Security Flashcards
A single server hosts a sensitive SQL-based database and a web service containing static content. A few of the database fields need to be encrypted due to
regulatory requirements. Which of the following would provide the BEST encryption solution for this particular server?
A.
Individual file
B.
Database
C.
Full-disk
D.
Record based
D
A building engineer just installed a new environmental control system (ECS) for a room that is critical to the company’s operation and needs the ability to manage
and monitor the system from any part of the network. Which of the following should the security administrator utilize to minimize the attack surface and still allow the
needed access?
A.
Configure the ECS host-based firewall to block non-ECS application traffic
B.
Create an encrypted connection between the ECS and the engineer’s computer
C.
Install a firewall that only allows traffic to the ECS from a single management and monitoring network
D.
Implement an ACL that permits the necessary management and monitoring traffic
A
Following a site survey for an upcoming 5GHz wireless network implementation, the project manager determines that several areas of the facility receive
inadequate coverage due to the use of vertical antennas on all access points. Which of the following activities would be MOST likely to remediate the issue without
changing the current access point layout in the facility?
A.
Convert all access points to models operating at 2.4GHz.
B.
Install antennas with lower front-to-back ratios to narrow the focus of coverage as needed.
C.
Reorient the existing antennas in horizontal configuration.
D.
Install unidirectional antennas to focus coverage where needed.
D
A company’s security analyst is investigating the suspected compromise of the company’s intranet web server. The compromise occurred at a time when no users
were logged into the domain. Which of the following is MOST likely to have prevented the attack from a new machine introduced to the corporate network?
A.
Domain log review
B.
802.1x
C.
NIDS
D.
Rogue detection
B
Upper management wishes to implement a policy forbidding the use of personal devices on the corporate network. Which of the following is the primary reason why
such a policy would be put in place?
A.
Devices connected to the corporate network become legally bound to company SLAs.
B.
Personally owned devices might not be subjected to the same security controls as corporate devices.
C.
Personal devices might contain personally owned media that could leave company open to licensing issues.
D.
Employees might not be properly trained to utilize the device on the corporate network.
B
The security administrator for a growing company is concerned about the increasing prevalence of personal devices connected to the corporate WLAN. Which of
the following actions should the administrator take FIRST to address this concern?
A.
Implement RADIUS to centrally manage access to the corporate network over WiFi.
B.
Request that senior management support the development of a policy that addresses personal devices.
C.
Establish a guest-access wireless network and request that employees use the guest network.
D.
Distribute a memo addressing the security risks associated with the use of personally-owned devices on the corporate WLAN.
B
A security engineer is monitoring suspicious traffic from an internal endpoint to a malicious landing page of an external entity. The internal endpoint is configured
using a limited account, is fully patched to current standards, and has current antivirus signatures. No alerts have been received involving this endpoint. The
security engineer finds malicious code on the endpoint during a forensic analysis. Which of the following MOST likely explains this occurrence?
A.
The external entity breached the IDS
B.
The antivirus engine was evaded
C.
The DLP did not detect the malicious code
D.
The endpoint was running on a hypervisor
B
A company uses PKI certificates stored on a smart chip enabled badge. The badge is used for a small number of devices that connect to a wireless network. A user
reported that their badge was stolen. Which of the following could the security administrator implement to prevent the stolen badge from being used to compromise
the wireless network?
A.
Asset tracking
B.
Honeynet
C.
Strong PSK
D.
MAC filtering
A
A company is implementing a system to transfer direct deposit to a financial institution. One of the requirements is that the institution must be certain that the
deposit amounts within the file have not been charged. Which of the following should be used to meet requirement?
A.
Key escrow
B.
Perfect forward secrecy
C.
Transport encryption
D.
Digital signatures
E.
File encryption
D
An application developer has coded a new application and needs to test all input fields. Which of the following should be used to fulfill this requirement?
A.
Application hardening
B.
Server-side validation
C.
Input validation
D.
Fuzzing
D
A security analyst has been asked to perform penetration testing against a web application being deployed for the first time. When performing the test the
application stops responding and returns an error referring to failed database connections. Upon further investigation, the analyst finds the database server was
inundated with commits which exhausted available space on the volume. Which of the following has been performed against the database server?
