Practice Test 1

Question 1

Which of the following is generally a script planted by a disgruntled employee or other malicious actor that is set to execute at a certain time?

A) Virus
B) Trojan horse
C) Logic bomb
D) Adware

Answer 1

C) Logic bomb

A logic bomb is simply a script that is set to execute at a certain time. Logic bombs are usually created by rogue administrators or disgruntled employees.A virus is a piece of malicious software that must be propagated through a definite user action. A Trojan horse is a piece of software that seems to be of value to the user, but in reality is malware. Adware is usually annoying advertisements that come in the form of pop-up messages in a user?s browser.

Question 2

Which of the following methods of strengthening weak keys involves taking a weak initial key and feeding it to an algorithm that produces an enhanced key, which is much stronger?

A) Key streaming
B) Key repetition
C) Key exchange
D) Key stretching

Answer 2

D) Key stretching

Key stretching is a technique used to change weak keys into stronger ones by feeding them into an algorithm to produce enhanced keys.Key streaming involves sending individual characters of the key through an algorithm and using mathematical XOR function to change the output. Key repetition is not a valid answer or term. Key exchange involves generating and exchanging a asymmetric key used for a particular communications session, or exchanging public keys in order to use them for public key cryptography.

Question 3

Which the following is a recognized way of restricting access to applications?

A) Whitelisting
B) Blacklisting
C) Greylisting
D) Filtering

Answer 3

B) Blacklisting

Blacklisting is a technique that involves an administrator adding undesirable or restricted software or applications to a list on content filtering devices, in group policy, or through some other type of mechanism. This ensures that users are not allowed to download, install, or execute these particular applications.Whitelisting is the opposite of blacklisting; applications that users are allowed to download, install, and execute are added to a whitelist. There is no such term as graylisting. Filtering typically involves checking traffic on a network device based upon specific characteristics. The term normally does not apply to software or applications.

Question 4

Which type of network intrusion detection system (NIDS) develops a baseline of normal traffic so it can detect deviations in this traffic that might indicate an attack?

A) Rule-based system
B) Anomaly-based system
C) Signature-based system
D) Filter-based system

Answer 4

B) Anomaly-based system

Anomaly-based systems detect unusual network traffic patterns based upon a baseline of normal network traffic.Rule-based systems use predefined rule sets. Signature-based systems use predefined traffic signatures that are typically downloaded from a vendor. Filter-based systems, such as routers and firewalls, base detection on access control lists that specify traffic that is permitted and denied.

Question 5

Which of the following types of network-connected systems can manage heating, ventilation, and air-conditioning controls?

A) Minicomputers
B) Embedded hosts
C) Supervisory control and data acquisition
D) Mainframes

Answer 5

C) Supervisory control and data acquisition

Supervisory control and data acquisition (SCADA) systems are used to control and manage heating, ventilation, air-conditioning, and other types of industrial and environmental systems.Minicomputers are antiquated computers that performed advanced tasks in the place of mainframe systems and are no longer widely in use. Although some SCADA systems could be embedded, embedded hosts normally refer to systems that have operating systems burned into their computer chips. Mainframe systems normally do not control industrial types of systems, such as heating, ventilation, and air-conditioning.

Question 6

Which of the following uses a management information base (MIB) to provide detailed device-specific information to a central management console?

A) SMTP
B) SNMP
C) Syslog
D) ACL

Answer 6

B) SNMP

The Simple Network Management Protocol (SNMP) uses a management information base, or MIB, specific to each device and from which device information can be obtained.SMTP, the Simple Mail Transport Protocol, is responsible for sending e-mail. Syslog is a log server found in UNIX and Linux systems. An access control list (ACL) resides on network devices and filters traffic coming into and out of a device.

Question 7

Which type of assessment is used to determine weaknesses within a system?

A) Vulnerability assessment
B) Threat assessment
C) Risk assessment
D) Penetration test

Answer 7

A) Vulnerability assessment

A vulnerability assessment looks for weaknesses in systems.A threat assessment looks at events that could exploit vulnerabilities. A risk assessment is a combination of assessments and is designed to assess factors, including likelihood and impact, that affect an asset. A penetration test actually attempts to exploit any found weaknesses (usually after a vulnerability assessment) to gain access to systems.

Question 8

What is the biggest difference between EAP-TLS and EAP-TTLS?

A) EAP-TTLS needs server and client certificates; EAP-TLS only needs server certificates
B) EAP-TTLS can use unsigned certificates; EAP-TLS must have third-party signed certificates
C) EAP-TLS can use unsigned certificates; EAP-TTLS must have third party signed certificates
D) EAP-TLS needs server and client certificates, EAP-TTLS only needs server certificates

Answer 8

D) EAP-TLS needs server and client certificates, EAP-TTLS only needs server certificates

EAP-TLS needs server and client certifcates; EAP-TTLS only needs server certifcates.The EAP standard does not define the use of signed or unsigned certificates, although most implementations require signed certificates.

Question 9

Which of the following enables a user to provide one set of credentials to the system and use those credentials throughout other interconnected systems?

A) Multifactor authentication
B) Single-factor authentication
C) Single sign-on
D) Pass-through authentication

Answer 9

C) Single sign-on

Single sign-on is a method of authentication that enables a user to provide one set of credentials and use them throughout an interconnected network. Both Kerberos and Sesame protocols allow single sign-on.Multifactor authentication refers to the use of several different factors to authenticate to a system, such as something you know, something you are, and something you have. Multifactor authentication can be used in a single sign-on environment but is not necessarily required. Single-factor authentication uses only one factor, such as something you know, to authenticate to a system. It can also be used in a single sign-on environment but is not required. Pass-through authentication can appear to be similar to single sign-on, but it requires all individual systems simply to accept credentials passed from another system without a unified approach.

Question 10

All of the following are characteristics of the RADIUS authentication protocol, EXCEPT:

A) RADIUS encrypts user passwords during the authentication process
B) RADIUS accepts earlier forms of authentication protocols, such as PAP
C) RADIUS uses UDP port 1812
D) RADIUS uses TCP port 1812

Answer 10

D) RADIUS uses TCP port 1812

RADIUS does not use TCP.All of these are characteristics of the RADIUS protocol.

