(Udemy CASP+ (CAS-004): Practice Exam #1 - Results) Flashcards
A vulnerability scan has returned the following results:
What best describes the meaning of this output?
A. Windows Defender has a known exploit that must be resolved or patched
B. Connecting to the host using a null session allows enumeration of thee share names on the host
C. There is an unknown bug in an Apache server with no Bugtraq ID
D. There is no CVE present, so this is a false positive caused by Apache running on a Windows server
B. Connecting to the host using a null session allows enumeration of thee share names on the host
Explanation:
These results from the vulnerability scan conducted show an enumeration of open Windows shares on an Apache server. The enumeration results show three share names (print$, files, Temp) were found using a null session connection. There is no associated CVE with this vulnerability, but it is not a false positive. Not all vulnerabilities have a CVE associated with them. Nothing in this output indicates anything concerning Windows Defender, so this is not the correct answer. Bugtraq IDs are a different type of identification number issued for vulnerabilities by SecurityFocus. Generally, if there is a CVE, there will also be a Bugtraq ID. Both the CVE and Bugtraq ID being blank is not suspicious since we are dealing with a null enumeration result.
Your boss is looking for a recommendation for a cloud solution that will only allow for both onsite systems and cloud services to work together seamlessly. What type of cloud model should you recommend?
A. Public Cloud
B. Community Cloud
C. Hybrid Cloud
D. Private Cloud
C. Hybrid Cloud
Explanation:
A hybrid cloud model allows for the seamless integration of both onsite and cloud services to the end-user simultaneously. Hybrid clouds can be cost-efficient, flexible, easy to migrate to a complete cloud solution in the future, and require less maintenance than completely onsite options. As with all cloud options, the contents must be properly secured due to the elastic storage nature of all cloud solutions and the possibility of data remnants. A public cloud contains services offered by third-party providers over the public Internet and is available to anyone who wants to use or purchase them. They may be free or sold on-demand, allowing customers to pay only per usage for the CPU cycles, storage, or bandwidth they consume. A private cloud contains services offered either over the Internet or a private internal network and only to select users instead of the general public. A community cloud is a collaborative effort in which infrastructure is shared between several organizations from a specific community with common concerns (security, compliance, jurisdiction, etc.), whether managed internally or by a third party and hosted internally or externally.
A new alert has been distributed throughout the information security community regarding a critical Apache vulnerability. What action could you take to ONLY identify the known vulnerability?
A. Perform an unauthenticated vulnerability scan on all servers in the environment
B. Perform a web vulnerability scan on all servers in the environment
C. Perform an authenticated scan on all web servers in the environment
D. Perform a scan for the specific vulnerability on all web servers
D. Perform a scan for the specific vulnerability on all web servers
Explanation:
Since you wish to check for only the known vulnerability, you should scan for that specific vulnerability on all web servers. All web servers are chosen because Apache is a web server application. While performing an authenticated scan of all web servers or performing a web vulnerability scan of all servers would also find these vulnerabilities, it is a much larger scope. It would waste time and processing power by conducting these scans instead of properly scoping the scans based on your needs. Performing unauthenticated vulnerability scans on all servers is also too large in scope (all servers) while also being less effective (unauthenticated scan).
You have been asked to recommend a capability to monitor all of the traffic entering and leaving the corporate network’s default gateway. Additionally, the company’s CIO requests to block certain content types before it leaves the network based on operational priorities. Which of the following solution should you recommend to meet these requirements?
A. Install a firewall on the routers internal interface and a NIDS on the routers external interface
B. Configure IP filtering on the internal and exteranl interfaces of the router
C. Install a NIPS on the internal interface and a firewall on the external interface of the router
D. Installation of a NIPS on both the internal and exteranl interfaces of the router
C. Install a NIPS on the internal interface and a firewall on the external interface of the router
Explanation:
Due to the requirements provided, you should install a NIPS on the gateway router’s internal interface and a firewall on the external interface of the gateway router. The firewall on the external interface will allow the bulk of the malicious inbound traffic to be filtered before reaching the network. Then, the NIPS can be used to inspect the traffic entering the network and provide protection for the network using signature-based or behavior-based analysis. A NIPS is less powerful than a firewall and could easily “fail open” if it is overcome with traffic by being placed on the external interface. The NIPS installed on the internal interface would also allow various content types to be quickly blocked using custom signatures developed by the security team. We wouldn’t want to place the NIPS on the external interface in the correct choice for the same reasons. We also wouldn’t choose to install a NIPS on both the internal and external connections. IP filtering on both interfaces of the router will not provide the ability to monitor the traffic or to block traffic based on content type. Finally, we would not want to rely on a NIDS on the external interface alone since it can only monitor and not provide the content blocking capabilities needed.
