Practice Test Mistakes Flashcards
Which of the following best describes a typical process for building and implementing an Information Security Continuous Monitoring program as described by NIST Special Publication 800-137?
A. Define, establish, implement, analyze and report, respond, review, and update
B. Design, build, operate, analyze, respond, review, revise
C. Prepare, detect and analyze, contain, respond, recover, report
D. Define, design, build, monitor, analyze, react, revise
A.
NIST SP 800-137 outlines the process for organizations that are establishing, implementing, and maintaining an ISCM as define, establish, implement, analyze and report, respond, review, and update. Prepare, detect and analyze, contain, respond, recover, report is an incident response plan, and the others do not match the NIST process.
During a penetration test of her organization, Kathleen’s IPS detects a port scan that has the URG, FIN, and PSH flags set and produces an alarm. What type of scan is the penetration tester attempting?
A. A SYN scan
B. A TCP flag scan
C. An Xmas scan
D. An ACK scan
C.
A TCP scan that sets all or most of the possible TCP flags is called a Christmas tree, or Xmas, scan since it is said to “light up like a Christmas tree” with the flags. A SYN scan would attempt to open TCP connections, whereas an ACK scan sends packets with the ACK flag set. There is no such type of scan known as a TCP flag scan.
Which one of the following is not a technique used by virus authors to hide the existence of their virus from antimalware software?
A. Stealth
B. Multipartitism
C. Polymorphism
D. Encryption
B.
Multipartite viruses use multiple propagation mechanisms to defeat system security controls but do not necessarily include techniques designed to hide the malware from antivirus software. Stealth viruses tamper with the operating system to hide their existence. Polymorphic viruses alter their code on each system they infect to defeat signature detection. Encrypted viruses use a similar technique, employing encryption to alter their appearance and avoid signature detection mechanisms.
Which of the following is not a valid LDAP DN (distinguished name)?
A. cn=ben+ou=sales
B. ou=example
C. cn=ben,ou=example;
D. ou=example,dc=example,dc=com+dc=org
C.
LDAP distinguished names are made up of zero or more comma-separated components known as relative distinguished names. cn=ben,ou=example; ends with a semicolon and is not a valid DN. It is possible to have additional values in the same RDN by using a plus sign between then.
Gordon is concerned about the possibility that hackers may be able to use the Van Eck radiation phenomenon to remotely read the contents of computer monitors in his facility. What technology would protect against this type of attack?
A. TCSEC
B. SCSI
C. GHOST
D. TEMPEST
D.
The TEMPEST program creates technology that is not susceptible to Van Eck phreaking attacks because it reduces or suppresses natural electromagnetic emanations.
By default, in what format does OpenLDAP store the value of the user Password attribute?
A. In the clear
B. Salted and hashed
C. MD5 hashed
D. Encrypted using AES256 encryption
A.
By default, OpenLDAP stores the user Password attribute in the clear. This means that ensuring that the password is provided to OpenLDAP in a secure format is the responsibility of the administrator or programmer who builds its provisioning system.
Which one of the following laws requires that communications service providers cooperate with law enforcement requests?
A. ECPA
B. CALEA
C. Privacy Act
D. HITECH Act
B.
The Communications Assistance to Law Enforcement Act (CALEA) requires that all communications carriers make wiretaps possible for law enforcement officials who have an appropriate court order.
At point A in the diagram, the client sends the username and password to the KDC. How is the username and password protected?
A. 3DES encryption
B. TLS encryption
C. SSL encryption
D. AES encryption
D.
The client in Kerberos logins uses AES to encrypt the username and password prior to sending it to the KDC.
What LDAP authentication mode can provide secure authentication?
A. Anonymous
B. SASL
C. Simple
D. S-LDAP
B.
The Simple Authentication and Security Layer (SASL) for LDAP provides support for a range of authentication types, including secure methods. Anonymous authentication does not require or provide security, and simple authentication can be tunneled over SSL or TLS but does not provide security by itself. S-LDAP is not an LDAP protocol.
Ben’s team is attempting to categorize a transaction identification issue that is caused by use of a symmetric key shared by multiple servers. What STRIDE category should this fall into?
