Security+ Flashcards
The organization that Chris works for has disabled automatic updates. What is the most common reason for disabling automatic updates for organizational systems?
A. To avoid disruption of the work process for office workers
B. To prevent security breaches due to malicious patches and updates
C. To avoid issues with problematic patches and updates
D. All of the above
C. The most common reason to disable automatic patching is to avoid issues with problematic or flawed patches and updates. In most environments the need to patch regularly is accepted and handled for office workers without causing significant disruption. That concern would be different if the systems being patched were part of an industrial process or factory production environment. Malicious patches from legitimate sources such as an automatic update repository are exceptionally rare and are not a common concern or driver of this behavior. For more information, see Chapter 11.
Which of the following is the least volatile according to the forensic order of volatility?
A. The system’s routing table
B. Logs
C. Temp files
D. CPU Registers
B. Logs, along with any file that is stored on disk without the intention of being frequently overwritten, are the least volatile item listed. In order from most volatile to least from the answers here, you could list these as CPU registers, the system’s routing table, temp files, and logs. For more information, see Chapter 15.
Ed wants to trick a user into connecting to his evil twin access point (AP). What type of attack should he conduct to increase his chances of the user connecting to it?
A. A disassociation attack
B. An application denial-of-service attack
C. A known plain-text attack
D. A network denial-of-service attack
A. If Ed can cause his target to disassociate from the access point they are currently connected to, he can use a higher transmission power or closer access point to appear higher in the list of access points. If he is successful at fooling the user or system into connecting to his AP, he can then conduct on-path attacks or attempt other exploits. Denial-of-service attacks are unlikely to cause a system to associate with another AP, and a known plain-text attack is a type of cryptographic attack and is not useful for this type of attempt. For more information, see Chapter 12.
What term is used to describe wireless site surveys that show the relative power of access points on a diagram of the building or facility?
A. Signal surveys
B. db maps
C. AP topologies
D. Heatmaps
D. Site surveys that show relative power on a map or diagram are called heatmaps. They can help show where access points provide a strong signal, and where multiple APs may be competing with each other due to channel overlap or other issues. They can also help identify dead zones where signal does not reach. Signal surveys, db maps, and AP topologies were made up for this question. For more information, see Chapter 13.
What hardware device is used to create the hardware root of trust for modern desktops and laptops?
A. System memory
B. A HSM
C. The CPU
D. The TPM
D. A hardware root of trust provides a unique element that means that a board or device cannot be replicated. A Trusted Platform Module (TPM) is commonly used to provide the hardware root of trust. CPUs and system memory are not unique in this way for common desktops and laptops, and a hardware security module (HSM) is used to create, manage, and store cryptographic certificates as well as perform and offload cryptographic operations. For more information, see Chapter 11.
Angela wants to prevent users in her organization from changing their passwords repeatedly after they have been changed so that they cannot reuse their current password. What two password security settings does she need to implement to make this occur?
A. Set a password history and a minimum password age.
B. Set a password history and a complexity setting.
C. Set a password minimum and maximum age.
D. Set password complexity and maximum age.
A. Angela needs to retain a password history and set a minimum password age so that users cannot simply reset their password until they have changed the password enough times to bypass the history. For more information, see Chapter 8.
Chris wants to establish a backup site that is fully ready to take over for full operations for his organization at any time. What type of site should he set up?
A. A cold site
B. A clone site
C. A hot site
D. A ready site
C. Hot sites are ready to take over operations in real time. Cold sites are typically simply ready buildings with basic infrastructure in place to set up a site. Clone sites and ready sites are not typical terms used in the industry. For more information, see Chapter 9.
Which of the following is not a common constraint of embedded and specialized systems?
A. Computational power
B. Overly complex firewall settings
C. Lack of network connectivity
D. Inability to patch
B. Embedded and specialized systems tend to have lower-power CPUs, less memory, less storage, and often may not be able to handle CPU-intensive tasks like cryptographic algorithms or built-in security tools. Thus, having a firewall is relatively unlikely, particularly if there isn’t network connectivity built in or the device is expected to be deployed to a secure network. For more information, see Chapter 11.
Gary is reviewing his system’s SSH logs and sees logins for the user named “Gary” with passwords like password1, password2 … PassworD. What type of attack has Gary discovered?
A. A dictionary attack
B. A rainbow table attack
C. A pass-the-hash attack
D. A password spraying attack
A. A dictionary attack will use a set of likely passwords along with common variants of those passwords to try to break into an account. Repeated logins for a single user ID with iterations of various passwords is likely a dictionary account. A rainbow table is used to match a hashed password with the password that was hashed to that value. A pass-the-hash attack provides a captured authentication hash to try to act like an authorized user. A password spraying attack uses a known password (often from a breach) for many different sites to try to log in to them. For more information, see Chapter 4.
Kathleen wants to set up a system that allows access into a high-security zone from a low-security zone. What type of solution should she configure?
A. VDI
B. A container
C. A screened subnet
D. A jump server
D. Jump servers are systems that are used to provide a presence and access path in a different security zone. VDI is a virtual desktop infrastructure and is used to provide controlled virtual systems for productivity and application presentation among other uses. A container is a way to provide a scalable, predictable application environment without having a full underlying virtual system, and a screened subnet is a secured zone exposed to a lower trust level area or population. For more information, see Chapter 12.
Derek’s organization is worried about a disgruntled employee publishing sensitive business information. What type of threat should Derek work to protect against?
A. Shoulder surfing
B. Social engineering
C. Insider threats
D. Phishing
C. Derek’s organization is worried about insider threats, or threats that are created by employees and others who are part of the organization or are otherwise trusted by the organization. Social engineering involves deceiving people to achieve an attacker’s goals. Phishing attempts to acquire personal information through social engineering and other techniques, and shoulder surfing is a technique where malicious actors watch over someone’s shoulder to acquire information like passwords or credit card numbers. For more information, see Chapter 2.
Jeff is concerned about the effects that a ransomware attack might have on his organization and is designing a backup methodology that would allow the organization to quickly restore data after such an attack. What type of control is Jeff implementing?
A. Corrective
B. Preventive
C. Detective
D. Deterrent
A. Corrective controls remediate security issues that have already occurred. Restoring backups after a ransomware attack is an example of a corrective control. Preventative controls attempt to stop future issues. Detective controls focus on detecting issues and events, and deterrent controls attempt to deter actions. For more information, see Chapter 1.
Samantha is investigating a cybersecurity incident where an internal user used his computer to participate in a denial-of-service attack against a third party. What type of policy was most likely violated?
A. BPA
B. SLA
C. AUP
D. MOU
C. This activity is almost certainly a violation of the organization’s acceptable use policy (AUP), which should contain provisions describing appropriate use of networks and computing resources belonging to the organization. BPA is not a common term in this context. Service level agreements (SLAs) determine an agreed upon level of service, and MOUs, or memorandums of understanding are used to document agreements between organizations. See Chapter 16 for more information.
Jean recently completed the user acceptance testing process and is getting her code ready to deploy. What environment should house her code before it is released for use?
A. Test
B. Production
C. Development
D. Staging
D. The staging environment is a transition environment for code that has successfully cleared testing and is waiting to be deployed into production. This is where the code should reside before it is released for use. The development environment is where developers work on the code prior to preparing it for deployment. The test environment is where the software or systems can be tested without impacting the production environment. The production environment is the live system. Software, patches, and other changes that have been tested and approved move to production. For more information, see Chapter 6.
Rob has created a document that describes how staff in his organization can use organizationally owned devices, including if and when personal use is allowed. What type of policy has Rob created?
A. Change management policy
B. Acceptable use policy
C. Access control policy
D. Playbook
B. Acceptable use policies define how organizational systems, devices, and services can and should be used. Change management policies determine how an organization handles change and change control. Access control documentation is typically handled as a standard, and playbooks describe how perform specific duties or processes.
Oren obtained a certificate for his domain covering *.acmewidgets.net. Which one of the following domains would not be covered by this certificate?
A. www.acmewidgets.net
B. acmewidgets.net
C. test.mail.acmewidgets.net
D. mobile.acmewidgets.net
C. Wildcard certificates protect the listed domain as well as all first-level subdomains. test.mail.acmewidgets.net is a second-level subdomain of acmewidgets.net and would not be covered by this certificate. For more information, see Chapter 7.
Richard is sending a message to Grace and would like to apply a digital signature to the message before sending it. What key should he use to create the digital signature?
A. Richard’s private key
B. Richard’s public key
C. Grace’s private key
D. Grace’s public key
A. The sender of a message may digitally sign the message by encrypting a message digest with the sender’s own private key. For more information, see Chapter 7.
Andrew is employing which type of risk management strategy as he works with his financial team to purchase a cybersecurity insurance policy to cover the financial impact of a data breach?
A. Risk avoidance
B. Risk transference
C. Risk acceptance
D. Risk mitigation
B. Purchasing insurance is the most common example of risk transference—shifting liability to a third party. Avoidance involves efforts to prevent the risk from occurring, acceptance is just that—formally accepting that the risk may occur, and mitigation attempts to limit the impact of the risk. For more information, see Chapter 17.
Shelly is writing a document that describes the steps that incident response teams will follow upon first notice of a potential incident. What type of document is she creating?
A. Guideline
B. Standard
C. Procedure
D. Policy
C. Procedures provide checklist-style sets of step-by-step instructions guiding how employees should react in a given circumstance. Procedures commonly guide the early stages of incident response. Standards define how policies should be implemented. Guidelines are voluntary, whereas policies are mandatory. For more information, see Chapter 16.
Define control objectives
The specific goals or intended outcomes of implementing certain security measures or controls. These objectives are crucial for ensuring the confidentiality, integrity, and availability of information systems and data.
Define security controls
Specific measures that fulfill the security objectives of an organization.
Define gap analysis
A method used to assess the difference between the current state of security measures and the desired state. It involves identifying the existing controls within an organization’s security posture and comparing them against industry standards or best practices.
What are the security control categories?
- Technical controls enforce confidentiality, integrity, and availability in the digital space. Examples of technical security controls include firewall rules, access control lists, intrusion prevention systems, and encryption.
- Operational controls include the processes that we put in place to manage technology in a secure manner. These include user access reviews, log monitoring, and vulnerability management.
- Managerial controls are procedural mechanisms that focus on the mechanics of the risk management process. Examples of administrative managerial controls include periodic risk assessments, security planning exercises, and the incorporation of security into the organization’s change management, service acquisition, and project management practices.
- Physical controls are security controls that impact the physical world. Examples of physical security controls include fences, perimeter lighting, locks, fire suppression systems, and burglar alarms.
What are the security control types?
- Preventive controls intend to stop a security issue before it occurs. Firewalls and encryption are examples of preventive controls.
- Deterrent controls seek to prevent an attacker from attempting to violate security policies. Vicious guard dogs and barbed wire fences are examples of deterrent controls.
- Detective controls identify security events that have already occurred. Intrusion detection systems are detective controls.
- Corrective controls remediate security issues that have already occurred. Restoring backups after a ransomware attack is an example of a corrective control.
- Compensating controls are controls designed to mitigate the risk associated with exceptions made to a security policy. Think a necessary, but outdated OS device running in an isolated network.
- Directive controls inform employees and others what they should do to achieve security objectives. Policies and procedures are examples of directive controls.
