Sec+ Objective 4 Test Questions Flashcards
A company is creating a security policy for corporate mobile devices:
- All mobile devices must be automatically locked after a predefined time period.
- The location of each device needs to be traceable.
- All of the user’s information should be completely separate from company data.
Which of the following would be the BEST way to establish these security policy rules?
❍ A. Segmentation
❍ B. Biometrics
❍ C. COPE
❍ D. MDM
D. MDM
An MDM (Mobile Device Manager) provides a centralized management system for all mobile devices. From this central console, security administrators can set policies for many different types of mobile devices. (4.1)
A company has placed a SCADA system on a segmented network with limited access from the rest of the corporate network. Which of the following would describe this process?
❍ A. Load balancing
❍ B. Least privilege
❍ C. Data retention
❍ D. Hardening
D. Hardening
The hardening process for an industrial SCADA (Supervisory Control and Data Acquisition) system might include network segmentation, additional firewall controls, and the implementation of access control lists. (4.1)
What is SCADA?
Supervisory Control and Data Acquisition System. Also known as ICS, Industrial Control Systems. Basically large scale industrial networking. Various building controls talking to one another through the network. Managed usually at one computer.
A company is deploying a new application to all employees in the field. Some of the problems associated with this roll out include:
- The company does not have a way to manage the devices in the field
- Team members have many different kinds of mobile devices
- The same device needs to be used for both corporate and private use
Which of the following deployment models would address these concerns?
❍ A. CYOD
❍ B. SSO
❍ C. COPE
❍ D. BYOD
C. COPE
A COPE (Corporate-owned, Personally Enabled) device would solve the issue of device standardization and would allow the device to be used for both corporate access and personal use. (4.1)
A security administrator is configuring the authentication process used by technicians when logging into wireless access points and switches. Instead of using local accounts, the administrator would like to pass all login requests to a centralized database. Which of the following would be the BEST way to implement this requirement?
❍ A. COPE
❍ B. AAA
❍ C. IPsec
❍ D. SIEM
B. AAA
Using AAA (Authentication, Authorization, and Accounting) is a common method of centralizing authentication. Instead of having separate local accounts on different devices, users can authenticate with account information maintained in a centralized database. (4.1)
A company is installing access points in all of their remote sites. Which of the following would provide confidentiality for all wireless data?
❍ A. 802.1X
❍ B. WPA3
❍ C. RADIUS
❍ D. MDM
B. WPA3
WPA3 (Wi-Fi Protected Access 3) is an encryption protocol used on wireless networks. All data sent over a WPA3-protected wireless network will be encrypted. (4.1)
A security administrator has identified an internally developed application which allows modification of SQL queries through the web-based frontend. Which of the following changes would resolve this vulnerability?
❍ A. Store all credentials as salted hashes
❍ B. Verify the application’s digital signature
❍ C. Validate all application input
❍ D. Obfuscate the application’s source code
C. Validate all application input
Input validation would examine the input from the client and make sure that the input is expected and not malicious. In this example, validating the input would prevent any SQL (Structured Query Language) injection through the web front-end. (4.1)
In terms of application security, what is input validation?
Basically editing application code. Application developers perform input validation when information is going into their application. It ensures that any unexpected data that’s put into one of those inputs will not be interpreted by the application. They check to see what they’ve put into their apps matches what’s actually supposed to go in there.
A network administrator is viewing a log file from a web server:
https://www.example.com/?s=/Index/think/app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][0]=__HelloThinkPHP
Which of the following would be the BEST way to prevent this attack?
❍ A. Static code analyzer
❍ B. Input validation
❍ C. Allow list
❍ D. Secure cookies
B. Input validation
In this example, the attacker is attempting to use a remote code execution exploit. Input validation can be used to create a very specific filter of allowed input, and a strict validation process would have prevented the web server from processing this attack information. (4.1)
A system administrator has configured MAC filtering on their corporate access point, but access logs show unauthorized users accessing the network. Which of the following should the administrator configure to prevent future unauthorized use?
❍ A. Enable WPA3 encryption
❍ B. Remove unauthorized MAC addresses from the filter
❍ C. Modify the SSID name
❍ D. Modify the channel frequencies
A. Enable WPA3 encryption
A MAC (Media Access Control) address can be spoofed on a remote device, which means anyone within the vicinity of the access point can view and use legitimate MAC addresses. To ensure proper authentication, the system administrator can enable WPA3 (Wi-Fi Protected Access version 3) with a pre-shared key or 802.1X can be used to integrate with an existing authentication database. (4.1)
Which of the following deployment models would a company follow if they require individuals to use their personal phones for work purposes?