Question 11

Which of the following security controls allows connectivity to a network based on the system?s hardware address?

A) WEP encryption
B) MAC address filtering
C) Disabling SSID broadcast
D) WPA2 encryption

Answer 11

B) MAC address filtering

Filtering by the MAC address ensures that only specific systems can access the wireless network based on the MAC address generally presented by the network card. That address is added into a list of systems that can connect (or not).Encryption technologies cannot stop specific systems from entering the network on its own. Disabling the SSID broadcast cannot stop systems from connecting if they determine the SSID through other means.

Question 12

Which of the following DES/AES encryption modes is considered the weakest?

A) ECB
B) CBC
C) OFB
D) CTR

Answer 12

A) ECB

With ECB mode, a given piece of plaintext will always produce the same corresponding piece of ciphertext. This predicability makes it weak.While CBC, OFB, and CTR mode go about the processes in different ways, these modes lack ECB’s predicability, adding strength to the underlying cryptosystem.

Question 13

Which of the following can cause a successful attack on a system when a user enters malicious code or characters into a form field on a Web application?

A) Lack of restrictive permission on the web form
B) Lack of input validation
C) Lack of adequate memory in a buffer
D) Lack of properly formatted HTML

Answer 13

B) Lack of input validation

A lack of input validation in the Web form field may allow certain types of attacks to take place when a user enters malicious or incorrect characters in the form.Permissions do not affect the quality or type of input in the field, only who can access and perform actions on the form. Adequate memory in a buffer cannot perform input validation functions. Properly formatted HTML cannot perform input validation on a form field.

Question 14

Which of the following fire suppression chemicals was banned in 1987 and can no longer be used in data centers?

A) Water
B) Halon
C) Carbon dioxide
D) FM-200

Answer 14

B) Halon

Halon is a dangerous chemical that was previously used in data centers to suppress fires. However, it was banned in 1987 because it is also dangerous to human beings.Water is still used to combat certain classes of fires. Carbon dioxide is used to combat both liquid and electrical fires. FM-200 has generally replaced Halon in data center fire suppression systems.

Question 15

All of the following types of social engineering attacks might go undetected by the victim, except:

A) Shoulder surfing
B) Tailgating
C) Dumpster diving
D) Coercion

Answer 15

D) Coercion

Coercion attacks generally require direct confrontation with the victim, so they are usually detected.All of these attacks may go undetected by the victim, because they may not require any direct interaction with the target and can be performed subtly by the attacker without the victim noticing.

Question 16

An attack in which an attacker attempts to disconnect a victim?s wireless host from its access point is called a(n) __________.

A) Spoofing
B) Deauthentication attack
C) Replay attack
D) Initialization vector attack

Answer 16

B) Deauthentication attack

A deauthentication attack involves sending specially-crafted traffic to both a wireless client and an access point, in the hopes of causing them to deauthenticate with each other and disconnect.A spoofing attack involves impersonating a wireless client or access point, either through its IP or MAC address. A replay attack involves the reuse of intercepted non-secure credentials to gain access to a system or network. Initialization vector (IV) attacks involve attempting to break WEP keys by targeting their weak IVs.

Question 17

Which of the following algorithms won the U.S. government?sponsored competition to become the Advanced Encryption Standard (AES)?

A) Blowfish
B) Twofish
C) Rijindael
D) RC4

Answer 17

C) Rijindael

Rijindael was selected as the winner of the NIST competition and became the U.S. government?s Advanced Encryption Standard (AES).Twofish, another symmetric algorithm, was one of the five finalists for the competition, but it did not win. Blowfish is also symmetric algorithm, but was not considered in the competition to be the AES. RC4 is a symmetric streaming cipher commonly seen in WEP and SSL implementations. It was not one of the finalists involved in the AES competition.

Question 18

Which of the following policy settings prevent a user from rapidly changing passwords and cycling through his or her password history to reuse a password?

A) Password history
B) Maximum password age
C) Minimum password age
D) Password complexity

Answer 18

C) Minimum password age

The minimum password age setting is used to force users to use a password for a minimum amount of time before they are allowed to change it. This prevents them from rapidly cycling through the password history to reuse an older password.Password history simply records a previous number of passwords, so that they cannot be reused in the system. The maximum password age is used to expire a password after a certain time period. Password complexity enforces the use of longer password lengths and character spaces, increasing password strength.

Question 19

You have received reports that a number of hosts in your company’s internal network are sluggish and unresponsive. After troubleshooting other items, you decide to use a sniffer to examine the network traffic coming into the host. You see that massive amounts of ICMP broadcasts are being sent on the network. The switch is having trouble processing all of this traffic, due to repeated ICMP replies, causing it to slow down. Which of the following is the most likely explanation for this?

A) Flood attack
B) Malware attack
C) Man-in-the-middle attack
D) Phishing attack

Answer 19

A) Flood attack

A flood is a type of network attack based upon confusing a switch with ICMP traffic.Malware would not cause a large volume of ICMP segments to be sent to a host. A man-in-the-middle attack attempts to break into an existing communications session, and is not a denial-of service attack. A phishing attack is a form of social engineering attack using e-mail.

Question 20

Which of the following terms indicates the length of time a device is expected to last in operation, and only a single, definitive failure will occur and will require that the device be replaced rather than repaired?

A) Mean time between failures
B) Mean time to recovery
C) Mean time to failure
D) Mean time to replace

Answer 20

C) Mean time to failure

The mean time to failure (MTTF) is the length of time a device is expected to last in operation. In MTTF, only a single, definitive failure will occur and will require that the device be replaced rather than repaired.Mean time between failures (MTBF) represents the manufacturer?s best guess (based on historical data) regarding how much time will pass between major failures of that component. This assumes that more than one failure will occur, which means that the component will be repaired, rather than replaced. Mean time to recovery (MTTR) is the amount of time it takes for a hardware component to recover from failure. Mean time to replace is not a valid term.

Question 21

What is the second step in the incident response life cycle?

A) Containment, eradication, and recovery
B) Preparation
C) Post-incident activity
D) Detection and analysis

Answer 21

D) Detection and analysis

Detection and analysis is the second step of the incident response life cycle.In order, the steps of the incident response life cycle are preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity.

