Threat, Vulnerabilities and Mitigations: Quiz Revision

Question 1

Which of the following network attacks has the goal of capturing a user’s login information to use in a subsequent attack?

A) Amplified
B) Credential replay
C) On-path
D) Reflected

Answer 1

A credential replay attack uses intercepted credentials to initiate an attack. An attacker will monitor the conversation between Benjamin and George and capture the credentials of George. Later, the attacker initiates a conversation with Benjamin. When challenged for credentials by Benjamin, the attacker supplies George’s credentials, and Benjamin allows the conversation to continue.

Question 2

What is a reflected attack?

Answer 2

Reflected attacks are Distributed Denial of Service (DDoS) attacks. Reflected DDoS attacks used spoofed IP addresses to send excessive traffic to targets. The attacker will make multiple requests for information from a server, using the spoofed IP address of a victim. The victim is then overwhelmed with response traffic from the server.

Question 3

What is a On-Path attack?

Answer 3

An on-path (formerly known as man-in-the-middle) attack occurs when a hacker intercepts messages from a sender, modifies those messages, and sends them to a legitimate receiver. This type of attack often involves interrupting network traffic to insert malicious code.

Question 4

What is a Amplified attack?

Answer 4

Amplified attacks are often part of a DDoS attack, usually associated with UDP protocols. The goal of this attack is to turn a simple query, such as DNS or NTP, into a flood of responses that overwhelms the victim’s network resources

Question 5

A user notifies you that a software application displays advertisements while the application is executing. Of which security threat is this an example?

A) spyware
B) virus
C) worm
D) adware

Answer 5

Adware is a software application that displays advertisements while the application is executing. A common example is a free mobile app that displays advertisements for other products at the bottom of the screen. Some adware is also spyware that monitors your Internet usage and personal information. Some adware will even allow credit card information theft. The application’s developer may or may not be aware that malicious ads containing spyware are being displayed through the application.

A worm is a program that spreads itself through network connections. Spyware often uses tracking cookies to collect and report on a user’s activities. Not all spyware is adware, and not all adware is spyware. The definition of spyware requires that your activities be monitored and tracked; the definition of adware requires that advertisements be displayed.

A virus is malicious software (malware) that relies upon other application programs to execute itself and infect a system. Another malware that you need to be familiar with is ransomware, which restricts access to a computer that it infects. The ransomware then demands a ransom paid to the creator of the malware for the restriction to be removed.

Question 6

Which threat actor motivation is exemplified by threatening to release sensitive personally identifiable information (PII)?

A) Financial gain
B) Service disruption
C) Blackmail
D) Data exfiltration

Answer 6

Blackmail is most commonly accomplished by threatening to release sensitive PII or incriminating evidence regarding an individual. The cyber-criminal targets an individual who has access to certain company assets, such as data, systems, or processes, and then digs into their personal records. The cyber-criminal threatens to expose the individual unless they take some action against a company asset on the criminal’s behalf.

Remember that not all PII is sensitive. While names, addresses, gender, and dates of birth are PII, they are found in many public databases. PII also includes geo-location data, online browsing history, and medical records, which are more likely to be leveraged by a blackmailer.

Question 7

What is service disruption?

Answer 7

Service disruption can cause damage to an organization’s reputation, or loss of public confidence in the organization. If an airline had a disruption where you could not access their services, such as booking a flight, that person would likely do business with another airline.

Question 8

What is Data exfiltration?

Answer 8

Data exfiltration is the act of sending sensitive or proprietary information to unauthorized recipients external to the organization. Data loss prevention is designed to detect and stop data exfiltration behavior by users. If DLP software is not present, data exfiltration might only be discovered after the event. When it occurs, the best course of action is to identify the source of the disclosure, if possible, and then take disciplinary action against the user.

Question 9

What is financial gain motivation?

Answer 9

Financial gain motivation is exemplified by activities such as fraud, ransom attacks, and theft of credit card data. Once the threat actor has your information, they can sell it or use it for fraudulent purposes. When a cyber-criminal threatens to reveal sensitive PII in exchange for money, it is termed extortion, not blackmail.

Question 10

What is Espionage?

Answer 10

Espionage – Competition attacks are the modern version of industrial espionage. Theft of intellectual property, marketing plans, and customer lists are all examples that can have devastating effects on the targeted organization. Even stealing the victim company’s credit card list can have a severe economic impact on that company. Often, the attacking company will find a disgruntled individual in the subject company to carry out the attack.

Question 11

What is Philosophical or political beliefs?

Answer 11

Philosophical or political beliefs – Philosophical beliefs and political beliefs are used by extremist groups to recruit members to their cause. One nation might attempt to convince citizens of another nation to perform cyberterrorist activities. Hacktivists are the typical actor here.

Question 12

What are ethical motives?

Answer 12

Ethical motives – Ethical hackers (sometimes called white-hat hackers or penetration testers) are individuals hired by the company to test the company’s security infrastructure. Their purpose is to conduct activities to find weaknesses and “break in”. The ethical hacker will prepare a report detailing the weaknesses so that the client company can address those issues and make corrections. They may be mistaken for threat actors by the company’s in-house team during a closed penetration test.

Question 13

What is revenge motivation?

Answer 13

Revenge – threat actors can be motivated by revenge. Revenge and retaliation result from the perception that the threat actor has been slighted by a person or organization. The threat actor wants to “teach them a lesson” or extract revenge.

Question 14

What is disruption and Chaos?

Answer 14

Disruption/Chaos – Some threat actors simply want to cause disruption and chaos. A threat actor might be motivated to gain notoriety by claiming responsibility for a disruptive event. The end goal is to upset normal operations in an attention-getting way.

Question 15

What is War motivations?

Answer 15

War – Civilians and nation-states can use cyberspace to advance wartime agendas. Each may be engaged in activities that disrupt a target’s communications, services, and infrastructure, or to spread propaganda, misinformation, and fear.

Question 16

Which of the following supply chain elements are threat vectors? (Choose all that apply.)

A) Third-party software dependencies
B) Managed service providers
C) Hardware suppliers
D) Software suppliers

Answer 16

Managed service providers (MSPs), software and hardware suppliers, and third-party software dependencies are all threat vectors in the supply chain. A supply-chain attack is not an attack on a target directly, but on a more vulnerable company or resource that helps the target organization conduct its business or create a product. By infiltrating the target’s supply chain, the attackers can gain access to internal systems or data through the compromised components.

Managed Service Providers (MSPs) are highly susceptible to supply chain attacks. MSPs provide IT services to other organizations, and may have access to data from their clients. When an organization announces that they are outsourcing a certain aspect of their business, they are outsourcing to an MSP. An MSP may provide any combination of a number of services, such as help desk services, tech support, software updates, data backup, and even payroll services. When an attacker targets an MSP, they potentially have access to multiple clients of that MSP. The most well-known supply chain attack involving an MSP was the SolarWinds attack of 2020. Attackers may also disable access to a third-party managed service, as in the United Healthcare billing service attack of 2024.

Software suppliers include cloud-based SaaS providers and application vendors. Software provider vulnerabilities occur in third-party companies that provide software to other companies (customers). Attackers will look for a vulnerability within the software that the attacker can exploit. Then, when the customer installs the software, the customer’s data is exposed to the attacker, or the attacker is able to install more malicious software into the customer’s system to establish a foothold.

Third-party software dependencies refer to the external libraries, frameworks or components that integrate with an organization’s existing software or that were used to build third-party software. These external items add functionality, or perhaps assist with further development. Issues to consider with third-party software include the possibility of malicious components, lack of transparency from the vendor, and supply chain attacks on vulnerable components.

Question 17

What are some the strict Audit controls to avoid supply chain attacks?

Answer 17

All vendors in the supply chain should be under strict audit controls. Some recommended best practices to mitigate supply-chain attacks include:

Monitor third-party service providers’ access to sensitive data.

Make an inventory of all data exposed to the supply chain.

Request source code and list of all components used to build a vendor’s software.

Include security requirements and a right-to-audit in all contracts with managed service providers, software providers, and hardware suppliers.

Use automated supply-chain management tools to continually monitor for and remediate known vulnerabilities and audit behavior.

Have a formal procedure for offboarding old vendors and removing their access to internal systems.

Question 18

What are some of the hardware supply chain attacks?

Answer 18

Hardware provider vulnerabilities occur in device manufacturers and suppliers. A classic example is the Target breach in 2013. Target’s HVAC hardware provider was compromised, and through the HVAC provider, attackers accessed Target’s payment system and stole millions of credit card numbers from Target’s customers. Other hardware-based supply chain attacks could include:

Selling counterfeit equipment through an unauthorized channel
Tampering with legitimate equipment before it is delivered to the target

Using uncertified third-party components while manufacturing the hardware

Allowing off-site personnel to install hardware without supervision
To mitigate these risks, organizations should only buy hardware from authorized resellers or the manufacturer, inspect hardware for signs of tampering, supervise vendor personnel during equipment installation, and request vendors certify the hardware and its components.

Question 19

Which of the following malware attacks is actually a collection of unwanted or unnecessary programs installed on a system?

A) Keylogger
B) Bloatware
C) Rootkit
D) Trojan

Answer 19

Bloatware is an umbrella term for all the extra (and usually unwanted) applications that are installed on systems by the manufacturers. Many of these extra applications are harmless, and some of these applications may be bundled in a zip file. When you install from the zip file, you also install all the extra applications which may include things like browser hijackers, adware and even spyware.

Question 20

What is a keylogger?

Answer 20

Keyloggers capture the keystrokes made on the keyboard and send them to the attacker. The keylogger can be a physical device, it is more often a software application. The keylogger records the keystrokes made by the users as a file, which can be transmitted in real time or at a time of the attacker’s choosing.

Question 21

What is a Trojan?

Answer 21

A Trojan is malware, malicious content that looks to be something beneficial or legitimate. The user is tricked into downloading and installing the content, or clicking on a link that is actually an executable. The name “Trojan” comes from the ancient Greek story of the Trojan Horse.

