Security Flashcards
Quiz revision
Andrea is concerned that she is being lured to provide her financial institution’s credentials on an invalid site via a message she received. Which type of attack is most likely taking place?
A) MAC address spoofing
B) IP spoofing
C) data mining
D) email spoofing
An email spoofing attack is most likely taking place. Email spoofing occurs when an email header to make it look like the message came from a valid source, when in actuality it comes from someone hoping to gain access to your information or assets. These emails may end up in your spam folder. They often attempt to get users to open attachments and/or respond to their illegal solicitation. Spoofing can be tricky because it can appear real.
What is email Spoofing?
Email spoofing occurs when an email header to make it look like the message came from a valid source, when in actuality it comes from someone hoping to gain access to your information or assets. These emails may end up in your spam folder. They often attempt to get users to open attachments and/or respond to their illegal solicitation. Spoofing can be tricky because it can appear real.
What is IP Spoofing?
IP spoofing is a technique that hackers will use to gain unauthorized access to computers by using valid IP addresses making it appear to be from the valid trusted host. Upgrading your routers and using firewall protection can help alleviate IP spoofing.
MAC Address Spoofing
MAC address spoofing occurs when an attacker changes the MAC address of his computer to match that of a valid trusted host. This is the most often attack that occurs when MAC address filtering is deployed.
What does the NAC stand for and function?
A popular method for this is to deploy a network access control (NAC) server and the appropriate NAC policies. NAC basically provides network solutions that secure network devices attempting to access via a non-compliant device. If the device complies with the set policies, they are given full access based on the user’s permissions. But if the device does not comply with the policies, the device is given limited access and is usually quarantined from critical resources.
You need to access a shared folder named research$. Which fact is true about this shared folder?
A)It is hidden.
B)It is a local share.
C)It is an administrative share.
D)It is visible.
Because the shared folder ends with a dollar sign, you should know it has the following qualities:
It is hidden.
It requires administrative privileges to access.
A share that ends with a dollar sign ($) is not a local or administrative share. Local shares are created locally and usually have the icon of a hand in all versions of Windows. Local shares can be seen by all users on the network.
Administrative shares are not the only hidden objects. System files and folders are often hidden so that they do not appear when a standard user views a directory listing. System files and folders are assigned the hidden attribute to provide this security.
Which of the following wireless authentication methods separates authentication and authorization into two different processes?
A) Multifactor authentication
B) RADIUS
C) Single factor authentication
D) TACACS
The Terminal Access Controller Access-Control System (TACACS) protocol suite separates authentication and authorization into two different processes, with accounting as a third process.
You are instructing a new IT technician on securing networks and using permissions. What would you tell Graham that the default permission position should be?
A) explicit allow
B) implicit allow
C) implicit deny
D) explicit deny
The default permission position in a secure network should be implicit deny. This will ensure that if a user or group does not have an explicit allow permission configured, the access will default to an implicit deny. An implicit deny should be the last rule contained on any firewall because most firewalls do not default to this setting. This firewall rule is often defined with a Drop All statement. On Windows servers, the access control list (ACL) defaults to an implicit deny.
A hacker has called a company employee and learned the employee’s user name and password by posing as a member of corporate technical support.
Which type of attack has the company suffered?
A) social engineering
B) denial of service
C) brute force
D) Insider threat
The company has suffered a social engineering attack, in which a hacker posed as a company employee or contractor to gain information about a network from legitimate company employees. A hacker typically uses social engineering to gain user names and passwords or sensitive documents by non-technical means, such as posing as an employee or dumpster diving. A company can help protect itself from a social engineering attack by requiring employees to attend security awareness training, which is one of the most neglected aspects of network security. Often hackers will use flattery as a means to gain trust to obtain information.
You want to provide secure access to the research laboratory and ensure that only authorized persons can enter the laboratory’s server room. Which system does NOT provide an effective means of ensuring that only authorized persons can enter the server room?
A) biometric access control system
B) smart card system
C) swipe card system
D) single sign-on system
The single sign-on system does not provide an effective means of ensuring that only authorized persons can enter the server room. Single Sign-On (SSO) is used to provide access over a network and ensures security of data in a computer network. However, it does not ensure physical security of data and computers, and cannot be used to ensure that only authorized persons enter the laboratory’s server room.
Your organization issues an iPhone to every member of senior management. As dictated by the organizational security policy, you configure the iPhones with passcode locks and enable remote wipe.
