Security+ Warm Up Flashcards

Question

Which technology would be utilized in this scenario? Creating a document with invalid authentication information. A) Honeyfile B) OCSP C) Federation D) False negative

Answer 1

A) Honeyfile Honeyfile: A fake file with fake information to attract a bad guy. An alert is sent once the file is accessed. (1.2)

Answer 2

E) Recipient's public key Asymmetric Encryption: Public key cryptography. Two (or more) mathematically related keys. You encrypt data with one key and decrypt data with a different key. Both keys are made at the same time so they mathematically understand one another. One of the keys made is the private key (the one that is not shared) and the other is made to be the public key (the one that is shared to other people). The private key is the only key that can decrypt data encrypted with the public key, making all data encrypted with the public key safe from encryption except from one source. (1.4)

Answer 3

A) Unskilled Unskilled Attackers: Basically the opposite of a Nation State. Low skill, resources, and capability. Motivated by causing disruption and general chaos. They usually run pre-made scripts to attack your organization without really knowing how any of it works. Anyone can do this. Can be internal or external. (2.1)

Answer 4

E) Management Management plane: Also called the Application Layer. Where we as Network admins physically configure and manage all of these network devices. (3.1) SDN: Software Defined Networking. Networking architecture is defined by how the networking devices operate on their planes of operation, and organized accordingly. The three planes of operation for software defined networking are the data, control, and management planes.

Answer 5

C) FIM FIM: File Integrity Monitoring. Some files should never change. FIMs check and make sure the files that shouldn’t be changing aren’t changing. Windows has one built in called SFC (system file checker). Linux has one called Tripwire. (4.5)

Answer 6

D) Containment Containment: Stopping the attack as quickly as possible by isolating it. (4.8)

Answer 7

B) Install locks on the server rack doors Physical Controls: Controls that limit physical access to a building, room or device. Locks, fences, and badge readers are examples of this. (1.1)

Answer 8

A) Install a firewall to monitor and control incoming and outgoing network traffic Firewall: Filters traffic by port number and protocol or application, depending on whether it’s a traditional firewall or a next gen firewall. (4.5)

Answer 9

A) Install more surveillance cameras at all entry points Video surveillance: Or CCTV. Security cameras that watch areas to see if unauthorized people are gaining access. Can have motion or object detection. (1.2)

Answer 10

C) Jailbreaking Jailbreaking: Bypassing the built in security that comes with a mobile device. One could also replace the standard OS and/or firmware that comes with the device and replace it with your own. On an Android device, this is known as rooting. On an Apple iOS device, this is known as Jailbreaking.(2.3)

Answer 11

A) Encrypting stored data CIA Triad: A combination of principles concerning the fundamentals of security; Confidentiality, Integrity, and Availability. (1.2)

Answer 12

B) Gap analysis Gap Analysis: A study of where we are versus where we would like to be. It requires research and consideration of many different IT and security factors in order to close that gap and make sure everything is completed without tripping over itself. (1.2)

Answer 13

C) Erecting bollards along the building's street facing side Barricades and bollards: Allow people access by channeling them to a specific point, but prevent vehicles. (1.2)

Answer 14

B) Obtaining formal approval for the project from senior management Change Management: Or Change Approval Process. The formal process an IT administrator goes through to ensure that a change to the systems goes through properly and without messing anything up. Change Control Process: -1) Fill out an approval process request form. -2) Explain what the change is and why it’s being implemented. -3) Identify the scope of the change, or how big this change will be. -4) Schedule a date and time for the change to take place. -5) Determine the affected systems and the impact on those systems. -6) Analyze the risk associated with the change. -7) Get approval from the change control board to go ahead with the change. (1.3)

Answer 15

D) Purple Integrated Penetration Testing: Red Vs Blue going together. Offensive: A pen test where your systems are attacked and vulnerabilities are looked for to exploit (The Red Team). Defensive: A pen test where a group (The Blue Team) attempts to identify pen test attacks in real-time and tries to prevent unauthorized access. (5.5)

Answer 16

A) Chain of custody Chain of Custody: Information must maintain its unmodified status for the duration of its necessary use, thus a process is in place to see who has access to the information. Hashes and digital signatures allow us to know how the data has been stored and whether or not it has been tampered with. (4.8)

Answer 17

C) Using an asymmetric algorithm such as Diffie-Hellman Asymmetric Encryption: Public key cryptography. Two (or more) mathematically related keys. You encrypt data with one key and decrypt data with a different key. Both keys are made at the same time so they mathematically understand one another. One of the keys made is the private key (the one that is not shared) and the other is made to be the public key (the one that is shared to other people). The private key is the only key that can decrypt data encrypted with the public key, making all data encrypted with the public key safe from encryption except from one source. (1.4)