Question 22

What is a rootkit?

Answer 22

A rootkit is a type of malware that allows attackers to have administrative access through a backdoor. Once an attacker has gained access, the rootkit may have the capability of erasing its tracks. Rootkits are particularly dangerous, since the administrative access allows the attacker to change system-level files including the Registry.

Question 23

You have several independent security monitoring solutions, each with different logging mechanisms. You are concerned that they are not working well together, and that the separate logs may not present all the necessary information. In addition, the costs of maintaining the separate products are rising. You need to provide a centralized solution that will include centralized logging. What could you replace them with?

A) Patch management tools
B) Host-based firewall
C) DLP
D) UTM

Answer 23

Unified Threat Management (UTM) incorporates several threat management devices and systems into one appliance. The biggest advantage to a UTM from an analysis standpoint is that all the logs are in one place, as opposed to checking multiple systems. In addition, a UTM would cut down on the costs associated with maintaining separate products.

Question 24

What are HIPS and HIDS used for?

Answer 24

HIDSs and HIPSs have two different functions. Host-based Intrusion Detection Systems (HIDS) will provide an alert in the event of a breach on a single server or computer. Host-based Intrusion prevention systems (HIPS) will go a step further and stop the attack. An example would be shutting down port 80 when http traffic exceeds the baseline norm. With either product, it would be important to view the log entries generated, and interpret the results based on documentation provided by the HIPS/HIDS vendor. A host-based system will not monitor network traffic for threats.

Question 25

Is Antivirus products a one stop shop against threat?

Answer 25

Antivirus products (and the antimalware products that encompass them) provide notifications when a threat has been detected, and what action was taken. On many occasions, the software will identify a potential threat, and prompt you for what action to take. Antivirus is not a centralized solution for security; it is only one part of the solution.

Question 26

What does Patch Management tool assist in?

Answer 26

Patch management tools assist with the installation of patches, which can present a significant challenge to an enterprise environment. Their logs will contain successful and failed updates, incompatible patches, and unsuccessful patch installations, but no other security logging information.

Question 27

What are the features of Host-Based firewalls?

Answer 27

Host-based firewalls include products that are installed as an application, or included in the OS, such as the Windows Firewall. In the case of Windows Firewall, it is possible to have the firewall activated, but not generating log entries. You can activate logging by going into the console, choosing Actions, then Properties. The logging can be set as seen below. It is important to review the documentation that accompanies the application to interpret the results. Firewall logs display traffic that has been allowed and denied passage through the firewall, but not logs from other security systems, such as antimalware tools.

Question 28

What are the security technologies and their output?

Answer 28

For the Security+ exam, you also need to understand other security technologies and their output, including file integrity checks, application allow listing, removable media control, DEP, WAFs, DLP, UTM, and advanced malware tools.

Question 29

What is a File integrity checks do?

Answer 29

File integrity checks examine selected files to see if there have been any changes, or attempted changes. It is important to review the logs to know when attempts have been made, even if the file integrity product returned the file to the original state.

Question 30

What are the functions of Application allow list?

Answer 30

Application allow list is the practice of denying all applications except for those that are approved. Those approved applications are designated as on the allow list. Several products are available that check for applications that are not on the allow list, including attempts to install those applications. The logs the allow list product generates would tell you if someone had attempted (for example) to install a keylogger. Removable media control (RMC) is important in many environments. USB drives, SD cards, CDs, DVDs and BluRay devices can all present dangers to the system. As an example, someone can use a USB drive to copy sensitive information and deliver it to someone outside the organization. Another example could be a CD that appears to be a music CD but is actually installation media for unauthorized software. Examine the RMC logs to determine attempts to violate removable media policies.

Question 31

Why are advanced malware tools check do?

Answer 31

Advanced malware tools check for malicious code that would otherwise slip by standard antivirus and antimalware tools.

Question 32

What does DLP examine?

Answer 32

Data Loss Prevention (DLP) examines outbound traffic for sensitive data, keywords, and specific files leaving the organization.

Question 33

What does DEP do?

Answer 33

Data execution prevention (DEP) forces the user to approve an application before it executes or launches. Logs will record execution attempts, including failed attempts. Notification of failed attempts is important, as it could tell you that your antimalware application successfully blocked an attempt to install malware.

Question 34

What is a web application firewall?

Answer 34

A web application firewall uses a set of defined rules to manage incoming and outgoing web server traffic, as well as attack prevention. Organizations can define their own rules, based on their particular vulnerability.

Question 35

Recently, while reviewing log data, you discover that a hacker has used a design flaw in an application to obtain unauthorized access to the application. Which type of attack has occurred? A) backdoor B) privilege escalation C) maintenance hook D) buffer overflow

Answer 35

An escalation of privileges attack occurs when an attacker has used a design flaw in an application to obtain unauthorized access to the application. Privilege escalation includes incidents where a user logs in with valid credentials and then takes over the privileges of another user, or where a user logs in with a standard account and uses a system flaw to obtain administrative privileges. There are two types of privilege escalation: vertical and horizontal. With vertical privilege escalation, the attacker obtains higher privileges by performing operations that allow the attacker to run unauthorized code. With horizontal privilege escalation, the attacker obtains the same level of permissions as he already has but uses a different user account to do so.

Question 36

What does the term backdoor mean?

Answer 36

A backdoor is a term for lines of code that are inserted into an application to allow developers to enter the application and bypass the security mechanisms. Backdoors are also referred to as maintenance hooks.

Question 37

What does a buffer overflow involved in?

Answer 37

A buffer overflow occurs when an application erroneously allows an invalid amount of input in the buffer. It can be used to perform a denial-of-service (DoS) attack or a Distributed Denial-of-Service (DDoS) attack.

Question 38

What is a race condition in Application issue?

Answer 38

Race condition – typically targets timing, mainly the delay between time of check (TOC) and time of use (TOU). To eliminate race conditions, application developers should create code that processes exclusive-lock resources in a certain sequence and unlocks them in reverse order.

Question 39

What is insecure direct object references in application issues?

Answer 39

Insecure direct object references – occurs when a developer exposes a reference to an internal object, such as a file, directory, database record, or key, as a URL or form parameter without implementing the appropriate security control. An attacker can manipulate direct object references to access other objects without authorization. Implementing an access control check helps to protect against these attacks.

Question 40

What does CSRF do in terms of application issues?

Answer 40

Cross-site request forgery (CSRF) – occurs when a malicious site executes unauthorized commands from a user on a web site that trusts the user. It is also referred to as a one-click attack or session riding. Implementing anti-forgery tokens protect against this attack.

Question 41

What application issue occurs when improper storage of sensitive data occurs?

Answer 41

Improper storage of sensitive data – occurs when sensitive data is not properly secured when it is stored. Sensitive data should be encrypted and protected with the appropriate access control list. Also, when sensitive data is in memory, it should be locked.

Question 42

When does improper error and exception handling occurs in application issues?

Answer 42

Improper error and exception handling – occurs when developers do not design appropriate error or exception messages in an application. The most common problem because of this issue is the fail-open security check, which occurs when access is granted (instead of denied) by default. Other issues include system crashes and resource consumption. Error handling mechanisms should be properly designed, implemented, and logged for future reference and troubleshooting.

Question 43

Why is Secure cookie storage transmission so important to avoid application issues?

Answer 43

Secure cookie storage and transmission – Cookies store a user's web site data, often including confidential data, such as usernames, passwords, and financial information. A secure cookie has the secure attribute enabled and is only used via HTTPS, ensuring that the cookie is always encrypted during transmission.

Question 44

What are memory leaks when it comes to application issues?

Answer 44

Memory leaks – occur when an application does not release memory after it is finished working with it. Reviewing coding and designing best practices helps to prevent memory leaks.

Question 45

Application Issue: Integra Overflow?

Answer 45

Integer overflows – occurs when an operation attempts to input an integer that is too large for the register or variable. The best solution is to use a safe integer class that has been built to avoid these problems.

Question 46

Application Issue: Geo-Tagging?

Answer 46

Geo-tagging – occurs when media, such as photos or videos, are tagged with geographical information. Turning off the geo-tagging feature on your device protects against releasing this type of information. It is also possible to remove geo-tagging information from media before using it in an application or web site.

Question 47

Application issue: Data Remnants?

Answer 47

Data remnants – occurs when applications are removed but data remnants, including registry entries, are left behind. Specialty tools and apps are available to ensure that applications have been completely removed from a device.

Question 48

You have recently been hired as a network administrator. The CIO informs you that their wireless networks are protected using firewalls. He has asked that you implement MAC filtering on all access points. What is the purpose of using this technology? A) to provide port authentication for a wireless network B) to ensure that unused ports are not accessible by clients C) to restrict the clients that can access a Web site D) to restrict the clients that can access a wireless network

Answer 48

The purpose of MAC filtering is to restrict the clients that can access a wireless network. Access is restricted based on the client's media access control (MAC) address, which is the unique identifier that is encoded on the network interface card (NIC).MAC filtering is not used to restrict the clients that can access a Web site. This is most often done using access control lists (ACLs). 802.1X (or WPA2-Enterprise) provides port authentication for a wireless network using Extensible Authentication protocol (EAP). 802.1X can use Protected EAP (PEAP) or Lightweight EAP (LEAP). PEAP is the more secure of the two. Both of these implementations require a server certificate on the RADIUS server. If the RADIUS server certificate expires, then clients will be unable to connect until the RADIUS server obtains a new certificate. To ensure that unused ports are not accessible by clients, you should disable all unused ports.

Question 49

How to increase network security in wireless network?

