Udemy CASP Practice Exam 2

Question 1

Dion Training wants to get an external attacker’s perspective on its security status. Which of the following services should they purchase?

A. Patch management
B. Vulnerability Scan
C. Penetrationn test
D. Asset management

Answer 1

C. Penetrationn test

Explanation:
OBJ-2.4: Penetration tests provide an organization with an external attacker’s perspective on their security status. The NIST process for penetration testing divides tests into four phases: planning, discovery, attack, and reporting. The penetration test results are valuable security planning tools, as they describe the actual vulnerabilities that an attacker might exploit to gain access to a network. A vulnerability scan provides an assessment of your security posture from an internal perspective. Asset management refers to a systematic approach to the governance and realization of value from the things that a group or entity is responsible for over their whole life cycles. It may apply both to tangible assets and intangible assets. Patch management is the process that helps acquire, test, and install multiple patches (code changes) on existing applications and software tools on a computer, enabling systems to stay updated on existing patches and determining which patches are the appropriate ones.

Question 2

What is a common Service Oriented Architecture Protocol (SOAP) vulnerability?

A. SQL Injection
B. Cross site scripting
C. XPath Injection
D. XML Denial of Service

Answer 2

D. XML Denial of Service

Explanation:
OBJ-2.5: An XML denial of service (or XML bomb) attempts to pull in entities recursively in a defined DTD and explode the amount of memory used by the system until a denial of service condition occurs. Service-Oriented Architecture (SOA) is an architectural paradigm, and it aims to achieve a loose coupling amongst interacting distributed systems. SOA is used by enterprises to efficiently and cost-effectively integrate heterogeneous systems. However, SOA is affected by several security vulnerabilities, affecting the speed of its deployment in organizations. SOA is most commonly vulnerable to an XML denial of service. While the other options could be used as part of an attack on SOAP, the SOAP message itself is formatted as an XML document making an XML denial of service the most common vulnerability. While SOAP requests are vulnerable to SQL injections, this occurs by submitting a parameter as a morphed SQL query that can authenticate or reveal sensitive information as an attack on the underlying SQL. Cross-Site Scripting (XSS) attacks are a type of injection in which malicious scripts are injected into otherwise benign and trusted websites. XPath Injections operate on websites that use user-supplied information to construct an XPath query for XML data.

Question 3

Dion Training is worried about the security of the data on their corporate smartphones if lost or stolen. The Chief Security Officer has instructed that the devices be configured so that unauthorized users cannot access the data. Which TWO of the following settings would provide the BEST security and protection for the corporate smartphones’ data?

A. Enable device lockouts after 3 failed attempts
B. Enable full device encryption
C. Require complex passwords
D. Configure the ability to perform a remote wipe
E. Enable a pattern lock
F. Disable the installation of applications from untrusted sources

Answer 3

B. Enable full device encryption
D. Configure the ability to perform a remote wipe

Explanation:
OBJ-3.1: The BEST protections for the data would involve enabling full disk encryption and configuring the ability to perform a remote wipe. Even if the device is lost or stolen, its data would be unreadable if it was using full disk encryption. Additionally, by configuring the ability to wipe the device’s storage remotely, the data would be erased before a thief can access it. The other options are all valid options to increase security, but they do not directly address the issues presented in the scenario.

Question 4

Which term refers to the consistent and tamper-resistant operation of every element within an enterprise?

A. Trusted computing environment
B. Accrediteed network
C. Trusted foundry
D. Trust certified enterprise

Answer 4

A. Trusted computing environment

Explanation:
OBJ-3.2: A trusted computing environment refers to every element’s consistent and tamper-resistant operation within an enterprise. The Trusted Foundry Program, also called the trusted supplier program, is a United States Department of Defense program designed to secure the manufacturing infrastructure for information technology vendors providing hardware to the military. An accredited network means that a relevant system has been approved for use, and an authorizing official has accepted the risk involved. The term trust certified enterprise is not an industry-standard term and was created as a distractor from the correct answer.

Question 5

You have been asked to help conduct a known environment penetration test. As part of your preparations, you have been given the source code for the organization’s custom web application.
Which type of vulnerability might be able to exploit the code shown in this image?

A. Remote Code Execution
B. Buffer overflow
C. JavaScript injection
D. SQL Injection

Answer 5

B. Buffer overflow

Explanation:
OBJ-2.5: The function DionCode may be subject to a buffer overflow as the user enters something over 20 characters as their input. In defining the char (character) type array, the programmer only allocated 20 characters worth of memory storage. To solve this problem, the programmer should create proper input validation to ensure that the input is less than 20 characters before passing the user_input variable to the strcpy (string copy) function.

Question 6

A cybersecurity analyst has deployed a custom DLP signature to alert on any files that contain numbers in the format of a social security number (xxx-xx-xxxx). Which of the following concepts within DLP is being utilized?

A. Exact data match
B. Document matching
C. Classification
D. Statiscal matching

Answer 6

A. Exact data match

Explanation:
OBJ-1.4: An exact data match (EDM) is a pattern matching technique that uses a structured database of string values to detect matches. For example, a company might have a list of actual social security numbers of its customers. But, since it is not appropriate to load these numbers into a DLP filter, they could use EDM to match the numbers’ fingerprints instead based on their format or sequence. Document matching attempts to match a whole document or a partial document against a signature in the DLP. Statistical matching is a further refinement of partial document matching that uses machine learning to analyze various data sources using artificial intelligence or machine learning. Classification techniques use a rule based on a confidentiality classification tag or label attached to the data. For example, the military might use a classification-based DLP to search for any files labeled as secret or top secret.

Question 7

Which of the following features of homomorphic encryption allows two parties to jointly evaluate a publicly known function without revealing their respective inputs?

A. Secure multiparty computation
B. Secure function evaluation
C. Private function evaluation
D. Private information retrieval

Answer 7

B. Secure function evaluation

Explanation:
OBJ-1.8: Secure Function Evaluation (SFE) allows two parties to jointly evaluate a publicly known function without revealing their respective inputs. Private Information Retrieval (PIR) retrieves an item from a service in possession of a database without revealing which item is retrieved. Private Function Evaluation (PFE) allows two parties to jointly evaluate a private function without revealing their respective inputs. Secure Multi-Party Computation creates methods for parties to jointly compute a function over their inputs while keeping those inputs private.

Question 8

Dion Training Solutions is currently calculating the risk associated with building a new data center in a hurricane-prone location. The data center would cost $3,125,000 to build and equip. Based on their assessment of the history of the location, a major hurricane occurs every 20 years and their data center would risk losing 60% of its value due to downtime and possible structural damages. If the data center is built in this location, what is the annual loss expectancy for this data center?

A. 1,875,000
B. 93,750
C. 625,000
D. 156,250

Answer 8

B. 93,750

Explanation:
OBJ-4.1: The annual loss expectancy (ALE) of the data center would be $93,750. The annual loss expectancy (ALE) is the average amount that would be lost over a year for a given asset. The annual loss expectancy is calculated by multiplying the single loss expectancy and the annual rate of occurrence together. The single loss expectancy is the amount of value lost in a single occurrence of a risk factor being realized. The single loss expectancy is calculated by multiplying the asset value and the exposure factor together. The annual rate of occurrence is the number of times a risk might be realized in a given year. Therefore, the annual loss expectancy equals the ARO (1 occurrence divided by 20 years) multiplied by the SLE (exposure factor of 60% time the asset value of $3,125,000 equals ), which equals $92,750 (0.05 x $1,875,000).

Question 9

You are an analyst and have been asked to review and categorize the following output from a packet analysis in Wireshark:
Based on your review, what does this scan indicate?

A. 173.12.15.23 might be infected with malware
192.168.3.145 might be infected with malware
C. 173.12.15.23 might be infected and beaconing to a C2 server
D. This appears to be normal network traffic
E. 192.168.3.145 might be infected and beaconing to a C2 server

Answer 9

D. This appears to be normal network traffic

Explanation:
OBJ-2.9: This appears to be normal network traffic. The first line shows that a DNS lookup was performed for a website (test.diontraining.com). The second line shows the response from the DNS server with the IP address of the website. The third line begins a three-way handshake between an internal host and the website. The fourth line is the SYN-ACK response from the website to the internal host as part of this handshake. The fifth line is a standard Windows NetBIOS query within the local area network to translate human-readable names to local IP addresses. The sixth and seventh lines appear to be inbound requests to port 443 and port 8080, both of which were sent the RST by the internal host’s firewall since it is not running those services on the host. None of this network traffic appears to be suspicious.

Question 10

Which of the following emergent technologies would be most useful in creating a synthetic customer service agent to respond to initial support requests from users within your enterprise network when they call your help desk?

A. Deep fake
B. Natural language processing
C. Big data
D. Distributed consensus

Answer 10

B. Natural language processing

Explanation:
OBJ-1.8: Natural language processing (NLP) is a type of deep learning focused on understanding and responding to human language. A deep fake is a realistic video or audio that impersonates a real person. Deep fakes are created using deep learning technology. Distributed consensus is used in a distributed or decentralized system to solve a particular computation to maintain the overall integrity of the distributed system or blockchain. Big data refers to data collections that are too large and complex for a traditional database to manage.

Question 11

You are deploying OpenSSL in your organization and must select a cipher suite. Which of the following ciphers should NOT be used with OpenSSL?

A. ECC
B. DES
C. RSA
D. AES

Answer 11

B. DES

Explanation:
OBJ-3.6: DES is outdated and should not be used for any modern applications. The AES, RSA, and ECC are all current secure alternatives that could be used with OpenSSL. This question may seem beyond the scope of the exam. Still, the objectives allow for “other examples of technologies, processes, or tasks about each objective may also be included on the exam although not listed or covered” in the objectives’ bulletized lists. The content examples listed in the objectives are meant to clarify the test objectives and should not be construed as a comprehensive listing of this examination’s content. Therefore, questions like this are fair game on test day. That said, your goal isn’t to score 100% on the exam; it is to pass it. Don’t let questions like this throw you off on test day. If you aren’t sure, take your best guess and move on!

Question 12

Dion Training wants to implement a new wireless network in their offices. Which of the following types would support encryption for traffic being sent and received over the network while still allowing users to connect to the open network without a password, passphrase, or digital certificate?

A. WPA2
B. WPA3
C. WPA
D. WEP

Answer 12

B. WPA3

Explanation:
OBJ-3.1: One of the features of WPA3 (WIFI6) is enhanced open. Enhanced Open enables encryption for traffic being sent and received over a wireless network when still using open authentication. WEP, WPA, WPA2 do not provide encryption of traffic sent over the network unless the network is protected by a password, passphrase, or digital certificate.

Question 13

Fail to Pass Solutions has requested that its employees have a mobile device so that they can respond to questions when they are out of the office. Each employee is responsible for buying their Android smartphone and cellular plan service. To access the corporate network and its data, the employees need to install a company-provided APK on their device. This app contains access to their company-provided email, cloud storage, and customer relationship management (CRM) database. Which of the following policies BEST describes Fail to Pass’s mobile device deployment model?