Answer 18

B) Hashing Hash: A short string of text that can be created based upon data contained within the plain text. Also known as a message digest or a fingerprint. Hashing: Representing data as a short string of text. Cannot be decrypted. (1.4)

Answer 19

C) CRL Certificate Revocation Lists: (CRLs) A list of digital certificates that have been revoked by the issuing Certificate Authority (CA) before their scheduled expiration date. When a CA issues a digital certificate, it includes an expiration date. However, certain events may lead to the need for revocation before the certificate's expiration, such as the compromise of the private key associated with the certificate, the compromise of the CA itself, or other security-related concerns. (1.4)

Answer 20

D) Insider threat Insider Threat: A threat from the inside of your organization. Someone on the outside can squeazel their way in and then betray you. Motivated by revenge and financial gain. In this circumstance, your organization is their funding. They have institutional knowledge, and know what vulnerable systems to hit. (2.1)

Answer 21

C) Watering-hole Watering Hole Attack: An attacker, who cannot gain access to your network by conventional means, “poisons” a third party website that all of your employees visit, thus getting a foot in the door, and attacking your network indirectly. (2.2)

Answer 22

B) Patching Patching: Keeping your systems up to date by closing up found holes of vulnerability. Do this as often as you can. (2.5)

Answer 23

C) Vishing Vishing: Voice fishing. An attacker lying to you over the phone to get your information. (2.2)

Answer 24

D) File's metadata Metadata: Data that describes other data sources, so, for example, in a picture taken on your phone, you can pull up all sorts of data about the picture, such as when and where it was taken and how large it is, things like that. (4.9)

Answer 25

B) A security breach where a malicious actor gains control of the host system from within a virtual machine VM Escape: When a VM is able to break out of its self-contained system and interact with the host operating system or hardware on the same hypervisor. (2.3)

Answer 26

C) Implementing an application allow list Application Allow/Deny List: Ensuring only legitimate applications are used on a system. Allow List = Nothing runs unless it’s approved. Deny List = Everything can run except the things denied. (2.5)

Answer 27

A) The scenario describes a worm attack known for its ability to self-replicate Worm: Malware similar to a virus that can move around from system to system without any user intervention. (2.4)

Answer 28

B) Missing logs can be a sign of a security incident or a potential breach of the logging system. The security engineer should investigate the cause of the missing logs and take corrective action. Missing Logs: Deleted log information is an indication of compromise that someone is (sloppily) trying to cover their tracks. (2.4)

Answer 29

B) Host-based firewall Host-based firewall: Software based firewall that runs behind the scenes on every endpoint. Allows or disallows incoming or outgoing application traffic. Identifies and blocks unknown processes. (2.5)

Answer 30

C) Hosting servers and data within physical facilities Benefits of On-Premises Security: Everything is local and on you to secure, giving you the freedom and control to protect things exactly how you want it, but it costs more to maintain (being a Tech Director). (3.1)

Answer 31

C) IDS IDS: Intrusion Detection System. Watches network traffic and only alerts if it finds traffic it doesn’t recognize. (3.2)

Answer 32

D) FIM FIM: File Integrity Monitoring. Some files should never change. FIMs check and make sure the files that shouldn’t be changing aren’t changing. Windows has one built in called SFC (system file checker). Linux has one called Tripwire. (4.5)

Answer 33

B) Setting up a VPN and firewall restrictions Infrastructure Monitoring: Monitor your remote access systems to see who’s connecting via VPN. Also, take a look at your firewall and IPS reports. (4.4)

Answer 34

A) Load balancing Load Balancing: Load is distributed across multiple servers, but the servers are unaware of each other. Only the load balancer knows about all the servers. Servers can run different OSs. (3.4)

Answer 35

B) NAC NAC: Network Access Control. Rules put in place that limit a device’s access to certain types of data, either someone on the outside trying to get in, or someone inside trying to get out. Rules based on user, group, location, application, etc. Think ACLs.