A.
DoS
B.
SQL injection
C.
SYN flood
D.
DDoS
E.
Cross-site scripting
A
Which of the following allows an application to securely authenticate a user by receiving credentials from a remote web domain?
A.
TACACS+
B.
RADIUS
C.
Kerberos
D.
SAML
D
Ann is preparing a presentation for management to highlight some of the issues the security department is facing trying to integrate the organizations BYOD policy.
Highest of her list is the transparency of network resources. The DAC environment includes several departments including payroll, HR, IT, and Management.
However, the small company’s structure has never been updated to incorporate these departments. The organization continued to add users based on the same
original general user profile. Which of the following security methods should Ann suggest to management to BEST fix this issue?
A.
Two-factor authentication
B.
Mandatory access control
C.
Application firewall
D.
Network segmentation
D
A university police department is housed on the first floor of a student dormitory. Which of the following would prevent students from using ARP spoofing attacks
against computers at the police department?
A.
Enable proxy ARP on router
B.
Private network addresses
C.
Separate Layer 2 VLANs
D.
Disable SSID broadcast
C
The CEO for company A has asked the security engineer to design a PKI for company A. The CEO has asked that it allow company A users to send signed and
encrypted emails to company B. The users from company B must have an inherent trust in certificates from company A, because the security policy of company B
disallows adding of new CAs to their trusted root container. Which of the following is the BEST solution?
A.
Request email certificates for the users of company A from the PKI of company B.
B.
Build a new CA within the boundary of company A and issue email certificates to the users
C.
Establish a sub CA of company B’s root CA to issue email certificates to the users.
D.
Procure the services of a common Internet root CA to issue email certificates to the users.
D
A security administrator is called to troubleshoot a computer infection. The computer’s software correctly identified the malware and flagged it to the central
management console; however the malicious payload was still executed. Which of the following can cause this scenario?
A.
The payload hash did not match known malware
B.
The antivirus is running an older virus definition
C.
The computer is running an IDS
D.
The payload is a zero-day attack
C
Am organization decides to implement a BYOD policy but wants to ensure they address requirements associated with any legal investigations and controls needed
to comply with the analysis and recreation of an incident. This concern is also known as which of the following?
A.
Data ownership
B.
Forensics
C.
Chain of custody
D.
Acceptable use
B
A security administrator is having continued issues with malware variants infecting systems infecting systems and encrypting several types of files. The malware
uses a document macro to create a randomly named executable that downloads the encrypted payload of the malware. Once downloaded, the malware searches
all drives, creates and HTML file with the decryption instructions in the directory, and then proceeds to encrypt the target files. Which of the following actions would
BEST interrupt the malware before it encrypts other files while minimizing the adverse impacts to the users?
A.
Block execution of documents with macros
B.
Block addition of documents with macros
C.
Block the creation of the HTML of the HTML document on the local system
D.
Block running external files from within documents.
A
A media company would like to securely stream live video feeds over the Internet to clients. The security administrator suggests that the video feed is encrypted in
transport and configures the web server to prefer ciphers suited to the live video feeds. Which of the following cipher suites should the administrator implement on
the web server to minimize the computational and performance overhead of delivering live feeds?
A.
ECDHE-RSA-RC4-SHA
B.
DHE-DSA-DES-CBC-SHA
C.
ECDHE-RSA-AES-CBC-SHA
D.
ECDHE-RSA-AES256-CBC-SHA
A
Several users require administrative access for software compatibility reasons. Over time, these users have made several changes to important system settings.
Which of the following is the BEST course of action to ensure the system settings are properly enforced?
A.
Require users to run under a standard user account
B.
Use centralized group policy to configure the settings
C.
Conduct user access reviews to determine appropriate privileges
D.
Implement an application whitelist throughout the company
B
In the course of troubleshooting wireless issues from users, a technician discovers that users are connecting to their home SSIDs while at work. The technician
scans detects none of those SSIDs. The technician eventually discovers a rogue access point that spoofs any SSID that a client requests. Which of the following
allows wireless use while mitigating this type of attack?
A.