A. Information disclosure
B. Denial of service
C. Tampering
D. Repudiation
D.
Since a shared symmetric key could be used by any of the servers, transaction identification problems caused by a shared key are likely to involve a repudiation issue. If encrypted transactions cannot be uniquely identified by server, they cannot be proved to have come from a specific server.
Which one of the following stakeholders is not typically included on a business continuity planning team?
A. Core business function leaders
B. Information technology staff
C. CEO
D. Support departments
C.
While senior management should be represented on the BCP team, it would be highly unusual for the CEO to fill this role personally.
Neal is working with a DynamoDB database. The database is not structured like a relational database but allows Neal to store data using a key-value store. What type of database is DynamoDB?
A. Relational database
B. Graph database
C. Hierarchical database
D. NoSQL database
D.
A key-value store is an example of a NoSQL database that does not follow a relational or hierarchical model like traditional databases. A graph database is another example of a NoSQL database, but it uses nodes and edges to store data rather than keys and values.
Tom enables an application firewall provided by his cloud infrastructure as a service provider that is designed to block many types of application attacks. When viewed from a risk management perspective, what metric is Tom attempting to lower?
A. Impact
B. RPO
C. MTO
D. Likelihood
D.
Installing a device that will block attacks is an attempt to lower risk by reducing the likelihood of a successful application attack.
Which one of the following terms accurately describes the Caesar cipher?
A. Transposition cipher
B. Block cipher
C. Shift cipher
D. Strong cipher
C.
The Caesar cipher is a shift cipher that works on a stream of text and is also a substitution cipher. It is not a block cipher or a transposition cipher. It is extremely weak as a cryptographic algorithm.
What type of security vulnerability are developers most likely to introduce into code when they seek to facilitate their own access, for testing purposes, to software they developed?
A. Maintenance hook
B. Cross-site scripting
C. SQL injection
D. Buffer overflow
A.
Maintenance hooks, otherwise known as backdoors, provide developers with easy access to a system, bypassing normal security controls. If not removed prior to finalizing code, they pose a significant security vulnerability if an attacker discovers the maintenance hook.
Jim would like to identify compromised systems on his network that may be participating in a botnet. He plans to do this by watching for connections made to known command-and-control servers. Which one of the following techniques would be most likely to provide this information if Jim has access to a list of known servers?
A. Netflow records
B. IDS logs
C. Authentication logs
D. RFC logs
A.
Netflow records contain an entry for every network communication session that took place on a network and can be compared to a list of known malicious hosts. IDS logs may contain a relevant record, but it is less likely because they would only create log entries if the traffic triggers the IDS, as opposed to netflow records, which encompass all communications. Authentication logs and RFC logs would not have records of any network traffic.
Google’s identity integration with a variety of organizations and applications across domains is an example of which of the following?
A. PKI
B. Federation
C. Single sign-on
D. Provisioning
B.
Google’s federation with other applications and organizations allows single-sign on as well as management of their electronic identity and its related attributes. While this is an example of SSO, it goes beyond simple single sign-on. Provisioning provides accounts and rights, and a public key infrastructure is used for certificate management.
Robin recently conducted a vulnerability scan and found a critical vulnerability on a server that handles sensitive information. What should Robin do next?
A. Patching
B. Reporting
C. Remediation
D. Validation
D.
Once a vulnerability scanner identifies a potential problem, validation is necessary to verify that the issue exists. Reporting, patching, or other remediation actions can be conducted once the vulnerability has been confirmed.
Steve has been tasked with implementing a network storage protocol over an IP network. What storage-centric converged protocol is he likely to use in his implementation?
A. MPLS
B. FCoE
C. SDN
D. VoIP
B.
Fiber Channel over Ethernet allows Fiber Channel communications over Ethernet networks, allowing existing high-speed networks to be used to carry storage traffic. This avoids the cost of a custom cable plant for a Fiber Channel implementation. MPLS, or Multiprotocol label Switching, is used for high performance networking; VoIP is Voice over IP; and SDN is Software-Defined Networking.
Which of the following tasks are not performed by a system owner per NIST SP 800-18?
