Professor Messer - Security+ SY0-701: Exam B Flashcards
What is the first step of the incident Response Plan?
Preparation
What is the second step of the incident Response Plan?
Detection
What is the third step of the incident Response Plan?
Analysis
What is the fourth step of the incident Response Plan?
Containment
What is the fifth step of the incident Response Plan?
Eradication
What is the sixth step of the incident Response Plan?
Recovery
What is the seventh step of the incident response plan?
Lesson Learned
What is Data in-transit?
Data in-transit moves across the network
Data at rest is…
Data at-rest is located on a storage device.
Data in-use is….
Data in-use is in the memory of a device.
A shipping company stores information in small regional warehouses
around the country. The company maintains an IPS at each warehouse to
watch for suspicious traffic patterns. Which of the following would BEST
describe the security control used at the warehouse?
❍ A. Deterrent
❍ B. Compensating
❍ C. Directive
❍ D. Detective
An IPS can detect, alert, and log an intrusion attempt. The IPS could also
be categorized as a preventive control, since it has the ability to actively
block known attacks.
Security Control: Deterrent
A deterrent discourages an intrusion attempt, but it doesn’t directly
prevent the access. An application splash screen or posted warning sign
would be categorized as a deterrent.
Security Control: Compensating
A compensating control can’t prevent an attack, but it can provide an
alternative when an attack occurs. For example, a compensating control
would include the re-imaging of a compromised server.
Security Control: Directive
Directive control types are guidelines offered to help direct a subject
towards security compliance. Training users on the proper storage of
sensitive files would be an example of a directive control.
A security engineer is preparing to conduct a penetration test of a thirdparty website. Part of the preparation involves reading through social
media posts for information about this site. Which of the following
describes this practice?
❍ A. Partially known environment
❍ B. OSINT
❍ C. Exfiltration
❍ D. Active reconnaissance
OSINT (Open Source Intelligence) describes the process of obtaining
information from open sources such as social media sites, corporate
websites, online forums, and other publicly available locations.
Partially known environment
A partially known environment describes how aware an attacker might be
about a test. The attacker may have access to some information about the
test, but not all information is disclosed.
Penetration test: Exfiltration
Exfiltration describes the theft of data by an attacker
Penetration test: Active Reconnaissance
Active reconnaissance would show some evidence of data gathering.
For example, performing a ping scan or DNS query wouldn’t exploit a vulnerability, but it would show that someone was gathering information
A company would like to orchestrate the response when a virus is
detected on company devices. Which of the following would be the
BEST way to implement this function?
❍ A. Active reconnaissance
❍ B. Log aggregation
❍ C. Vulnerability scan
❍ D. Escalation scripting
Escalation scripting
Scripting and automation can provide methods to automate or orchestrate
the escalation response when a security issue is detected.
Log aggregation
Log aggregation provides a method of centralizing evidence and log files
for reporting and future analysis.
Vulnerability scanning
A vulnerability scan will identify any known vulnerabilities that may be
associated with a system.
Buffer Overflow attack
A buffer overflow vulnerability is associated with application input that exceeds the expected input size. A buffer overflow would cause an
application to fail or perform unusually
Amplified DDoS
An amplified DDOS (Distributed Denial of Service) would attack a
service from many different devices and cause the service to be unavailable.
This attack sends specially crafted packets to maximize the amount of
traffic seen in the response. I
Penetration Methodology: Bench mark
Security benchmarks describe a set of best practices to apply to an application, operating system, or any other service.
Penetration Methodology: Passive reconnaissance
Passive reconnaissance is the process of gathering information from
publicly available sites, such as social media or corporate websites.
A manufacturing company produces radar used by commercial and
military organizations. A recently proposed policy change would allow the
use of mobile devices inside the facility. Which of the following would be
the MOST significant threat vector issue associated with this change in
policy?
❍ A. Unauthorized software on rooted devices
❍ B. Remote access clients on the mobile devices
❍ C. Out of date mobile operating systems
❍ D. Loss of intellectual property
Loss of intellectual property
The exfiltration of confidential information and intellectual property is
relatively simple with an easily transportable mobile phone. Organizations
associated with sensitive products or services must always be aware of the
potential for information leaks using files, photos, or video.
A technician at an MSP has been asked to manage devices on third-party
private network. The technician needs command line access to internal
routers, switches, and firewalls. Which of the following would provide the
necessary access?
❍ A. HSM
❍ B. Jump server
❍ C. NAC
❍ D. Air gap
A jump server is a highly secured device commonly used to access secure
areas of another network. The technician would first connect to the jump
server using SSH or a VPN tunnel, and then “jump” from the jump server
to other devices on the inside of the protected network. This would allow
technicians at an MSP (Managed Service Provider) to securely access
devices on their customer’s private networks.
HSM
An HSM (Hardware Security Module) is a secure method of
cryptographic key backup and hardware-based cryptographic offloading