Question 22

Which of the following statements best describes the relationship between the elements of risk?

A) Threat actors initiate vulnerabilities
B) Threats exploit vulnerabilities
C) Threats cause impact to vulnerabilities
D) Threat actors create vulnerabilities in assets

Answer 22

B) Threats exploit vulnerabilities

Threats exploit vulnerabilities.The relationship between the elements of risk are as follows: threat actors initiate threats, which in turn exploit vulnerabilities.

Question 23

During which stage of a secure development model would you normally find steps such as secure code review, fuzzing, and vulnerability assessments?

A) Security testing
B) Secure design
C) Security requirements
D) Secure implementation

Answer 23

A) Security testing

During the secure testing phase of the secure software development model, software is measured or tested against security, functional, and performance requirements. This may include secure code review, application fuzzing, and vulnerability assessments, as well as penetration testing.In the secure design stage, different security functionality is designed into the application. In the security requirements stage, requirements for different security functions are determined. During secure implementation of software, security requirements are validated as implemented in the application.

Question 24

Which of the following utilities are specifically used to diagnose DNS issues? (Select Two)

A) dig
B) Nmap
C) Kali
D) nslookup
E) ping

Answer 24

A) dig
D) nslookup

Both dig and nslookup are designed to query DNS servers.One might argue that Nmap and ping might be used to diagnose DNS, but neither of them are specifically for DNS queries. Kali is a Linux distro, not a utility.up

Question 25

Which of the following describe a false reject rate? (Choose two.) A) The error caused from rejecting someone who is in fact an authorized user B) Type 1 error C) The error caused when an unauthorized user is validated as authorized D) Type 2 error

Answer 25

A) The error caused from rejecting someone who is in fact an authorized user B) Type 1 error A false reject rate (FRR) is the error caused from rejecting an authorized user; it is also called a Type I error.A false acceptance rate (FAR) is the error caused when an unauthorized user is validated as authorized, also referred to as a Type II error.

Question 26

Which of the following access control models enables a person who creates or owns objects to define permissions to access those objects? A) Mandatory access control model B) Rule-based access control model C) Role-based access control model D) Discretionary access control model

Answer 26

D) Discretionary access control model Discretionary access control enables a user who has created or owns an object, such as a file or folder, the discretion to assign permissions for that object to anyone they choose.Mandatory access control models use labels and security clearances to grant access to objects. Rule-based access control models use a specific set of rules that control the interaction between users and objects. Role-based access control models use defined roles with specific rights and permissions assigned to those roles to control access to objects.

Question 27

During which type of assessment would penetration testers not have any knowledge about the network and network defenders have no knowledge of the test itself? A) Black box test B) Blind test C) Double-blind test D) Gray box test

Answer 27

C) Double-blind test In a double-blind test, testers have no prior knowledge of the network they are testing, and network defenders have no prior knowledge of the test and aren?t aware of any attacks unless they can detect and defend against them. This test is designed to test the defenders? abilities to detect and respond to attacks and to test and exploit vulnerabilities on the network.In a black box test, only the testers have no knowledge of details about this network configuration. This type of test is also referred to as a blind test. In a gray box test, the penetration tester may have some limited knowledge of the network or systems, gained from the organization that wants the test.

Question 28

Which of the following processes is concerned with validating credentials? A) Authorization B) Authentication C) Auditing D) Accountability

Answer 28

B) Authentication Authentication is the process of validating that a user?s credentials are authentic, after the user has presented them through the identification process.Authorization is the process of controlling access to resources through methods that include permissions, rights, and privileges. Auditing is the process of reviewing logs and other audit trails to determine what actions have been performed on systems and data. Accountability uses auditing to ensure that users are traced to and held responsible for their actions.

Question 29

Your organization is concerned that employees might e-mail proprietary information to themselves at their private addresses. Which of the following would be most effective at catching that particular effort? A) Antispam filter B) Content filter C) Caching proxy server D) Firewall

Answer 29

B) Content filter Content filters can scan content as it leaves the network, checking for certain types of content that has been pre-specified within the software.The other choices are incorrect because those technologies will not content-filter messages. Antispam filters are used to catch and quarantine spam messages. Caching proxy servers are used to cache, or store, messages for speedy retrieval in the future. Firewalls help control and block (when necessary) network traffic at the ingress and egress points.

Question 30

Which of the following methods of log management involves visiting each individual host to review its log files? A) Centralized B) SIEM C) Decentralized D) Syslog

Answer 30

C) Decentralized Decentralized log management means that logs are managed and reviewed on a host-by-host basis, rather than as a centralized, consolidated group.Centralized log management involves collecting logs from across the network into a system and reviewing then as a group. Security Information Event Management (SIEM) is a centralized method of obtaining logs and other data from disparate devices across a network. Syslog is a logging tool found in UNIX and Linux systems, which can be used either on a centralized or decentralized basis.

Question 31

You are trying to determine the appropriate level of high availability for a server. The server must be available on a constant basis, and downtime in a given year cannot exceed 1 hour. It normally takes you about 45 minutes to bring down and restart the server for maintenance. Which of the following reflects the level of availability you require? A) 99.999% availability B) 99.9% availability C) 99.99% availability D) 99% availability

Answer 31

C) 99.99% availability 99.99 percent availability accounts for 52 minutes of downtime per year.99.999 percent availability allows only 5.26 minutes of downtime per year, which may not be enough if the server requires almost an hour of maintenance time. 99.9 percent availability equates to more than 8 hours of downtime per year and exceeds the stated requirement. 99 percent availability is more than 3 days of downtime per year, far exceeding the requirement for no more than 1 hour of downtime.

Question 32

Which of the following ports would be most likely to allow secure remote access into a system within a data center? A) UDP port 53 B) TCP port 1701 C) UDP port 123 D) TCP port 443

Answer 32

B) TCP port 1701 L2TP aligns to TCP port 1701, allowing secure remote access to a system through a VPN connection.UDP port 53 aligns to the Domain Name Service (DNS), UDP port 123 is used by Network Time Protocol (NTP) services, and TCP port 443 is used by HTTP over SSL.