Which of the following security policies could help detect fraudulent cases that occur even when other security controls are already in place?
A. Mandatory vacations
B. Separation of duties
C. Least privilege
D. Dual control
A. Mandatory vacations
Explanation:
Mandatory vacation policies require employees to take time away from their job and help to detect fraud or malicious activities. Even if other controls such as separation of duties, least privilege, and dual control are used, an employee could collude with others to conduct fraud. By utilizing mandatory vacation policies, this fraud can often be discovered since a new person will be conducting the duties assigned to the person on vacation. Separation of duties is the concept of having more than one person required to complete a particular task to prevent fraud and error. Dual control, instead, requires both people to act together. For example, a nuclear missile system uses dual control and requires two people to each turn a different key simultaneously to allow for a missile launch to occur. Least privilege is the concept and practice of restricting access rights for users, accounts, and computing processes to only those resources required to perform routine, legitimate activities.
What type of cloud service would allow you to provide a cloud-based application to your employees using their smartphones?
A. IaaS
B. SaaS
C. DaaS
D. PaaS
B. SaaS
Explanation:
Software as a service (SaaS) allows users to connect to and use cloud-based apps over the Internet. Common examples are email, calendaring, and office tools. SaaS provides a complete software solution that you purchase on a pay-as-you-go basis from a cloud service provider. You rent the use of an app for your organization, and your users connect to it over the Internet, usually with a web browser. All of the underlying infrastructure, middleware, app software, and app data are located in the service provider’s data center. The service provider manages the hardware and software, and with the appropriate service agreement, it will ensure the availability and the security of the app and your data. SaaS allows your organization to get quickly up and running with an app at minimal upfront cost. Platform as a Service (PaaS) is a cloud computing service that enables consumers to rent fully configured systems that are set up for specific purposes. Infrastructure as a Service (IaaS) is a cloud computing service that enables a consumer to outsource computing equipment purchases and running their own data center. Desktop as a Service (DaaS) provides a full virtualized desktop environment from within a cloud-based service. This is also known as VDI (Virtualized Desktop Infrastructure) and is coming in large enterprise businesses focused on increasing their security and minimizing their operational expenses.
Dion Training is using a cloud service provider under an Infrastructure as a Service (IaaS) model. Assuming there is a shared responsibility model between the two organizations, which of the following is MOST likely the security responsibility of the cloud service provider under this IaaS model?
A. User identity management
B. Security of isolation between tenants
CV. Protection of operating systems
D. Use and configuration of encryption
B. Security of isolation between tenants
Explanation:
The shared responsibility model identifies that responsibility for the implementation of security as applications, data, and workloads are transitioned into a cloud platform and shared between the customer and the cloud service provider (CSP). Using an Infrastructure as a Service (IaaS) model provides hardware hosted at a provider facility using the provider’s physical security controls and utilities. Identifying the boundary between customer and cloud provider responsibilities, in terms of security, is imperative for reducing the risk of introducing vulnerabilities into your environment. In this scenario, since an IaaS model was chosen, the cloud service provider will be responsible for the security of cloud infrastructure resource isolation between tenants. Dion Training, on the other hand, will be responsible for user identity management, protection of the operating systems, and the use and configuration of encryption, including the protection of the encryption keys.
While conducting a penetration test against an organization, you gained access to the CEO’s account. You log in as the CEO and send the following email:
Which of the following attacks are you utilizing in this scenario?
A. BEC Attack
B. Whaling attack
C. Deauthentication attack
D. Smishing attack
A. BEC Attack
Explanation:
A business email compromise (BEC) is a form of elicitation where the attacker impersonates a high-level executive or directly takes over their email account. The attacker then sends an email to elicit personnel to take action on their behalf. In this example, the attacker is impersonating the company’s CEO by sending an email to the financial personnel requesting they send a money transfer for what appears to be a legitimate service. This example also uses the urgency and authority motivation factors to convince the employee to take action.
A technician is testing a new web-based tool capable of generating an automatic teller machine (ATM) cash and service availability reports. A consortium of financial institutions developed the web-based tool. Which of the following cloud delivery models is being described in this scenario?
