Practice Exam 1 (81 - 125)

Question 1

What kind of attack is an example of IP spoofing?

A. SQL injections

B. Man-in-the-middle

C. Cross-site scripting

D. ARP poisoning

Answer 1

B. Man-in-the-middle

Explanation
OBJ-4.1: The man-in-the-middle attack intercepts communications between two systems. For example, in an HTTP transaction, the target is the TCP connection between client and server. Using different techniques, the attacker splits the original TCP connection into 2 new connections, one between the client and the attacker and the other between the attacker and the server. This often uses IP spoofing to trick a victim into connecting to the attack. SQL injection is a code injection technique used to attack data-driven applications. Malicious SQL statements are inserted into an entry field for execution, such as dumping the database contents to the attacker. A man-in-the-middle attack (MITM) is an attack where the attacker secretly relays and possibly alters the communications between two parties who believe that they are directly communicating with each other. ARP Poisoning, also known as ARP Spoofing, is a type of cyber attack carried out over a Local Area Network (LAN) that involves sending malicious ARP packets to a default gateway on a LAN to change the pairings in its IP to MAC address table. Cross-Site Scripting (XSS) attacks are a type of injection in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in a browser side script, to a different end-user.

Question 2

You are trying to select the best device to install to detect an outside attacker trying to reach into your internal network. The device should log the event, but it should not take any action to stop it. Which of the following devices would be the BEST for you to select?

A. Proxy server

B. Authentication server

C. IPS

D. IDS

Answer 2

D. IDS

Explanation
OBJ-4.5: An intrusion detection system is a device or software application that monitors a network or system for malicious activity or policy violations. Any malicious activity or violation is typically reported to an administrator or collected centrally using a security information and event management system. Unlike an IPS, which can stop malicious activity or policy violations, an IDS can only log these issues and not stop them.

Question 3

A new piece of malware attempts to exfiltrate user data by hiding the traffic and sending it over a TLS-encrypted outbound traffic over random ports. What technology would be able to detect and block this type of traffic?

A. Intrusion detection system

B. Application-aware firewall

C. Stateful packet inspection

D. Stateless packet inspection

Answer 3

B. Application-aware firewall

Explanation
OBJ-4.5: A Web Application Firewall (WAF) or Application-Aware Firewall would detect both the accessing of random ports and TLS encryption and identify it as suspicious, whereas Stateless would inspect port number used by the traffic leaving. IDS only analyzes incoming traffic. Therefore it would not be able to see this activity as suspicious.

Question 4

You have just received an email that claims to be from the Federal Bureau of Investigation (FBI). The email claims that your computer was identified as part of a botnet being used to distribute pirated copies of a new movie. The email states that you must click the link below and pay a fine of $1000 within 24 hours, or federal agents will be sent to your home to arrest you for copyright infringement. What social engineering principle is this email relying on using?

A. Intimidation

B. Consensus

C. Familiarity

D. Trust

Answer 4

A. Intimidation

Explanation
OBJ-4.2: Intimidation is a commonly used technique during a social engineering campaign. It relies on trying to scare or frighten a person into clicking a link. Often, these emails will claim to be from the FBI, IRS, or other government agencies.

Question 5

Your company’s Security Operations Center (SOC) is currently detecting an ongoing DDoS attack against your network’s file server. A cybersecurity analyst has identified forty internal workstations on the network conducting the attack against your network’s file server. The cybersecurity analyst believes these internal workstations are infected with malware and places them into a quarantined network area. The analyst then submits a service desk ticket to have the workstations scanned and cleaned of the infection. What type of malware was the workstation likely a victim of based on the scenario provided?

A. Spyware

B. Botnet

C. Rootkit

D. Ransomware

Answer 5

B. Botnet

Explanation
OBJ-4.3: A botnet is many internet-connected devices, each of which is running one or more bots. Botnets can be used to perform distributed denial-of-service (DDoS) attacks, steal data, send spam, and allow the attacker to access the device and its connection. A zombie (also known as a bot) is a computer or workstation that a remote attacker has accessed and set up to forward transmissions (including spam and viruses) to other computers on the internet.

Question 6

You are trying to select the best device to install to proactively stop outside attackers from reaching your internal network. Which of the following devices would be the BEST for you to select?

A. IDS

B. IPS

C. Proxy server

D. Syslog server

Answer 6

B. IPS

Explanation
OBJ-4.5: An intrusion prevention system (IPS) is a form of network security that detects and prevents identified threats. Intrusion prevention systems continuously monitor your network, looking for possible malicious incidents, and capturing information about them. An IPS can block malicious network traffic, unlike an IDS, which can only log them.

Question 7

Your organization has been receiving many phishing emails recently, and you are trying to determine why they are effective in getting your users to click on their links. The latest email consists of what looks like an advertisement that is offering an exclusive early access opportunity to buy a new iPhone at a discounted price. Still, there are only 5 phones available at this price. What type of social engineering principle is being exploited here?

A. Familiarity

B. Scarcity

C. Intimidation

D. Trust

Answer 7

B. Scarcity

Explanation
OBJ-4.2: Scarcity is used to create a fear in a person of missing out on a special deal or offer. This technique is used in advertising all the time, such as “supplies are limited,” “only available for the next 4 hours”, and other such artificial limitations being used.

