Simulation Qs

Question 1

An attacker sends multiple syn packets from multiple sources
Target: Web server

Botnet
Phishing
Worm
Keylogger
RAT
Backdoor
Logic Bomb
Ransomware
—————————————————————–
implement 2FA using push notification
implement a host based IPS
Update the cryptographic algorithm
disable vulnerable services
change the default application password
enable DDoS protection
Disable Remote access services
Conduct a Code Review

Answer 1

Botnet
enable DDoS protection

Question 2

The attack is self propogating and compromises a SQL database using well-known credentials as it moves through the network

Target: Database Server

Botnet
Phishing
Worm
Keylogger
RAT
Backdoor
Logic Bomb
Ransomware
—————————————————————–
implement 2FA using push notification
implement a host based IPS
Update the cryptographic algorithm
disable vulnerable services
change the default application password
enable DDoS protection
Disable Remote access services
Conduct a Code Review

Answer 2

Worm
change the default application password

Question 3

The Attacker establishes a connection which allows remote commands to be executed

Target: User

Botnet
Phishing
Worm
Keylogger
RAT
Backdoor
Logic Bomb
Ransomware
—————————————————————–
implement 2FA using push notification
implement a host based IPS
Update the cryptographic algorithm
disable vulnerable services
change the default application password
enable DDoS protection
Disable Remote access services
Conduct a Code Review

Answer 3

RAT
implement a host based IPS

Question 4

The attacker embeds hidden access in an internally developed application that bypasses account log in

Target: application

Botnet
Phishing
Worm
Keylogger
RAT
Backdoor
Logic Bomb
Ransomware
—————————————————————–
implement 2FA using push notification
implement a host based IPS
Update the cryptographic algorithm
disable vulnerable services
change the default application password
enable DDoS protection
Disable Remote access services
Conduct a Code Review

Answer 4

Backdoor
implement 2FA using push notification

Question 5

The attacker uses hardware to remotely monitor a user’s input activity to harvest credentials

Botnet
Phishing
Worm
Keylogger
RAT
Backdoor
Logic Bomb
Ransomware
—————————————————————–
implement 2FA using push notification
implement a host based IPS
Update the cryptographic algorithm
disable vulnerable services
change the default application password
enable DDoS protection
Disable Remote access services
Conduct a Code Review

Answer 5

Keylogger
disable vulnerable services

Question 6

A security engineer is setting up passwordless authentication for the first time.
INSTRUCTIONS
Use the minimum set of commands to set this up and verify that it works. Commands cannot be reused.

chmod664 ~/.ssh/id_rsa
chmod 777 ~/.ssh/authorized_keys
ssh-keygen -t rsa
scp ~/.ssh/id_rsa user@server:.ssh/authorized_keys
ssh-copy-id -i ~/.ssh/id_rsa.pub user@server
ssh -i ~/.ssh/id_rsa user@server
ssh root@server

Answer 6

ssh-keygen -t rsa
ssh-copy-id -i ~/.ssh/id_rsa.pub user@server
chmod664 ~/.ssh/id_rsa
ssh root@server

Question 7

Click on each host and firewall. Review all logs to determine which host originated the infection and then identify if each remaining host is clean or infected.

Answer 7

192.168.10.22 - origin - scans disabled on this host by svchost
192.168.10.37 - clean - scan found and quarantined svchost
192.168.10.41 - infected - heuristic pattern match but failed to quarantine svchost
10.10.9.12 - clean - scan found and quarantined svchost
10.10.9.18 - infected - heuristic pattern match but failed to quarantine svchost

Question 8

Match the Data Classification with the scenario

1 - Bound copes of internal audit reports from a private company
2 - Copies of financial audit reports from exchange traded organizations on a flash drive
3 - Database containing driver’s license information on a reusable backup tape
4 - Decommissioned mechanical hard drive containing application source code
5 - Employee Records on an SSD
6 - Paper based customer records, which includes medical data
——————————————————————————————————
PII
PHI
Intellectual property
Corporate Confidential
Public

Answer 8

PII - 3
PHI - 6
Intellectual property - 4
Corporate Confidential - 1, 5
Public - 2

Question 9

Match the Data Destruction Method with the scenario

1 - Bound copies of internal audit reports from a private company
2 - Copies of financial audit reports from exchange traded organizations on a flash drive
3 - Database containing driver’s license information on a reusable backup tape
4 - Decommissioned mechanical hard drive containing application source code
5 - Employee Records on an SSD
6 - Paper based customer records, which includes medical data
——————————————————————————————————

Degaussing And Multi Pass Wipe
Physical destruction via shredding

Answer 9

Degaussing And Multi Pass Wipe - 2, 3, 4, 5
Physical destruction via shredding - 1, 6