A. Develops a system security plan
B. Establishes rules for appropriate use and protection of data
C. Identifies and implements security controls
D. Ensures that system users receive appropriate security training
B.
The data owner sets the rules for use and protection of data. The remaining options all describe tasks for the system owner, including implementation of security controls.
Jim configures his LDAP client to connect to an LDAP directory server. According to the configuration guide, his client should connect to the server on port 636. What does this indicate to Jim about the configuration of the LDAP server?
A. It requires connections over SSL/TLS.
B. It supports only unencrypted connections.
C. It provides global catalog services.
D. It does not provide global catalog services.
A.
Port 636 is the default port for LDAP-S, which provides LDAP over SSL or TLS, thus indicating that the server supports encrypted connections. Since neither port 3268 nor 3269 is mentioned, we do not know if the server provides support for a global catalog.
Which one of the following systems assurance processes provides an independent third-party evaluation of a system’s controls that may be trusted by many different organizations?
A. Certification
B. Definition
C. Verification
D. Accreditation
C.
The verification process is similar to the certification process in that it validates security controls. Verification may go a step further by involving a third-party testing service and compiling results that may be trusted by many different organizations. Accreditation is the act of management formally accepting an evaluating system, not evaluating the system itself.
Ben wants to prevent or detect tampering with data. Which of the following is not an appropriate solution?
A. Hashes
B. Digital signatures
C. Filtering
D. Authorization controls
C.
Filtering is useful for preventing denial of service attacks but won’t prevent tampering with data. Hashes and digital signatures can both be used to verify the integrity of data, and authorization controls can help ensure that only those with the proper rights can modify the data.
Which of the following statements is true about heuristic-based antimalware software?
A. It has a lower false positive rate than signature detection.
B. t requires frequent definition updates to detect new malware.
C.It has a higher likelihood of detecting zero-day exploits than signature detection.
D. It monitors systems for files with content known to be viruses.
C.
Heuristic-based anti-malware software has a higher likelihood of detecting a zero-day exploit than signature-based methods. Heuristic-based software does not require frequent signature updates because it does not rely upon monitoring systems for the presence of known malware. The trade-off with this approach is that it has a higher false positive rate than signature detection methods.
Which one of the following might a security team use on a honeypot system to consume an attacker’s time while alerting administrators?
A. Honeynet
B. Pseudoflaw
C. Warning banner
D. Darknet
B.
A pseudoflaw is a false vulnerability in a system that may attract an attacker. A honeynet is a network of multiple honeypots that creates a more sophisticated environment for intruders to explore. A darknet is a segment of unused network address space that should have no network activity and, therefore, may be easily used to monitor for illicit activity. A warning banner is a legal tool used to notify intruders that they are not authorized to access a system.
Which California law requires conspicuously posted privacy policies on commercial websites that collect the personal information of California residents?
A. The Personal Information Protection and Electronic Documents Act
B. The California Online Privacy Protection Act
C. California Online Web Privacy Act
D. California Civil Code 1798.82
B.
The California Online Privacy Protection Act (COPPA). requires that operators of commercial websites and services post a prominently displayed privacy policy if they collect personal information on California residents.
The Personal Information Protection and Electronic Documents Act is a Canadian privacy law, while California Civil Code 1798.82 is part of the set of California codes that requires breach notification. The California Online Web Privacy Act does not exist.
Under the Digital Millennium Copyright Act (DMCA), what type of offenses do not require prompt action by an Internet service provider after it receives a notification of infringement claim from a copyright holder?
A. Storage of information by a customer on a provider’s server
B. Caching of information by the provider
C. Transmission of information over the provider’s network by a customer
D. Caching of information in a provider search engine
C.
The DMCA states that providers are not responsible for the transitory activities of their users. Transmission of information over a network would qualify for this exemption. The other activities listed are all nontransitory actions that require remediation by the provider.
A software company developed two systems that share information. System A provides information to the input of System B, which then reciprocates by providing information back to System A as input. What type of composition theory best describes this practice?
A. Cascading
B. Feedback
C. Hookup
D. Elementary
B.
The feedback model of composition theory occurs when one system provides input for a second system and then the second system provides input for the first system. This is a specialized case of the cascading model, so the feedback model is the most appropriate answer.