A. BYOD
B. COBO
C. CYOD
D. COPE

Answer 13

A. BYOD

Explanation:
OBJ-3.1: Bring Your Own Device (BYOD) is a mobile device deployment model that facilitates the use of personally owned devices to access corporate networks and data. Corporate Owned Business Only (COBO) is a mobile device deployment model that provides the employee with a corporate-owned device that may only be used for official work functions and purposes. Corporate Owned Personally Enabled (COPE) is a mobile device deployment model where the device remains the property of the organization, but certain personal use, such as private email, social networking, and web browsing, is also permitted. Choose Your Own Device (CYOD) is a mobile device deployment model where employees are offered a selection of corporate devices for work and, optionally, private use.

Question 14

You have decided to have DNA genetic testing and analysis performed to determine your exact ancestry composition and possibly find some lost relatives through their database. Which of the following types of data should this be classified?

A. PHI
B. CUI
C. IP
D. PII

Answer 14

A. PHI

Explanation:
OBJ-4.3: Protected health information (PHI) refers to medical and insurance records, plus associated hospital and laboratory test results. Data collected by genetic mapping and heredity companies include the subject’s DNA, making it PHI. Personally identifiable information (PII) is data that can be used to identify, contact, or locate an individual. Information such as social security number (SSN), name, date of birth, email address, telephone number, street address, and biometric data is considered PII. Proprietary information or intellectual property (IP) is information created and owned by the company, typically about the products or services that they make or perform. Controlled Unclassified Information (CUI) is federal non-classified information that must be safeguarded by implementing a uniform set of requirements and information security controls to secure sensitive government information.

Question 15

A company needs to implement stronger authentication by adding an authentication factor to its wireless system. The wireless system only supports WPA with pre-shared keys, but the backend authentication system supports EAP and TTLS. What should the network administrator implement?

A. PKI with user authentication
B. WPA2 with a complex shared key
C. 802.1x using EAP with MSCHAPv2
D. MAC address filtering with IP filtering

Answer 15

C. 802.1x using EAP with MSCHAPv2

Explanation:
OBJ-1.5: Since the backend uses a RADIUS server for back-end authentication, the network administrator can install 802.1x using EAP with MSCHAPv2 for authentication. The Extensible Authentication Protocol (EAP) is a framework in a series of protocols that allows for numerous different mechanisms of authentication, including things like simple passwords, digital certificates, and public key infrastructure. Microsoft Challenge Handshake Authentication Protocol version 2 (MS-CHAP v2) is a password-based authentication protocol that is widely used as an authentication method in PPTP-based (Point to Point Tunneling Protocol) VPNs and can be used with EAP.

Question 16

What is a reverse proxy commonly used for?

A. To prevent the unauthorized use of cloud services from the local network
B. Allowing access to a virtual private cloud
C. To obfuscate the origin of a user within a network
D. Directing traffic to internal services if the contents of the traffic comply with the policy

Answer 16

D. Directing traffic to internal services if the contents of the traffic comply with the policy

Explanation:
OBJ-1.1: A reverse proxy is positioned at the cloud network edge and directs traffic to cloud services if the contents of that traffic comply with the policy. This does not require the configuration of the users’ devices. This approach is only possible if the cloud application has proxy support. You can deploy a reverse proxy and configure it to listen for client requests from a public network, like the internet. The proxy then creates the appropriate request to the internal server on the corporate network and passes the server’s response back to the external client. They are not generally intended to obfuscate the source of communication, nor are they necessarily specific to the cloud. A cloud access security broker (CASB) can be used to prevent unauthorized use of cloud services from the local network.

Question 17

An organization utilizes a BYOD policy with its employees. This allows the employees to store sensitive corporate data on their personally owned devices. Which of the following occurred if an employee accidentally left their device in the back of a taxi?

A. A data breach
B. Failed deperimeterization management
C. Failed data loss prevention
D .An advanced persistent threat

Answer 17

B. Failed deperimeterization management

Explanation:
OBJ-1.1: Deperimeterization is a strategy for protecting a company’s data on multiple levels using encryption and dynamic data-level authentication. Since the employee lost the device, which contained sensitive corporate data outside of the network, this would be classified as failed deperimeterization management. Data loss prevention (DLP) detects potential data breaches/data exfiltration transmissions and prevents them by monitoring, detecting, and blocking sensitive data while in use, in motion, and at rest. DLP does not apply to this scenario since the employee was authorized to have the corporate data on the device under the BYOD policy. A data breach is an incident that exposes confidential or protected information. Based on the scenario provided, we are not told whether anyone has tried to access the device’s data. If an attacker accesses the device’s data, it may be considered a data breach or inadvertent data disclosure, depending on your organization’s policies. An advanced persistent threat is a stealthy computer network threat actor, typically a nation-state or state-sponsored group, which gains unauthorized access to a computer network and remains undetected for an extended period.

Question 18

Dion Training is designing a new practice exam application that will be hosted in the cloud. The company knows there will be periods of higher and lower demands based on an analysis of historical usage patterns. The programmers have created the code using distributed programming techniques so that the jobs can be distributed over numerous machines across the virtual private cloud (VPC) containing each of the servers. To help control costs, any new servers added to the pool must be added by a system administrator after verifying the current demand. Which of the following BEST describes the type of action used to meet the increasing demands on the server?

A. Autoscaling
B. Content delivery network
C. Horizontal scaling
D. Vertical scaling

Answer 18

C. Horizontal scaling

Explanation:
OBJ-1.2: Horizontal scaling allows additional capacity to be achieved by adding servers to help process the same workload, such as adding nodes to a distributed system or adding web servers to an existing server farm. Vertical scaling allows additional resources to be added to an individual system, such as adding processors, memory, and storage to an existing server. Autoscaling is the ability to expand and contract the performance of workloads based on policies with specific maximum and minimum capacity specifications. Autoscaling can be used with either horizontal or vertical scaling depending on your cloud service provider. A content delivery network (CDN) distributes and replicates the components of any service (such as web apps, media, and storage) across all the key service areas needing access to the content.

Question 19

The Dion Development Group is a young startup that creating a new Software as a Service (SaaS) tool. To aid in their risk management, the company has decided to create risk tiers to assign to potential vulnerabilities based on their potential ALE cost. For risks with an ALE under $10,000, the company will classify them as low risk. For risks with an ALE between $10,000 and $50,000, the company will classify them as medium risk. For risks with an ALE over $50,000, the company will classify them as high risk. What best describes these potential risk classifications based on the stated monetary thresholds?

A. Inherent risk
B. Risk tolerance
C. Risk appetite
D. Residual risk

Answer 19

B. Risk tolerance

Explanation:
OBJ-4.1: Risk tolerance is defined as the threshold that separates the different levels of risk within an organization. Risk appetite is a strategic assessment of what level of residual risk is acceptable to an organization. Inherent risk is the level of risk that exists before any compensating controls have been implemented. Residual risk is the risk that remains after compensating controls have been implemented.

Question 20

You are working as a network administrator for Dion Training. The company has decided to allow employees to connect their devices to the corporate wireless network under a new BYOD policy. You have been asked to separate the corporate network into an administrative network (for corporate-owned devices) and an untrusted network (for employee-owned devices). Which of the following technologies should you implement to achieve this goal?

A. VLAN
B. VPN
C. MAC Filtering
D. WPA2

Answer 20

A. VLAN

Explanation:
OBJ-1.1: A virtual local area network (VLAN) is a type of network segmentation configured in your network switches that prevent communications between different VLANs without using a router. This allows two virtually separated networks to exist on one physical network and separates the two virtual network’s data. A virtual private network (VPN) is a remote access capability to connect a trusted device over an untrusted network back to the corporate network. A VPN would not create the desired effect. WPA2 is a type of wireless encryption, but it will not create two different segmented networks on the same physical hardware. MAC filtering is used to allow or deny a device from connecting to a network, but it will not create two network segments, as desired.

Question 21

Dion Training wants to implement DNS protection on their mobile devices. Which of the following implementations would allow the device’s DNS requests to be tunneled within TLS traffic to aid in the privacy protection of the user?

A. Custom DNS
B. Profiles
C. Token based access
D. DOH

Answer 21

D. DOH

Explanation:
OBJ-3.1: DNS over HTTPS (DoH) allows the DNS requests to be tunneled within the TLS traffic over port 443. This allows most of the DNS protocol traffic over port 53 to be eliminated after the first DNS request to the DoH provider is made. DoH is used mainly to provide privacy protection for the user and their web browsing activities. Custom DNS is often used to block dangerous sites by purposefully refusing to resolve to a previously identified malicious host. Device configuration profiles are XML files that contain configuration details defined at either the user or device level. These profiles can be manually installed or automatically deployed through an MDM solution. Token-based access requires an enrolled device to provide a token issued by an IAM solution to gain access to network resources. Mobile devices with an installed token are granted access to the network resources after being verified by a network access control (NAC) appliance.

Question 22

Dion Training is building a new learning management system that will require its students to access the system through a webpage. To create a secure communication channel between the student’s system and the learning management system, the programmers have decided to use ephemeral session keys without the use of the server’s digital certificate and instead relying on a Diffie-Hellman key agreement. The programmer states that in his implementation, even if the server’s private key is exposed, the ephemeral session keys would remain secure. Which cryptographic concept is the programmer referring to in his implementation?

A. Key stretching
B. AEAD
C. Forward secrecy
D. Cipher block chaining

Answer 22

C. Forward secrecy

Explanation:
OBJ-3.6: Forward secrecy (FS), also known as perfect forward secrecy (PFS), is a feature of specific key agreement protocols that gives assurances that session keys will not be compromised even if long-term secrets that were used in the session key exchange are compromised. Key stretching is a technique that strengthens potentially weak input for cryptographic key generation, such as passwords or passphrases created by people, against brute force attacks. Authenticated encryption with associated data (AEAD) is a form of encryption that provides confidentiality of the plaintext, a way to check its integrity, and a method of verifying its authenticity. Cipher block chaining (CBC) is a simple mode of enabling symmetric block ciphers to work with large sets of data. CBC is an older method that is vulnerable to the padding-oracle attack and should therefore not be used.

Question 23

An analyst just completed a port scan and received the following results of open ports:
Based on these scan results, which of the following services are NOT currently operating?

A. RDP
B. SSH
C. Web
D. Database

Answer 23

B. SSH

Explanation:
OBJ-2.9: Based on the port numbers shown as open in the nmap scan results, SSH is not currently operating. SSH operates over port 22. Web servers use port 80 for HTTP and 443 for HTTPS. Database servers run on port 1433 (Microsoft SQL) or 3306 (MySQL). Remote Desktop Protocol runs on port 3389.