Question 8

Which of the following tools provides a penetration tester with a framework to conduct technical social engineering attacks like phishing against an organization’s employees?

A. Kismet

B. SET

C. Proxychains

D. Censys

Answer 8

B. SET

Explanation
OBJ-4.2: SET (Social Engineer Toolkit) is an open-source penetration testing framework included with Kali Linux that supports the use of social engineering to penetrate a network or system. Kismet is an 802.11 Layer 2 wireless network detector, sniffer, and intrusion detection system included with Kali Linux. Proxychains is a command-line tool that enables pen testers to mask their identity and/or source IP address by sending messages through intermediary or proxy servers. Censys is a search engine that returns information about the types of devices connected to the Internet.

Question 9

Your company was recently the victim of a cross-site scripting attack. The system administrators claim this wasn’t possible since they performed input validation using REGEX to alert on any strings that contain the term “[Ss]cript” in them. Which of the following statements concerning this attack is true?

A. An SQL injection must have occurred since their input validation would have prevented < SCRIPT> or < script> from being used

B. The server has insufficient logging and monitoring configured

C. The REGEX expression to filter using “[Ss]cript” is insufficient. As an attacker could use SCRIPT or SCRipt or %53CrIPT to evaded it

D. The attacker has modified the logs to cover their tracks and prevent a successful investigation

Answer 9

C. The REGEX expression to filter using “[Ss]cript” is insufficient. As an attacker could use SCRIPT or SCRipt or %53CrIPT to evaded it

Explanation
OBJ-4.5: The most likely explanation is that the REGEX filter was insufficient to eliminate every single possible cross-site scripting attack that could occur. Since cross-site scripting relies on the < script> and < /script> HTML tags to launch, the system administrators had a good idea of creating input validation using a REGEX for those keywords. Unfortunately, they forgot to include a more inclusive version of this REGEX to catch all variants. For example, simply using [Ss][Cc][Rr][Ii][Pp][Tt] would have been much more secure, but even this would miss %53CrIPT would evade this filter. To catch all the letter S variants, you would need to use [%53%%73Ss], which includes the capital S in hex code, the lower case s in hex code, the capital S, and the lowercase s. While it is possible that an attacker used an SQL injection instead, their REGEX input validation would still have allowed a cross-site scripting attack to occurs, so this option must be eliminated. As for the logging options, both are possible in the real world, but they do not adequately answer this scenario. The obvious flaw in their input validation is their REGEX filter.

Question 10

You have been contracted by Dion Training to conduct a penetration test against its learning management system (LMS). The LMS is a web application that is hosted in the organization’s DMZ. Which of the following appliances should the organization whitelist your source IP in before the engagement begins?

A. WAF

B. HIDS

C. NIDS

D. DLP

Answer 10

A. WAF

Explanation
OBJ-4.5: Whitelisting allows the IP address to be excluded from ACL rules and other signatures. This prevents an active device, like a web application firewall (WAF), layer 4 firewall, or an intrusion protection system (IPS) from blocking the penetration tester during the assessment. By having your IP added to the whitelist, you can focus your time and efforts on finding vulnerabilities with the servers themselves instead of trying to break through a compensating control like a WAF or IPS.

Question 11

What type of wireless security measure can easily be defeated by a hacker by spoofing their network interface card’s hardware address?

A. MAC filtering

B. WEP

C. Disable SSID broadcast

D. WPS

Answer 11

A. MAC filtering

Explanation
OBJ-4.1: Wireless access points can utilize MAC filtering to ensure only known network interface cards are allowed to connect to the network. If the hacker changes their MAC address to a trusted MAC address, they can easily bypass this security mechanism. MAC filtering is considered a good security practice as part of a larger defense-in-depth strategy, but it won’t stop a skilled hacker for long. MAC addresses are permanently burned into the network interface card by the manufacturer and serve as the device’s physical address. WEP is the Wired Equivalent Privacy encryption standard, which is considered obsolete in modern wireless networks. WEP can be broken using a brute force attack within just a few minutes by an attacker. Another security technique is to disable the SSID broadcast of an access point. While this prevents the SSID broadcast, a skilled attacker can still find the SSID using discovery scanning techniques. WPS is the WiFi Protected Setup. WPS is used to connect and configure wireless devices to an access point easily.

Question 12

A cybersecurity analyst is reviewing the logs of a Citrix NetScaler Gateway running on a FreeBSD 8.4 server and saw the following output:

• =-=-=-=–=-=-=-=–=-=-=-=–=-=-=-=–=-=-=-=–=-=-=-=–=-=-=-=-
  10. 1.1.1 - - [10/Jan/2020:13:23:51 +0000] “POST /vpn/../vpns/portal/scripts/newbm.pl HTTP/1.1” 200 143 “https://10.1.1.2/” “USERAGENT “

10.1.1.1 - - [10/Jan/2020:13:23:53 +0000] “GET /vpn/../vpns/portal/backdoor.xml HTTP/1.1” 200 941 “-“ “USERAGENT”

10. 1.1.1 - - [10/Jan/2020:16:12:31 +0000] “POST /vpns/portal/scripts/newbm.pl HTTP/1.1” 200 143 “https://10.1.1.2/” “USERAGENT”
    - =-=-=-=–=-=-=-=–=-=-=-=–=-=-=-=–=-=-=-=–=-=-=-=–=-=-=-=-

What type of attack was most likely being attempted by the attacker?

