pReview Flashcards
Which type of attack is primarily intended to disrupt the availability of critical business functions?
Man-in-the-middle
Denial-of-service
Eavesdropping
Covert channel
Denial-of-service
Classify each attack method in relation to its direct impact on the CIA triad.
Answer options may be used more than once or not at all. Confidentiality, Integrity, or Availability.
Key logger
DNS poisoning
Covert channels
DDoS
Key logger - Confidentiality
DNS poisoning - Integrity
Covert channels - Confidentiality
DDoS - Availability
A security administrator has configured a small keysize to protect the VPN.
Which security objective does this affect?
Confidentiality
Availability
Authentication
Integrity
Confidentiality
A laptop has been stolen, and the data has been seen for sale on the darknet.
Which process could have protected the confidentiality of the data?
BIOS password
Hard drive encryption
Two-factor authentication
Host-based IDS
Hard drive encryption
When browsing to a financial website, a user receives an error on the browser that points to the certificate on the website. The user reviews the certificate and maps it to a known certificate authority.
Why did the user need to perform these actions?
To validate client authenticity
To establish a trust relationship
To monitor communications
To ensure connection is available and reliable
To establish a trust relationship
A team of scientists is working on a secure project. The network administrator needs to configure a network for the team that is not routable from the Internet. A firewall is protecting the scientists’ network and is using network address translation (NAT) to translate the internal IP addresses to public IP addresses.
Which IP address should the network administrator configure on the inside interface of the firewall?
- 131.162.1
- 14.15.16
- 32.255.1
- 169.255.12
10.14.15.16
An ad hoc network design team has just finished a presentation on the latest updates to the organization’s network infrastructure. The team ensured that plenty of redundancy has been built in and bottlenecks have been eliminated.
Which security objective has the team bolstered through these improvements?
Integrity
Availability
Confidentiality
Non-repudiation
Availability
A company has recently implemented a new email encryption system that uses public key infrastructure (PKI). The company is now requiring all employees to sign and encrypt internal communication. An employee wants to send a digitally signed message to the IT director.
What does the IT director use to decode the employee’s signature under the new system?
The employee’s public key The IT director’s password The IT director’s private key The IT director’s public key The employee’s password The employee’s private key
The employee’s public key
An administrator at a small office is tasked with supporting a new time clock that has been installed on the network. The outsourced company managing the time clock states that the connection protocol it uses with the clock is encrypted, but it needs to allow incoming connections from the Internet.
Which action should allow the outsourced company to securely manage the time clock with a minimal amount of configuration effort?
- Setting up a port forward on the firewall from the outsourced company to the time clock
- Configuring a virtual private network (VPN) between the outsourced company and the small office
- Creating an access rule on the firewall allowing the clock to connect to the outsourced company
- Creating a transparent forward proxy to allow the encrypted protocol to traverse the Internet
- Setting up a port forward on the firewall from the outsourced company to the time clock
A small nonprofit company has received several legacy wireless access points (APs) as a donation. The security administrator discovers that the encryption protocol the devices use is not very secure. The encryption key can be discovered by a malicious hacker in only a few minutes. After discussions with other security professionals, the administrator learns the APs can implement a key protocol that can change the encryption key every few seconds and provide a per-packet verification at each side of the communication.
Which security measure is the key protocol implemented to protect?
Confidentiality of the key Availability of the key Accountability of the key Privacy of the key Integrity of the key
Integrity of the key
A recently terminated employee from accounting used several widely available programs in an amateur attempt to exploit a company’s database.
Which term describes the terminated employee?
White hat hackers
Black hat hackers
Hacktavists
Script kiddies
Script kiddies
An organization has recently undergone a period of growth, both in terms of business operations and personnel. The network infrastructure has kept pace, growing to accommodate the new size and structure. Mapping and auditing of the expanded network needs to be done. One of the first findings is that the router has permissive rights to all unassigned ports.
What is this finding an example of?
A threat
A good security practice
A vulnerability
An opportunity
A vulnerability
A company has been the target of multiple social engineering attacks and is implementing a new mandatory security awareness training program to reduce the risk of a future compromise. The security administrator is mainly concerned with the following attack vectors:
Spoofed emails containing fake password reset links aimed at harvesting employees’ passwords Phone calls to the helpdesk by a malicious user pretending to be an employee needing a password reset A malicious user tailgating while impersonating a contractor to steal employees’ mobile devices
What are the two vulnerabilities that the company needs to address to meet the above requirements?
Choose 2 answers
Disgruntled employees Weak passwords Compromised email system Untrained users Lack of secure access control
Untrained users
Lack of secure access control
An email link takes a user to an online store. After clicking the link, the user is redirected to a spoofed online store.
Which type of attack is occurring?
SQL injection
Cross-site scripting
Session hijacking
Distributed denial-of-service
Cross-site scripting
Which device is responsible for performing stateful packet inspection on traffic traversing connected segments?
Screening router
VPN appliance
Layer 3 switch
Firewall
Firewall
Which device is Layer 7 aware and provides both filtering of unwanted source IP traffic from accessing a network and policy on which ports may be used?
Packet filter firewall
IPSec VPN
Application firewall
Circuit firewall
Application firewall
A software circuit firewall is on the network providing protection for a web server. There is a cross-site scripting vulnerability on the web server.
How will the software circuit firewall react to an exploit of this vulnerability?
- It will filter based solely on initial session setup.
- It will filter traffic at each layer of the OSI model.
- It will be restricted to protecting against low-volume attacks.