What are the three criteria for PCI DSS compensating controls in order to be satisfactory?
- The control must meet the intent and rigor of the original requirement.
- The control must provide a similar level of defense as the original requirement, such that the compensating control sufficiently offsets the risk that the original PCI DSS requirement was designed to defend against.
- The control must be “above and beyond” other PCI DSS requirements.
What are the three states in which data might exist?
- Data at rest is stored data that resides on hard drives, tapes, in the cloud, or on other storage media. This data is prone to theft by insiders or external attackers who gain access to systems and are able to browse through their contents.
- Data in transit is data that is in motion/transit over a network. When data travels on an untrusted network, it is open to eavesdropping attacks by anyone with access to those networks.
- Data in use is data that is actively in use by a computer system. This includes the data stored in memory while processing takes place. An attacker with control of the system may be able to read the contents of memory and steal sensitive information.
What are DLP systems?
DLP (Data Loss Prevention) systems are security tools that monitor, detect, and block the unauthorized transmission of information across a network. They help ensure that sensitive or critical information does not leave the corporate network or is not used in a manner that violates policies. DLP systems can be rule-based and may involve a combination of content inspection and contextual analysis to identify and protect data in use (endpoint actions), in motion (network traffic), and at rest (storage). They are crucial in enforcing regulatory compliance and protecting intellectual property.
What are agent-based DLP systems?
Agent-based DLP uses software agents installed on systems that search those systems for the presence of sensitive information. These searches often turn up Social Security numbers, credit card numbers, and other sensitive information in the most unlikely places.
What are agentless DLP systems?
Agentless (network-based) DLP systems are dedicated devices that sit on the network and monitor outbound network traffic, watching for any transmissions that contain unencrypted sensitive information. They can then block those transmissions, preventing the unsecured loss of sensitive information.
How can you automatically apply encryption to email exchanges that may contain sensitive information?
Integrate Data Loss Prevention (DLP) systems. They can be configured to scan email and encrypt traffic automatically.
How can you stop users from utilizing USB drives?
Implement an agent-based DLP (in this case, host-based).
What are the two mechanisms of action for DLP systems?
1) Pattern matching, where they watch for the telltale signs of sensitive information. For example, if they see a number that is formatted like a credit card or Social Security number, they can automatically trigger on that. Similarly, they may contain a database of sensitive terms, such as “Top Secret” or “Business Confidential,” and trigger when they see those terms in an outbound transmission.
2) Watermarking, where systems or administrators apply electronic tags to sensitive documents and then the DLP system can monitor systems and networks for unencrypted content containing those tags.
Define data minimization
The principle of collecting, processing, and storing only the minimum amount of personal data necessary for specific purposes. This reduces the risk of data breaches and complies with privacy regulations.
Define de-identification
The process of removing or altering personally identifiable information (PII) from data sets, so that individuals cannot be readily identified, enhancing privacy and security while allowing data analysis and usage.
What are the three main data obfuscation methods?
- Hashing
- Tokenization
- Masking
Define tokenization
Tokenization replaces sensitive values with a unique identifier using a lookup table. For example, we might replace a widely known value, such as a student ID, with a randomly generated 10-digit number. We’d then maintain a lookup table that allows us to convert those back to student IDs if we need to determine someone’s identity. Of course, if you use this approach, you need to keep the lookup table secure.
Define masking
Masking partially redacts sensitive information by replacing some or all sensitive fields with blank characters. For example, we might replace all but the last four digits of a credit card number with X’s or *’s to render the card number unreadable.
Define rainbow table attack
A cryptographic attack that uses precomputed tables of hash values for cracking password hashes. It’s efficient against unsalted hashes, reducing the time needed to crack a password by comparing precomputed hashes rather than computing them on-the-fly.
Define (network) segmentation
Segmentation places sensitive systems on separate networks where they may communicate with each other but have strict restrictions on their ability to communicate with systems on other networks.
Define nonrepudiation
Nonrepudiation means that someone who performed some action, such as sending a message, cannot later deny having taken that action. Digital signatures are a common example of nonrepudiation. They allow anyone who is interested to confirm that a message truly originated with its purported sender.
Matt is updating the organization’s threat assessment process. What category of control is Matt implementing?
A. Operational
B. Technical
C. Corrective
D. Managerial
D. Managerial controls are procedural mechanisms that focus on the mechanics of the risk management process. Threat assessment is an example of one of these activities.
Jade’s organization recently suffered a security breach that affected stored credit card data. Jade’s primary concern is the fact that the organization is subject to sanctions for violating the provisions of the Payment Card Industry Data Security Standard. What category of risk is concerning Jade?
A. Strategic
B. Compliance
C. Operational
D. Financial
B. The breach of credit card information may cause many different impacts on the organization, including compliance, operational, and financial risks. However, in this scenario, Jade’s primary concern is violating PCI DSS, making his concern a compliance risk.
Chris is responding to a security incident that compromised one of his organization’s web servers. He believes that the attackers defaced one or more pages on the website. What cybersecurity objective did this attack violate?
A. Confidentiality
B. Nonrepudiation
C. Integrity
D. Availability
C. The defacement of a website alters content without authorization and is, therefore, a violation of the integrity objective. The attackers may also have breached the confidentiality or availability of the website, but the scenario does not provide us with enough information to draw those conclusions.
Tonya is concerned about the risk that an attacker will attempt to gain access to her organization’s database server. She is searching for a control that would discourage the attacker from attempting to gain access. What type of security control is she seeking to implement?
A. Preventive
B. Detective
C. Corrective
D. Deterrent
D. Deterrent controls are designed to prevent an attacker from attempting to violate security policies in the first place. Preventive controls would attempt to block an attack that was about to take place. Corrective controls would remediate the issues that arose during an attack. Detective controls detect issues or indicators of issues.
Greg is implementing a data loss prevention system. He would like to ensure that it protects against transmissions of sensitive information by guests on his wireless network. What DLP technology would best meet this goal?
A. Watermarking
B. Pattern recognition
C. Host-based
D. Network-based
D. In this case, Greg must use a network-based DLP system. Host-based DLP requires the use of agents, which would not be installed on guest systems. Greg may use watermarking and/or pattern recognition to identify the sensitive information, but he must use network-based DLP to meet his goal.
What term best describes data that is being sent between two systems over a network connection?
A. Data at rest
B. Data in transit
C. Data in processing
D. Data in use
B. Data being sent over a network is data in transit. Data at rest is stored data that resides on hard drives, tapes, in the cloud, or on other storage media. Data in processing, or data in use, is data that is actively in use by a computer system.
Tina is tuning her organization’s intrusion prevention system to prevent false positive alerts. What type of control is Tina implementing?
A. Technical control
B. Physical control
C. Managerial control
D. Operational control
A. Technical controls enforce confidentiality, integrity, and availability in the digital space. Examples of technical security controls include firewall rules, access control lists, intrusion prevention systems, and encryption.
Which one of the following is not a common goal of a cybersecurity attacker?
A. Disclosure
B. Denial
C. Alteration
D. Allocation
D. The three primary goals of cybersecurity attackers are disclosure, alteration, and denial. These map directly to the three objectives of cybersecurity professionals: confidentiality, integrity, and availability.
Tony is reviewing the status of his organization’s defenses against a breach of their file server. He believes that a compromise of the file server could reveal information that would prevent the company from continuing to do business. What term best describes the risk that Tony is considering?
A. Strategic
B. Reputational
C. Financial
D. Operational
A. The risk that Tony is contemplating could fit any one of these categories. However, his primary concern is that the company may no longer be able to do business if the risk materializes. This is a strategic risk.
Which one of the following data elements is not commonly associated with identity theft?
A. Social Security number
B. Driver’s license number
C. Frequent flyer number
D. Passport number
C. Although it is possible that a frequent flyer account number, or any other account number for that matter, could be used in identity theft, it is far more likely that identity thieves would use core identity documents. These include drivers’ licenses, passports, and Social Security numbers.
What term best describes an organization’s desired security state?
A. Control objectives
B. Security priorities
C. Strategic goals
D. Best practices
A. As an organization analyzes its risk environment, technical and business leaders determine the level of protection required to preserve the confidentiality, integrity, and availability of their information and systems. They express these requirements by writing the control objectives that the organization wishes to achieve. These control objectives are statements of a desired security state.
What technology uses mathematical algorithms to render information unreadable to those lacking the required key?
A. Data loss prevention
B. Data obfuscation
C. Data minimization
D. Data encryption
D. Encryption technology uses mathematical algorithms to protect information from prying eyes, both while it is in transit over a network and while it resides on systems. Encrypted data is unintelligible to anyone who does not have access to the appropriate decryption key, making it safe to store and transmit encrypted data over otherwise insecure means.
Greg recently conducted an assessment of his organization’s security controls and discovered a potential gap: the organization does not use full-disk encryption on laptops. What type of control gap exists in this case?
A. Detective
B. Corrective
C. Deterrent
D. Preventive
D. The use of full-disk encryption is intended to prevent a security incident from occurring if a device is lost or stolen. Therefore, this is a preventive control gap.
What compliance regulation most directly affects the operations of a health-care provider?
A. HIPAA
B. PCI DSS
C. GLBA
D. SOX
A. Although a health-care provider may be impacted by any of these regulations, the Health Insurance Portability and Accountability Act (HIPAA) provides direct regulations for the security and privacy of protected health information and would have the most direct impact on a health-care provider.
Nolan is writing an after-action report on a security breach that took place in his organization. The attackers stole thousands of customer records from the organization’s database. What cybersecurity principle was most impacted in this breach?
A. Availability
B. Nonrepudiation
C. Confidentiality
D. Integrity
C. The disclosure of sensitive information to unauthorized individuals is a violation of the principle of confidentiality.
Which one of the following objectives is not one of the three main objectives that information security professionals must achieve to protect their organizations against cybersecurity threats?
A. Integrity
B. Nonrepudiation
C. Availability
D. Confidentiality
B. The three primary objectives of cybersecurity professionals are confidentiality, integrity, and availability.
Which one of the following data protection techniques is reversible when conducted properly?
A. Tokenization
B. Masking
C. Hashing
D. Shredding
A. Tokenization techniques use a lookup table and are designed to be reversible. Masking and hashing techniques replace the data with values that can’t be reversed back to the original data if performed properly. Shredding, when conducted properly, physically destroys data so that it may not be recovered.
Which one of the following statements is not true about compensating controls under PCI DSS?
A. Controls used to fulfill one PCI DSS requirement may be used to compensate for the absence of a control needed to meet another requirement.
B. Controls must meet the intent of the original requirement.
C. Controls must meet the rigor of the original requirement.
D. Compensating controls must provide a similar level of defense as the original requirement.
A. PCI DSS compensating controls must be “above and beyond” other PCI DSS requirements. This specifically bans the use of a control used to meet one requirement as a compensating control for another requirement.
Define hacktivist
Hacktivists use hacking techniques to accomplish some activist goal. They might deface the website of a company whose policies they disagree with. Or a hacktivist might attack a network due to some political issue. The defining characteristic of hacktivists is that they believe they are motivated by the greater good, even if their activity violates the law.
Define APT
Sophisticated, long-term cyberattacks conducted by highly skilled adversaries targeting specific organizations for espionage or financial gain. APTs stealthily infiltrate networks to extract or compromise data without detection.