A. SQL injection

B. Directory traversal

C. XML injection

D. Password spraying

Answer 12

B. Directory traversal

Explanation
OBJ-5.2: A directory traversal attack aims to access files and directories stored outside the webroot folder. By manipulating variables or URLs that reference files with “dot-dot-slash (../)” sequences and its variations or using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code or configuration and critical system files. The example output provided comes from a remote code execution vulnerability being exploited in which a directory traversal is used to access the files. XML Injection is an attack technique used to manipulate or compromise an XML application or service’s logic. SQL injection is the placement of malicious code in SQL statements via web page input. Password spraying attempts to crack various user’s passwords by attempting a compromised password against multiple user accounts.

Question 13

A new alert has been distributed throughout the information security community regarding a critical Apache vulnerability. What action could you take to ONLY identify the known vulnerability?

A. Perform an unauthenticated vulnerability scan on all servers in the environment

B. Perform a scan for the specific vulnerability on all web servers

C. Perform a web vulnerability scan on all servers in the environment

D. Perform an authenticated scan on all web servers in the environment

Answer 13

B. Perform a scan for the specific vulnerability on all web servers

Explanation
OBJ-5.1: Since you wish to check for only the known vulnerability, you should scan for that specific vulnerability on all web servers. All web servers are chosen because Apache is a web server application. While performing an authenticated scan of all web servers or performing a web vulnerability scan of all servers would also find these vulnerabilities, it is a much larger scope. It would waste time and processing power by conducting these scans instead of properly scoping the scans based on your needs. Performing unauthenticated vulnerability scans on all servers is also too large in scope (all servers) while also being less effective (unauthenticated scan).

Question 14

In 2014, Apple’s implementation of SSL had a severe vulnerability that, when exploited, allowed an attacker to gain a privileged network position that would allow them to capture or modify data in an SSL/TLS session. This was caused by poor programming in which a failed check of the connection would exit the function too early. Based on this description, what is this an example of?

A. Use of insecure functions

B. Insufficient logging and monitoring

C. Improper error handling

D. Insecure object reference

Answer 14

C. Improper error handling

Explanation
OBJ-5.2: This is an example of an improper error handling vulnerability. A well-written application must be able to handle errors and exceptions gracefully. The main goal must be for the application not to fail and allows the attacker to execute code or perform an injection attack. One famous example of an improper error handling vulnerability is Apple’s GoTo bug, as described above. For more details on this particular vulnerability, please see CVE-2014-1266. Insecure object reference refers to when a reference to an internal implementation object, such as a file or database key, is exposed to users without any other access control. Insufficient logging and monitoring allow attackers to achieve their goals without being detected due to the lack of monitoring and timely response by defenders. The use of insecure functions occurs in the C language when legacy functions like strcpy() are used. These insecure functions can lead to buffer overflow and other exploits being successful against a program.

Question 15

You are analyzing the logs of a web server and see the following entry:

• =-=-=-=-=–=-=-=-=-=–=-=-=-=-=-
  192. 168.1.25 – – [05/Aug/2020:15:16:42 -0400] “GET /%27%27;!–%22%3CDION%3E=&{()} HTTP/1.1″ 404 310 “-” “Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.12)Gecko/2009070812 Ubuntu/19.04 (disco dingo) Firefox/3.0.12″
• =-=-=-=-=–=-=-=-=-=–=-=-=-=-=-

Based on this entry, which of the following attacks was attempted?

A. XML injection

B. Buffer overflow

C. XSS

D. SQL injection

Answer 15

C. XSS

Explanation
OBJ-5.2: This is an example of an XSS attack as recorded by a web server’s log. In this example, the XSS attack was obfuscated by the attacker using HTML encoding. The encoding of %27%27 translates to two single quote marks (‘ ‘). While you don’t need to be able to decode the exact string used in the logs, when you see HTML encoding on the exam, it is usually going to be an XSS attack unless you see SQL or XML statements in the string, which in this case there are neither of those. Cross-site scripting (XSS) attacks use a specially crafted URL that includes attack code that will cause user information entered into their web browser to be sent to the attacker. An attacker finds a web server vulnerable to XSS and sends a legitimate-looking URL with XSS attack code appended to the end of the URL through a phishing email or other message to trick the user into clicking the link. A buffer overflow attempts to write data to a buffer that overruns the buffer’s boundary and writes data into the adjacent memory locations, which is not occurring in this example.

