Security+ Flashcards
Change management is a set of processes that introduce visibility and governance and into the configuration management process.
True
PCI compliance requires that systems serving up credit card information be patched to mitigate exposures resulting from unknown security vulnerabilities.
False
SCADA
SCADA is an acronym for supervisory control and data acquisition, a computer system for gathering and analyzing real time data. SCADA systems are used to monitor and control a plant or equipment in industries such as telecommunications, water and waste control, energy, oil and gas refining and transportation.
Collision Resistance is a property such that given two different hash inputs they should not have equal distances.
False hash functions: a hash function H is collision resistant if it is hard to find two inputs that hash to the same output; that is, two inputs a and b such that H(a) = H(b), and a ≠ b. Every hash function with more inputs than outputs will necessarily have collisions.
NERC CIP
The NERC CIP (North American Electric Reliability Corporation critical infrastructure protection) plan is a set of requirements designed to secure the assets required for operating North America’s bulk electric system.
What is a rainbow table?
A rainbow table attack is a type of hacking wherein the perpetrator tries to use a rainbow hash table to crack the passwords stored in a database system. A rainbow table is a hash function used in cryptography for storing important data such as passwords in a database.
Rule Based Access Control and Role Based Access Control are the same.
False
The “___ ____” is a full Bluetooth Pen Testing Suite
Blue Diving
When s-boxes are defined using pairs of characters they are referred to as diagrams.
True In cryptography, an S-box (substitution-box) is a basic component of symmetric key algorithms which performs substitution. In block ciphers, they are typically used to obscure the relationship between the key and the ciphertext — Shannon’s property of confusion.
“_________” data at rest and in motion can additionally enhance the security and confidentiality of data in Big Data systems such as Hadoop and NoSQL based platforms.
Encrypting
“_____ ________” are tools that are commonly used to check system security settings and patch levels.
Vulnerability Scanners
Name a best practice for controlling malware command and control callbacks from leaving your corporate network.
Deploy an authenticated forward proxy.
What is a benefit of placing a honeypot on the untrusted internet side of a company’s DMZ?
Does not utilize FW and IDS resources and if compromised does not create a launch point int the DMZ.
IDS
Intrusion Detections System
IPS
Intrusion Protection System
RSA cryptography strength is a function of ALL of the four key characteristics. 1. Primality. 2. Greatest common divisor. 3. Modular inverse computation 4. Modular powers.
True
Using a “___ ____” is a memory protection technique which a compiler encrypts pointers when stored in memory and decrypting them only when inserted into a CPU’s registers.
Point Guard
Encase is a popular paid forensics case management tool
True EnCase® Forensic is a powerful investigation platform that collects digital data, performs analysis, reports on findings and preserves them in a court validated, forensically sound format.
SAML assertions are secured through the use of digital certificates.
True Security Assertion Markup Language (SAML) is an open standard that allows identity providers (IdP) to pass authorization credentials to service providers (SP). … SAML enables Single-Sign On (SSO), a term that means users can log in once, and those same credentials can be reused to log into other service providers
“___” filtering can help to ensure that only users with authorized MAC addresses can access a wireless access point.
MAC
The java runtime can allow untrusted “_____” to run in a sandboxed environment to limit its access to the rest of the system.
True
When filling out a CSR what is a CN?
The Common Name (AKA CN) represents the server name protected by the SSL certificate. The certificate is valid only if the request hostname matches the certificate common name. Most web browsers display a warning message when connecting to an address that does not match the common name in the certificate. A CSR or Certificate Signing request is a block of encoded text that is given to a Certificate Authority when applying for an SSL Certificate. … It also contains the public key that will be included in the certificate. A private key is usually created at the same time that you create the CSR, making a key pair.
“_____” protects DNS servers and clients from attacks such as DNS Spoofing and DNS Cache Poisoning
DNS-SEC DNSSEC strengthens authentication in DNS using digital signatures based on public key cryptography. With DNSSEC, it’s not DNS queries and responses themselves that are cryptographically signed, but rather DNS data itself is signed by the owner of the data.
OCTAVE is a suite of tools, processes and methods used for strategic security assessment and planning.
True
Three types of security control categories include Preventive, Corrective and Detective.
True
“_____” is the common replacement for Halon for fire suppression
FM200
Java programs themselves typically aren’t affected by buffer overflows because the java virtual machine manages register allocation but the JDK and/or JVM itself can be subject to buffer overflows.
False
The goals of Incident Response planning and execution are to limit damage, reduce recovery time and recovery costs.
True
Second Pre-image Resistance is also known as Strong Collision Avoidance.
False Strong And Weak Collision Resistance Are Not The Same Even though they seem similar, there is a subtle difference between strong and weak collision resistance. Weak collision resistance is bound to a particular input, whereas strong collision resistance applies to any two arbitrary inputs.