A user from your organization contacts you that a company-issued iPhone has been lost. The iPhone contained confidential information. You need to remove all the data from this iPhone.
What should you do?
A) Log in to iTunes, and select Find My iPhone. Select the device from the Devices list, and click Lock.
B )Log in to iCloud.com, and select Find My iPhone. Select the device from the Devices list, and click Lock.
C) Log in to iCloud.com, and select Find My iPhone. Select the device from the Devices list, and click Erase iPhone.
D )Log in to iTunes, and select Find My iPhone. Select the device from the Devices list, and click Erase iPhone.
To remove all the data from the iPhone, you should log in to iCloud.com and select Find My iPhone. Then select the device from the Devices list and click Erase iPhone. This will perform a remote wipe on the lost device.
What is a smart card?
A) an electronic file that establishes your identity via a public key infrastructure (PKI) to complete transactions
B) a technology that measures a human characteristic for authentication
C) an electronic signature that can be used to prove the sender’s identity or a document’s signer
D) a hardware device that has an embedded microchip that contains authentication or security information
A smart card is a hardware device that has an embedded microchip that contains authentication or security information. Smart cards are inserted into computers or smart card readers to unlock access for a user. RFID is one technology used in smart cards.
You need to run a command or application that requires administrative privileges. What should you do?
A) Right-click the application and select Properties. Select the Run this program as an administrator option on the Compatibility tab.
B) Enter the command name in the search window, right-click the command when it displays, and select Run as administrator.
C) Any of these
D) Right-click the command prompt, select Run as administrator, and enter the command.
You may use any of the options to run a command that requires administrative privileges. Standard privileges would not allow users to run commands or applications that require administrative privileges.
You have recently implemented five different security solutions for a small business. Move the correct items from the left column to the column on the right to match the security solutions on the left with the security issue that the solution BEST addresses.
Digital security Install antivirus software
Physical security Implement biometrics
Social engineering Educate users
Wireless security Disable SSID broadcast
Data security Destroy hard drives
Digital security focuses mainly on protecting your networks and devices from harmful data and malware. It includes anti-virus software, firewalls, anti-spyware software, and user authentication with strong passwords.
Physical security focuses mainly on ensuring the buildings and server rooms are protected against physical intrusion. It includes locked doors, guards, mantraps/access control vestibules, securing documentation, shredding old documentation, biometrics, badgers, key fobs, RFID badges, RSA tokens, and privacy filters.
Social engineering occurs when an attacker attempts to acquire information about a network via phone conversations or other social settings. User gullibility is the main reason that social engineering occurs. User education is the best protection against social engineering.
Wireless security focuses mainly on ensuring that a wireless network is protected against intrusion. It includes changing default user names and passwords, changing SSIDs, setting encryptions, disabling SSID broadcast, enabling MAC filtering, antenna and access point placement, power levels, and assigning static IP addresses to wireless routers.
Data security focuses mainly on protecting stored data. It includes hard drive formatting, sanitation, and physical destruction.
You are a network administrator for Nutex Corporation. Your organization implements a network. You have been tasked with designing the end-user security training that will be given to all employees regarding the network.
Which security issue should you cover?
A) social engineering attacks
B) denial of service (DoS) attacks
C) physical security issues
D) smart card usage
You should ensure that social engineering attacks are covered in the end-user network security training. End users should always be aware of the social engineering techniques that can be used by hackers. A network security policy should cover end-user training on security solutions and social engineering training.
You are attending a class on network identification and authentication. What is the most common form of identification and authentication?
A) user identification with reusable password
B) biometrics
C) two-factor authentication
D)s mart cards
The most common form of identification and authentication is user identification with reusable password. User identifications (IDs) and passwords are something you know, such as your personal information or an alphanumeric word or phrase that you memorize.
A user’s computer is infected with malicious software that spreads through the Internet to collect user information, including browsing habits. Which type of malware has infected this computer?
A) virus
B) Trojan horse
C) spyware
D) keylogger
Spyware is a type of malicious software, also referred to as malware. It infects through the Internet to collect user information, including browsing habits. Windows Defender and Microsoft AntiSpyware are two common tools from Microsoft to fight malware. Spyware is most likely to result in identify theft.
According to your company’s new security policy, the administrator must define the number of days that a password can be kept before the user can change it. Which password policy setting should the administrator use?