What are espionage attacks?
Espionage attacks are motivated by organizations seeking to steal secret information from other organizations. This may come in the form of nation-states attacking each other or corporate espionage.
What are the types of threat actors?
- Cybercriminals: Individuals or groups seeking financial gain through attacks like phishing, malware, and identity theft.
- Hacktivists: Hackers who target organizations for political or social reasons, often through website defacement or data leaks.
- Nation-State Actors: Government-sponsored groups conducting cyber espionage or attacks to gather intelligence or disrupt other nations.
- Insiders: Employees or contractors who misuse their access to steal information or sabotage systems.
- Script Kiddies: Inexperienced hackers using pre-written scripts to exploit known vulnerabilities without fully understanding the technology.
- Advanced Persistent Threats (APTs): Highly skilled groups engaging in prolonged and targeted cyberattacks to steal data or monitor organizations.
What are the typical motivations for threat actor attacks?
- Data exfiltration attacks are motivated by the desire to obtain sensitive or proprietary information, such as customer data or intellectual property.
- Espionage attacks are motivated by organizations seeking to steal secret information from other organizations. This may come in the form of nation-states attacking each other or corporate espionage.
- Service disruption attacks seek to take down or interrupt critical systems or networks, such as banking systems or health-care networks.
- Blackmail attacks seek to extort money or other concessions from victims by threatening to release sensitive information or launch further attacks.
- Financial gain attacks are motivated by the desire to make money through theft or fraud. Organized crime is generally motivated by financial gain, as are other types of attackers.
- Philosophical/political belief attacks are motivated by ideological or political reasons, such as promoting a particular cause or ideology. Hacktivists are generally motivated by philosophical or political beliefs.
- Ethical attacks, or white-hat hacking, are motivated by a desire to expose vulnerabilities and improve security. These attacks are often carried out by security researchers or ethical hackers with the permission of the organization being tested.
- Revenge attacks are motivated by a desire to get even with an individual or organization by embarrassing them or exacting some other form of retribution against them.
- Disruption/chaos attacks are motivated by a desire to cause chaos and disrupt normal operations. War may also be a motivation for cyberattacks. Military units and civilian groups may use hacking in an attempt to disrupt military operations and change the outcome of an armed conflict.
Define attack surface
This is a system, application, or service that contains a vulnerability that a threat actor might exploit.
Define threat vector
A path or method used by a cyber attacker to gain unauthorized access to a system or network to deliver a payload or malicious outcome. Common vectors include phishing, malware, social engineering, and unsecured networks.
What are the common message-based threat vectors?
- Phishing: Deceptive communication, often email, aiming to steal sensitive data.
- Spear Phishing: Targeted phishing attacks directed at specific individuals or organizations.
- Whaling: Highly targeted phishing attacks aimed at senior executives.
- Spam: Unsolicited messages, often carrying malware or phishing links.
What are the common physical-based threat vectors?
- USB Drop Attacks: Distributing malware-infected USB drives to unsuspecting users.
- Tailgating: Gaining unauthorized access to restricted areas by following authorized personnel.
What are the common social engineering-based threat vectors?
- Pretexting: Creating a fabricated scenario to steal a victim’s information.
- Baiting: Offering something enticing to deliver malware or steal information.
- Quid Pro Quo: Offering a service or benefit in exchange for information, typically under false pretenses.
What are the common wireless-based threat vectors?
- Evil Twin Attacks: Creating a malicious Wi-Fi network mimicking a legitimate one.
- Wi-Fi Eavesdropping: Intercepting information sent over unprotected Wi-Fi networks.
- Bluetooth Hacking: Exploiting vulnerabilities over Bluetooth connections.
What are the common cloud-based threat vectors?
- API Vulnerabilities: Exploiting weaknesses in cloud services’ Application Programming Interfaces.
- Misconfigured Cloud Storage: Accessing improperly secured cloud storage to extract data.
- Account Hijacking: Gaining control of cloud accounts to access sensitive information.
What is the DAD triad?
Definition: The DAD triad stands for Disclosure, Alteration, and Destruction. It is a model used to outline the potential security threats to information systems, contrasting the CIA (Confidentiality, Integrity, Availability) triad by focusing on negative outcomes.
Example: An attacker stealing confidential documents (Disclosure), modifying data (Alteration), or deleting critical files (Destruction).
Define data exfiltration
Definition: Data exfiltration refers to the unauthorized transfer of data from a computer or other device to an external location or attacker-controlled environment. This can be done manually via physical means or automatically through malware or compromised networks.
Example: An attacker using a phishing scam to install malware that silently transfers sensitive files from the victim’s computer to an external server.
What is PHI?
Definition: Protected Health Information is any information in a medical record or other health-related information that can be used to identify an individual and that was created, used, or disclosed in the course of providing a healthcare service, such as diagnosis or treatment.
Example: Names, addresses, birth dates, Social Security Numbers, medical records, and health insurance information.
What are control objectives?
Definition: Control objectives are the goals or purposes intended to be achieved by implementing specific control measures or procedures in information security. These objectives help ensure the confidentiality, integrity, and availability of data.
Example: Ensuring only authorized users have access to sensitive data, data is accurate and unaltered, and information systems are available when needed.
What are CPU registers?
Definition: CPU registers are small, high-speed storage locations within a computer’s CPU (Central Processing Unit) that hold data and instructions that are being processed by the CPU. They play a critical role in the CPU’s ability to execute operations quickly.
Example: Instruction registers hold the instruction currently being executed, while accumulator registers store intermediate arithmetic and logic results.
Define threat intelligence
Definition: Threat intelligence is information that is used to understand the threats that have, will, or are currently targeting an organization. This information can be used to prepare, prevent, and identify cyber threats looking to take advantage of valuable resources.
Example: Data indicating a new malware strain is targeting the financial sector, helping institutions to proactively bolster their defenses.
What are threat feeds and what can they do for your organization?
Definition: Threat feeds deliver real-time information about potential security threats to an organization, providing actionable intelligence that can be used to bolster cybersecurity measures.
Details Included: IP addresses, domains, email addresses, URLs, file hashes, paths, and CVE numbers, offering comprehensive insight into the nature of threats.
Benefits: By including context such as why an organization might be targeted, descriptions of threat actors, and insights into their motives and methods, threat feeds enable organizations to understand and mitigate threats more effectively.
What is STIX?
Definition: STIX is a language and serialization format used to exchange cyber threat intelligence (CTI) in a standardized manner. It enables organizations to share information about cyber threats and their indicators effectively and efficiently.
Purpose: Facilitates the understanding, management, and sharing of cyber threat intelligence, enhancing the ability to respond to and mitigate cyber threats across different platforms and organizations.
What is TAXII?
Definition: Trusted Automated Exchange of Intelligence Information (TAXII) is a protocol used for the automated exchange of cyber threat information in a secure and standardized manner.
Purpose: It supports the sharing of information about malware, attack patterns, and threat indicators, making it easier for organizations to communicate and collaborate on threat intelligence. TAXII is often used in conjunction with STIX to facilitate the exchange of structured threat information.
What are TTPs?
TTPs (Tactics, Techniques, and Procedures) represent the behavior patterns of threat actors or cybercriminals.
Tactics: The overarching strategy or goal of an attacker. For example, an attacker’s tactic might be to gain unauthorized access to a network to steal sensitive data.
Techniques: The methods used to carry out the tactic. Continuing the example, the technique could be phishing emails to trick employees into revealing their login credentials.
Procedures: The detailed, step-by-step actions taken to execute the technique. In this case, the procedure might involve crafting a convincing email that appears to be from a trusted source, embedding a malicious link, and then sending it to multiple employees within the targeted organization.
Frank is concerned about the admissibility of his forensic data. Which of the following is not an element he should be concerned about?
A. Whether the forensic source data has remained unaltered
B. Whether the practices and procedures would survive review by experts
C. Whether the evidence is relevant to the case
D. Whether the forensic information includes a time stamp
D. Forensic information does not have to include a time stamp to be admissible, but time stamps can help build a case that shows when events occurred. Files without a time stamp may still show other information that is useful to the case or may have other artifacts associated with them that can provide context about the time and date.
What is authorized, semi-authorized, and unauthorized hacking?
White, grey, and black hat hacking.
What remains on a flash media device after it has been quick-formatted?
Quick-formatting a drive removes the file indexes but leaves the file content on the drive. Recovery tools look for those files on the drive and piece them back together using metadata, headers, and other clues that help to recover the files.
Tony is reviewing the status of his organization’s defenses against a breach of their file server. He believes that a compromise of the file server could reveal information that would prevent the company from continuing to do business. What term best describes the risk that Tony is considering?
A. Strategic
B. Reputational
C. Financial
D. Operational
A. The risk that Tony is contemplating could fit any one of these categories. However, his primary concern is that the company may no longer be able to do business if the risk materializes. This is a strategic risk.
Joanna wants to detect password spraying attacks. What type of rule should she deploy through her security systems?
A. Match attempts to log into many systems with the same username and password.
B. Match multiple attempts to log into the same user account using different passwords.
C. Match repeated use of the same password during failed login attempts for multiple usernames.
D. Match all attempts to use passwords with slight changes for the same account.
C. Password spraying involves the use of the same password to attempt to log into multiple accounts. Joanna should search for uses of the same password for different accounts.
Valentine wants to deploy a secure version of DHCP for her organization. What should she implement?
A. S-DHCP
B. DHCP over TLS
C. DHCPS
D. There is no secured version of DHCP.
D. While many protocols have a secure version, DHCP does not have a secure option, and protection must be handled by using detection and response mechanisms, rather than an encrypted protocol.
What is out-of-cycle logging?
This refers to the recording of system or application activities at times outside of normal operational hours or scheduled intervals, often to detect unauthorized access or anomalies that could indicate a security incident.
Dana is reviewing her system’s application logs and notices that a full backup of the application was done at 10 a.m. She knows that the job that runs the backup process is set to run overnight. What indicator should she flag this as?
A. Unexpected logs
B. Resource consumption
C. Resource inaccessibility
D. Out-of-cycle logging
D. This is an example of out-of-cycle logging, or logging that occurs at a different time than expected. This may be because an attacker is using the backup tool to acquire data. Unexpected logs are not an indicator found on the Security+ exam outline. There is no indication of resource consumption or inaccessibility in the question.
Which organization did the U.S. government help create to share knowledge between organizations in specific verticals?
ISACs. The U.S. government created the Information Sharing and Analysis Centers (ISACs). ISACs help infrastructure owners and operators share threat information, and provide tools and assistance to their members.
Which one of the following algorithms is primarily used for the exchange of encryption keys?
A. PBKDF2
B. AES
C. OCSP
D. Diffie–Hellman
D. Diffie–Hellman is a key exchange algorithm used to create a common shared secret key. The Advanced Encryption Standard (AES) is a symmetric encryption algorithm used to protect data. Password-Based Key Derivation Function 2 (PBKDF2) is a key stretching algorithm used to create strong keys from short passwords. The Online Certificate Status Protocol (OCSP) is used to verify the validity of digital certificates.
Sarah is an IT compliance officer at a large U.S. publicly traded tech company. Her role involves ensuring that the financial records of the company are secured with a high degree of assurance. She understands that there is a particular act that mandates such assurance for the IT systems storing and processing these records. Which of the following acts is Sarah most focused on ensuring her company complies with?
