Udemy CASP Practice Exam 3

Question 1

Dion Training is creating a new website and needs to register a new digital certificate to support SSL/TLS connections to the server. When creating the digital certificate, Jason was required to publish a TXT record to the domain’s DNS records to validate that he owned the new domain name. Which of the following digital certificate types did he utilize in this scenario?

A. Wildcard
B. General purpose
C. Extended validation
D. Multidomain

Answer 1

B. General purpose

Explanation:
OBJ-3.5: General Purpose or Domain Validation (DV) digital certificates prove the ownership of a particular domain by responding to an email to the authorized domain contact or by publishing a text record to the domain’s DNS records. Extended Validation (EV) digital certificates are subject to a process that requires more rigorous checks on the subject’s legal identity and control over the domain or software being signed. A major drawback to EV certificates is that they cannot be issued for a wildcard domain. A wildcard certificate contains the wildcard character (*) in its domain name field and allows the digital certificate to be used for any number of subdomains. For example, the wildcard certificate of *.diontraining.com can be used for members.diontraining.com, cart.diontraining.com, and support.diontraining.com. A multidomain certificate is a single SSL/TLS digital certificate that can be used to secure multiple, different domain names. For example, if you want to install the same certificate on diontraining.com and yourcyberpath.com, you will need to register a multidomain certificate.

Question 2

Dion Training is joining a group of five other training organizations to work on a joint venture. Each organization has its own PKI implementations built around a single certificate authority at each organization. During the joint venture, the training organizations want to establish a trust relationship between all six of the certificate authorities so that users and devices from each organization can use resources from the other organizations during the project. This is a temporary project and the organizations involved do not want to have to issue new digital certificates to all of their users. Which of the following trust models would BEST meet these requirements?

A. Cross certification model
B. Bridge Model
C. Hierarchical model
D. Single CA model

Answer 2

B. Bridge Model

Explanation:
OBJ-3.5: A bridge model is most appropriate when connecting multiple organizations that each have a single CA architecture already configured. A bridge model is a trust model that allows a local CA to connect to a centralized bridge CA which maintains bilateral arrangements with the local CAs from other organizations. This model forms a star topology of trust, where all trust and verification occur through the central bridge node. A cross certification model is a trust model that allows a trust relationship to be established between two certification authorities. Cross certification allows users and devices of two organizations to be recognized by the other, regardless of which organization’s root CA signed their certificate. A hierarchical model allows a root certificate authority to trust multiple intermediate or subordinate certificate authorities in a parent/child relationship. Through this trust model, all members trust the root server and, therefore, they can also trust each other. A single CA is used to issue certificates to users and users only trust certificates issued by that CA.

Question 3

A company is implementing enhanced user authentication for system administrators accessing the company’s confidential servers. They intend to use two-factor authentication to accomplish this. Which of these BEST represents two-factor authentication?

A. ID Badge and Keys
B. Username and password
C. Fingerprint scanner and retina scan
D. Password and key fob

Answer 3

D. Password and key fob

Explanation:
OBJ-1.5: Two-factor authentication (also known as 2FA) is a method of confirming a user’s claimed identity by using a combination of two different factors: (1) something you know, (2) something you have, or (3) something you are. Out of the options provided, only a key fob (something you have) and a password (something you know) meet the requirements of 2FA. If you have two factors from the same type/category, like something you know (username and password), this is only considered a single factor of authentication.

Question 4

Your team is developing an update to a piece of code that allows customers to update their billing and shipping addresses in the web application. The shipping address field used in the database was designed with a limit of 75 characters. Your team’s web programmer has brought you some algorithms that may help prevent an attacker from trying to conduct a buffer overflow attack by submitting invalid input to the shipping address field. Which pseudo-code represents the best solution to prevent this issue?

A. if (shippingAddress !=75 {update field} else exit
B. if (shippingAddress = 75) {update field} else exit
C. if (shippingAddress <=75) {update field} else exit
D. if (shippingAddress >=75) {update field} else exit

Answer 4

C. if (shippingAddress <=75) {update field} else exit

Explanation:
OBJ-1.3: To ensure that the field is not overrun by an input that is too long, input validation must occur. Checking if the shipping address is less than or equal to 75 characters before updating the field will prevent a buffer overflow from occurring in this program. If the input is 76 characters or more, then the field will not be updated, and the algorithm will exit the function.

Question 5

The Dion Development Group is about to release a new Software as a Service (SaaS) tool to the marketplace. The company has utilized some third-party libraries in the development of their web application and has added compensating controls during the testing process to account for any insecurities in the third-party library. Which of the following terms best describes the type of risk this third-party library represents to the company?

A. Qualitative Risk
B. Quantitative Risk
C. Inherent Risk
D. Residual Risk

Answer 5

D. Residual Risk

Explanation:
OBJ-4.1: Residual risk is the risk that remains after compensating controls have been implemented. Inherent risk is the level of risk that exists before any compensating controls have been implemented. Qualitative risk describes the evaluation of risk using words instead of numbers and is much more subjective than quantitative risk analysis. Quantitative risk describes the evaluated risk using numbers, generally monetary values, to evaluate its potential impact. Risk tolerance is defined as the threshold that separates the different levels of risk within an organization.

Question 6

Dion Training is working on an internal development server while developing a new web application. The development server has been issued a self-signed digital certificate to use during testing. When Tim, a developer, connects to the web application over HTTPS, he receives an error that states “Your connection is not private”. Which of the following actions should Tim take to securely use the web application on the development server for testing on the company’s internal test and development network?

A. Connect to the web application on the development server using HTTP
B. Accept the self signed certificate as trusted in the clients browser
C. Ex tend the validity of the self signed certified from 1 year to 3 years
D. Uninstall the self signed certificate and request an EV certificate

Answer 6

B. Accept the self signed certificate as trusted in the clients browser

Explanation:
OBJ-3.7: A self-signed certificate is a certificate generated independently of a certificate authority and is considered not trustworthy. If this was a publicly available server or one used in a production network, you should uninstall the self-signed certificate and instead request a new digital certificate from a trusted third-party CA. An EV certificate should not be requested or used in this case due to the excessive costs involved. Extended Validation (EV) digital certificates are subject to a process that requires more rigorous checks on the subject’s legal identity and control over the domain or software being signed. The web application should not be used over HTTP since this would allow data sent to/from the server to be possibly intercepted by an on-path attack. The validity of the self-signed certificate does not need to be changed as it is already valid for use once accepted by the client’s web browser.

Question 7

Dion Training is trying to define key performance indicators for their recently released voucher management system. The CIO has stated that the voucher management system must be built on serverless architecture to support up to 1 million students per hour while maintaining a 3-second latency or less when issuing vouchers. To monitor this requirement, the analysts have created a metric to measure the number of students per hour using the system and another metric to measure the latency when issuing vouchers to those students. Which of the following types of key performance indicators would these metrics be classified as?

A. Availability
B. Usability
C. Reliability
D. Scalability

Answer 7

D. Scalability

Explanation:
OBJ-4.1: Scalability metrics measure the ability of a system to handle an increase in workload while maintaining a consistent level of performance. Reliability metrics measure the ability of a system to perform without error or to avoid, detect, and/or repair component or integrity failures. Availability metrics measure the probability that a system will be operating as expected at any given point in time. The most common availability metric used is known as uptime. Usability metrics measure the effectiveness, efficiency, and satisfaction of users working with a given system.

Question 8

Your company is setting up a system to accept credit cards in their retail and online locations. Which of the following compliance types should you be MOST concerned with dealing with credit cards?

A. GDPR
B. PII
C. PHI
D. PCI-DSS

Answer 8

D. PCI-DSS

Explanation:
OBJ-4.3: The Payment Card Industry Data Security Standard (PCI-DSS) applies to companies of any size that accept credit card payments. If your company intends to accept card payment and store, process, and transmit cardholder data, you need to securely host your data and follow PCI compliance requirements. The General Data Protection Regulation (GDPR) is a regulation created in the European Union that creates provisions and requirements to protect the personal data of European Union (EU) citizens. Transfers of personal data outside the EU Single Market are restricted unless protected by like-for-like regulations, such as the US’s Privacy Shield requirements. Personally identifiable information (PII) is data used to identify, contact, or locate an individual. Information such as social security number (SSN), name, date of birth, email address, telephone number, street address, and biometric data is considered PII. Protected health information (PHI) refers to medical and insurance records, plus associated hospital and laboratory test results.

Question 9

You are reviewing a rule within your organization’s IDS. You see the following output:
Based on this rule, which of the following malicious packets would this IDS alert on?

A. Any malicious inbound packets
B. A malicious outbound TCP packet
C. A malicious inbound TCP packet
D. Any malicious outbound packets

Answer 9

C. A malicious inbound TCP packet

Explanation:
OBJ-3.2: The rule header is set to alert only on TCP packets based on this IDS rule’s first line. The flow condition is set as “to_client,established,” which means that only inbound traffic will be analyzed against this rule and only inbound traffic for connections that are already established. Therefore, this rule will alert on an inbound malicious TCP packet only when the packet matches all the conditions listed in this rule. This rule is an example of a Snort IDS rule. For the exam, you do not need to create your own IDS rules, but you should be able to read them and pick out generic content like the type of protocol covered by the signature, the port to be analyzed, and the direction of flow.