Question 24

You want to provide controlled remote access to the remote administration interfaces of multiple servers hosted on a private cloud. What type of segmentation security solution is the best choice for this scenario?

A. Airgap
B. Jumpbox
C. Bastion hosts
D. Physical

Answer 24

B. Jumpbox

Explanation:
OBJ-1.1: Installing a jumpbox as a single point of entry for the administration of servers within the cloud is the best choice for this requirement. The jumpbox only runs the necessary administrative port and protocol (typically SSH). Administrators connect to the jumpbox then use the jumpbox to connect to the admin interface on the application server. The application server’s admin interface has a single entry in its ACL (the jumpbox) and denies any other hosts’ connection attempts. A bastion host is a special-purpose computer on a network specifically designed and configured to withstand attacks. The computer generally hosts a single application. For example, a proxy server and all other services are removed or limited to reduce the threat to the computer. An airgap system is a network or single host computer with unique security requirements that may physically be separated from any other network. Physical separation would prevent a system from accessing the remote administration interface directly and require an airgap system to reach the private cloud.

Question 25

You are working as part of a penetration testing team during an engagement. A coworker just entered “sudo systemctl start DionTrainingApp” in the shell of a Linux server the team exploited. What action is your coworker performing with this command?

A. To enumerate the running services on the server
B. To enable persistence of the server
C. To remove persistence on the server
D. To shutdown the running on the server

Answer 25

B. To enable persistence of the server

Explanation:
OBJ-2.4: This scenario uses the systemctl command to remove persistence from a Linux server within its shell. The systemd tool is an init system and system manager that has widely become the new standard for Linux distributions. The systemctl is part of systemd. The systemctl is used to manage services, check their status, change their status, and work with the configuration files. By entering “sudo systemctrl start DionTrainingApp” in the shell, the system will start the service known as DionTrainingApp. This will create persistence by running the DionTrainingApp service, which is just a fictional service name used in this example to hide the penetration tester’s persistence tools. This service could be named anything the penetration tester deems appropriate during the service’s installation.

Question 26

You are developing a containment and remediation strategy to prevent the spread of an APT within your network. Your plan suggests creating a mirror of the company’s databases, routing all externally sourced network traffic to it, and gradually updating with pseudo-realistic data to confuse and deceive the APT as they attempt to exfiltrate the data. Once the attacker has downloaded the corrupted database, your company would then conduct remediation actions on the network and restore the correct database information to the production system. Which of the following types of containment strategies does the plan utilize?

A. Isolation based containment by removing the affected database from production
B. Segmentation based containment that deceives the attack into believing their attack was successful
C. Segmentation based containment disrupts the APT by using a hack back approach
D. Isolation based containment by disconnecting the APT from the affected network

Answer 26

B. Segmentation based containment that deceives the attack into believing their attack was successful

Explanation:
OBJ-2.6: There are two types of containment: segmentation and isolation. This is an example of a segmentation-based containment strategy that utilizes deception. Segmentation-based containment is a means of achieving the isolation of a host or group of hosts using network technologies and architecture. As opposed to completely isolating the hosts, you might configure the protected segment to deceive him or her into thinking the attack is progressing successfully, such as in the database modification example. The scenario is not a hack-back approach since the APT is not directly attacked, only deceived. Isolation-based containment involves removing an affected component from whatever larger environment it is a part of. In this scenario, the original database was never isolated from the network, nor were any other affected assets during the deception.

Question 27

Dion Training has contracted a cloud service provider to host their webservers. Dion Training wants to ensure their webservers are highly available and fault-tolerant, but they want to ensure all their data remains located in the same geographic area. Which of the following would allow Dion Training to host their webservers in two different data centers located in the same geographic area?

A. VPC/VNet
B. Data zone
C. Availability Zone
D. Region

Answer 27

C. Availability Zone

Explanation:
OBJ-1.1: An availability zone is a physical or logical data center within a single region. A region describes a collection of data centers located within a geographic area and they are distributed across the globe. A Virtual Private Cloud (VPC) or a Virtual Network (VNet) allows for the creation of cloud resources within a private network that parallels the functionality of the same resources in a traditional, privately operated data center. Data zones describe the state and location of data to help isolate and protect it from unauthorized/inappropriate use within a data lake.

Question 28

An analyst reviews the logs from the network and notices that there have been multiple attempts from the open wireless network to access the networked HVAC control system. The open wireless network must remain openly available so that visitors can access the internet. How can this type of attack be prevented from occurring in the future?

A. Implement a VLAN to seperate the HVAC control system from the open wireleess network
B. Enable WPA2 Security on the open wireless network
C. Enable NAC on the open wireless network
D. Install an IDS to protect the HVAC system

Answer 28

A. Implement a VLAN to seperate the HVAC control system from the open wireleess network

Explanation:
OBJ-3.3: A VLAN is useful to segment out network traffic to various parts of the network and stop someone from the open wireless network from logging to the HVAC controls. By utilizing NAC, each machine connected to the open wireless network could be checked for compliance and determine if it is a ‘known’ machine, but they would still be given access to the entire network. Also, since this is a publicly usable network, using NAC could prevent users from accessing all the network features. An IDS would be a good solution to detect the attempted logins, but it won’t prevent them. Instead, an IPS would be required to prevent logins.

Question 29

Jay is replacing his organization’s current vulnerability scanner with a new tool. As he begins to create the scanner’s configurations and scanning policy, he notices a conflict in the settings recommended between different documents. Which of the following sources must Jay follow when trying to resolve these conflicts?

A. Corporate policy
B. NIST Guideline documents
C. Configuration settings from the prior system
D. Vendor best practices

Answer 29

A. Corporate policy

Explanation:
OBJ-4.1: Policies are formalized statements that apply to a specific area or task. Policies are mandatory, and employees who violate a policy may be disciplined. Guidelines are general, non-mandatory recommendations. Best practices are considered procedures that are accepted as being correct or most effective but are not mandatory to be followed. Configuration settings from the prior system could be helpful, but this is not a mandatory compliance area like a policy. Therefore, Jay should first follow the policy before the other three options if there is a conflict.

Question 30

The Dion Development Group is a young startup that is about to release a minimum viable product (MVP) of their new Software as a Service (SaaS) tool to the marketplace. The company has conducted a strategic assessment and determined that they can accept no more than a $1,000,000 ALE for their SaaS solution after implementing compensating controls. What best describes this acceptable risk level?

A. Risk tolerance
B. Inherent risk
C. Risk appetite
D. Residual risk

Answer 30

A. Risk tolerance

Explanation:
OBJ-4.1: Risk appetite is a strategic assessment of what level of residual risk is acceptable to an organization. Inherent risk is the level of risk that exists before any compensating controls have been implemented. Risk tolerance is defined as the threshold that separates the different levels of risk within an organization. Residual risk is the risk that remains after compensating controls have been implemented.

Question 31

Dion Training is drafting a new business continuity plan and is trying to determine the appropriate metric to utilize in defining the recovery requirements for their practice exam web application. This application is used by all of Dion Training’s students to prepare for their upcoming certification exams. The web application currently lets students take practice exams, review the results of the exam when completed, and review the complete history of all of their previous exam attempts. The organization has determined that after an incident, they will prioritize the ability for students to take a new exam and review those results first, then work to fully recover the students’ historical exam attempts after the initial recovery is complete. Which of the following metrics best defines this two-tiered approach to recovery?

A. Recovery service level (RSL)
B. Recovery point objective (RPO)
C. Recovery time objective (RTO)
D. Mean time to recovery (MTTR)

Answer 31

A. Recovery service level (RSL)

Explanation:
OBJ-4.4: The recovery service level is the minimum acceptable amount of services that must be restored for a given system to consider it recovered. For example, your organization may need to restore its databases and websites to meet its recovery service level objectives while leaving its print servers offline since they may not be considered a mission-essential function in your organization. The recovery point objective defines the maximum amount of data that can be lost without irreparable harm to the operation of the business. The recovery time objective defines the maximum amount of time that performing a recovery can take and the service can be offline. The mean time to recovery is the average amount of downtime calculated based on when a service or device fails and when its functionality is restored.

Question 32

Which of the following exploitation frameworks contain plugins that can trigger buffer overflows in SCADA systems, such as /exploit/windows/scada/daq_factory_bof that can trigger a stack overflow by sending excessive requests to a service port on the system?
A. Metasploit
B. Nikto
C. Androzer
D. Nessus

Answer 32

A. Metasploit

Explanation:
OBJ-2.4: Metasploit is an open-source exploitation framework that uses plugins to add different exploits and functionalities. They are always in the form of a directory structure, like /exploit/windows/scada/daq_factory_bof. This represents the plugin type (exploit), the operating system involved (windows), the service/program (scada), and the specific exploit (daq_factory_bof). If you see this format in a question, the answer is most likely related to Metasploit.

Question 33

Jason is sending an email to Tamera’s Dion Training account with the latest student enrollment numbers. To ensure integrity and non-repudiation of the enrollment numbers, Jason’s email client hashes the email and then encrypts the hash with Jason’s private key before sending the email and the encrypted hash to Tamera’s account. Which of the following certificate use cases is described by this scenario?

A. Digital signature
B. Code signing
C. Server authentication
D. Client authentication

Answer 33

A. Digital signature

Explanation:
OBJ-3.5: A digital signature is created by encrypting the hash digest with the sender’s private key. For example, when digitally signing an email, the email is first hashed and then the hash is encrypted with the private key of the sender to prove its integrity and non-repudiation when sent. Code signing is a method of using a digital signature to ensure the source and integrity of programming code. If a valid code signature exists, this indicates that the code has not been changed or modified since being released by the code’s author or publisher. Client authentication describes the mechanism by which a server can verify that a connection request is originating from a preauthorized endpoint. Client authorization is commonly used by SSH servers by storing a local copy of a client’s public SSH key on the SSH server and using this to authorize the client during a connection. Server authentication is utilized by a client device when the client establishes that the server is genuine. For example, when visiting a new website, a client will use the web server’s digital certificate and public key to authenticate that the server they connected to is legitimate.

Question 34

Alexa is an analyst for a large bank that has offices in multiple states. She wants to create an alert to detect if an employee from one bank office logs into a workstation located at an office in another state. What type of detection and analysis is Alexa configuring?

A. Anomaly
B. Behavior
C. Heuristic
D. Trend

Answer 34

D. Trend

Explanation:
OBJ-1.1: This is an example of behavior-based detection. Behavior-based detection (or statistical- or profile-based detection) means that the engine is trained to recognize baseline traffic or expected events associated with a user account or network device. Anything that deviates from this baseline (outside a defined level of tolerance) generates an alert. The heuristic analysis determines whether several observed data points constitute an indicator and whether related indicators make up an incident depending on a good understanding of the relationship between the observed indicators. Human analysts are typically good at interpreting context but work painfully slowly, in computer terms, and cannot hope to cope with the sheer volume of data and traffic generated by a typical network. Anomaly analysis is the process of defining an expected outcome or pattern to events and then identifying any events that do not follow these patterns. This is useful in tools and environments that enable you to set rules. Trend analysis is not used for detection but instead to better understand capacity and the system’s normal baseline. Behavioral-based detection differs from anomaly-based detection. Behavioral-based detection records expected patterns concerning the entity being monitored (in this case, user logins). Anomaly-based detection prescribes the baseline for expected patterns based on its observation of what normal looks like.