Question 33

Which of the following secure protocols protects traffic during transmission and uses TCP port 443? (Choose two.) ``` A) SCP B) SSH C) TLS D) SSL E) TFTP ```

Answer 33

C) TLS D) SSL Both Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols are used to encrypt traffic sent over untrusted networks, such as the Internet. Both use TCP port 443.SCP is part of the SSH protocol suite and is used to copy files securely from one host to another. SSH is a protocol used to connect to and administer hosts remotely. Both SCP and SSH use TCP port 22. UDP uses UDP port 69 and is totally unsecure.

Question 34

All of the following are valid methods to secure static hosts in an organization, except: A) Layered security B) Network segmentation C) Application level firewalls D) User-dependent security

Answer 34

D) User-dependent security The organization should not depend solely upon the users to manage security and static devices, because these devices can be managed just as traditional hosts and network devices are.These are all valid methods of securing static hosts in an organization.

Question 35

Wissa is updating a printer driver on a Windows system. She downloads the latest driver from the manufacturer's Web site. When installing the driver, Windows warns that the driver is unsigned. To which of the following threats is Wissa exposing her system? A) Man-in-the-middle B) Version control C) Refactoring D) Shimming

Answer 35

C) Refactoring A refactored driver will work correctly, but might also perform other, malicious actions.Man-in-the-middle might be a result of the refactor, but is not the threat itself. Version control refers to formally tracking different versions of the baseline configuration. Shimming is a library that responds to inputs that the original device driver isn't designed to handle and would require a separate file.

Question 36

Which of the following types of factors could be used to describe a fingerprint-based method of logging in and authenticating to a touchscreen device? A) Something you know B) Something you have C) Something you are D) Something you can do

Answer 36

C) Something you are This is an example of "something you are," like any biometric factor, such as a fingerprint or retinal eye pattern.An example of ?something you know? would be a password or PIN. ?Something you have? would include a token or smart card. ?Something you do? would be considered swiping a pattern like a pattern unlock on a cell phone.

Question 37

Which of the following technologies allows devices to communicate with each other at very close range through radio signals by using a special chip implanted in the device, and may be vulnerable to eavesdropping and man-in-the-middle attacks? A) 802.11 wireless B) Bluetooth C) Near-field communication (NFC) D) Infrared

Answer 37

C) Near-field communication (NFC) Near-field communication is enables devices to send very low-power radio signals to each other by using a special chip implanted in the device. This technology requires that the devices be extremely close or even touching each other. This technology is used for a wide variety of applications, including payments through NFC-enabled smartphones.Neither 802.11 wireless nor Bluetooth technologies are used in this manner. Infrared does not use radio frequency technology; it enables communications between devices using a beam of light.

Question 38

Which of the following is an application designed to create and initiate files on a host to provide a fully functional virtual machine? A) Host operating system B) Hypervisor C) Guest operating system D) Load balancer

Answer 38

B) Hypervisor A hypervisor, also called a virtual machine monitor, is application software responsible for creating and managing virtual machines and their associated files on a host.The host operating system does not create or manage virtual machines; it merely shares resources with them. The guest operating system is the virtual machine itself and is managed by a hypervisor. A load balancer is other software or a hardware appliance responsible for balancing user requests and network traffic among several different physical or virtualized hosts.

Question 39

How many rounds does DES perform when it encrypts plaintext? A) 16 B) 32 C) 64 D) 128

Answer 39

A) 16 DES uses 16 rounds of encryption.DES does not use 32,64, or 128 rounds of encryption or decryption processes.

Question 40

Which of the following secure e-mail protocols is carried over an SSL or TLS connection and uses TCP port 993? A) SMTP B) POP3 C) IMAPS D) IMAP4

Answer 40

C) IMAPS IMAPS (secure IMAP) is a secure version of the IMAP4 protocol used over SSL or TLS connections to provide for client e-mail security.SMTP is a server-side e-mail protocol and is not used over SSL or TLS. SMTP uses TCP port 25. POP3 is a non-secure client-side e-mail protocol that uses TCP port 110. IMAP4 is a non-secure client-side e-mail protocol that uses TCP port 143.

Question 41

Which of the following are true statements regarding the relationships of functionality, security, and available resources? (Choose two.) A) As functionality increases, security increases B) As security increases, functionality decreases C) As resources increase, security decreases but functionality decreases D) As resources decrease, both functionality and security decrease

Answer 41

B) As security increases, functionality decreases D) As resources decrease, both functionality and security decrease The relationship between security and functionality is inversely proportional. As one increases, the other decreases. The relationship between resources and both security and functionality is directly proportional. As resources increase, so do both functionality and security. If resources decrease, so do functionality and security.If functionality increases, security generally decreases. If resources increase, both security and functionality increase as well.

Question 42

During which stage of a secure development model would you normally find steps such as requirements gathering, analysis, and diagram development? A) Security testing B) Secure design C) Security requirements D) Secure implementation

Answer 42

C) Security requirements In the security requirements stage, requirements for different security functions are determined. Iterations of interviews and surveys might be developed and gathered and diagrams developed to show project milestones.During the secure testing phase of the secure software development model, software is measured or tested against security, functional, and performance requirements. This may include secure code review, application fuzzing, and vulnerability assessments, as well as penetration testing. In the secure design stage, different security functionality is designed into the application. During the secure implementation of software, security requirements are validated as implemented in the application.

Question 43

Risk assessment means evaluating which of the following elements? (Choose two.) A) Probability B) Threat C) Vulnerability D) Impact

Answer 43

A) Probability D) Impact Probability and impact values are evaluated and assessed during a risk assessment.Threats and vulnerabilities do not have defined values.

Question 44

Which of the following is a protocol used to obtain the status of digital certificates in public keys? A) DHE B) RSA C) OCSP D) ECC

Answer 44

C) OCSP The Online Certificate Status Protocol (OCSP) is used to obtain the revocation status of digital certificates. It is used as an alternative to certificate revocation lists and enables clients to request and receive the electronic status of digital certificates automatically and in real-time.Diffie-Hellman Exchange (DHE) is a key negotiation and agreement protocol used in public key cryptography. RSA is the de facto standard used to generate public and private key pairs in a PKI. Elliptic curve cryptography (ECC) is a public key cryptography protocol used on small mobile devices, due to its low power and computing requirements.