Question 10

Which of the following types of digital forensic investigations is most challenging due to the on-demand nature of the analyzed assets?

A. Cloud services
B. Employee workstations
C. On premise Servers
D. Mobile Devices

Answer 10

A. Cloud services

Explanation:
OBJ-3.4: The on-demand nature of cloud services means that instances are often created and destroyed again, with no real opportunity for forensic recovery of any data. Cloud providers can mitigate this to some extent by using extensive logging and monitoring options. A CSP might also provide an option to generate a file system and memory snapshots from containers and VMs in response to an alert condition generated by a SIEM. Employee workstations are often the easiest to conduct forensics on since they are a single-user environment for the most part. Mobile devices have some unique challenges due to their operating systems, but good forensic tool suites are available to ease the forensic acquisition and analysis of mobile devices. On-premise servers are more challenging than a workstation to analyze, but they do not suffer from the same issues as cloud-based services and servers.

Question 11

John is a cybersecurity consultant that wants to sell his services to an organization. In preparation for his first meeting with the client, John wants to conduct a vulnerability scan of their network to show the client how much they need his services. What is the most significant issue with John conducting this scan of the organization’s network?

A. The IP range of the client systems is unknown by John
B. John does not have permissions to perform the scan
C. The clients infrastructure design to unknown to John
D. John does not know what operating system and applications are in use

Answer 11

B. John does not have permissions to perform the scan

Explanation:
OBJ-2.4: All options listed are an issue, but the most significant issue is that John does not have the client’s permission to perform the scan. A vulnerability scan may be construed as a form of reconnaissance, penetration testing, or even an attack on the organization’s systems. A cybersecurity analyst should never conduct a vulnerability scan on another organization’s network without explicit written permission. In some countries, a vulnerability scan against an organization’s network without their permission is considered a cybercrime and could result in jail time for the consultant.

Question 12

In which phase of the security intelligence cycle do system administrators capture data to identify anomalies of interest?

A. Dissemination
B. Analysis
C. Feedback
D. Collection

Answer 12

D. Collection

Explanation:
OBJ-2.1: The collection phase is usually implemented by administrators using various software suites, such as security information and event management (SIEM). This software must be configured with connectors or agents that can retrieve data from sources such as firewalls, routers, IDS sensors, and servers. The analysis phase focuses on converting collected data into useful information or actionable intelligence. The dissemination phase refers to publishing information produced by analysis to consumers who need to develop the insights. The final phase of the security intelligence cycle is feedback and review, which utilizes both intelligence producers’ and intelligence consumers’ input. This phase aims to improve the implementation of the requirements, collection, analysis, and dissemination phases as the life cycle develops.

Question 13

Which of the following has occurred if a device fails to activate because it has detected an unknown modification?

A. Self-checking
B. Obfuscation
C. Improper authentication
D. Failed trusted foundry

Answer 13

A. Self-checking

Explanation:
OBJ-3.3: NIST defines self-checking behavior as a control used to prohibit elicit modification to hardware components. This can be done using anti-tamper technology like a field-programmable gate array (FPGA), a physically unclonable function (PUF), or other techniques. Obfuscation is the act of making something obscure, unclear, or unintelligible. Usually, this is done by encoding strings or binary information to make it less detectable by signature-based detection mechanisms. Improper authentication occurs when an attacker claims to have a given identity, and the software does not prove or insufficiently prove that the claim is correct. The Trusted Foundry Program, also called the trusted supplier program, is a United States Department of Defense program designed to secure the manufacturing infrastructure for information technology vendors providing hardware to the military.

Question 14

Trevor is responsible for conducting vulnerability scans for his organization. His supervisor must produce a monthly report for the CIO that includes the number of open vulnerabilities. What process should Trevor use to ensure the supervisor gets the information needed for their monthly report?

A. Run a report each month and then email to his supervisor
B. Create an account for the supervisors assistant so they can create the reports
C. Create an account for the supervisor to the vulnerability scanner so they can run the reports themselves
D. Create a custom report that is automatically emailed each month to the supervisor with the needed information

Answer 14

D. Create a custom report that is automatically emailed each month to the supervisor with the needed information

Explanation:
OBJ-2.3: The best solution is to design a report that provides all necessary information and configure it to send this report to the supervisor each month automatically. It is not a good practice to create additional accounts on the vulnerability scanner beyond what is necessary per the concept of least privilege. It is also inefficient for Trevor to run the reports each month and then email them to his supervisor. When possible, the use of automation should be encouraged.

Question 15

If an attacker can compromise an Active Directory domain by utilizing an attack to grant administrative access to the domain controllers for all domain members, which type of attack is being used?

A. Lateral movement
B. Pass the hash
C. Golden ticket
D. Pivoting

Answer 15

C. Golden ticket

Explanation:
OBJ-2.5: A golden ticket is a Kerberos ticket that can grant other tickets in an Active Directory environment. Attackers who can create a golden ticket can use it to grant administrative access to other domain members, even to domain controllers. Pass the Hash (PtH) is the process of harvesting an account’s cached credentials when the user logs in to a single sign-on (SSO) system. This would then allow the attacker to use the credentials on other systems, as well. Lateral movement is an umbrella term for a variety of attack types. Attackers can extend their lateral movement by a great deal if they can compromise host credentials. Pivoting is a process similar to lateral movement. When attackers pivot, they compromise one central host (the pivot) that allows them to spread out to other hosts that would otherwise be inaccessible.

Question 16

Sarah has reason to believe that systems on her network have been compromised by an APT. She has noticed many file transfers outbound to a remote site via TLS-protected HTTPS sessions from unknown systems. Which of the following techniques would most likely detect the APT?

A. Endpoint forensics
B. Network traffic analysis
C. Network forensics
D. Endpoint behavior analysis

Answer 16

A. Endpoint forensics

Explanation:
OBJ-2.7: An advanced persistent threat (APT) is a stealthy computer network threat actor, typically a nation-state or state-sponsored group, which gains unauthorized access to a computer network and remains undetected for an extended period. APTs usually send encrypted traffic so that they are harder to detect through network traffic analysis or network forensics. This means that you need to focus on the endpoints to detect an APT. Unfortunately, APTs are very sophisticated, so endpoint behavioral analysis is unlikely to detect them easily, so Sarah will need to conduct endpoint forensics as her most likely method to detect an APT and their associated infections on her systems.

Question 17

Your Security Operations Center is experiencing a backlog of threat intelligence to analyze. The SOC Director has recommended that you investigate using emerging technologies to perform accurate correlations between various threat intelligence sources and traffic being observed on the production network. Which of the following emerging technologies should you select?

A. Natural Language Processing
B. Deep Fakes
C. Machine Learning
D. Artificial Intelligence

Answer 17

D. Artificial Intelligence

Explanation:
OBJ-1.8: Artificial Intelligence is the science of creating machines to develop problem-solving and analysis strategies without significant human direction or intervention. A machine learning (ML) system uses a computer to accomplish a task without being explicitly programmed. In the context of cybersecurity, ML generally works by analyzing example data sets to create its own ability to classify future items presented. If the system was presented with large datasets of malicious and benign traffic, it will learn which is malicious and categorize future traffic presented to it. Machine Learning is useful for categorizations and classifications, but it is not as sophisticated as artificial intelligence in terms of data correlation. A deep fake is a realistic video or audio that impersonates a real person. Deep fakes are created using deep learning technology. Natural language processing (NLP) is a type of deep learning focused on understanding and responding to human language.

Question 18

What SCAP component provides a list of entries that contains an identification number, a description, and a public reference for each publicly known weakness in a piece of software?

A. CPE
B. CCE
C. CVE
D. XCCDF

Answer 18

C. CVE

Explanation:
OBJ-2.3: The Common Vulnerabilities and Exposures (CVE) system provides a reference method for publicly known information-security vulnerabilities and exposures. XCCDF (extensible configuration checklist description format) is a language that is used in creating checklists for reporting results. The Common Configuration Enumeration (CCE) provides unique identifiers to system configuration issues to facilitate fast and accurate correlation of configuration data across multiple information sources and tools. Common Platform Enumeration (CPE) is a standardized method of describing and identifying classes of applications, operating systems, and hardware devices present among an enterprise’s computing assets.

Question 19

Which of the following services should you install to connect multiple remote branch offices to your cloud service provider’s virtual private cloud (VPC) using an IPSec site-to-site connection?

A. API Gateway
B. VPN Gateway
C. NAT Gateway
D. XML Gateway

Answer 19

B. VPN Gateway

Explanation:
OBJ-1.1: A VPN gateway is a type of networking device that connects two or more devices or networks in a VPN infrastructure. It is designed to bridge the connection or communication between two or more remote sites, networks, or devices and/or to connect multiple VPNs. An extensible markup language (XML) gateway acts as an application layer firewall specifically to monitor XML formatted messages as they enter or leave a network or system. An XML gateway is used for inbound pattern detection and the prevention of outbound data leaks. XML is a document structure that is both human and machine-readable. Information within an XML document is placed within tags that describe how the information within the document is structured. Application programming interface (API) gateway is a special cloud-based service that is used to centralize the functions provided by APIs. An API is a type of software interface that offers a service to other pieces of software to build or connect to specific functions or features. A NAT Gateway within a cloud platform allows private subnets in a Virtual Private Cloud (VPC) access to the Internet.