Question 35

Which of the following layers within software-defined networking consists of the physical networking devices, such as switches and routers?

A. Application layer
B. Control layer
C. Infrastructure layer
D. Management plane

Answer 35

C. Infrastructure layer

Explanation:
OBJ-1.1: The infrastructure layer contains the physical networking devices that receive information from the control layer about where to move the data and then perform those movements. The application layer focuses on the communication resource requests or information about the network. The control layer uses the information from applications to decide how to route a data packet on the network and to make decisions about how traffic should be prioritized, how it should be secured, and where it should be forwarded to. The management plane is used to monitor traffic conditions, the status of the network, and allows network administrators to oversee the network and gain insight into its operations.

Question 36

Which type of monitoring would utilize a network tap?

A. Passive
B. SNMP
C. Router based
D. Active

Answer 36

A. Passive

Explanation:
OBJ-1.1: Network taps are devices that allow a copy of network traffic to be captured for analysis. They conduct passive network monitoring and visibility without interfering with the network traffic itself. Active monitoring relies on scanning targeted systems, not a network tap. Router-based monitoring would involve looking over the router’s logs and configuration files. SNMP is used to monitor network devices but is considered active monitoring and doesn’t rely on network taps.

Question 37

Fail to Pass operates a web-based learning management system for its students to utilize. The system uses a password-based authentication system and requires a password of at least 8 characters in length. The company does not have an account lockout policy in place and has been subject to brute force authentication attacks in the past. Which of the following cryptographic concepts would slow down a brute force attack by adding thousands of additional rounds of hashing to the authentication process?

A. Forward secrecy
B. Key stretching
C. Cipher block chaining
D. AEAD

Answer 37

B. Key stretching

Explanation:
OBJ-3.6: Key stretching is a technique that strengthens potentially weak input for cryptographic key generation, such as passwords or passphrases created by people, against brute force attacks. Key stretching will not stop a brute force attack, but it will slow it down since each password must still be put through thousands of rounds of hashing before being checked against the stored password in the database. Authenticated encryption with associated data (AEAD) is a form of encryption that provides confidentiality of the plaintext, a way to check its integrity, and a method of verifying its authenticity. Forward secrecy (FS), also known as perfect forward secrecy (PFS), is a feature of specific key agreement protocols that gives assurances that session keys will not be compromised even if long-term secrets used in the session key exchange are compromised. Cipher block chaining (CBC) is a simple mode of enabling symmetric block ciphers to work with large sets of data. CBC is an older method that is vulnerable to the padding-oracle attack and should therefore not be used.

Question 38

What sanitization technique uses only logical techniques to remove data, such as overwriting a hard drive with a random series of ones and zeroes?

Explanation

Question 39

Which term is used in software development to refer to the method in which app and platform updates are committed to a production environment rapidly?

A. Continuous monitoring
B. Continous delivery
C. Continous integration
D. Continous deployment

Answer 39

D. Continous deployment

Explanation:
OBJ-1.3: Continuous deployment is a software development method in which app and platform updates are committed to production rapidly. Continuous delivery is a software development method in which app and platform requirements are frequently tested and validated for immediate availability. Continuous integration is a software development method in which code updates are tested and committed to development or build server/code repositories rapidly. Continuous monitoring is the technique of constantly evaluating an environment for changes so that new risks may be more quickly detected and business operations improved upon. While continuous deployment and continuous delivery sound very similar, there is one key difference. In continuous delivery, a human is still required to approve the release into the production environment. In continuous deployment, the test and release process into the production environment is automated, making the changes available for immediate release once the code is committed.

Question 40

Your organization has recently migrated to a SaaS provider for its enterprise resource planning (ERP) software. Before this migration, a weekly port scan was conducted to help validate the on-premise systems’ security. Which of the following actions should you take to validate the security of the cloud-based solution?

A. Utilize a VPN to scan inside the vendors security perimeter
B. Utilize third party contractor to conduct the scans
C. Utilize a different scanning tool
D. Utilize vendor testing and audits

Answer 40

D. Utilize vendor testing and audits

Explanation:
OBJ-3.4: The best option is to utilize vendor testing and audits in a cloud-based environment. Most SaaS providers will not allow customers to conduct their own port scans or vulnerability scans against the SaaS service. This means you cannot scan using a VPN connection, utilize different scanning tools, or hire a third-party contractor to scan on your behalf.

Question 41

You are analyzing the logs of a web server and see the following entry:
Based on this entry, which of the following attacks was attempted?

A. SQL injection
B. XSS
C. XML Injection
D. Buffer overflow

Answer 41

B. XSS

Explanation:
OBJ-2.2: This is an example of an XSS attack as recorded by a web server’s log. In this example, the XSS attack was obfuscated by the attacker using HTML encoding. The encoding of %27%27 translates to two single quote marks (‘ ‘). While you don’t need to be able to decode the exact string used in the logs, when you see HTML encoding on the exam, it is usually going to be an XSS attack unless you see SQL or XML statements in the string, which in this case there are neither of those. Cross-site scripting (XSS) attacks use a specially crafted URL that includes attack code that will cause user information entered into their web browser to be sent to the attacker. An attacker finds a web server vulnerable to XSS and sends a legitimate-looking URL with XSS attack code appended to the end of the URL through a phishing email or other message to trick the user into clicking the link. A buffer overflow attempts to write data to a buffer that overruns the buffer’s boundary and writes data into the adjacent memory locations, which is not occurring in this example.

Question 42

Dion Training is evaluating the security of its database server’s configuration. During the evaluation, one of the analysts identifies that data can be decrypted outside of a dedicated section of memory. Which of the following endpoint security controls would eliminate this vulnerability by ensuring that sensitive information is only allowed to be decrypted within the CPU or a protected region of memory?

A. Attestation services
B. Self encrypting drive (SED)
C. Local drive encryption
D. Secure encrypted enclaves

Answer 42

D. Secure encrypted enclaves

Explanation:
OBJ-3.2: Secure encrypted enclaves protect CPU instructions, dedicated secure subsystems in a system on a chip (SoC), or a protected region of memory in a database engine by only allowing data to be decrypted on the fly within the CPU, SoC, or protected region. A self-encrypting drive (SED) is a type of solid state device (SSD) or hard disk drive (HDD) that conducts transparent encryption of all data as it is written to the device using an embedded hardware cryptographic processor. Local drive encryption protects the contents of a solid state device (SSD) or hard disk drive (HDD) when the operating system is not running through the use of software-based encryption such as BitLocker, FileVault, or TrueCrypt. Attestation services are used to ensure the integrity of the computer’s startup and runtime operations. Hardware-based attestation is designed to protect against threats and malicious code that could be loaded before the operating system is loaded.

Question 43

Christina is auditing the security procedures related to the use of a cloud-based online payment service. She notices that the access permissions are set so that a single person can not add funds to the account and transfer funds out of the account. What security principle is most closely related to this scenario?

A. Separation of duties
B. Security through obscurity
C. Least privilege
D. Dual control authentication

Answer 43

A. Separation of duties

Explanation:
OBJ-4.1: Separation of duties is the concept of having more than one person required to complete a task. In business, the separation by sharing more than one individual in a single task is an internal control intended to prevent fraud and error. In this case, one person can transfer money in, while another must transfer money out. Dual control authentication is used when performing a sensitive action and requires two different users to log in. Least privilege is the concept and practice of restricting access rights for users, accounts, and computing processes to only those resources required to perform routine, legitimate activities. Security through obscurity is the reliance on security engineering in design or implementation by using secrecy as the main method of providing security to a system or component.

Question 44

Dion Training wants to set up remote access and authentication for its users utilizing EAP. Which EAP implementation should they utilize to allow for the establishment of an encrypted TLS tunnel between a client and a server using a public key certificate from both the client and server to allow for mutual authentication?

A. EAP-TLS
B. EAP-TTLS
C. EAP-FAST
D. PEAP

Answer 44

A. EAP-TLS

Explanation:
OBJ-3.6: EAP Transport Layer Security (EAP-TLS) is the strongest type of authentication used in EAP. EAP-TLS establishes an encrypted TLS tunnel between the client and the server using public key certificates for both the server and the client for mutual authentication. The client will normally use digital certificates located on a smart card or a certificate installed on the client device in the TPM for their portion of the authentication for additional security. Protected Extensible Authentication Protocol (PEAP) uses an encrypted TLS tunnel between the client and the server, but it only utilizes a server-side public key certificate making it prone to password guessing and on-path attacks. PEAP only supports the use of EAP-MSCHAP or EAP-GTC (Generic Token Card) for client authentication. EAP Tunneled Transport Layer Security (EAP-TTLS) uses a server-side certificate to establish a protected tunnel through which the user’s authentication credentials are transmitted to the authentication server. EAP-TTLS can use any inner authentication protocol, including PAP, CHAP, MSCHAP, or GTC, whereas PEAP can only use EAP-MSCHAP and EAP-GTC. EAP with Flexible Authentication via Secure Tunneling (EAP-FAST) creates a protected tunnel without using a digital certificate and then passes the user’s authentication credentials through the tunnel to the authentication server. Instead of relying on a digital certificate, the client is issued a Protected Access Credential (PAC) based on the server’s master key, but then this PAC must be securely distributed to the user’s client before utilizing EAP-FAST.

Question 45

Which type of encryption can allow fields in a given dataset to be used in a computation without first being decrypted?

A. Advanced encryption standard
B. Elliptic curve cryptography
C. Homomorphic encryption
D. Data encryption standard

Answer 45

C. Homomorphic encryption

Explanation:
OBJ-1.8: Homomorphic encryption is a method of encryption that allows computation of certain fields in a dataset without first decrypting the dataset. The advanced encryption system (AES), elliptic curve cryptography (ECC), and the data encryption standard (DES) are traditional encryption protocols that require their data to be decrypted before computations can be performed on it. Homomorphic encryption is considered an emerging technology and is still being developed/improved since it is currently too slow to be practical for modern applications.

Question 46

You are applying for a job at a cybersecurity firm. The application requests you enter your social security number, date of birth, and email address to conduct a background check as part of the hiring process. Which of the following types of information have you been asked to provide?