Configure the device to verify access point MAC addresses
B.
Disable automatic connection to known SSIDs
C.
Only connect to trusted wireless networks
D.
Enable MAC filtering on the wireless access point
A
An employee connects a wireless access point to the only jack in the conference room to provide Internet access during a movie. The access point is configured to
secure its users with WPA2-TKIP. A malicious user is able to intercept clear text HTTP communication between the meeting attendees and the Internet. Which of
the following is the reason the malicious user is able to intercept and see clear text communications?
A.
The malicious user is running a wireless sniffer
B.
The wireless access point is broadcasting the SSID
C.
The malicious user is able to capture the wired communication
D.
The meeting attendees are using unencrypted hard drives
C
A security engineer notices that unknown devices are connecting to the company’s wireless network and trying to access the database server. The wireless access
point is configured with WPA for encryption and the network administrator setup a 8 digit pin for easy setup to the wireless access point. Which of the following is
the MOST likely type of attack?
A.
IV attack
B.
WPS attack
C.
Bluesnarfing attack
D.
Replay attack
B
A user contacts the help desk after being unable to log in to the corporate website. The user can log into the site from another computer in the next office, but not
from the PC. The user’s PC was able to connect earlier in the day. The help desk has the user restart the NTP service. Afterwards, the user is able to log into the
website. The MOST likely reason for the initial failure was that the website was configured to use which of the following authentication mechanisms?
A.
Secure LDAP
B.
RADIUS
C.
NTLMv2
D.
Kerberos
D
A network administrator recently implemented two caching proxy servers on the network. How can the administrator BEST aggregate the log files from the proxy
servers?
A. Syslog
B.
Configure each proxy server to write to log files stored locally
C.
Configure both proxy servers to log to a network share
D.
Configure both proxy servers to log to a centralized switch
A
A company wants to ensure that all software executing on a corporate server have been authorized to do so by a central control point. Which of the following can be
implemented to enable such a control?
A.
Digital signatures
B.
Mandatory access control
C.
Session keys
D.
Non repudiation
A
A new help desk employee at a cloud services provider receives a call from a customer. The customer is unable to log into the provider’s web application database.
The help desk employee is unable to find the customer’s user account in the directory services console, but see the customer information in the application
database. The application does nit appear to have any fields for a password. The customer then remembers the password and is able to log in. The help desk
employee still does not see the user account in directory services. Which of the following is the MOST likely ?
A.
A bug has been discovered in the application
B.
An application uses a weak encryption cipher
C.
A federated authentication model is being used.
D.
The application uses single sign on.
C
An organization uses a Kerberos-based LDAP service for network authentication. The service is also utilized by internal web applications. Finally, access to terminal
applications is achieved using the same authentication method by joining the legacy system to the Kerberos realm. The company is using Kerberos to achieve
which of the following?
A.
Trusted operating system
B.
Rule-based access control
C.
Single sign-on
D.
Mandatory access control
C
A security program manager wants to actively test the security posture of a system. The system is not yet in production and has no uptime requirement or active
user base. Which of the following methods will produce a report which shows vulnerabilities that were actually exploited?
A.
Peer review
B.
Component testing
C.
Penetration testing
D.
Vulnerability testing
C
The chief security officer (CS0) has issued a new policy that requires that all internal websites be configured for HTTPS traffic only. The network administrator has
been tasked to update all internal sites without incurring additional costs. Which of the following is the best solution for the network administrator to secure each
internal website?
A.
Use certificates signed by the company CA
B.
Use a signing certificate as a wild card certificate
C.
Use certificates signed by a public ca
D.
Use a self-signed certificate on each internal server
A
An administrator intends to configure an IPSec solution that provides ESP with integrity protection, but not confidentiality protection. Which of the following AES
modes of operation would meet this integrity-only requirement?
A.
GMAC
B.
PCBC
C.
CBC
D.
GCM
E.
CFB
A
A company wants to ensure that the validity of publicly trusted certificates used by its web server can be determined even during an extended internet outage.
Which of the following should be implemented?
A.
Recovery agent
B.
OCSP
C.
CRL
D.