Question 20

Dion Training Solutions has received proposals from four suppliers to install a new data loss prevention (DLP) system and contractors to operate it. The cost of each full-time equivalent (FTE) position to operate the system costs $75,000 per year. Supplier Alpha’s system will require 3 FTE positions to operate and costs $100,000 for licensing and maintenance fees per year. Supplier Bravo’s system will require 2 FTE positions to operate and costs $150,000 for licensing and maintenance fees per year. Supplier Charlie’s system will require 4 FTE positions to operate and costs $50,000 for licensing and maintenance fees per year. Supplier Delta’s system will require 1 FTE position to operate and costs $250,000 for licensing and maintenance fees per year. If all of the data loss prevention systems would provide equivalent security, which supplier’s system would provide the lowest TCO?

A. Supplier Delta
B. Supplier Alpha
C. Supplier Charlie
D. Supplier Bravo

Answer 20

D. Supplier Bravo

Explanation:
OBJ-4.1: Supplier Bravo would have the lowest TCO with a value of $300,000 per year. The total cost of ownership (TCO) is the associated costs of an asset including acquisition costs and costs to maintain and safely operate the asset over its entire lifespan. Since the DLP system in this scenario will be charged under a SaaS model using yearly contract labor, licensing, and maintenance fees, you can calculate the TCO simply by comparing one year of each supplier’s fees against the others. Supplier Alpha’s TCO would equal 3 FTEs ($225,000) plus $100,000 (licensing/maintenance fee) which equals $325,000. Supplier Bravo’s TCO would equal 2 FTEs ($150,000) plus $150,000 (licensing/maintenance fee) which equals $300,000. Supplier Charlie’s TCO would equal 4 FTEs ($300,000) plus $50,000 (licensing/maintenance fee) which equals $350,000. Supplier Delta’s TCO would equal 1 FTEs ($75,000) plus $250,000 (licensing/maintenance fee) which equals $325,000.

Question 21

Which of the following Nmap commands would scan DionTraining.com and probe any open ports to determine the versions of the running services on those ports?

A. nmap -sV DionTraining.com
B. nmap -sS DionTraining.com
C. nmap -sT DionTraining.com
D. nmap -sL DionTraining.com

Answer 21

A. nmap -sV DionTraining.com

Explanation:
OBJ-2.9: The -sV option will scan the target by probing all the open ports to determine the service version they are running. The -sS option will scan the target using a TCP SYN packet and conduct a half-open scan. The -sT option will scan the target by conducting a full TCP 3-way handshake. The -sU option will scan the target by conducting a UDP scan.

Question 22

Your company has decided to move all of its data into the cloud. Your company is small and has decided to purchase some on-demand cloud storage resources from a commercial provider (such as Google Drive) as its primary cloud storage solution. Which of the following types of clouds is your company using?

A. Private
B. Public
C. Hybrid
D. Community

Answer 22

B. Public

Explanation:
OBJ-1.6: The public cloud is defined as computing services offered by third-party providers over the public internet, making them available to anyone who wants to use or purchase them. They may be free or sold on-demand, allowing customers to pay only per usage for the CPU cycles, storage, or bandwidth they consume. Amazon Web Services, Microsoft Azure, and Google Cloud are three popular public cloud platforms. A private cloud contains services offered either over the Internet or a private internal network and only to select users instead of the general public. A community cloud is a collaborative effort in which infrastructure is shared between several organizations from a specific community with common concerns (security, compliance, jurisdiction, etc.), whether managed internally or by a third party and hosted internally or externally. A hybrid cloud is a cloud computing environment that uses a mix of on-premises, private cloud, and third-party public cloud services with orchestration between these platforms. This typically involves a connection from an on-premises data center to a public cloud.

Question 23

Fail to Pass is concerned about the possibility of an on-path attack being conducted against their students when trying to connect to the company’s web server. Several years ago, their web developer implemented a technique that embedded the certificate data in the HTTP header and presented it to the student’s web browser when they connected to the webserver. Unfortunately, this technique is now considered vulnerable and deprecated, but Fail to Pass has not bothered to upgrade its code. Which of the following techniques is Fail to Pass most likely using?

A. HSTS
B. Secure cookies
C. Certificate pinning
D. Wildcard certificate

Answer 23

C. Certificate pinning

Explanation:
OBJ-3.5: Certificate pinning is a deprecated method of trusting digital certificates that bypasses the CA hierarchy and chain of trust to minimize on-path (formerly man-in-the-middle) attacks. Certificate pinning with HTTP Public Key Pinning (HPKP) embeds the server’s certificate data into the HTTP header when sending the data to the web browser. Certificate pinning should be replaced with HSTS to provide resistance to an on-path attack. HTTP Strict Transport Security (HSTS) is configured as a response header on a web server and notifies a browser to connect to the requested website using HTTPS only. HSTS helps prevent on-path and downgrade attacks. Secure cookies are a type of HTTP cookie that has the Secure attribute set, which limits the scope of the cookie to secure channels. When a cookie has the Secure attribute, the user agent will include the cookie in an HTTP request only if the request is transmitted over a secure channel. A wildcard certificate contains the wildcard character (*) in its domain name field and allows the digital certificate to be used for any number of subdomains. For example, the wildcard certificate of *.diontraining.com can be used for members.diontraining.com, cart.diontraining.com, and support.diontraining.com.

Question 24

A hospital’s file server has become infected with malware. The files on the server all appear to be encrypted and cannot be opened. The network administrator receives an email from the attacker asking for 20 bitcoin in exchange for the decryption key. Which type of malware MOST likely infected these computers?

A. Spyware
B. Rootkit
C. Keylogger
D. Ransomware

Answer 24

D. Ransomware

Explanation:
OBJ-2.7: Ransomware is a type of malware designed to deny access to a computer system or data until a ransom is paid. Ransomware typically spreads through phishing emails or by unknowingly visiting an infected website. Once infected, a system or its files are encrypted, and then the decryption key is withheld from the victim unless payment is received. Spyware is a program that monitors user activity and sends the information to someone else. It may be installed with or without the user’s knowledge. It invades the device, steals sensitive information and internet usage data, and relays it to advertisers, data firms, or external users. A keylogger actively attempts to steal confidential information by capturing the data when entered into the computer by the user. This is done by recording keystrokes entered into a web browser or other application. A software keylogger can be run in the background on a victim’s computer. A hardware keylogger may be placed between the USB port and the wired keyboard. A rootkit is a clandestine computer program designed to provide continued privileged access to a computer while actively hiding its presence. A rootkit is generally a collection of tools that enabled administrator-level access to a computer or network. They can often disguise themselves from detection by the operating system and anti-malware solutions. If a rootkit is suspected on a machine, it is best to reformat and reimage the system.

Question 25

Which of the following features of homomorphic encryption allows two parties to jointly evaluate a private function without revealing their respective inputs?

A. Private Information Retrieval
B. Secure Multi Party Computation
C. Private Function Evaluation
D. Secure Function Evaluation

Answer 25

C. Private Function Evaluation

Explanation:
OBJ-1.8: Private Function Evaluation (PFE) allows two parties to jointly evaluate a private function without revealing their respective inputs. Secure Function Evaluation (SFE) allows two parties to jointly evaluate a publicly known function without revealing their respective inputs. Private Information Retrieval (PIR) retrieves an item from a service in possession of a database without revealing which item is retrieved. Secure Multi-Party Computation creates methods for parties to jointly compute a function over their inputs while keeping those inputs private.

Question 26

(Sample Simulation – On the real exam for this type of question, you would have access to the log files to determine which server on a network might have been affected, and then choose the appropriate actions.) A cybersecurity analyst has determined that an attack has occurred against your company’s network. Fortunately, your company uses a good logging system with a centralized Syslog server, so all the logs are available, collected, and stored properly. According to the cybersecurity analyst, the logs indicate that the database server was the only company server on the network that appears to have been attacked. The network is a critical production network for your organization. Therefore, you have been asked to choose the LEAST disruptive actions on the network while performing the appropriate incident response actions. Which actions do you recommend as part of the response efforts?

A. Immediately remove the database server from the network. create an image of its hard disk, and maintain the chain of custody
B. Isolate the affected server from the network immediately, format the database server, reinstall from a known good backup
C. Capture network traffic using a sniffer, schedule a period of downtime to image and remediate the affected server and maintain the chain of custody
D. Conduct a system restore of the database server, image the hard drive and maintain the chain of custody

Answer 26

C. Capture network traffic using a sniffer, schedule a period of downtime to image and remediate the affected server and maintain the chain of custody

Explanation:
OBJ-2.7: Since the database server is part of a critical production network, it is important to work with the business to time the remediation period to minimize productivity losses. You can immediately begin to capture network traffic since this won’t affect the database server or the network (least intrusive) while scheduling a period of downtime in which to take a forensic image of the database server’s hard drive. All network captures and the hard drive should be maintained under the chain of custody if needed for criminal prosecution or civil action after remediation. The server should be remediated and brought back online once the hard drive image has been created.