Question 45

All of the following are supporting elements of authorization, except: A) Credential validation B) Principle of least privilege C) Separation of duties D) Rights, permissions, and privileges

Answer 45

A) Credential validation Validating credentials is an important aspect of authentication, not authorization.All of these elements directly support authorization.

Question 46

Which of the following forms of authentication pass credentials in clear text and is not recommended for use? A) PAP B) CHAP C) MS-CHAP D) EAP

Answer 46

A) PAP The Password Authentication Protocol (PAP) is an older authentication method that passes usernames and passwords in clear text. For this reason, it is no longer used.CHAP, the Challenge Handshake Authentication Protocol, uses password hashes and challenge methods to authenticate to the system. Passwords are not passed in clear text with this protocol. MS-CHAP (Microsoft CHAP) is a Microsoft proprietary version of CHAP, native to Windows systems. The Extensible Authentication Protocol (EAP) is a modern authentication framework that can use various authentication methods. It also does not pass username and password information in clear text.

Question 47

Your organization wants you to create and implement a policy that will detail proper use of its information systems during work hours. Which of the following is the best choice? A) Acceptable-use policy B) Due care C) Service level agreement D) Access control policies

Answer 47

A) Acceptable-use policy An acceptable-use policy details what is (and is not) acceptable for users to do during their working hours, including personal use and unacceptable activities on the company network, such as gambling and pornography.Due care is an act performed by the company itself, and is not a user policy. Service level agreements are made between a company and a third party, such as a contractor or a supplier. Access control policies help protect against unauthorized access, both physical and logical, but they don?t discuss how users can and cannot use systems.

Question 48

If a person knows a control exists, and this control keeps him or her from performing a malicious act, what type of control would this be classified as? A) Preventative control B) Corrective control C) Deterrent control D) Compensating control

Answer 48

C) Deterrent control A deterrent control keeps someone from performing a malicious act, provided that he or she knows the control is there and is aware of the consequences for violating it.The difference between a deterrent control and a preventive control is that it is necessary for a potential attacker to have knowledge of the deterrent control for it to be effective. Users do not have to have knowledge of a preventative control for it to function. A corrective control is used to correct a condition when there is either no control at all, or when the existing control is ineffective. Normally, a corrective control is temporary until a more permanent solution is put into place. A compensating control assists and mitigates the risk when an existing control is unable to do so.

Question 49

When information is converted to an unreadable state using cryptography, in what form is the information? A) Plaintext B) Ciphertext C) Hash D) Message digest

Answer 49

B) Ciphertext Ciphertext is a result of the encryption process; it is encrypted text.Plaintext is unencrypted text. A hash or message digest is a cryptographic representation of variable length text, but it is not the text itself.

Question 50

What type of file, often sent with an e-mail message, can contain malicious code that can be downloaded and executed on a client?s computer? A) Cookie B) Locally shared object C) HTML attachment D) Cross-site script

Answer 50

C) HTML attachment Any form of attachment is a risk. An HTML attachment is basically an HTML file that comes attached to an e-mail message. When a user clicks this attachment, it automatically spawns a browser session and could connect to a malicious Web site. Once the user is connected to the site, malicious code can be downloaded onto the user?s browser.Neither cookies, locally shared objects, nor cross-site scripts are attached to e-mail messages.

Question 51

Marisol sees a tremendous amount of traffic on TCP port 389 from the Internet. Which TCP/IP service should she inspect first? A) SQL B) LDAP C) HTTPS D) TLS

Answer 51

B) LDAP The Lightweight Directory Application Protocol (LDAP) uses TCP port 389.SQL is a query language for directories. HTTPS is the secure HTTP protocol for Web pages. TLS is an authentication/encryption protocol.

Question 52

Which of the following is a form of intentional interference with a wireless network? A) Evil twin B) SSID cloaking C) MAC spoofing D) Jamming

Answer 52

D) Jamming Jamming is an intentional interference with the signal of a wireless network. It is often part of a DoS attack.An evil twin attack is a rogue wireless access point set up to be nearly identical to a legitimate access point. SSID cloaking is a weak security measure designed to hide the broadcasting of a wireless network?s service set identifier. MAC spoofing is an attempt to impersonate another host by using its MAC address.

Question 53

Which of the following is a variant of a phishing attack, where a phishing e-mail is sent to a high-value target instead of on a mass scale to all employees? A) Whaling B) Spear phishing C) Vishing D) Pharming

Answer 53

A) Whaling Whaling is a social engineering attack that targets people in high-value positions, such as senior executives. It is a form of a phishing attack.Spear phishing involves targeting a particular type of user, regardless of rank in the organization, and basing the attack on more detailed, in-depth information in order to convince the target that the phishing e-mail is actually valid. Vishing is a form of phishing attack that takes place over Voice-over-IP (VoIP) telephone systems. Pharming is a form of DNS attack.

Question 54

Which of the following secure file copy protocols is used over an SSL or TLS connection? A) FTPS B) FTP C) SCP D) SFTP

Answer 54

A) FTPS FTPS is a secure version of the non-secure FTP protocol and is used over SSL or TLS connections to ensure security when transferring files to or from an Internet-based host.FTP is a non-secure protocol used to copy files to and from Internet-based hosts. SCP is a secure copy protocol used to copy files securely to and from a networked host, and it uses SSH. SFTP is a secure file transfer protocol used to copy files to and from an Internet-based host, and it also uses SSH.

Question 55

Which of the following statements best describes a buffer overflow attack? A) An attack that exceeds the memory allocated to an application for a particular function, causing it to crash B) An attack that uses unexpected numerical results from a mathematical operation to overflow a buffer C) An attack on a database through vulnerabilities in the web application, usually in the user input fields D) An attack that involves sending malicious XML content to a web application, taking advantage of any lack of input validation and XML parsing

Answer 55

A) An attack that exceeds the memory allocated to an application for a particular function, causing it to crash A buffer overflow attack is an attack that exceeds the memory allocated to an application for a particular function, causing it to crash.While similar to a buffer overflow attack, answer B describes an integer overflow attack, which uses unexpected numerical results from a mathematical operation to overflow a buffer. An SQL injection attack is an attack on a database through vulnerabilities in the Web application, usually in user input fields. An XML injection attack involves sending malicious XML content to a Web application, taking advantage of any lack of input validation and XML parsing.