Answer 49

To increase network security, you should use the following mitigation and deterrent techniques: MAC limiting and filtering 802.1X Disable unused interfaces, applications, and services. Rogue machine detection You should always monitor system logs, including the audit logs, event logs, security logs, and access logs. Often by monitoring these logs, a security professional can discover issues or attacks and can take measures to prevent the issues. Security professionals should understand an organization's security posture. Security professionals should perform certain mitigation and deterrent activities including recording an initial baseline configuration, continually monitoring security, and performing remediation as necessary. You should also ensure that a good reporting system is set up to notify appropriate personnel if certain actions occur. This reporting system should include alarms and alerts. Security professionals should also perform periodic trending analysis to identify any new organizational trends. Mitigation controls help to mitigate security issues. Deterrent controls help to deter attacks. Prevention controls help to prevent attacks. Detective controls help to detect any attack when it occurs. Any security policy should employ all of these types of controls to be most effective. Cameras and intrusion detection systems (IDSs) are detective controls. Intrusion prevention systems (IPSs) and guards are preventive controls.

Question 50

A remote employee has a history of logging into the system every day between 8:50 AM and 9:05 AM. Today, the employee logs in at 3 AM. What does this exemplify? A) Out-of-cycle logging B) Resource inaccessibility C) Published/documented D) Missing logs

Answer 50

Out-of-cycle logging is when an event that normally occurs and is recorded at a regular time or interval shows up in the log as having occurred at an odd time or off-cycle. While it’s normal to see the event, it appears at a strange time, signaling that an attack may be underway.

Question 51

What are the signs of Resource inaccessibility?

Answer 51

Resource inaccessibility is an indicator of malicious activity. For example, if a web server goes down and is suddenly inaccessible, it might be the victim of a Denial of Service (DoS) attack.

Question 52

What happens when published/documented indicators are used?

Answer 52

Published/documented indicators are those that have been recently discovered and subsequently published by threat feed organizations such as the Cybersecurity and Infrastructure Security Agency (CISA). These indicators may include things like IP addresses, file hashes like MD5, and domain names. By knowing what to look for, this information can be used to uncover and respond to attacks.

Question 53

What are missing logs may be signs of?

Answer 53

Missing logs may be a sign that an attack has been attempted or has occurred, and the attacker has erased the log to cover up their tracks. Log files are a critical tool in monitoring activities, investigating problems, storing information about the health of the system and the network. Consequently, many organizations will store the log files on a separate device or server in a protected area of the network.

Question 54

Which of the following mitigation techniques would include establishing, deploying, and then maintaining a standard configuration, such as an image? A) Removal of unnecessary software B) Decommissioning C) Installation of endpoint protection D) Configuration enforcement

Answer 54

Configuration enforcement includes establishing, deploying, and then maintaining a standard configuration, such as a naming convention or even a system image. You could have an image based on a device/OS pair, an image for each of several user groups, or images for departments throughout the organization. Once the proper configuration has been established and preserved as a system image, configuration enforcement looks for changes to that configuration and, in some cases, even reverts the system to the proper configuration.

Question 55

What is decommissioning so important?

Answer 55

Decommissioning is a mitigation technique that is used when a system or device is no longer of use to the organization. Contrary to what many users feel as adequate, deleting files into the recycle bin is not a secure process. When a system or device has reached the end of its service life, storage media and drives must be sanitized, either through destruction or using tools to erase all traces of data on the device. Such as degaussing

Question 56

What is the removal of unnecessary software associated with?

Answer 56

Removal of unnecessary software is associated with system hardening. System hardening increases the security of a server or a computer system by reducing vulnerabilities and the attack surface. Other examples of system hardening activities include closing down ports and adjusting permissions.

Question 57

What does endpoint security involve?

Answer 57

Endpoint security is the practice of protecting the endpoints (workstations, printers, etc.) in the network. Endpoint protection includes protecting them from other endpoints that spend at least some of the time outside the LAN. This is done by verifying patches and updates before the device is allowed access to the network. Endpoint security also includes the hardening process of endpoints. It cannot route traffic from a device being flooded to a location where the traffic can be studied

Question 58

Which of the following is not a vulnerability associated with the supply chain? A) Service provider B) TPM C) Software provider D) Hardware provider

Answer 58

Trusted Platform Module (TPM) is not a supply chain vulnerability. TPM and Hardware Security Module (HSM) are both chips that implement hardware-based encryption. The main difference between the two is that a TPM chip is usually mounted on the motherboard and HSM chips are PCI adapter cards. Supply chain vulnerabilities include the service provider, the hardware provider, and the software provider. Hardware provider vulnerabilities occur in device manufacturers and suppliers. A classic example is the Target breach in 2013. Target’s HVAC hardware provider was compromised, and through the HVAC provider, attackers accessed Target’s payment system and stole millions of credit card numbers from Target’s customers. Software provider vulnerabilities occur in third-party companies that provide software to other companies (customers). Attackers will look for a vulnerability within the software that the attacker can exploit. Then, when the customer installs the software, the customer Service provider vulnerabilities can occur with a company that provides you with services, such as when you outsource your payroll processing or billing. If the service provider is compromised, the attacker can access and exploit the customer data.

Question 59

Which threat actor type can be characterized by an unsophisticated skill level, the use of widely available tools, and is motivated by the need to prove their skills? A) Hacktivist B) Shadow IT C) Insider D) Unskilled attacker E) Competitor

Answer 59

Unskilled attackers (sometimes referred to as script kiddies) typically rely on tools that are widely available on the Internet. These unskilled attackers are often motivated by the thrill of the chase and by the need to prove that they can do it. For the most part, they have limited time and financial resources.

Question 60

What is Shadow IT?

Answer 60

Shadow IT are IT applications, systems, and resources (such as cloud services) that are installed or used by internal staff without the knowledge or consent of the IT department. Shadow IT is neither authorized nor approved, and therefore poses a risk to the organization's security posture, risk management, data integrity, and regulatory compliance.

Question 61

What is Hacktivist?

Answer 61

Hacktivists are activists who use hacking techniques to promote their own political or social agenda. Their activities can cause DoS and DDoS attacks, or place embarrassing posts on the web sites or social media sites of an organization with opposing views. They often believe they are engaging in a righteous and morally correct cause, even if their activities are illegal. As with unskilled attackers, hacktivists often have limited time and financial resources. However, a hacktivist within a sophisticated or large organization may have access to significant resources.

Question 62

What are insider attacks?

Answer 62

Insider attacks are perpetrated by people within the organization. Insider threats have many possible motives, including promotion of an activist agenda, monetary reward, retaliation for not being selected for a promotion, or some other situation that caused the insider to become disgruntled with the organization. They typically have limited resources but given that they may already have substantial knowledge of the organization and network, they are particularly dangerous.

Question 63

What is Competition Attacks?

Answer 63

Competition attacks are the modern version of industrial espionage. Theft of intellectual property, marketing plans, and customer lists are all examples that can have devastating effects on the targeted organization. Even stealing the victim company's credit card list can have a severe economic impact on that company. Often, the attacking company will find a disgruntled individual in the subject company to carry out the attack.

Question 64

What are Organized Crime Attacks?

Answer 64

Organized crime attacks are carried out by criminal groups for the sole purpose of monetary gain. Organizations like the Mafia, Russian organized crime, and drug cartels have significant resources in terms of time and money to recruit hackers to carry out their agenda.

Question 65

What is Nation State Attacks?

Answer 65

Nation-state / Advanced Persistent Threat (APT) attacks are conducted by one nation upon another or upon a significant entity within the target country with large coordinated attacks. APTs have attackers who have very significant time and financial resources. Motives could be financial, political, disruption of the economy, or theft of intellectual property, such as military secrets.

Question 66

Which of the following begins with the attacker creating a fake patch? A) SQL injection B) Cross-site scripting C) Malicious update D) Memory injection

Answer 66

Malicious update is when an attacker first creates a fake software update, containing malware, that appears to be legitimate, and then gets users to download and install the update. Upon installation, the malware is activated on the system.

Question 67

What is memory Injections?

Answer 67

Memory injection is the primary goal of buffer overflow attacks. Buffer overflows attempt to put more information than can fit into an allocated area of memory. With memory injection, the attacker inserts malicious code into program memory. The computer then executes that malicious code as part of the program.

Question 68

What is an SQL injection?

Answer 68

An SQL injection is an example of improper input handling, and the impact can include data destruction or unfettered access to the database. Inputs should be checked for common SQL injection symbols. Other examples of improper input handling include failure to validate the type of data in an input field, the length of the data, and proper date ranges.

Question 69

What is cross-site scripting (XSS) Attacks?

Answer 69

A cross-site scripting (XSS) attack occurs when an attacker locates a vulnerability on a website that allows the attacker to inject malicious code into a web application. A persistent XSS attack occurs when data provided to the web application is first stored persistently on the server and later displayed to users without being encoded using HTML on the web client. A non-persistent XSS attack occurs when data provided by a web client is used immediately by server-side scripts to generate results for that user. XSS flaws occur every time an application takes user-supplied data and sends it to a web browser without first confirming or encoding the data.

Question 70

You are considering cloud services, and you are concerned about the interaction of your security policies and those of the hosting provider. What can alleviate your concern? A) Stress testing B) VM escape protection C) Cloud access security brokers D) VDI

Answer 70

Cloud access security brokers would alleviate your concern because they enforce security policies, whether on-premises or cloud-based. They often sit between the cloud service users and providers, merging the security policies of the user and the provider. Virtual desktop infrastructure (VDI) creates a user desktop on a virtual machine that is hosted on a data center server. Desktops can be personalized while still having centralized management and security.

Question 71

What does VDI strengthens and mitigate?

Answer 71

The virtual desktop environment (VDE) maintains everything related to the user desktop and deploys them to the host. Virtual desktop infrastructure can make your desktops either more secure or less so. Storing data on VDI servers in the data center is more secure than storing it locally on the user's machine. Also, administrators have greater control over desktop and app distribution in a VDI environment. VM escape protection can be accomplished by sandboxing. If the virtual application crashes, sandboxing allows you to contain the data and not allow the information to "escape" into another application. VM escape occurs when a vulnerability in the operating system running in the virtual machine is exploited. When this occurs, it allows an attacker to run malicious code and escape the boundaries of the VM.

Question 72

What does stress testing involve?