Question 16

Fail to Pass Systems recently installed a break and inspect appliance that allows their cybersecurity analysts to observe HTTPS traffic entering and leaving their network. Consider the following output from a recorded session captured by the appliance:

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
POST /www/default.php HTTP/1.1
HOST: < external IP address>.123
Content-Length: 147
Cache-Control: no-cache
Origin: chrome-extension://ghwjhwrequsds
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:24.0) Gecko/20100101 Firefox/24.0
Content-Type: multipart/form-data; boundary=—-
WebKitFormBoundaryaym16ehT29q60rUx
Accept:/
Accept-Language: zh, en-us; q=0.8, en; q=0.6
Cookie: security=low; PHPSESSID=jk3j2kdso8x73kdjhehakske

——WebKitFormBoundaryaym16ehT29q60rUx
Content-Disposition: form-data; name=”q”

cat /etc/passwd

• —–WebKitFormBoundaryaym16ehT29q60rUx
• =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Which of the following statements is true?

A. The /etc/passwd file was just downloaded through a webshell by an attacker

B. This is a normal request from a host to your web server in the DMZ

C. A request to issue the command “cat /etc/passwd” occurred but additional analysis is required to verify if the file was downloaded

D. The web browser used in the attack was Microsoft Edge

Answer 16

C. A request to issue the command “cat /etc/passwd” occurred but additional analysis is required to verify if the file was downloaded

Explanation
OBJ-5.2: This is a post request to run the “cat /etc/passwd” command from an outside source. It is not known from the evidence provided if this command were successful or not, but it should be analyzed further as this is not what would be expected, normal traffic. While the browser’s default language was configured for Chinese (zh), this is easily changed and cannot be used to draw authoritative conclusions about the threat actor’s true location or persona. The User-Agent used is listed as Mozilla, which is used by both Firefox and Google Chrome. For an in-depth analysis of the full attack this code snippet was taken from, please visit https://www.rsa.com/content/dam/en/solution-brief/asoc-threat-solution-series-webshells.pdf. This 6-page article is definitely worth your time to look over and learn how a remote access web shell is used as an exploit.

Question 17

You have just conducted an automated vulnerability scan against a static webpage without any user input fields. You have been asked to adjudicate the scanner’s findings in the automated report. Which of the following is MOST likely to be a false positive?

A. Reflected XSS

B. Insecure HTTP methods allowed

C. Command injection allowed

D. Directory listing enabled

Answer 17

C. Command injection allowed

Explanation
OBJ-5.1: A command injection is unlikely since this is a static webpage and does not accept any user input. A command injection allows the user to supply malicious input to the web server and then passes that data to a system shell for execution. In this sense, command injection does create new instances of execution and can, therefore, leverage languages that the web app does not directly support.

Question 18

You are performing a web application security test, notice that the site is dynamic, and must be using a back-end database. You decide you want to determine if the site is susceptible to a SQL injection. What is the first character that you should attempt to use in breaking a valid SQL request?

A. Semicolon

B. Single quote

C. Exclamation mark

D. Double quote

Answer 18

B. Single quote

Explanation
OBJ-5.3: The single quote character (‘) is the character limiter in SQL. With a single quote,’ you delimit strings, and therefore you can test whether the programmer has properly escaped the strings in the targeted application. If not escaped directly, you can end any string supplied to the application and add other SQL code after it. This is a common technique for SQL injections. A semicolon is a commonly used character at the end of a line of code or command in many programming languages. An exclamation mark comments a line of code in several languages. Double quotes contain a string that is passed to a variable.

Question 19

A cybersecurity analyst is reviewing the logs of a proxy server and saw the following URLs:

• =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
  https: //test.diontraining.com/profile.php?userid=1546
  https: //test.diontraining.com/profile.php?userid=5482
  https: //test.diontraining.com/profile.php?userid=3618
• =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

What type of vulnerability does this website have?

A. Race condition

B. Insecure direct object reference

C. Improper error handling

D. Weak or default configurations

Answer 19

B. Insecure direct object reference

Explanation
OBJ-5.2: Insecure direct object references (IDOR) are a cybersecurity issue that occurs when a web application developer uses an identifier for direct access to an internal implementation object but provides no additional access control and/or authorization checks. An attacker could change the userid number and directly access any user’s profile page in this scenario. A race condition is a software vulnerability when the resulting outcome from execution processes is directly dependent on the order and timing of certain events. Those events fail to execute in the order and timing intended by the developer. Weak or default configurations are commonly a result of incomplete or ad-hoc configurations, open cloud storage, misconfigured HTTP headers, unnecessary HTTP methods, permissive Cross-Origin resource sharing (CORS), and verbose error messages containing sensitive information. Improper handling of errors can reveal implementation details that should never be revealed, such as detailed information that can provide hackers important clues on the system’s potential flaws.

Question 20

Yoyodyne Systems has recently bought out its competitor, Whamiedyne Systems, which went out of business due to a series of data breaches. As a cybersecurity analyst for Yoyodyne, you are assessing Whamiedyne’s existing applications and infrastructure. During your analysis, you discover the following URL is used to access an application:

• =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
  https: //www.whamiedyne.com/app/accountInfo?acct=12345
• =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

You change the URL to end with 12346 and notice that a different user’s account information is displayed. Which of the following type of vulnerabilities or threats have you discovered?