A. Public
B. Hybrid
C. Private
D. Community
D. Community
Explanation:
A community cloud is a collaborative effort in which infrastructure is shared between several organizations from a specific community with common concerns (security, compliance, jurisdiction, etc.), whether managed internally or by a third party and hosted internally or externally. The scenario described is a community cloud-created tool by the banking industry. A public cloud contains services offered by third-party providers over the public Internet and is available to anyone who wants to use or purchase them. They may be free or sold on-demand, allowing customers to pay only per usage for the CPU cycles, storage, or bandwidth they consume. A private cloud contains services offered either over the Internet or a private internal network and only to select users instead of the general public. A hybrid cloud uses a mix of on-premises, private cloud, and third-party, public cloud services with orchestration between these platforms. This typically involves a connection from an on-premises data center to a public cloud.
Which of the following should a domain administrator utilize to BEST protect their endpoints from buffer overflow attacks?
A. Ensure ASLR is enabled on the endpoint
B. Install an anti-malware tool on the endpoint
C. Conduct input validation on all web input forms
D. Conduct bound checking before executing a program
A. Ensure ASLR is enabled on the endpoint
Explanation:
Address Space Layout Randomization (ASLR) is a feature that randomly arranges the address space of the memory so that attacker cannot place their code into predetermined spots. Essentially, ASLR is used as a mechanism to provide buffer overflow prevention by making it difficult to guess the location of executable files stored in the random access memory. ASLR must be supported by the underlying operating system for it to work. Every version of Windows since Windows 7 supports ASLR, as does every version of Macintosh OS X since 2007. At this point, ASLR is considered commonplace in Windows, Macintosh, iOS, Android, and BSD operating systems.
An electronics store was recently the victim of a robbery where an employee was injured, and some property was stolen. The store’s IT department hired an external supplier to expand its network to include a physical access control system. The system has video surveillance, intruder alarms, and remotely monitored locks using an appliance-based system. Which of the following long-term cybersecurity risks might occur based on these actions?
A. There are no new risks due to the install and the company has a strong physical security posute
B. These devices should be isolated from the rest of the enterprise network
C. These devices are insecure and should be isolated from the internet
D. These devices should be scanned for viruses before installation
B. These devices should be isolated from the rest of the enterprise network
Explanation:
While the physical security posture of the company has been improved by adding the cameras, alarms, and locks, this appliance-based system may pose additional risks to the store’s network. Specialized technology and appliance-based systems rarely receive security updates at the same rate as regular servers or endpoints. These devices need to be on a network to ensure that their network functions can continue, but they don’t necessarily need to be on the enterprise production network. A good option would be to set up a parallel network that is physically or logically isolated from the enterprise network and install the video cameras, alarms, and lock on that one. These devices cannot be isolated from the internet without compromising their functions, such as allowing remote monitoring of the system and locks. The devices should be scanned for viruses before installation, but that is a short-term consideration and doesn’t protect them long-term.
You are conducting a routine vulnerability scan of a server when you find a vulnerability. You locate a patch for the vulnerability on the software vendor’s website. What should you do next?
A. Establish continuous monitoring
B. Submit a request for change using the change management process
C. Download and install the patch immediately
D. Start the incident response process
B. Submit a request for change using the change management process
Explanation:
OBJ-2.3: Before any change to a baseline occurs, a Request for Change should be submitted. This submission will start the change management process within your organization. Once approved, the patch should be tested in a staging environment, installed on the production server, and then the server should be rescanned to ensure the vulnerability no longer exists. In this scenario, no incident response is being performed since this vulnerability is found during a routine vulnerability scan.
Which of the following identity and access management controls relies upon using a certificate-based authentication mechanism?
A. Smart card
B. HOTP
C. Proximity Card
D. TOTP
A. Smart card
Explanation:
Smart cards, PIV, and CAC devices are used as an identity and access management control. These devices contain a digital certy embedded within the smart card. (PIV/CAC) presented to the system when it is inserted into the smart card reader. When combined with a PIN, the smart card can be used as a multi-factor authentication mechanism. The PIN unlocks the card and allows the digital certificate to be presented to the system.
Which of the following authentication methods is an open-source solution for single sign-on across organizational boundaries on the web?
A. TACAS+
B. Kerberos
C. RADIUS
D. Shibboleth
D. Shibboleth
Explanation:
OBJ-1.5: Shibboleth is a standards-based, open-source software package for single sign-on across or within organizational boundaries on the web. It allows sites to make informed authorization decisions for individual access to protected online resources in a privacy-preserving manner. Shibboleth utilizes SAML to provide this federated single sign-on and attribute exchange framework.
Dion Training is setting up a new website called YourCyberPath.com. Dion Training wants to install the same digital certificate on YourCyberPath.com and DionTraining.com. Which of the following digital certificate types should they utilize to meet this requirement?
