Practice study 2 Flashcards
A security administrator has performed an audit of the organization’s production web servers, and the results have identified banner information leakage, web services that run from a privileged account, and inconsistencies with SSL certificates. Which of the following would be the BEST way to resolve these issues? ❍ A. Server hardening ❍ B. Multi-factor authentication ❍ C. Use HTTPS ❍ D. Run operating system updates
A. Server hardening
Many applications and services include secure configuration guides that can assist in hardening the system. These hardening steps will make the
system as secure as possible while simultaneously allowing the application to run efficiently.
SY0-501, Objective 1.4 - Penetration Testing
The incorrect answers:
B. Multi-factor authentication
Although multi-factor authentication is always a good best practice, simply
enabling multiple authentication methods would not resolve the issues
identified during the audit.
C. Use HTTPS
Most web servers will use HTTPS to ensure that network communication
is encryption. However, the encrypted network traffic would not correct
the issues identified during the audit.
D. Run operating system updates
Keeping the system up to date is another good best practice, but the
issues identified during the audit were not bugs related to the operating
systems. All of the issues identified in the audit appear to be related to the
configuration of the web server, so any resolution will focus on correcting
these configuration issues.
A shipping company stores information in small regional warehouses around the country. The company does not keep an IT person at each warehouse, and most configuration changes are completed remotely. The
company keeps an IPS online at each warehouse to watch for suspicious traffic patterns. Which of the following would BEST describe the security control used at the warehouse?
❍ A. Administrative
❍ B. Compensating
❍ C. Physical
❍ D. Detective
D. Detective
An IPS can detect and record any intrusion attempt.
The incorrect answers:
A. Administrative
Administrative controls would be guidelines that would control how people
act, such as security policies and standard operating procedures.
B. Compensating
A compensating control can’t prevent an attack, but it can compensate
when an attack occurs. For example, a compensating control would be the
re-imaging process or a server restored from backup if an attack had been
identified.
C. Physical
A physical control would block
SY0-501, Objective 5.7 - Security Controls
An internal sales application is updated each day with new pricing information, feature updates, and security patches. The system administrators have traditionally pushed these updates to the end-user workstations every Friday night, but the sales management teams would prefer daily updates. Which of the following would be the BEST way to keep this application updated every day?
❍ A. IT configures an overnight testing environment and performs automated patch management
❍ B. The development team pushes the updates to the end-user workstations when ready
❍ C. The sales teams manually update the application on-demand
❍ D. The development team sends the updates directly to the sales managers
A. IT configures an overnight testing environment and
performs automated patch management
To properly deploy any changes, the IT team will need to perform testing to ensure that the change does not cause problems with any other application or the underlying operating system. After the testing is complete, the
update can be pushed out to the end-user device.
The incorrect answers:
B. The development team pushes the updates to the end-user
workstations when ready
Although the development team is usually very confident in the stability
of their application, they aren’t responsible for testing other applications
or the underlying operating system. Pushing an untested update could
potentially disable other applications or the entire operating system.
C. The sales teams manually update the application on-demand
Putting the responsibility for updates on the sales teams circumvents any
testing and requires that the sales teams actively remember to perform the
update.
D. The development team sends the updates directly to the sales managers
Not only does this option skip the testing process, but it requires the sales
managers to become experts at application updates and requires the sales
management team to troubleshoot
SY0-501, Objective 3.3 - Operating System Security
A security engineer is preparing to conduct a penetration test. Part of the preparation involves reading through social media posts for information
about a third-party website. Which of the following describes this practice?
❍ A. Grey box testing
❍ B. Passive reconnaissance
❍ C. Exfiltration
❍ D. Active reconnaissance
B. Passive reconnaissance
Passive reconnaissance is the process of obtaining as much information as possible from open sources, such as social media sites, corporate websites, online forums, and other publicly available locations.
The incorrect answers:
A. Grey box testing
A grey box test describes how much information the attacker knows about
the test. With a grey box, the attacker may have access to some information
about the test, but not all information is disclosed.
C. Exfiltration
Exfiltration describes the theft of data by an attacker.
D. Active reconnaissance
Active reconnaissance would show some evidence of data gathering.
For example, performing a ping scan or DNS query wouldn’t exploit a
vulnerability, but it would show that someone was gathering information.
SY0-501, Objective 1.4 - Penetration Testing
A company’s IT security team has used a known exploit against an internal server. This exploit allowed the security team to gain access to the operating system without using any authentication. Which of the
following describes the actions of the security team?