Answer 36

C) Perform static code analysis Static Code Analysis: A method application developers use to test the security of their applications. They put their code through a static code analyzer and the analyzer checks it for buffer overflows and database injections. (4.1)

Answer 37

C) Initiate the acquisition/procurement process for new software licenses The Acquisition/Procurement Process: A user wants something and asks IT for it. IT (or the purchasing committee) looks at what they want to buy and analyzes the budget to see if they can buy it. If they can, management, IT, and/or the purchasing committee sign off on it and they buy it. Sometimes IT haggles with whoever they’re trying to buy it from. When a price is reached, the transaction takes place. Paid all at once or in payments. (4.2)

Answer 38

D) SOW WO: Work Order (or Statement of Work). Specific list of items to be completed used in conjunction with the MSA that details the scope of the job, the location, acceptance criteria, etc. (5.3)

Answer 39

C) SIEM Log Aggregation: Getting all the security data you need all at once. Use a SIEM: Security Information and Event Management. The logging of security events and information to one central consolidation point. What you can reference if something goes wrong with security. You can set up a SIEM to alert you as well. (4.4)

Answer 40

C) Badge access system & D) Controlled access vestibule Physical Controls: Controls that limit physical access to a building, room or device. Locks, fences, and badge readers are examples of this. Access Control Vestibule: A place people have to go into first before accessing another part of the building. Opening one door causes another one to lock, or vice versa. (1.2)

Answer 41

D) Just-in-time permissions Just-In-Time Permissions: Granting admin access for a limited time on a specific set of time sensitive credentials.(4.6)

Answer 42

B) Cost reduction

Answer 43

B) Application logs Application Logs: Log files specific to an application. You can find this in the application log in Event Viewer in Windows.(4.9)

Answer 44

C) Maintenance of a risk register Risk Register: A document that identifies the risk associated with each step of a project, and offers possible solutions to those risks. (5.2)

Answer 45

C) Cloning attack RFID Cloning: Duplicating an access badge to impersonate a legitimate employee and gain access to where they go. (2.4)

Answer 46

B) The scenario describes an on-path attack On-Path attacks: The attacks formerly known as man-in-the-middle attacks. Attackers getting in between two systems and watching, capturing, and modifying the traffic that flows between them. The attacker is “on your path” (2.4)

Answer 47

C) Endpoint security Endpoint: The device used by the user. (4.5)

Answer 48

A) Passive reconnaissance Passive Reconnaissance: Information needed before an attack that is gathered by learning as much as you can from open sources. Social media, websites, online forums, and social engineering, for example. (5.5)

Answer 49

B) User authentication (4.6)

Answer 50

B) Threat hunting Threat Hunting: Finding the attacker before they find you. Upgrading your defenses so that threats can be caught before they get in. (4.8)

Answer 51

B) Data confidentiality Confidentiality: Ensures that information being exchanged is confidential or private. The concept includes the prevention of disclosure of information to unauthorized individuals or systems. This is achieved through encryption, two-factor authentication, and access controls. (1.2)

Answer 52

D) Air-gapped Air Gap: Means the devices are physically separate. If an attacker gained access to switch A, they would have no way to access switch B. (3.1)

Answer 53

A) Disk encryption Examples of full-disk and partition/volume encryption software include BitLocker (Windows OS) and FileVault (Mac OS). (1.4)

Answer 54

C) Code signing Code Signing: Validating that the code you’re about to run on your computer for an application is the same code that was made by the developers. Code is digitally signed by the dev, like a CA. (4.1)

Answer 55

C) Segmentation Physical segmentation: Devices confined within a specific network that are unable to access other networks because the physical devices between the two networks are not physically connected. Logical segmentation: Devices ARE connected to the same physical switch, but they are separated on the switch via VLANs. (2.5 and 4.3)

Answer 56

C) Fire safety mechanisms should fail open Fail-Open: When a system fails, data continues to flow. Fail-Close: When a system fails, data stops flowing. (3.2)

Answer 57

B) Sometimes called logical security controls C) Executed by computer systems (instead of people) E) Implemented with technology Technical Controls: Controls implemented using some type of technical system, for example, setting up policies and procedures in an OS that would allow or disallow different functions from occurring. Firewalls, anti-virus, and other similar software fall under this category. (1.1)

Answer 58

B) Encryption D) IDSs F) Firewalls Technical Controls: Controls implemented using some type of technical system, for example, setting up policies and procedures in an OS that would allow or disallow different functions from occurring. Firewalls, anti-virus, and other similar software fall under this category. (1.1)

Answer 59

A) Also known as administrative controls C) Focused on reducing the risk of security incidents E) Documented in written policies Managerial Controls: A series of policies that explain to end users the best way to manage their computers, data, or other systems. A security policy document or manual is an example of this. (1.1)

Answer 60

C) Organizational security policy D) Risk assessments E) Security awareness training Managerial Controls: A series of policies that explain to end users the best way to manage their computers, data, or other systems. A security policy document or manual is an example of this. (1.1)

Answer 61

B) Focused on the day-to-day procedures of an organization D) Used to ensure that the equipment continues to work as specified F) Primarily implemented and executed by people (as opposed to computer systems) Operational Controls: Controls implemented by people instead of systems or documents. Security guards, awareness programs, and posters are all examples of this. (1.1)

