Security Flashcards
During an external vulnerability scan, the penetration tester finds that telnet, ftp, and http are open inbound on a storage server at the customer site. This information has been relayed to the customer after the penetration test has been completed. Which of the following is the BEST mitigation for this vulnerability?
A. The customer should enable two-factor authentication.
B. The customer should wrap http in TLS.
C. The customer should move the services to non-standard ports.
D. The customer should use system hardening guides to close unnecessary services and ports.
D. The customer should use system hardening guides to close unnecessary services and ports.
A penetration tester finds a username with a relative ID (RID) of 500 on a Windows device. Which of the following privilege levels does this user have?
A. Administrator
B. User
C. Guest
D. Power user
A. Administrator
A penetration tester notices the results from an external vulnerability scan are unreliable. The same IP address has shown different vulnerabilities each time it is scanned. Which of the following is the MOST likely cause for this?
A. The address being scanned is a load balancer with systems behind it.
B. The vulnerability scanner is reporting false positives.
C. The customer has been patching and rolling back their updates.
D. The vulnerability scanner is improperly configured.
A. The address being scanned is a load balancer with systems behind it.
A web application is coded in such a way that it concatenates user input directly into a database query:
http://example.com?page=news&ID=14
To which of the following vulnerabilities could this situation apply?
A. XML injection
B. Insecure direct object reference
C. Insecure cross-origin resource sharing
D. SQL injection
D. SQL injection
Output from a static code analyzer shows a high number of null pointer issues. Which of the following is the MOST likely cause of this issue?
A. Improper use of named pipes
B. Poor file-system integration C. Lack of variable initialization D. Bad socket programming
C. Lack of variable initialization
A penetration tester is removing a local admin account from a target system, clearing credentials from an exploitation framework, and purging copies of documents from the laptop that was used to create reports. Which of the following is the penetration tester performing?
A. Attestation of findings
B. Post-engagement cleanup
C. Deception techniques
D. Remediation steps
B. Post-engagement cleanup
HTTP is being used during authentication on a target network. Which of the following passive reconnaissance techniques can help a penetration tester obtain a user’s credentials?
A. Traffic throttling
B. Traffic sniffing
C. Traffic shaping
D. Traffic blocking
B. Traffic sniffing
While scoping a compliance-based assessment, which of the following MUST be considered?
A. Protocols used
B. Stealth
C. Bandwidth limitations
D. Local and national laws
D. Local and national laws
Joe, a security analyst, is asked by a co-worker, “What is this AAA thing all about in the security world? Sounds like something I can use for my car.” Which of the following terms should Joe discuss in his response to his co-worker? (Select THREE).
A. Accounting B. Accountability C. Authorization D. Authentication E. Access F. Agreement
A. Accounting
C. Authorization
D. Authentication
A system administrator is configuring accounts on a newly established server. Which of the following characteristics BEST differentiates service accounts from other types of accounts?
A. They can often be restricted in privilege.
B. They are meant for non-person entities.
C. They require special permissions to OS files and folders.
D. They remain disabled in operations.
E. They do not allow passwords to be set.
B. They are meant for non-person entities.
Recently, a company has been facing an issue with shoulder surfing. Which of the following safeguards would help with this?
A. Screen filters
B. Biometric authentication
C. Smart cards
D. Video cameras
A. Screen filters
The process of presenting a user ID to a validating system is known as:
A. authorization.
B. authentication.
C. identification.
D. single sign-on.
C. identification.
An input field that is accepting more data than has been allocated for it in memory is an attribute of:
A. buffer overflow.
B. memory leak.
C. cross-site request forgery.
D. resource exhaustion.
A. buffer overflow.
Which of the following if used would BEST reduce the number of successful phishing attacks?
A. Two-factor authentication
B. Application layer firewall
C. Mantraps
D. User training
D. User training
