Security+ Midterm Flashcards
Which of the following specifically describes the exploitation of an interactive process to access otherwise restricted areas of the OS?
Buffer overflow attack
Process affinity
Pivoting
Privilege escalation
Privilege escalation
When designing a web based client server application with single application server and database cluster backend, input validation should be performed:
On the client
Using HTTPS
Using database stored procedures
On the application server
On the application server
Which of the following could occur when both strong and weak ciphers are configured on a VPN concentrator? (Select TWO)
The VPN concentrator could revert to L2TP.
The integrity of the data could be at risk.
An attacker could potentially perform a downgrade attack.
The IPSec payload reverted to 16-bit sequence numbers
The connection is vulnerable to resource exhaustion.
An attacker could potentially perform a downgrade attack.
The IPSec payload reverted to 16-bit sequence numbers
Upon entering an incorrect password, the logon screen displays a message informing the user that the password does not match the username provided and is not the required length of 12 characters. Which of the following secure coding techniques should a security analyst address with the application developers to follow security best practices?
Obfuscation
Input validation
Error handling
Data exposure
Error handling
A security analyst observes the following events in the logs of an employee workstation:
Question_Chap5_67.JPG
Given the information provided, which of the following MOST likely occurred on the workstation?
Application whitelisting controls blocked an exploit payload from executing.
The SIEM log agent was not tuned properly and reported a false positive.
Antivirus software found and quarantined three malware files
Automatic updates were initiated but failed because they had not been approved.
Application whitelisting controls blocked an exploit payload from executing.
Security administrators attempted corrective action after a phishing attack. Users are still experiencing trouble logging in, as well as an increase in account lockouts. Users’ email contacts are complaining of an increase in spam and social networking requests. Due to the large number of affected accounts, remediation must be accomplished quickly. Which of the following actions should
be taken FIRST? (Select TWO)
Update WAF rules to block social networks
Disable the compromised accounts
Enable sender policy framework
Remove the compromised accounts with all AD groups
Change the compromised accounts’ passwords
Disable the open relay on the email server
Enable sender policy framework
Disable the open relay on the email server
A workstation puts out a network request to locate another system. Joe, a hacker on the network, responds before the real system does, and he tricks the workstation into communicating with him. Which of the following BEST describes what occurred?
The hacker-exploited improper key management.
The hacker used a pass-the-hash attack.
The hacker used a race condition.
The hacker exploited weak switch configuration.
The hacker exploited weak switch configuration.
A security administrator learns that PII, which was gathered by the organization, has been found in an open forum. As a result, several C-level executives found their identities were compromised, and they were victims of a recent whaling attack. Which of the following would prevent these problems in the future? (Select TWO). Implement a HIDS Implement a spam filter Implement an email DLP Implement a reverse proxy. Implement a host-based firewall
Implement a spam filter
Implement an email DLP
A security technician has been receiving alerts from several servers that indicate load balancers have had a significant increase in traffic. The technician initiates a system scan. The scan results illustrate that the disk space on several servers has reached capacity. The scan also indicates that incoming internet traffic to the servers has increased.
Which of the following is the MOST likely cause of the decreased disk space?
Logs and events anomalies
Unauthorized software
Authentication issues
Misconfigured devices
Unauthorized software
A software developer is concerned about DLL hijacking in an application being written. Which of the following is the MOST viable mitigation measure of this type of attack?
Access to DLLs from the Windows registry should be disabled
The DLL of each application should be set individually
The affected DLLs should be renamed to avoid future hijacking
All calls to different DLLs should be hard-coded in the application
All calls to different DLLs should be hard-coded in the application
A network administrator is attempting to troubleshoot an issue regarding certificates on a secure website. During the troubleshooting process, the network administrator notices that the web gateway proxy on the local network has signed all of the certificates on the local machine. Which of the following describes the type of attack the proxy has been legitimately programmed to perform? Man-in-the-middle Replay Transitive access Spoofing
Man-in-the-middle
A member of the admins group reports being unable to modify the “changes” file on a server. The permissions on the file are as follows:
Permissions User Group File
-rwxrw-r–+ Admins Admins changes
Based on the output above, which of the following BEST explains why the user is unable to modify the “changes” file?