Answer 62

B) Configuration management C) System backups E) Patch management Operational Controls: Controls implemented by people instead of systems or documents. Security guards, awareness programs, and posters are all examples of this. (1.1)

Answer 63

B) Physical security controls Physical Controls: Controls that limit physical access to a building, room or device. Locks, fences, and badge readers are examples of this. (1.1)

Answer 64

C) Data backups E) Firewalls G) Asset management Physical Controls: Controls that limit physical access to a building, room or device. Locks, fences, and badge readers are examples of this. (1.1)

Answer 65

A) Encryption D) Firewalls F) AV software Preventive Controls: Block access to a resource. (1.1)

Answer 66

A) Warning signs C) Lighting F) Fencing/Bollards Deterrent Controls: Discourages an intrusion, but does not directly prevent access. (1.1)

Answer 67

B) Log monitoring E) CCTV F) IDS G) Vulnerability scanning Detective Controls: Identifies and logs an intrusion attempt (1.1)

Answer 68

A) IRPs C) Backups and system recovery D) DRPs E) Forensic analysis Corrective Controls: Applies a control after an event has been detected. (1.1)

Answer 69

A) Temporary service disablement C) MFA D) Backup power systems E) Sandboxing F) Temporary port blocking Compensating: A control method using other means instead (Plan B) (1.1)

Answer 70

True. Directive Controls: Directs a subject towards security compliance. (1.1)

Answer 71

A) IRP B) AUP Directive Controls: Directs a subject towards security compliance. (1.1)

Answer 72

D) CIA CIA Triad: A combination of principles concerning the fundamentals of security; Confidentiality, Integrity, and Availability. (1.2)

Answer 73

False. Non-repudiation: The ability to verify whether the information received is from the sender that the information says it’s from. A non-technological example would be like you signing a document. Only you have your own signature, so that adds non-repudiation to the document you’re signing. (1.2)

Answer 74

A) Digital certificate Digital Certificate: A file that contains both a public key and a digital signature. Think of it as a digital version of an ID card. It’s a way to provide trust and for them to say that the person is who they actually say they are in authentication, and allow them access to things they previously did not have access to. (1.4)

Answer 75

B) Shared account Non-repudiation: The ability to verify whether the information received is from the sender that the information says it’s from. A non-technological example would be like you signing a document. Only you have your own signature, so that adds non-repudiation to the document you’re signing. (1.2)

Answer 76

A) Authentication The AAA Framework: Authentication, Authorization, and Accounting. Authentication: The check between your username, your password, and any other authentication factors. It proves we are who we say we are. (1.2)

Answer 77

B) Authorization The AAA Framework: Authentication, Authorization, and Accounting. Authorization: What type of access one has after they’ve proven who they are through identification and authentication. (1.2)

Answer 78

C) Accounting The AAA Framework: Authentication, Authorization, and Accounting. Accounting: A log of who has logged in, sent and received data, and logged out. (1.2)

Answer 79

B) TACACS+ D) RADIUS RADIUS: Remote Authentication Dial-in User Service. How the teachers at school log in. A centralized database of users and passwords (Active Directory) that allows for authentication into a network. Used by all sorts of devices, very popular. (4.1)

Answer 80

B) Usernames and passwords D) Biometrics E) MFA Authentication: The check between your username, your password, and any other authentication factors. It proves we are who we say we are. (1.2)

Answer 81

B) Digital certificates C) IP addresses F) MAC addresses Authentication: The check between your username, your password, and any other authentication factors. It proves we are who we say we are. (1.2)

Answer 82

B) Gap analysis Gap Analysis: A study of where we are versus where we would like to be. It requires research and consideration of many different IT and security factors in order to close that gap and make sure everything is completed without tripping over itself. (1.2)

Answer 83

False Zero Trust: A holistic approach to network security that covers every device, process and person. You have to authenticate every time you want to gain access to a particular resource. (1.2)

Answer 84

C) Adaptive identity Adaptive Identity: Where you examine the identity of an individual and apply security controls based on other factors than just what the end user told you, such as the end user’s physical location, their relationship to the organization, their type of connection, and their IP address. (1.2)

Answer 85

A) Policy Engine (PE) E) Policy Administrator (PA) Policy Engine: Thing that looks at all of the requests that are coming through the network, examines each request, compares it to a set of predefined security policies, and then makes a decision on whether the request is granted, denied, or revoked. Policy Administrator: Takes the decision made by the policy engine and provides that information to the PEP. (1.2)