A. Wildcard
B. General purpose
C. Extended validation
D. Multidomain
D. Multidomain
Explanation:
OBJ-3.5: A multidomain certificate is a single SSL/TLS digital certificate that can be used to secure multiple, different domain names. For example, if you want to install the same certificate on diontraining.com and yourcyberpath.com, you will need to register a multidomain certificate. A wildcard certificate contains the wildcard character (*) in its domain name field and allows the digital certificate to be used for any number of subdomains. For example, the wildcard certificate of *.diontraining.com can be used for members.diontraining.com, cart.diontraining.com, and support.diontraining.com. General Purpose or Domain Validation (DV) digital certificates prove the ownership of a particular domain by responding to an email to the authorized domain contact or by publishing a text record to the domain’s DNS records. Extended Validation (EV) digital certificates are subject to a process that requires more rigorous checks on the subject’s legal identity and control over the domain or software being signed. A major drawback to EV certificates is that they cannot be issued for a wildcard domain.
Dion Consulting Group is helping an organization build a new Security Operations Center. The organization wants to create a centralized repository that contains logs from all the network devices, servers, and endpoints so cybersecurity analysts can search the repository and conduct threat hunting. Which of the following types of sensors or systems should you implement to centralize the logging and event data from across the enterprise network into one place?
A. Host based intrusion detection (HIDS)
B. File integrity monitoring (FIM)
C. Security and information event management (SIEM)
D. Data Loss Prevention (DLP)
C. Security and information event management (SIEM)
Explanation:
OBJ-1.1: While all of these options can provide logging information, only a SIEM works to consolidate various sources of logs and event information into a single repository. Security information and event management system (SIEM) is a solution that provides real-time or near-real-time analysis of security alerts generated by network hardware and applications. File integrity monitoring (FIM) is a type of software that reviews system files to ensure that they have not been tampered with. Host-based intrusion detection systems (HIDS) provide threat detection by monitoring an operating system’s logs, processes, services, files, systems, and the Windows Registry where applicable. Data Loss Prevention (DLP) is a software solution designed to detect and prevent sensitive information from being used, transmitted, or stored inappropriately.
A penetration tester issued the following command on a victimized Windows system:
Based on this command, which of the following exploits is the penetration tester MOST likely trying to conduct?
A. Download and execute a remote script
B. Exploiting unquoted service paths
C. Scheduling a task for persistencee
D. Conduct DLL hijacking
A. Download and execute a remote script
Explanation:
This command executes the PowerShell environment without loading the PowerShell profile (-nop) and in a hidden window (-w hidden). The command powershell.exe is running is shown after the -c, which stands for executing a command or script block and then exiting. This command in PowerShell to Invoke-Expression (IEX) creates a new web client object and then downloads the file located at the URL provided. This file could be malicious, and if it is another PowerShell script, it will be executed once downloaded.
Which party in a federation provides services to members of the federation?
A. SSO
B. RP
C. SAML
D. IdP
B. RP
Explanation:
Relying parties (RPs) provide services to members of a federation. An identity provider (IdP) provides identities, makes assertions about those identities, and releases information about the identity holders. The Security Assertion Markup Language (SAML) is an open standard for exchanging authentication and authorization data between parties between an identity provider and a service provider (SP) or a relying party (RP). Single sign-on (SSO) is an authentication scheme that allows a user to log in with a single ID and password to any of several related yet independent software systems across a federation. SAML and SSO are not parties. Therefore, they cannot possibly be the right answer to this question.
Which of the following cipher suites does not support the more secure ephemeral key agreement mode?
A. TLS_RSA_WITH_AES_256_CBC_SHA256
B. TLS_AES_256_GCM_SHA384
C. TLS_CHACHA20_POLY1305_SHA256
D. ECDHE_RSA_AES128_GCM_SHA256
A. TLS_RSA_WITH_AES_256_CBC_SHA256
Explanation:
The reason is that the TLS_RSA_WITH_AES_256_CBC_SHA256 cipher suite uses the RSA key exchange method, which is not ephemeral. In RSA key exchange, the server’s public key is used to encrypt the pre-master secret, and this pre-master secret is then used to generate the session keys. The problem with this method is that if the server’s private key is compromised, all past sessions that used this key exchange method could be decrypted.
On the other hand, the other cipher suites listed support more secure ephemeral key agreement modes:
ECDHE_RSA_AES128_GCM_SHA256: This uses the Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) key exchange, providing forward secrecy. This means that even if the server’s private key is compromised in the future, previously recorded sessions cannot be decrypted.