❍ A. Active reconnaissance
❍ B. Vulnerability scan
❍ C. Zero-day attack
❍ D. Penetration test
D. Penetration test
A penetration test will attempt to exploit a vulnerability to gain access to data or a system.
The incorrect answers:
A. Active reconnaissance
Active reconnaissance will gather information about a system, but it will
stop short of exploiting a vulnerability.
B. Vulnerability scan
A vulnerability scan will identify any known vulnerabilities that may be
associated with a system. However, a vulnerability scan will not attempt to
exploit a vulnerability.
C. Zero-day attack
A zero-day attack is an attempt to exploit a system using a vulnerability
SY0-501, Objective 1.4 - Penetration Testing
An organization is using Shibboleth to implement SAML. Which of the
following would BEST describe this configuration?
❍ A. An internal help desk needs centralized logins to all switches and routers
❍ B. A user logging in once to the Windows Domain will not need to re-authenticate to other resources
❍ C. A university needs to provide login access to a research server with user accounts from many different schools
❍ D. The login credentials to a message board hash all passwords with a salt
C. A university needs to provide login access to a research
server with user accounts from many different schools
SAML (Security Assertion Markup Language) is an open standard for authentication and authorization. Shibboleth is open-source software that
implemenents SAML to provide federated authentication, which would fit the scenario where many different account types need to login to a shared resource.
The incorrect answers:
A. An internal help desk needs centralized logins to all switches
and routers
Internal authentication methods are usually centralized using RADIUS
(Remote Authentication Dial-In User Service), TACACS+ (Terminal
Access Controller Access-Control System Plus), or a similar authentication
framework. There would be no need for Shibboleth and SAML for internal
centralized authentication.
B. A user logging in once to the Windows Domain will not need to
re-authenticate to other resources
The Kerberos protocol provides the SSO (Single Sign On) functionality
used in Windows. Shibboleth and SAML are not associated with this SSO
process.
D. The login credentials to a message board hash all passwords with a salt
A good best practice is to store passwords as a salted hash. This
SY0-501, Objective 4.2 - Federated Identities
Which of the following would be MOST associated with the testing phase of the secure deployment process?
❍ A. Performance baselines are created
❍ B. Updated application code is installed on end user computers
❍ C. Code is written and executed in a sandbox
❍ D. QA techs will evaluate the functionality of the application
D. QA techs will evaluate the functionality of the application
The QA (Quality Assurance) process tests the usability and features of an application to ensure that it will work as designed on the end user systems.
The incorrect answers:
A. Performance baselines are created
The performance of an application is usually created during the staging
phase once the application code has been frozen.
B. Updated application code is installed on end user computers
Applications aren’t updated on the end user devices until the testing and
staging phases are complete.
C. Code is written and executed in a sandbox
The development teams write their software and test the functionality of
the code in their own self-contained sandbox environment.
SY0-501, Objective 3.4 - Secure Deployments
Which of the following allows an attacker to access a Bluetooth-enabled device and transfer contact lists, email, pictures, and other data without prior authorization? ❍ A. Bluejacking ❍ B. Spoofing ❍ C. Evil twin ❍ D. Bluesnarfing
D. Bluesnarfing
Bluesnarfing was one of the first major vulnerabilities associated with Bluetooth.
The incorrect answers:
A. Bluejacking
Bluejacking allowed a third-party to send unsolicited messages to another
device using Bluetooth.
B. Spoofing
Spoofing is when one device pretends to be another. The Bluesnarfing
vulnerability doesn’t require a device to be spoofing another.
C. Evil twin
An evil twin is a malicious device that is configured identically to a
legitimate device. These are often associated with wireless network attacks.
SY0-501, Objective 1.2 - Bluejacking and Bluesnarfing
A company is launching a new internal application that will not startup until a username and password is entered and a smart card is plugged into the computer. Which of the following BEST describes this process? ❍ A. Federation ❍ B. Accounting ❍ C. Authentication ❍ D. Authorization
C. Authentication
The process of proving who you say you are is authentication. In this example, the password and smart card are two factors of authentication, and both reasonably prove that the person logging in is authentic.
The incorrect answers:
A. Federation
Federation provides a way to authenticate and authorize between two
different organizations. In this example, the authentication process uses
internal information without any type of connection or trust to a
third-party.
B. Accounting
Accounting will document information regarding a user’s session, such as
login time, data sent and received, files transferred, and logout time.