A. Insecure direct object reference

B. XML injection

C. Race condition

D. SQL injection

Answer 20

A. Insecure direct object reference

Explanation
OBJ-5.2: This is an example of an insecure direct object reference. Direct object references are typically insecure when they do not verify whether a user is authorized to access a specific object. Therefore, it is important to implement access control techniques in applications that work with private information or other sensitive data types. Based on the URL above, you cannot determine if the application is vulnerable to an XML or SQL injection attack. An attacker can modify one or more of these four basic functions in a SQL injection attack by adding code to some input within the web app, causing it to execute the attacker’s own set of queries using SQL. An XML injection is similar but focuses on XML code instead of SQL queries. A race condition is a software vulnerability when the resulting outcome from execution processes is directly dependent on the order and timing of certain events. Those events fail to execute in the developer’s order and timing, which is not the case in this scenario.

Question 21

Which technique is used with the ProxyChains command to allow a penetration tester to pivot to a new subnet?

A. Port forwarding

B. VPN pivoting

C. SSH pivoting

D. Modifying routing tables

Answer 21

D. Modifying routing tables

Explanation
OBJ-5.2: ProxyChains is a tool that allows a penetration tester to pivot to a new subnet, but it must be combined with the modification of the penetration tester’s routing tables on their machine. For example, assume that the exploited client machine is located in the 192.168.5.0/24 subnet, but you need to access a server in the 10.0.0.0/24 subnet. You would then need to “route add 10.0.0.0 255.255.255.0 1” (1 is the ID of your Meterpreter session). Then, you can run “proxychains < command>” to target the new subnet. For example, “proxychains nmap -sT -Pn -p21,23,25,80,443 10.0.0.5” would perform an nmap scan of the targeted server in the new subnet by chaining the connections together using a proxy on the localhost.

Question 22

A recently hired security employee at a bank was asked to perform daily scans of the bank’s intranet to look for unauthorized devices. The new employee decides to create a script that scans the network for unauthorized devices every morning at 2:00 am. Which programming language would work best to create this script?

A. PHP

B. C#

C. Python

D. ASP.NET

Answer 22

C. Python

Explanation
OBJ-5.1: Python is a commonly used scripting language used in cybersecurity. PHP is used as a scripting language for web applications. C# and ASP.NET are both compiled languages, not scripting languages.

Question 22

Which mobile device strategy is most likely to introduce vulnerable devices to a corporate network?

A. COPE

B. CYOD

C. BYOD

D. MDM

Answer 22

C. BYOD

Explanation
OBJ-7.1: The BYOD (bring your own device) strategy opens a network to many vulnerabilities. People can bring their personal devices to the corporate network, and their devices may contain vulnerabilities that could be allowed to roam free on a corporate network. COPE (company-owned/personally enabled) means that the company provides the users with a smartphone primarily for work use, but basic functions such as voice calls, messaging, and personal applications are allowed, with some controls on usage and flexibility. With CYOD, the user can choose which device they wish to use from a small selection of devices approved by the company. The company then buys, procures, and secures the device for the user. The MDM is a mobile device management system that gives centralized control over COPE company-owned personally enabled devices.

Question 23

What remediation strategies are the MOST effective in reducing the risk to an embedded ICS from a network-based compromise? (Select TWO)

A. Patching

B. NIDS

C. Disabling unused services

D. Segmentation

Answer 23

C. Disabling unused services
D. Segmentation

Explanation
OBJ-7.2: Segmentation is the best method to reduce the risk to an embedded ICS system from a network-based compromise. Additionally, you could disable unused services to reduce the footprint of the embedded ICS. Many of these embedded ICS systems have a large number of default services running. So, by disabling the unused services, we can better secure these devices. By segmenting the devices off the main portion of the network, we can also better protect them. A NIDS might detect an attack or compromise, but it would not reduce the risk of the attack succeeding since it can only detect it. Patching is difficult for embedded ICS devices since they usually rely on customized software applications that rarely provide updates.

Question 24

Your company recently suffered a small data breach caused by an employee emailing themselves a copy of the current customer’s names, account numbers, and credit card limits. You are determined that something like this shall never happen again. Which of the following logical security concepts should you implement to prevent a trusted insider from stealing your corporate data?

A. Firewall

B. MDM

C. DLP

D. Strong passwords

Answer 24

C. DLP

Explanation
OBJ-7.1: Data loss prevention software detects potential data breaches/data ex-filtration transmissions and prevents them by monitoring, detecting, and blocking sensitive data while in use (endpoint actions), in-motion (network traffic), and at rest (data storage). Since the user was an authorized user (employee), changing your password policy, reconfiguring the firewall, or setting up an MDM solution would not solve this problem. Instead, a DLP solution must be implemented.

Question 25

You are working as part of a DevSecOps team at Dion Training on a new practice exam Android application. You need to conduct static analysis on the APK (Android PacKage) as part of your software assurance responsibilities. Which of the following tools should you utilize?

A. Convert the Java code in the APK to a JAR file and then cross-compile it to a DEX

B. Convert the DEX to a JAR file and then decompile the JAR into Java

C. Copile the APK into a JAR and then convert it into the DEX source code

D. Decompile the DEX to a JAR file and then convert the JAR into Java

Answer 25

B. Convert the DEX to a JAR file and then decompile the JAR into Java

Explanation
OBJ-7.1: Android apps come packaged as APKs (Android PacKages). The APK contains all the application files, including the DEX file (Android bytecode/binary). To reverse the APK into source code to conduct a static analysis, you can convert the DEX file to a JAR (Java Archive) file. Then, you can decompile the JAR file into Java source code using a decompiler. While the specifics on how to do all of this are beyond the exam’s scope, you should understand the concepts and basic steps involved per the exam objectives.