Answer 86

True. Policy Enforcement Point: (PEP) The gatekeeper that all network traffic goes through. Can be one device or multiple devices working together checking different policies on things. (1.2)

Answer 87

True. Access Control Vestibule: A place people have to go into first before accessing another part of the building. Opening one door causes another one to lock, or vice versa. (1.2)

Answer 88

B) Honeypots mimic real systems to attract cyber attackers D) Honeypots contain apparent vulnerabilities that are closely monitored by a security team Honeypot: Setting up a fake system to attract a bad guy, monitoring how they are attempting to override your fake system, and then recording their methods to implement securities on your real system. Tricking evil Winnie the Pooh and trapping him. (1.2)

Answer 89

B) A network of honeypots Honeynet: A bunch of honeypots networked together. Very sticky. (1.2)

Answer 90

E) All of the above Honeynet: A bunch of honeypots networked together. Very sticky. (1.2)

Answer 91

False. Honeyfile: A fake file with fake information to attract a bad guy. An alert is sent once the file is accessed. (1.2)

Answer 92

D) All of the above Honeyfile: A fake file with fake information to attract a bad guy. An alert is sent once the file is accessed. (1.2)

Answer 93

D) A unique identifier that is designed to track attackers Honeytokens: A bit of traceable data added to your honeynet. If data is stolen and shared, you will be notified and can trace it to who stole it. (1.2)

Answer 94

A) Active user account credentials C) Actual URLs to live websites or resources Honeytokens: A bit of traceable data added to your honeynet. If data is stolen and shared, you will be notified and can trace it to who stole it. (1.2)

Answer 95

B) BIA BIA: A business impact analysis (BIA) predicts the consequences of a disruption to your business, and gathers information needed to develop recovery strategies. (5.3)

Answer 96

A) PKI PKI: Public Key Infrastructure. Policies and procedures that are responsible for creating, distributing, managing, storing, revoking, and performing processes associated with digital certificates. PKI used as a verb means to associate a certificate to people or devices. (1.4)

Answer 97

C) A pair of keys where one is used for encryption and the other for decryption Asymmetric Encryption: Public key cryptography. Two (or more) mathematically related keys. You encrypt data with one key and decrypt data with a different key. Both keys are made at the same time so they mathematically understand one another. One of the keys made is the private key (the one that is not shared) and the other is made to be the public key (the one that is shared to other people). The private key is the only key that can decrypt data encrypted with the public key, making all data encrypted with the public key safe from encryption except from one source. (1.4)

Answer 98

A) Data encryption Symmetric Encryption: A single, shared key. You encrypt data with the key and decrypt data with the key. If the key gets out, you’ll need another key. Also known as a secret key algorithm or a shared secret. It doesn’t really scale very well because it’s only one key shared between a bunch of people. It is very fast, however. (1.4)

Answer 99

False. Key Escrow: Someone else holding onto your decryption keys, either within your organization or with a third party. (1.4)

Answer 100

D) SED SED: Self-Encrypting Devices. Data storage device with built-in cryptographic processing that may be utilized to encrypt and decrypt the stored data, occurring within the device and without dependence on a connected information system. (1.4)

Answer 101

B) FDE (Full Disk Encryption) Encryption Hardening Techniques: Ensure file systems are encrypted, either EFS or FDE, and encrypt your network with a VPN. (2.5)

Answer 102

B) EFS (Encrypting File System) You can encrypt individual files on Windows using EFS (Encrypting File System), and other OSs using other third party utilities. (1.4)

Answer 103

B) HTTPS Transport encryption: Protecting data as it crosses the network. This is done by browsers using secure ports such as HTTPS that encrypt data as it crosses the network. VPNs are another example, either site to site VPNs using IPsec, or client based VPNs using SSL/TLS. (1.4)

Answer 104

D) SMTPS Insecure Protocols: Telnet, FTP, SMTP, and IMAP all send their information in the clear, so use the secure versions of these instead. (NA)

Answer 105

True. (NA)

Answer 106

B) SFTP (NA)

Answer 107

False. It's an extension of SSH. (NA)

Answer 108

B) SSH (NA)

Answer 109

C) IPsec IPSec: Internet Protocol Security. Provides authentication (AH, authentication header) and encryption (ESP, encapsulation security payload) for all layer 3 (IP) packets. (3.2)

Answer 110

D) ESP IPSec: Internet Protocol Security. Provides authentication (AH, authentication header) and encryption (ESP, encapsulation security payload) for all layer 3 (IP) packets. (3.2)

Answer 111

B) VPN VPN: Virtual Private Network. Encrypted (private) data traversing a public network. Data meets and flows in and out of a VPN concentrator. (3.2)