What challenge is most common for endpoint security system deployments?
A. Compromises
B. The volume of data
C. Monitoring encrypted traffic on the network
D. Handling non-TCP protocols
B.
Endpoint security solutions face challenges due to the sheer volume of data that they can create. When each workstation is generating data about events, this can be a massive amount of data. Endpoint security solutions should reduce the number of compromises when properly implemented, and they can also help by monitoring traffic after it is decrypted on the local host. Finally, non-TCP protocols are relatively uncommon on modern networks, making this a relatively rare concern for endpoint security system implementations.
Ben’s development team needs to address an authorization issue using STRIDE, resulting in an elevation of privilege threat. Which of the following controls is most appropriate to this type of issue?
A. Auditing and logging is enabled.
B. RBAC is used for specific operations.
C. Data type and format checks are enabled.
D. User input is tested against a whitelist.
B.
Microsoft’s STRIDE threat assessment model places threats into one of six categories:
Spoofing—threats that involve user credentials and authentication, or falsifying legitimate communications
Tampering—threats that involve the malicious modification of data
Repudiation—threats that cause actions to occur that cannot be denied by a user
Information disclosure—threats that involve exposure of data to unauthorized individuals
Denial of service—threats that deny service to legitimate users
Elevation of privilege—threats that provide higher privileges to unauthorized users
Using role-based access controls (RBACs) for specific operations will help to ensure that users cannot perform actions that they should not be able to. Auditing and logging can help detect abuse but won’t prevent it, and data type, format checks, and whitelisting are all useful for preventing attacks like SQL injection and buffer overflow attacks but are not as directly aimed at authorization issues.
What issue is the validation portion of the NIST SP 800-88 sample certificate of sanitization (shown here) intended to help prevent?
A. Destruction
B. Reuse
C. Data remanence
D. Attribution
C.
Validation processes are conducted to ensure that the sanitization process was completed, avoiding data remanence. A form like this one helps to ensure that each device has been checked and that it was properly wiped, purged, or sanitized. This can allow reuse, does not prevent destruction, and does not help with attribution, which is a concept used with encryption to prove who created or sent a file.
Which one of the following testing methodologies typically works without access to source code?
A. Dynamic testing
B. Static testing
C. White box testing
D. Code review
A.
Dynamic testing of software typically occurs in a black box environment where the tester does not have access to the source code. Static testing, white box testing, and code review approaches all require access to the source code of the application.
Which of the following is not a single sign-on implementation?
A. Kerberos
B. ADFS
C. CAS
D. RADIUS
D.
Kerberos, Active Directory Federation Services (ADFS), and Central Authentication Services (CAS) are all SSO implementations. RADIUS is not a single sign-on implementation, although some vendors use it behind the scenes to provide authentication for proprietary SSO.
During a third-party audit, Jim’s company receives a finding that states, “The administrator should review backup success and failure logs on a daily basis, and take action in a timely manner to resolve reported exceptions.” What is the biggest issue that is likely to result if Jim’s IT staff need to restore from a backup?
A. They will not know if the backups succeeded or failed.
B. The backups may not be properly logged.
C. The backups may not be usable.
D. The backup logs may not be properly reviewed.
C.
The audit finding indicates that the backup administrator may not be monitoring backup logs and taking appropriate action based on what they report, thus resulting in potentially unusable backups. Issues with review, logging, or being aware of the success or failure of backups are less important than not having usable backups.
Which data role is tasked with granting appropriate access to staff members?
A. Data processors
B. Business owners
C. Custodians
D. Administrators
D.
Administrators have the rights to assign permissions to access and handle data. Custodians are trusted with day-to-day data handling tasks. Business owners are typically system or project owners, and data processors are systems used to process data.
What application development method uses the cycle shown here?
A. Waterfall
B. Spiral
C. Agile
D. RAD
D.
Rapid Application Development, or RAD, focuses on fast development and the ability to quickly adjust to changing requirements. RAD uses four phases: requirements planning, user design, construction, and cutover.
Which mapping correctly matches data classifications between nongovernment and government classification schemes?