D. Authorization
The authorization process assigns users to resources. This process
SY0-501, Objective 4.1 - AAA and Authentication
An online retailer is planning a penetration test as part of their PCI DSS validation. A third-party organization will be performing the test, and the online retailer has provided the Internet-facing IP addresses for their public web servers but no other details. What penetration testing methodology is the online retailer using? ❍ A. White box ❍ B. Passive reconnaissance ❍ C. Grey Box ❍ D. Ping scan
C. Grey Box
A grey box test is performed when the attacker knows some information about the victim, but not all information is available.
The incorrect answers:
A. White box
A white box test is performed when the attacker has complete details about
the victim’s systems and infrastructure.
B. Passive reconnaissance
Passive reconnaissance is the process of gathering information from
publicly available sites, such as social media or corporate websites.
D. Ping scan
A ping scan is a type of network scan that can identify devices
SY0-501, Objective 1.4 - Penetration Testing
A manufacturing company makes radar used by commercial and military organizations. A recently proposed policy change would allow the use of
mobile devices inside the facility. Which of the following would be the MOST significant security issue associated with this change in policy?
❍ A. Unauthorized software on rooted devices
❍ B. Remote access clients on the mobile devices
❍ C. Out of date mobile operating systems
❍ D. Photo and video use
D. Photo and video use
The exfiltration of company confidential information is relatively simple with an easily transportable camera or video recorder. Organizations associated with sensitive products or services must always be aware of the
potential for information leaks using photos or video.
The incorrect answers:
A. Unauthorized software on rooted devices
Although unauthorized software use can be a security issue, it isn’t as
significant as the exfiltration of company confidential information.
B. Remote access clients on the mobile devices
It’s sometimes convenient to have a remote access client available, and this
type of access can certainly be a concern if the proper security is not in
place. However, the much more significant security issue in this list would
be associated with the ease of photos and videography when working with
confidential information.
C. Out of date mobile operating systems
Having an outdated operating system can potentially include security
vulnerabilities, but these vulnerabilities
SY0-501, Objective 2.5 - Mobile Device Enforcement
A company is designing an application that will be used at their remote storefronts. It is expected that this application will have a high demand and will require significant computing resources during the summer. During the winter, there will be little to no application use and resource use should be minimal. Which of these characteristics BEST describe this application requirement? ❍ A. Availability ❍ B. Orchestration ❍ C. Imaging ❍ D. Elasticity
D. Elasticity
Elasticity is the process of providing resources when demand increases and scaling down when the demand is low.
The incorrect answers:
A. Availability
Availability describes the ability to use a service, but it doesn’t directly
describe the ability of the service resources to grow or shrink based on
demand.
B. Orchestration
The process of automating the configuration, maintenance, and operation
of an application instance is called orchestration. The description of the
application requirement didn’t mention the use of automation when
scaling resources.
C. Imaging
Imaging is a technique that allows a system administrator to build a
specific operating system and application configuration. This configuration
can then be saved as an “image” and easily deployed to other systems.
SY0-501, Objective 3.8 - Resiliency and Automation
Vala, a security analyst, has received an alert from her IPS regarding active exploit attempts from the Internet. Which of the following would provide
detailed information about these exploit attempts?
❍ A. Netstat command
❍ B. Nmap scan
❍ C. Vulnerability scan
❍ D. Protocol analyzer
D. Protocol analyzer
A protocol analyzer can provide information about every frame that traverses the network. From a security perspective, the protocol decode can show the exploitation process and details about the payloads used during the attempt.
The incorrect answers:
A. Netstat command
The netstat command can display connectivity information about a device,
but it won’t provide any additional details about an exploit attempt.
B. Nmap scan
An Nmap scan is a useful tool for understanding the potential exploitation
vectors of a device, but it won’t show information about an active
exploitation attempt.
C. Vulnerability scan
A vulnerability scan can help identify potential exploit vectors, but
SY0-501, Objective 2.2 - Software Security Tools
A user in the accounting department would like to send a spreadsheet to a list of third-party vendors. The size of the spreadsheet is too large to email, and the spreadsheet contains private information that must not be intercepted in-transit. Which of the following could be used to transfer this spreadsheet to the vendors? (Select TWO) ❍ A. IMAPS ❍ B. SRTP ❍ C. DNSSEC ❍ D. FTPS ❍ E. HTTPS ❍ F. SNMPv3
D. FTPS and E. HTTPS
FTPS (File Transfer Protocol Secure) and HTTPS (HyperText Transfer Protocol Secure) both provide mechanisms for transferring files using encrypted communication.
The incorrect answers:
A. IMAPS
IMAPS (Internet Message Access Protocol Secure) is a protocol exclusive
to email communication.