A) the Maximum password age setting
B) the Minimum password age setting
C) the Minimum password length setting
D) the Enforce password history setting
You can configure the Minimum password age setting on a Windows computer to define number of days that a password must be kept before the user can change it. The Minimum password age setting determines how many days a new password must be kept before the user can change it. The Minimum password age setting is designed to work with the Enforce password history setting to prevent users from changing back to their old passwords by quickly resetting their passwords the required number of times.
Daniel, a member of the board of directors for your company, has called the help line to complain that an unknown person is posting to his account on his favorite social media site pretending to be him. After discussing the problem, he reveals that he performed the steps as dictated by last week’s email from your department. Your department did not send out an email last week with steps to complete. What term(s) below best describe which attack most likely occurred? (Choose all that apply.)
A) whaling
B) zombie
C) spear phishing
D) mining
E) ransomware
Whaling or spear phishing most likely occurred. Whaling and spear phishing are two types of targeted phishing attacks. Spear phishing targets a group of high-risk users in an organization through email and social media posts. The hacker will send emails to a specific target attempting to convince someone to answer their questions with the objective of getting access to confidential information, usually login credentials. Once they get a response, they will monitor the user’s actions. Later they may use the information gained to mimic the targeted user’s behavior and even writing style. Whaling is conducted like spear phishing, except that whaling specifically targets senior executives (the “big fish”).
Vivian wants to set permissions on a certain folder to allow users to modify data. What is she really allowing them to do with this type of permission?
A) The user has all rights to change permissions and take ownership of the directory or any of its subdirectories.
B) The user can read, write, execute, and delete everything, including the folder.
C) The user can read files and view the contents of a directory and any of its subdirectories.
D) The user can read, write, execute, and delete everything, EXCEPT the folder.
With this type of permission, the user can read, write, execute, and delete everything, including the folder. NTFS permissions set on a file or a folder are done by accessing the folder s Properties dialog box and then opening the Security tab. In a nutshell, NTFS enable you to set up security settings on files and folders with the following permissions:
Full Control – Grants users all permissions on the folder. Administrators have this access.
Modify – Grants users a high level of access, except the ability to take full ownership.
Read & Execute – Allows users to read files and execute executable files.
List Folder Contents – Allows users to list the contents of the folder. It does not allow them to read the individual files within that folder. They can only see the file and folder names.
Read – Allows users to read the folder’s contents.
Write – Allows user to write or edit the folder’s contents.
Adam is new to networking and is curious about the various terms like MAC address and MAC address filtering. What would be the best description to explain to him about the purpose of MAC address filtering?
A) to provide port authentication for a wireless network
B) to restrict the clients that can access a Web site
C) to restrict the clients that can access a wireless network
D) to ensure that unused ports are not accessible by clients
The purpose of MAC address filtering is to restrict the clients that can access a wireless network. Access is restricted based on the client’s media access control (MAC) address, which is the unique identifier that is encoded on the network interface card (NIC). However, this is no longer considered a major security configuration because MAC addresses can usually be obtained using a network sniffer.
Which statement is true regarding smart cards?
A) Smart cards use infrared.
B) Smart cards can be deactivated or replaced.
C) Smart cards do not contain a microprocessor.
D) Smart cards are used only as hotel room keys.
An advantage of using a smart card is that you can deactivate or replace a card key if a user reports it lost or stolen. Smart cards contain a microprocessor that stores information, such as financial, authorization, and personal information. Smart cards are implemented with computers to improve network security. Usually a smart card reader is connected to a computer’s USB port or laptop’s PCMCIA port.
Which option would best address the security issues surrounding a BYOD policy in the organization?
A) Smart card
B) MDM policies
C) Software tokens
D) Multifactor identification
Mobile Device Management (MDM) policies would best address the security issues inherent in bring your own device (BYOD) policies in the workplace. MDM policies can allow the organization to control the security of its assets, even assets that are not owned by the organization, while at the same time allowing the employee the freedom of using their own personal devices, such as smart phones and tablets.
You have two wireless networks in your building. The wireless networks do not overlap. Both of them use Wi-Fi Protected Access 2 (WPA2).
You want to ensure that no unauthorized wireless access points are established. What should you do?
A) Periodically complete a site survey.
B) Change the two wireless networks to WEP.
C) Change the two wireless networks to WPA3.
D) Disable SSID broadcasts for the two wireless networks.