Question 56

Which of the following is a key agreement protocol used in public key cryptography? A) ECDH B) RSA C) AES D) SHA-2

Answer 56

A) ECDH Elliptic Curve Diffie-Hellman (ECDH) is a key exchange protocol used in public key cryptography. It is used to negotiate, agree upon, and establish a secure session between two parties.RSA (Rivest-Shamir-Adleman) is the most common public-private key generation algorithm used in public key cryptography. It is used to generate a public and private key pair. AES is the Advanced Encryption Standard, and it is not used in public key cryptography; it is a symmetric key cryptography algorithm. SHA-2 is the second iteration of the Secure Hashing Algorithm and is used to generate message digests for plaintext. It is not used in public key cryptography to exchange keys or establish secure sessions.

Question 57

Which of the following types of public key cryptography uses a web of trust model? A) RSA B) PGP C) DHE D) AES

Answer 57

B) PGP Pretty good privacy, or PGP, is commonly used between individuals or small groups of people, and it normally does not require a public key infrastructure. It uses a web of trust model, which means that each individual has to be able to trust every other individual who uses PGP to encrypt and decrypt data sent and received by them.RSA is the de-facto key generation protocol used in public key cryptography, and it is normally used in a public key infrastructure type of environment. Diffie-Hellman Exchange (DHE) is a key negotiation and agreement protocol that is used to exchange keys and establish a secure communications session. AES is a symmetric key protocol not used in public key cryptography.

Question 58

Which of the following authentication protocols uses a series of tickets to authenticate users to resources, as well as timestamps to prevent replay attacks? A) Kerberos B) MS-CHAP C) EAP D) SESAME

Answer 58

A) Kerberos Kerberos is an authentication protocol used in Windows Active Directory. It uses a series of tickets and timestamps to authenticate individuals and prevent replay attacks.MS-CHAP is a Microsoft version of the Challenge Handshake Authentication Protocol, used in earlier versions of Windows. It uses challenges and password hashes to authenticate individuals. EAP, the Extensible Authentication Protocol, is an authentication framework that can use several other protocols for secure access across both wired and wireless networks. SESAME (Secure European System for Applications in a Multivendor Environment) is a European-developed authentication protocol that can provide for single sign-on capability. It is not widely used and does not use tickets for authentication.

Question 59

All of the following are considered duties of a first responder to an incident, except: A) Secure the scene B) Notifying and coordinating with senior management and law enforcement officials C) Determining the initial scope and impact of the incident D) Notifying the incident response team

Answer 59

B) Notifying and coordinating with senior management and law enforcement officials Notifying and coordinating with senior management and law enforcement officials is normally the job of a senior leader within the incident response team.The primary job of a first responder is to secure the scene. They are also responsible for notifying the incident response team and initially determining the scope, seriousness, and impact of the incident.

Question 60

What size WEP key did the original IEEE 802.11b specification use? A) 512 bit B) 256 bit C) 128 bit D) 64 bit

Answer 60

D) 64 bit WEP key sizes are 64-bits (40-bit key and 24-bit initialization vector) or 128-bit (104-bit key and 24-bit initialization vector). The 802.11b standard called for a 64-bit key.Neither 512-bit nor 256-bit are valid WEP key sizes. The original 802.11b standard called for a 64-bit key; the 128-bit key was developed after this standard was issued.

Question 61

Which of the following encryption protocols uses RC4 with small initialization vector sizes? A) WPA2 B) WEP C) WPA D) 802.1x

Answer 61

B) WEP WEP is a legacy wireless encryption protocol that has been determined to be very weak and easily broken. It uses the RC4 streaming protocol and weak initialization vectors (24-bit) to encrypt data on wireless networks.WPA2 is an advanced encryption protocol that uses AES. WPA was an interim protocol used to correct some of WEP?s weaknesses. It uses the TKIP protocol. 802.1X is a port-based authentication method, not a wireless encryption protocol.

Question 62

Which of the following details the specific access levels that individuals or entities may have when interacting with objects? A) Access approval list B) Access control list C) Metadata table D) Rule-based access control

Answer 62

B) Access control list An access control list (ACL) is a physical or logical list that details specific access levels individuals or entities may have when interacting with objects. An ACL is also used on network devices to determine how traffic from various users can enter and exit a network device and access internal hosts.Access approval lists and metadata tables are distractors and are not valid terms. Rule-based access control is an access control model based upon various access control rules that apply to users, objects, and actions.

Question 63

What type of organizations are the main users of an interconnection service agreement (ISA)? A) Telecommunications companies B) End users C) Government entities D) Satellite providers

Answer 63

C) Government entities Government entities use ISAs as a more formal document than an MOU because contracts are not the primary method of agreements between entities of the same governement. Telecoms use Interconnection Agreements which are not ISAs.

Question 64

What size is the initialization vector (IV) for the Temporal Key Integrity Protocol (TKIP), used in the WPA standard? A) 24 bit B) 48 bit C) 64 bit D) 128 bit

Answer 64

B) 48 bit The IV size for TKIP is 48-bit.The only valid IV size for TKIP is 48-bit.

Question 65

Which of the following is the biggest risk involved in cloud computing? A) Lack of control B) Lack of accountability C) Lack of responsibility D) Lack of availability

Answer 65

A) Lack of control Lack of control over data and the infrastructure is probably the greatest risk to cloud computing.Accountability and responsibility can be established through effective security controls and well-written service-level agreements. Cloud computing usually increases availability of data for users, since it is typically built on highly available, redundant infrastructures.

Question 66

A virtual LAN (VLAN) offers which of the following advantages for network security? (Choose two.) A) Allows logical segmentation of hosts B) Creates broadcast domains C) Allows different security policies to be applied to different hosts D) Allows physical segmentation of hosts by IP subnet

Answer 66

A) Allows logical segmentation of hosts C) Allows different security policies to be applied to different hosts VLANs offer the security advantage of logically segmenting hosts, and they allow different segments to receive different security policies.VLANs help eliminate broadcast domains, not create them. VLANs use logical segmentation, not physical segmentation.