Question 27

Which of the following is the most difficult to confirm with an external vulnerability scan?

A. Cross site scripting (XSS)
B. Blind SQL injection
C. Unpatched web server
D. Cross site request forgery (XSRF/CSRF)

Answer 27

B. Blind SQL injection

Explanation:
OBJ-2.3: Vulnerability scanners typically cannot confirm that a blind SQL injection with the execution of code has previously occurred. XSS and CSRF/XSRF are typically easier to detect because the scanner can pick up information that proves a successful attack. The banner information can usually identify unpatched servers.

Question 28

Which of the following layers is NOT used in a three-tiered data center network architecture?

A. Access/edge layer
B. Distribution/aggregation layer
C. Control layer
D. Core layer

Answer 28

C. Control layer

Explanation:
OBJ-1.1: The control layer is used in software-defined networking (SDN), not the three-tiered data center network architecture. The Core Layer is considered the backbone of our network and is used to merge geographically separated networks back into one logical and cohesive unit. In general, you will have at least two routers at the core level, operating in a redundant configuration. The distribution or aggregation layer is located under the core layer and it provides boundary definition by implementing access lists and filters to define the policies for the network at large. The access or edge layer is located beneath the distribution or aggregation layer and is used to connect all the endpoint devices like computers, laptops, servers, printers, wireless access points, and others.

Question 29

Which of the following options places the correct phases of the Software Development Lifecycle’s waterfall method in the correct order?

A. Planning, requirements analysis, design, implementation, testing, deployment, and maintenance
B. Requirements analysis, planning, design, implementation, testing, deployment and maintenance
C. Requirements analysis, planning, design, implementation, deployment, testing, maintenance
D. Planning, requirements analysis, design, implementation, deployment, testing, maintenance

Answer 29

A. Planning, requirements analysis, design, implementation, testing, deployment, and maintenance

Explanation:
OBJ-1.3: The software development lifecycle (SDLC) can be conducted using waterfall or agile methods. The waterfall method moves through seven phases: planning, requirements, design, implementation, testing, deployment, and maintenance. Planning involves training the developers and testers in security issues, acquiring security analysis tools, and ensuring the development environment’s security. Requirements analysis is used to determine security and privacy needs in terms of data processing and access controls. Design identifies threats and controls or secure coding practices to meet the requirements. Implementation performs known environment source code analysis and code reviews to identify and resolve vulnerabilities. Testing performs known or unknown environment testing to test for vulnerabilities in the published application and its publication environment. Deployment installs and operates the software packages and best practice configuration guides. Maintenance involves ongoing security monitoring and incident response procedures, patch development and management, and other security controls. For a question like this on the real certification exam, you may be asked to drag and drop the seven steps into the proper order instead of receiving this as a multiple-choice question.

Question 30

Dion Training is creating a new security policy that states all access to system resources will be controlled based on the user’s job functions and tasks within the organization. For example, only people working in Human Resources can access employee records, and only the people working in finance can access customer payment histories. Which of the following policies or security practices is BEST described by this new policy?

A. Job rotation
B. Mandatory vacation
C. Least privilege
D. Separation of duties

Answer 30

C. Least privilege

Explanation:
OBJ-4.1: Least privilege is a security policy that states someone or something should be allocated the minimum necessary rights, privileges, or information to perform the specific role. Separation of duties is a security policy that states that duties and responsibilities should be divided among individuals to prevent ethical conflicts or abuse of powers. Job rotation is a security policy that prevents any one individual from performing the same role or tasks for too long. Job rotation is useful in deterring fraud and providing better oversight of the person’s duties. Mandatory vacation is a security policy that states when and how long an employee must take time off from work so that their activities may be subjected to a security review by having another employee conduct their job functions.

Question 31

Which of the following utilizes a well-written set of carefully developed and tested scripts to orchestrate runbooks and generate consistent server builds across an enterprise?

A. Software Defined Networking (SDN)
B. Infrastructure as a Service (IaaS)
C. Infrastructure as Code (IaC)
D. Software as a Service (SaaS)

Answer 31

C. Infrastructure as Code (IaC)

Explanation:
OBJ-3.4: Infrastructure as Code (IaC) is designed with the idea that a well-coded description of the server/network operating environment will produce consistent results across an enterprise and significantly reduce IT overhead costs through automation while precluding the existence of security vulnerabilities. SDN uses software to define networking boundaries but does not necessarily handle server architecture in the same way that IaC can. Infrastructure as a Service (IaaS) is a computing method that uses the cloud to provide any or all infrastructure needs. Software as a Service (SaaS) is a computing method that uses the cloud to provide users with application services.

Question 32

Dion Training has noticed an increase in trouble tickets from students stating they are receiving a “Your connection is not private” error when connecting to the company’s homepage. Vikas is investigating the issue and believes it is a problem between the webserver and the student’s web browsers. Vikas determined that the issue only occurs when students attempt to connect using the older Internet Explorer web browser on a Windows 7 client machine. If those same students attempt to log in using their newer smartphones, though, they can connect securely. Which of the following is MOST likely causing this error?

A. Incorrect permissions
B. Cipher mismatch error
C. Chain issues
D. Wrong certificate type

Answer 32

B. Cipher mismatch error

Explanation:
OBJ-3.7: The most likely cause of the issue is a cipher mismatch caused by using an older web browser and operating system. A cipher mismatch error is generated by a modern web browser if an old or deprecated cipher suite is being requested for use by the webserver. Alternatively, this error can also occur if the client is using an older operating system that doesn’t support a more modern cipher suite. An incorrect permissions error is generated when a template is used for certificate enrollment but the template’s permissions are misconfigured. This can result in a “cannot enroll for this type of certificate” or an “operation failed” error. Chain issues occur when the root, subordinate, or leaf certificate fails to pass a validity check. Since the certificate authorities must all pass the validity checks for the certification issued to be considered valid, if any of these are invalid then the entire chain is considered invalid, too. A wrong certificate type error is generated when a certificate designed for a specific use case is used for a different reason. For example, if a user attempts to log in to a website using an email certificate instead of an identification certificate, a wrong certificate type error will be generated.

Question 33

You are reverse engineering a piece of malware recovered from a retailer’s network for analysis. They found that the malicious code was extracting track data from their customer’s credit cards during processing. Which of the following types of threats would you classify this malware as?

A. POS malware
B. Keylogger
C. Rootkit
D. Ransomwaree

Answer 33

A. POS malware

Explanation:
OBJ-2.7: Point-of-sale malware (POS malware) is usually a type of malicious software (malware) that is used by cybercriminals to target point of sale (POS) and payment terminals with the intent to obtain credit card and debit card information, a card’s track 1 or track 2 data and even the CVV code, by various man-in-the-middle attacks, that is the interception of the processing at the retail checkout point of sale system. Ransomware is a type of malware that threatens to publish the victim’s data or perpetually block access to it unless a ransom is paid. Keyloggers are a type of monitoring software designed to record keystrokes made by a user. These keyloggers can record the information you type into a website or application and send it back to an attacker. A rootkit is a malware class that modifies system files, often at the kernel level, to conceal its presence.

Question 34

Due to numerous network misconfiguration issues in the past, Dion Training adopted a policy that requires a second technician to verify any configuration changes before they are applied to a network device. When the technician inspects a newly proposed configuration change from a coworker, she determines that it would improperly configure the AS number on the device. Which of the following issues could have resulted from this configuration change if it was applied?

A. Spanning tree ports would have entered flooding mode
B. BGP routing issues would have occurred
C. Wireless coverage area would be decreased
D. A frequency mismatch would have occurred

Answer 34

B. BGP routing issues would have occurred

Explanation:
OBJ-1.1: BGP (Border Gateway Protocol) is used to route data between autonomous systems (AS). A collection of networks within the same administrative domain is called an autonomous system (AS). The routers within an AS to use an interior gateway protocol, such as the Routing Information Protocol (RIP) or the Open Shortest Path First (OSPF) protocol, exchange routing information among themselves. Autonomous systems operate at layer 3 and are focused on wired networks. Therefore, the frequency mismatch, decreased wireless coverage areas, and spanning tree ports would not be affected by the improper configuration of an AS number on a device.

Question 35

Dion Training issues two different digital certificates for each team member and embeds them onto a smart card. One of the digital certificates is used for identity verification while the second is used for the digital signing of the team member’s emails. Jason is trying to log in to the SharePoint server on the company’s intranet using his smart card. When he clicks the login button, a window pops up asking for him to select a certificate from his smart card. Jason selects a certificate and then receives an error stating “Your session could not be established. Access was denied by the access policy.” Which of the following is MOST likely causing this error?

