Practice Test SYO - 701 General Security Concepts Flashcards
Felicia wants to deploy an encryption solution that will protect files in motion as they are copied between file shares as well as at rest, and also needs it to support granular, per‐user security. What type of solution should she select?
Partition encryption
File encryption
Full‐disk encryption
Record‐level encryption
B. File encryption meets all of the needs described. Full‐disk encryption is easier to deploy and manage but does not protect individual files in motion and does not effectively support multiuser scenarios. Partition‐level encryption has the same challenges, albeit at a partition rather than full‐disk level. Record‐level encryption is typically used in databases to protect individual records or entries.
Valerie wants to use a certificate to handle multiple subdomains for her website, including the sales.example.com and support.example.com subdomains. What type of certificate should she use?
A self‐signed certificate
A root of trust certificate
A CRL certificate
A wildcard certificate
D. Wildcard certificates are used to handle multiple subdomains with a single certificate. A self‐signed certificate will not be recognized by browsers and other services, creating confusion for customers. Root of trust certificates and CRL certificates are not types of certificates.
What information is analyzed during a gap analysis?
Control objectives and controls intended to meet the objectives
Physically separate networks and their potential connection points
Compensating controls and the controls they are replacing
Security procedures and the policies they are designed to support
A. Gap analysis considers control objectives and the controls that are intended to meet the objectives.
Susan’s team has recommended an application restart for a production, customer‐facing application as part of an urgent patch due to a security update. What technical implication is the most common concern when conducting an application restart?
Application configuration changes caused by the restart
Whether the patch will properly apply
Lack of security controls during the restart
The downtime during the restart
D. In most production environments downtime is the primary concern when considering an application restart. Many application architectures are designed to allow restarts of individual systems or services without creating an outage or downtime. Configuration changes should not be created by a restart, patches generally apply properly, and security controls should be in place throughout the process.
Using a tool like git is most frequently associated with what critical change management process?
Having a backout plan
Stakeholder analysis
Version control
Standard operating procedures (SOPs)
C. Organizations frequently use tools like git to build repositories that support their need for version control. Backout plans might note that you need to return to the prior version but will need to include how to do so. Stakeholder analysis and SOPs are not specifically supported by or improved by using git.
Jacob is concerned that the password used for one of his organization’s services is weak, and he wants to make it harder to crack by making it harder to test possible keys during a brute‐force attack. What is this technique called?
Master keying
Key stretching
Key rotation
Passphrase armoring
B. Key stretching makes potentially weak keys more resistant to brute‐forcing and often involves using a hash or block cipher repeatedly to make the original value harder to crack. Key rotation is the process of changing keys on a periodic basis to limit the impact of potential exposure. Master keying and passphrase armoring are not commonly used concepts for information security, although master keys are used for physical locks.
Log monitoring is an example of what control category?
Technical
Managerial
Operational
Physical
C. Operational controls like log monitoring, change management processes, and vulnerability management are all put in place to support managing and using technology in a secure manner.
Rick wants to make offline brute‐force attacks against his password file very difficult for attackers. Which of the following is not a common technique to make passwords harder to crack?
Use of a salt
Use of a pepper
Use of a purpose‐built password hashing algorithm
Encrypting password plain text using symmetric encryption
D. Retaining the actual password is not a best practice, and thus encrypting password plain text is not a common technique to make passwords harder to crack. Since the application would need the cryptographic key to read the passwords, anybody who had access to that key could decrypt the passwords. Using a salt, a pepper, and a cryptographic hashing algorithm designed for passwords are all common best practices to prevent offline brute‐force attacks.
Diffie–Hellman and RSA are both examples of what important encryption‐related solution?
Rekeying
Certificate revocation protocols
Key exchange algorithms
Key generation algorithms
C. Both Diffie–Hellman and RSA are key exchange algorithms designed to securely allow key exchange between users or systems that have not previously communicated.
Sally wants to ensure that her change management process includes a procedure for what to do if the change fails. What should she create to handle this possibility?
An impact analysis
A backout plan
A regression test
A maintenance window
B. Backout plans document what to do to return to a state prior to the change being made and are designed to be implemented if the change fails. They may involve undoing changes, restoring from backups, or taking other steps and they must contain an appropriate level of detail to ensure that the change can be undone. An impact analysis looks at the potential impact of a change, regression testing ensures that old issues are not introduced in new updates, and maintenance windows are scheduled to allow for downtime or other maintenance activities with appropriate communications, staffing, and other needed elements.
Carol wants to obfuscate data that is contained in her database. She wants to be able to refer to the data elements without having the actual data exposed. What type of obfuscation option should she select?
Tokenization
Encryption
Data masking
Data randomization
A. Tokens replace data with a value that is linked specifically to the data, allowing it to be referenced and used without the field being exposed. Encryption is not used for this purpose, data masking hides elements of a data field like digits from a credit card number, and data randomization is not an obfuscation method.
Charles wants to reduce the threat scope of compromised credentials. What type of the following security controls is best suited to meeting this need?
Single sign‐on
Federation
Zero trust
Multifactor authentication (MFA)
C. Zero trust designs implement continuous verification, which is an effective control used to limit the threat scope of compromised credentials. While multifactor authentication can be a useful control in this circumstance, a fully implemented zero‐trust design will provide greater control than just MFA alone. Single sign‐on and federation are both likely to increase threat scope in a compromised credential scenario.