B. SRTP
SRTP (Secure Real-Time Transport Protocol) is used for secure voice over
IP and media communication across the network.
C. DNSSEC
DNSSEC (Domain Name System Secure Extensions) are used on DNS
servers to validate DNS responses using public key cryptography.
F. SNMPv3
SNMPv3 (Simple Network Management Protocol version 3) uses
encrypted communication to manage devices, but it is not used for secure
file transfers between devices.
SY0-501, Objective 2.6 - Secure Protocols
A system administrator would like to segment the network by department. The marketing, accounting, and manufacturing departments would have
their own private networks, and the network communication between departments would be restricted to provide security. Which of the
following should be configured on this network?
❍ A. VPN
❍ B. RBAC
❍ C. VLAN
❍ D. NAT
C. VLAN
A VLAN (Virtual Local Area Network) is a common method of logically segmenting a network. The devices in each segmented VLAN can only communicate with other devices in the same VLAN. A router is used to connect VLANs, and this router can often be used to control traffic flows between VLANs.
The incorrect answers:
A. VPN
A VPN (Virtual Private Network) is an encryption technology that can
be used to secure network connections between sites or remote enduser
communication. VPNs are not commonly used to segment internal
network communication.
B. RBAC
RBAC (Role-Based Access Control) describes a control mechanism for
managing rights and permissions in an operating system. RBAC is not used
for network segmentation.
D. NAT
NAT (Network Address Translation) is used to modify the source or
destination IP address or port number of a network traffic flow. NAT would
not be used when segmenting internal networks.
SY0-501, Objective 3.2 - Network Segmentation
A transportation company has installed a new application in their data center to assist with client reservations. The application works properly
in the test environment, but it doesn’t respond when moved to the production data center network. The security team does not find any rules in the data center firewall that would be specific to this application.
Which of the following is the MOST likely reason for this issue?
❍ A. The firewall is not configured with the correct application
encryption certificate
❍ B. The application is being blocked by an implicit deny rule
❍ C. The application service is not started
❍ D. A VPN configuration is required for the application traffic flows
B. The application is being blocked by an implicit deny rule
If network traffic does not match an explicit rule in the firewall rulebase, the traffic will be blocked. This implicit deny rule is the default for any non-matching traffic flows.
The incorrect answers:
A. The firewall is not configured with the correct application
encryption certificate
Encryption certificates for applications are configured on the application
server and not the firewall.
C. The application service is not started
A non-operational application service would certainly cause a
communications issue, but it would not be the most likely reason. The
question already identified a missing security rule that would prevent all
application traffic flows, and this would prevent all traffic regardless of the
application service’s status.
D. A VPN configuration is required for the application traffic flows
VPNs are not a common requirement for application use. Without a
specific firewall security rule, all application traffic would be blocked
regardless of the transportation method.
SY0-501, Objective 2.1 - Firewalls
A company has determined that a device on the manufacturing floor used to cut aluminum is not repairable and it’s estimated that it will operate
approximately ninety days before it must be replaced. Which of the following describes this estimate?
❍ A. MTTR (Mean Time to Repair)
❍ B. RPO (Recovery Point Objectives)
❍ C. RTO (Recovery Time Objectives)
❍ D. MTTF (Mean Time to Failure)
D. MTTF
The MTTF (Mean Time to Failure) is the expected lifetime of a nonrepairable product or system.
The incorrect answers:
A. MTTR
MTTR (Mean Time to Repair) is the time required to repair a product or
system after a failure. In this example, the device is not repairable.
B. RPO
RPO (Recovery Point Objectives) define how much data loss would be
acceptable during a recovery.
C. RTO
RTO (Recovery Time Objectives) define the minimum objectives required
to get up and running to a particular service level.
SY0-501, Objective 5.2 - Business Impact Analysis
Janet, a manager in the marketing department, is promoting the company by posting pictures from her mobile device to a popular social media
image sharing service. She has manually disabled the location services in the social media app, but she has asked the IT department to disable this functionality for all apps on the device. Which of the following should be disabled to meet this requirement?
❍ A. USB OTG
❍ B. WiFi Direct
❍ C. Geotagging
❍ D. Tethering
C. Geotagging
Geotagging adds location information to document metadata. With geotagging enabled, photos and videos can include longitude and latitude details as part of the shared file. Disabling geotagging will still allow the
sharing of the media, but the location information will not be saved when the image or video is created.
The incorrect answers:
A. USB OTG
USB OTG (USB On-The-Go) allows two mobile devices to be cabled
directly together for transferring information. USB OTG is not commonly
associated with location services.
