Practice Test 2 Flashcards
Which technology solution takes complex concepts and breaks them into simpler elements?
Deep Learning
Deep learning is a type of machine learning that de-constructs knowledge into a series of smaller, simpler parts. Complex concepts are broken down into simpler elements of knowledge so they can be used to interpret data.
A security engineer looks to change the Extensible Authentication Protocol (EAP) authentication method between client workstations and server systems. If the current solution uses the Protected Access credential, which EAP implementation does the engineer look to replace?
EAP with Flexible Authentication via Secure Tunneling (EAP-FAST)
EAP with Flexible Authentication via Secure Tunneling (EAP-FAST) uses a Protected Access Credential (PAC), which is generated for each user from the authentication server’s master key.
An engineer deploys a cloud access security broker (CASB) solution to mediate access to cloud services. The goal is for users’ local and cloud access to be in sync with one another. What solution describes the engineer’s deployment?
An API-based CASB brokers connections between the cloud service and the cloud consumer.
With an application programming interface (API), rather than placing a CASB appliance or host inline, an API-based CASB brokers connections between the cloud service and the cloud consumer.
Security experts look to implement protection methods against distributed denial-of-service (DDoS) attacks at data facilities. Blackhole routing is implemented for one of the critical systems. What have the experts achieved with this configuration?
Traffic intended for the system is dropped.
Blackhole Routing takes all the traffic intended for an endpoint and essentially drops it. This approach drops both legitimate and malicious traffic.
Network administrators look to harden a corporate network. Initial testing results in discovering that wireless signals from the private network extended further into a public area than expected. How have the administrators discovered this vulnerability?
Vulnerability scans
Vulnerability scans, such as a wireless scan, can identify the configuration and signal coverage of an organization’s wireless network, for example, to determine if the hardware is vulnerable to known attacks.
Security engineers are engaged in threat intelligence training. They are focused on understanding the overarching objectives, intentions, and broader goals of potential threat actors. Which type of threat intelligence predominantly discusses this aspect of adversarial motivation?
Strategic
Strategic threat intelligence is focused on the big picture leadership-focused information typically associated with reports. The information is used to help identify the motivations, capabilities, and intentions of various threat actors.
Tactical threat intelligence is focused on the tactics, techniques, and procedures (TTPs) of a threat actor.
Operational threat intelligence is collected from the organization’s infrastructure and includes logs and the information reported by SIEM platforms.
A security engineer utilizes the Extensible Authentication Protocol (EAP) between client workstations and server systems. If the solution uses public key certificates on both clients and servers, which EAP implementation does the engineer deploy?
EAP Transport Layer Security (EAP-TLS)
EAP Transport Layer Security (EAP-TLS) is one of the strongest types of authentication. An encrypted Transport Layer Security (TLS) tunnel is established between a client and a server using public-key certificates on the server and client.
A server engineer improves a virtual server’s performance by adding additional resources such as memory and more processor cores. The engineer has used which scaling type?
Vertical
By scaling vertically, additional resources are added to an individual system, such as adding processors, memory, and storage to an existing server.
A newly formed company has purchased .com, .cc, and .org domains to establish its presence online. The company would like to use a single certificate for all of the domains. Which field in a domain certificate can be used for this purpose?
Subject Alternative Name (SAN)
A certificate subject alternative name (SAN), provides a way to identify names other than what is identified in the common name (CN) so the certificate can be used with other domain names.
An attacker gains access to a sensitive shared folder. What might a security engineer configure to directly mitigate the problem?
Adjust ACL rules
Modifying access control list (ACL) rules using access rules can block or limit access to resources, such as blocking access to files and folders or blocking write access from specific accounts.
A critical system at an organization is placed on a subnet between two firewalls with one edge restricting access from a public network. Which solution protects this critical system?
By creating a screened subnet
A screened subnet uses two firewalls placed on either side of the DMZ. The edge firewall restricts traffic on the external/public interface and allows permitted traffic to the hosts in the DMZ.