Key escrow
C
A computer on a company network was infected with a zero-day exploit after an employee accidentally opened an email that contained malicious content. The
employee recognized the email as malicious and was attempting to delete it, but accidentally opened it. Which of the following should be done to prevent this
scenario from occurring again in the future?
A.
Install host-based firewalls on all computers that have an email client installed
B.
Set the email program default to open messages in plain text
C.
Install end-point protection on all computers that access web email
D.
Create new email spam filters to delete all messages from that sender
B
A company researched the root cause of a recent vulnerability in its software. It was determined that the vulnerability was the result of two updates made in the last
release. Each update alone would not have resulted in the vulnerability. In order to prevent similar situations in the future, the company should improve which of the
following?
A.
Change management procedures
B.
Job rotation policies
C.
Incident response management
D.
Least privilege access controls
A
A security administrator is developing training for corporate users on basic security principles for personal email accounts. Which of the following should be
mentioned as the MOST secure way for password recovery?
A.
Utilizing a single question for password recovery
B.
Sending a PIN to a smartphone through text message
C.
Utilizing CAPTCHA to avoid brute force attacks
D.
Use a different e-mail address to recover password
B
Which of the following use the SSH protocol? (Choose two).
A.
Stelnet
B.
SCP
C.
SNMP
D.
FTPS
E.
SSL
F.
SFTP
B, F
A network administrator is attempting to troubleshoot an issue regarding certificates on a secure website. During the troubleshooting process, the network
administrator notices that the web gateway proxy on the local network has signed all of the certificates on the local machine. Which of the following describes the
type of attack the proxy has been legitimately programmed to perform?
A.
Transitive access
B.
Spoofing
C.
Man-in-the-middle
D.
Replay
C
A security administrator is tasked with conducting an assessment made to establish the baseline security posture of the corporate IT infrastructure. The
assessment must report actual flaws and weaknesses in the infrastructure. Due to the expense of hiring outside consultants, the testing must be performed using
in-house or cheaply available resource. There cannot be a possibility of any requirement being damaged in the test. Which of the following has the administrator
been tasked to perform?
A.
Risk transference
B.
Penetration test
C.
Threat assessment
D.
Vulnerability assessment
D
An attacker wearing a building maintenance uniform approached a company’s receptionist asking for access to a secure area. The receptionist asks for
identification, a building access badge and checks the company’s list approved maintenance personnel prior to granting physical access to the secure are. The
controls used by the receptionist are in place to prevent which of the following types of attacks?
A.
Tailgating
B.
Shoulder surfing
C.
Impersonation
D.
Hoax
C
A security analyst has been asked to perform a review of an organization’s software development lifecycle. The analyst reports that the lifecycle does not contain a
phase in which team members evaluate and provide critical feedback of another developer’s code. Which of the following assessment techniques is BEST
described in the analyst’s report?
A.
Architecture evaluation
B.
Baseline reporting
C.
Whitebox testing
D.
Peer review
D
A security engineer is faced with competing requirements from the networking group and database administrators. The database administrators would like ten
application servers on the same subnet for ease of administration, whereas the networking group would like to segment all applications from one another. Which of
the following should the security administrator do to rectify this issue?
A.
Recommend performing a security assessment on each application, and only segment the applications with the most vulnerability
B.
Recommend classifying each application into like security groups and segmenting the groups from one another
C.
Recommend segmenting each application, as it is the most secure approach
D.
Recommend that only applications with minimal security features should be segmented to protect them
B
An organization has hired a penetration tester to test the security of its ten web servers. The penetration tester is able to gain root/administrative access in several
servers by exploiting vulnerabilities associated with the implementation of SMTP, POP, DNS, FTP, Telnet, and IMAP. Which of the following recommendations
should the penetration tester provide to the organization to better protect their web servers in the future?
A.
Use a honeypot
B.
Disable unnecessary services
C.
Implement transport layer security
D.
Increase application event logging
B
A member of a digital forensics team, Joe arrives at a crime scene and is preparing to collect system data. Before powering the system off, Joe knows that he must
collect the most volatile date first. Which of the following is the correct order in which Joe should collect the data?
A.
CPU cache, paging/swap files, RAM, remote logging data
B.