A. A chain issue occurred with intermediate CA
B. The incorrect name is on the certificate
C. The wrong certificate type was presented
D. There is a validity date error on the certificate

Answer 35

C. The wrong certificate type was presented

Explanation:
OBJ-3.7: The most likely cause of this error is that Jason selected the email certificate instead of his identity certificate from his smart card during the login process. A wrong certificate type error is generated when a certificate designed for a specific use case is used for a different reason. For example, if a user attempts to log in to a website using an email certificate instead of an identification certificate, a wrong certificate type error will be generated. A validity date error occurs when a certificate is presented for use on a date that is already past the expiration date. An incorrect name error is generated when the certificate’s CN name does not match the FQDN of the system that is using the certificate. For example, if the certificate is issued to diontraining.com but is being presented for www.diontraining.com or yourcyberpath.com, it will generate an incorrect name error. Chain issues occur when the root, subordinate, or leaf certificate fails to pass a validity check. Since the certificate authorities must all pass the validity checks for the certification issued to be considered valid, if any of these are invalid then the entire chain is considered invalid, too.

Question 36

Kevin is conducting a penetration test against Dion Training’s network. He is in the post-exploitation phase and needs to cover his tracks. He runs the following script:
Which technique to cover his tracks is being used?

A. Changing timestamp values
B. Clearing specific event log entries
C. Erasing data securely
D. Erasing shell history

Answer 36

A. Changing timestamp values

Explanation:
OBJ-2.4: If you can modify the time that certain events are recorded, you can deceive investigators into believing a false narrative. Altering a file’s MACE (modified, accessed, created, entry modified) metadata can confuse and misdirect investigators into thinking that your attack happened at a different time, or has lasted for a longer or shorter amount of time than it has. You can use the timestomp command in Meterpreter to change MACE values.

Question 37

What type of technique does exploit chaining often implement?

A. Setting a user’s session identifier (SID) to an explicit known value
B. Adding multiple parameters with the same name in HTTP requests
C. Injecting parameters into a connection string using semicolon as a separator
D. Inserting malicious JavaScript code into input parameters

Answer 37

C. Injecting parameters into a connection string using semicolon as a separator

Explanation:
OBJ-2.5: Connection String Parameter Pollution (CSPP) exploits specifically the semicolon-delimited database connection strings that are constructed dynamically based on the user inputs from web applications. CSPP, if carried out successfully, can be used to steal user identities and hijack web credentials. CSPP is a high-risk attack because of the relative ease with which it can be carried out (low access complexity) and the potential results it can have (high impact). Exploit chaining involves multiple commands and exploits being conducted in a series to fully attack or exploit a given target.

Question 38

Dion Training wants to create and manage new virtual networks using their existing enterprise network devices. Which of the following approaches to implementing a software-defined network would allow Dion Training to move data over their existing physical network devices while no longer configuring or managing those devices directly?

A. SDN Overlay
B. Hybrid SDN
C. Peering SDN
D. Open SDN

Answer 38

A. SDN Overlay

Explanation:
OBJ-1.1: SDN Overlay allows the use of software to create and manage new virtual networks which leverage your existing hardware. All network management and configuration is performed using software and new virtual networking devices are defined within that software. This virtualized overlay moves the data across the existing physical network devices, but that hardware no longer is directly configured or managed by administrators. Hybrid SDN uses a combination of traditional and software-defined networks in the same environment to achieve its objectives. Open SDN uses open standards and open-source software as a strategy to reduce the risks of vendor lock-in. Peering SDN is not a real type of SDN and is therefore incorrect.

Question 39

Which of the following access control methods utilizes a set of organizational roles in which users are assigned to gain permissions and access rights?

A. RBAC
B. DAC
C. ABAC
D. MAC

Answer 39

A. RBAC

Explanation:
OBJ-1.5: Role-based access control (RBAC) is a modification of DAC that provides a set of organizational roles that users may be assigned to gain access rights. The system is non-discretionary since the individual users cannot modify the ACL of a resource. Users gain their access rights implicitly based on the groups to which they are assigned as members.

Question 40

What technology is NOT PKI x.509 compliant and cannot be used in various secure functions?

A. Blowfish
B. AES
C. SSL/TLS
D. PKCS

Answer 40

A. Blowfish

Explanation:
OBJ-3.5: AES, PKCS, and SSL/TLS are all compatible with x.509 and can be used in a wide variety of functions and purposes. AES is used for symmetric encryption. PKCS is used as a digital signature algorithm. SSL/TLS is used for secure key exchange.

Question 41

Which of the following techniques would best mitigate malware that utilizes a fast flux network for its command and control infrastructure?

A. Blocklisting known malicious domain names
B. Utilize a secure recursive DNS resolver to a third party secure DNS resolver
C. Conduct detailed statistical analysis of the structure of domain names to detect anomalies
D. Blocklisting known malicious IP addresses

Answer 41

B. Utilize a secure recursive DNS resolver to a third party secure DNS resolver

Explanation:
OBJ-2.7: Third-party DNS resolvers, particularly those of ISPs, will typically have elaborate algorithms designed to detect command and control (C2) via fast flux networks. Fast flux DNS utilizes a technique that rapidly changes the IP address associated with a domain to allow an adversary to defeat IP-based blocklists. Often, these fast flux networks have communication patterns that might be detectable, though. While in-house statistical analysis might be possible (and could be done in parallel), the commercial resources available to a large-scale ISP or dedicated secure DNS providers will be better tailored to combat this issue.

Question 42

You were conducting a forensic analysis of an iPad backup and discovered that only some of the information is within the backup file. Which of the following best explains why some of the data is missing?

A. The backup is a differential backup
B. THe backup is encrypted
C. The backup was interrupted
D. The backup is stored in iCloud

Answer 42

A. The backup is a differential backup

Explanation:
OBJ-1.4: iPhone/iPad backups can be created as full or differential backups. In this scenario, the backup being analyzed is likely a differential backup containing the information that has changed since the last full backup. If the backup were encrypted, you would be unable to read any of the contents. If the backup were interrupted, the backup file would be in an unusable state. If the backup were stored in iCloud, you would need access to their iCloud account to retrieve and access the file. Normally, during an investigation, you will not have access to the user’s iCloud account.

Question 43

Miranda is attempting to visit https://www.FailToPass.com but is receiving an error that states “Your connection is not private”. She clicks on the “Not Secure” label next to the website’s address to view the details of the digital certificate. She checks the expiration date of the digital certificate and notices it doesn’t expire for another 7 months. She checks the CN name and sees it listed as https://www.FailToPass.com. She also notices that the digital certificate was issued by DigiCert, a well-known root certificate authority. Which of the following is MOST likely causing this error?

A. The certificate has been revoked
B. The certificate is self signed
C. There is a validity date error on the certificate
D. The incorrect name is on the certificate

Answer 43

A. The certificate has been revoked

Explanation:
OBJ-3.7: The most likely cause of the issue is that the certificate has been revoked prematurely by the certificate authority. A revoked certificate error is generated when a certificate is presented for use after it has been added to the certificate revocation list. A validity date error occurs when a certificate is presented for use on a date that is already past the expiration date. An incorrect name error is generated when the certificate’s CN name does not match the FQDN of the system that is using the certificate. For example, if the certificate is issued to diontraining.com but is being presented for www.diontraining.com or yourcyberpath.com, it will generate an incorrect name error. A self-signed certificate is a certificate generated independently of a certificate authority and is considered not trustworthy.

Question 44

Which of the following secure coding best practices ensures special characters like <, >, /, and ‘ are not accepted from the user via a web form?

A. Session management
B. Error handling
C. Output encoding
D. Input validation

Answer 44

D. Input validation

Explanation:
OBJ-1.3: Input validation is performed to ensure only properly formed data is entering the workflow in an information system, preventing malformed data from persisting in the database and triggering a malfunction of various downstream components. Input validation should happen as early as possible in the data flow, preferably as soon as the data is received from the user. Improper error handling can introduce various security problems where detailed internal error messages such as stack traces, database dumps, and error codes are displayed to an attacker. The session management implementation defines the exchange mechanism that will be used between the user and the web application to share and continuously exchange the session ID. Output encoding involves translating special characters into some different but equivalent form that is no longer dangerous in the target interpreter, for example, translating the < character into the < string when writing to an HTML page.

Question 45

Jason has installed multiple virtual machines on a single physical server. He needs to ensure that the traffic is logically separated between each virtual machine. How can Jason best implement this requirement?

A. Configure a virtual switch on the physical server and create VLANs
B. Conduct system partitioning on the physical server to ensure the virtual disk images are on different partitions
C. Create a virtual router and disable the spanning tree protocol
D. Install a virtual firewall and establish an access control list

Answer 45

A. Configure a virtual switch on the physical server and create VLANs

Explanation:
OBJ-1.2: A virtual switch is a software application that allows communication between virtual machines. A virtual local area network (VLAN) is a hardware-imposed network segmentation created by switches. This solution provides a logical separation of each virtual machine through the use of VLANs on the virtual switch.

Question 46

Your organization is updating its incident response communications plan. A business analyst in the working group recommends that if the company discovers they are the victims of a data breach, they should only notify the affected parties to minimize media attention and bad publicity. Which of the following recommendations do you provide in response to the business analyst’s statement?