A. PII
B. IP
C. PHI
D. CUI

Answer 46

A. PII

Explanation:
OBJ-4.3: Personally identifiable information (PII) is data used to identify, contact, or locate an individual. Information such as social security number (SSN), name, date of birth, email address, telephone number, street address, and biometric data is considered PII. Protected health information (PHI) refers to medical and insurance records, plus associated hospital and laboratory test results. Proprietary information or intellectual property (IP) is information created and owned by the company, typically about the products or services that they make or perform. Controlled Unclassified Information (CUI) is federal non-classified information that must be safeguarded by implementing a uniform set of requirements and information security controls to secure sensitive government information.

Question 47

You are investigating traffic involving three separate IP addresses (192.168.66.6, 10.66.6.10, and 172.16.66.1). Which REGEX expression would you use to be able to capture ONLY those three IP addresses in a single statement?

A.

Question 48

A network technician has received reports of an Internet-based application that has stopped functioning. Employees reported that after updating the Internet browsers, the application began to fail. Many users rolled back the update, but this did not correct the issue. What should the company do to reduce this type of action from causing network problems in the future?

A. Implement a disaster recovery plan with a host site to allow users to continue working
B. Coordinate the Internet servers update to coincide with the users updates
C. Segment the network and create a test lab for all updates before deployment
D. Verify the update hashes match those on the vendors website

Answer 48

C. Segment the network and create a test lab for all updates before deployment

Explanation:
OBJ-3.2: Segmented networks would ensure every system isn’t updated simultaneously and would be updated in groups. This is a common configuration known as “patch rings”, where smaller groups of end-users have their machines updated to minimize the number of people affected at one time. The test lab would ensure proper functionality before deployment or would allow you to work through the technical difficulties before deployment.

Question 49

Which of the following agreements is used between companies and employees, between companies and contractors, and between two companies to protect information assets?

A. SLA
B. ISA
C. NDA
D. DSUA

Answer 49

C. NDA

Explanation:
OBJ-4.3: Non-disclosure agreement (NDA) is the legal basis for protecting information assets. NDAs are used between companies and employees, between companies and contractors, and between two companies. If the employee or contractor breaks this agreement and shares such information, they may face legal consequences. NDAs are useful because they deter employees and contractors from violating the trust that an employee places in them. An interconnection security agreement (ISA) is defined by NIST’s SP800-4 and is used by any federal agency interconnecting its IT system to a third party must create an ISA to govern the relationship. A service level agreement (SLA) is a contractual agreement that sets out the detailed terms under which a service is provided. A data sharing and use agreement (DSUA) states that personal data can only be collected for a specific purpose. A DSUA can specify how a dataset can be analyzed and proscribe the use of reidentification techniques.

Question 50

Dion Security Group is analyzing the encryption implementation of one of its customers. An analyst has discovered that they are using a mode of operation that creates a chain of encrypted blocks by using an initial chaining vector (ICV) during the first round of encryption and then combines the output of the previous rounds into the subsequent rounds to create a securely encrypted ciphertext result. Which of the following modes of operation is being used by the customer?

A. Counter mode
B. Output feedback
C. Cipher block chaining
D. Galois/counter mode

Answer 50

B. Output feedback

Explanation:
OBJ-3.6: Output feedback (OFB) enables symmetric block ciphers to work with large sets of data by using an initial chaining vector (ICV) during the first round of encryption and then combining the output of the previous rounds into the subsequent rounds. Cipher block chaining (CBC) is a simple mode of enabling symmetric block ciphers to work with large sets of data and is an older method that is vulnerable to the padding-oracle attack. Galois/counter mode (GCM) provides a method of authenticated encryption with associated data (AEAD) that enables symmetric block ciphers to work with large sets of data. GCM is a specialized variant of the older counter mode that adds the authenticated data feature for the integrity and authenticity of the data. Counter (CTR) mode enables symmetric block ciphers to work with large sets of data by using an initialization vector and adding an incrementing counter value to the key to generate a keystream. Counter mode does not use padding in its operations and simply discards any unused space in the final block.

Question 51

In which phase of the security intelligence cycle is input collected from intelligence producers and consumers to improve the implementation of intelligence requirements?

A. Feedback
B. Analysis
C. Collection
D. Dissemination

Answer 51

A. Feedback

Explanation:
OBJ-2.1: The final phase of the security intelligence cycle is feedback and review, which utilizes intelligence producers’ and intelligence consumers’ input. This phase aims to improve the implementation of the requirements, collection, analysis, and dissemination phases as the life cycle is developed. The dissemination phase refers to publishing information produced by analysis to consumers who need to develop the insights. The analysis phase focuses on converting collected data into useful information or actionable intelligence. The collection phase is usually implemented by software suites, such as security information and event management (SIEM). This software must be configured with connectors or agents that can retrieve data from sources such as firewalls, routers, IDS sensors, and servers.

Question 52

Dion Training’s new COO is reviewing the organization’s current information security policy. She notices that it was first created three years ago. Since that time, the organization has undergone multiple audits and assessments that required revisions to the policy. Which of the following is the most reasonable frequency to conduct a formal review of the organization’s policies to ensure they remain up to date?

A. Monthly
B. Every five years
C. Annually
D. Quarterly

Answer 52

C. Annually

Explanation:
OBJ-4.1: Annual reviews are an industry standard and are typically sufficient unless circumstances happen that might require an update or revision sooner. Waiting five years between policy reviews is too long and would leave the organization with constantly outdated policies. Similarly, conducting quarterly or monthly reviews is too frequent, and there will not be enough time for substantial changes to have occurred. Additionally, most formal audits and assessments are undertaken annually. Therefore, this is a reasonable frequency to use without overburdening your staff.

Question 53

You are trying to connect to a router using SSH to check its configuration. Your attempts to connect to the device over SSH keep failing. You ask another technician to verify that SSH is properly configured, enabled on the router, and allows access from all subnets. She attempts to connect to the router over SSH from her workstation and confirms all the settings are correct. Which of the following steps might you have missed in setting up your SSH client preventing you from connecting to the router?

A. Change default credentials
B. Generate a new SSH key
C. Perform file hashing
D. Update firmware

Answer 53

B. Generate a new SSH key

Explanation:
OBJ-3.7: When configuring your SSH connection, you must ensure that a key is established between your client and the server. If you never set up an SSH key, you will need to generate a new key to get SSH to connect properly. Since the other technician was able to connect on her machine, we can rule out a SSH server issue, so it must be an issue with your account or client. The only option that relates solely to your account or client is the possibility that a key was not properly generated for your client.

Question 54

Your company has several small branch offices around the country, but you work as a network administrator at the centralized headquarters building. You need the capability of being able to remotely access any of the remote site’s routers to configure them without having to fly to each location in person. Your company’s CIO is worried that allowing remote access could allow an attacker to gain administrative access to the company’s network devices. Which of the following is the MOST secure way to prevent this from occurring while still allowing you to access the devices remotely?

A. Configure the remote router’s ACL to only permit Telnet traffic
B. Configure the remote router’s ACL to only HTTP Traffic
C. Create an out of band management network
D. Install an out of band modem

Answer 54

C. Create an out of band management network

Explanation:
OBJ-1.1: You should create an out-of-band management network and use an SSH (console) connection to reach the routers. Out-of-band (OOB) management is a method of remotely controlling and managing critical IT assets and network equipment using a secure connection through a secondary interface that is physically separate from the primary network connection. Telnet and HTTP are not encrypted channels and should not be used for remote connections. Using a modem is also a bad security practice since these are subject to war dialing and provide slow connectivity speeds.

Question 55

Susan, a help desk technician at Dion Training, has received several trouble tickets today related to employees receiving the same email as part of a phishing campaign. She has determined that the email’s malicious link is not being blocked by the company’s security suite when a user clicks the link. Susan asks you what action can be performed to prevent a user from reaching the website associated with the phishing email’s malicious link. What action do you recommend she utilize?

A. Forward this phishing email to all employees with a warning not to click on the embeedded links
B. BLock the IP address of thje malicious domain in your firewalls ACL
C. Add the malicious domain name to your content filter and web proxy’s block list
D. Enable TLS on your organization’s mail server

Answer 55

C. Add the malicious domain name to your content filter and web proxy’s block list

Explanation:
OBJ-1.1: To prevent a user from accessing the malicious website when the link is clicked, the malicious domain name should be added to the blocklist of the company’s content filter and web proxy. This will ensure that no devices on the network can reach the malicious domain name. While blocking the IP address associated with the domain name might help for a short period of time, the malicious domain’s owner could quickly redirect the DNS to point to a different IP. Then the users would still be able to access the malicious domain and its contents. Enabling TLS on the mail server will only encrypt the connection between the email server and its clients. Still, it will not prevent the users from clicking on the malicious link and accessing the malicious content. While informing the users that there is an active attempt at phishing being conducted against the organization is a good idea, forwarding the phishing email with the malicious link will generally cause more users to accidentally click on the malicious link, which further exacerbates the issue.

Question 56

James, a programmer at Apple Computers, is surfing the internet on his lunch break. He comes across a rumor site focused on providing details of the upcoming iPhone being released in a few months. James knows that Apple likes to keep its product details a secret until it is publicly announced. As James is looking over the website, he sees a blog post with an embedded picture of a PDF containing detailed specifications for the next iPhone and labeled “Proprietary Information – Internal Use Only.” The new iPhone is still several months away from release. What should James do next?

A. Contact the service desk or incident response team to detrermine what to do next
B. Contact his team lead and ask what he should do next
C. Reply to the blog post and deny the accuracy of the specifications
D. Contact the websites owner and request they take down thee PDF

Answer 56

A. Contact the service desk or incident response team to detrermine what to do next

Explanation:
OBJ-1.4: This is an example of either a data leak or a data breach. James is not sure how the website got the details of the product’s specifications. Therefore, he should follow his organizational procedures for notification that internal company information has been leaked to the internet. In most organizations, the service desk acts as the single point of contact for all IT issues (even possible data breaches), and they can refer James to the incident response team (if one is currently stood up). Since James works as a programmer, it is unlikely that his team lead is responsible for handling a data leak or data breach, so it is better to contact the service desk first. James should not contact the website directly nor reply to the blog post. Instead, he should leave the response actions to the security team and the incident response team.

Question 57

Dion Training provides its team members with a mobile device so that they can respond to questions when they are out of the office. To minimize the risk of a data leak, the organization has decided to purchase each employee a new iPhone, configured it using a mobile device management (MDM) solution, and had each employee sign an AUP that states they can only use the device for work-related purposes. Which of the following policies BEST describes Dion Training’s mobile device deployment model?

A. BYOD
B. COPE
C. COBO
D. CYOD

Answer 57

C. COBO

Explanation:
OBJ-3.1: Corporate Owned Business Only (COBO) is a mobile device deployment model that provides the employee with a corporate-owned device that may only be used for official work functions and purposes. Corporate Owned Personally Enabled (COPE) is a mobile device deployment model where the device remains the property of the organization, but certain personal use, such as private email, social networking, and web browsing, is also permitted. Choose Your Own Device (CYOD) is a mobile device deployment model where employees are offered a selection of corporate devices for work and, optionally, private use. Bring Your Own Device (BYOD) is a mobile device deployment model that facilitates the use of personally owned devices to access corporate networks and data.