Answer 72

Stress testing puts a load on the system much higher than what is normally expected. For example, testing a website with 100x the normal amount of traffic would identify how the system will respond to the stress. Stress testing does not reveal security weaknesses between the interactions of your security policies with those of the hosting provider.

Question 73

What is the difference between hosted solution, cloud solution and on-premises solution?

Answer 73

Choosing between an on-premises solution versus a hosted solution versus a cloud solution are all virtualization decisions. On-premises virtual machines (VMs) are stored at your physical location. The hosted model allows you to contract with a third party for virtual access, and the responsibilities of the third party are detailed in a service level agreement (SLA). Cloud systems, while closely related to hosted models, have requirements such as on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service, as defined by NIST.

Question 74

Management is concerned that mobile device location information can be revealed to attackers. Which mobile device feature should you investigate? A) allow listing B) remote wiping C) geotagging D) screen lock

Answer 74

Geotagging is the process of attaching location information in the form of geographical metadata to digital media like web sites, videos, and photographs. Geotagging is a security concern because it can reveal location information. This feature embeds unseen code into a picture that records the longitude/latitude information of where the picture was taken. Geotags may also be applied to digital output and communications such as tweets or status updates on social media. The information included in a geotag may include place coordinates (latitude and longitude), bearings, altitude, distances, or even place names. This feature becomes a serious concern when it comes to protecting your privacy and data. Geotagging can give enough information about your current whereabouts (and where you’re not) which can allow thieves to target your home or workplace in your absence.

Question 75

What are the considerations you need to make when you installing an application in a mobile device?

Answer 75

When considering applications that can be installed on mobile devices, you need to understand the following concepts for the Security+ exam: Key management – You should take measures to ensure that all keys are protected. Measures that you can use include implementing device encryption to protect the keys while stored and using IPSec to protect the keys during transmission. Credential management – You should implement solutions that allow you to manage credentials for users to ensure that mobile devices are only accessed by valid users. In addition, you should ensure that the protocols that you use do not transmit credential information in plaintext. Authentication – If possible, you should require your mobile applications to authenticate users before allowing access. This ensures that applications are only accessed by valid users. Encryption – Applications often request personally identifiable information (PII) that should be protected. In addition, they often transmit PII and other confidential information. Therefore, you should employ encryption to protect the data in storage and in transmission. Transitive trust/authentication – Transitive trust occurs when federated user identities allow users to access multiple applications, devices, and resources using a single authentication. A trusted computing base is established as the basis of federated user identity. Enterprises should ensure that any entities allowed into the trusted computing base are fully protected. When deploying mobile devices securely, security professionals need to set policies and enforce them through monitoring all of the following features or practices: Third-party app stores, rooting/jailbreaking, sideloading, custom firmware, carrier unlocking, firmware over-the-air (OTA) updates, camera use, SMS/MMS, external media, USB on-the-go (OTG), recording microphones, GPS tagging, Wi-Fi direct/ad hoc, tethering, and payment methods. Management should set the policy for each of these mobile device components. Policies are only effective if a plan for enforcement and monitoring is also established.

Question 76

You need to ensure that corporate users understand the different types of malware they will encounter. Match the descriptions on the left with the malware types on the right. Backdoor - a program that infects a system under the guise of another legitimate program Logic bomb - a developer hook in a system or application that allows developers to circumvent normal authentication Spyware – a program that executes when a certain predefined event occurs Trojan horse - a program that monitors and tracks user activities

Answer 76

The malware types should be matched with the descriptions in the following manner: Backdoor – a developer hook in a system or application that allows developers to circumvent normal authentication Logic bomb – a program that executes when a certain predefined event occurs Spyware – a program that monitors and tracks user activities Trojan horse – a program that infects a system under the guise of another legitimate program

Question 77

Your organization has a contract to provide networking services to a government agency. You are required to use certified hardware to build a secure network. Which of the following practices will help you avoid adversarial threats in the supply chain? (Choose all that apply.) A) Inspect hardware for signs of tampering B) Have a legally enforceable purchase order with the hardware vendor C) Integrate supply chain management into the overall risk management framework D) Request proof of equipment certification from hardware vendors E) Only purchase hardware from authorized vendors or resellers F) Source hardware from multiple vendors in case natural disasters disrupt availability

Answer 77

NIST defines cybersecurity risks throughout the supply chain as “the potential for harm or compromise that may arise from suppliers, their supply chains, their products, or their services” (NIST SP 800-161r1). Among the recommended techniques for minimizing adversarial threats from hardware purchases, you should: Only purchase hardware from authorized vendors or resellers Integrate supply chain management into the overall risk management framework Inspect hardware for signs of tampering Request proof of equipment certification from hardware vendors Conduct a supply chain analysis and audit the existing supply chain Have an inventory management system that includes asset tracking and secure disposal Natural disasters are a threat to the supply chain, but they are not an adversarial threat. Adversarial threats arise from a human vector, such as malicious insiders, organized crime, and nation-states. A legally enforceable purchase order with a hardware vendor will not protect your organization from hardware that has been tampered with once it left the vendor’s direct control. Hardware should be inspected for missing or broken seals, opened boxes, refurbished components, or counterfeit components.

Question 78

A user supplies the proper credentials and logins in to a remote system from an offsite location in New York. Moments later, the same proper credentials are used to login from a different offsite location, this time from Tokyo. What type of Indicator of Compromise does this represent? A) Resource consumption B) Impossible travel C) Blocked content D) Concurrent session usage

Answer 78

Impossible travel is when a user logs in from one location, and then moments later logs in from another location, but it would have been impossible for the user to have traveled between the two locations in that time frame. An example would be a user who logs on in New York, then 20 seconds later the same user logs on in Tokyo. Blocked content can be an IoC. If, for example, a filter on a firewall could result from a filter on a firewall finding malicious code, or it could be Resource consumption occurs with events like filling all the space on a drive or using all the bandwidth on a network.

Question 79

What is a concurrent session?

Answer 79

Concurrent session usage happens when you have two or more instances of a user account logged in at the same time, when there should be only one instance of that user login. This could happen with the same system or different systems. The key factor here is that it would be unexpected for the user to login multiple times. A user with a Gmail account open on several devices simultaneously would not be a concurrent session usage IoC.

Question 80

You are your organization's security analyst. Recently, you discovered that an attacker injected malicious code into a web application on your organization's website. You discovered this attack by reviewing the log data on the web servers. Which type of attack did your organization experience? A) path traversal B) SQL injection C) cross-site scripting D) buffer overflow

Answer 80

Your organization experienced a cross-site scripting (XSS) attack. An XSS attack occurs when an attacker locates a vulnerability on a website that allows the attacker to inject malicious code into a web application. A persistent XSS attack occurs when data provided to the web application is first stored persistently on the server and later displayed to users without being encoded using HTML on the web client. A non-persistent XSS attack occurs when data provided by a web client is used immediately by server-side scripts to generate results for that user. XSS flaws occur every time an application takes user-supplied data and sends it to a web browser without first confirming or encoding the data. To locate XSS attacks, you should look for lines in the web server log that contain JavaScript or other scripting languages that forward a user's session cookie to an external location or web page.

Question 81

What are signs of a buffer overflow?

Answer 81

A buffer overflow occurs when an invalid amount of input is written to the buffer area.

Question 82

What does input validation mitigates?

Answer 82

A SQL injection occurs when an attacker inputs actual database commands into the database input fields instead of the valid input. You should include input validation to prevent SQL injection attacks.

Question 83

What command does ../ entered in command line?

Answer 83

Path traversal occurs when the ../ characters are entered into the URL to traverse directories that are not supposed to be available from the web.

Question 84

What are some of the possible countermeasures to input validation attacks?

Answer 84

Some possible countermeasures to input validation attacks include the following: Filter out all known malicious requests. Validate all information coming from the client, both at the client level and at the server level. Implement a security policy that includes parameter checking in all web applications.

Question 85

What is click jacking?

Answer 85

Another application issue that you need to understand is click-jacking. Click-jacking is a technique that is used to trick users into revealing confidential information or taking over the user's computer when clicking links.

Question 86

How can you determine attack vectors?

Answer 86

Often you will need to determine the attack vector used. Reverse engineering is the best way to do this.

Question 87

What are the consideration of designing a web application?

Answer 87

When designing a web application, security should be one of the facets that you should always keep in mind. An application should be secure by design, by default, and by deployment. Secure by design means that the application is designed with security in mind. Secure by default means that the application defaults to being secure without changing application settings. Secure by deployment means that the environment into which the application is deployed is taken into consideration from a security standpoint.

Question 88

What are the exploits that will cause security issues with identity and access management?

Answer 88

You also need to understand exploits that will cause security issues with identity and access management: Impersonation – Attackers may try to impersonate a legitimate user to obtain access credentials. Identity proofing is mitigation for this type of attack. Man-in-the-middle (MITM) – This attack occurs when an attacker intercepts messages between two devices and eavesdrops on the communication. The attacker attempts to impersonate each party. Using one-time-passwords and mutual authentication are mitigations for this attack. Session hijack – This attack occurs when an attacker attempts to take over a session that is already occurring. Encryption is a mitigation for this attack. Rootkit – A rootkit is a set of software tools that allow an attacker to gain control of a device. The best mitigation is to remove all rootkits.

Question 89

What is vishing? A) an attack that looks for open ports B) a special type of phishing that targets a single power user C) a special type of phishing that appears to come from a trusted individual D) a special type of phishing that uses Voice over IP (VoIP)

Answer 89

Vishing is a special type of phishing that uses VoIP. Often these types of attacks involve receiving telephone calls that appear to come from a trusted source, such as your financial institution. The telephone call asks you to disclose confidential information that can be used to access your account. An Xmas attack is an attack that looks for open ports. Nmap is the most popular application that is used to carry out this type of attack. Spear phishing is a special type of phishing that appears to come from a trusted individual. Digital Signatures can help protect against spear phishing attacks, and improve the overall security posture, by assuring employees that an email originated from the CEO. Whaling is a special type of phishing that targets a single power user, such as a Chief Executive Officer (CEO). Whaling is used to gain confidential information about the company, and usually occurs via email.