- It will protect against application vulnerabilities.
- It will filter based solely on initial session
During preproduction testing, a key security control is found to be missing. This oversight inadvertently allows users to view data they are not authorized to access. Upon review of the initial security requirements, it was stated that authentication, authorization, and accounting (AAA) of users was required in the design of the system.
What occurred during the systems development life cycle (SDLC) that caused this problem?
- AAA requirements were not clear in the system security requirements.
- Penetration testing was not performed during the implementation phase.
- Identity and access management (IAM) assessments were not conducted to ensure authentication was enforced during the testing phase.
- No objective security reviews were conducted to ensure security requirements were being met during the development phase.
- No objective security reviews were conducted to ensure security requirements were being met during the development phase.
Many of the devices a company uses are stand-alone, third-party appliances. While the appliances are evaluated for security concerns at the time of purchase, many have reached the end of their support and will need to be replaced soon.
What should a security administrator do to protect these assets before they are disposed of and replaced?
Use a defense-in-depth strategy
Implement security through obscurity
Follow a strict compliance methodology
Develop custom, in-house patches
Use a defense-in-depth strategy
During the initiation phase of the systems development life cycle (SDLC), an administrator is working on a new system that will support remote access to the organization’s disaster recovery environment. As part of the effort, the administrator is attempting to calculate the bandwidth required to support systems identified in the business impact analysis.
Why is the calculation of required bandwidth vital to the tenets of security?
- The organization will not have the desired level of availability without sufficient bandwidth.
- Failure to provide adequate bandwidth will be a violation of the Internet service provider’s service level agreement.
- The integrity of critical data will be compromised without sufficient bandwidth.
- Limited bandwidth will impact the organization’s ability to cut over to a hot site.
- The organization will not have the desired level of availability without sufficient bandwidth.
A technician is configuring the security features of new, built-in-house software. After configuring the application, the technician tests the new security controls.
At which phase of the systems development life cycle (SDLC) process is the technician operating?
Implementation
Initiation
Deployment
Operation
Implementation
In the diagram provided, three network zones containing servers are depicted. As the security architect, only one host intrusion sensor and one network intrusion sensor will be allowed in the design.
Where should the sensors be deployed to maximize detection of threats against this organization’s extranet implementation?
- Host-based Intrusion Detection System (HIDS) on the DB server and Network Intrusion Prevention System (NIPS) in the LAN
- HIDS on the DB server and NIPS in the DMZ
- HIDS on the app server and NIPS in the LAN
- HIDS on the laptop and NIPS in the DMZ
- HIDS on the web server and NIPS in the DMZ
- HIDS on the web server and NIPS in the DMZ
An information security project manager has been tasked with implementing a new system designed to detect and respond to network security threats to user workstations as well as systems in a screened subnet. As part of the configuration, the project team will implement a new network topology.
Which network topoly should the project team implement?
- Intrusion prevention system (IPS) along with sensors in the demilitarized zone (DMZ) and local area network (LAN)
- IPS along with sensors in the wide are network (WAN) and LAN
- IPS along with sensors in the metropolitan area network (MAN) and multiprotocol label switching (MPLS)
- Intrusion detection system (IDS) along with sensors in the LAN and DMZ
- IDS along with sensors in the DMZ and network address translation (NAT)
- Intrusion prevention system (IPS) along with sensors in the demilitarized zone (DMZ) and local area network (LAN)
A security administrator receives an intrusion detection system (IDS) alert identifying suspicious traffic on the network between two sites. In order to identify whether the traffic was malicious or not, the administrator enables a packet capture both inside and outside of one site’s firewall. While monitoring the internal packet captures, the administrator determines that a rogue IP address is generating a lot of address resolution protocol (ARP) traffic. Further monitoring of the external packet capture reveals that the secure sockets layer (SSL) certificate that certain clients were using was changed to a self-signed certificate.
Which type of attack is occurring, based on the packet captures?
Rogue access point
DNS poisoning
Cross-site scripting
Man-in-the-middle
Man-in-the-middle
As a fundamental concept of network security, backups are vital to incident recovery. A security administrator has been tasked with reporting on the pros and cons of various backup/recovery technologies and is preparing a list of these technologies.
Match the advantages and disadvantages with each backup/recovery technology to assist the security administrator.
Answer options may be used more than once or not at all. Select your answer from the pull-down list.
Online/Offline storage
Prompts (Advantages)
Offers access to data from any Internet connection
Better option when faced with possible major catastrophes affecting connectivity
Provides for quick recoveries while controlling the physical/logical information
Prompts (Disadvantages)
Puts data on someone else’s hardware
Requires rented/leased space for storage
Subject to physical threats under the organizations control
- Offers access to data from any Internet connection
- Better option when faced with possible major catastrophes affecting connectivity
- Provides for quick recoveries while controlling the physical/logical information
- Puts data on someone else’s hardware
- Requires rented/leased space for storage
- Subject to physical threats under the organizations control
Online storage - Offers access to data from any Internet connection
Offsite storage - Better option when faced with possible major catastrophes affecting connectivity
Onsite storage - Provides for quick recoveries while controlling the physical/logical information
Online storage - Puts data on someone else’s hardware
Offsite storage - Requires rented/leased space for storage
Onsite storage - Subject to physical threats under the organizations control
A company is concerned about employee usernames and passwords being obtained through phishing campaigns.
Which emerging technology should the company employ to keep this from happening?
Cloud computing
ITIL
Permissioning
Tokens
Tokens