Question 67

Which of following is the process of marking a photo or other type of media with geographical location information using the GPS of a mobile device? A) Remote management B) Geolocation C) Geofencing D) Geotagging

Answer 67

D) Geotagging Geotagging is the practice of marking media files, such as pictures and video, with relevant information such as geographic location (using the GPS features of the mobile device) and time. This information can be used by security professionals to track where and how a mobile device has been used.Remote management is the overall process of remotely managing and monitoring mobile devices that are used to connect to the corporate infrastructure. Geolocation is the use of a device?s GPS features to determine device location, to locate points of interest, and to gather other useful information. Although it can be used to geotag media, it is not the same as geotagging. Geofencing is the use of geolocation features to ensure that a mobile device does not leave specific areas of corporate property.

Question 68

All of the following are characteristics of hashing, except: A) Hashes are cryptographic representations of plaintext B) Hashes produce fixed-length digests for variable-length text C) Hashing can be used to protect data integrity D) Hashes are decrypted using the same algorithm and key that encrypted them

Answer 68

D) Hashes are decrypted using the same algorithm and key that encrypted them Hashes are produced from one-way mathematical functions and cannot be decrypted.All of these are characteristics of hashing.

Question 69

All of the following are methods that can be used to detect unauthorized (rogue) hosts connected to the network, except: A) DHCP logs B) MAC filtering logs C) NAC device logs D) Switch logs

Answer 69

B) MAC filtering logs MAC addresses can be spoofed, so examining MAC address on filtering logs may not provide any indication of whether a host is authorized or not.All of these are valid methods of detecting rogue hosts that connect to the network.

Question 70

Which of the following is the simplest form of disaster recovery exercise? A) Tabletop exercise B) Documentation review C) Full-scale test D) Walkthrough test

Answer 70

B) Documentation review The documentation review is the simplest form of test. In this type of test, the business continuity plan, disaster recovery plan, and associated documents are reviewed by relevant personnel including managers, recovery team members, and anyone else who may have responsibilities directly affecting plans.A tabletop exercise is a type of group review. In a full-scale test, all personnel are usually involved and may actually conduct activities as they would during a real incident. This type of test is more complex and normally requires extensive resources, such as people and equipment, so it is typically conducted infrequently. In a walkthrough test, team members go through the motions of fulfilling the responsibilities and conducting the activities required during an incident or disaster.

Question 71

You have a server that is used for Domain Name System (DNS) queries. You find that it has several open ports, and you intend to close all of the unnecessary ports on the server. The server is listening on ports 22, 25, 53, and 80. Which port must be left open to continue to use DNS functionality? A) 22 B) 25 C) 53 D) 80

Answer 71

C) 53 DNS uses TCP and UDP port 53, so this port should be left open. All other unnecessary ports should be closed.Port 22 is used by SSH. Port 25 is used by SMTP. Port 80 is used by HTTP.

Question 72

Which of the following is not a characteristic of effective signage? A) Signage should follow national and international standards for symbols and colors B) Signage should be placed in well-lit areas and not obstructed by large objects C) Signage should warn intruders away from restricted areas D) Signage should indicate security checkpoints to report to in the event of an emergency requiring evacuation

Answer 72

D) Signage should indicate security checkpoints to report to in the event of an emergency requiring evacuation Signage should indicate the location and route to emergency evacuation exits, not security checkpoints, in the event of an emergency requiring evacuation.All of these are valid characteristics of good signage.

Question 73

Which of the following is an example of a trusted OS? A) Windows 10 B) Ubuntu Linux C) Windows server D) SELinux

Answer 73

D) SELinux SELinux is the only example, from the answers given, of a trusted operating system.These operating systems are not considered trusted operating systems, although they can be hardened to varying degrees.

Question 74

Which of the following concepts should be the most important consideration when determining how to budget properly for security controls? A) Asset identification B) Threat of natural disasters C) Risk likelihood and impact D) Qualitative costs

Answer 74

C) Risk likelihood and impact The risk likelihood and impact should directly determine how much you budget for controls to prevent the occurrence of risk.Asset identification does not require analysis of cost. Risk likelihood and impact are more accurate than threat of natural disaster and qualitative costs in determining how much a solution will actually cost.

Question 75

Which of the following are two characteristics of strong passwords? (Choose two.) A) Authentication methods B) Password length C) Use of additional character space D) Encryption strength

Answer 75

B) Password length C) Use of additional character space Password length and the use of additional character space are two important characteristics of password strength and complexity.Neither authentication methods nor encryption strength directly affects password strength.

Question 76

Which of the following is normally required to convert and read coded messages? A) Symmetric key B) Codebook C) Algorithm D) Asymmetric key

Answer 76

B) Codebook Codes are representations of an entire phrase or sentence, where ciphers are encrypted on a character-by-character basis. A codebook is needed to translate coded phrases into their true plaintext meanings.A symmetric key is used to encrypt ciphers, not codes, as are algorithms and asymmetric keys.

Question 77

The corporate IT manager wants you to implement a process that separates corporate apps from personal apps on mobile devices. Which of the following techniques will enable you to do this? A) Whitelisting B) Containerization C) Sandboxing D) Blacklisting

Answer 77

C) Sandboxing Sandboxing separates applications from one another and does not allow them to share execution, user, or data space.Whitelisting enables an administrator to determine which applications and other software the user is allowed to install and execute. Containerization is a technique used to separate different sensitivities of data, such as corporate and personal data on a mobile device. Blacklisting is a method that enables administrators to restrict users from installing and executing certain applications.

Question 78

Which of the following is an older form of attack where a malicious/compromised Web site places invisible controls on a page, giving users the impression they are clicking some safe item that actually is an active control for something malicious? A) Header manipulation B) Man-in-the-middle browser C) Clickjacking D) Buffer overflow

Answer 78

C) Clickjacking Clickjacking is almost never seen anymore as it's easy to detect this type of attack.Header manipulation means to add malicious information to HTTP headers. A man-in-the-browser attack means to add malicious information or code, often by using a Trojan horse. Buffer overflows attempt to access privilege escalation by forcing a buffer to cause an error.