When using a virtual private network (VPN) on a mobile device, which would provide always-on functionality?
Operating system
An operating system level VPN offers comprehensive protection of device traffic since they operate at a low level of the operating system and capture all device traffic as a result. OS level VPN can be configured to operate as “always-on.”
Some protocol security methods can provide data integrity while others can provide confidentiality as well. An engineer chooses to implement a solution that does both. Which specific protocol does the engineer use that will encrypt a packet?
Encapsulating Security Payload (ESP)
The Encapsulating Security Payload (ESP) provides confidentiality and/or authentication and integrity. The TCP header and payload from the original packet are encapsulated within ESP and then encrypted to provide confidentiality.
Which web traffic protection method is configured on an SSL/TLS web server to periodically obtain a time-stamped Online Certificate Status Protocol (OCSP) response from the certificate authority?
Certificate Stapling
Certificate stapling resolves certificate pinning issues by having a SSL/TLS web server periodically obtain a time-stamped OCSP response from the CA.
Management at a law firm asks that IT implement a warning system if files are copied from internal servers without proper authorization. What solution does IT configure to satisfy this requirement?
Data loss prevention (DLP)
Data loss prevention (DLP) products automate the discovery and classification of data types and enforce rules so that data is not viewed or transferred without a proper authorization.
Security engineers perform threat intelligence training. Which approach uses threat intelligence in a practical and actionable way?
Emulation
Emulation exercises help teams test and improve their skills and capabilities and also force the interpretation and use of threat intelligence in a practical and actionable way.
An organization performs a risk management exercise as it relates to server security. Experts examine a workflow that involves the replication of files from one server to another. The replication is found to not use any form of encryption for data. The experts document this finding during which phase of the exercise?
Identification of known vulnerabilities
Identification of any vulnerabilities for each function or workflow is useful in determining what risk exists and how to harden systems. Unencrypted data and communications is susceptible to an attack.
A security expert examines a server system for malicious processes. Which tool will the experts find helpful in determining dependencies for a process?
ldd
The ldd utility can be used to display a program’s dependencies. For example, issuing the command sudo ldd /sbin/poweroff displays all of the shared libraries required by the Linux poweroff command.
Developers test a newly developed software application for vulnerabilities by entering malformed data at data entry points. What vulnerability assessment method do the developers attempt with this approach?
Fuzz testing
Fuzz testing is a black-box testing method using specialty software tools designed to identify problems and issues with an application by purposely inputting malformed data.
Servers at a data center are now protected with a data loss prevention (DLP). A remediation policy is configured such that any user is prevented from copying files, but access to read any files remains. What remediation policy is in place?
Block
A block policy prevents users from copying the original file but they retain access to it. Users may or may not be alerted to the policy violation, but it will be logged as an incident by the management engine.
Users at an organization access sensitive data throughout the business day. The IT department has concerns that while the data is in volatile memory it is at risk of compromise. Which data state is the IT department concerned with?
Data in use
Data in use is the state when data is present in volatile memory, such as system RAM or CPU registers and cache. Data that may be in use include documents open in a word processing application.
A forensics team investigates a compromised server. The server is powered on and the team looks to do a live collection of real-time system information. Which tool does the team find suited for the task?
vmstat
The vmstat command-line utility is designed to display real-time information about system memory, running processes, interrupts, paging, and I/O statistics.
An engineer discovers that an attack occurred on a system via a backdoor through a connected application. What enabled this form of attack?
API
APIs provide the core mechanisms that enable the integration and orchestration of application integration. APIs can be exploited to gain access to protected features of the underlying platform or used to extract sensitive data.
An organization plans to configure several domain names to represent new product launches online. The organization goes through an extended validation process to prove its identity. What certificate feature is not possible when using extended validation?
Wildcard
Extended Validation (EV) is a process that requires more rigorous checks on the subject’s legal identity and control over the domain or software being signed. A drawback to EV certificates is that they cannot be issued for a wildcard domain.