Question 90

Which of the following is most likely the primary motivation for a threat actor who wants to gain notoriety by claiming responsibility for an event? A) Disruption and chaos B) War C) Revenge D) Service disruption

Answer 90

Some threat actors simply want to cause disruption and chaos. A threat actor might be motivated by this technique to gain notoriety by claiming responsibility for the event. Whatever the event, their goal is to upset normal operations in an attention-getting way.

Question 91

What is service disruption?

Answer 91

Service disruption is meant to damage an organization’s reputation, or cause loss of public confidence in the organization. If an airline had a disruption where you could not access their services, such as booking a flight, that person would likely do business with another airline. It may have any motivation, including revenge or financial gain. The purpose of service disruption is to harm a specific organization, while attackers who are motivated to create disruption and chaos will choose any random, vulnerable target.

Question 92

What are ethical hackers?

Answer 92

Ethical hackers want to prevent an event, not cause one and take credit for it. Ethical hackers (sometimes called white-hat hackers or penetration testers) are individuals hired by the company to test the company’s security infrastructure. Their purpose is to conduct activities to find weaknesses and “break in”. The ethical hacker will prepare a report detailing the weaknesses so that the client company can address those issues and make corrections.

Question 93

What does War have influences of cyber sec attacks?

Answer 93

Militaries and civilians can be motivated by war. Civilians and nation-states can use cyberspace to advance wartime agendas. Each may be engaged in activities that disrupt a target’s communications, services, and infrastructure, or to spread propaganda, misinformation, and fear. Nation-states want cyber-attacks that advance wartime agendas to remain secret so that the target states are unaware of their actions.

Answer 94

Espionage – Competition attacks are the modern version of industrial espionage. Theft of intellectual property, marketing plans, and customer lists are all examples that can have devastating effects on the targeted organization. Even stealing the victim company's credit card list can have a severe economic impact on that company. Often, the attacking company will find a disgruntled individual in the subject company to carry out the attack. Blackmail – Blackmail is the threat to release sensitive PII or incriminating evidence regarding an individual who has access to certain company assets, such as data, systems, or processes. The cyber-criminal threatens to expose the individual unless they take some action against a company asset on the criminal’s behalf. Data exfiltration – Data exfiltration is the act of sending sensitive or proprietary information to unauthorized recipients external to the organization. Data loss prevention is designed to detect and stop data exfiltration behavior by users. If DLP software is not present, data exfiltration might only be discovered after the event. When it occurs, the best course of action is to identify the source of the disclosure, if possible, and then take disciplinary action. Philosophical or political beliefs – Philosophical beliefs and political beliefs are used by extremist groups to recruit members to their cause. One nation might attempt to convince citizens of another nation to perform cyberterrorist activities. Hacktivists are the typical actor here. Revenge – threat actors can be motivated by revenge. Revenge and retaliation result from the perception that the threat actor has been slighted by a person or organization. The threat actor wants to “teach them a lesson” or extract revenge.

Question 95

Which of the following would most likely be the primary motivation for attacks conducted by organized crime? A) Revenge B) Financial gain C) Disruption and chaos D) Wartime agendas

Answer 95

Organized crime most commonly conducts cyber-attacks for their personal financial gain. This is exemplified by activities such as fraud, ransom attacks, and theft of credit card data. Once the threat actor has your information, they can sell it or use it for fraudulent purposes.

Question 96

An attacker carried out an IP spoofing that included saturating your network with ICMP messages. Which attack occurred? A) brute force B) on-path C) smurf D) SYN flood

Answer 96

A smurf attack is a combination of Internet Protocol (IP) spoofing and the saturation of a network with Internet Control Message Protocol (ICMP) messages. To initiate a smurf attack, a hacker sends ICMP messages from a computer outside a network with a spoofed IP address of a computer inside the network. The ICMP message is broadcast on the network, and the hosts on the network attempt to reply to the spurious ICMP message. A smurf attack causes a denial-of-service (DoS) on a network because computers are busy responding to the ICMP messages. The IP spoofing part of a smurf attack can be countered by configuring a router to ensure that messages with IP addresses inside the network originate on the private network side of the router.

Question 97

A SYN flood attack occurs when?

Answer 97

A SYN flood attack occurs when an attacker exploits the three-packet Transmission Control Protocol (TCP) handshake. A SYN flood attack is a type of denial-of-service (DoS) attack.

Question 98

You have recently been notified by an application vendor that the application includes a rootkit. The manufacturer has released a patch that will remove the vulnerability from the application. What is a rootkit? A) a software application that displays advertisements while the application is executing B) an application that uses tracking cookies to collect and report a user's activities C) a program that spreads itself through network connections D) a collection of programs that grants a hacker administrative access to a computer or network

Answer 98

A rootkit is a collection of programs that grants a hacker administrative access to a computer or network. The hacker first gains access to a single system, and then uploads the rootkit to the hacked system. An example of a rootkit is a system-level kernel module that modifies file system operations. If a server dedicated to the storage and processing of sensitive information is compromised with a rootkit and sensitive data was exfiltrated, you should wipe the storage, reinstall the OS from original media, and restore the data from the last known good backup.

Question 99

You are responsible for designing your company's identification, authentication, and authorization system to ensure that the company's network is protected from unauthorized access. What is the purpose of authentication on this network? A) backing up data stored on hard disks B) verifying the identity of users C) allowing users to access resources D) encrypting files

Answer 99

Authentication refers to the process of verifying the identity of users. Authentication technologies that you need to understand include the following: Tokens – a small device that generates time-sensitive passwords Common access cards – similar to smart cards and are used by the U.S. federal government for active-duty military personnel Smart cards – small plastic cards that contains authentication information Multifactor authentication – when multiple authentication factors are used to authenticate a user.

Question 100

Name all the authentication factors?

Answer 100

For the Security+ exam, you must understand the following authentication factors: something you are, something you have, and something you know. You also need to understand two additional authentication attributes: somewhere you are and something you do.

Question 101

Authentication: What is TOTP?

Answer 101

TOTP – A time-based one-time password is an extension of the HOTP that is modified to support a time-based moving factor. If an organization introduces token-based authentication to system administrators due to risk of password compromise, and the tokens have a set of numbers that automatically change every 30 seconds, TOTP is being used.

Question 102

Authentication: What is HOTP?

Answer 102

HOTP – An HMAC one-time password is an algorithm that is used to generate a password that is used once. HOTP stands for HMAC-based One-Time Password. It is a one-time password (OTP) algorithm based on HMAC (Hash-based Message Authentication Code). HOTP is used for generating a short-lived password that is valid for only one authentication session or transaction, enhancing security by ensuring that passwords cannot be reused or intercepted for future use.

Question 103

Authentication: What is CHAP?

Answer 103

CHAP – Challenge Handshake Authentication protocol is an authentication protocol that validates the identity of the remote user.

Question 104

Authentication: What is PAP?

Answer 104

PAP – Password Authentication protocol is an authentication protocol that uses a password.

Question 105

Authentication: What is single-Sign-On?

Answer 105

Single sign-on – an authentication technology that allows a user to log in once and be granted access to different systems configured as part of the network

Question 106

Authentication: What is Implicit deny?

Answer 106

Implicit deny – when a user inherits a deny permission based on his membership is a group or role

Question 107

What is Authorization?

Answer 107

Authorization allows users to access resources. Authorization is typically applied to a user account after a user is authenticated on a network.

Question 108

Authentication: What is a Trusted OS?

Answer 108

Trusted OS – an operating system that provides support for multilevel security

Question 109

Authorization: Least privilege?

Answer 109

Least privilege – This principle ensures that users are granted only those permissions they need to do their work

Question 110

Authorization: Separation of Duties?

Answer 110

Separation of duties – This principle ensures that tasks are divided between users to ensure that one user cannot commit fraud.

Question 111

Authorization: ACL?

Answer 111

Access Control List (ACL) – Access control lists are configured to control permissions to resources.

Question 112

Authorization: Time of day restrictions?

Answer 112

Time of day restrictions – This method configures the time(s) and day(s) that users are allowed to access resources. In some cases, this policy also allows administrators to configure the location from which the user can log in.

Question 113

What is the AAA standard in CyberSecurity?

Answer 113

Authentication, authorization, and accounting (AAA) is a term for controlling access to computer resources using authentication, enforcing policies using authorization, and auditing usage and providing the information necessary to bill for services using accounting.

Question 114

Which of these vulnerabilities is often associated with cloud computing? A) Legacy applications B) Resource reuse C) Outdated firmware D) End-of-life hardware

Answer 114

Resource reuse vulnerability is often associated with cloud computing. In cloud computing, a resource such as memory, a file or an application may be used by multiple customers. When the customer is finished with the item they are using, such as memory, the cloud provider should sanitize it by writing all zeroes to the memory. Doing so ensures that when the next customer uses the memory, that memory does not have any trace data from the previous customer. Failure to sanitize the memory during the transition from one customer to another introduces the possibility of a resource reuse vulnerability.

Question 115

Which message-based attack vector is the platform responsible for launching over 90% of all attacks? A) IM B) Typo-squatting C) SMS D) Email

Answer 115

Email is estimated to be responsible for more than 90% of all attacks. All it takes is one unsuspecting user to open the wrong attachment, or click on a bogus link, to compromise the organization. There are several varieties of email attacks, such as phishing, spear phishing, whaling, and others. Spear phishing targets a specific individual, while whaling targets a high-level person (typically C-level) in the organization. Some methods of preventing email attacks include blocking messages from senders with bad domain reputations, throttling or blocking messages from known bad IP addresses, using email authentication to ensure that senders are authorized, and bulk filtering of user mailboxes.

Question 116

What is Typo Squatting?

Answer 116

Typo-squatting, also known as URL hijacking, relies on mistakes made by users when they input web addresses. Another type of URL hijacking involves replacing the source behind a link in a search engine index and redirecting to a false URL.