Question 58

A student just connected to https://www.DionTraining.com for the first time. When the connection occurred, the student’s web browser requested a copy of the server’s digital certificate containing its public key. The client’s browser then encrypted a large random number using the server’s public key and sent that encrypted data to the server. The server then decrypted the data and used that large random number as a symmetric key for establishing a secure connection between the client’s web browser and the webserver. Which of the following certificate use cases is described by this scenario?

A. Server authentication
B. Digital signature
C. Client authentication
D. Code signing

Answer 58

A. Server authentication

Explanation:
OBJ-3.5: Server authentication is utilized by a client device when the client establishes that the server is genuine. For example, when visiting a new website, a client will use the web server’s digital certificate and public key to authenticate that the server they connected to is legitimate. Client authentication describes the mechanism by which a server can verify that a connection request is originating from a preauthorized endpoint. Client authorization is commonly used by SSH servers by storing a local copy of a client’s public SSH key on the SSH server and using this to authorize the client during a connection. Code signing is a method of using a digital signature to ensure the source and integrity of programming code. If a valid code signature exists, this indicates that the code has not been changed or modified since being released by the code’s author or publisher. A digital signature is created by encrypting the hash digest with the sender’s private key. For example, when digitally signing an email, the email is first hashed and then the hash is encrypted with the private key of the sender to prove its integrity and non-repudiation when sent.

Question 59

What popular open-source port scanning tool is commonly used for host discovery and service identification?

A. Nessus
B. service.msc
C. dd
D. nmap

Answer 59

D. nmap

Explanation:
OBJ-2.9: The world’s most popular open-source port scanning utility is nmap. The Services console (services.msc) allows an analyst to disable or enable Windows services. The dd tool is used to copy files, disks, and partitions, and it can also be used to create forensic disk images. Nessus is a proprietary vulnerability scanner developed by Tenable. While Nessus does contain the ability to conduct a port scan, its primary role is as a vulnerability scanner, and it is not an open-source tool.

Question 60

Which of the following is NOT a part of the security incident validation effort?

A. Scanning
B. Patching
C. Permissions
D. Sanitization

Answer 60

D. Sanitization

Explanation:
OBJ-2.7: Patching, permissions, scanning, and verifying logging are the components of the security incident validation effort. Sanitization is a component of the security incident eradication effort.

Question 61

A hacker successfully modified the sale price of items purchased through your company’s website. During the investigation that followed, the security analyst has verified the web server, and the Oracle database was not compromised directly. The analyst also found no attacks that could have caused this during their log verification of the Intrusion Detection System (IDS). What is the most likely method that the attacker used to change the items’ sale price?

A. Cross site scripting
B. Changing hidden from values
C. SQL Injection
D. Buffer overflow attack

Answer 61

B. Changing hidden from values

Explanation:
OBJ-2.5: Since there are no indications in the IDS logs, the database, or the server, it is most likely that the hacker changed hidden form values to change the items’ price in the shopping cart. A buffer overflow is an anomaly that occurs when a program overruns the buffer’s boundary and overwrites adjacent memory locations while writing data to a buffer. Cross-Site Scripting (XSS) attacks are a type of injection in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in a browser side script, to a different end-user. SQL injection is a code injection technique used to attack data-driven applications. Malicious SQL statements are inserted into an entry field for execution, such as dumping the database contents to the attacker.

Question 62

Which type of testing is used to test an individual block of code to ensure it works as expected?

A. Integration testing
B. CI/CD
C. Unit Testing
D. Regression testing

Answer 62

C. Unit Testing

Explanation:
OBJ-1.3: Unit testing is used to test a particular block of code performs the exact action intended and provides the exact output expected. Normally, unit testing is coded into the software using simply pass/no pass tests for each block of code. Integration testing is used to test individual components of a system together to ensure that they interact as expected. Regression testing is the process of testing an application after changes are made to see if these changes have triggered problems in older areas of code. Continuous integration/continuous delivery (CI/CD) is a software development methodology in which code updates are tested and committed to a development or build server/code repository rapidly.

Question 63

A popular game allows for in-app purchases to acquire extra lives in the game. When a player purchases the extra lives, the number of lives is written to a configuration file on the gamer’s phone. A hacker loves the game but hates having to buy lives all the time, so they developed an exploit that allows a player to purchase 1 life for $0.99 and then modifies the content of the configuration file to claim 100 lives were purchased before the application reading the number of lives purchased from the file. Which of the following type of vulnerabilities did the hacker exploit?

A. Deferencing
B. Race condition
C. Broken authentication
D. Sensitive data exposure

Answer 63

B. Race condition

Explanation:
OBJ-2.5: Race conditions occur when the outcome from execution processes is directly dependent on the order and timing of certain events. Those events fail to execute in the order and timing intended by the developer. In this scenario, the hacker’s exploit is racing to modify the configuration file before the application reads the number of lives from it. Sensitive data exposure is a fault that allows privileged information (such as a token, password, or PII) to be read without being subject to the proper access controls. Broken authentication refers to an app that fails to deny access to malicious actors. Dereferencing attempts to access a pointer that references an object at a particular memory location.

Question 64

Which of the following technologies could be used to ensure that users who log in to a network are physically in the same building as the network they are attempting to authenticate on? (SELECT TWO)

A. Geo-IP
B. NAC
C. Port security
D. GPS Location

Answer 64

B. NAC
D. GPS Location

Explanation:
OBJ-3.1: Network Access Control is used to identify an endpoint’s characteristics when conducting network authentication. The GPS location of the device will provide the longitude and latitude of the user, which could be compared against the GPS coordinates of the building. Port security enables an administrator to configure individual switch ports to allow only a specified number of source MAC addresses to communicate using a given switchport. This would not help to locate the individual based on their location, though. Geo-IP, or geolocation and country lookup of a host based on its IP address, would identify the country of origin of the user, but not whether they are within the building’s confines. Geo-IP is also easily tricked if the user logs in over a VPN connection.

Question 65

Which of the following is NOT a host-related indicator of compromise?

A. Memory consumption
B. Processor consumption
C. Beaconing
D. Drive capacity consumption

Answer 65

C. Beaconing

Explanation:
OBJ-2.2: Beaconing is considered a network-related indicator of compromise. Memory consumption, processor consumption, and drive capacity consumption are all classified as host-related indicators of compromise.

Question 66

Dion Training is trying to define key performance indicators for their recently released voucher management system. The CIO has stated that the voucher management system must be able to provide at least a 99.999% uptime as one of the KPIs. To monitor this requirement, the analysts have created a metric to measure the uptime for the system and will generate a report weekly with the average uptime maintained. Which of the following types of key performance indicators would this metric be classified as?

A. Usability
B. Availability
C. Reliability
D. Scalability

Answer 66

B. Availability

Explanation:
OBJ-4.1: Availability metrics measure the probability that a system will be operating as expected at any given point in time. The most common availability metric used is known as uptime. Scalability metrics measure the ability of a system to handle an increase in workload while maintaining a consistent level of performance. Reliability metrics measure the ability of a system to perform without error or to avoid, detect, and/or repair component or integrity failures. Usability metrics measure the effectiveness, efficiency, and satisfaction of users working with a given system.

Question 67

Rick is upset that he was passed over for a promotion. He decides to take revenge on his nemesis, Mary, who got the job instead of him. Rick sets up an on-path attack against Mary’s computer by redirecting any layer 2 traffic destined for the gateway to his computer first. Rick is careful only to affect the traffic associated with Mary’s computer and not the entire network. Which type of on-path attack is Rick conducting against Mary?

A. Evil twin
B. IP Spoofing
C. ARP poisoning
D. MAC spoofing

Answer 67

C. ARP poisoning

Explanation:
OBJ-2.5: Based on the scenario, we can eliminate evil twin (focused on wireless access points) and IP spoofing (since this affects layer 3 traffic). While MAC spoofing the gateway’s address might work, it would also affect every computer on this subnet. ARP poisoning (also known as ARP spoofing) is a type of attack in which a malicious actor sends falsified ARP (Address Resolution Protocol) messages over a local area network. This results in the linking of an attacker’s MAC address with the IP address of a legitimate computer or server on the network. By conducting an ARP spoofing, Rick can poison the cache and replace Mary’s computer’s MAC address and IP binding association with his own, allowing him to complete an on-path attack between Mary and the default gateway.

Question 68

Dave’s company utilizes Google’s G-Suite environment for file sharing and office productivity, Slack for internal messaging, and AWS for hosting their web servers. Which of the following cloud models type of cloud deployment models is being used?

A. Community
B. Public
C. Multi-cloud
D. Private

Answer 68

C. Multi-cloud

Explanation:
OBJ-1.6: Multi-cloud is a cloud deployment model where the cloud consumer uses multiple public cloud services. In this example, Dave is using the Google Cloud, Amazon’s AWS, and Slack’s cloud-based SaaS product simultaneously. A private cloud is a cloud that is deployed for use by a single entity. A public cloud is a cloud that is deployed for shared use by multiple independent tenants. A community cloud is a cloud that is deployed for shared use by cooperating tenants.

Question 69

Evaluate the following log entry:
Based on this log entry, which of the following statements are true?

A. The packet was blocked inbound to the network
B. Packets are being blocked inbound to and outbound from the network
C. An attempted connection to the telnet service was prevented
D. The packet was blocked outbound from the network
E. MAC Filtering is enabled on the firewall
F. An attempted connection to the ssh service was prevented

Answer 69

A. The packet was blocked inbound to the network
C. An attempted connection to the telnet service was prevented

Explanation:
OBJ-2.2: Firewall log formats will vary by vendors, but this example is a commonly used format from the Linux iptable firewall tool. This log starts with the date and time of the event and provides some key pieces of information. For example, the word “drop” shows the action this log entry recorded. In this case, the firewall dropped a packet due to an ACL rule being applied. You can also see that the packet was detected on the inbound connection over eth0, so we know that packets are being scanned and blocked when they are headed inbound to the network. Next, we see the MAC address of the source device of the packet, the source (SRC) IP address, and the destination (DST) IP address. Further down, we see the source (SPT) and destination ports (DPT). In this case, the DPT is 23 and is a well-known port for telnet. Based on this single log entry, we cannot tell if packets are also being blocked when they are attempting to leave the network or if they are blocking connections to the ssh service (port 22) is also being conducting.

Question 70

You just heard of a new ransomware attack that has been rapidly spreading across the internet that takes advantage of a vulnerability in the Windows SMB protocol. To protect your network until Microsoft releases a security update, you want to block the port for SMB at your firewall to prevent becoming a victim of this attack. Which of the following ports should you add to your blocklist?

