PE 1: Essential Knowledge Flashcards
A security team is implementing various security controls across the organization. After several configurations and applications, a final agreed-on set of security controls are put into place; however, not all risks are mitigated by the controls. Of the following, which is the next best step?
A. Continue applying controls until all risk is eliminated.
B. Ignore any remaining risk as “best effort controlled.”
C. Ensure that any remaining risk is residual or low and accept the risk.
D. Remove all controls.
C. Ensure that any remaining risk is residual or low and accept the risk.
A Certified Ethical Hacker (CEH) follows a specific methodology for testing a system. Which step comes after footprinting in the CEH methodology?
A. Scanning
B. Enumeration
C. Reconnaissance
D. Application attack
A. Scanning
Your organization is planning for the future and is identifying the systems and processes critical for their continued operation. Which of the following best describes this effort?
A. BCP
B. BIA
C. DRP
D. ALE
B. BIA
Which of the following describes security personnel who act in defense of the network during attack simulations?
A. Red team
B. Blue team
C. Black hats
D. White hats
B. Blue team
You’ve been hired as part of a pen test team. During the brief, you learn the client wants the pen test attack to simulate a normal user who finds ways to elevate privileges and create attacks. Which test type does the client want?
A. White box
B. Gray box
C. Black box
D. Hybrid
B. Gray box
Which of the following is defined as ensuring the enforcement of organizational security policy does not rely on voluntary user compliance by assigning sensitivity labels on information and comparing this to the level of security a user is operating at?
A. Mandatory access control
B. Authorized access control
C. Role-based access control
D. Discretionary access control
A. Mandatory access control
Which of the following statements is true regarding the TCP three-way handshake?
A. The recipient sets the initial sequence number in the second step.
B. The sender sets the initial sequence number in the third step.
C. When accepting the communications request, the recipient responds with an acknowledgement and a randomly generated sequence number in the second step.
D. When accepting the communications request, the recipient responds with an acknowledgement and a randomly generated sequence number in the third step.
C. When accepting the communications request, the recipient responds with an acknowledgement and a randomly generated sequence number in the second step.
Your network contains certain servers that typically fail once every five years. The total cost of one of these servers is $1000. Server technicians are paid $40 per hour, and a typical replacement requires two hours. Ten employees, earning an average of $20 per hour, rely on these servers, and even one of them going down puts the whole group in a wait state until it’s brought back up. Which of the following represents the ARO for a server?
A. $296
B. $1480
C. $1000
D. 0.20
D. 0.20
An ethical hacker is given no prior knowledge of the network and has a specific framework in which to work. The agreement specifies boundaries, nondisclosure agreements, and a completion date definition. Which of the following statements is true?
A. A white hat is attempting a black-box test.
B. A white hat is attempting a white-box test.
C. A black hat is attempting a black-box test.
D. A black hat is attempting a gray-box test.
A. A white hat is attempting a black-box test.
Which of the following is a detective control?
A. Audit trail
B. CONOPS
C. Procedure
D. Smartcard authentication
E. Process
A. Audit trail
As part of a pen test on a U.S. government system, you discover files containing Social Security numbers and other sensitive personally identifiable information (PII) information. You are asked about controls placed on the dissemination of this information. Which of the following acts should you check?
A. FISMA
B. Privacy Act
C. PATRIOT Act
D. Freedom of Information Act
B. Privacy Act
Four terms make up the Common Criteria process. Which of the following contains seven levels used to rate the target?
A. ToE
B. ST
C. PP
D. EAL
D. EAL
Organization leadership is concerned about social engineering and hires a company to provide training for all employees. How is the organization handling the risk associated with social engineering?
A. They are accepting the risk.
B. They are avoiding the risk.
C. They are mitigating the risk.
D. They are transferring the risk.
C. They are mitigating the risk.
In which phase of the ethical hacking methodology would a hacker be expected to discover available targets on a network?
A. Reconnaissance
B. Scanning and enumeration
C. Gaining access
D. Maintaining access
E. Covering tracks
B. Scanning and enumeration
Which of the following was created to protect shareholders and the general public from corporate accounting errors and fraudulent practices, and to improve the accuracy of corporate disclosures?
A. GLBA
B. HIPAA
C. SOX
D. FITARA
C. SOX