TLS_AES_256_GCM_SHA384: This cipher suite uses AES-256 in Galois/Counter Mode (GCM) for encryption and SHA-384 for message authentication. It does not specify the key exchange method explicitly but should be used with ephemeral key exchange for better security.
TLS_CHACHA20_POLY1305_SHA256: This cipher suite uses the ChaCha20-Poly1305 encryption algorithm along with SHA-256 for message authentication. Like TLS_AES_256_GCM_SHA384, it doesn’t specify the key exchange method explicitly but should be used with an ephemeral key exchange for better security.
In summary, TLS_RSA_WITH_AES_256_CBC_SHA256 is the only option that does not support the more secure ephemeral key agreement mode.
IMG_8175
Keith wants to validate the application file that he downloaded from the vendor of the application. Which of the following should he compare against the file to verify the integrity of the downloaded application?
A. Private key of the file
B. Public key of the file
C. File size and file creation date
D. MD5 or SHA1 hash digest of the file
D. MD5 or SHA1 hash digest of the file
Explanation:
Keith should conduct a hash of the downloaded file and compare it against the MD5 hash digest listed on the server of this file. This file needs to be a verifiable MD5 hash file to validate the file integrity has not been compromised during the download. This is an important step to ensure the file was not modified in transit during the download. The other options are insufficient to guarantee the integrity of the downloaded file since integrity checking relies on comparing hash digests. A public or private key would not be assigned solely to a single file, nor do they provide integrity on their own. Public and private keys are used to ensure data confidentiality, whereas a hash digest ensures integrity. The file size and file creation date are additional forms of metadata that could help validate a file’s integrity. Still, they are of a much lower quality and trust factor than using a hash digest. Therefore MD5 or SHA1 is a better choice.
Dion Training provides its team members with a mobile device so that they can respond to questions when they are out of the office. To minimize the risk of a data leak, the organization has decided to purchase each employee a new iPhone, configure it using a mobile device management (MDM) solution, and use a containerized app to process and store all corporate data on the device. Each employee signs an AUP that states they can use the device for work-related and personal use, but the device and any data stored on it remain the property of Dion Training. Which of the following policies BEST describes Dion Training’s mobile device deployment model?
A. COBO
B. CYOD
C. COPE
D. BYOD
C. COPE
Explanation:
Corporate Owned Personally Enabled (COPE) is a mobile device deployment model where the device remains the property of the organization, but certain personal use, such as private email, social networking, and web browsing, is also permitted. Corporate Owned Business Only (COBO) is a mobile device deployment model that provides the employee with a corporate-owned device that may only be used for official work functions and purposes. Choose Your Own Device (CYOD) is a mobile device deployment model where employees are offered a selection of corporate devices for work and, optionally, private use. Bring Your Own Device (BYOD) is a mobile device deployment model that facilitates the use of personally owned devices to access corporate networks and data.
Ryan needs to verify the installation of a critical Windows patch on his organization’s workstations. Which method would be the most efficient to validate the current patch status for all of the organization’s Windows 10 workstations?
A. Create and run a PowerShell script to search for the specific patch in question
B. Use an endpoint manager to validate patch status for each machine on the domain
C. Conduct a registry scan of each workstationn to validate the patch was installed
D. Check the Update History manually
B. Use an endpoint manager to validate patch status for each machine on the domain
Explanation:
OBJ-3.2: The Microsoft Endpoint Configuration Manager (MECM) provides remote control, patch management, software distribution, operating system deployment, network access protection, and hardware and software inventory. In an Azure environment, you can also use the Update Compliance tool to monitor your device’s Windows updates, Windows Defender anti-virus status, and the up-to-date patching status across all of your Windows 10 workstations. In previous Windows versions, you could use the Microsoft Baseline Analyzer (MSBA), but that is no longer supported when Windows 10 was introduced. A PowerShell script may be a reasonable option, but it would take a knowledgeable analyst to create the script and scan the network, whereas using SCCM is easier and quicker. Manually checking the Update History or registry of each system could also work, but that is very time-consuming and inefficient, especially if Ryan is supporting a large network.
Fail to Pass Systems has recently moved its corporate offices from France to Westeros, a country with no meaningful privacy regulations. The marketing department believes that this move will allow the company to resell all of its customer’s data to third-party companies and shield the company from any legal responsibility. Which policy is violated by this scenario?