A. Guidance from laws and regulations should be considered when deciding who must be notified to avoid fines and judgements from non compliance
B. The Human Resources Department should have information security personnel who are involved in the investigation of the incident sign non disclosure agreement so the company cannot be held liable for customer data that is viewed during an investigation
C. An externally hosted website should be prepared in advance to ensure that when an incident occurs, victims have timely access to notification from a non compromised resource
D. The first responder should contact law enforcement5 upon confirmation of a security incident for a forensic team to preserve the chain on custody

Answer 46

A. Guidance from laws and regulations should be considered when deciding who must be notified to avoid fines and judgements from non compliance

Explanation:
OBJ-2.7: Guidance from various laws and regulations must be considered when deciding who must be notified to avoid fines and judgments. The requirements for different types of data breaches are set out in laws/regulations. The requirements indicate who must be notified. Other than the regulator itself, this could include law enforcement, individuals and third-party companies affected by the breach, and public notification through the press or social media channels. For example, the Health Insurance Portability and Accountability Act (HIPAA) sets out reporting requirements in legislation, requiring breach notification to the affected individuals, the Secretary of the US Department of Health and Human Services, and, if more than 500 individuals are affected, to the media.

Question 47

When using tcpdump, which option or flag would you use to record the ethernet frames during a packet capture?

A. -X
B. -n
C. -e
D. -nm

Answer 47

C. -e

Explanation:
OBJ-2.9: The -e option includes the ethernet header during packet capture. The -n flag will show the IP addresses in numeric form. The -nn option shows IP addresses and ports in numeric format. The -X option will capture the packet’s payload in hex and ASCII formats.

Question 48

You are working as part of a penetration team that is assessing the security of a java-based practice exam application for Dion Training. You want to perform static code analysis on the application, but you don’t have the source code. Luckily, you were able to download a copy of the Java bytecode. Which of the following techniques should you utilize to get the bytecode ready for running through a static code analysis tool?

A. Decompile the application with JAD
B. Use Peach to conduct fuzzing
C. Use a debugger like GDB to reverse engineer it
D> Brute force the source code using Hydra

Answer 48

A. Decompile the application with JAD

Explanation:
OBJ-2.5: To conduct a static analysis, you need to have the source code. Since the company didn’t provide it, you can use the Java bytecode (binary) and a decompiler to create the source code. JAD is a Java Application Decompiler. Brute forcing the application with hydra wouldn’t provide you with the source code. It would only provide a password. Debuggers can be useful, but they will return bytecode level information and not source code. Peach is a great fuzzing tool, but fuzzing is a dynamic technique and not a static one.

Question 49

Which file on a Linux system is modified to set the maximum number of days before a password must be changed?

A. /etc/passwd
B. /etc/users
C. /etc/groups
D. /etc/shadow

Answer 49

D. /etc/shadow

Explanation:
OBJ-1.5: The /etc/shadow file stores the actual password in an encrypted format (more like the hash of the password) for the user’s account with additional properties related to the user password. Basically, it stores secure user account information. All fields are separated by a colon (:) symbol. It contains one entry per line for each user listed in the /etc/passwd file. The last 6 fields provide password aging and account lockout features.

Question 50

DeepScan supports data-flow analysis and understands the execution flow of a program. It allows you to see possible security flaws without executing the code. Which of the following types of tools would DeepScan be classified as?

A. Fuzzer
B. Static code analyzer
C. Decomplier
D. Fault injector

Answer 50

B. Static code analyzer

Explanation:
OBJ-2.4: DeepScan is an example of a static code analysis tool. It inspects the code for possible errors and issues without actually running the code. Fuzzing is an automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program through a fuzzer. A decompiler is a computer program that takes an executable file as input and attempts to create a high-level source file that can be recompiled successfully. Fault injection is a testing technique that aids in understanding how a system behaves when stressed in unusual ways. A fuzzer, decompiler, and fault injector are all dynamic analysis tools because they require the program to be run during testing and analysis.

Question 51

Dion Training wants to prevent their end users from using the command prompt on their Windows 11 endpoints. Which of the following endpoint security controls would BEST meet these requirements?

A. Antivirus
B. Secure boot
C. Attestation services
D. Shell restrictions

Answer 51

D. Shell restrictions

Explanation:
OBJ-3.2: Shell restrictions are configurations that limit an end user’s ability to access the command prompt in Windows or the shell in Linux to prevent their ability to interact directly with the operating system. Attestation services are used to ensure the integrity of the computer’s startup and runtime operations. Hardware-based attestation is designed to protect against threats and malicious code that could be loaded before the operating system is loaded. Antivirus is a type of software that uses signature-based detection to identify known malicious code or software. Secure boot is a feature of UEFI that prevents unwanted processes from executing during the boot operation by checking a list of digital certificates from valid operating system vendors before the system booting up.

Question 52

Your company explicitly obtains permission from its customers to use their email address as an account identifier in its CRM. Max, who works at the marketing department in the company’s German headquarters, just emailed all their customers to let them know about a new sales promotion this weekend. Which of the following privacy violations has occurred, if any?

A. There was no privacy violation since the customers were emailed securely through the customer relationship management tool
B. There was a privacy violation since data minimization policies were not followed properly
C. There was a privacy violation since the customers explicitly gave permission to use the email address as an identifier and did not consent to receive marketing emails
D. There was no privacy violation because only corporate employees had access to their email addresses

Answer 52

C. There was a privacy violation since the customers explicitly gave permission to use the email address as an identifier and did not consent to receive marketing emails

Explanation:
OBJ-4.3: According to the European Union’s General Data Protection Regulation (GDPR), personal data collected can only be used for the exact purpose in which explicit consent was obtained. To use email addresses for marketing purposes, separate explicit consent should have been obtained. Since the company operates in Germany, it must follow the GDPR privacy standard. Even if a company doesn’t operate within the European Union, its customers might be European Union citizens, and therefore the company should still optional follow the GDPR guidelines. While data minimization is a good internal policy to utilize, not following it doesn’t equate to a privacy violation or breach. Data minimization is the principle that data should only be processed and stored, if necessary, to perform the purpose for which it is collected. The option concerning the customer relationship management (CRM) tool is a distractor since the issue is using the data in ways that were not consented to by the customer, not which system the email was sent through. A privacy violation can occur when corporate employees view data if those employees do not have a need to know, a valid business requirement to use the data, or consent from the customer to use the data for a specific purpose (as was the case in this scenario).

Question 53

Dion Training selected an EAP implementation to use for authentication on their network. The company has decided to avoid using digital certificates on both the clients and the servers. Instead, the company will create a Protected Access Credential (PAC) based on the server’s master key for each user. The client’s PAC will be installed on each user’s laptop before issuing the device to the user. Which of the following EAP implementations did the organization select?

A .EAL-TLS
B. PEAP
C. EAP-FAST
D. EAP-TTLS

Answer 53

C. EAP-FAST

Explanation:
OBJ-3.6: EAP with Flexible Authentication via Secure Tunneling (EAP-FAST) creates a protected tunnel without using a digital certificate and then passes the user’s authentication credentials through the tunnel to the authentication server. Instead of relying on a digital certificate, the client is issued a Protected Access Credential (PAC) based on the server’s master key, but then this PAC must be securely distributed to the user’s client before utilizing EAP-FAST. EAP Transport Layer Security (EAP-TLS) is the strongest type of authentication used in EAP. EAP-TLS establishes an encrypted TLS tunnel between the client and the server using public-key certificates for both the server and the client for mutual authentication. The client will normally use digital certificates located on a smart card or a certificate installed on the client device in the TPM for their portion of the authentication for additional security. EAP Tunneled Transport Layer Security (EAP-TTLS) uses a server-side certificate to establish a protected tunnel through which the user’s authentication credentials are transmitted to the authentication server. EAP-TTLS can use any inner authentication protocol, including PAP, CHAP, MSCHAP, or GTC, whereas PEAP can only use EAP-MSCHAP and EAP-GTC. Protected Extensible Authentication Protocol (PEAP) uses an encrypted TLS tunnel between the client and the server, but it only utilizes a server-side public key certificate making is prone to password guessing and on-path attacks. PEAP only supports the use of EAP-MSCHAP or EAP-GTC (Generic Token Card) for client authentication.

Question 54

Which of the following methods could not be used to retrieve the key from a forensic copy of a BitLocker encrypted drive?

A. Performing a FireWire attack on mounted drives
B. Analyzing the memory dump file
C. Analyzing the hibernation file
D. Retrieving the key from MBR

Answer 54

D. Retrieving the key from MBR

Explanation:
OBJ-2.8: BitLocker information is not stored in the Master Boot Record (MBR). Therefore, you cannot retrieve the key from the MBR. BitLocker keys can also be retrieved via hibernation files or memory dumps. The recovery key may also be retrieved by conducting a FireWire attack on the mounted drive using a side-channel attack known as a DMA attack. This question may seem beyond the scope of the exam. Still, the objectives allow for “other examples of technologies, processes, or tasks about each objective may also be included on the exam although not listed or covered” in the objectives’ bulletized lists. The content examples listed in the objectives are meant to clarify the test objectives and should not be construed as a comprehensive listing of this examination’s content. Therefore, questions like this are fair game on test day. That said, your goal is not to score 100% on the exam; it is to pass it. Don’t let questions like this throw you off on test day. If you aren’t sure, take your best guess and move on!