A. FERPA
B. GLBA
C. SOX
D. HIPAA
C. Sarah’s main focus in this situation is the Sarbanes–Oxley Act (SOX Act), as it is specifically designed for U.S. publicly traded companies. It insists on a high level of confidence in the IT systems that manage these companies’ financial records. The Family Educational Rights and Privacy Act (FERPA) applies to educational institutions in the U.S., mandating the secure handling of student records. The Gramm–Leach–Bliley Act (GLBA) is aimed at U.S. financial institutions, necessitating them to establish a formal security program. The Health Insurance Portability and Accountability Act (HIPAA) sets the rules for health-care providers, insurance firms, and health information clearinghouses in the U.S., calling for adherence to security and privacy standards related to health information. While each of these regulations plays a crucial role within their specific sectors, in Sarah’s role at a publicly traded tech firm, it’s the SOX Act that is most pertinent.
Isabelle needs to select the EAP protocol that she will use with her wireless network. She wants to use a secure protocol that does not require client devices to have a certificate, but she does want to require mutual authentication. Which EAP protocol should she use?
A. EAP-FAST
B. EAP-TTLS
C. PEAP
D. EAP-TLS
C. Isabelle should select PEAP, which doesn’t require client certificates but does provide TLS support. EAP-TTLS provides similar functionality but requires additional software to be installed on some devices. EAP-FAST focuses on quick reauthentication, and EAP-TLS requires certificates to be deployed to the endpoint devices.
Alaina wants to maintain chain-of-custody documentation and has created a form. Which of the following is not a common element on a chain-of-custody form?
A. Item identifier number
B. Signature of the person transferring the item
C. Signature of the person receiving the item
D. Method of transport
D. Method of transport
What are the CVSS score to risk category mappings?
Low: 0.1 - 3.9
Medium: 4.0 - 6.9
High: 7.0 - 8.9
Critical: 9.0 - 10.0
Michelle has received a drive that a manager in her organization retrieved from a staff member’s house. The drive had been left on the manager’s desk for a week before she caught up with Michelle to hand the drive over. What concern should Michelle express about the drive in the event that it is needed for a legal case?
A. The drive cannot be safely copied after not having power for so long.
B. The drive may not meet legal hold requirements.
C. The drive may have lost data after not having power for so long.
D. There is a gap in the chain of custody for the drive.
D. Since the drive acquisition was both unmonitored and not logged, and since the drive sat without being secured, the chain of custody for the drive cannot be validated. Michelle cannot prove that the drive was handled properly or was not modified between the time it was obtained and when it was handed to her. Drives will not typically lose data or have issues being copied after being unpowered for a week, or even months. There is no requirement for legal hold in this scenario, and no third party requested that the drive or data on the drive be preserved.
Which of the following human vectors is primarily associated with nation-state actors?
A. Misinformation campaigns
B. Watering hole attacks
C. Business email compromise
D. Password spraying
A. Misinformation and disinformation campaigns are primarily associated with nation-state actors, but are increasingly used by other organizations and even individuals as well. Watering hole attacks, business email compromise, and password spraying are broadly used attacks.
Eve is investigating a security incident where the user of a web application submitted an internal URL to the application and tricked the web server into retrieving sensitive data from that URL and displaying it as output. What term best describes this attack?
A. SSRF
B. CSRF
C. XSS
D. Command injection
A. Server-side request forgery (SSRF) attacks trick a server into visiting a URL based on user-supplied input. SSRF attacks are possible when a web application accepts URLs from a user as input and then retrieves information from that URL. If the server has access to non-public URLs, an SSRF attack can unintentionally disclose that information to an attacker. CSRF (cross-site request forgery) leverages malicious code to cause users to take action via a website they’re already authenticated to. XSS (cross-site scripting) injects malicious scripts into preexisting websites by getting them to display the scripts, and command injection attacks attempt to run commands on an operating system by leveraging a vulnerable application.
Ivan is running an enterprise wireless network and his heatmap shows that two access points are likely conflicting with each other. What will the enterprise access controller most likely do to handle this conflict?
A. Increase the broadcast power of one of the access points.
B. Change the SSID for one of the access points.
C. Disable one of the access points.
D. Decrease the broadcast power of the access points.
D. When access points conflict, enterprise wireless network management tools will typically decrease the power for both access points until the issue is resolved. Simply increasing power will cause more conflicts, changing the SSID would not serve typical enterprise models that use a single SSID to allow roaming, and disabling an access point may leave coverage gaps.
What component of a zero-trust architecture forwards requests from subjects and acts on whether subjects are allowed to access resources?
A. Policy administrators
B. Policy enforcement points
C. Policy engines
D. Policy gateways
B. Policy enforcement points communicate with policy administrators to forward requests from subjects and to receive instructions from them about connections to allow or end. Policy administrators are components that establish or remove the communication path between subjects and resources, including creating session-specific authentication tokens or credentials as needed. Policy engines make policy decisions based on both rules and external systems. Policy gateways are not reference components for zero-trust designs.
Wayne is concerned that an on-path attack has been used against computers he is responsible for. What artifact is he most likely to find associated with this attack?
A. A compromised router
B. A browser plug-in
C. A compromised server
D. A modified hosts file
B. Browser on-path attacks take advantage of malicious browser plug-ins or proxies to modify traffic at the browser level. They do not involve compromised routers or servers, and a modified hosts file is more likely to be involved in an on-path attack.
When a caller was recently directed to Amanda, who is a junior IT employee at her company, the caller informed her that they were the head of IT for her organization and that she needed to immediately disable the organization’s firewall. After Amanda made the change, she discovered that the caller was not the head of IT, and that they were actually a penetration tester hired by her company. What social engineering attack best describes this?
A. Smishing
B. Pretexting
C. Impersonation
D. Vishing
C. This is an example of an impersonation attack. The pentester impersonated the head of IT in order to achieve their goals. The good news is that it was a penetration tester! Smishing is phishing via SMS, vishing is phishing via voice or voicemail, and pretexting provides a reason that the target should perform an action. Here the attack relied on the authority that Amanda believed the caller had.
A connection between two systems has been redirected by an attacker. The attacker has spoofed ARP packets to make it so that responses to the legitimate server are instead sent to a system that the attacker controls. When traffic is sent to that system, the attacker reads and potentially modifies the traffic before passing it along the server, then sends back responses from the server after reviewing or modifying them as well. What type of attack is this?
A. An ARPjacking B. A disassociation attack C. An on-path attack D. A TCP redirect attack
C. This is one form of an on-path attack, an attack that redirects traffic to a system or device controlled by the attacker, which can then take action on network traffic originally destined for another system. ARPjacking and TCP redirect attacks are made up. Disassociation attacks focus on causing Wi-Fi devices to drop their connection and try to reconnect to an access point.
Henry is following the EDRM model and is preparing to review data. What two key tasks occur during this stage?
It is important to ensure that data prepared for e-discovery only contains what it is supposed to, and that information that should not be shared is not included.
How do you determine categorization for guidelines, standards, procedures, and policies?
To categorize these governance documents, assess their scope and detail level. Policies provide broad, principle-based directions and define the organization’s security posture. Standards specify mandatory actions, technical requirements, or rules to implement policies. Procedures are detailed, step-by-step instructions that describe exactly how to comply with policies and standards. Guidelines offer advisory best practices that can be tailored to specific circumstances or environments. The hierarchy moves from general (policies) to specific (procedures) with standards providing the compulsory requirements to achieve policy goals and guidelines offering optional advice.
Define federation
In cybersecurity, federation is the process of linking and managing identities across multiple systems and organizations to allow users to access shared resources with single sign-on (SSO).
What is the EDRM?
The Electronic Discovery Reference Model (EDRM) is a framework that outlines standards for the recovery and discovery of digital data. It provides guidance for the creation, management, and use of electronic stored information (ESI) in legal proceedings.
Define logic bomb
Definition: A logic bomb is a piece of malicious code intentionally inserted into a software system that will set off a malicious function when specified conditions are met, such as a particular time or event. It lies dormant until triggered.
Example: An employee might insert a logic bomb that deletes files on a specific date or after they are terminated from the company.
Maria wants to use a secure replacement for FTP and wants to use the tool that will require the least additional work to function through her firewall. Which secure replacement should she choose, and for which reason?
A. FTPS, because it provides strong encryption
B. SFTP, because it uses the same port as SSH
C. FTPS, because it uses the same port as SSH
D. SFTP, because it provides strong encryption
B. SFTP implements file transfers via SSH and only requires a single port to be open. FTPS uses a second port for file transfers, just like FTP. SFTP also allows the use of key-based authentication, making transfers even easier for users. Both SFTP and FTPS provide strong encryption, so this is not a deciding factor.
What is FRR in biometric systems?
FRR (false rejection rate) describes what happens when a biometric system does not accept a valid biometric factor.
What is FAR in biometric systems?
FAR (false acceptance rate) is the rate at which false acceptances occur.
What is an SNMP trap?
An Simple Network Management Protocol (SNMP) trap is an automated notification sent by an SNMP-enabled device to a management station, signaling that an event or threshold has been reached. It’s a type of unsolicited alert from a network device that communicates significant incidents or status changes without request.
Matt uploads a malware sample to a third-party malware scanning site that uses multiple antimalware and antivirus engines to scan the sample. He receives multiple different answers for what the malware package is. What has occurred?
One of the challenges security practitioners can face when attempting to identify malware is that different antivirus and antimalware vendors will name malware packages and families differently. This means that Matt may need to look at different names to figure out what he is dealing with.
Mike wants to make it harder to break the encryption for a file that needs to stay secure for a number of years. Which of the following solutions should he select?
A. Digitally sign the file.
B. Increase the key length.
C. Hash the file before encrypting it.
D. Encrypt the file before hashing it.
B. A longer key is generally stronger for modern cryptosystems, and a longer key will be harder to crack. Signing the file helps with nonrepudiation but not resistance to cracking the encryption. Hashing the file before encrypting it or hashing it after will not help in this scenario.
Define ABAC
Attribute-Based Access Control (ABAC) is a flexible access control methodology where access rights are granted to users through the use of policies which combine attributes together. The attributes can be related to the user, the resource to be accessed, and the current environment.
Define DAC
Discretionary Access Control (DAC) is an access control method where access rights are assigned by the owner of the resource. It allows users to control resources they own by granting or restricting access to other users.
Define MAC as it pertains to access control
Mandatory Access Control (MAC) is a strict access control model that enforces access policies based on clearance levels of users and data classification. It is commonly used in environments that require high security, where access decisions are made by a central authority.
Cindy is concerned that her organization may be targeted by a supply chain attack and is conducting a review of all of her vendor and supplier partners. Which one of the following organizations is least likely to be the conduit for a supply chain attack?
A. Hardware provider
B. Software provider
C. Managed service provider
D. Talent provider
D. Supply chain attacks are typically associated with vendors and suppliers that provide technology infrastructure or services that may be compromised. This would include hardware and software providers as well as managed service providers (MSPs). Talent providers, who help with staffing solutions, are generally not considered common avenues for supply chain attacks.
What is smishing?
SMS (text message) based phishing
Which of the following is not a common constraint of an embedded system?
A. Compute
B. Cost
C. Network
D. Authentication
B. Embedded systems are available at many price points. Understanding constraints that limited resources create for embedded systems helps security professionals identify appropriate security controls and options.
