Technologies and Tools Flashcards
What mechanism of loop protection is based on an element in a protocol header ?
Time to live (TTL) is a value in the IP header used to prevent loops at Layer 3. The TTL value sets the max number of routers that an IP packet will transverse before it is discarded if it has not reached its intended destination.
What type of wireless antenna can be used to send or receive signals in any direction ?
A rubber duck antenna is an omnidirectional antenna.
What mechanism of wireless security is based on AES?
Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP) is based on the AES encryption scheme.
What is the most effective means to reduce the risk of losing the data on a mobile device such as a notebook computer ?
Keeping minimal sensitive data on the system is the only way to reduce the risk.
Which of the following is true regarding an exploitation framework? (Select all that apply)
A. Is a passive scanner
B. Fully exploits vulnerabilities
C. Only operates in an automated fashion
D. Allows for customisation of test elements
E. Represents additional risk to the environment
F. Can only assess systems over IPv4
B, D, E
How are effective permissions determined or calculated ?
Accumulating the grants or allows of permissions, either thru group memberships or to the user accounts directly, and then removing any denials of permissions.
What is an example of a PUP?
Potentially unwanted programs can include any type of questionable software such as sniffers, pw crackers, network mappers, port scanners, and vulnerability scanners.
What is the purpose of DEP being present in an OS?
Data execution prevention is a memory security feature of many OS aimed at blocking a range of memory abuse attacks including buffer overflows. It blocks the execution of code stored in areas of memory designed as data only areas.
Layer 7 of OSI model
Application layer
Layer 6 of OSI model
Presentation layer
Layer 5 of OSI model
Session later
Layer 4 of OSI model
Transport layer
Layer 3 of OSI model
Network layer
Layer 2 of OSI model
Data link layer
Layer 1 of OSI model
Physical layer
FTP port
TCP ports 20 and 21
SSH
TCP port 25
SMTP
TCP port 25
DNS
TCP and UDP port 53
HTTP
TCP port 80
POP3
TCP port 110
NetBios Session Service
TCP port 139
IMAP4
TCP port 143
HTTPS
TCP Port 443 or TLS TCP 80
Remote Desktop protocol (RDP)
TCP port 3389
As the CTO Marge is implementing a security program. She has included security controls to address confidentiality and availability. Of the following choices what else should she include ?
1) ensure critical systems provide uninterrupted service
2) protect data in transit from unauthorised disclosure
3) endure systems are not susceptible to unauthorised changes
4) secure data to prevent unauthorised disclosure
c
The system in the example is already addressing confidentiality and availability.
Which type of virtualisation allows a computers OS kernel to run multiple isolated instances of a guest virtual machine, with each guest sharing the kernel ?
1) container virtualisation
2) type 1 hypervisor virtualisation
3) type II hypervisor virtualisation
4) VDE
1.
Container based virtualization uses the same OS kernel of the host computer.
Ned is reviewing pw security for employees of The Leftorium. The pw policy has the following settings:
The pw max age is 30 days
The pw min length is 14 characters
Pw cannot be reused until 5 other pw have been used
Pw must include at least one of the following four character types: uppercase letters, lowercase letters, numbers and special characters.
Ned discovers that despite having this pw policy in place users are still using the same pw that they were using more then a month ago. Which of the following actions will resolve this issue ?
Create a rule in the pw policy for the pw min age to be 7 days
Change the pw history to 10
Require the use of complex pw
Change the max age setting to 60 days
A
Your org has decided to implement a biometric solution for authentication. One of the goals is to ensure that the biometric system is highly accurate. Which of the following provides the BEST indication of accuracy with the biometric system ?
The lowest possible FRR
The highest possible FAR
The lowest possible CER
The highest possible CER
A lower crossover error rate indicates a more accurate biometric system. The false acceptance rate and the false rejection rate vary based on the sensitivity of the biometric system and don’t indicate accuracy by themselves. A higher CER indicates a less accurate biometric system.
Your org recently updated an online application employees use to log on when working from home. Employees enter their username and pw into the application from their smartphone and the application logs their location using GPS. Which type of authentication is being used ? A. One factor B. Dual factor C. Something you are D. Somewhere you are
A
A network includes a ticket granting ticket server used for authentication. Which authentication service does this network use ?