Question 117

Which type of attack relies on mistakes made by users when they input Web addresses? A) malicious insider threat B) URL hijacking C) DoS D) watering hole attack

Answer 117

A URL hijacking, or typo-squatting, attack relies on mistakes made by users when they input Web addresses. Another type of URL hijacking involves replacing the source behind a link in a search engine index and redirecting to a false URL.

Question 118

What is a watering hole attack?

Answer 118

A watering hole attack occurs when an attacker profiles victims to discover the sites they visit. The attacker then accesses the most commonly accessed sites for vulnerabilities. Once a vulnerability is discovered, the attacker then compromises the site and redirects users to an alternative site that will infect the computers of users who access this alternative site. This attack may also be called a waterhole attack.

Question 119

You need to implement an independent network within your private LAN. Only users in the Research and Development department should be able to access the independent network. Which type of network should you deploy? A) an extranet B) a VLAN C) a VPN D) a DMZ

Answer 119

You should deploy a virtual local area network (VLAN). This type of network can be used to ensure that Internal access to other parts of the network is controlled and restricted. A VLAN is usually created using a switch. VLAN segregation protects each individual segment by isolating the segments. VLAN segregation is best used to prevent ARP poisoning attacks across a network. VLANs provide a layer of protection against sniffers and can decrease broadcast traffic. Creating a VLAN is much simpler than using firewalls or implementing a virtual private network (VPN). A VLAN is a good solution if you need to separate two departments into separate networks. VLAN management is implemented at the switch to configure the VLANs and the nodes that are allowed to participate in a particular VLAN. You can configure a switch to allow only traffic from computers based upon their physical (MAC) address.

Question 120

What are other zone topologies that you need to understand?

Answer 120

Intranet – a network connection within an organization that is designed for business-to-employee communication. Wireless – a network connection that allows personnel and guests to connect without using wires. Guest – a network that is set aside for guest usage that is usually isolated from the Internal network and given limited connection capabilities. Honeynet – a set of honeypots that appear to be attractive targets but are actually traps for attackers. Network address translation (NAT) – a technology that allows resources that are using private IP addresses to communicate with the Internet through the NAT device and using a single public IP address. Ad hoc – a network that consists of a group of devices communicating wirelessly without a wireless access point.

Question 121

What do you also need to understand the following segregation/segmentation/isolation topics:

Answer 121

Physical – a type of segmentation whereby different segments of the network are separated by physical devices, such as routers and firewalls. Logical (VLAN) – a type of segmentation whereby different segments of the network are virtually separated using a switch. Virtualization – a type of isolation whereby multiple guest machines reside on a single physical computer. Air gaps – an isolation technique whereby a computer is not connected to any network to prevent security issues, or an IoT device is prevented from connecting to external networks.

Question 122

Which threat actor type would most likely have the most resources available? A) Unskilled attackers B) Organized crime C) Nation states D) Hacktivist

Answer 122

Nation-state / Advanced Persistent Threat (APT) attacks would most likely have the most resources available. These attacks are conducted by one nation upon another, or upon a significant entity within the target country, with large sophisticated attacks. APTs have attackers who have very significant amounts of time and funding resources. Motives could be financial, political, disruption of the economy, or theft of intellectual property, such as military secrets. They are a highly skilled group of attackers that keep their presence hidden so that they can continually exploit their targets and launch layered attacks, known as establishing a foothold.

Question 123

What are script kiddies?

Answer 123

Unskilled attackers (sometimes referred to as script kiddies) typically rely on tools that are widely available on the Internet. They are often motivated by the thrill of the chase and by the need to prove that they can do it. For the most part, they have limited time and financial resources.

Question 124

What are some ways to detect threat attributes and the main threat actors that you should know?

Answer 124

Another way to detect a threat actor attribute is to use open-source intelligence. There are several websites and tools available to assist you. One is ThreatCrowd (www.threatcrowd.org), which allows you to examine several types of attacks. Another website is https://openphish.com, which gives you the most current information on phishing attacks. To summarize the attributes of the various threat actors that you should know for the SY0-701 exam: Internal or external – Attackers can come from within a target organization, making the threat actor Internal. Nation/states, by contrast, would be external threat actors. Level of sophistication – Script kiddies are typically the least sophisticated, whereas nation/states would be the most sophisticated. Resources and funding – Nation/states would have the most time, resources, and funding, followed by organized crime. Script kiddies would have the least resources available. Intent and motivation – The intent of a script kiddie might be to simply prove that they can do it, whereas the intent and motivation of a hacktivist could be a moral or political issue.

Question 125

Your organization has asked the security team to add terrorist attacks to the organization's business continuity plan. Which type of threat does this most likely represent? A) Internal threat B) Politically motivated threat C) Supply system threat D) Natural environmental threat

Answer 125

A terrorist attack is most likely a politically motivated threat. A terrorist attack is usually an attack against a particular country’s view from a group that opposes the philosophical or political beliefs of that country. Often, a particular group takes credit for a terrorist attack. Politically motivated threats include strikes, riots, civil disobedience, and terrorist attacks.

Question 126

What is a system threat?

Answer 126

Supply system threats include power outages, communications interruptions, and water and gas interruption.

Question 127

You must prepare a presentation that describes different security attacks against your enterprise. Match the descriptions on the left with the application attacks on the right. Buffer overflow - an attack that occurs when an application receives more data than it is programmed to accept Zero-day attack - an attack that allows code injection by hackers into the Web pages viewed by other users Session hijacking - an attack that occurs when user validation information is stolen and used to establish a connection Cross-site scripting - an attack that occurs on the day when an application vulnerability has been discovered

Answer 127

Buffer overflow – an attack that occurs when an application receives more data than it is programmed to accept Cross-site scripting (XSS) – an attack that allows code injection by hackers into the Web pages viewed by other users Session hijacking – an attack that occurs when user validation information is stolen and used to establish a connection Zero-day attack – an attack that occurs on the day when an application vulnerability has been discovered

Question 128

A man wearing a service provider’s coveralls and carrying a toolbox approaches your facility’s security guard. He says that his work crew is running some new Ethernet cable inside your office, but he left his mobile phone at home, so he can’t call his crew to let him in. The security guard admits the man through your secured door. The following week you find an undocumented network device installed in a closet. Which social engineering attack techniques were used? (Choose all that apply.) A) Pretexting B) Eliciting information C) Identity fraud D) Impersonation E) Influence campaign

Answer 128

The attacker used pretexting and impersonation to commit physical social engineering. Pretexting (when referring to social engineering) is inventing a scenario that will engage the victim and provide the attacker with an excuse to be in the area. Impersonation is pretending to be an employee, vendor, IT help desk staff, delivery driver, or other individual with some level of legitimate access. Impersonation can occur on the phone or in person. In this scenario, the guard should have asked an employee inside the building to verify that an authorized work crew was on the grounds. While this was an impersonation, it was not identity fraud. Identity fraud is stealing a specific individual’s PII or credentials to commit financial fraud, elicit information, gain access to confidential records, or penetrate a network. Impersonation is generic, while identity fraud is specific. The attacker did not elicit information. Eliciting information is tricking the victim into revealing sensitive information, like shift times and manned desk hours, through friendly conversation. An influence campaign is a multi-actor attack that uses social media accounts to post inflammatory rhetoric and unsubstantiated or fake news stories. The goal of the disinformation is to cause political, social, and economic instability in the target. Influence campaigns are usually conducted by APTs and hostile nation-states. Physical social engineering uses in-person techniques to gather confidential information or gain access. Other human vector or physical social engineering tricks are dumpster diving, shoulder surfing, tailgating / piggybacking, and reconnaissance. Remember that in the CompTIA objectives, reconnaissance can mean visiting a target to observe security controls in person, but it can also refer to digital and remote intelligence gathering techniques using OSINT and automated tools.

Question 129

A user reports that she is unable to access a file server. You discover that there are numerous open connections on the file server from several servers and routers. Which type of attack has affected the file server? A) denial-of-service (DoS) attack B) man-in-the-middle attack C) privilege escalation D) backdoor attack

Answer 129

The file server has become the victim of a denial-of-service (DoS) attack. Because multiple routers and servers are involved in the attack, a distributed DoS (DDoS) attack has actually occurred. A DDoS attack usually involves the hijacking of several computers and routers to use as agents of the attack. Multiple servers and routers involved in the attack often overwhelm the bandwidth of the attack victim. For example, if a server has intermittent connection issues, the logs show repeated connection attempts from the same IP addresses, and the attempts are overloading the server to the point it cannot respond to traffic, then the server is experiencing a DDoS attack.

Question 130

What is privilege escalation?

Answer 130

Privilege escalation usually occurs by logging in to a system using your valid user account and then finding a way to access files that you do not have permission to access. This often involves invoking a program that can change your permissions, such as Set User ID (SUID) or Set Group ID (SGID) or invoking a program that runs in an administrative context. There are several methods of dealing with privilege escalation, including using least privilege accounts, privilege separation, and so on. Privilege escalation can lead to denial-of-service (DoS) attacks. An example of privilege escalation is gaining access to a file you should not access by changing the permissions of your valid account. Privilege escalation is also a concern for users with administrative-level accounts. If a user needs administrative-level access, the user should be given two user accounts: one administrative-level account and one regular user account. The user should use the regular user account for most activities and use the administrative-level account only to perform administrative duties.

Question 131

What is backdoor access?

Answer 131

Backdoors are hidden applications that vendors create to ensure that they are able to access their devices. After installing new devices or operating systems, you need to ensure that all backdoors and default passwords are either disabled or reset. Often, hackers first attempt to use such backdoors and default passwords to access new devices.

Question 132

What is man-in-the-middle-attack?

Answer 132

A man-in-the-middle attack occurs when a hacker intercepts messages from a sender, modifies those messages, and sends them to a legitimate receiver.