Question 55

Your company has decided to move all of its data into the cloud. Your company is concerned about the privacy of its data due to some recent data breaches that have been in the news. Therefore, they have decided to purchase cloud storage resources that will be dedicated solely for their use. Which of the following types of clouds is your company using?

A. Public
B. Private
C. Hybrid
D. Community

Answer 55

B. Private

Explanation:
OBJ-1.6: A private cloud contains services offered either over the Internet or a private internal network and only to select users instead of the general public. A private cloud is usually managed via internal resources. The terms private cloud and virtual private cloud (VPC) are often used interchangeably. A public cloud contains services offered by third-party providers over the public Internet and is available to anyone who wants to use or purchase them. They may be free or sold on-demand, allowing customers to pay only per usage for the CPU cycles, storage, or bandwidth they consume. A community cloud is a collaborative effort in which infrastructure is shared between several organizations from a specific community with common concerns (security, compliance, jurisdiction, etc.), whether managed internally or by a third party and hosted internally or externally. A community cloud is a collaborative effort in which infrastructure is shared between several organizations from a specific community with common concerns (security, compliance, jurisdiction, etc.), whether managed internally or by a third party and hosted internally or externally.

Question 56

You are working as a network administrator and are worried about the possibility of an insider threat. You want to enable a security feature that would remember the Layer 2 address first connected to a particular switch port to prevent someone from unplugging a workstation from the switch port and connecting their laptop to that same switch port. Which of the following security features would BEST accomplish this goal?

A. Port security
B. NAC
C. ACL
D. 802.1x

Answer 56

A. Port security

Explanation:
OBJ-1.1: Port security, also known as persistent MAC learning or Sticky MAC, is a security feature that enables an interface to retain dynamically learned MAC addresses when the switch is restarted or if the interface goes down and is brought back online. This is a security feature that can be used to prevent someone from unplugging their office computer and connecting their laptop to the network jack without permission since the switch port connected to that network jack would only allow the computer with the original MAC address to gain connectivity.

Question 57

Which of the following threats to a SaaS deployment would be the responsibility of the consumer to remediate?

A. Unpatched operating systems on the server
B. An endpoint security failure
C. Cross Site Scripting
D. SQL Injections

Answer 57

B. An endpoint security failure

Explanation:
OBJ-4.2: In a SaaS model, the consumer has to ensure that the endpoints being used to access the cloud are secure. Since the consumer owns the endpoint (laptop, desktop, tablet, smartphone, etc.), they are responsible for securing it. The entire concept behind using a SaaS product is that the service provider will patch the servers’ underlying operating systems, create secure software that isn’t vulnerable to SQL injection or cross-site scripting attacks, and ensure proper operations and maintenance of the backend systems.

Question 58

Which of the following techniques would allow an attacker to get a full listing of your internal DNS information if your DNS server is not properly secured?

A. FQDN Resolution
B. Split Horizon
C. Zone transfers
D. DNS poisoning

Answer 58

C. Zone transfers

Explanation:
OBJ-1.1: A DNS zone transfer provides a full listing of DNS information. If your organization’s internal DNS server is improperly secured, an attacker can gather this information by performing a zone transfer. Fully qualified domain name (FQDN) resolution is a normal function of DNS that converts a domain name like www.diontraining.com to its corresponding IP address. Split horizon is a method of preventing a routing loop in a network. DNS poisoning is a type of attack which uses security gaps in the Domain Name System (DNS) protocol to redirect internet traffic to malicious websites.

Question 59

John is setting up 100 Windows 10 computers for a new corporate office. He wants to ensure that unauthorized applications are prevented from being installed during the bootup process. What feature should he ensure is enabled?

A. Secure Boot
B. BIOS password required
C. Full disk encryption
D. RAM Integrity checking

Answer 59

A. Secure Boot

Explanation:
OBJ-3.2: The purpose of Secure Boot is to prevent malicious and unauthorized apps from loading into the operating system (OS) during the startup process. Secure Boot is enabled by default in Windows 10. When the PC starts, the firmware checks the signature of each piece of boot software, including UEFI firmware drivers (also known as Option ROMs), EFI applications, and the operating system. If the signatures are valid, the PC boots and the firmware gives control to the operating system. The OEM can use instructions from the firmware manufacturer to create Secure boot keys and to store them in the PC firmware. When you add UEFI drivers, you’ll also need to make sure these are signed and included in the Secure Boot database. Full disk encryption is used to encrypt the user and system data stored in the device’s internal storage. RAM integrity checking is conducted by default on most systems during the initial boot process but it doesn’t check the contents of the memory for malware. The BIOS password would prevent the system from booting up without the correct password being entered, but this would not prevent unauthorized applications from being installed during the bootup process.

Question 60

Dion Training wants to test operations at their alternative warm site to validate their business continuity plan. The company has decided that they will continue to maintain operations in their headquarters and main data center while also bringing the warm site online using the appropriate data and personnel. Which of the following types of tests are they planning to utilize to validate their BCP?

A. Full interruption test
B. Walk through
C. Parallel test
D. Checklist

Answer 60

C. Parallel test

Explanation:
OBJ-4.4: A parallel test occurs when the alternative site is brought online as if a real disaster occurred, but the primary site is not taken offline or affected, thereby keeping both the primary and alternate sites operating in parallel. A full interruption test is used to take the primary site offline and shift operations to the alternate site. A walk-through test typically occurs as a group conference where a representative from each business unit discusses the actions taken by their teams, reviews the plan, analyzes the plan’s effectiveness, and provides feedback or changes. Checklist test uses a copy of the business continuity/disaster recovery plan to review and provide comments, updates, or changes to the plan during a periodic update.

Question 61

A network technician is using telnet to connect to a router on a network that has been compromised. A new user and password have been added to the router with full rights. The technician is concerned that the regularly used administrator account has been compromised. After changing the password on all the networking devices, which of the following should the technician do to prevent the password from being sniffed on the network again?

A. Copy all configurations to routers using TFTP for security
B. Use SNMPv1 for all configurations involving the router
C. Ensure the password is 10 characters, containing letters and numbers
D. Only allow admins to access routers using port 22

Answer 61

D. Only allow admins to access routers using port 22

Explanation:
OBJ-1.1: Port 22 uses SSH to authenticate a remote computer or user, or in this case, an administrator. Even if the router has been compromised, the new full rights user will not access their new account without the SSH key, which could only be provided by a true administrator. Telnet uses port 23 and passes all information as unencrypted traffic on the network. Telnet should always be disabled for security reasons, and SSH (which uses encryption) should be used instead.

Question 62

A cybersecurity analyst is preparing to run a vulnerability scan on a dedicated Apache server that will be moved into a DMZ. Which of the following vulnerability scans is most likely to provide valuable information to the analyst?

A. Database vulnerability scan
B. Web application vulnerability scan
C. Port scan
D. Network vulnerability scan

Answer 62

B. Web application vulnerability scan

Explanation:
OBJ-2.4: Since Apache is being run on the scanned server, this indicates a web server. Therefore, a web application vulnerability scan would be the most likely to provide valuable information. A network vulnerability scan or port scan can provide valuable information against any network-enabled server. Since an Apache server doesn’t contain a database by default, running a database vulnerability scan is not likely to provide any valuable information to the analyst.

Question 63

The digital certificate on the Dion Training web server is about to expire. Which of the following should Jason submit to the CA to renew the server’s certificate?

A. CSR
B. Key Escrow
C. OCSP
D. CRL

Answer 63

A. CSR

Explanation:
OBJ-3.5: A CSR (certificate signing request) is what is submitted to the CA (certificate authority) to request a digital certificate. Key escrow stores keys, CRL is a list of revoked certificates, and the OCSP is a status of certificates that provides validity such as good, revoked, or unknown.

Question 64

A company needs to implement stronger authentication by adding an authentication factor to its wireless system. The wireless system only supports WPA with pre-shared keys, but the back-end authentication system supports EAP and TTLS. What should the network administrator implement?

A. MAC address filtering with IP filtering
B. PKI with under authentication
C. 802.1x using PAP
D. WPA2 with a pre shared key

Answer 64

C. 802.1x using PAP

Explanation:
OBJ-1.5: The network administrator can utilize 802.1x using EAP-TTLS with PAP for authentication since the backend system supports it. Password Authentication Protocol (PAP) is a password-based authentication protocol used by Point to Point Protocol (PPP) to validate users. MAC address filtering does not filter based on IP addresses, but instead, it filters based on the hardware address of a network interface card, known as a MAC address. WPA2 is a secure method of wireless encryption that relies on the use of a pre-shared key or the 802.1x protocol. In the question, though, it states that the system only supports WPA, therefore WPA2 cannot be used. PKI with user authentication would be extremely secure, but it is only used with EAP-TLS, not EAP-TTLS. EAP-TTLS only works with credential-based authentication, such as a username and password. Therefore, 802.1x using PAP is the best answer.

Question 65

Which type of media sanitization would you classify degaussing as?