A. Shibboleth
B. SAML
C. LDAP
D. Kerberos
D
Marge is reviewing an organizations account management processes. She wants to ensure that security log entries accurately report the id of personnel taking specific actions. Which of the following steps would BEST meet this requirement ?
A. Update ACLs for all files and folders
B. Implement role based privileges
C. Use an SSO solution
D. Remove all shared accounts
D
A recent security audit discovered several apparently dormant user accounts. Although users could log on to the accounts no one has logged on to them over 60 days. You later discovers that these accounts are for contractors who work approx one week every quarter. Which of the following is the BEST response to this situation ?
A. Remove the account expiration from the accounts
B. Delete the accounts
C. Reset the accounts
D. Disable the accounts
D
Members of a project team chose to meet at a local library to complete some work on a key project. All of them are authorised to work from home using a VPN connection and have connected from home successfully. However they found they were unable to connect to the network using the VPN from the library and they could not access any of the project data. Which of the following choices is the MOST likely reason why they can’t access this data ?
A. Role based access control
B. Time of day access control
C. Location based policy
D. Discretionary access control
C
A company recently hired you as a security admin. You notice that some former accounts used by temp employees are currently enabled. Which of the following choices is the BEST RESPONSE
A. Disable all the temp accounts
B. Disable the temp accounts you’ve noticed are enabled
C. Craft a script to id inactive accounts based on the last time they logged on
D. Set account expiration dates for all accounts when creating them
C
Developers are planning to develop an application using role based access control. Which of the following would they MOST likely include in their planning ?
A. A listing of labels reflecting classification levels
B. A requirements list identifying need to know
C. A listing of owners
D. A matrix of functions matched with their required privileges
D
A security admin needs to implement an access control system that will protect data based on the following matrix.
Doc type - security level - security label
Emp docs - private - employee
Salary & compensation docs - private - payroll
Internal phone listing docs - private - employee
Which of the following models is the admin implementing ?
A. DAC
B. MAC
C. Role-BAC
D. ABAC
B
This is a mandatory access control model. You can tell because it is using security labels.
A Discretionary access control model has an owner who establishes access for the objects. A role based access control model uses roles or groups to assign rights and permissions. An attribute based access control model uses attributes assigned to subjects and objects within a policy to grant access.
Which of the following allows the deployment of a publicly accessible web server without compromising the security of the private network ? A. Intranet B. DMZ C. Extranet D. Switch
B. A DMZ provides a network segment where publicly accessible servers can be deployed without compromising the security of the private network.
A security template can be used to perform all but which of the following tasks ?
A. Capture the security configuration of a master system.
B. Apply security settings to a target system
C. Return a target system to its precompromised state
D. Evaluate compliance with security of a target system
C
In order to avoid creating a monolithic security structure, organizations should adopt a wide range of security mechanisms. This concept is known as A. Defense in depth B. Control diversity C. Intranet buffering D. Sandboxing
B
When offering a resource to public users, what means of deployment provides the most protection for a private network ? A. Intranet B. Wireless C. Honeynet D. DMZ
D
When you are implementing a security monitoring system, what element is deployed in order to detect and record activities and events ?
A. Correlation engine
B. Tap
C. Sensor
D. Aggregation switch
C
What form of cloud service provides the customer with the ability to run their own custom code but does not require that they manage the execution environment or operating system ?
A. SaaS
B. PaaS
C. IaaS
D. SECaas
B. Platform as a Service is the concept of providing a computing platform and SW solution stack to a virtual or cloud based service.
Marge needs to collect network device config info and network statistics from devices on the network. She wants to protect the confidentiality of credentials used to connect to these devices. Which of the following protocols would BEST meet this need ?
A. SSH
B. FTPS
C. SNMPv3
D. TLS
C. Simple Network Mgmt Protocol v3 is a secure protocol that can monitor and collect info from network devices and includes strong auth mechanisms to protect the confidentiality of credentials.
Your org wants to increase security for VoIP and video teleconferencing apps used within the network. Which of the following protocols will BEST support this goal ?
A. SMTP
B. TLS
C. SFTP
D. SRTP
D. The secure real time transport protocol provides encryption, message auth, and integrity for VoIP, video teleconferencing, and other streaming media apps.
Mgmt within your org wants to ensure that switches are not susceptible to switching loop problems. Which of the following protocols is BEST choice to meet this need ?