❍ A. CYOD
❍ B. MDM
❍ C. BYOD
❍ D. COPE
C. BYOD
BYOD (Bring Your Own Device) is a model where the employee owns the mobile device but can also use the same device for work. (4.1)
When decommissioning a device, a company documents the type and size of storage drive, the amount of RAM, and any installed adapter cards. Which of the following describes this process?
❍ A. Destruction
❍ B. Sanitization
❍ C. Certification
❍ D. Enumeration
D. Enumeration
Enumeration describes the detailed listing of all parts in a particular device. For a computer, this could include the CPU type, memory, storage drive details, keyboard model, and more. (4.2)
A company has deployed laptops to all employees, and each laptop is enumerated during each login. Which of the following is supported with this configuration?
❍ A. If the laptop hardware is modified, the security team is alerted
❍ B. Any malware identified on the system is automatically deleted
❍ C. Users are required to use at least two factors of authentication
❍ D. The laptop is added to a private VLAN after the login process
A. If the laptop hardware is modified, the security team
is alerted
The enumeration process identifies and reports on the hardware and software installed on the laptop. If this configuration is changed, an alert can be generated. (4.2)
A financial services company is headquartered in an area with a high occurrence of tropical storms and hurricanes. Which of the following would be MOST important when restoring services disabled by a storm?
❍ A. Disaster recovery plan
❍ B. Stakeholder management
❍ C. Change management
❍ D. Retention policies
A. Disaster recovery plan
A disaster recovery plan is a comprehensive set of processes for large-scale outages that affect the organization. Natural disasters, technology failures, and human-created disasters would be reasons to implement a disaster recovery plan. (4.2)
A finance company is legally required to maintain seven years of tax records for all of their customers. Which of the following would be the BEST way to implement this requirement?
❍ A. Automate a script to remove all tax information more than seven years old
❍ B. Print and store all tax records in a seven-year cycle
❍ C. Allow users to download tax records from their account login
❍ D. Create a separate daily backup archive for all applicable tax records
D. Create a separate daily backup archive for all applicable tax records
An important consideration for a data retention mandate is to always have access to the information over the proposed time frame. In this example, a daily backup would ensure tax information is constantly archived over a seven year period and could always be retrieved if needed. If data was inadvertently deleted from the primary storage, the backup would still maintain a copy. (4.2)
An internal audit has discovered four servers that have not been updated in over a year, and it will take two weeks to test and deploy the latest patches. Which of the following would be the best way to quickly respond to this situation in the meantime?
❍ A. Purchase cybersecurity insurance
❍ B. Implement an exception for all data center services
❍ C. Move the servers to a protected segment
❍ D. Hire a third-party to perform an extensive audit
C. Move the servers to a protected segment
Segmenting the servers to their own protected network would allow for additional security controls while still maintaining the uptime and availability of the systems. (4.3)
A security engineer runs a monthly vulnerability scan. The scan doesn’t list any vulnerabilities for Windows servers, but a significant vulnerability was announced last week and none of the servers are patched yet. Which of the following best describes this result?
❍ A. Exploit
❍ B. Compensating controls
❍ C. Zero-day attack
❍ D. False negative
D. False negative
A false negative is a result that fails to detect an issue when one actually exists. (4.3)
A company has just purchased a new application server, and the security director wants to determine if the system is secure. The system is currently installed in a test environment and will not be available to users until the roll out to production next week. Which of the following would be the BEST way to determine if any part of the system can be exploited?
❍ A. Tabletop exercise
❍ B. Vulnerability scanner
❍ C. DDoS
❍ D. Penetration test
D. Penetration test
A penetration test can be used to actively exploit potential vulnerabilities in a system or application. This could cause a denial of service or loss of data, so the best practice is to perform the penetration test during nonproduction hours or in a test environment. (4.3)
A security engineer is preparing to conduct a penetration test of a third party website. Part of the preparation involves reading through social media posts for information about this site. Which of the following describes this practice?
❍ A. Partially known environment
❍ B. OSINT
❍ C. Exfiltration
❍ D. Active reconnaissance
B. OSINT
OSINT (Open Source Intelligence) describes the process of obtaining information from open sources such as social media sites, corporate websites, online forums, and other publicly available locations. (4.3)
What is OSINT?
