Pocket Prep 4 Flashcards
An organization needs an open source encryption system to enable the signing and encryption of email messages using keys the organization themselves manages. Which of the following meets their requirements?
A. GPG
B. SSH
C. SSL
D. DRM
A. GPG
Explanation:
GNU Privacy Guard is an open source encryption system closely related to Pretty Good Privacy
Both programs were developed to protect electronic communications and enable digital signing and encryption. It is considered more secure than PGP
A company wants to implement a solution to credentials management that has a low up front development cost. They decide they will use a system that is portable and can be used across systems controlled by different identities. What type of solution should they implement?
A. IAM
B. Federation
C. SSO
D. MFA
B. Federation
Explanation:
A federation identity system is used for users to access resources across multiple domains. Each member of the federation agrees to a common set of policies and standards
Of the following wireless security protocols, which uses the Advanced Encryption Standard to provide superior encryption?
A. WPA
B. WPA2
C. WEP
D. Personal WPA
B. WPA2
Explanation:
WPA2 is an improvement on WPA. WPA2 uses AES rather than TKIP
A company needs to determine the annualized loss expectancy of its web servers. What formula should they use to determine this?
A. ALE = EF x ARO
B. ALE = SLE x ARO
C. ALE = AV x EF
D. ALE = SLE x AV
B. ALE = SLE x ARO
Explanation:
The annualized loss expectancy is the risk factor of a threat to happen in one year. This is calculated by determining the Single Loss Expectancy (SLE) times the Annualized Rate of Occurrence
IPSec is a suite of protocols. Which of the following protocols provides data integrity and authentication but does not provide data confidentiality?
A. AH
B. ESP
C. ISAKMP
D. IKE
A. AH
Explanation:
Authentication Header (AH) provides data integrity and authentication
Encapsulating security payload (ESP) provides data confidentiality. Internet Security Association and Key Management Protocol (ISAKMP) handles the creation of security association for the session and exchange keys
Which protocol supports authentication and encryption and is often used for automation at water companies?
A. Zigbee
B. DNP3
C. Modbus
D. CIP
B. DNP3
Explanation:
The Distributed Network Protocol 3 is used by utilizies, such as electric and water companies. It is wrapped within TCP/IP packets to integrate with modern networking infrastructure
What denial of service attack involvers sending a packet with matching source and destination addresses and ports?
A. Land
B. Ping of death
C. SYN Flood
D. Smurf
A. Land
Explanation:
Land attacks send a packet with a source port and address that are the same as the destination
Smurf attacks are a type of DoS attack that involves the attacker sending an ICMP packet that uses the targets address as the source od a broad cast message
In a Cisco IOS environment, what are the two actions that can be taken for each subject in an ACL entry?
A. List and execute
B. Read and write
C. Permit and deny
D. Protocol and port
C. Permit and deny
Explanation:
The permit action will allow traffic to pass through the interface while the deny action will block traffic from it
When the algorithm breaks down the message into a fixed length units and then processes them with the algorithm formula resulting in ciphertext, this cipher is called what?
A. Elliptical cipher
B. Stream cipher
C. Hybrid cipher
D. Block cipher
D. Block cipher
Explanation:
Block ciphers break down messages into individual blocks and then perform the necessary computation on these blocks to provide the resulting ciphertext. Block ciphers have multiple advantages, such as easier implementation than stream ciphers
All of the following are events in the life cycle for certificates except:
A. Certificates are allowed to be renewed before expiration
B. Certificates are issued from a CA
C. Certificates are signed by the requesting entity
D. Certificates are revoked if necessary
C. Certificates are signed by the requesting entity
Explanation:
In Public Key Infrastructure, the certificates are signed by the CA not the requesting entity
The lifecycle includes the certs being issued by the CA, certificates being revoked if needed, and certificates being renewed or expired
A software development company wants to take a development approach that is incremental and iterative. They want to produce a prototype and do a risk analysis at each stage. What developmental approach should they take?
A. Agile
B. Waterfall
C. SecDevOps
D. Spiral
D. Spiral
Explanation:
The spiral model has each phase start with a design goal and end with a client review. It can be good for large projects but it is slower than other models
In data science and cyber, what is it called when a conclusion is extrapolated from a data set?
A. SOAR
B. Bootstrapping
C. CDN
D. Hypervision
B. Bootstrapping
Explanation:
In data science, bootstrapping refers to the process of extrapolating a conclusion based on a data set. This can be helpful in machine learning algorithms in tools like SOAR to better detect threats and patterns
Which of the following statements about asymmetric encryption is false?
A. It is slower than symmetric encryption
B. It provides authentication
C. It provides integrity
D. It requires smaller keys than symmetric encryption
D. It requires smaller keys than symmetric encryption
Explanation:
Asymmetric requires larger keys than symmetric encryption
While symmetric encryption provides confidentiality only, asymmetric encryption provides nonrepudiation, authentication, integrity and confidentiality
Which of the following is a standard that is satisfied when a company has taken the level of precaution required to demonstrate they have done what a reasonable and prudent organization would do?
A. Due process
B. Due diligence
C. Due care
D. CIA
C. Due care
Explanation:
The standard of due care referred to the tenet of ensuring an organization has taken at least the minimum steps required to maintain a reasonable level of security for a particular set of circumstances
Which of the following situations represents an attacker hacing supply chain access?
A. An attacker uses a prepackaged tool to exploit a vulnerable protocol the company runs
B. An attacker introduces malware into a third party software library a company uses
C. An attacker is a former disgruntled employee that leaves a malicious script on a server
D. An attacker steals proprietary company secrets to sell to a competing company
B. An attacker introduces malware into a third party software library a company uses
Explanation:
A supply chain attack is targeted at a companys input. This can include software libraries from a third party a company uses