You should periodically complete a site survey to ensure that no unauthorized wireless access points are established. Site surveys generally produce information on the types of systems in use, the protocols in use, and other critical information. You need to ensure that hackers cannot use site surveys to obtain this information. To protect against unauthorized site surveys, you should change the default Service Set Identifier (SSID) and disable SSID broadcasts. Immediately upon discovering a wireless access point using a site survey, you should physically locate the device and disconnect it.
After determining the scope of a user’s job, what is the next step in implementing the principle of least privilege?
A) Determine the minimum set of privileges needed to perform the user’s job.
B) Configure the appropriate group memberships for the user’s account.
C) Configure the appropriate privileges for the user’s account.
D) Determine the maximum set of privileges needed to perform the user’s job.
After determining exactly what a user’s job entails, you should determine the minimum set of privileges that is needed to perform the user’s job.
You have discovered that hackers are gaining access to your WEP wireless network. After researching, you discover that the hackers are using war driving. You need to protect against this type of attack. What should you do? (Choose all that apply.)
A) Configure the WEP protocol to WPA2.
B) Configure the network to use authenticated access only.
C) Disable SSID broadcast.
D) Change the default Service Set Identifier (SSID).
You should complete all of the following steps to protect against war-driving attacks:
Change the default SSID.
Disable SSID broadcast.
Configure the network to use authenticated access only.
Configure the WEP protocol to WPA2.
Some other suggested steps include the following:
Implement WPA3 instead of WPA2.
Reduce the access point signal strength.
When users log in to the network locally, they must provide their username and password. When users log in to the network remotely, they must provide their username, password, and smart card.
Which two statements are true regarding your organization’s security? (Choose two.)
A) The remote network login uses three-factor authentication.
B) The local network login uses two-factor authentication.
C) The remote network login uses two-factor authentication.
D) he local network login uses one-factor authentication.
The local network login uses one-factor authentication. Although two items are being presented, both items are categorized as something you know.
The remote network login uses two-factor authentication. Although three items are being presented, two items are something you know and one is something you have. Another example of a two-factor authentication system is an ATM card (something you have) and a personal identification number (something you know).
Management has requested that BitLocker To Go be implemented on all Windows 10 computers. Which hardware is required to implement this technology?
A) a USB flash drive
B) a network interface card (NIC)
C) DirectX 10.0
D) an optical DVD/CD drive
To implement BitLocker To Go on all Windows 10 computers, you need a USB Flash drive. BitLocker To Go is a technology in Windows 10 that allows you to encrypt the contents of USB Flash drives.
None of the other hardware is required to implement BitLocker To Go.
You are creating a presentation for company management on the pros and cons of mobile devices. What is the greatest threat to the security of mobile devices?
A) GPS location services
B )unsecured Wi-Fi
C) theft
D) excessive permissions
Theft
Your company has several security measures that they have implemented on all mobile devices. Which of the following is NOT a security measure for mobile devices?
A) geotracking
B) passcode locks
C) login attempt restrictions
D) patching/updates
E) anti-virus
Geotracking is NOT a security measure for mobile devices. Geotracking occurs when a mobile device records the location of the device periodically and stores the information in a central location. This is actually a security concern for many mobile device users because law enforcement may be able to access this information. The United States Department of Homeland Security retains the right to access this information when they deem necessary.
You work as a network administrator for a small organization that has recently experienced several malware attacks. The attacks originated from users unintentionally downloading malicious software while browsing the Internet. You have been tasked with improving security to help minimize these attacks. Which of the following browser best practices should be implemented to help prevent future attacks? (Choose all that apply).
A) Installing an ad blocker
B) Clearing cached data
C) Using private-browsing modes
D) Using a password manager
Each of these options are practices and tools that should be implemented to help improve browser security.
You are creating a wireless network for your company. You need to implement a wireless protocol that provides maximum security while providing support for older wireless clients. Which protocol should you choose?
A) Wi-Fi Protected Access (WPA)
B) Wired Equivalent Privacy (WEP)
C) Wireless Application Protocol (WAP)
D) Wi-Fi Protected Access 2 (WPA2)
You should implement WPA. Wi-Fi Protected Access (WPA) was created to fix core problems with Wired Equivalent Privacy (WEP). WPA is designed to work with older wireless clients while implementing the 802.11i standard.
Note that WEP and WPA are both considered deprecated protocols. While an organization can still implement them, IT professionals should caution against it because of the security issues with both protocols.