B. WiFi Direct
WiFi Direct is another common method of connecting mobile devices
directly together over a wireless network without the need for an access
point. Location services are not part of WiFi Direct.
D. Tethering
Tethering is the process of connecting a cable between a computer and
mobile phone to provide Internet access for the computer. The tethering
process is not related to location services.
SY0-501, Objective 2.5 - Mobile Device Enforcement
Which of the following would be considered multi-factor authentication?
❍ A. PIN and fingerprint
❍ B. USB token and smart card
❍ C. Username, password, and email address
❍ D. Face scan and voiceprint
A. PIN and fingerprint
A PIN (Personal Identification Number) is something you know, and a fingerprint is something you are.
The incorrect answers:
B. USB token and smart card
A USB token and a smart card are both something you have. Both of these
describe a single factor of authentication.
C. Username, password, and email address
A password is something you know, but a username and email address
claim an identity but do not authenticate or prove the identity.
D. Face scan and voiceprint
Both a face scan and a voiceprint are biometric factors, or something you
are. Both of these describe a single factor of authentication.
SY0-501, Objective 4.1 - AAA and Authentication
Sam, a security administrator, is configuring the authentication process used by technicians when logging into a router. Instead of using accounts that are local to the router, Sam would like to pass all login requests to a centralized database. Which of the following would be the BEST way to implement this requirement?
❍ A. NTLM (NT LAN Manager)
❍ B. RADIUS (Remote Authentication Dial-In User Service)
❍ C. IPsec
❍ D. MS-CHAP (Microsoft Challenge-Handshake Authentication Protocol)
B. RADIUS
The RADIUS (Remote Authentication Dial-In User Service) protocol is a common method of centralizing authentication for users. Instead of having separate local accounts on different devices, users can authenticate with account information that is maintained in a centralized database.
The incorrect answers:
A. NTLM
NTLM (NT LAN Manager) authentication was first used in LAN Manager,
a precursor to the modern Windows operating systems. Unfortunately,
vulnerabilities with NTLM would limit its use as an authentication
method.
C. IPsec
IPsec is commonly used as an encrypted tunnel between sites or endpoints.
It’s useful for protecting data sent over the network, but IPsec isn’t used to
centralize the authentication process.
D. MS-CHAP
MS-CHAP (Microsoft Challenge-Handshake Authentication Protocol) was
commonly used in Microsoft’ PPTP (Point-to-Point Tunneling Protocol),
but vulnerabilities related to the use of DES (Data Encryption Standard)
encryption make it relatively easy to brute force the NTLM hash used in
MS-CHAP.
SY0-501, Objective 4.2 - Identity and Access Services
A security administrator is part of a project that will enhance the security of the desktops and servers in the company. An audit has recently found
some old company login credentials on a public Internet message board. Which of the following policies should the security administrator enforce
to limit the impact of this type of breach?
❍ A. Create a Group Policy to specify a minimum password length
❍ B. Encrypt all authentication traffic on the network
❍ C. Decrease the password expiration timeframe
❍ D. Store all passwords as salted hashes
C. Decrease the password expiration timeframe
Decreasing the password expiration timeframe would require users to change their password more often, therefore limiting the impact of a breached username and password.
The incorrect answers:
A. Create a Group Policy to specify a minimum password length
It’s always a good idea to have passwords with at least eight characters, but
the issue in this question was related to login credentials that were made
public. A minimum password length would limit the impact of this breach.
B. Encrypt all authentication traffic on the network
If captured data can’t be viewed, then it will remain confidential. In this
example, the credentials were already made public, so encrypting future
communication wouldn’t limit the impact of this breach.
D. Store all passwords as salted hashes
Secure storage of passwords is important, but once the password is public
the salted hash is no longer protecting password.
SY0-501, Objective 4.4 - Account Policy Enforcement
A system administrator is setting up an IPsec tunnel on a firewall with the following parameters: Peer: 10.1.1.2 Version: IKEv1 mode Authentication: Pre-Shared Key Encryption: DES Authentication hash: SHA256 DH Group: Group 5 Lifetime: 1 hour Which of the following would best describe these configuration settings? ❍ A. The authentication mode is not associated with an IPsec tunnel ❍ B. The IKE version is invalid ❍ C. The encryption standard is too weak ❍ D. The peer address is invalid
C. The encryption standard is too weak
DES (Data Encryption Standard) encryption is a weak encryption protocol that could be easily circumvented through the use of a brute-force attack. Using 3DES (Triple DES) or an AES (Advanced Encryption Standard) variant would be a better choice for encryption.