Question 133

Management is worried about an evil twin. Which of the following BEST describes this entity? A) signals about the wireless network marked on the outside of a building B) an unauthorized access point C) cracking the WEP secret key using the initialization vector (IV) D) an access point with the same SSID as the legitimate access point

Answer 133

An evil twin is an access point with the same SSID as the legitimate access point. It is a special type of unauthorized access point.

Question 134

What does site surveys mitigates?

Answer 134

A rogue access point is an unauthorized access point that allows access to a secure network. Performing a site survey is the best way to discover rogue access points. Discovering a large number of unauthorized wireless connections in a particular area is a sign of a rogue access point.

Question 135

What is an IV attack?

Answer 135

An IV attack is cracking the WEP secret key using the initialization vector (IV). An IV attack involves interception of authentication traffic in an attempt to gain unauthorized access to a wireless network.

Question 136

What is interference Jamming?

Answer 136

Another consideration in wireless networks is interference or jamming. If an organization implements multiple wireless access points, the organization must ensure that the access points do not interfere with each other. This can be accomplished in one of two ways: deploy the access points on different channels within the frequency or decrease the power level of the access point. Also, some electronic devices can cause interference with access points. Often, just moving the wireless access point can fix the issue.

Question 137

Which of the following is based on impersonating an executive in an organization, with the intent of convincing an employee to do something they shouldn’t? A) Misinformation B) Business email compromise C) Brand impersonation D) Typo-squatting

Answer 137

Business email compromise is an attack that exploits the name and/or position of a high-ranking executive within the organization. The attacker will impersonate the executive in an email to the victim, typically an employee in the organization, asking them to perform tasks. One of the most common examples asks an employee to purchase dozens of gift cards.

Question 138

What is Brand Impersonation?

Answer 138

Brand impersonation, also known as brand spoofing, is a type of phishing attack. Attackers will use a legitimate company’s assets, such as logos, banners, and images, to make it appear as though the email is coming from the legitimate company. The attackers may also create a fake website that mimics the legitimate website. As an example, the attacker creates a fake website that looks like a legitimate banking website. The attacker then sends an email to users asking them to log in to their account by clicking on the link to the fraudulent website. When the user enters their login credentials, the attacker can steal their information and use it for fraudulent purposes.

Question 139

What is misinformation and disinformation?

Answer 139

Misinformation and disinformation are types of influence campaigns designed to swing public opinion in a certain direction. Misinformation is the spread of incorrect information, usually because the initial facts were incorrect or misunderstood, without the intent to deceive. Disinformation is crafting and spreading deliberately inaccurate or false information with the intent to deceive.

Question 140

Which of the following threat actor motivations is also known as a competition attack? A) Philosophical beliefs B) Revenge C) Ethical hacking D) Espionage

Answer 140

Competition attacks are the modern version of industrial espionage. Theft of intellectual property, marketing plans, and customer lists are all examples that can have devastating effects on the targeted organization. Even stealing the victim company's credit card list can have a severe economic impact on that company. Often, the attacking company will find a disgruntled individual in the subject company to carry out the attack.

Question 141

Provisioning requests for the IT department have been backlogged for months. You are concerned that employees are using unauthorized cloud services to deploy VMs and store company data. Which of the following services can be used to bring this shadow IT back under the corporate security policy? A) SLA B) SWG C) CASB D) VPN

Answer 141

A cloud access security broker (CASB) enforces proper security measures between a cloud solution and a customer organization. A CASB monitors user activities, notifies administrators about significant events, performs malware prevention and detection, and enforces compliance with security policies.

Question 142

What is SWG?

Answer 142

A secure web gateway (SWG) is a cloud-based web gateway that combines features of a Next-generation Firewall (NGFW) and a Web Application Firewall (WAF). SWG provides an ongoing update to filters and detection databases and is designed to provide filtering services between cloud-based resources and on-premises resources. SWG uses standard WAF functions, TLS decryption, CASB functions, sandboxing features, and threat detection functions to protect enterprises from the ever-evolving cloud-based risks and attacks.

Question 143

Match the attacks on the left with the mode of attack given on the right. Pharming - Social networks Spimming - Email Vishing, Smishing - Web Browser Phishing - Mobile Phone

Answer 143

Pharming – Web browser Phishing – Email Spimming – Social networks Vishing, Smishing – Mobile phone

Question 144

Which of the following is not a cryptographic attack? A) Downgrade B) Spraying C) Birthday D) Collision

Answer 144

A spraying attack is not a cryptographic attack, but rather a type of brute-force password attack. A spraying attack has a couple of different forms. It may use a common or default password for an organization and test that against multiple accounts. “P@$$w0rd” is often used as a secure password, and in a larger organization, you are likely to find an account that uses this password. Another form would be to use a variation of a company’s slogan against a user list.

Question 144

Cryptographic attack: Collision attack?

Answer 144

A collision attack is a cryptographic attack that combines brute force attacks, each with a different input, to produce the same hash value.

Question 144

Cryptographic attack: Downgrading?

Answer 144

A downgrade attack is a cryptographic attack that causes the system to use less-stringent security controls. When these less-stringent (downgraded) security controls, typically insecure protocols, are activated, the attacker takes advantage of those less-than-secure settings. An example would be an attack that disables HTTPS port 443. In order for web traffic to go through, HTTP port 80 is enabled. HTTP is less secure protocol than HTTPS, and the attacker exploits HTTP.

Question 145

Cryptographic attack: Birthday attack?

Answer 145

A birthday attack is a type of cryptographic attack. A birthday attack is named after the mathematical probability that two people in the same network have the same birthday.

Question 146

Which of the following physical attacks is exemplified by making a copy of an employee’s access badge? A) RFID cloning B) Tampering C) Brute force D) Environmental attacks

Answer 146

RFID cloning is the process of creating a copy of an RFID card or key fob that grants access to a facility. RFID cards contain a small chip that contains data about the holder of the card, such as their name, company role, and authorization to enter facilities. These cards use short-range radio waves to send this data to readers, which then use the card as a “key” to open doors. Hackers can clone these cards by using a card reader within reading distance of a card, and they can snag the data that is loaded on the chip remotely. This data can then be copied over to a blank card, and the hacker can essentially pose as a legitimate actor and use their RFID copy to go anywhere the real employee can. A practical example of RFID cloning is when a hacker gains access to a facility by cloning an employee's RFID card. The hacker can then move around the facility undetected and access sensitive areas. To prevent such attacks, businesses can leverage other forms of security hardware to fully protect their premises and maintain authorized access control. For example, a CCTV camera pointed at the card reader can detect and record any tampering by a hacker trying to install a skimmer. Likewise, cameras that have a field of vision over the approach to the front door reader can pick up on suspicious behavior, like a person with a bag trying to get within RFID-reading distance of employees and linger there.

Question 147

Management has asked you to provide mitigations against certain attack types. Match the Web site application code attack types on the left with the mitigations given on the right. Choose the mitigation that BEST applies to the attack.

Answer 147

The attacks and their mitigations should be matched in the following manner: Cross-site request forgery (CSRF) – Validate both the client and server side. Cross-site scripting (XSS) – Implement input validation. Session hijacking – Encrypt communications between the two parties. Malicious add-ons – Implement application allow lists. It is important that you understand application attacks and how to prevent them.

Question 148

Management has recently become worried about DNS poisoning after reading an article about it. Which of the following BEST describes this attack? A) the practice of dispensing IP addresses and host names with the goal of traffic diversion B) the practice of continually sending synchronization messages with spoofed packets to a DNS server C) the practice of one computer transmitting malformed packets to a DNS server to cause the server to crash D) the practice of many computers transmitting malformed packets to a DNS server to cause the server to crash

Answer 148

DNS poisoning is the practice of dispensing IP addresses and host names with the goal of traffic diversion. Properly configured DNS security (DNSSEC) on the DNS server can provide message validation, which, in turn, would prevent DNS poisoning.

Question 149

What is ARP posioning?

Answer 149

ARP poisoning is similar to DNS poisoning. In this attack, a malicious actor sends falsified ARP messages over a local area network. In a domain hijacking attack, the registration of a domain name is changed without the permission of the original registrant.

Question 150

Which cryptographic attacks attempt to produce the same hash value from a brute force attack using two inputs? (Choose two.) A) Birthday B) Replay C) Collision D) Weak Implementations

Answer 150

A collision attack or a birthday attack combines brute force attacks, each with a different input, to produce the same hash value. When two separate inputs create the same hash value, it is called a collision. A birthday attack is named after the mathematical probability that two people in the same network have the same birthday.

Question 151

What is a replay attack?

Answer 151

In a replay attack, the attacker sends the victim a previously accepted frame, such as one that includes a cryptographic key that has been sniffed by the attacker. The victim believes he is still in a valid communication, but the communication has been intercepted and exploited.

Question 152

What is the primary goal of buffer overflow attacks? A) Cross-site scripting B) Memory injection C) SQL injection D) Malicious update

Answer 152

Memory injection is the primary goal of buffer overflow attacks. Buffer overflows attempt to put more information than can fit into an allocated area of memory. With memory injection, the attacker inserts malicious code into program memory. The computer then executes that malicious code as part of the program.

Question 153

What is an SQL injection?

Answer 153

An SQL injection is an example of improper input handling, and the impact can include data destruction or unfettered access to the database. Inputs should be checked for common SQL injection symbols. Other examples of improper input handling include failure to validate the type of data in an input field, the length of the data, and proper date ranges.

Question 154

What is XSS attack?

Answer 154

A cross-site scripting (XSS) attack occurs when an attacker locates a vulnerability on a website that allows the attacker to inject malicious code into a web application. A persistent XSS attack occurs when data provided to the web application is first stored persistently on the server and later displayed to users without being encoded using HTML on the web client. A non-persistent XSS attack occurs when data provided by a web client is used immediately by server-side scripts to generate results for that user. XSS flaws occur every time an application takes user-supplied data and sends it to a web browser without first confirming or encoding the data.