What key is used to decrypt information sent by another individual between two people using public key encryption?
The recipient’s private key
The recipient’s public key
The sender’s private key
The sender’s public key
A. The sender uses the receiver’s public key to encrypt the message, then the receiver uses their private key to decrypt the message. This ensures that the receiver is the only person who can decrypt a message sent using public key encryption.
Greg wants to implement a version control system to ensure that changes are made in ways that will not cause problems for his organization’s critical software. Which of the following is not a common feature of version control systems designed for software source code?
Atomic operations
File locking
Regression testing
Tagging and labeling
C. Version control systems track versions but don’t do testing themselves. Atomic operations ensure that actions like commits don’t overwrite other commits in progress. File locking allows a developer to check out a file while it is being worked on, and tagging and labeling helps developers track files and versions.
What hardware component is used to generate, store, and manage cryptographic keys?
A CPU
A NSA
A TPM
A CCA
C. A TPM, or trusted platform module, is a hardware‐based, cryptographic processor that is used to generate, store, and manage cryptographic keys. It is also used to help ensure platform integrity by allowing boot validation processes to occur in a secure manner. A CPU is the main processor for a system, NSA is the National Security Agency, and a CCA is a chosen ciphertext attack, a type of attack against cryptographic systems where the attacker can cause a cryptographic system to encrypt known text for analysis.
Chris wants to check to see if a certificate has been revoked. What protocol can he use to validate the current status of a certificate?
TLS
OCRS
SSL
OCSP
D. The Online Certificate Status Protocol (OCSP) is used to validate certificate status, including checking to see if the certificate is on a certificate revocation list (CRL). TLS is Transport Layer Security, a protocol used to encrypt data in transit between systems that relies on cryptographic certificates, but it is not used to validate the status of certificates on a CRL. Despite SSL itself being outmoded, the term SSL is commonly used to refer to TLS—but here, neither TLS nor SSL is the right option. OCRS was made up for this question.
Brian’s organization uses a process where a secure module boots systems, then monitors them as each boot stage proceeds. It validates each signed boot stage and reports on whether the boot process was correct or not when complete. What is the secure module used to verify these stages called?
B. A root of trust–based secure boot process validates each signed component as it starts and ensures that the trusted components are all loaded as part of the boot process. Changes to the components are reported as exceptions, meaning that the boot process cannot be properly verified or trusted. Secure initiation manager, boot hash, cryptographic boot manager were made up for this question.
A vulnerability scan shows that an embedded device that Alice is responsible for has a vulnerability. She knows the vendor is no longer in business and that there is no updated firmware or software update for the device. To resolve the issue, Alice places a firewall between the device and the rest of the network and creates rules that prevent the vulnerable service from being available to other devices. What type of control has Alice deployed?
Alice has deployed a compensating control since she cannot apply controls like patching, configuration, or updates. Directive controls provide formal directions to staff, detective controls detect issues rather than preventing them directly, and procedural controls are not a type of control type used on the Security+ exam.
Jason knows that his Apple system uses a separate portion of its SoC (system on chip) to store keys and biometric information. What is this specialized component called?
A TPM
A HSM
A secure enclave
A screened subnet
C. Apple devices use a specialized, separate coprocessor that uses encrypted memory and storage as well as dedicated cryptographic functions called a secure enclave. This is distinct from a TPM or HSM, and a screened subnet is a networking concept for a space that will be exposed to the less secure zones while needing to remain secure.
Jack knows that there are three common types of database encryption. Which of the following is not a common type of database encryption?
Sensitivity‐based encryption
Transparent data encryption
Field‐level encryption
Column‐level encryption
A. Transparent data encryption, field‐level, and column‐level encryption are all common types of database encryption. Sensitivity‐based encryption is not and was made up for this question.
Renee wants to ensure that her logs support nonrepudiation. What should she do to ensure this?
Encrypt, then hash the logs.
Hash the logs and then digitally sign them.
Digitally sign the log file, then encrypt it.
Hash, then encrypt the logs.
B. Calculating a cryptographic hash allows the log’s hash to be compared against copies to validate that they match. Digitally signing the hash ensures that it can be verified to be the original. Encrypting the log does not allow it to be verified against an original. Without a digital signature, a hash does not meet Renee’s requirement for nonrepudiation.
What are considerations like database and network connectivity, authentication system access, and network time availability considered in the context of change management processes?
Allowed services
Standard operating procedures
Denied services
Dependencies
D. Database and network connectivity, authentication system access, and network time availability are all common dependencies that must be considered when making changes. Applications and services may fail to start properly if these dependencies are not available when they attempt to start.
What role does the policy engine play in a zero‐trust environment?
It creates new administrative policies based on user behavior.
It grants access based on policies created by administrators and based on security systems data.
It enforces policies by monitoring connections between clients and servers.
It suggests new administrative policies based on usage patterns for adoption by the organization.
B. Policy engines decide whether to grant access to resources based on policies created by administrators and based on data provided by tools like endpoint detection and response tools, threat intelligence feeds, and security information and event management tools. It does not create or suggest administrative policies, and it does not directly enforce policies—that occurs at a policy enforcement point, typically through a zero‐trust agent on the client and at the resource or service side.
Damian issues the following command on his Linux server:
openssl req -new -newkey rsa:2048 -nodes -keyout exampleserver.key -out exampleserver.csr
What has he done?
Damian has created a certificate signing request, which he can submit to a certificate authority (CA).