A. Data sovereignty
B. Data enrichment
C. Data limitation
D. Data minimization
A. Data sovereignty
Explanation:
While the fictitious Westeros may have no privacy laws or regulations, the laws of the countries where the company’s customers reside may still retain sovereignty over the data obtained from those regions during the company’s business there. This is called Data Sovereignty. Data sovereignty refers to a jurisdiction (such as France or the European Union) preventing or restricting processing and storage from taking place on systems that do not physically reside within that jurisdiction. Data sovereignty may demand certain concessions on your part, such as using location-specific storage facilities in a cloud service. Fail to Pass Systems will likely face steep fines from different regions if they go through with their plan to sell all of their customers’ data to the highest bidders. Fail to Pass Systems may even be blocked from communicating with individual regions. Although Data minimization and data limitation policies may be violated depending on the company’s internal policies, these policies are not legally binding like the provisions of GDPR are. Data enrichment means that the machine analytics behind the view of a particular alert can deliver more correlating and contextual information with a higher degree of confidence, both from within the local network’s data points and from external threat intelligence.
Dion Training Solutions is currently calculating the risk associated with building a new data center in a hurricane-prone location. The data center would cost $3,125,000 to build and equip. Based on their assessment of the history of the location, a major hurricane occurs every 20 years and their data center would risk losing 60% of its value due to downtime and possible structural damages. If the data center is built in this location, what is the annual rate of occurrence for this data center?
A. 0.03
B. 0.60
C. 0.05
D. 0.20
C. 0.05
Explanation:
OBJ-4.1: The annual rate of occurrence is 0.05 since one incident occurs every 20 years (1/20 is 0.05). The annual rate of occurrence (ARO) is the number of times in a year that a single event occurs. If the number of times an event occurs is counted over multiple years, then the number is divided by the number of years to calculate the ARO. If the number of times is counted monthly, then it is multiplied by 12 to annualize it. For example, if the number of occurrences was 3 times per month, then the ARO would be 36 times per year (3 occurrences x 12 months in a year).
A company-wide audit revealed employees are using company laptops and desktops for personal use. To prevent this from occurring, in which document should the company incorporate the phrase “Company-owned IT assets are to be used to perform authorized company business only”?
A. AUP
B. MOU
C. SLA
D. NOA
A. AUP
Explanation:
OBJ-4.1: Acceptable Use Policy dictates what types of actions an employee can or cannot do with company-issued IT equipment. An acceptable use policy (AUP) is a set of rules applied by the owner, creator, or administrator of a network, website, or service, that restrict how the network, website, or system may be used and sets guidelines as to how it should be used. A memorandum of understanding (MOU) is important because it defines the responsibilities of each party in an agreement, provides the scope and authority of the agreement, clarifies terms, and outlines compliance issues. A non-disclosure agreement (NDA) is a legal contract or part of a contract between at least two parties that outlines confidential material, knowledge, or information that the parties wish to share for certain purposes, but wish to restrict access to. A service level agreement (SLA) is a commitment between a service provider and a client for particular aspects of the service, such as quality, availability, or responsibilities.
An organization wants to improve its ability to detect the infiltration of servers in a DMZ or screened subnet. The network’s IPS/IDS solutions are currently located on edge between DMZ and Untrust, and DMZ and Trust. Which of the following could increase visibility inside the DMZ or screened subnet?
A. Honeypot
B. NAC server
C. VPN headend
D. Layer 7 firewall
D. Layer 7 firewall
Explanation:
OBJ-1.1: Layer 7 firewalls operate at the application layer. These devices allow you to implement security at a more granular level. A layer 7 firewall can be configured to log all of the details for data entering and leaving the DMZ or screened subnet. A network access control (NAC) server is used to unify your endpoint security technology and user/system authentication. A NAC server is used for authentication, and would not provide additional visibility into the DMZ or screened subnet. A honeypot is a computer security mechanism set to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information systems. A honeypot will detect attacks against itself, but not the other servers in the DMZ or screened subnet. A VPN headend establishes multiple encrypted VPN tunnels at the same time and provides a secure and encrypted connection between different VPN nodes. A VPN headend would not provide any additional visibility into the DMZ or screened subnet.
Which of the following does a User-Agent request a resource from when conducting a SAML transaction?