What type of access control scheme best describes the Linux filesystem?
Linux users can change who can read, write, or execute files and directories they own, which is discretionary access control (DAC). Mandatory access control (MAC) would enforce settings set by the systems administrator without users having the rights to make their own decisions. While role-based access control is involved, DAC best describes the access control scheme. ABAC is not a default method for setting rights for the Linux filesystem.
What is an access control vestibule?
An access control vestibule uses a pair of doors. When an individual enters, the first door must be closed and secured before the second door can be opened. This helps prevent tailgating, since the person entering will notice anybody following them through the secured area.
What is a Faraday cage used for?
A Faraday cage is used to stop electromagnetic interference (EMI).
What is a bollard?
A device that prevents vehicular traffic.
Define air gap
A physical separation of networks or devices
What is a watering hole attack?
Watering hole attacks rely on compromising or infecting a website that targeted users frequently visit, much like animals will visit a common watering hole.
Define whaling
Whaling is a type of phishing scam that targets high-profile individuals within an organization, like executives (the “big fish”). The attacks are highly personalized to trick the victim into divulging confidential information or transferring funds.
Define typosquatting
Typosquatting is a deceptive strategy where attackers register domain names that are misspellings of popular websites. Unsuspecting users who make typographical errors when entering a URL are led to fraudulent websites, which can result in phishing attacks or malware infections.
Define stream cipher
A stream cipher is an encryption method that encrypts digital data one bit or byte at a time. It combines plain text bits with a pseudorandom cipher digit stream (keystream), typically using bitwise XOR.
Define block cipher
A block cipher is an encryption method that divides text into fixed-sized blocks and encrypts them one at a time. It provides a high level of security by using various modes of operation and can repeatedly change the key during the encryption process.
What is a legal hold notice?
A legal hold is a notification that litigation is in progress or active and that data and documents related to the case must be preserved. Legal holds are used to ensure that information relevant to the case is not lost or destroyed.
What is striping as it pertains to RAID?
Striping (RAID 0) is a method of dividing data into blocks and spreading it evenly across two or more disks to improve speed and capacity. However, it does not provide redundancy; if one disk fails, all data is lost.
What is mirroring as it pertains to RAID?
Mirroring (RAID 1) involves creating an exact copy of a set of data on two or more disks. This provides high fault tolerance because if one disk fails, the data can be retrieved from the other.
What is parity as it pertains to RAID?
Parity (RAID 5) involves spreading data across multiple disks and adding a parity block to each write operation. The parity blocks are used to recover data from a failed disk, providing a balance between performance and data protection.
What is double parity as it pertains to RAID?
Double parity (RAID 6) extends the single parity system of RAID 5 by adding a second parity block. This allows for two disk failures within the array without loss of data and provides a greater fault tolerance.
What are the benefits of RAID 10?
RAID 10 (Mirroring and Striping): Combines the benefits of RAID 0 and RAID 1 for both redundancy and improved performance. Requires a minimum of four drives.
Allan is preparing to harden his organization’s network switches. Which of the following is not a common hardening technique for network devices?
A. Removing unnecessary software
B. Installing patches
C. Administrative VLANs
D. Changing default passwords
A. Unlike computers and mobile devices, switches and other network devices typically do not have additional software that can be removed. Installing patches, placing administrative interfaces on protected VLANs, and changing default passwords are all common hardening techniques for network devices like switches.
Matt is updating the organization’s threat assessment process. What category of control is Matt implementing?
Managerial controls are procedural mechanisms that focus on the mechanics of the risk management process.
Michelle wants to prevent unauthorized applications from being installed on a Windows system. What type of tool can she use to stop applications from being installed?
A Windows Group Policy Object (GPO) can be used to control whether users are able to install software.
Yasmine believes that her organization may be dealing with an advanced rootkit and wants to write IoC definitions for it. Which of the following is not likely to be a useful IoC for a rootkit?
A. File hashes
B. Command and control domains
C. Pop-ups demanding a ransom
D. Behavior-based identifiers
C. Rootkits are intended to be stealthy, and a pop-up demanding ransom works against that purpose. File hashes, command and control details, and behavior-based identifiers are all useful IoCs likely to be relevant to a rootkit.
Define GPO
In the context of Windows systems, a GPO (Group Policy Object) is a virtual collection of policy settings created using Microsoft’s Group Policy technology. GPOs control the working environment of user and computer accounts, managing a range of configurable settings within an Active Directory environment.
What are IoCs?
An IoC (Indicator of Compromise) is forensic data gathered from system logs, files, or other sources that indicate a potential intrusion or malicious activity within a network or system.
What is command and control?
Command and Control refer to methods cyber attackers use to maintain communication with compromised systems within a target network, typically to control malware, exfiltrate data, or issue commands to infected hosts.
Which one of the following items is not normally included in a request for an exception to security policy?
A. Description of a compensating control
B. Description of the risks associated with the exception
C. Proposed revision to the security policy
D. Business justification for the exception
C. Requests for an exception to a security policy would not normally include a proposed revision to the policy. Exceptions are documented variances from the policy because of specific technical and/or business requirements. They do not alter the original policy, which remains in force for systems not covered by the exception.
Emily is the Chief Information Security Officer (CISO) at a rapidly growing fintech startup. The company provides services to numerous other businesses, and as a result, they often receive requests from their clients to verify their security controls. To avoid the burden of multiple independent third-party audits from their various clients, Emily is considering a common standard that could be used by auditors to assess the organization’s controls. What standard should Emily consider to alleviate this audit burden?
Emily is looking for a solution to minimize the load of numerous third-party audits. In such a situation, SSAE 18, also referred to as service organization controls (SOC) audits, is an ideal solution as it provides a common standard for auditors assessing service organizations. It allows the organization to undertake an external assessment instead of multiple third-party assessments, sharing the resulting report with customers and potential clients. While COBIT, ISO 27001, and ISO 27002 are valuable auditing and assessment standards, they do not specifically address the issue of multiple third-party audits. COBIT is a common framework for conducting audits and assessments, ISO 27001 describes an approach for setting up an information security management system, and ISO 27002 provides more detail on the specifics of information security controls, but none of them offer a solution like SSAE 18 for service organizations facing numerous audits.
What is COBIT?
COBIT (Control Objectives for Information and Related Technologies) is a framework for IT management and governance, providing a set of best practices and models to help organizations ensure effective control over information systems and technology.
What is ISO 27001?
ISO 27001 is an international standard for information security management systems (ISMS), providing a framework for establishing, implementing, maintaining, and continually improving information security within an organization.
What is ISO 27002?
ISO 27002 provides guidelines and best practices for implementing information security controls within the context of an ISO 27001 ISMS framework. It covers the selection, implementation, and management of controls based on risk assessment.
What is SSAE 18?
SSAE 18 (Statement on Standards for Attestation Engagements No. 18) is an auditing standard for service organizations, ensuring that they have adequate controls and processes in place. It’s the standard that guides the execution of SOC 1 audits.
What is a NGFW?
A next-generation firewall (NGFW) device is typically designed and built to be more capable at high speeds and throughput than a universal threat management device. A NGFW offers standard firewall capabilities such as packet filtering, along with advanced features like encrypted traffic inspection, intrusion prevention systems, and the ability to identify and block sophisticated attacks.
Define UTM
Unified Threat Management (UTM) provides a comprehensive security solution that combines multiple security features and services, including antivirus, anti-spam, firewall, and intrusion detection, in a single device or service package.
Which one of the following statements is not true about zero-day attacks?
A. They may be found in software or hardware.
B. They have a limited window of use.
C. They are generally unpatchable.
D. They are often widely publicized.
D. Zero-day attacks are generally known only to a small group of researchers who discover the vulnerabilities. They are not known to the general public and would likely be patched by the vendor if they became widely known. Zero-day vulnerabilities may exist in any technology component: software or hardware. They are only effective during the limited window of opportunity when they remain unpatchable before the vendor issues a fix.
Isaac needs to sanitize an SSD that uses full-disk encryption and that has been encrypted for its full service life with the company he works for. What is the most effective means of making the data on the SSD no longer retrievable?
A. Completely overwrite the drive with binary 0s.
B. Reformat the drive using a full format.
C. Completely overwrite the drive with random patterns of binary 1s and 0s.
D. Destroy the encryption key for the drive and then use the SATA secure erase command.
D. Isaac can simply destroy all copies of the encryption key for the drive to make the data very difficult to access. Using the built-in secure erase command will ensure that the data is no longer recoverable under any normal circumstances. Overwriting SSDs and other flash media that are overprovisioned with additional space for wear leveling purposes is likely to miss remnant data in spare or replaced space. Formatting a drive simply removes the file indices and does not remove the data.
What are the common methods of performing root cause analysis?
Common methods of performing a root cause analysis include the 5 Whys technique, where you ask “why” multiple times to drill down to the underlying cause; Fishbone (Ishikawa) Diagram, which identifies potential factors causing an overall effect; and the Fault Tree Analysis, which uses a tree-like model to deduce the root causes of a problem. These methods aim to uncover the primary cause of a problem rather than focusing on symptoms.
What is a root/branch review?
This method involves examining the problem (root) and its manifestations or symptoms (branches) to understand the cause-and-effect relationship. It helps in identifying not just what happened and how, but why it happened, ensuring that solutions address the core issue.
Under the European Union’s GDPR, what term is assigned to the individual who leads an organization’s privacy efforts?
Data protection officer
Precompiled SQL statements that only require variables to be input are an example of what type of application security control?
A parameterized query (sometimes called a prepared statement) uses a prebuilt SQL statement to prevent SQL-based attacks. Variables from the application are fed to the query, rather than building a custom query when the application needs data.
Gary has deployed a technology that allows him to manage his network via APIs. He uses the technology to dynamically manage the network as part of his zero-trust deployment and to ensure appropriate performance from the network. What type of network technology is Gary using?
Software-defined networking (SDN) uses software-based controllers and application programming interfaces to control networks. It is frequently used to ensure proper performance by making dynamic changes to networks and is a common element in zero-trust deployments.
Sally is working to restore her organization’s operations after a disaster took her datacenter offline. What critical document should she refer to as she restarts systems?
A documented restoration order helps ensure that systems and services that have dependencies start in the right order and that high-priority or mission-critical services are restored first.
What is TOTP?
Time-Based One-Time Password (TOTP) generates a password that is valid for only a short period of time, using a shared secret and the current time to ensure each password is unique and temporary.
Define HOTP
HMAC-Based One-Time Password (HOTP) generates a one-time password using a counter that increments with each new password. It relies on a shared secret key and a simple counter mechanism for password generation.
What is restoration order?
In disaster recovery, the restoration order is the sequence in which systems, applications, and data are restored to return to operational status. This order is critical for minimizing downtime and ensuring critical services are prioritized.
What is the difference in how trojans, worms, and viruses infect a device?
- Trojans: Disguise themselves as legitimate software to trick users into installing them, providing a backdoor for malicious activities.
- Worms: Self-replicate without human interaction, spreading across networks by exploiting vulnerabilities.
- Viruses: Attach themselves to clean files and require human action (like opening a file) to execute and infect other files and systems.
Joe is examining the logs for his web server and discovers that a user sent input to a web application that contained the string WAITFOR. What type of attack was the user likely attempting?