A. Flood guard
B. SNMPv3
C. SRTP
D. RSTP
D. Rapid STP prevents switching loop problems and should be enabled on the switches to meet this need.
A network tech incorrectly wired switch connections in your orgs network. It effectively disabled the switch as tho it was a victim of a DoS attack. Which of the following should be done to prevent this situation in the future ?
A. Install an IDS
B. Only use layer 2 switches
C. Install SNMPv3 on the switches
D. Implement STP or RSTP
D
Spanning tree protocol and rapid STP both percent switching loop problems.
You manage a Linux computer used for security within your network you plan to use it to inspect and handle network based traffic using iptables. Which of the following network devices can this replace ?
A. Wireless access point
B. Firewall
C. Layer 2 switch
D. Bridge
B
Iptables include settings used by the Linux kernel firewall and can be used to replace a firewall.
You need to implement antispoofing on a border router. Which one of the following choices will BEST meet this goal ?
A. Create rules to block all outgoing traffic from a private IP address
B. Implement a flood guard on switches
C. Add a web app firewall
D. Create rules to block all incoming traffic from a private IP address
D
You would create rules to block all incoming traffic from private IP addresses. The border router is between the internal network and the internet and any traffic coming from the internet with a private IP address is a spoofed source IP address.
An org has recently had several attacks against servers within a DMZ. Security admin discovered that many of these attacks are using TCP but they did not start with a three way handshake. Which of the following devices provides the BEST solution ?
A. Stateless firewall
B. Stateful firewall
C. Network firewall
D. App based firewall
B.
A stateful firewall filters traffic based on the state of a packet within a session. It would filter a packet that isn’t part of a TCP three way handshake. A stateless firewall filters traffic based on the IP address, port, or protocol ID. While it’s appropriate to place a network firewall in a DMZ a network firewall could be either a stateless or a stateful firewall. An app based firewall is typically only protecting a host not a network.
Your org hosts a web server and wants to increase its security. You need to separate all web facing traffic from internal network traffic. Which of the following provides the BEST solution?
A. DMZ
B. VLAN
C. Firewall
D. WAF
A
Mgmt at your org wants to prevent employees from accessing social media sites using company owned computers. Which of the following devices would you implement ?
A. Transparent proxy
B. Reverse proxy
C. Nontransparent proxy
D. Caching proxy
C. A nontransparent proxy includes the ability to filter traffic based on the URL and is the best choice.
You need to configure a UTM security appliance to restrict traffic going to social media sites. Which of the following are you MOST likely to configure ?
A. Content inspection
B. Malware inspection
C. URL filter
D. DDoS mitigator
C
You would most likely configure the URL filter on the unified threat management security appliance. This would block access to the peer to peer sites based on their URL.
What method of access control is best suited for environments with a high rate of employee turnover? A. MAC B. DAC C. RBAC D. ACL
C. Role based access control is best suited for environments with a high rate of employee turnover because access is defined against static job descriptions rather then transitive used accounts (DAC and ACL) or assigned clearances (MAC).
Which of the following technologies can be used to add an additional layer of protection between a directory services based network and remote clients?
A. SMTP
B. RADIUS
C. PGP
D. VLAN
RADIUS is a centralized authentication solution that adds an additional layer of security between a network and remote clients. SMTP is the email forwarding protocol used on the internet and intranets. PGP is a security solution for email. VLANS are created by switches to logically divide a network into subnets.
How are effective permissions calculated?
A. Count the number of allows, subtract the number of denials
B. Accumulate allows, remove denials
C. Look at the users clearance level
D. Count the number of groups the user is a member of
B. Effective permissions are calculated by accumulating all allows or grants of access to a resource, and then subtracting or removing any denials to that resource.
Failing to perform regular permissions auditing can result in a violation of what security concept ?
A. Implicit deny
B. Security by obscurity
C. Least privilege
D. Diversity of defense
Failing to regularly audit user permissions can result in users gaining more access over time that is not required by their current work responsibilities. This situation is a violation of the principle of least privilege.
Attackers have recently launched several attacks against servers in your organization’s DMZ. You are tasked with identifying a solution that will have the best chance at preventing these attacks in the future. Which is the best choice A. An out of band IPS B. An in band IPS C. A passive IDS D. An out of band IDS
The best solution is an in band intrusion prevention system. Traffic goes thru the IPS and the IPS has the best chance of preventing attacks from reaching internal systems. An IPS is in and not out of band. An IDS is passive and not in band so it can only detect and react to the attacks not block them.