Question 26

You are attending a cybersecurity conference and just watched a security researcher demonstrating the exploitation of a web interface on a SCADA/ICS component. This caused the device to malfunction and be destroyed. You recognize that the same component is used throughout your company’s manufacturing plants. Which of the following mitigation strategies would provide you with the most immediate protection against this emergent threat?

A. Demand that the manufacturer of the component release a patch immediately and deploy the patch as soon as possible

B. Logically or physically isolate the SCADA/ICS component from the enterprise network

C. Evaluate if the web interface must remain open for the system to function; if it isn’t needed, block the web interface

D. Replace the affected SCADA/ICS components with more secure models from a different manufacturer

Answer 26

C. Evaluate if the web interface must remain open for the system to function; if it isn’t needed, block the web interface

Explanation
OBJ-7.2: The most immediate protection against this emergent threat would be to block the web interface from being accessible over the network. Before doing this, you must evaluate whether the interface needs to remain open for the system to function properly. If it is not needed, you should block it to minimize the SCADA/ICS component’s attack surface. Ideally, your SCADA/ICS components should already be logically or physically isolated from the enterprise network. Since the question doesn’t mention the networks as an area of concern, we can assume they are already following the industry best practice of logical or physical segmentation between the SCADA/ICS network and the enterprise network. On the exam, make sure you focus on the question being asked. In this case, the question focuses on the web interface. Developing a patch can be a time-consuming process, therefore waiting for the manufacturer to provide a patch will not provide immediate protection to your components. The same is true for replacing the affected components. Even if you could get the company to authorize the funding for such a purchase, it would take time to order, ship, receive, and install the new components. Additionally, you would cause unwanted downtime in the factory during the installation of the components, making it an ineffective option when simply blocking the web interface is free, quick, and effective.

Question 27

Tim, a help desk technician, receives a call from a frantic executive who states that their company-issued smartphone was stolen during their lunch meeting with a rival company’s executive. Tim quickly checks the MDM administration tool and identifies that the user’s smartphone is still communicating with the MDM, and displays its location on a map. What should Tim do next to ensure the stolen device’s data remains confidential and inaccessible to the thief?

A. Reset the device’s password

B. Perform a remote wipe of the device

C. Remotely encrypt the device

D. Identify the IP address of the smartphone

Answer 27

B. Perform a remote wipe of the device

Explanation
OBJ-7.1: To ensure the data remains confidential and is not accessed by the thief, Tim should perform a remote wipe of the device from the MDM. This will ensure any corporate data is erased before anyone accessing it. Additionally, Tim could reset the device’s password, but if the thief can guess or crack the password, they would have access to the data. Identifying the smartphone’s IP address is not a useful step in protecting the data on the device. Additionally, devices should be encrypted BEFORE they are lost or stolen, not after. Therefore, the option to remotely encrypt the device is provided as a wrong answer and a distractor.

Question 28

Which of the following is a special type of embedded operating system that uses a predictable and consistent scheduler?

A. Mobile

B. IoT

C. RTOS

D. PoS

Answer 28

C. RTOS

Explanation
OBJ-7.2: A real-time operating system (RTOS) is a special type of embedded OS. An RTOS ideal for embedded systems because they tend to have strict requirements for when a task should be completed and do not have particularly taxing workloads. An RTOS uses a predictable and consistent scheduler, unlike a general-purpose OS like Windows or macOS.

Question 29

You have determined that your client uses several networked devices that rely on an embedded operating system during your reconnaissance. Which of the following methods would MOST likely be the best method for exploiting these?

A. Use social engineering to trick a user into opening a malicious APK

B. Use web-based exploits against the devices web interfaces

C. Identify a jailbroken device for easy exploitation

D. Use a spearphishing campaign to trick a user into installing a RAT

Answer 29

B. Use web-based exploits against the devices web interfaces

Explanation
OBJ-7.2: Most embedded operating systems use a web interface to access their configurations for setup and installation. Focusing on this web interface and using common web-based exploits is usually one of the best methods of exploiting a device with an embedded OS.

Question 30

A company wants to ensure that its mobile devices are configured to protect any data stored on them if they are lost or stolen. Which of the following should you enable and enforce through their MDM?

A. Remove backups

B. Enable SSO

C. Full storage encryption

D. Enable OS updates

Answer 30

C. Full storage encryption

Explanation
OBJ-7.1: Since the company is concerned with protecting data on the devices, you should enforce full storage encryption on the devices. Even if the device is lost or stolen, the device’s data would be inaccessible to the person who stole or found the device. Additionally, the company may wish to enable the capability to conduct remote wipes of the device if they are lost or stolen to protect the data further.

Question 31

Which of the following vulnerabilities involves leveraging access from a single virtual machine to other machines on a hypervisor?