Tools such as rakes, tension wrenches and bump keys are used for what purpose?
Lock Picking
When the SSO is not initiated at the Service Provider is referred to as SP-Initiated SSO.
False Single sign-on (SSO) is a property of access control of multiple related, yet independent, software systems. With this property, a user logs in with a
Your company wants you to stand up a web server behind your corporate stateful firewall. What change do you need to make on the firewall to allow web users to communicate with the server?
Allow inbound from all IP addresses on tcp port 80
Making “_______” of log files is a technique that can make audit logs tamper-evident.
Hashes
What is a smart tag attack?
NFC stands for Near Field Communication. Essentially, it’s a way for your phone to interact with something in close proximity. It operates within a radius of about 4 cm and provides a wireless connection between your device and another.
The Cloud Security alliance defines “__” cloud security domains as part of their cloud controls matrix.
16
OFB – a mode of block cipher operation where each block of plaintext is XOR’d with the current output block to be the plaintext block. The current output block is the encrypted version of the previous output block.
False The Output Feedback (OFB) mode makes a block cipher into a synchronous stream cipher. It generates keystream blocks, which are then XORed with the plaintext blocks to get the ciphertext. Just as with other stream ciphers, flipping a bit in the ciphertext produces a flipped bit in the plaintext at the same location.
“____ ______” refers to techniques used to make a possibly weak key, typically a password or passphrase, more secure against a brute force attack by increasing the time it takes to test each possible key.
Key Stretching Others are: Distributed Polynomial Monomial
One benefit of Federation is that it keeps password management centralized to the Identity Provider.
True
“______” generation antivirus solutions utilize activity traps and antivirus signatures to catch and quarantine malware. This generation of malware is sometimes said to have HIPS functionality.
Fourth
Active Directory groups are a valid example of RBAC use.
True Role Based Access Control for Active Directory (RBAC AD) enables IT admins to control what individual users can do within Secret Server.
What is a ‘salt’ used for when protecting password data?
In cryptography, a salt is random data that is used as an additional input to a one-way function that hashes data, a password or passphrase.
“____” can prevent malicious activities at the host layer.
HIPS A host-based intrusion prevention system (HIPS) is a system or a program employed to protect critical computer systems containing crucial data against viruses and other Internet malware. Starting from the network layer all the way up to the application layer, HIPS protects from known and unknown malicious attacks. HIDS Host Intrusion Detecdtions System
What is a bluebug attack?
BlueBugging is an attack in which an attacker exploits Bluetooth on a device to get unauthorized access to the device and manipulate the target device to compromise its security. … BlueBugging was first found by German researcher Martin Herfurt in 2004, and since then, it has affected many victims.
Which of the following two ways typically separate network hosts for security purposes? (Choose two.)
Logically Pyshically Correct Answer: Networks are typically separated for security purposes either physically, logically, or both. Physical separation involves separating network hosts by connecting them to different devices. Logical separation involves separating them through segmented IP subnetworks.
All of the following are characteristics of the RADIUS authentication protocol, EXCEPT:
Radius uses tcp 1812
Which of the following DES/AES encryption modes is considered the weakest?
Correct Answer: With ECB mode, a given piece of plaintext will always produce the same corresponding piece of ciphertext. This predicability makes it weak. Incorrect Answers: While CBC, OFB, and CTR mode go about the processes in different ways, these modes lack ECB’s predicability, adding strength to the underlying cryptosystem.
All of the following are supporting elements of authorization, except:
Correct Answer: Validating credentials is an important aspect of authentication, not authorization. incorrect Answers: All of these elements directly support authorization.
Which of the following is a protocol used to obtain the status of digital certificates in public keys?
Correct Answer: The Online Certificate Status Protocol (OCSP) is used to obtain the revocation status of digital certificates. It is used as an alternative to certificate revocation lists and enables clients to request and receive the electronic status of digital certificates automatically and in real-time. Incorrect Answers: Diffie-Hellman Exchange (DHE) is a key negotiation and agreement protocol used in public key cryptography. RSA is the de facto standard used to generate public and private key pairs in a PKI. Elliptic curve cryptography (ECC) is a public key cryptography protocol used on small mobile devices, due to its low power and computing requirements.
Which of the following is an example of a trusted OS?
Correct Answer: SELinux is the only example, from the answers given, of a trusted operating system. Incorrect Answers: These operating systems are not considered trusted operating systems, although they can be hardened to varying degrees.
Which of the following is a variant of a phishing attack, where a phishing e-mail is sent to a high-value target instead of on a mass scale to all employees?