The use of the SQL WAITFOR command is a signature characteristic of a timing-based SQL injection attack.
What is PAM?
Privileged Access Management (PAM) secures, manages, and monitors privileged accounts and access across an IT environment to protect critical resources and data.
What are just-in-time permissions?
This approach grants access rights as needed for a limited time, reducing the risk of unauthorized access or abuse of privileges.
Define password vaulting
A security practice where passwords are stored in a secured digital vault to prevent unauthorized access and improve password management.
Define ephemeral credentials
Temporary credentials that are automatically generated and expire after a short duration, enhancing security by minimizing the risk of credential misuse.
Define HMAC
Hash-Based Message Authentication Code (HMAC) is a security mechanism used to verify both the integrity and the authenticity of a message. It combines the use of a cryptographic hash function with a secret cryptographic key, creating a unique code (the MAC) that can be attached to a message. Here’s a breakdown for better understanding:
- Integrity: HMAC ensures that the message has not been altered from its original form. When the message is received, the recipient can compute their own HMAC using the same hash function and secret key. If the HMAC produced matches the one sent with the message, it confirms that the message has not been tampered with during transit.
- Authentication: The inclusion of a secret key that both the sender and receiver share adds a layer of authentication. Only someone with access to the same secret key could generate the correct HMAC for the message. This confirms the message’s origin, verifying that it was indeed sent by someone who possesses the shared secret key.
The process involves taking the original message and applying a hash function to it and the secret key in a specific way. This typically involves hashing the combination of the secret key and the message, then hashing that output again with the key to produce the final HMAC. This dual application of the hash function, combined with the key’s involvement, provides robust protection against tampering and impersonation.
HMAC is widely used in various security applications and protocols, including VPNs, API authentication, and securing data in transit over the internet. Its effectiveness lies in the difficulty of forging a valid HMAC without knowing the secret key, making it a reliable method for securing digital communications.
Marie is implementing a PAM solution and wants to ensure that root passwords are available in the event of an outage. Which PAM-related tool is most likely to be useful in this situation?
Password vaulting, which stores passwords for use with proper authentication and rights, is the most appropriate solution for Marie’s needs.
Which type of multifactor authentication is considered the least secure?
SMS messages are not secure and could be accessed by cloning a SIM card or redirecting VoIP traffic, among other possible threat models.
Which one of the following approaches, when feasible, is the most effective way to defeat injection attacks?
A. Input block lists
B. Input allow lists
C. Browser-based input validation
D. Signature detection
Input allow list approaches define the specific input type or range that users may provide. When developers can write clear business rules defining allowable user input, allow listing is definitely the most effective way to prevent injection attacks. Block lists achieve the same goal but attempt to block malicious content rather than allow approved content so they are less effective. Browser-based input validation is not a good practice because an attacker can easily bypass that validation. Signature detection is generally not used for injection attacks but rather for antivirus software.
Define SCADA
Supervisory Control and Data Acquisition (SCADA) refers to a system used to monitor and control industrial processes across various industries. It consists of hardware and software elements that allow organizations to control industrial processes locally or at remote locations, monitor, gather, and process real-time data, and directly interact with devices such as sensors, valves, pumps, motors, and more through human-machine interface (HMI) software. SCADA systems are essential for industrial automation, helping to ensure efficiency, process control, and data collection for critical decision-making.
Rick has been asked to secure a legacy SCADA environment that his organization uses to manage power generation facilities. What recommendation is best suited to a legacy environment that uses a combination of proprietary and open protocols and systems?
A. Require regular patching and enable local firewalls on all devices to build a zero-trust environment.
B. Deploy a HIPS for each device to protect each system from both known and behavioral threats.
C. Put the SCADA system on an isolated network and strictly control ingress and egress.
D. None of the above
C. Aging infrastructure that is tightly coupled to critical systems like a power generation facility is a common issue that enterprise security practitioners encounter in many industries. Placing devices that cannot otherwise be secured onto an isolated network and ensuring that only trusted and inspected access is allowed is a common solution. Since aging devices are often out of support, cannot be patched, and do not have support for firewalls or host-based intrusion prevention systems (HIPSs), those solutions are often unable to be implemented, particularly for the embedded and specialized devices found in supervisory control and data acquisition (SCADA) and industrial control systems (ICS) environments.
What are failure modes?
Definition: Failure modes are the various ways in which a system, component, or process can fail. Identifying failure modes helps in understanding how something might go wrong, assessing the potential impact of different types of failures, and implementing measures to mitigate or prevent such failures.
- Fail-Open: A security mechanism that defaults to allowing access or operation when it fails or malfunctions, prioritizing availability over security.
- Fail-Closed: Conversely, this approach defaults to denying access or operation in the event of a failure, prioritizing security over availability.
What are the principles of social engineering?
In cybersecurity, social engineering principles are psychological tactics used by attackers to manipulate individuals into divulging confidential information or performing actions that compromise security. Key principles include:
- Authority, where the attacker poses as someone in power
- Urgency, creating a false sense of immediate action needed
- Scarcity, suggesting limited time or availability
- Social proof, pretending to be a trusted entity
- Liking, where attackers build rapport or a sense of affinity with their target
These principles exploit human nature to bypass technical security measures.
Charles needs to know about actions an individual performed on a PC. What is the best starting point to help him identify those actions?
Although it may be tempting to use a technical answer, interviewing the individual involved is the best starting point when a person performed actions that need to be reviewed. Charles can interview the staff member, and then move on to technical means to validate their responses.
What is a UTM device?
Unified threat management (UTM) devices are designed to be all-in-one security devices that can act as a firewall. They commonly offer services ranging from IPS and IDS to spam filtering and antivirus/antimalware.
Angela has chosen to federate with other organizations to allow use of services that each organization provides. What role does Angela’s organization play when they authenticate their users and assert that those users are valid to other members of the federation?
Identity provider (IdP)
Define EAP
Extensible Authentication Protocol - a framework used in wireless networks and Point-to-Point connections, allowing for the deployment of various authentication methods, including passwords, tokens, and certificates.
Define IdP
Identity provider - a service that stores and verifies user identity information, providing authentication services to other applications within a single sign-on (SSO) or federated identity system.
Define footprinting
The process of gathering information about a target system, network, or organization to identify potential vulnerabilities and attack vectors.
What are HSMs?
Hardware Security Modules are physical devices that provide secure cryptographic key storage and management, often used to enhance security in transaction systems, data storage, and applications requiring high assurance of key security.
What are CASBs?
Cloud Access Security Brokers - security policy enforcement points that sit between cloud service consumers and providers to ensure that network traffic complies with the organization’s security policies.
Which team member acts as a primary conduit to senior management on an IR team?
Members of management or organizational leadership act as a primary conduit to senior leadership for most incident response teams. They also ensure that difficult or urgent decisions can be made without needing escalated authority.
Define SWG
Secure Web Gateways - appliances or software that monitor and enforce company policies on internet usage, blocking malicious traffic and preventing unauthorized access to harmful websites.
What are the main benefits of automation in cybersecurity operations?
- Efficiency and time savings
- Enforcing baselines
- Standardizing infrastructure configurations
- Scaling in a secure manner
- Retaining employees
- Reducing reaction time
- Serving as a workforce multiplier
When Mike receives the message that David encrypted for him, what key should he use to decrypt the message?
In an asymmetric encryption algorithm, the recipient of a message uses their own private key to decrypt messages that they receive.
What term is given to an individual or organization who determines the reasons for processing personal information?
Data controllers are the entities who determine the reasons for processing personal information and direct the methods of processing that data. This term is used primarily in European law, and it serves as a substitute for the term data owner to avoid a presumption that anyone who collects data has an ownership interest in that data.
Grace received a digitally signed message from Richard and would like to verify the digital signature. What key should she use to perform this verification?
The recipient of a digitally signed message may verify the digital signature by decrypting it with the public key of the individual who signed the message.
Which one of the following data protection techniques is reversible when conducted properly?
A. Tokenization
B. Masking
C. Hashing
D. Shredding
Tokenization techniques use a lookup table and are designed to be reversible. Masking and hashing techniques replace the data with values that can’t be reversed back to the original data if performed properly. Shredding, when conducted properly, physically destroys data so that it may not be recovered.
Lin’s hardware manufacturer has stopped selling the model of device that Lin’s organization uses and has also stopped providing security or other updates. What phase of the hardware life cycle is the device in?
Legacy hardware is unsupported and no longer sold. End-of-life typically means that the device is no longer being made but is likely to still have support for a period of time. End-of-sales means the device is no longer being sold, but again, may have support for some time.
What is the order of volatility of data sources for forensic practitioners?
- CPU registers, cache
- Routing table, ARP cache, process table, kernel statistics
- RAM
- Swap space
- Data on hard disk
- Remotely logged data
- Data stored on backup media
Vince is choosing a symmetric encryption algorithm for use in his organization. He would like to choose the strongest algorithm from these choices. What algorithm should he choose?
A. DES
B. 3DES
C. RSA
D. AES
AES is the successor to 3DES and DES and is the best choice for a symmetric encryption algorithm. RSA is a secure algorithm, but it is asymmetric rather than symmetric.
What is the GLBA?
GLBA (Gramm-Leach-Bliley Act):
A U.S. law that requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data.
Define SOX
SOX (Sarbanes-Oxley Act):
A U.S. law aimed at protecting investors from fraudulent financial reporting by corporations, requiring strict financial record keeping and reporting.
Define espionage
The act of obtaining secret or confidential information without the permission of the holder of the information. Espionage is a method used in warfare, spying, and theft of trade secrets.
Greg’s desktop system stores hashes of the system’s firmware, bootloader, drivers, and other components that are loaded at boot in the TPM, and then boots. The OS then uses a remote attestation client to send that information to a server. What type of boot process is he using?
Measured boot
What does secure boot do?
Validates hashes against known good hashes for those boot elements
Susan wants to create a dashboard that shows her aggregated log events related to logins from different geographic regions. Her goal is to identify impossible travel scenarios. Which of the following solutions should she select to accomplish that goal?
A. IPS
B. OS logs
C. SIEM
D. Vulnerability scan data
A SIEM with correlation rules for geographic IP information as well as user IDs and authentication events will accomplish Susan’s goals. An IPS may detect attacks, but it isn’t well suited to detecting impossible travel. OS logs would need to be aggregated, and vulnerability scan data won’t show this at all.
What is a SIEM tool?
SIEM Tool (Security Information and Event Management Tool):
A software solution that aggregates and analyzes activity from many different resources across your IT infrastructure, providing real-time analysis of security alerts generated by applications and network hardware.
What is a measured boot?
A process that measures each component, from firmware up through the operating system, used during the boot process of a device to ensure they have not been tampered with.
What is a parameter pollution attack?
A type of web attack where attackers manipulate or “pollute” the parameters of a web application to create unexpected outcomes, often bypassing site security measures.
Example:
http://www.mycompany.com/servicestatus.php?serviceID=892&serviceID=892’%20;DROP%20TABLE%20Services;–
In this case, it appears that the attacker was waging a SQL injection attack and tried to use parameter pollution to slip the attack past content filtering technology. The two instances of the serviceID parameter in the query string indicate a parameter pollution attempt.
What is the key difference between hashing and checksums?