The SELinux mode on the server is set to “permissive.”
The SELinux mode on the server is set to “enforcing.”
A FACL has been added to the permissions for the file.
The admins group does not have adequate permissions to access the file.
A FACL has been added to the permissions for the file.
Which of the following attack types BEST describes a client-side attack that is used to manipulate an HTML iframe with JavaScript code via a web browser?
No answer text provided.
XSS
MITM
Buffer overflow attack
XSS
Which of the following types of attacks precedes the installation of a rootkit on a server?
DDoS Pharming Buffer overflow attack Cross-site scripting attack Privilege escalation
Privilege escalation
An attacker uses a network sniffer to capture the packets of a transaction that adds $20 to a gift card. The attacker then use a function of the sniffer to push those packets back onto the network again, adding another $20 to the gift card. This can be done many times. Which of the following describes this type of attack?
Smurf attack Buffer overflow attack Cross-site scripting attack Replay attack Integer overflow attack
Replay attack
Which of the following BEST describes an attack where communications between two parties are intercepted and forwarded to each party with neither party being aware of the interception and potential modification to the communications? spear phishing Man-in-the-middle URL hijacking Transitive access
Man-in-the-middle
A security analyst receives an alert from a WAF with the following payload:
var data= “” ++ “
Which of the following types of attacks is this?
SQL injection Cross-site request forgery JavaScript data insertion Firewall evasion script Buffer overflow
JavaScript data insertion
Which of the following techniques can bypass a user or computer's web browser privacy settings? (Select Two) SQL injection Session hijacking Locally shared objects Cross-site scripting LDAP injection
Session hijacking
Cross-site scripting
A web application is configured to target browsers and allow access to bank accounts to siphon money to a foreign account. This is an example of which of the following attacks? Header manipulation Cross-site scripting SQL injection Flash cookie exploitation
Cross-site scripting
A bank is experiencing a DoS attack against an application designed to handle 500 IP-based sessions. In addition, the perimeter router can only handle 1Gbps of traffic. Which of the following should be implemented to prevent a DoS attacks in the future?
Install a firewall at the network to prevent all attacks
Increase the capacity of the perimeter router to 10 Gbps
Use redundancy across all network devices and services
Deploy multiple web servers and implement a load balancer
Use redundancy across all network devices and services
A malicious attacker has intercepted HTTP traffic and inserted an ASCII line that sets the referrer URL. Which of the following is the attacker most likely utilizing? Cookie hijacking Header manipulation Cross-site scripting XML injection
Header manipulation
*** During a routine vulnerability assessment, the following command was successful:
echo “vrfy ‘perl -e ‘print “hi” x 500 ‘ ‘ “ | nc www.company.com 25
Which of the following vulnerabilities is being exploited?
Cross-site scripting directed at www.company.com
Buffer overflow directed at a specific host MTA
SQL injection directed at a web server
Race condition in a UNIX shell script
Buffer overflow directed at a specific host MTA
A computer on a company network was infected with a zero-day exploit after an employee accidentally opened an email that contained malicious content. The employee recognized the email as malicious and was attempting to delete it, but accidentally opened it.
Which of the following should be done to prevent this scenario from occurring again in the future?
Install end-point protection on all computers that access web email
Create new email spam filters to delete all messages from that sender
Install host-based firewalls on all computers that have an email client installed
Set the email program default to open messages in plain text
Install end-point protection on all computers that access web email
Malicious traffic from an internal network has been detected on an unauthorized port on an application server.
Which of the following network-based security controls should the engineer consider implementing?
ACLs
NAT
HIPS
MAC filtering
ACLs