Correct Answer: Whaling is a social engineering attack that targets people in high-value positions, such as senior executives. It is a form of a phishing attack. Incorrect Answers: Spear phishing involves targeting a particular type of user, regardless of rank in the organization, and basing the attack on more detailed, in-depth information in order to convince the target that the phishing e-mail is actually valid. Vishing is a form of phishing attack that takes place over Voice-over-IP (VoIP) telephone systems. Pharming is a form of DNS attack.
All of the following are valid methods to secure static hosts in an organization, except:
The organization should not depend solely upon the users to manage security and static devices, because these devices can be managed just as traditional hosts and network devices are. Incorrect Answers: These are all valid methods of securing static hosts in an organization.
Which of the following forms of authentication pass credentials in clear text and is not recommended for use?
Correct Answer: The Password Authentication Protocol (PAP) is an older authentication method that passes usernames and passwords in clear text. For this reason, it is no longer used. Incorrect Answers: CHAP, the Challenge Handshake Authentication Protocol, uses password hashes and challenge methods to authenticate to the system. Passwords are not passed in clear text with this protocol. MS-CHAP (Microsoft CHAP) is a Microsoft proprietary version of CHAP, native to Windows systems. The Extensible Authentication Protocol (EAP) is a modern authentication framework that can use various authentication methods. It also does not pass username and password information in clear text.
All of the following are methods that can be used to detect unauthorized (rogue) hosts connected to the network, except:
Correct Answers: MAC addresses can be spoofed, so examining MAC address on filtering logs may not provide any indication of whether a host is authorized or not. Incorrect Answers: All of these are valid methods of detecting rogue hosts that connect to the network.
Which of the following statements best defines the recovery point objective (RPO)?
Explanation Correct Answers: The RPO is the maximum allowable amount of data (measured in terms of time) that the organization can afford to lose during a disaster or an incident. Incorrect Answers: The RPO is the maximum amount of data, not the minimum, that can be lost during a disaster or an incident. RPO refers to data that can be lost, not time itself. RPO is measured in time, not gigabytes.
What size WEP key did the original IEEE 802.11b specification use?
Correct Anwer: WEP key sizes are 64-bits (40-bit key and 24-bit initialization vector) or 128-bit (104-bit key and 24-bit initialization vector). The 802.11b standard called for a 64-bit key. Incorrect Answers: Neither 512-bit nor 256-bit are valid WEP key sizes. The original 802.11b standard called for a 64-bit key; the 128-bit key was developed after this standard was issued.
Which of the following methods of strengthening weak keys involves taking a weak initial key and feeding it to an algorithm that produces an enhanced key, which is much stronger?
orrect Answer: Key stretching is a technique used to change weak keys into stronger ones by feeding them into an algorithm to produce enhanced keys. Incorrect Answers: Key streaming involves sending individual characters of the key through an algorithm and using mathematical XOR function to change the output. Key repetition is not a valid answer or term. Key exchange involves generating and exchanging a asymmetric key used for a particular communications session, or exchanging public keys in order to use them for public key cryptography.
You are trying to determine the appropriate level of high availability for a server. The server must be available on a constant basis, and downtime in a given year cannot exceed 1 hour. It normally takes you about 45 minutes to bring down and restart the server for maintenance. Which of the following reflects the level of availability you require?
Correct Answers 99.99 percent availability accounts for 52 minutes of downtime per year. Incorrect Answers: 99.999 percent availability allows only 5.26 minutes of downtime per year, which may not be enough if the server requires almost an hour of maintenance time. 99.9 percent availability equates to more than 8 hours of downtime per year and exceeds the stated requirement. 99 percent availability is more than 3 days of downtime per year, far exceeding the requirement for no more than 1 hour of downtime.
Which of the following is the simplest form of disaster recovery exercise?
Correct Answer: The documentation review is the simplest form of test. In this type of test, the business continuity plan, disaster recovery plan, and associated documents are reviewed by relevant personnel including managers, recovery team members, and anyone else who may have responsibilities directly affecting plans. Incorrect Answers: A tabletop exercise is a type of group review. In a full-scale test, all personnel are usually involved and may actually conduct activities as they would during a real incident. This type of test is more complex and normally requires extensive resources, such as people and equipment, so it is typically conducted infrequently. In a walkthrough test, team members go through the motions of fulfilling the responsibilities and conducting the activities required during an incident or disaster.
Which of the following algorithms won the U.S. government?sponsored competition to become the Advanced Encryption Standard (AES)?
Correct Answer: Rijindael was selected as the winner of the NIST competition and became the U.S. government?s Advanced Encryption Standard (AES). Incorrect Answers: Twofish, another symmetric algorithm, was one of the five finalists for the competition, but it did not win. Blowfish is also symmetric algorithm, but was not considered in the competition to be the AES. RC4 is a symmetric streaming cipher commonly seen in WEP and SSL implementations. It was not one of the finalists involved in the AES competition.