A. 143
B. 123
C. 445
D. 514

Answer 70

C. 445

Explanation:
OBJ-2.2: Server Message Block (SMB) uses ports 139 and 445, and is a network file sharing protocol that runs on top of the NetBIOS architecture in Windows environments. When the WannaCry ransomware was spreading rapidly across the internet, you could help protect your organization’s network by blocking ports 139 and 445 at your firewall to prevent your machines from getting infected over the internet. Network Time Protocol (NTP) uses port 123 and is a networking protocol for clock synchronization between computer systems over packet-switched, variable-latency data networks. Internet Message Access Protocol (IMAP) uses port 143 and is an Internet standard protocol used by email clients to retrieve email messages from a mail server over a TCP/IP connection. System Logging Protocol (Syslog) uses port 514 and is a way network devices can use a standard message format to communicate with a logging server. It was designed specifically to make it easy to monitor network devices. Devices can use a Syslog agent to send out notification messages under a wide range of specific conditions.

Question 71

One of the routers in your network just failed. You have been asked to replace it with the same model router from the spare inventory closet as part of an emergency change request. You find the new router in the closet and notice it was signed into inventory 13 months ago. You install the router and attempt to enable HTTPS in the configuration to allow for remote access. The failed router had this capability, but this spare does not, even though they are the same model and were purchased at the same time. What should you do to enable HTTPS access for this router?

A. Update the firmware
B. Reboot the router
C. Enable HTTP instead
D. Perform a factory reset

Answer 71

A. Update the firmware

Explanation:
OBJ-3.2: Since the new router was pulled from your spare inventory closet, it is likely using an older and out-of-date version of the firmware. You should update the firmware for this router and then check if the HTTPS can be enabled again. Firmware updates to switches and routers provide both security updates and additional features that were not initially available. Since the device has been in the supply closet for 13 months, it is possible the HTTPS configuration was not included in the initial version and has been included in an updated firmware that was not applied to the spare router.

Question 72

You have been asked to scan your company’s website using the OWASP ZAP tool. When you perform the scan, you received the following warning:

“The AUTOCOMPLETE output is not disabled in HTML FORM/INPUT containing password type input. Passwords may be stored in browsers and retrieved.”

You begin to investigate further by reviewing a portion of the HTML code from the website that is listed below:
Based on your analysis, which of the following actions should you take?

A. You tell the developer to review their code and implement a bug/code fix
B. You recommend thatg the system administrator pushes out a GPO update to reconfigure the web browsers security settings
C. This is a false positive and you should implement a scanner exception to ensure you do not receive this again during your next scan
D. You recommend that the system administrator disables SSL on the server and implements TLS instead

Answer 72

A. You tell the developer to review their code and implement a bug/code fix

Explanation:
OBJ-2.4: Since your company owns the website, you can require the developer to implement a bug/code fix to prevent the form from allowing the AUTOCOMPLETE function to work on this website. The code change to perform is quite simple, simply adding “autocomplete=off” to the code’s first line. The resulting code would be <form action=”authenticate.php” autocomplete=”off”>.

Question 73

Dion Consulting Group is conducting an assessment on the Fail to Pass webservers. During the assessment, Melinda runs a test against their four servers to determine each server’s preferred cipher suite during an HTTPS/TLS 1.2 connection. One of the four servers responded with a weak cipher suite error. Which of the following four cipher suites is considered weak and needs to have its cryptographic implementation updated?

A. TLS_ECDHE_ECDSA_WITHAES128_GCM_SHA256
B.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
C. TLS_ECDHE_RSA_AES_256_GCM_SHA384
D. TLS_ECDHE_RSA_WITH_RC4_128_SHA

Answer 73

D. TLS_ECDHE_RSA_WITH_RC4_128_SHA

Explanation:
OBJ-3.7: A weak cipher suite error is generated if a website is configured to utilize old or deprecated cipher suites instead of newer and more modern cipher suites. Of the four options presented, the oldest and least secure is RC4. RC4 is an older stream cipher that is considered easily broken and should never be used in modern applications. RSA and DSA are considered secure for digital signatures if used with the Elliptic-Curve Diffie Hellman Key Exchange(ECDHE), while AES and CHACHA20 are considered secure for encryption.

Question 74

You have been asked to select the best endpoint security control to meet the following requirement. The endpoint is a server that will be running Internet Information Services (IIS) and configured to accept connections over ports 80 and 443. Which of the following should be installed to block all inbound network traffic to the endpoint except TCP traffic using ports 80 and 443?

A. Host baseed intrusion detection systems (HIDS)
B. Host-based firewall
C. User and entity behavior analytics (UEBA)
D. Endpoint detection and response

Answer 74

B. Host-based firewall

Explanation:
OBJ-3.2: A firewall is the best endpoint security control to utilize to block network traffic using specific ports or protocols. A host-based firewall is a firewall implemented as application software running on the host that provides sophisticated filtering of network traffic as well as block processes at the application level. Endpoint detection and response (EDR) is a software agent that collects system data and logs for analysis by a monitoring system to provide early detection of threats. User and entity behavior analytics (UEBA) is a type of cybersecurity application or appliance that identifies anomalous or malicious behavior by using machine learning and statistical analysis to identify deviations from normally established baselines and patterns of activity. A host-based intrusion detection system (HIDS) is a type of IDS that monitors a computer system for unexpected behavior or drastic changes to the system’s state.

Question 75

A firewall technician at Dion Training configures a firewall to allow HTTP traffic as follows:
Dion Training is afraid that an attacker might try to send other types of network traffic over port 80 to bypass their security policies. Which of the following should they implement to prevent unauthorized traffic from entering through the firewall?

A. HTTPS (SSL/TLS)
B. Stateless packet inspection
C. Stateful packet inspection
D. Application state firewall

Answer 75

D. Application state firewall

Explanation:
OBJ-1.1: An application-aware firewall can make decisions about what applications are allowed or blocked by a firewall, as opposed to simply using IP addresses and port numbers, by applications by inspecting the data contained within the packets. A stateless packet inspection firewall allows or denies packets into the network based on the source and destination IP address or the traffic type (TCP, UDP, ICMP, etc.). A stateful packet inspection firewall monitors the active sessions and connections on a network. The process of stateful inspection determines which network packets should be allowed through the firewall by utilizing the information it gathered regarding active connections as well as the existing ACL rules. Neither a stateless nor stateful inspection firewall operates at layer 6 or layer 7, so they cannot inspect the contents of the packet to ensure it contains HTTP traffic and not other types of network traffic. HTTPS (SSL/TLS) would allow for an encrypted communication path between the webserver and the client, but this would not prevent an attacker from sending other network protocol data over port 80 and bypassing the firewall rules.

Question 76

Which tool would allow you to identify the target’s operating system by analyzing the TCP/IP stack responses?

A. dd
B. scanf
C. nmap
D. OllyDbg

Answer 76

C. nmap

Explanation:
OBJ-2.9: The nmap tool can identify the target’s operating system by analyzing the TCP/IP stack responses. Identification of the operating system relies on differences in how operating systems and operating system versions respond to a query, what TCP options they support, what order they send the packets in, and other details that, when combined, can provide a unique fingerprint for a given TCP stack. The dd tool is used to create disk images. The scanf function is a vulnerable input function in the C programming language. OllyDbg is a Windows-based debugger used for binary code analysis.

Question 77

What type of weakness is John the Ripper used to test during a technical assessment?

A. Usernames
B. Firewall rulesets
C. File permissions
D. Passwords

Answer 77

D. Passwords

Explanation:
OBJ-2.4: John the Ripper is a free, open-source password cracking software tool. It tests the strength of passwords during a technical assessment. John the Ripper supports both dictionary and brute force attacks.

Question 78

You are conducting static analysis of an application’s source code and see the following:
If an attacker wanted to get a complete copy of the courses table and was able to substitute arbitrary strings for “id” and “certification”, which of the following strings allow this to occur?

A. id= “1’ OR ‘1’==’1” and certification = “cysa’ OR ‘1’==’1”
B. certification = “cysa’ OR ‘1’==’1”
C. id = “1’ OR ‘1’==’1” and certification = “cysa’ OR ‘1==’1”
D. id = “1’ OR ‘1’==’1”

Answer 78

A. id= “1’ OR ‘1’==’1” and certification = “cysa’ OR ‘1’==’1”

Explanation:
OBJ-2.5: ID and certification must be crafted so that when substituted for the “.getparameter” fields, the SQL statement formed is still complete and will return a Boolean value of true for the ENTIRE statement every time it is evaluated. The AND in the middle of the WHERE clause indicates that both the courseID and certification portion must be true in every case. When this occurs, the entire table of courses would be returned. The only string that would ensure both halves of the WHERE clause always return true would be <id = “1’ OR ‘1’ ==’1”. The other statements either would only partially be true or are using the incorrect number and placement of single quotes in the SQL statement so that an error is returned.

Question 79

Dion Consulting Group has recently been awarded a contract to provide cybersecurity services for a major hospital chain in 48 cities across the United States. Previously, the consultants have won numerous contracts with financial services and publicly traded companies, but they are new to the healthcare industry. Which of the following laws must the consultants review to ensure the hospital and its customers are fully protected?

A. GLBA
B. SOX
C. HIPAA
D. COSO

Answer 79

C. HIPAA

Explanation:
OBJ-4.3: The Health Insurance Portability and Accountability Act (HIPAA) was created primarily to modernize the flow of healthcare information, stipulate how Personally Identifiable Information maintained by the healthcare and healthcare insurance industries should be protected from fraud and theft, and address limitations on healthcare insurance coverage. This is a federal law that must be followed in the United States. The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and safeguard sensitive data. This includes companies that offer consumers financial products or services like loans, financial or investment advice, or insurance. The Sarbanes-Oxley Act of 2002 is a federal law that established sweeping auditing and financial regulations for public companies. Lawmakers created the legislation to help protect shareholders, employees, and the public from accounting errors and fraudulent financial practices. The Committee of Sponsoring Organizations of the Treadway Commission (COSO) guides governance-related topics, including fraud, controls, finance, and ethics. COSO’s ERM-integrated framework defines risk, and related common terminology lists key components of risk management strategies and supplies direction and criteria for enhancing risk management practices.

Question 80

Dion Training wants to purchase an email marketing solution to better communicate with their students. A promising new startup has a new offering to provide access to their product from a central location rather than requiring Dion Training to host the product on their internal network. Dion Training wants to ensure that their sensitive corporate information is not accessible by any startup’s other clients. Which type of cloud server should Dion Training look to purchase to meet these needs?

