Q17 Flashcards
Which of the following is the best response after detecting and verifying an incident? A. Contain it. B. Report it. C. Remediate it. D. Gather evidence.
A. Contain it.
Which of the following are denial-of-service attacks? (Choose three.) A. Teardrop B. Smurf C. Ping of death D. Spoofing
A. Teardrop
B. Smurf
C. Ping of death
A web server hosted on the Internet was recently attacked, exploiting a vulnerability in the operating system. The operating system vendor assisted in the incident investigation and verified the vulnerability was not previously known. What type of attack was this? A. Botnet B. Zero-day exploit C. Denial-of-service D. Distributed denial-of-service
B. Zero-day exploit
Of the following choices, which is the most common method of distributing malware? A. Drive-by downloads B. USB flash drives C. Ransomware D. Unapproved software
A. Drive-by downloads
Of the following choices, what indicates the primary purpose of an intrusion detection system (IDS)? A. Detect abnormal activity B. Diagnose system failures C. Rate system performance D. Test a system for vulnerabilities
A. Detect abnormal activity
Which of the following is true for a host-based intrusion detection system (HIDS)?
A. It monitors an entire network.
B. It monitors a single system.
C. It’s invisible to attackers and authorized users.
D. It cannot detect malicious code.
B. It monitors a single system.
Which of the following is a fake network designed to tempt intruders with unpatched and unprotected security vulnerabilities and false data? A. IDS B. Honeynet C. Padded cell D. Pseudo flaw
B. Honeynet
Of the following choices, what is the best form of anti-malware protection?
A. Multiple solutions on each system
B. A single solution throughout the organization
C. Anti-malware protection at several locations
D. One-hundred-percent content filtering at all border gateways
C. Anti-malware protection at several locations
When using penetration testing to verify the strength of your security policy, which of the following is not recommended?
A. Mimicking attacks previously perpetrated against your system
B. Performing attacks without management knowledge
C. Using manual and automated attack tools
D. Reconfiguring the system to resolve any discovered vulnerabilities
B. Performing attacks without management knowledge
What is used to keep subjects accountable for their actions while they are authenticated to a system? A. Authentication B. Monitoring C. Account lockout D. User entitlement review
B. Monitoring
What type of a security control is an audit trail? A. Administrative B. Detective C. Corrective D. Physical
B. Detective
Which of the following options is a methodical examination or review of an environment to ensure compliance with regulations and to detect abnormalities, unauthorized occurrences, or outright crimes? A. Penetration testing B. Auditing C. Risk analysis D. Entrapment
B. Auditing
What can be used to reduce the amount of logged or audited data using nonstatistical methods? A. Clipping levels B. Sampling C. Log analysis D. Alarm triggers
A. Clipping levels
Which of the following focuses more on the patterns and trends of data than on the actual content? A. Keystroke monitoring B. Traffic analysis C. Event logging D. Security auditing
B. Traffic analysis
What would detect when a user has more privileges than necessary? A. Account management B. User entitlement C. audit Logging D. Reporting
B. User entitlement