A. VM escape

B. VM migration

C. VM sprawl

D. VM data remnant

Answer 31

A. VM escape

Explanation
OBJ-8.1: Virtual machine escape vulnerabilities are the most severe issue that may exist in a virtualized environment. In this attack, the attacker can access a single virtual host and then leverages that access to intrude on the resources assigned to different virtual machines. Data remnant is the residual representation of digital data that remains even after attempts have been made to remove or erase it. Virtualization sprawl is a phenomenon that occurs when the number of virtual machines on a network reaches a point where the administrator can no longer manage them effectively. Virtual machine migration is the task of moving a virtual machine from one physical hardware environment to another.

Question 32

Dion Training wants to install a new accounting system and is considering moving to a cloud-based solution to reduce cost, reduce the information technology overhead costs, improve reliability, and improve availability. Your Chief Information Officer is supportive of this move since it will be more fiscally responsible. Still, the Chief Risk Officer is concerned with housing all of the company’s confidential financial data in a cloud provider’s network that might be shared with other companies. Since the Chief Information Officer is determined to move to the cloud, what type of cloud-based solution would you recommend to account for the Chief Risk Officer’s concerns?

A. PaaS in a community cloud

B. SaaS in a private cloud

C. PaaS in a hybrid cloud

D. SaaS in a public cloud

Answer 32

B. SaaS in a private cloud

Explanation
OBJ-8.1: A SaaS (Software as a Service) solution best describes an accounting system or software used as part of a cloud service. This meets the CIO’s requirements. To mitigate the concerns of the Chief Risk Officer, you should use a private cloud solution. This type of solution ensures that the cloud provider does not comingle your data with other customers’ data and providers dedicated servers and resources for your company’s use only.

Question 33

Which cloud computing concept is BEST described as focusing on the replacement of applications and programs on a customer’s workstation with cloud-based resources?

A. IaaS

B. PaaS

C. SaaS

D. DBaaS

Answer 33

C. SaaS

Explanation
OBJ-8.1: Software as a Service (SaaS) is used to provide web applications to end-users. This can be a calendar, scheduling, invoicing, word processor, database, or other programs. For example, Google Docs and Officer 365 are both word processing SaaS solutions.

Question 34

You work for a bank interested in moving some of its operations to the cloud, but it is worried about security. You recently discovered an organization called CloudBank that was formed by 15 local banks as a way for them to build a secure cloud-based environment that can be accessed by the 15 member banks. Which cloud model BEST describes the cloud created by CloudBank?

A. Private cloud

B. Public cloud

C. Hybrid cloud

D. Community cloud

Answer 34

D. Community cloud

Explanation
OBJ-8.1: Community Cloud is another type of cloud computing in which the cloud setup is shared manually among different organizations that belong to the same community or area. A multi-tenant setup is developed using cloud among different organizations belonging to a particular community or group with similar computing concerns. For joint business organizations, ventures, research organizations, and tenders, a community cloud is an appropriate solution. Based on the description of 15 member banks coming together to create the CloudBank organization and its cloud computing environment, a community cloud model is most likely described.

Question 35

Your company has decided to begin moving some of its data into the cloud. Currently, your company’s network consists of both on-premise storage and some cloud-based storage. Which of the following types of clouds is your company currently using?

A. Hybrid

B. Private

C. Public

D. Community

Answer 35

A. Hybrid

Explanation
OBJ-8.1: A hybrid cloud is a cloud computing environment that uses a mix of on-premises, private cloud, and third-party public cloud services with orchestration between these platforms.

Question 36

The Pass Certs Fast corporation has recently been embarrassed by several high profile data breaches. The CIO proposes improving the company’s cybersecurity posture by migrating images of all the current servers and infrastructure into a cloud-based environment. What, if any, is the flaw in moving forward with this approach?

A. This approach assumes that the cloud will provide better security than is currently done on-site

B. This approach only changes the location of the network and not the attack surface of it

C. The company has already paid for the physical servers and will not fully realize their ROI on them due to the migration

D. This is a reasonable approach that will increase the security of the servers and infrastructure

Answer 36

B. This approach only changes the location of the network and not the attack surface of it

Explanation
OBJ-8.1: A poorly implemented security model at a physical location will still be a poorly implemented security model in a virtual location. Unless the fundamental causes of the security issues that caused the previous data breaches have been understood, mitigated, and remediated, then migrating the current images into the cloud will change where the processing occurs without improving the network’s security. While the statement concerning unrealized ROI may be accurate, it simply demonstrates the sunk cost argument’s fallacy. These servers were already purchased, and the money was spent. Regardless of whether we maintain the physical servers or migrate to the cloud, that money is gone. Those servers could also be repurposed, reused, or possibly resold to recoup some of the capital invested. While the company’s physical security will potentially improve in some regards, the physical security of the endpoints on-premises is still a concern that cannot be solved by this cloud migration. Additionally, the scenario never stated that physical security was an issue that required being addressed, so it is more likely that the data breach occurred due to a data exfiltration over the network. As a cybersecurity analyst, you must consider the business case and the technical accuracy of a proposed approach or plan to add the most value to your organization.

Question 37

You want to provide controlled remote access to the remote administration interfaces of multiple servers hosted on a private cloud. What type of segmentation security solution is the best choice for this scenario?