A. Private SaaS
B. Community IaaS
C. Public SaaS
D. Hybrid IaaS

Answer 80

A. Private SaaS

Explanation:
OBJ-1.6: SaaS (Software as a Service) is a cloud model whereby a service provider provides a software service and makes the service available to customers over the Internet. Examples of SaaS solutions include Microsoft Office 365, Microsoft Exchange Online, and Google Docs. Because of the concerns with sensitive corporate information being processed by the SaaS, Dion Training should ensure a Private SaaS is chosen. A private cloud is a particular model of cloud computing that involves a distinct and secure cloud-based environment in which only the specified client (Dion Training in this case) can operate. A public cloud contains services offered by third-party providers over the public Internet and is available to anyone who wants to use or purchase them. They may be free or sold on-demand, allowing customers to pay only per usage for the CPU cycles, storage, or bandwidth they consume. A community cloud is a collaborative effort in which infrastructure is shared between several organizations from a specific community with common concerns (security, compliance, jurisdiction, etc.), whether managed internally or by a third-party and hosted internally or externally. A hybrid cloud uses a mix of on-premises, private cloud, and third-party, public cloud services with orchestration between these platforms. This typically involves a connection from an on-premises data center to a public cloud.

Question 81

Your service desk has received many complaints from external users that a web application is responding slowly to requests and frequently receives a “connection timed out” error message when they attempt to submit information to the application. Which software development best practice should have been implemented to prevent this from occurring?

A. Input validation
B. Fuzzing
C. Stress testing
D. Regression testing

Answer 81

C. Stress testing

Explanation:
OBJ-1.2: Stress testing is a software testing activity that determines the robustness of software by testing beyond normal operating limits. Stress testing is essential for mission-critical software but can be used with all types of software. Stress testing is an important component of the capacity management process of IT service management. It ensures adequate resources are available to support the end user’s needs when an application goes into a production environment. Regression testing confirms that a recent program or code change has not adversely affected existing features. Input validation is the process of ensuring any user input has undergone cleansing to ensure it is properly formatted, correct, and useful. Fuzzing is an automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program.

Question 82

Which type of threat will patches NOT effectively combat as a security control?

A. Known vulnerabilities
B. Zero day attacks
C. Discovered software bugs
D. Malware with defined indicators of compromise

Answer 82

B. Zero day attacks

Explanation:
OBJ-3.2: Zero-day attacks have no known fix, so patches will not correct them. A zero-day vulnerability is a computer-software vulnerability that is unknown to, or unaddressed by, those who should be interested in mitigating the vulnerability (including the vendor of the target software). If a discovered software bug or known vulnerability is found, a patch or mitigation is normally available. If a piece of malware has well-defined indicators of compromise, a patch or signature can be created to defend against it, as well.

Question 83

Dion Consulting Group has recently received a contract to develop a networked control system for a self-driving car. The company’s CIO is concerned about the liability of a security vulnerability being exploited that may result in the death of a passenger or an innocent bystander. Which of the following methodologies would provide the single greatest mitigation if successfully implemented?

A DevSecOps
B. Rigorous user acceptance testing
C. Peer review of source code
D. Formal methods of verification

Answer 83

D. Formal methods of verification

Explanation:
OBJ-1.3: Formal verification methods use a mathematical model of the inputs and outputs of a system to prove that the system works as specified in all cases. Given the level of certainty achieved through formal verification methods, this approach provides the single greatest mitigation against this threat. Formal methods are designed for use in critical software in which corner cases must be eliminated. For example, what should the car do if a child jumps out in front of it, and the only way to avoid the child is to swear off the road (which might kill the driver)? This is a classic corner case that needs to be considered for a self-driving car. User acceptance testing (UAT) is a beta phase of software testing. When the developers have tested the software, it is installed to a limited set of users who follow test schemes and report findings. DevSecOps is a combination of software development, security operations, and systems operations and integrates each discipline with the others. Peer review of source code allows for the review of uncompiled source code by other developers. While DevSecOps, peer review, and user acceptance testing help bring down the system’s risk, only a formal method of verification could limit the liability involved with such a critical application as a self-driving car.

Question 84

Which of the following cloud infrastructures includes on-premise servers utilizing a centralized Syslog server hosted at a third-party organization to review the logs?

A. Community
B. Public
C. Hybrid
D. Private

Answer 84

C. Hybrid

Explanation:
OBJ-1.6: On-premise servers are an aspect of the private cloud, whereas Syslog hosted on a third-party server is an aspect of the public cloud. Since a hybrid cloud consists of any type of cloud computing sharing multiple aspects of different cloud infrastructure designs, hybrid is the correct answer. A community cloud is a collaborative effort in which infrastructure is shared between several organizations from a specific community with common concerns (security, compliance, jurisdiction, etc.), whether managed internally or by a third-party and hosted internally or externally. A public cloud contains services offered by third-party providers over the public Internet and is available to anyone who wants to use or purchase them. They may be free or sold on-demand, allowing customers to pay only per usage for the CPU cycles, storage, or bandwidth they consume. A private cloud contains services offered either over the Internet or a private internal network and only to select users instead of the general public.

Question 85

An analyst reviews a triple-homed firewall configuration that connects to the internet, a private network, and one other network. Which of the following would best describe the third network connected to this firewall?

A. Staging environment
B. Availability zone
C. Data zone
D. Screened subnet

Answer 85

D. Screened subnet

Explanation:
OBJ-1.1: A triple-homed firewall connects to three networks internal (private), external (internet/public), and a screened subnet (formerly called a demilitarized zone or DMZ). The screened subnet is used to host systems that require access from external hosts. Data zones describe the state and location of data to help isolate and protect it from unauthorized/inappropriate use-for example, as data transitions from raw storage, processing, production, and analytical use. Data zones are associated with data lakes and designed to help manage big data used by analysts and scientists for data exploration and discovery tasks. An availability zone is an individual data center within a region of a cloud service provider’s network. A staging environment is a pre-production enclave used for testing and development.

Question 86

While investigating a data breach, you discover that the account credentials used belonged to an employee who was fired several months ago for misusing company IT systems. The IT department never deactivated the employee’s account upon their termination. Which of the following categories would this breach be classified as?

A. Insider threat
B . Advanced persistent threat
C. Zero day
D. Known threat

Answer 86

A. Insider threat

Explanation:
OBJ-2.1: An insider threat is any current or former employee, contractor, or business partner who has or had authorized access to an organization’s network, system, or data and intentionally exceeded or misused that access in a manner that negatively affected the confidentiality, integrity, or availability of the organization’s information or information systems. Based on the details provided in the question, it appears the employee’s legitimate credentials were used to conduct the breach. This would be classified as an insider threat. A zero-day is a vulnerability in software unpatched by the developer or an attack that exploits such a vulnerability. A known threat is a threat that can be identified using a basic signature or pattern matching. An advanced persistent threat (APT) is an attacker with the ability to obtain, maintain, and diversify access to network systems using exploits and malware.

Question 87

A cybersecurity analyst at Yoyodyne Systems just finished reading a news article about their competitor, Whamiedyne Systems, being hacked by an unknown threat actor. Both companies sell to the same basic group of consumers over the internet since their products are used interchangeably by consumers. Which of the following is a valid cybersecurity concern for Yoyodyne Systems?

A. The attacker will conduct an on patch attack
B. They may now be vulnerable to a credential stuffing attack
C. The attacker will conduct a SQL injection against their database
D. The samee vulnerability will be compromised on their servers

Answer 87

B. They may now be vulnerable to a credential stuffing attack

Explanation:
OBJ-2.5: The largest and most immediate cybersecurity concern that the analyst should have is credential stuffing. Credential stuffing occurs when an attacker tests username and password combinations against multiple online sites. Since both companies share a common consumption group, it is likely that some of Yoyodyne’s consumers also had a user account at Whamiedyne. If the attackers compromised the username and passwords from Whamiedyne’s servers, they might attempt to use those credentials on Yoyodyne’s servers, too. There is no definitive reason to believe that both companies are using the same infrastructure. Therefore, the same vulnerability that was exploited by the attacker may not exist at Yoyodyne. The question doesn’t mention an SQL database. Therefore, there is no direct threat of an SQL injection. An on-path attack occurs when the attacker sits between two communicating hosts and transparently captures, monitors, and relays all communications between the host. Nothing in this question indicates that an on-path was utilized or is a possible threat.

Question 88

As a cybersecurity analyst conducting vulnerability scans, you have just completed your first scan of an enterprise network comprising over 10,000 workstations. As you examine your findings, you note that you have less than 1 critical finding per 100 workstations. Which of the following statement does BEST explain these results?

A. An uncredentialed scan of the network was performed
B. The network has an exceptionally strong security posture
C. The scanner failed to connect with the majority of workstations
D. The scanner was not compatible with the devices on your network

Answer 88

A. An uncredentialed scan of the network was performed

Explanation:
OBJ-2.3: Uncredentialed scans are generally unable to detect many vulnerabilities on a device. When conducting an internal assessment, you should perform an authenticated (credentialed) scan of the environment to most accurately determine the network’s vulnerability posture. In most enterprise networks, if a vulnerability exists on one machine, it also exists on most other workstations since they use a common baseline or image. If the scanner failed to connect to the workstations, an error would have been generated in the report.

Question 89

An attacker is searching in Google for Cisco VPN configuration files by using the filetype:pcf modifier. The attacker located several of these configuration files and now wants to decode any connectivity passwords that they might contain. What tool should the attacker use?

A. Nessus
B. Nmap
C. Netcat
D. Cain and Abel

Answer 89

D. Cain and Abel

Explanation:
OBJ-2.4: Cain and Abel (often abbreviated to Cain) is a popular password cracking tool. It can recover many password types using methods such as network packet sniffing, cracking various password hashes by using methods such as dictionary attacks, brute force, and cryptanalysis attacks. It also includes a module to conduct Cisco VPN Client Password Decoding too. CUPP is used to create password lists. Nessus is a vulnerability scanner. The netcat tool is used to create reverse shells for remote access.

Question 90

A cybersecurity analyst is reviewing the logs for his company’s server and sees the following output:
Based on this potential indicator of compromise (IoC), which of the following hypotheses should you make to begin threat hunting?

A. Unauthorized privileges are beeing utilized
B. Data exfiltration is occurring over the network
C. A common protocol is being used over a non standard port
D. Beaconinig ios establishing a connection to a C2 server

Answer 90

A. Unauthorized privileges are beeing utilized

Explanation:
OBJ-2.2: This appears to be an indication that unauthorized privileges are being used. The first binary, svchost.exe, executes from an odd location that indicates it might be malicious). The process svchost.exe doesn’t usually reside in the inetsrv folder in a Windows system since this folder contains the Windows IIS web server files. Additionally, this file then spawned a binary that appears to be masquerading as a Windows process, the WMI Provider Host called wmiprvse.exe. This appears to be the beginning of a privilege escalation attack. Based on the output above, there is no evidence that data is being exfiltrated or stolen from the network. Based on the output above, there is no evidence that any network protocol is currently used over a non-standard port. Finally, there is no evidence of beaconing or network activity in this output.