The incorrect answers:
A. The authentication mode is not associated with an IPsec tunnel
Pre-shared keys are commonly used with IPsec tunnel configurations,
although stronger authentication methods are certainly available.
B. The IKE version is invalid
Both IKEv1 (Internet Key Exchange v1) and IKEv2 are both valid options
for IPsec tunnel configurations.
D. The peer address is invalid
The peer address should be a valid IP address for the remote device at the
other end of the IPsec tunnel. The address listed in this configuration is a
valid IP address.
SY0-501, Objective 2.3 - Common Security Issues
A company has connected their wireless access points and have enabled WPS. Which of the following security issues would be associated with this configuration? ❍ A. Brute force ❍ B. Client hijacking ❍ C. Cryptographic vulnerability ❍ D. Spoofing
A. Brute force
A WPS personal identification number (PIN) was designed to have only 11,000 possible iterations, making a brute force attack very possible if the access point doesn’t provide any protection against multiple guesses.
The incorrect answers: B. Client hijacking The processes of adding a device through WPS occurs well before any app or client is used. C. Cryptographic vulnerability The vulnerability in WPS is based on a limited number of PIN options and not a cryptographic shortcoming. D. Spoofing Spoofing an
SY0-501, Objective 1.2 - WPS Attacks
An organization has traditionally purchased insurance to cover a ransomware attack, but the costs of maintaining the policy have increased above the acceptable budget. The company has now decided to cancel the insurance policies and deal with ransomware issues internally. Which of the following would best describe this action? ❍ A. Mitigating the risk ❍ B. Accepting the risk ❍ C. Transferring the risk ❍ D. Avoiding the risk
B. Accepting the risk
Risk acceptance is a business decision that places the responsibility of the risky activity on the organization itself.
The incorrect answers:
A. Mitigating the risk
If the organization was to purchase additional backup facilities and update
their backup processes to include offline backup storage, they would be
mitigating the risk of a ransomware infection.
C. Transferring the risk
Purchasing insurance to cover a risky activity is a common method of
transferring risk from the organization to the insurance company.
D. Avoiding the risk
To avoid the risk of ransomware, the organization would need to
completely disconnect from the Internet and disable all methods that
ransomware might use to infect a system. This risk response technique
would most likely not apply to ransomware.
SY0-501, Objective 5.3 - Risk Assessment
Which of these threat actors would be the MOST likely to deface a website to promote a political agenda? ❍ A. Organized crime ❍ B. Nation state ❍ C. Hacktivist ❍ D. Competitor
C. Hacktivist
A hacktivist often has a political statement to make, and their hacking efforts would commonly result in a public display of that information.
The incorrect answers:
A. Organized crime
Organized crime is usually motivated by money. An organized crime group
is more interested in stealing information than defacing sites.
B. Nation state
Nation states are highly sophisticated hackers, and their efforts are usually
focused on obtaining confidential government information or disrupting
governmental operations.
D. Competitor
A competitor may be interested in making another company look bad, but
the reason for the denial of services is not commonly based on a political
agenda.
SY0-501, Objective 1.3 - Threat Actors
An IPS report of the last 24 hours shows that a series of exploit attempts were made against externally facing web servers. The system administrator of the web servers has identified a number of unusual log
entries on each system. Which of the following would be the NEXT step in the incident response process?
❍ A. Check the IPS logs for any other potential attacks
❍ B. Create a plan for removing malware from the web servers
❍ C. Disable any breached user accounts
❍ D. Disconnect the web servers from the network
D. Disconnect the web servers from the network
The unusual log entries on the web server indicate that the system may have been exploited. In that situation, the servers should be isolated to prevent access to or from those systems.
The incorrect answers:
A. Check the IPS logs for any other potential attacks
Before looking for additional exploits, the devices showing a potential
exploit should be isolated and contained.
B. Create a plan for removing malware from the web servers
The recovery process should occur after the systems have been isolated and
contained.
C. Disable any breached user accounts
This is part of the recovery process, and it should occur after isolation and
containment of the exploited servers.
SY0-501, Objective 5.4 - Incident Response Process
A security administrator is viewing the logs on a laptop in the shipping and receiving department and identifies these events:
8:55:30 AM | D:\Downloads\ChangeLog-5.0.4.scr | Quarantine Success
9:22:54 AM | C:\Program Files\Photo Viewer\ViewerBase.dll | Quarantine Failure
9:44:05 AM | C:\Sales\Sample32.dat | Quarantine Success
Which of the following would BEST describe the circumstances surrounding these events?