A. Top Secret – Confidential/Proprietary
Secret – Private
Confidential – Sensitive
B. Secret – Business confidential
Classified – Proprietary
Confidential – Business Internal
C. Top Secret – Business sensitive
Secret – Business internal
Confidential – Business proprietary
D. Secret – Proprietary
Classified – Private
Unclassified – Public
A.
While many nongovernment organizations create their own classification schemes, a common model with levels that align with the U.S. government’s classification labels is shown here. In the given options, B and D do not match the U.S. government’s Top Secret, Secret, Confidential scheme, and C incorrectly matches business proprietary data with confidential data as well as Top Secret data with business sensitive data. Business internal is often another term for business sensitive, meaning that it is used to match two classifications!
What type of log is shown in the figure?
A. Firewall log
B. Change log
C. Application log
D. System log
C.
The file clearly shows HTTP requests, as evidenced by the many GET commands. Therefore, this is an example of an application log from an HTTP server.
Alex has been with the university he works at for over 10 years. During that time, he has been a system administrator and a database administrator, and he has worked in the university’s help desk. He is now a manager for the team that runs the university’s web applications. Using the provisioning diagram shown here, answer the following questions.
Alex has access to B, C, and D. What concern should he raise to the university’s identity management team?
A. The provisioning process did not give him the rights he needs.
B. He has excessive privileges.
C. Privilege creep may be taking place.
D. Logging is not properly enabled.
C.
As Alex has changed roles, he retained access to systems that he no longer administers. The provisioning system has provided rights to workstations and the application servers he manages, but he should not have access to the databases he no longer administers. Privilege levels are not specified, so we can’t determine if he has excessive rights. Logging may or may not be enabled, but it isn’t possible to tell from the diagram or problem.
Norm is starting a new software project with a vendor that uses an SDLC approach to development. When he arrives on the job, he receives a document that has the sections shown here. What type of planning document is this?
A. Functional requirements
B. Work breakdown structure
C. Test analysis report
D. Project plan
B.
The work breakdown structure (WBS) is an important project management tool that divides the work done for a large project into smaller components. It is not a project plan because it does not describe timing or resources. Test analyses are used during later phases of the development effort to report test results. Functional requirements may be included in a work breakdown structure, but they are not the full WBS.
During a web application vulnerability scanning test, Steve runs Nikto against a web server he believes may be vulnerable to attacks. Using the Nikto output shown here, answer the following questions.
Why does Nikto flag the /test directory?
A. The /test directory allows administrative access to PHP.
B. It is used to store sensitive data.
C. Test directories often contain scripts that can be misused.
D. It indicates a potential compromise.
C.
Test directories often include scripts that may have poor protections or may have other data that can be misused. There is not a default test directory that allows administrative access to PHP. Test directories are not commonly used to store sensitive data, nor is the existence of a test directory a common indicator of compromise.
During a web application vulnerability scanning test, Steve runs Nikto against a web server he believes may be vulnerable to attacks. Using the Nikto output shown here, answer the following questions.
Why does Nikto identify directory indexing as an issue?
A. It lists files in a directory.
B. It may allow for XDRF.
C. Directory indexing can result in a denial-of-service attack.
D. Directory indexing is off by default, potentially indicating compromise.
A.
Directory indexing may not initially seem like an issue during a penetration test, but simply knowing the name and location of files can provide an attacker with quite a bit of information about an organization, as well as a list of potentially accessible files. XDRF is not a type of attack, and indexing is not a denial-of-service attack vector. Directory indexing being turned on is typically either due to misconfiguration or design, or because the server was not properly configured at setup, rather than being a sign of attack.
During a web application vulnerability scanning test, Steve runs Nikto against a web server he believes may be vulnerable to attacks. Using the Nikto output shown here, answer the following questions.
Nikto lists OSVDB-877, noting that the system may be vulnerable to XST. What would this type of attack allow an attacker to do?
A. Use cross-site targeting.
B. Steal a user’s cookies.
C. Counter SQL tracing.
D. Modify a user’s TRACE information.
B.
Cross-site tracing (XST) leverages the HTTP TRACE or TRACK methods and could be used to steal a user’s cookies via cross-site scripting (XSS). The other options are not industry terms for web application or web server attacks or vulnerabilities.