Answer 112

D) SRTP (NA)

Answer 113

B) CCMP (NA)

Answer 114

D) TKIP (NA)

Answer 115

B) TLS Transport encryption: Protecting data as it crosses the network. This is done by browsers using secure ports such as HTTPS that encrypt data as it crosses the network. VPNs are another example, either site to site VPNs using IPsec, or client based VPNs using SSL/TLS. Client VPNs use SSL/TLS protocols (TCP 443). (1.4 & 3.2)

Answer 116

True. (1.4)

Answer 117

A) PSK WPA3: Wi-Fi Protected Access 3. WPA with GCMP block cipher mode. PSK is not sent across the network. Nothing to brute force. Each session key is unique, so it doesn’t matter if it’s captured. Very secure. (4.1)

Answer 118

A) ECC (NA)

Answer 119

A) AES (NA)

Answer 120

C) LEAP (NA)

Answer 121

A) PEAP (NA)

Answer 122

B) Input validation D) Error and exception handling Input Validation: Basically editing application code. Application developers perform input validation when information is going into their application. It ensures that any unexpected data that’s put into one of those inputs will not be interpreted by the application. They check to see what they’ve put into their apps matches what’s actually supposed to go in there. (4.1)

Answer 123

B) Input validation Input Validation: Basically editing application code. Application developers perform input validation when information is going into their application. It ensures that any unexpected data that’s put into one of those inputs will not be interpreted by the application. They check to see what they’ve put into their apps matches what’s actually supposed to go in there. (4.1)

Answer 124

True. Secure Cookies: Cookies are bits of data about your web sessions that’s stored on your computer by a web browser. Secure cookies only send that data over HTTPS so it’s secure. (4.1)

Answer 125

D) Static code analysis Static Code Analysis: A method application developers use to test the security of their applications. They put their code through a static code analyzer and the analyzer checks it for buffer overflows and database injections. (4.1)

Answer 126

False. Dynamic Code Analysis: Fuzzing. Fuzzing is designed to send a random input into the code of an application (fault-injecting) and see if it responds in an unexpected way. (4.1)

Answer 127

False. Static Code Analysis: A method application developers use to test the security of their applications. They put their code through a static code analyzer and the analyzer checks it for buffer overflows and database injections. (4.1)

Answer 128

B) Confirms the application's source of origin D) Validates the application's integrity Code Signing: Validating that the code you’re about to run on your computer for an application is the same code that was made by the developers. Code is digitally signed by the dev, like a CA.

Answer 129

C) Dynamic code analysis OR D) Fuzzing Dynamic Code Analysis: Fuzzing. Fuzzing is designed to send a random input into the code of an application (fault-injecting) and see if it responds in an unexpected way. (4.1)

Answer 130

C) Sandboxing Sandboxing: Running code in an isolated environment to make sure it works and won’t infect anything if it’s corrupted. Commonly used during development. (4.1)

Answer 131

B) SEH (Secured Exceptions Handling) (NA)

Answer 132

True. (NA)

Answer 133

B) CAPTCHA (NA)

Answer 134

E) All of the above (4.2)

Answer 135

C) RFID (4.2)

Answer 136

A) MDM MDM: Mobile Device Management: A centralized console that manages company-owned and user-owned mobile devices. Can set policies on what mobile apps can and can’t be used, can remotely access phones, and can partition the device data into segments. (4.1)

Answer 137

True. Media Sanitization: Making sure data is completely removed from media, and no usable information remains. You can either completely clean a hard drive for future use, or just permanently delete a single file. (4.2)

Answer 138

A) Shredding C) Burning Physical Destruction of Media: Drill it. Hammer it. Shoot it. Put it in a shredder. Crush it. Incinerate it. Degauss it. (4.2)

Answer 139

C) Degaussing Physical Destruction of Media: Drill it. Hammer it. Shoot it. Put it in a shredder. Crush it. Incinerate it. Degauss it. (4.2)

Answer 140

True. Certificate of Destruction: Give your drives to a third party, they blow them up, and then give you a certificate saying they blew them up.