Publicly available information from a variety of sources that give information on the latest threats and attacks to watch out for on your systems.
Which of the following would a company use to calculate the loss of a business activity if a vulnerability is exploited?
❍ A. Risk tolerance
❍ B. Vulnerability classification
❍ C. Environmental variables
❍ D. Exposure factor
D. Exposure factor
An exposure factor describes a loss of value to the organization. For example, a network throughput issue might limit access to half of the users, creating a 50% exposure factor. A completely disabled service would calculated as a 100% exposure factor. (4.3)
What is exposure factor?
Usually represented as a percentage, it tells users how risky it is to have that vulnerability remain on your system. If it’s minor, the percentage will be small. If it’s major, the percentage will be high.
Which of the following would be a common result of a successful vulnerability scan?
❍ A. Usernames and password hashes from a server
❍ B. A list of missing software patches
❍ C. A copy of image files from a private file share
❍ D. The BIOS configuration of a server
B. A list of missing software patches
A vulnerability scan can identify vulnerabilities and list the patches associated with those vulnerabilities. (4.3)
An organization has received a vulnerability scan report of their Internet-facing web servers. The report shows the servers have multiple Sun Java Runtime Environment (JRE) vulnerabilities, but the server administrator has verified that JRE is not installed. Which of the following would be the BEST way to handle this report?
❍ A. Install the latest version of JRE on the server
❍ B. Quarantine the server and scan for malware
❍ C. Harden the operating system of the web server
❍ D. Ignore the JRE vulnerability alert
D. Ignore the JRE vulnerability alert
It’s relatively common for vulnerability scans to show vulnerabilities that don’t actually exist, especially if the scans are not credentialed. An issue that is identified but does not actually exist is a false positive, and it can be dismissed once the alert has been properly researched. (4.3)
A company is using SCAP as part of their security monitoring processes. Which of the following would BEST describe this implementation?
❍ A. Train the user community to better identify phishing attempts
❍ B. Present the results of an internal audit to the board
❍ C. Automate the validation and patching of security issues
❍ D. Identify and document authorized data center visitors
C. Automate the validation and patching of security issues
SCAP (Security Content Automation Protocol) focuses on the standardization of vulnerability management across multiple security tools. This allows different tools to identify and act on the same security criteria. (4.4)
What is SCAP?
Security Content Automation Protocol. The consolidation of vulnerabilities found by multiple firewalls, IPSs, vulnerability scanners, etc. into a single language, so that all of these devices are communicating and working together to find threats.
The security policies in a manufacturing company prohibit the transmission of customer information. However, a security administrator has received an alert that credit card numbers were transmitted as an email attachment. Which of the following was the MOST likely source of this alert message?
❍ A. IPS
❍ B. DLP
❍ C. RADIUS
❍ D. IPsec
B. DLP
DLP (Data Loss Prevention) technologies can identify and block the transmission of sensitive data across the network. (4.4)
What is DLP?
Data Loss Prevention. Looks for and stops running data you don’t want running on your network. If someone sends their social security number over the network, DLP stops it.
A security administrator receives a report each week showing a Linux vulnerability associated with a Windows server. Which of the following would prevent this information from appearing in the report?
❍ A. Alert tuning
❍ B. Application benchmarking
❍ C. SIEM aggregation
❍ D. Data archiving
A. Alert tuning
Our monitoring systems are not always perfect, and many require ongoing tuning to properly configure alerts and notifications of important events. (4.4)
A company has identified a compromised server, and the security team would like to know if an attacker has used this device to move between systems. Which of the following would be the BEST way to provide this information?
❍ A. DNS server logs
❍ B. Penetration test
❍ C. NetFlow logs
❍ D. Email metadata
C. NetFlow logs
NetFlow information can provide a summary of network traffic, application usage, and details of network conversations. The NetFlow logs will show all conversations from this device to any others in the network. (4.4)
What is NetFlow?
Gathers statistics and data from the raw traffic going across your network. Consists of a probe and a collector. The probe gathers data and then exports it back to the collector.
A newly installed IPS is flagging a legitimate corporate application as malicious network traffic. Which of the following would be the BEST way to resolve this issue?
❍ A. Disable the IPS signature
❍ B. Block the application
❍ C. Log all IPS events
❍ D. Tune the IPS alerts
D. Tune the IPS alerts
Each signature of an IPS can commonly be tuned to properly alert on a legitimate issue. Tuning the IPS can properly identify and block attacks and allow all legitimate traffic. (4.4)