RAM, CPU cache. Remote logging data, paging/swap files
C.
Paging/swap files, CPU cache, RAM, remote logging data
D.
CPU cache, RAM, paging/swap files, remote logging data
D
A mobile device user is concerned about geographic positioning information being included in messages sent between users on a popular social network platform.
The user turns off the functionality in the application, but wants to ensure the application cannot re-enable the setting without the knowledge of the user. Which of
the following mobile device capabilities should the user disable to achieve the stated goal?
A.
Device access control
B.
Location based services
C.
Application control
D.
Geo-Tagging
B
A chief Financial Officer (CFO) has asked the Chief Information Officer (CISO) to provide responses to a recent audit report detailing deficiencies in the
organization security controls. The CFO would like to know ways in which the organization can improve its authorization controls. Given the request by the CFO,
which of the following controls should the CISO focus on in the report? (Select Three)
A.
Password complexity policies
B.
Hardware tokens
C.
Biometric systems
D.
Role-based permissions
E.
One time passwords
F.
Separation of duties
G.
Multifactor authentication
H.
Single sign-on
I.
Least privilege
D, F, I
A user of the wireless network is unable to gain access to the network. The symptoms are:
1.) Unable to connect to both internal and Internet resources 2.) The wireless icon shows connectivity but has no network access The wireless network is WPA2
Enterprise and users must be a member of the wireless security group to authenticate. Which of the following is the MOST likely cause of the connectivity issues?
A.
The wireless signal is not strong enough
B.
A remote DDoS attack against the RADIUS server is taking place
C.
The user’s laptop only supports WPA and WEP
D.
The DHCP scope is full
E.
The dynamic encryption key did not update while the user was offline
C
An administrator has concerns regarding the traveling sales team who works primarily from smart phones. Given the sensitive nature of their work, which of the
following would BEST prevent access to the data in case of loss or theft?
A.
Enable screensaver locks when the phones are not in use to prevent unauthorized access
B.
Configure the smart phones so that the stored data can be destroyed from a centralized location
C.
Configure the smart phones so that all data is saved to removable media and kept separate from the device
D.
Enable GPS tracking on all smart phones so that they can be quickly located and recovered
B
A network administrator wants to ensure that users do not connect any unauthorized devices to the company network. Each desk needs to connect a VoIP phone
and computer. Which of the following is the BEST way to accomplish this?
A.
Enforce authentication for network devices
B.
Configure the phones on one VLAN, and computers on another
C.
Enable and configure port channels
D.
Make users sign an Acceptable use Agreement
A
While reviewing the monthly internet usage it is noted that there is a large spike in traffic classified as “unknown” and does not appear to be within the bounds of the
organizations Acceptable Use Policy. Which of the following tool or technology would work BEST for obtaining more information on this traffic?
A.
Firewall logs
B.
IDS logs
C.
Increased spam filtering
D.
Protocol analyzer
D
The Chief Security Officer (CISO) at a multinational banking corporation is reviewing a plan to upgrade the entire corporate IT infrastructure. The architecture
consists of a centralized cloud environment hosting the majority of data, small server clusters at each corporate location to handle the majority of customer
transaction processing, ATMs, and a new mobile banking application accessible from smartphones, tablets, and the Internet via HTTP. The corporation does
business having varying data retention and privacy laws. Which of the following technical modifications to the architecture and corresponding security controls
should be implemented to provide the MOST complete protection of data?
A.
Revoke exiting root certificates, re-issue new customer certificates, and ensure all transactions are digitally signed to minimize fraud, implement encryption for
data in-transit between data centers
B.
Ensure all data is encryption according to the most stringent regulatory guidance applicable, implement encryption for data in-transit between data centers,
increase data availability by replicating all data, transaction data, logs between each corporate location
C.
Store customer data based on national borders, ensure end-to end encryption between ATMs, end users, and servers, test redundancy and COOP plans to
ensure data is not inadvertently shifted from one legal jurisdiction to another with more stringent regulations
D.
Install redundant servers to handle corporate customer processing, encrypt all customer data to ease the transfer from one country to another, implement endto-end encryption between mobile applications and the cloud.
C