A. Both can validate integrity, but a hash also provides a unique digital fingerprint.
B. A hash can be reversed, and a checksum cannot be.
C. Checksums provide greater security than hashing.
D. Checksums have fewer message collisions than a hash.
Although both a checksum and a hash can be used to validate message integrity, a hash has fewer collisions than a checksum and will also provide a unique fingerprint for a file. Checksums are primarily used as a quick means of checking that that integrity is maintained, whereas hashes are used for many other purposes such as secure password validation without retaining the original password. A checksum would not be useful for proving a forensic image was identical, but it could be used to ensure that your work had not changed the contents of the drive.
Alyssa wants to harden iOS devices her organization uses. What set of guidelines can she follow to align to common industry security practices?
A. OWASP
B. CIS benchmarks
C. NIST 800-103
D. NIST 800-111
The Center for Internet Security (CIS) provides hardening guidelines known as CIS benchmarks that Alyssa can use as a guide to secure her organization’s iOS devices. OWASP does not provide these, and NIST provides general guidance, not OS- or device-specific configuration guides.
Which of the following defenses is most likely to prevent Trojan installation?
A. Installing patches for known vulnerabilities
B. Preventing downloads from application stores
C. Preventing the use of USB drives
D. Disabling autorun from USB drives
Trojans are often found in application stores where they appear to be innocuous but desirable applications or are listed in confusingly similar ways to legitimate applications. Many organizations choose to lock down the ability to acquire applications from app stores to prevent this type of issue. Since Trojans do not self-spread and rely on user action, patching typically won’t prevent them. While users may try to transfer files via USB, this isn’t the most common means for modern Trojans to spread.
Frank needs to choose a mobile device deployment option for his organization. He wants to allow users to use devices that his organization selects and purchases for their own use. Which mobile solution should he select?
The corporate-owned, personally enabled (COPE) model allows end users to use their devices for personal as well as corporate use while providing corporate control and management of the mobile devices.
What is the COPE model?
COPE Model (Corporate-Owned, Personally Enabled):
A policy where the organization owns the devices but allows employees to use them for personal tasks, providing a balance between control and flexibility.
Define VDI
VDI (Virtual Desktop Infrastructure):
A technology that hosts desktop environments on a centralized server and deploys them to end-users on request, allowing remote access to a desktop interface.
Define CYOD
CYOD (Choose Your Own Device):
A policy that allows employees to choose from a list of approved devices for work use, offering flexibility while maintaining control over security.
Define BYOD
BYOD (Bring Your Own Device):
A policy allowing employees to use their personal devices for work purposes, emphasizing convenience and personal preference, with security managed through corporate guidelines.
What is a honeynet?
A network set up with intentional vulnerabilities; its purpose is to attract hackers and study their tactics, acting as a decoy to improve security defenses. Example: A fake financial website designed to lure and analyze malware attacks. The same concept as a honeypot, except on the network or group-of-systems level.
What is a tarpit?
A service that intentionally delays incoming connections, slowing down attackers or automated scripts, effectively trapping them to prevent or mitigate spam and unauthorized access. Example: A mail server that uses tarpitting to slow down mass email sending operations by spammers.
What does ISO 27001 cover?
A framework for managing and protecting information assets, ensuring confidentiality, integrity, and availability through a comprehensive set of policies, procedures, and controls.
What does ISO 27002 cover?
Provides best practice guidelines on information security controls for implementing and achieving ISO 27001 certification, including user access management, incident management, and security policies.
What does ISO 27701 cover?
Extends ISO 27001 to cover privacy-specific requirements, helping organizations manage personal data securely and in compliance with privacy regulations.
What does ISO 31000 cover?
Offers guidelines on risk management principles and the implementation of risk assessment practices, aiming to help organizations identify, assess, and manage risks across different areas of operation.
Naomi has discovered the following TCP ports open on a system she wants to harden. Which ports are used for unsecure services and thus should be disabled to allow their secure equivalents to continue to be used?
A. 21, 22, and 80
B. 21 and 80
C. 21, 23, and 80
D. 22 and 443
The services listed are:
21—FTP 22—SSH 23—Telnet 80—HTTP 443—HTTPS
Of these services, SSH (Port 22) and HTTPS (port 443) are secure options for remote shell access and HTTP. Although secure mode FTP (FTP/S) may run on TCP 21, there is not enough information to know for sure, and HTTPS can be used for secure file transfer if necessary. Thus, Naomi’s best option is to disable all three likely unsecure protocols: FTP (port 21), Telnet (port 23), and HTTP (port 80).
Wendy is scanning cloud-based repositories for sensitive information. Which one of the following should concern her most, if discovered in a public repository?
A. Product manuals
B. Source code
C. API keys
D. Open source data
All of these items could be concerning, depending on the circumstances. However, API keys should never be found in public repositories because they may grant unauthorized individuals access to information and resources.
Jim wants to view log entries that describe actions taken by applications on a Red Hat Linux system. Which of the following tools can he use on the system to view those logs?
A. logger
B. syslog-ng
C. journalctl
D. tail
Red Hat Enterprise uses journalctl to view journal logs that contain application information. Jim should use journalctl to review the logs for the information he needs. The tool also provides functionality that replicates what head and tail can do for logs. Syslog-ng is a logging infrastructure, and though logs may be sent via syslog-ng, it is not mentioned here. logger is a logging utility used to make entries in the system log.
Charlene wants to prevent attacks against her system that leverage flaws in the services that it provides while still keeping the services accessible. What hardening technique should she use?
A. A host-based firewall
B. A host-based IPS
C. Encryption
D. An EDR
A host-based intrusion prevention system (HIPS) can detect and prevent attacks against services while allowing the service to be accessible. A firewall can only block based on port, protocol, and IP; encryption won’t prevent this; and an EDR is primarily targeted at malicious software and activity, not at network-based attacks on services.
What type of digital certificate provides the greatest level of assurance that the certificate owner is who they claim to be?
Extended validation (EV) certificates provide the highest available level of assurance. The CA issuing an EV certificate certifies that they have verified the identity and authenticity of the certificate subject.
What is the difference between inline CASBs and API-based CASBs?
Inline CASBs: These solutions act as intermediaries, intercepting requests and data moving between the user and the cloud service provider, providing real-time security enforcement.
API-based CASBs: These solutions integrate with cloud service providers using their APIs, allowing them to monitor and manage data and user activity within cloud applications indirectly, without requiring inline traffic inspection.
Tina is applying a digital signature to a contract so that the recipient can prove that she agreed to its terms. What goal of cryptography most directly describes Tina’s actions?
A. Nonrepudiation
B. Confidentiality
C. Integrity
D. Authentication
Nonrepudiation ensures that individuals can prove to a third party that a message came from its purported sender. Although Tina may also achieve other goals with her approach, this goal is her stated intention.
Tina’s organization is operating in a platform-as-a-service (PaaS) environment. Which of the following is a shared responsibility according the shared responsibility matrix in a PaaS environment?
A. Information and data
B. Identity infrastructure
C. Physical hosts
D. Accounts and identities
PaaS environments commonly rely on customers and providers to maintain identity and directory infrastructure, applications, and network controls. Customers manage information and data, devices, and accounts and identities, whereas providers are responsible for operating systems, physical hosts, networks, and datacenters.
What is the Security+ incident response cycle?
Preparation > Detection > Analysis > Containment > Eradication > Recovery
Then, begin the cycle again.
What is meant by “purpose limitation”
Organizations should only use data for the purposes disclosed during the collection of that data.
What is the key difference between a split-tunnel and a full-tunnel VPN?
A split-tunnel VPN sends traffic intended for the remote VPN network through the tunnel and responses back to the client.
A full tunnel sends any traffic (including internet-bound) through the corporate network. This provides enhanced security at the cost of corporate bandwidth.
Grace would like to determine the operating system running on a system that she is targeting in a penetration test. Which technique will most directly provide her with this information?
Footprinting is a technique specifically designed to elicit this information.
What are sideloaded applications?
Sideloading is the process of copying files between two devices like a phone and a laptop, desktop, or storage device.
Mark unplugs the network connection from a system that is part of an incident and places tape over its Ethernet jack with a sign that says, “Do not reconnect without approval from IR team.” How is this method best described?
Isolation. Mark has isolated the system by removing it from the network and ensuring that it cannot communicate with other systems.
Linda is migrating a system from an on-premises environment to an IaaS provider. The system is currently protected using network firewall rules that limit remote access. What cloud control can Linda use to achieve this same objective?
Security groups are used to limit network access to a server instance in the cloud. They are the equivalent of network firewall rules in an on-premises environment.
Helen’s organization is planning to deploy IoT devices across their buildings as part of a HVAC system. Helen knows that the vendor for the IoT devices does not provide regular security updates to the device’s web interfaces that are used to manage the devices. What security control should she recommend to help protect the devices on the network?
A. Install host-based firewalls.
B. Deploy the IoT devices to a protected VLAN.
C. Install host-based IPS.
D. Disable the web interfaces for the IoT devices.
Since the web interfaces are needed to manage the devices, Helen’s best option is to place the IoT devices in a protected VLAN. IoT devices will not typically allow additional software to be installed, meaning that adding firewalls or a HIPS won’t work.
Define POP
POP (Post Office Protocol):
Allows email clients to retrieve emails from a server; the latest version, POP3, is widely used but considered less flexible than IMAP because it typically downloads and deletes messages from the server.
What is IMAP?
IMAP (Internet Message Access Protocol):
Enables email clients to access messages stored on a mail server, allowing for synchronization across multiple devices. It is more versatile than POP3, as emails are stored on the server and can be accessed from anywhere.
Define SPF
SPF (Sender Policy Framework):
An email authentication method that prevents sender address forgery by specifying which mail servers are permitted to send email on behalf of a domain.
Define DKIM
DKIM (DomainKeys Identified Mail):
An email security standard designed to ensure that messages are not altered in transit between the sending and receiving servers, using digital signatures.
Define DMARC
DMARC (Domain-based Message Authentication, Reporting, and Conformance):
Builds on SPF and DKIM, allowing domain owners to protect their domain from unauthorized use, commonly known as email spoofing. DMARC provides instructions to receiving servers on how to handle non-aligned emails.
Define soft token
Soft Token:
A software-based security token that generates a one-time use login PIN. Unlike hard tokens, soft tokens are software that can be installed on a user’s device.
Define hard token
Hard Token:
A physical device used to gain access to a secured resource. Hard tokens can generate or store unique authentication codes, passwords, or cryptographic keys.
Brian has deployed a system that monitors sensors and uses that data to manage the power distribution for the power company that he works for. Which of the following terms is commonly used to describe this type of control and monitoring solution?
SCADA (supervisory control and data acquisition) is a system architecture that combines data acquisition and control devices with communications methods and interfaces to oversee complex industrial and manufacturing processes, just like those used in utilities.
Melissa receives a call and the caller informs her a senior manager in her organization needs her to buy gift cards for an event that starts in an hour. The caller says that the senior leader forgot to get the cards, and that the event is critical to her organization. Melissa buys the cards and sends them to the Gmail address the caller says that the senior leader needs them sent to. What type of attack has Melissa fallen for?
The caller is using pretexting, providing Melissa with a story that relies on urgency and perceived authority to get her to take actions she might normally question.
Valerie wants to replace the telnet access that she found still in use in her organization. Which protocol should she use to replace it, and what port will it run on?