A. Identity provider
B. Single sign on
C. Relying party
D. Service provider
D. Service provider
Explanation:
OBJ-1.5: Security assertions markup language (SAML) is an XML-based framework for exchanging security-related information such as user authentication, entitlement, and attributes. SAML is often used in conjunction with SOAP. SAML is a solution for providing single sign-on (SSO) and federated identity management. It allows a service provider (SP) to establish a trust relationship with an identity provider (IdP) so that the SP can trust the identity of a user (the principal) without the user having to authenticate directly with the SP. The principal’s User Agent (typically a browser) requests a resource from the service provider (SP). The resource host can also be referred to as the relying party (RP). If the user agent does not already have a valid session, the SP redirects the user agent to the identity provider (IdP). The IdP requests the principal’s credentials if not already signed in and, if correct, provides a SAML response containing one or more assertions. The SP verifies the signature(s) and (if accepted) establishes a session and provides access to the resource.
During your review of the firewall logs, you notice that an IP address from within your company’s server subnet had been transmitting between 125 to 375 megabytes of data to a foreign IP address overnight each day. You have determined this has been occurring for approximately 5 days, and the affected server has since been taken offline for forensic review. Which of the following is MOST likely to increase the impact assessment of the incident?
A. Forensic review of the server required fallback to a less efficient service
B. IP Addresses and other network related configurations were exfiltrated
C. PII of company employees and customers was exfiltrated
D. Raw financial information about the company was accessed
C. PII of company employees and customers was exfiltrated
Explanation:
OBJ-2.7: If the PII (Personally Identifiable Information) of the company’s employees or customers were exfiltrated or stolen during the compromise, this would increase the incident’s impact assessment. Loss of PII is a big issue for corporations and one that might garner media attention. While all of the options presented here are bad things that could increase the impact of the assessment, loss of PII is considered the MOST likely to increase the impact dramatically. Depending on the company’s size or organization, there may also be mandatory reporting requirements, fines, or restitution that must be paid.
Your company is adopting a new BYOD policy for tablets and smartphones. Which of the following would allow the company to secure the sensitive information on personally owned devices and the ability to remote wipe corporate information without the user’s affecting personal data?
A. Touch ID
B. Face ID
C. Long and complex passwords
D. Contanerization
D. Contanerization
Explanation:
OBJ-3.1: Containerization is the logical isolation of enterprise data from personal data while co-existing in the same device. The major benefit of containerization is that administrators can only control work profiles that are kept separate from the user’s personal accounts, apps, and data. This technology creates a secure vault for your corporate information. Highly targeted remote wiping is supported with most container-based solutions.
You are in the recovery steps of an incident response. Throughout the incident, your team never successfully determined the root cause of the network compromise. Which of the following options would you LEAST likely perform as part of your recovery and remediation actions?
A. Restrict host access to peripheral protocols like USB or Bluetooth
B. Disable unused user accounts
C. Review and enhance patch management policies
D. Proactively sanitizie and reimage all of your routers and switchers
D. Proactively sanitizie and reimage all of your routers and switchers
Explanation:
OBJ-3.2: Since your team could not determine the root cause of the compromise, you would most likely conduct system and network hardening actions as part of the recovery and remediation. The only option that is not considered a hardening action is proactively sanitizing and reimaging your routers and switches. If you performed this action, you could have unwanted disruptive effects on the company. Instead, it would be more beneficial to increase monitoring of the devices to ensure they are not compromised. Proactively sanitizing and reimaging all of the routers and switches would be a large undertaking. Without evidence suggesting that such an approach is warranted, you would be wasting a lot of time and money. The other options presented are the best security practices to prevent future compromises. Reimaging the network devices without knowing the root cause will likely be ineffective in securing the network.
An ethical hacker has been hired to conduct a physical penetration test of a company. During the first day of the test, the ethical hacker dresses up like a plumber and waits in the building’s main lobby until an employee goes through the main turnstile. As soon as the employee enters his access number and proceeds to go through the turnstile, the ethical hacker follows them through the access gate. What type of attack did the ethical hacker utilize to access the restricted area of the building?
A. Tailgating
B. Shoulder surfing
C. Social engineering
D. Spoofing
A. Tailgating
Explanation:
OBJ-2.6: Based on the description, the ethical hacker conducted a very specialized type of social engineering attack known as tailgating. Sometimes on a certification exam, there are two correct answers, but one is more correct. This question is an example of that concept. Tailgating involves someone who lacks the proper authentication following an employee into a restricted area. Social engineering uses deception to manipulate individuals into divulging confidential or personal information that may be used for fraudulent purposes. Shoulder surfing is a type of social engineering technique used to obtain personal identification numbers (PINs), passwords, and other confidential data by looking over the victim’s shoulder. Spoofing is the act of disguising a communication from an unknown source as being from a known, trusted source.
What tool is used to collect wireless packet data?