Answer 141

D) Data retention policy Data Retention: Sometimes you are required to keep data for a certain number of years (emails, for example). Make sure this data is backed up somewhere, and sometimes even in multiple formats. (4.2)

Answer 142

A) Identifies lack of security controls C) Identifies common misconfigurations E) Passively tests security controls Vulnerability Scan: A minimally invasive scan on your systems used to determine if a system may be susceptible to a type of attack. Not a penetration test. Usually includes a port scan. Sometimes include false positives, so they need to be looked through by hand afterward. (4.3)

Answer 143

A) Involves examining the code without executing it B) Often used early in the development process C) Examines code structure, syntax, and semantics to detect issues like syntax errors, coding standards violations, security vulnerabilities, and bugs Static Code Analysis: A method application developers use to test the security of their applications. They put their code through a static code analyzer and the analyzer checks it for buffer overflows and database injections. (4.1)

Answer 144

B) Individuals or groups affected by or involved in a change Stakeholders: Individuals or departments that will be impacted by the change you’re proposing. They’re going to want input on the change management process, and some type of control over when the change occurs. Take into account who all is going to be impacted by the change. Look beyond the immediate impact and look through the whole process. (1.3)

Answer 145

D) By implementing just-in-time permissions and password vaulting Privileged Access Management Tools: Just-In-Time Permissions: Granting admin access for a limited time on a specific set of time sensitive credentials. Password Vaulting: Primary credentials are stored in a password vault, and the vault controls who gets access to credentials. (4.6)

Answer 146

A) Limited access to internal systems B) Often motivated by financial gain Threat Actor: The entity responsible for an event that has an impact on the safety of another entity. Also called a malicious actor. The three important attributes to nail down when identifying a threat actor are 1) Are they internal or external 2) How much funding/resources do they have 3) What’s their level of sophistication/capability (2.1)

Answer 147

A) By analyzing and detecting anomalous user behavior User Behavior Analytics: A large amount of correlated user activity data observed by XDR and used to build a baseline for what “normally” happens on the network, so that outlying activity stands out and can be stopped. (4.5)

Answer 148

B) Enforcing security policies at runtime Policy Enforcement Point: (PEP) The gatekeeper that all network traffic goes through. Can be one device or multiple devices working together checking different policies on things. (1.2)

Answer 149

A) Nation-state Nation State: A threat actor external to your organization associated with a government or national security of that government. They could have many motivations for attacking you, with lots of sophistication, capability, and resources. (2.1)

Answer 150

C) Work Order (WO)/Statement of Work (SOW) WO: Work Order (or Statement of Work). Specific list of items to be completed used in conjunction with the MSA that details the scope of the job, the location, acceptance criteria, etc. (5.3)

Answer 151

B) To understand the fundamental reasons behind an incident Root Cause Analysis: Determining the ultimate cause of an incident. Asking, “Why did this happen?” or “What was the first domino to fall in this chain of incidents?” Gathering of facts to draw a reasonable conclusion. (4.8)

Answer 152

A) Regular disposal and destruction of outdated assets C) Monitoring and tracking assets throughout their lifecycle Assignment/Accounting and Monitoring/Asset Tracking: …Dude, just put an asset tag on things when you get them, and put them into an asset tracking system explaining what the thing is and who currently has it. This is not hard. Physical Destruction of Media: Drill it. Hammer it. Shoot it. Put it in a shredder. Crush it. Incinerate it. Degauss it. (4.2)

Answer 153

D) Prioritize Prioritize: Vulnerabilities are classified as low, medium, and high priority based upon how open the vulnerability makes your systems. (4.3)

Answer 154

A) Authority C) Intimidation D) Urgency Authority is a doubly correct answer here because the caller is made by someone impersonating an authority figure but also because of the threat to contact Frank’s supervisor. The threat consists of the threat to contact Frank’s supervisor. The urgency is referenced twice so clearly belongs to the correct choice. Neither trust nor scarcity apply in this scenario and Fright is a nonsense detractor as it is not a recognized category of human manipulation for social engineering. (2.2)

Answer 155

C) SAN SAN – Subject Alternative Name allows different values to be associated with a single certificate. A SAN allows a single digital certificate to specify additional host names to be protected by that one certificate. It also allows a certificate to cover multiple IP addresses. A wildcard digital certificate can protect all first-level subdomains on an entire domain but they cannot apply to different domains so they can’t fulfill Alina’s requirements. A domain validation digital certificate will verify the identity of the entity that has control over a given domain name. NAXX is the nonsense detractor. (4.1)

Answer 156

C) Hierarchical trust model. A hierarchical trust model assigns a single hierarchy with one master CA called the root, who signs all digital certificate authorities with a single key. The distributed trust model has multiple CAs that sign digital certificates. With the bridge trust model, no single CA signs digital certificates, and yet the CA acts as a facilitator to interconnect all other CAs. Centralized trust model. (1.4)

Answer 157

D) A CP provides recommended baseline security requirements for the use and operation of PKI components. A CP is a set of rules that provide recommended baseline security requirements for the use and operation of PKI components, while a CPS is a more technical document that describes how the CA uses and manages certificates. (1.4)