Question 155

Recently there was a DoS attack on one of the servers, which succeeded in taking the server down for three hours. You would like to deploy a solution that would allow you to detect a huge rush of traffic to a specific device and route it somewhere away from the device. What technique could you use? A) Endpoint security B) System isolation C) Sinkholes D) Network segmentation

Answer 155

You could use a sinkhole. A sinkhole is a routing mechanism that can route traffic from a device being flooded to a location where the traffic can be studied.

Question 156

Your company underwent an attack that involved an attacker injecting a command to access the underlying file system. Which type of attack occurred? A) privilege escalation B) DLP C) directory traversal D) resource exhaustion

Answer 156

In a directory or path traversal attack, an attacker uses the application to access the file system below. Usually, this means figuring out where the application has access and then jumping out of that folder into other folders on the system using commands. ../

Question 157

Where is steganography typically used? A) In voice calls B) As a removable device exploitation C) In executable file-based attacks D) In an image-based attack

Answer 157

Steganography is typically used in image-based attacks, but can also be used with audio and video files. Steganography works by embedding messages or malicious code within images. The large size of these files makes it difficult to find the embedded data, unless you know exactly where to look and what to look for. This allows the attacker to transmit while “hiding in plain sight.”

Question 158

What is a file based threat vector?

Answer 158

A file-based threat vector is a type of cyberattack conducted via executable files on a computer or network. Attackers can use this method to gain unauthorized access to sensitive data, install malware, or cause other types of damage. For example, an attacker might send an email with an attachment that contains malicious code. When the user opens the attachment, the code executes and infects the computer with malware. Other examples of file-based threat vectors include downloading files from untrusted sources, using outdated software, and opening files from unknown sources. File-based threat vectors inject malicious code into what would seem to be a harmless file. Typical targets are spreadsheets and document files. One example of this type of malicious code is a macro.

Question 159

Why are USB and external Hard drives can be exploitable?

Answer 159

Removable device exploitation can occur with USB drives or external hard drives. Attackers can use this method to load malware onto systems to launch cyber-attacks, with the aim of stealing sensitive information and causing system failures. For example, an attacker might leave a USB drive in an organization’s parking lot or send it as a gift to a target. Once the user inserts the device into their computer, the malware on the device can spread to other removable media or network drives, infecting the entire system.

Question 160

Which two options are threat vectors used against vulnerable software? (Choose two.) A) Agentless B) Unsupported systems and applications C) Client-based D) Default credentials

Answer 160

Client-based attacks and agentless attacks are used against vulnerable software. Client-based attacks exploit vulnerabilities within software running on a computer or mobile device. An example could be a vulnerability within a web browser that allows an attacker to install malware on the computer. Agentless attacks use web applications and services to acquire information from a computer or mobile device. The acquisition can occur without the need of a software installation on the device.

Question 161

What is Default Credentials considered as?

Answer 161

Default credentials are a common threat vector, but it primarily targets hardware devices like routers and wireless access points. Someone will configure a device, such as a new router, and forget to change the default credentials used for setup. These credentials rarely change by brand, and a list of default credentials for many devices can be found at https://www.softwaretestinghelp.com/default-router-username-and-password-list/.

Question 162

You have discovered that data was injected into your database, thereby causing security issues. Which injection attack most likely occurred? A) XML injection B) SQL injection C) LDAP injection D) command injection

Answer 162

A SQL injection affects a database. In this type of attack, the interface is expecting a user to enter data, but the interface is not properly designed to only allow a specific data type. A malicious user can enter SQL code.

Question 163

What is command injections?

Answer 163

Command injection allows users to gain access to restricted directories. If an operating system command, such as rm -rf /etc/password, is submitted in an HTML string, a command injection (or directory traversal) attack has occurred. Command injection is also referred to as directory traversal.

Question 164

What is XML injections?

Answer 164

XML injection occurs when a user enters values in an XML query that takes advantage of security loopholes.

Question 165

What is LDAP injections?

Answer 165

LDAP injection occurs when a user enters values in an LDAP query that takes advantage of security loopholes.

Question 166

What is header manipulations?

Answer 166

Header manipulation – This attack occurs when a hacker is able to manipulate a packet header to deface, hijack, or poison the packet.

Question 167

What is Malicious add-ons?

Answer 167

Malicious add-ons – This is an application add-on that a user adds for a particular functionality, but in reality serves as a way for a hacker to create a security breach.

Question 168

Recently, an attacker tricked a user into believing he was selecting a button to direct him to a legitimate web site, but that button actually took him to another site. Which type of attack occurred? A) Clickjacking B) Driver manipulation C) Amplification D) Pass the hash

Answer 168

Clickjacking involves putting a transparent button over an existing button (or image) on a web page. When the victim clicks the button, instead of going to the website they intended, they are routed to a different site where the attacker captures personal information. Amplification attacks are often part of a DDoS attack, usually associated with UDP protocols. The goal of this attack is to turn a simple query, such as DNS or NTP, into a flood of responses that overwhelms the victim's network resources.

Question 169

What is pass the hash attacks?

Answer 169

Pass the hash attacks exploit authentication protocol weaknesses, where the password hash remains the same between sessions until the password value changes.

Question 170

What is driver manipulation attacks?

Answer 170

Driver manipulation attacks change the information provided to a device driver. This results in the driver not being used at all or performing with unexpected results.

Question 171

What is Shimming?

Answer 171

Shimming is a form of driver manipulation. An API library is created that changes the arguments (parameters) passed to the driver, bypasses the driver, or has the API deal with the driver operation.

Question 172

What is Refactoring?

Answer 172

Refactoring identifies the flow within an application's code and changes the code without changing how the code appears to function. This is often used to identify exploitation opportunities in a weak area of an application's code.

Question 173

As part of your monthly report, you must classify specific vulnerabilities into a broad range of vulnerability types. Which type of vulnerability is demonstrated by an SQL injection? A) Misconfiguration/weak configuration B) Default configuration C) Improper input handling D) Improper error handling

Answer 173

An SQL injection is an example of improper input handling, and the impact can include data destruction or unfettered access to the database. Inputs should be checked for common SQL injection symbols. Other examples of improper input handling include failure to validate the type of data in an input field, the length of the data, and proper date ranges. Improper error handling could allow an attacker to crash a program. Error checking should be built into every module or code function. An error should not result in a crashed application, but rather generate an error message. Misconfiguration or weak configuration can have a severe impact. For example, a user who (for convenience) selects weak or minimal security settings on a browser may impact the security of the entire organization. Misconfiguration, such as not changing the administrative username or password, can also have a significant impact. Systems and components, such as routers, should never be deployed with the default configuration enabled. As an example, many SOHO users are thrilled that they got their new wireless network to finally communicate "out of the box." As a result, they do not change the default administrator information, leaving their network wide open for attack.

Question 174

Which of the following transmits data via Wi-Fi or Bluetooth only to a host device and are vulnerable to data interception and attack? A) UAV B) Medical devices C) Automobiles D) Wearable technology

Answer 174

Wearable technology transmits data via Wi-Fi or Bluetooth to a host device, and as such is subject to data interception and attack. In addition to being subject to attack, wearable devices such as voice recorders, video recorders, and hidden cameras can also be used by an attacker to gain information. UAVs operate far beyond the range of Wi-Fi and Bluetooth. Unmanned Aerial Vehicles (UAVs) or drones are controlled remotely, which is an inherent security risk. Aircraft/UAVs have multiple embedded systems, ranging from navigation to fuel control and ordnance delivery. Significant security systems must be incorporated to prevent these airborne vehicles from being compromised. Medical devices transmit via wired connections, Wi-Fi, Bluetooth, or radio frequency (RF) signals established by the Wireless Medical Telemetry Service (WMTS) within the specific frequency bands allocated to medical devices. Medical devices can be manipulated to report false data, resulting in harm to the patient. They can also be manipulated to provide the wrong level of service to a patient, such as the flaw that was announced by the FDA with pacemakers whereby unauthorized users could manipulate the heartbeat rate or cause the battery to drain at a faster rate. Automobiles with embedded technology are susceptible to hackers, but they usually use satellite or cellular communication. As an example, an air pressure sensor on a tire can be manipulated to show a low-pressure alert. When the consumer fills the tire sufficiently so that the alert stops, the tire is now overinflated. This can cause the tire to explode at highway speeds. Recently, security professionals have even demonstrated hacking into an automobile and driving it.

Question 175

In security operations, which of the following would provide well-defined operational guidelines for processes such as incident response, security policy, vulnerability management, and security awareness? A) System processes B) Windows registry C) Logging levels D) System hardening

Answer 175

System processes provide well-defined operational guidelines for processes such as incident response, security policy, vulnerability management, and security awareness, to name a few. A Security Operations Center (SOC) operates 24x7 to maintain the organization’s security posture. The abovementioned system processes provide the guidelines that the SOC uses for its operations. The Windows registry is a database that contains all the application settings and current configuration parameters for the hardware and software on a Windows system. Each machine running a Windows OS has a registry that contains keys (which identify applications, processes, hardware) and values (specific configuration data related to the key). For example, if a key was related to a printer, values associated with the key could include printing orientation, print history, default paper tray, and default paper size. Logging levels are classifications that indicate the severity or urgency of the logged event. Common logging levels include Emergency, Alert, Critical, Error, Warning, Notice, and Debug. System hardening increases the security of a server or a computer system by reducing vulnerabilities and the attack surface. Examples of system hardening activities include removing unnecessary software, closing down ports, and adjusting permissions. Other important operating system (OS) concepts include the location of configuration files and hardware architecture in Windows and Linux. The Windows OS uses the registry database for storing all configuration settings. In Linux, each application and process have its own configuration file. The Linux file structure uses the /etc/ directory for configuration file locations. Hardware architecture is also an important concept. If the hardware is not secure, it would be very difficult to build secure applications and databases and to have high availability. Physical access to critical hardware, such as servers, routers, wireless access points, and network switches, is often overlooked. It is not uncommon that administrative passwords are set to the default, firmware does not get updated, and encryption is not adequate for the device.