❍ A. The antivirus application identified three viruses and
quarantined two viruses
❍ B. The host-based firewall blocked two traffic flows
❍ C. A host-based whitelist has blocked two applications from executing
❍ D. A network-based IPS has identified two known vulnerabilities
A. The antivirus application identified three viruses and quarantined two viruses
The logs are showing the name of files on the local device and a quarantine disposition, which indicates that two of the files were moved (quarantined)
to a designated area of the drive. This will prevent the malicious files from executing and will safely store the files for any future investigation. The second file in the list failed the quarantine process, and was most likely
because the library was as already in use by the operating system and could not be moved.
The incorrect answers:
B. The host-based firewall blocked two traffic flows
A host-based firewall will allow or deny traffic flows based on IP address,
port number, application, or other criteria. A host-based firewall does not
block traffic flows based on the name of an existing file, and the firewall
process would not quarantine or move files to other folders.
C. A host-based whitelist has blocked two applications from executing
The “quarantine” disposition refers to a file that has been moved from one
location to another. A whitelist function would simply stop the application
from executing without changing the location of an application file.
8:55:30 AM | D:\Downloads\ChangeLog-5.0.4.scr | Quarantine Success
9:22:54 AM | C:\Program Files\Photo Viewer\ViewerBase.dll | Quarantine Failure
9:44:05 AM | C:\Sales\Sample32.dat | Quarantine Success
Practice Exam B - Answers 205
D. A network-based IPS has identified two known vulnerabilities
The logs from a network-based IPS (Intrusion Prevention System) would
not commonly be located on a user’s laptop, and those logs would display
allow or deny dispositions based on the name of a known vulnerability. A
network-based IPS would also not commonly move (quarantine) files on an
end-user’s computer.
SY0-501, Objective 2.4 - Analyzing Security Output
In the past, an organization has relied on the curated Apple App Store to avoid the issues associated with malware and insecure applications. However, the IT department has discovered an iPhone in the shipping
department that includes applications that are not available on the Apple App Store. How did the shipping department user install these apps on
their mobile device?
❍ A. Sideloading
❍ B. MMS install
❍ C. OTA updates
❍ D. Tethering
A. Sideloading
If Apple’s iOS has been circumvented using jailbreaking, then apps can be installed without using the Apple App Store. This installation process that circumvents the App Store is called sideloading.
The incorrect answers:
B. MMS install
Text messages that prompt to install an application will link to the App
Store version of the application.
C. OTA updates
OTA (Over the Air) updates are commonly provided from the carrier and
are not part of mobile app installations.
D. Tethering
Tethering uses a mobile phone as a communications medium to the
Internet, and it does not have any relationship to the apps that are installed
on the mobile device.
SY0-501, Objective 2.5 - Mobile Device Enforcement
A security team is investigating a compromised server that resulted in the loss of credit card information for thousands of customers. The web servers associated with the data breach was patched regularly each month. Forensic reviews show that the initial exploit was from a previously unknown application vulnerability. A week later, the stolen credit card
data was found to be available for purchase on a well-known dark web credit card site. Which of these would be the MOST likely source of this attack?
❍ A. Organized crime
❍ B. Nation state
❍ C. Script kiddie
❍ D. Insiders
A. Organized crime
The primary goal of organized crime is to make money, and accessing and selling credit card data is a common method of revenue generation. Organized crime also has the capital to fund their hacking efforts, and the use of zero-day or unknown vulnerabilities is not uncommon.
The incorrect answers:
B. Nation state
A nation state is generally less concerned with revenue generation and
more interested in gaining access to confidential data or disrupting the
operations of another government.
C. Script kiddie
A script kiddie does not often use sophisticated methods to gain access to a
system. Using an unknown vulnerability would be well outside the scope of
knowledge for most script kiddies.
D. Insiders
An insider wouldn’t need to use an unknown vulnerability to gain access to
data. Their existing rights
SY0-501, Objective 1.3 - Threat Actors
A security manager has ensured that the security posture of the organization includes electronic locks with cameras at the data center, firewalls on the Internet links, and specific policies for onboarding and
offboarding employees. Which of the following would BEST describe these security mechanisms?
❍ A. OSI Layering
❍ B. Defense-in-depth
❍ C. Multi-factor authentication
❍ D. Role-based access control
B. Defense-in-depth
The process of layering physical, technical, and administrative security controls is called defense-in-depth. No single process or technology will secure the entire network, so you have to layer multiple security controls to
provide the best possible security posture.