Answer 158

A) As much as possible rely on proprietary protocols to protect the network. SCADA: Supervisory Control and Data Acquisition System. Also known as ICS, Industrial Control Systems. Basically large scale industrial networking. Various building controls talking to one another through the network. Managed usually at one computer. (3.1)

Answer 159

D) Split tunnel In a split tunnel configuration, only traffic destined for the corporate network is sent through the Virtual Private Network (VPN) tunnel. All other traffic, such as internet browsing, goes directly to the internet without passing through the VPN tunnel. This configuration preserves bandwidth as it doesn’t route unnecessary traffic through the corporate VPN. The full tunnel configuration has all traffic sent to the VPN so it does not minimize traffic. Neither Point-to-Point Tunneling nor Secure Socket Tunneling are tunnel configurations, they are both protocols. (3.2)

Answer 160

A) It, on occasion, will gain unauthorized access and exploit vulnerabilities. Vulnerability Scan: A minimally invasive scan on your systems used to determine if a system may be susceptible to a type of attack. Not a penetration test. Usually includes a port scan. Sometimes include false positives, so they need to be looked through by hand afterward. (4.3)

Answer 161

B) The standby server performs no useful work other than to be ready if it is needed. Server Clustering: Having multiple servers configured to all work together as one big server. Can be added or removed in real-time as needed. All run the same OS. All use the same shared storage. (3.4)

Answer 162

D) Sales, marketing, production, and finance databases. The proprietary databases contain the most unique data and therefore would be the hardest to replace assets would they be lost. Next is the custom-made order fulfillment system as it is proprietary and so probably fairly expensive to replace although not as unique as the data. The off-the-shelf software and hardware are the easiest and cheapest to replace. (4.2)

Answer 163

The Answer: B. Passive reconnaissance Passive reconnaissance focuses on gathering as much information from open sources such as social media, corporate websites, and business organizations. (5.5)

Answer 164

The Answer: C. DMARC DMARC (Domain-based Message Authentication Reporting and Conformance) specifies the disposition of spam emails. The legitimate owner of the originating email domain can choose to have these messages accepted, sent to a spam folder, or rejected. (4.5)

Answer 165

The Answer: A. Organized crime An organized crime actor is motivated by money, and their hacking objectives are usually based around objectives that can be easily exchanged for financial capital. (2.1)

Answer 166

The Answer: A. Root cause analysis The goal of a root cause analysis is to explain the ultimate cause of an incident. Once the cause is known, it becomes easier to protect against similar attacks in the future. (4.8)

Answer 167

The Answer: C. System availability Requests to emergency services are often critical in nature, and it's important for a dispatching system to always be available when a call is made. (3.1)

Answer 168

The Answer: C. Automation Automation ensures that compliance checks can be performed on a regular basis without the need for human intervention. This can be especially useful to provide alerts when a configuration change causes an organization to be out of compliance. (5.4)

Answer 169

The Answer: A. Create an operating system security policy to prevent the use of removable media Removable media uses hot-pluggable interfaces such as USB to connect storage drives. A security policy in the operating system can prevent any files from being written to a removable drive. (2.2)

Answer 170

The Answer: D. Regulated Reports and information created for governmental use are regulated by laws regarding the disclosure of certain types of data. (3.3)

Answer 171

The Answer: A. Restrict login access by IP address and GPS location, E. Consolidate all logs on a SIEM, and G. Enable time-of-day restrictions on the authentication server Adding location-based policies will prevent direct data access from outside of the country. Saving log information from all devices and creating audit reports from a single database can be implemented through the use of a SIEM (Security Information and Event Manager). Adding a check for the time-of-day will report any access that occurs during non-working hours. (4.6)

Answer 172

The Answer: B. A download was blocked from a web server A traffic flow from a web server port number (80) to a device port (60818) indicates that this traffic flow originated on port 80 of the web server. A file download is one of the most common ways to deliver a Trojan, and this log entry shows that the file containing the XPACK.A_7854 Trojan was blocked. (4.9)

Answer 173

The Answer: C. On-path An on-path attack is often associated with a third-party who is actively intercepting network traffic. This entity in the middle would not be able to provide a valid SSL certificate for a third-party website, and this error would appear in the browser as a warning. (2.4)

Answer 174

The Answer: A. Federation Federation would allow members of one organization to authenticate using the credentials of another organization. (4.6)

Answer 175

The Answer: A. MTBF The MTBF (Mean Time Between Failures) is a prediction of how often a repairable system will fail. (5.2)

Answer 176

The Answer: A. Social engineering This social engineering attack uses impersonation to take advantage of authority and urgency principles in an effort to convince someone else to circumvent normal security controls. (2.2) [A19]