You have a server that is used for Domain Name System (DNS) queries. You find that it has several open ports, and you intend to close all of the unnecessary ports on the server. The server is listening on ports 22, 25, 53, and 80. Which port must be left open to continue to use DNS functionality?
Correct Answers: DNS uses TCP and UDP port 53, so this port should be left open. Incorrect Answers: All other unnecessary ports should be closed. Port 22 is used by SSH. Port 25 is used by SMTP. Port 80 is used by HTTP.
Which of the following technologies allows devices to communicate with each other at very close range through radio signals by using a special chip implanted in the device, and may be vulnerable to eavesdropping and man-in-the-middle attacks?
Correct Answer: Near-field communication is enables devices to send very low-power radio signals to each other by using a special chip implanted in the device. This technology requires that the devices be extremely close or even touching each other. This technology is used for a wide variety of applications, including payments through NFC-enabled smartphones. Incorrect Answers: Neither 802.11 wireless nor Bluetooth technologies are used in this manner. Infrared does not use radio frequency technology; it enables communications between devices using a beam of light.
What is the second step in the incident response life cycle?
Correct Answer: Detection and analysis is the second step of the incident response life cycle. Incorrect Answers: In order, the steps of the incident response life cycle are preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity.
What is the biggest difference between EAP-TLS and EAP-TTLS?
EAP-TLS needs server and client certifcates; EAP-TTLS only needs server certifcates. Incorrect Answers: The EAP standard does not define the use of signed or unsigned certificates, although most implementations require signed certificates.
A virtual LAN (VLAN) offers which of the following advantages for network security? (Choose two.)
Correct Answers: VLANs offer the security advantage of logically segmenting hosts, and they allow different segments to receive different security policies. Incorrect Answers: VLANs reduce the size of broadcast domains, not create them but this, in an of itself, does not improve network security. VLANs use logical segmentation, not physical segmentation.
The corporate IT manager wants you to implement a process that separates corporate apps from personal apps on mobile devices. Which of the following techniques will enable you to do this?
Correct Answer: Sandboxing separates applications from one another and does not allow them to share execution, user, or data space. Incorrect Answers: Whitelisting enables an administrator to determine which applications and other software the user is allowed to install and execute. Containerization is a technique used to separate different sensitivities of data, such as corporate and personal data on a mobile device. Blacklisting is a method that enables administrators to restrict users from installing and executing certain applications.
Which of the following utilities are specifically used to diagnose DNS issues? (Select Two)
Correct Answers: Both dig and nslookup are designed to query DNS servers. Incorrect Answers: One might argue that Nmap and ping might be used to diagnose DNS, but neither of them are specifically for DNS queries. Kali is a Linux distro, not a utility.
Risk assessment means evaluating which of the following elements? (Choose two.)
Correct Answers: Probability and impact values are evaluated and assessed during a risk assessment. Incorrect Answers: Threats and vulnerabilities do not have defined values.
Which of the following are two characteristics of strong passwords? (Choose two.)
Correct Answer: Password length and the use of additional character space are two important characteristics of password strength and complexity. Incorrect Answers: Neither authentication methods nor encryption strength directly affects password strength.
Which of the following describe a false reject rate? (Choose two.)
Explanation Correct Answer: A false reject rate (FRR) is the error caused from rejecting an authorized user; it is also called a Type I error. Incorrect Answer: A false acceptance rate (FAR) is the error caused when an unauthorized user is validated as authorized, also referred to as a Type II error.
Marisol sees a tremendous amount of traffic on TCP port 389 from the Internet. Which TCP/IP service should she inspect first?
Correct Answer: The Lightweight Directory Application Protocol (LDAP) uses TCP port 389. Incorrect Answers: SQL is a query language for directories. HTTPS is the secure HTTP protocol for Web pages. TLS is an authentication/encryption protocol.
Which of the following encryption protocols uses RC4 with small initialization vector sizes?
Correct Answer: WEP is a legacy wireless encryption protocol that has been determined to be very weak and easily broken. It uses the RC4 streaming protocol and weak initialization vectors (24-bit) to encrypt data on wireless networks. Incorrect Answers: WPA2 is an advanced encryption protocol that uses AES. WPA was an interim protocol used to correct some of WEP’s weaknesses. It uses the TKIP protocol. 802.1X is a port-based authentication method, not a wireless encryption protocol.
All of the following are considered duties of a first responder to an incident, except:
Correct Answer: Notifying and coordinating with senior management and law enforcement officials is normally the job of a senior leader within the incident response team. Incorrect Answers: The primary job of a first responder is to secure the scene. They are also responsible for notifying the incident response team and initially determining the scope, seriousness, and impact of the incident.