SY0-501, Objective 3.1 - Defense-in-Depth
A recent audit has found four different active service accounts that are configured with Administrator rights. The applications associated with these service accounts haven’t been used for years, and therefore the accounts are no longer necessary. Which of the following would be the BEST way to prevent this issue from occurring again?
❍ A. Enable password expirations for all accounts
❍ B. Disable all service accounts with Administrator permissions
❍ C. Increase the password complexity policy
❍ D. Require passwords of eight characters or more
A. Enable password expirations for all accounts
A standard password expiration timeout of 30 days would be a good way to ensure that accounts were constantly updated. Abandoned accounts would be automatically disabled within 30 days, regardless of their rights
and permissions. This is a good best practice for all accounts and not just service or administrator accounts.
The incorrect answers:
A. OSI Layering
The OSI model is a concept related to the transfer of data across the
network. The layers of the OSI model are not related to a layered security
approach.
C. Multi-factor authentication
Multi-factor authentication uses different techniques to help confirm the
identity of a user. The security mechanisms listed above do not describe
multi-factor authentication.
D. Role-based access control
Role-based access control is a method of assigning rights and permissions
based on job responsibilities. The security
SY0-501, Objective 4.4 - Account Policy Enforcement
Jack, a hacker, has identified a number of devices on a corporate network that use the username of “admin” and the password of “admin.” Which vulnerability describes this situation? ❍ A. Improper error handling ❍ B. Default configuration ❍ C. Weak cipher suite ❍ D. NULL pointer dereference
B. Default configuration
When a device is first installed, it will often have a default set of credentials, such as admin/password or admin/admin. Many times, these default credentials are never changed and can allow access by anyone who
knows the default configuration.
The incorrect answers:
B. Disable all service accounts with Administrator permissions
Some services may require administrator permissions, so disabling all of
them would not be the best option in this case.
C. Increase the password complexity policy
A complex password can still be attacked. Disabling an abandoned account
would ensure that forgotten accounts would not be a significant security
risk.
D. Require passwords of eight characters or more
Abandoned accounts that have Administrator rights would hopefully use
a secure password, but the more pressing issue is that these powerful
accounts are still accessible yet not in production use.
SY0-501, Objective 1.6 - Vulnerability Types
A security administrator has instituted a company-wide policy that disables the use of USB interfaces for removable storage devices. Which of the following is the MOST likely reason for this policy?
❍ A. Prevent operating system file corruption
❍ B. Avoid license compliance violations
❍ C. Prevent the use of a non-standard mouse or keyboard
❍ D. Protect against data exfiltration
D. Protect against data exfiltration
A common way to remove data from a facility is to copy the data to a portable storage device such as a USB flash drive. Once the data is on the USB drive, it can be easily taken outside of the facility.
The incorrect answers:
A. Prevent operating system file corruption
There are many ways to corrupt operating system files, but blocking
removable USB drives doesn’t make the system files any less susceptible to
corruption.
B. Avoid license compliance violations
USB interfaces are sometimes used for application licensing through the
use of a USB dongle. Restricting the use of the USB interface could prevent
the application from starting and may prevent the proper use of licensing
tools. If the applications don’t require a USB dongle, then USB interface
policies will have no effect on license compliance.
C. Prevent the use of a non-standard mouse or keyboard
The USB policies allow USB devices that do not register as a storage device,
so mouse and keyboard connections will still work normally.
SY0-501, Objective 2.3 - Common Security Issues
A manufacturing company owns industrial equipment that cuts and shapes aluminum parts. The company has created an isolated network exclusively for the control and management of this equipment. Which category BEST describes this network? ❍ A. ICS (Industrial Control System) ❍ B. SoC (System on a Chip) ❍ C. MFD (Multifunction Device) ❍ D. IoT (Internet of Things)
A. ICS
An ICS (Industrial Control System) is often a dedicated network used to manage and control manufacturing equipment, power generation equipment, water management systems, and other industrial machines.
The incorrect answers:
B. SoC
An SoC (System on a Chip) consists of multiple components running on a
single chip. These are usually small form-factor devices that work best as
embedded systems. SoC systems would not commonly be associated with
the control and management of industrial equipment.
C. MFD
An MFD (Multifunction Device) is commonly associated with a device that
can print, scan, and fax.
D. IoT
IoT (Internet of Things) devices are generally associated with home
automation and not with the management and control of industrial
equipment.
SY0-501, Objective 3.5 - Embedded Systems