Telnet provides remote command-line access but is not secure. SSH is the most common alternative to telnet, and it operates on port 22.
Georgia wants to ensure that if a network tap she has installed fails due to an extended power outage that traffic still flows to her network. What should she deploy?
A. A passive fail-open tap
B. A passive fail-closed tap
C. An active fail-open tap
D. An active fail-closed tap
A. A passive fail-open tap. This type of network tap is designed to allow network traffic to continue flowing even if the tap loses power or fails for some reason. Unlike active taps, which require power to actively direct traffic, passive fail-open taps ensure minimal disruption to network continuity, aligning with Georgia’s requirement for maintaining network flow during a power outage.
Chris operates a database-driven e-commerce website and wants to be able to restore his backups to the point in time when an outage occurs, resulting in a very short recovery point objective (RPO). What type of backup capability will he need to be able to do this without losing data?
Journaling. Chris will need a database backup solution that supports Point-in-Time Recovery (PITR) capability. PITR allows the restoration of a database to the exact moment before an outage or corruption occurred by using saved backup files and a log of transactions (journaling) that occurred after the backup. This method ensures minimal data loss, aligning with the goal of achieving a very short Recovery Point Objective (RPO) by replaying transactions up to the specified moment, thus maintaining data integrity and continuity.
What is a KMS?
Key management system, or KMS, allows customers to securely create, store, and manage keys in a cloud environment.
Fred wants to ensure that the administrative interfaces for the switches and routers are protected so that they cannot be accessed by attackers. Which of the following solutions should he recommend as part of his organization’s network design?
A. NAC
B. Trunking
C. Out-of-band management
D. Port security
Out-of-band management places the administrative interface of a switch, router, or other device on a separate network or requires direct connectivity to the device to access and manage it. This ensures that an attacker who has access to the network cannot make changes to the network devices. NAC and port security help protect the network itself, whereas trunking is used to combine multiple interfaces, VLANs, or ports together.
Define VM sprawl
Virtual machine (VM) sprawl occurs when IaaS users create virtual service instances and then forget about them or abandon them, leaving them to accrue costs and accumulate security issues over time. Organizations should maintain instance awareness to avoid VM sprawl issues.
Tom wants to duplicate all traffic passing through a network connection but does not want to add any additional load to the switch that it is passing through. What should he do to accomplish this?
A tap is a device that independently sends a copy of network traffic to another path or location. Both active and passive taps exist, and they offer the advantage of not requiring the switch or router to process the traffic.
Chris has turned on logon auditing for a Windows system. Which log will show them?
The Windows Security log records logon events when logon auditing is enabled.
Amitoj wants to ensure that her organization’s password policy does not allow users to reset their password multiple times until they can reuse their current password. What setting is used to prevent this?
Password age is set to prevent users from resetting their password enough times to bypass reuse settings.
Maria is considering a BYOD device deployment and wants to enroll the devices in an MDM application. What key concern will she likely need to address with her users in the event that a device is lost and the organization wants to respond to ensure no corporate data is lost?
Users in Maria’s organization are likely to be concerned about what would be wiped if the device was remotely wiped in the event it was lost. If the organization’s policy is to immediately fully wipe the device, and it is then recovered, their personal data may be lost. Organizational policies for BYOD devices can be complex, and many organizations choose to separate user and corporate data more completely via storage segmentation and other capabilities to avoid this scenario.
Define zero trust network
A security model that requires strict identity verification for every person and device trying to access resources on a private network, regardless of whether they are within or outside of the network perimeter. This approach operates on the principle “never trust, always verify,” eliminating implicit trust and continuously authenticating and authorizing users and devices.
Acme Widgets has 10 employees and they all need the ability to communicate with one another using a symmetric encryption system. The system should allow any two employees to securely communicate without other employees eavesdropping. If Acme Widgets switched to an asymmetric encryption algorithm, how many keys would be required to add the 11th employee?
In an asymmetric encryption algorithm, each employee needs only two keys: a public key and a private key. Adding a new user to the system requires the addition of these two keys for that user, regardless of how many other users exist.
Michelle enables the Windows picture password feature to control logins for her laptop. Which type of attribute will it provide?
A. Somewhere you are
B. Something you know
C. Something you are
D. Someone you know
Picture password asks users to click on specific, self-defined parts of a picture. This means that clicking on those points is something you know.
Define hot aisle
The aisle where systems in a datacenter exhaust warm air.
Ellen is concerned about her company’s resilience and wants to ensure it can handle either changing loads or support disaster recovery and business continuity efforts if a primary location or datacenter were taken offline. Which of the following should she primarily focus on during her capacity planning?
A. People, technology, and infrastructure
B. A generator and a UPS
C. RAID 0, 1, 5, and 10
D. Incremental, differential, and full backups
Resilience requires capacity planning to ensure that capacity—including staff, technology, and infrastructure—is available when is needed. Although a generator, UPS, various RAID levels, and backups have their place in disaster recovery and contingency planning, they are not the primary focus of resiliency and capacity planning.
What is DNSSEC?
DNSSEC uses digital signatures to validate information provided by a DNS server, helping to prevent issues such as DNS poisoning. The public key and signature are passed down during a query. There is a chain of trust with each of the DNS servers involved in resolving a query, so tampering isn’t feasible.
Colin would like to implement a security control in his accounting department that is specifically designed to detect cases of fraud that are able to occur despite the presence of other security controls. Which one of the following controls is best suited to meet Colin’s need?
A. Separation of duties
B. Least privilege
C. Dual control
D. Mandatory vacations
Mandatory vacations are designed to force individuals to take time away from the office to allow fraudulent activity to come to light in their absence. The other controls listed here (separation of duties, least privilege, and dual control) are all designed to prevent, rather than detect, fraud.
Define mutation testing
A testing method where small changes are made to a program’s source code to test if the existing test cases can detect the mutations. It helps evaluate the effectiveness of test cases in uncovering defects.
What is dynamic code analysis?
A process that evaluates a program’s behavior during execution to identify errors in the code. Unlike static analysis, it requires the program to be in a running state.
Define code signing
A security technology that uses digital signatures to verify the authenticity and integrity of software code. It assures the recipient that the software has not been altered after it was signed.
It is both for authenticity of the author and the integrity of the code itself.
Define fraud
Any deceitful practice or false representation intended to gain unauthorized benefits, such as manipulating digital transactions or stealing personal information.
Define dual control
A security measure requiring two or more authorized individuals to perform and approve sensitive operations or transactions, enhancing protection against unauthorized access or fraud.
April is working with an independent auditor to produce an audit report that she will share with her customers under NDA to demonstrate that her organization has appropriate security controls in place and that those controls are operating effectively. What type of audit report should April expect?
A. SOC 2 Type 1
B. SOC 2 Type 2
C. SOC 3 Type 1
D. SOC 3 Type 2
The fact that the auditor will be assessing the effectiveness of the controls means that this is a Type 2 report, not a Type 1 report. The fact that it will be shared only under NDA means that it is a SOC 2 assessment.
What component of a virtualization platform is primarily responsible for preventing VM escape attacks?
The hypervisor is supposed to prevent this type of access by restricting a virtual machine’s access to only those resources assigned to that machine.
Which one of the CVSS metrics would contain information about the type of account access that an attacker must have to execute an attack?
The privileges required (PR) metric indicates the type of system access that an attacker must have to execute the attack.
Define ad-hoc networks
A type of network where devices communicate directly without a central router, typically set up for a specific purpose or task.
Example: A group of laptops sharing files directly in a meeting.
Define point-to-point networks
A direct communication link between two devices, facilitating dedicated data transmission.
Example: A leased line connecting two corporate offices.
Define RFID
RFID (Radio-Frequency Identification):
Definition: A technology using radio waves to read and capture information stored on a tag attached to an object.
Example: Tracking inventory in a warehouse.
Define threat hunting
Proactive searching through networks to detect and isolate advanced threats that evade existing security solutions.
Example: Using threat intelligence to search for indicators of compromise within network logs.
Define war driving
The act of searching for Wi-Fi wireless networks by a person in a moving vehicle, using a device with Wi-Fi to detect vulnerable networks.
Example: Mapping out open Wi-Fi networks in a city.
What are the types of CAs in PKI?
- Root CAs: The top-level certification authorities that issue Digital Certificates. They are trusted entities that issue certificates to Intermediate or lower-level CAs.
- Intermediate CAs: Entities authorized by a Root CA to issue certificates to end entities or other lower-level Intermediate CAs. They act as a chain between the Root CA and end-entity certificates to spread the trust.
- Public CAs: Commercial entities that issue digital certificates to the public for securing web transactions.
- Private CAs: Operated within an organization for internal purposes, not trusted by external entities unless the root certificate is manually imported.
Henry wants to check to see if services were installed by an attacker. What commonly gathered organizational data can he use to see if a new service appeared on systems?
Vulnerability scans are the best way to find new services that are offered by systems. In fact, many vulnerability scanners will flag new services when they appear, allowing administrators to quickly notice unexpected new services.
James, a customer service representative at an online retail company, is undergoing a security training program. As part of his role, he frequently communicates with customers, handling their queries and complaints. Which type of training would best equip James to handle social engineering and pretexting attacks that he may encounter in his work?
A. Role-based training
B. Anomalous behavior recognition
C. Hybrid/remote work environment training
D. Security policy training
The correct answer is role-based training. This approach tailors the training content to the specific job responsibilities of an individual. For a customer service representative like James, the focus would be on nontechnical aspects, particularly on dealing with social engineering and pretexting attacks. Anomalous behavior recognition, while important, is more focused on recognizing unexpected or risky behavior internally and is not specifically tailored to his role. Hybrid/remote work environment training and security policy training, although crucial, deal with best practices for remote work security and organizational security policies, respectively, and are not directly related to handling social engineering and pretexting attacks, which are a significant part of James’s job responsibilities.
Paul is the CEO of a large manufacturing company. He is concerned about the company’s compliance obligations and wants reassurance about the effectiveness of the organization’s internal controls. He is considering ordering an audit, but he isn’t sure which type of audit would best meet his needs and would like to keep costs down. Which type of audit should Paul consider for his needs?
Paul’s scenario is ideally suited to an internal audit. This is because internal audits are often conducted when management or the board of a company wishes to gain assurance that the company is meeting its compliance obligations. Furthermore, these audits are designed to identify control gaps in anticipation of a more formal external audit. While external audits and independent third-party audits can provide validation of an organization’s controls, they are typically performed by outside auditing firms or other organizations, not the organization itself and are more expensive.
Define MMS
MMS (Multimedia Messaging Service):
Definition: A standard way to send messages that include multimedia content over mobile networks.
Example: Sending a photo or video clip via text message.
Define RCS
RCS (Rich Communication Services):
Definition: A communication protocol between mobile carriers and between phone and carrier, aiming to replace SMS messages with a richer text message system.
Example: Chat features over mobile data, like group chat, video, and file sharing within text messaging.
What is an internal audit?
An objective examination and evaluation of an organization’s operations and controls conducted by an internal team.
Example: A company conducts an internal audit to assess the effectiveness of its financial controls.
What is an independent third-party audit?
An evaluation performed by an external organization not affiliated with the client, to ensure transparency and objectivity.
Example: A cybersecurity firm assessing a company’s IT infrastructure for vulnerabilities.