A. Nessus
B. John the Ripper
C. Netcat
D. Aircrack-ng
D. Aircrack-ng
Explanation:
OBJ-2.9: Aircrack-ng is a complete suite of wireless security assessment and exploitation tools that includes monitoring, attacking, testing, and cracking of wireless networks. This includes packet capture and export of the data collected as a text file or pcap file. John the Ripper is a password cracking software tool. Nessus is a vulnerability scanner. Netcat is used to create a reverse shell from a victimized machine back to an attacker.
Jonathan is trying to open an encrypted and digitally-signed email he sent 3 years ago. Last month, he was issued a new public/private key pair since his old key pair had expired. When attempting to open some encrypted and digitally-signed emails he sent last week, he can read them without any issues. Which of the following errors is causing Jonathan’s issues with reading the email from 3 years ago?
A. Mismtached key error
B. Incorrect name error
C. Rekeying error
D. Compromised key pair
A. Mismtached key error
Explanation:
OBJ-3.7: The reason Jonathan can no longer read those encrypted emails is that his previous public/private key pair has expired and is no longer valid for use. His email client is trying to decrypt those emails using his new public/private key pair causing a mismatched key error. A mismatched key error occurs is the wrong public/private key pair is used to decrypt data. The most common forms of this error are displayed as “key mismatch” or “X509_check_private_key”. Rekeying is the process of changing an individual key during a communication session. Most communication protocols use session key rekeying to protect the data being transmitted. A rekeying is normally triggered based on the volume of data communicated or the amount of time since the last rekeying. A compromised or exposed key occurs when unauthorized access to a symmetric or private key is gained. When a key is compromised or exposed, it must be revoked and replaced. An incorrect name error is generated when the certificate’s CN name does not match the FQDN of the system that is using the certificate. For example, if the certificate is issued to diontraining.com but is being presented for www.diontraining.com or yourcyberpath.com, it will generate an incorrect name error.
You are configuring the ACL for the network perimeter firewall. You have just finished adding all the proper allow and deny rules. What should you place at the end of your ACL rules?
A. An implicit deny statement
B. A time of day restriction
C. An implicit allow statement
D. A SNMP deny string
A. An implicit deny statement
Explanation:
According to the best practices of firewall configurations, you should include an implicit deny at the end of your ACL rules. This will ensure that anything not specifically allowed in the rules above is blocked. Using an implicit allow is a bad security practice since it will allow anything into the network that is not specifically denied. While the time of day restrictions can be useful, they are not required for all network implementations.
Dion Training currently estimating the next fiscal year’s cybersecurity incident response budget. Jason has calculated an asset value of $75,000 for the server clusters that run the company’s practice exams for students. Based on his analysis, he believes that a one-hour denial of service attack on this server will occur twice every three years and has a risk exposure factor is 90% during the attack. What is the single loss expectancy (SLE) when a DDoS attack occurs against the practice exam server cluster?
A. $67,500
B. $75,000
C. $50,000
D. $45,000
A. $67,500
Epxplanation:
The single loss expectancy (SLE) is the amount that would be lost in a single occurrence of a particular risk factor. To calculate the single loss expectancy (SLE), you will multiple the asset value (AV) times the exposure factor (EF). Since you are asked to calculate the single loss expectancy, you do not need to calculate the annual rate of occurrence (2/3 or 66%) nor the annualized loss expectancy ($45,000). SLE = AV x EF = $75,000 x 0.90 = $67,500
Following an incident, the incident response team has generated many recommendations for additional controls and items to be purchased to prevent future recurrences. Which of the following approaches best describes what the organization should do next?
A. Contract an outsidee security consultasnt to provide an independent assessment of the network and outsource the remediation efforts
B. Conduct a cost/beneefit analysis of each recommendation against the companys current fiscal posture
C. Submit a prioritized list with all of the recommendations for review, procurement and installation
D. Immediately procure and install all of them because the adversary may reattack at any time
C. Submit a prioritized list with all of the recommendations for review, procurement and installation
Explanation:
Since an incident has just occurred, it is important to act swiftly to prevent a reoccurrence. The organization should still take a defined and deliberate approach to choosing the proper controls and risk mitigations. Therefore, execution through a rational business management process is the best approach, including creating a prioritized list of recommendations. Once this list has been created, the organization can conduct a cost/benefit analysis of each recommendation and determine which controls and items will be implemented in the network based upon resource availability in terms of time, person-hours, and money. This process does not need to be a long-term study or filled with complexity. Instead, it should be rapidly conducted due to the probability that an attacker may compromise the network again.