Question 79

Which of the following formal management efforts is designed to remediate security flaws discovered in applications and operating systems? A) Upgrade management B) Account management C) Patch management D) Change management

Answer 79

C) Patch management Patch management is the formal effort designed to remediate vulnerabilities and other software flaws on a regular basis.Managing upgrades is part of a formal change and configuration management process. Account management is the process of provisioning and maintaining user accounts on the system. Change management is a formalized process that involves both long-term and short-term infrastructure changes, as well as configuration changes to hosts and networks.

Question 80

For which of the following should employees receive training to establish how they are to treat information of differing sensitivity levels? A) Clean desk policy B) Protection of personally identifiable information on social media C) Information classification D) Data disposal

Answer 80

C) Information classification An organization's information classification policy not only outlines what level of security protections certain data receives, but it also serves to instruct employees on how to treat sensitive data.Clean desk policies, which instruct employees to not leave sensitive data unattended, as well as data disposal policies, can be included in the information and data handling policies, but these are very specific instances and don?t cover all information or all scenarios where an employee would be in a position to treat data with care. Protection of personally identifiable information on social media would be part of an organization?s social media policy.

Question 81

Which of the following two ways typically separate network hosts for security purposes? (Choose two.) A) Geographically B) Physically C) Logically D) Functionally

Answer 81

B) Physically C) Logically Networks are typically separated for security purposes either physically, logically, or both. Physical separation involves separating network hosts by connecting them to different devices. Logical separation involves separating them through segmented IP subnetworks.Separating network hosts either geographically or functionally does not contribute to security.

Question 82

Which of the following is a point-in-time backup of certain key configuration settings of a virtual machine, allowing the VM to be restored back to that point in time if it suffers a crash or other issue? A) Snapshot B) Differential backup C) Incremental backup D) System state backup

Answer 82

A) Snapshot A snapshot is a quick backup of critical configuration files, used by the hypervisor to restore the virtual machine back to its point-in-time status should it become unstable or suffer any other issues.Differential and incremental backups apply to entire systems and are used to back up only files that have changed since the last full backup. The system state backup is a Microsoft Windows type of backup that backs up critical files used by the operating system to restore it in the event of a system crash or other issue. Virtual machines can make use of all of these other types of backups, but they are not used by the hypervisor to restore the VM itself.

Question 83

Which of the following attacks might involve an attacker attempting to enter a facility with arms full of boxes, in an attempt to gain sympathy and have someone open the door for him or her? A) Shoulder surfing B) Tailgating C) Dumpster diving D) Impersonation

Answer 83

B) Tailgating A tailgating person might use some sort of creative pretext to convince someone to open the door and allow him or her to enter without proper identification.Neither shoulder surfing nor dumpster diving are attempts to enter a facility. Impersonation could be used to enter a facility, but it is not being used to do so in this case.

Question 84

Which of the following statements best defines the recovery point objective (RPO)? A) The RPO is the minimum amount of data the organization is expected to lose during a disaster or an incident B) The RPO is the maximum amount of time the organization can afford to be down from normal processing C) The RPO is the maximum allowable amount of data (measured in gigabytes) that the organization can afford to lose during a disaster or an incident D) The RPO is the maximum allowable amount of data (measured in terms of time) that the organization can afford to lose during a disaster or an incident E) Virus

Answer 84

D) The RPO is the maximum allowable amount of data (measured in terms of time) that the organization can afford to lose during a disaster or an incident The RPO is the maximum allowable amount of data (measured in terms of time) that the organization can afford to lose during a disaster or an incident.The RPO is the maximum amount of data, not the minimum, that can be lost during a disaster or an incident. RPO refers to data that can be lost, not time itself. RPO is measured in time, not gigabytes.

Question 85

If Bobby and Dawn exchange confidential encrypted e-mail messages using public and private key pairs, which of the following keys would Bobby need to encrypt confidential data in an e-mail message sent to Dawn? A) Bobby's public key B) Dawn's private key C) Bobby's private key D) Dawn's public key

Answer 85

D) Dawn's public key To encrypt information that Dawn can decrypt, using public and private key pairs, Bobby would need Dawn?s public key to encrypt data that only her private key can decrypt.Encrypting with Bobby?s public key would allow only Bobby?s private key to decrypt the data, and only he would possess that. Bobby would not possess Dawn?s private key to encrypt data to her, and then only her public key, which everyone would have, would be able to decrypt it, so there would be no confidentiality involved. Bobby would not use his private key to encrypt data, because only his public key can decrypt it, and everyone could have that key, so no confidentiality would be assured.

Question 86

Which type of cloud service is usually operated by a third-party provider that sells or rents ?pieces? of the cloud to different entities, such as small businesses or large corporations, to use as they need? A) External B) Private C) Community D) Public

Answer 86

D) Public A public cloud is operated by a third-party provider who leases space in the cloud to anyone who needs it.An external cloud is not a valid type of cloud and could be a public, private, or community cloud. A private cloud is for use only by one organization and is usually hosted by that organization?s infrastructure. A community cloud is for use by similar organizations or communities, such as universities or hospitals, that need to share common data.

Question 87

Which of the following are typically created for a single Web browsing session and are generally not carried across different sessions? A) Persistent cookies B) Session cookies C) Locally shared objects D) Flash cookies

Answer 87

B) Session cookies Session cookies are used for a single Web browsing session only and are generally not carried across Web sessions.Persistent cookies are saved and used between various Web sessions. Locally shared objects, also called flash cookies, are used for Web sites that use Adobe Flash content, and they can be persistent.

Question 88

Which of the following network management protocols uses agents that respond to queries to report its status to a central program manager? A) SMTP B) SNMP C) SHTTP D) SSH

Answer 88

B) SNMP The Simple Network Management Protocol (SNMP) uses SNMP agents that respond to queries to report their status to a central program manager.These protocols are not used to manage network devices.

Question 89

Fabian's new load balancer has a number of scheduling options and he's trying to decide the one to use. He wants to schedule load balancing such that the load balancer assigns to each server in order, then returns to the first server. What is this form of scheduling? A) Round robin B) Affinity C) On demand D) First come

Answer 89

A) Round robin Round robin is a turn-based scheduling method where jobs are assigned to servers in sequential order.Affinity scheduling means that the load balancer keeps a client's sessions connected to the server that's keeping the session. On demand and First come are meaningless terms created from the depths of your test writer's mind.