by the boot sequence, thereby affecting the implementation of such third-party software or custom hardware
Which of the following is part of the OS security configuration?
Disabling default passwords and unnecessary ports
Disabling default passwords and unnecessary ports are the primary steps for OS security configuration
John is a project manager with an IT firm, and his current project of developing an ERP application is in the development stage. Currently, the application is not yet mature or stable enough to be placed in a test environment. Which of the following secure coding review techniques is applicable for his project?
Perform static code analysis
The static code analysis should be performed before the source code compliance is done
Sheena wants to make sure that her browser activity is safe and prevent others from intercepting her data as it is transmitted over the browser. What should Sheena do to achieve this objective?
Only visit websites that are hosted over HTTPS or HSTS
HTTPS and HSTS force the website to encrypt data information, making it difficult to intercept and decrypt the data
Daniel accidentally installed a vulnerable application. Which of the following system exploitations would NOT be caused by the vulnerable application?
Social engineering and phishing attacks
Social engineering and phishing attacks are prominently performed by the attacker without accessing the victim’s system
ABC Technologies had its computer network compromised through a cybersecurity breach. A cybersecurity expert was employed to analyze and identify what caused the attack and the damage caused by the attack. He checked an available database for this purpose and found the threat actor behind the attack. He also found out the cybercriminal has been attempting to sell the company’s valuable data on the internet.
Which are the most probable methods used by the cybersecurity expert to get to this stage of the investigation?
The cybersecurity expert checked with CISCP and also investigated the dark web
CISCP can be used by the expert to check the TTP database to identify the threat actors behind the attack. Monitoring the dark web can give information on the sale of illegal data on the internet through the dark web by threat actors
A company has approached you for their product testing, and you agree to do it. First, you have to install the necessary plugins for the software through the browser, install the software, and run the software again.
What procedure should you adopt to ensure that you don’t compromise the browser and the computer’s operating system?
Making sure that the OS’s security options are deployed, run the antivirus/antispyware on the files downloaded, run the software on HSTS/HTTPS mode, and then send a secure cookie to the server
OS security is deployed, viruses checked, data transmission is encrypted, stored data of the cookie is safe from intercepting by a third person