A. Airgap

B. Jumpbox

C. Bastion hosts

D. Physical

Answer 37

B. Jumpbox

Explanation
OBJ-8.1: Installing a jumpbox as a single point of entry for the administration of servers within the cloud is the best choice for this requirement. The jumpbox only runs the necessary administrative port and protocol (typically SSH). Administrators connect to the jumpbox then use the jumpbox to connect to the admin interface on the application server. The application server’s admin interface has a single entry in its ACL (the jumpbox) and denies any other hosts’ connection attempts. A bastion host is a special-purpose computer on a network specifically designed and configured to withstand attacks. The computer generally hosts a single application. For example, a proxy server and all other services are removed or limited to reduce the threat to the computer. An airgap system is a network or single host computer with unique security requirements that may physically be separated from any other network. Physical separation would prevent a system from accessing the remote administration interface directly and require an airgap system to reach the private cloud.

Question 38

What technology is NOT PKI x.509 compliant and cannot be used in various secure functions?

A. AES

B. Blowfish

C. PKCS

D. SSL/TLS

Answer 38

B. Blowfish

Explanation
OBJ-9.1: AES, PKCS, and SSL/TLS are all compatible with x.509 and can be used in a wide variety of functions and purposes. AES is used for symmetric encryption. PKCS is used as a digital signature algorithm. SSL/TLS is used for secure key exchange.

Question 39

Which encryption type MOST likely is used for securing the key exchange during a client-to-server VPN connection?

A. TKIP

B. Kerberos

C. ISAKMP

D. AES

Answer 39

C. ISAKMP

Explanation
OBJ-9.1: ISAKMP is used in IPSec, which is commonly used in securing the key exchange during the establishment of a client-to-server VPN connection.

Question 40

A penetration tester wants to build a workstation that will be used to brute force hash digests. Which of the following is the BEST option to ensure sufficient power and speed to crack them?

A. Multi-core CPU

B. Dedicated GPU

C. 7200-RPM HDD

D. Integrated GPU

Answer 40

B. Dedicated GPU

Explanation
OBJ-9.1: Dedicated GPUs are designed to conduct complex mathematical functions extremely quickly. If you want to build a system to perform cracking of a password, hash, or encryption algorithm, it is important to have a high-speed, dedicated GPU. The reason to use a GPU instead of a CPU for password cracking is that it is much faster for this mathematically intensive type of work. Cracking passwords, hashes, and encryption is a lot like mining cryptocurrency in that using dedicated GPUs will give you the best performance.

Question 41

Which of the following hashing algorithms results in a 160-bit fixed output?

A. MD-5

B. RIPEMD

C. NTLM

D. SHA-2

Answer 41

B. RIPEMD

Explanation
OBJ-9.1: RIPEMD creates a 160-bit fixed output. SHA-2 creates a 256-bit fixed output. NTLM creates a 128-bit fixed output. MD-5 creates a 128-bit fixed output.

Question 42

Dion Training has just suffered a website defacement of its public-facing webserver. The CEO believes the company’s biggest competitor may have done this act of vandalism. The decision has been made to contact law enforcement so that evidence can be collected properly for use in a potential court case. Laura is a digital forensics investigator assigned to collect the evidence. She creates a bit-by-bit disk image of the web server’s hard drive as part of her evidence collection. What technology should Laura use after creating the disk image to verify the copy’s data integrity matches that of the original web server’s hard disk?

A. SHA-256

B. RSA

C. AES

D. 3DES

Answer 42

A. SHA-256

Explanation
OBJ-9.1: SHA-256 is the Secure Hash Algorithm with a 256-bit length output. This is one of the most common hash algorithms in use and is employed in many applications and protocols. SHA-256 and other hashing algorithms are used to ensure the data integrity of a file has not been altered. RSA, 3DES, and AES are all encryption algorithms. These algorithms can ensure confidentiality but not integrity.

Question 43

You just received an email from Bob, your investment banker, stating that he completed the wire transfer of $10,000 to your bank account in Vietnam. The problem is, you do not have a bank account in Vietnam, so you immediately call Bob to ask what happened. Bob explains that he received an email from you requesting the transfer. You insist you never sent that email to Bob initiating this wire transfer. What aspect of PKI could be used to BEST ensure that a sender actually sent a particular email message and avoid this type of situation?

A. CRL

B. Trust models

C. Recovery agents

D. Non-repudiation

Answer 43

D. Non-repudiation

Explanation
OBJ-9.1: Non-repudiation occurs when a sender cannot claim they didn’t send an email when they did. A digital signature should be attached to each email sent to achieve non-repudiation. This digital signature is comprised of a digital hash of the email’s contents, and then encrypting that digital hash using the sender’s private key. The receiver can then unencrypt the digital hash using the sender’s public key to verify the message’s integrity.

Question 44

Which of the following cryptographic algorithms is classified as symmetric?

A. AES

B. RSA

C. Diffie-Hellman

D. ECC

Answer 44

A. AES

Explanation
OBJ-9.1: The Advanced Encryption Standard (AES) is a symmetric-key algorithm for encrypting digital data. It was established as an electronic data encryption standard by NIST in 2001. AES can use a 128-bit, 192-bit, or 256-bit key, and uses a 128-bit block size.