A. Erasing
B. Purging
C. Clearing
D. Destruction

Answer 65

B. Purging

Explanation:
OBJ-4.3: Degaussing is classified as a form of purging. Purging eliminates information from being feasibly recovered even in a laboratory environment. Purging includes degaussing, encryption of the data with the destruction of its encryption key, and other non-destructive techniques. Some generic magnetic storage devices can be reused after the degaussing process has finished, such as VHS tapes and some older backup tapes. For this reason, though, the technique of degaussing is classified as purging and not destruction, even though hard drives are rendered unusable after being degaussed. Clearing data prevents data from being retrieved without the use of state-of-the-art laboratory techniques. Clearing often involves overwriting data one or more times with repetitive or randomized data. Destroying data is designed not merely to render the information unrecoverable but also to hinder any reuse of the media itself. Destruction is a physical process that may involve shredding media to pieces, disintegrating it into parts, pulverizing it to powder, or incinerating it to ash. Erasing or deleting is considered a normal operation of a computer, which erases the data file’s pointer on a storage device. Erasing and deleting are easily reversed, and the data can be recovered with commercially available or open-source tools.

Question 66

You are conducting a penetration test and planning to use a cross-site scripting attack. During your reconnaissance, you determined that the system performs input validation using REGEX to prevent any strings that contain the term “[Ss][Cc][Rr][Ii][Pp][Tt]” in the input. To bypass this input validation, which of the following variations of the script tag should you utilize?

A. <$script>
B.

C. <%53CRIPT>
D. 

Answer 66

C. <%53CRIPT>

Explanation:
OBJ-2.2: Since cross-site scripting (XSS) relies on the

 and 

HTML tags to launch, the system administrators had a good idea of creating input validation using a REGEX for those keywords. Unfortunately, they forgot to include a more inclusive version of this REGEX to catch all variants. For example, simply using [Ss][Cc][Rr][Ii][Pp][Tt] would have been much more secure, but even this would miss %53CRIPT would evade this filter. To catch all the letter S variants, you would need to use [%53%%73Ss], which includes the capital S in hex code, the lower case s in hex code, the capital S, and the lowercase s. As a penetration tester, it is important to remember that you can evade weak input validation using ASCII encoded characters, like %53 for the S character. As a cybersecurity analyst, you must build good input validations into your systems to prevent these types of attacks.

Question 67

Which type of system would classify traffic as malicious or benign based on explicitly defined examples of malicious and benign traffic?

A. Machine learning
B. Deep learning
C. Generative adversarial network
D. Artificial intelligence

Answer 67

A. Machine learning

Explanation:
OBJ-1.8: A machine learning (ML) system uses a computer to accomplish a task without being explicitly programmed. In the context of cybersecurity, ML generally works by analyzing example data sets to create its own ability to classify future items presented. If the system was presented with large datasets of malicious and benign traffic, it will learn which is malicious and categorize future traffic presented to it. Artificial Intelligence is the science of creating machines to develop problem-solving and analysis strategies without significant human direction or intervention. AI goes beyond ML and can make a more complicated decision than just the classifications made by ML. A deep learning system can determine what is malicious traffic without having the prior benefit of being told what is benign/malicious. A generative adversarial network is an underlying strategy used to accomplish deep learning but is not specific to the scenario described.

Question 68

The CTO at Dion Training recently created an encrypted external backup of their file server to a removable USB drive. The symmetric encryption key for this backup has been stored on an unencrypted memory card and was placed in an unlocked desk drawer in their office. Which of the following actions was performed by the CTO?

A. Rekeying of the encrypted drive
B. Improper key handling
C. Monthly key rotation
D. Creation of a mismatched key

Answer 68

B. Improper key handling

Explanation:
OBJ-3.7: The CTO conducted improper key handling by not encrypting the key on the memory card and not storing the memory card in a locked drawer or safe. Improper key handling occurs when private keys and symmetric keys are improperly protected or stored. Improper key handling can lead to data breaches, so any keys identified as having been improperly handled should be revoked and replaced. Key rotation is the process of purposely changing keys periodically to mitigate against brute force attacks and key disclosure compromises. During key rotation, the previous key is also revoked and invalidated. Rekeying is the process of changing an individual key during a communication session. Most communication protocols use session key rekeying to protect the data being transmitted. A rekeying is normally triggered based on the volume of data communicated or the amount of time since the last rekeying. A mismatched key error occurs is the wrong public/private key pair is used to decrypt data. The most common forms of this error are displayed as “key mismatch” or “X509_check_private_key”.

Question 69

The Dion Development Group is about to release a new Software as a Service (SaaS) tool to the marketplace. The company has utilized some third-party libraries in the development of their web application and has not added any compensating controls to validate the security of the third-party library yet. Which of the following terms best describes the type of risk this third-party library represents to the company?

A. Qualitative risk
B. Residual risks
C. Inherent risks
D. Quantitative risk

Answer 69

C. Inherent risks

Explanation:
OBJ-4.1: Inherent risk is the level of risk that exists before any compensating controls have been implemented. Residual risk is the risk that remains after compensating controls have been implemented. Qualitative risk describes the evaluation of risk using words instead of numbers and is much more subjective than quantitative risk analysis. Quantitative risk describes the evaluated risk using numbers, generally monetary values, to evaluate its potential impact.

Question 70

Your company is required to remain compliant with PCI-DSS due to the type of information processed by your systems. If there was a breach of this data, which type of disclosure would you be required to provide during your incident response efforts?

A. Notification to local law enforcement
B. Notification to your credit card processor
C.Notification to Visa and Mastercard
D. Notification to federal law enforcement

Answer 70

B. Notification to your credit card processor

Explanation:
OBJ-4.3: Any organization that processes a credit card will be required to work with their credit card processor instead of working directly with the card issuers (Visa and Mastercard). Conducting notification to your bank or credit card processor is one of the first steps in the incident response effort for a breach of this type of data. Typically, law enforcement does not have to be notified of a data breach at a commercial organization.

Question 71

Dion Training utilizes a federation authentication model for all of its internal and external services. If an employee needs to access one of the company’s web applications from their smartphone, they use a username and password to log in to the main website. They then are transferred and authenticated to all of the other sites and services automatically. Which of the following type of authentication is this known as?

A. SSO
B. MFA
C. FaceID
D. TouchID

Answer 71

A. SSO

Explanation:
OBJ-1.5: Single Sign-on (SSO) is an authentication technology that allows users to authenticate once and receive authorizations for multiple services. The advantage of single sign-on is that each user does not have to manage multiple user accounts and passwords. The disadvantage is that compromising the account also compromises multiple services. Multifactor authentication is an authentication scheme that relies on at least two of the five factors: something you know, something you have, something you are, something you do, and somewhere you are. Since only a username and password are used in this scenario, it is not considered multi-factor authentication. Face ID is an Apple device feature that uses a face lock to grant access to the device. Face ID is considered a form of biometric authentication. Touch ID is an Apple device feature that uses fingerprint biometric information to grant access to the device.

Question 72

Which of the following tools could be used to detect unexpected output from an application being managed or monitored?

A. Manual analysis
B. A signature based detection tool
C. A behavior based analysis tool
D. A log analysis tool

Answer 72

C. A behavior based analysis tool

Explanation:
OBJ-3.2: A behavior-based analysis tool can capture/analyze normal behavior and then alert when an anomaly occurs. Configuring a behavior-based analysis tool requires more effort to set up properly, but it requires less work and manual monitoring once it is running. Signature-based detection is a process where a unique identifier is established about a known threat so that the threat can be identified in the future. Manual analysis requires a person to read all the output and determine if it is erroneous. A log analysis tool would only be useful to analyze the logs, but it would not detect unexpected output by itself. Instead, the log analysis tool would need to use a behavior-based or signature-based detection system.

Question 73

Praveen is currently investigating activity from an attacker who compromised a host on the network. The individual appears to have used credentials belonging to a janitor. After breaching the system, the attacker entered some unrecognized commands with very long text strings and then began using the sudo command to carry out actions. What type of attack has just taken place?

A. Phishing
B. Session hijacking
C. Social engineering
D. Privilege escalation

Answer 73

D. Privilege escalation

Explanation:
OBJ-2.5: The use of long query strings points to a buffer overflow attack, and the sudo command confirms the elevated privileges after the attack. This indicates a privilege escalation has occurred. While the other three options may have been used as an initial access vector, they cannot be confirmed based on the question’s details. Only a privilege escalation is currently verified within the scenario due to the use of sudo.

Question 74

A cybersecurity analyst conducts proactive threat hunting on a network by correlating and searching the Sysmon and Windows Event logs. The analyst uses the following query as part of their hunt:

Based on the query above, which of the following potential indicators of compromise is the threat hunter relying on?

A. Irregular peer to peer communication
B. Processor computation
C. Unauthorized software
D. Data exfiltration

Answer 74

C. Unauthorized software

Explanation:
OBJ-2.2: This is a difficult question, but you should see a keyword in the query, “mimikatz.” Mimikatz is a leading post-exploitation tool that dumps passwords from memory, as well as hashes, PINs, and Kerberos tickets. Other useful attacks it enables are pass-the-hash, pass-the-ticket, or building Golden Kerberos tickets. This makes post-exploitation lateral movement within a network easy for attackers. It is considered unauthorized software and should be immediately alerted upon if discovered in your network. Data exfiltration is the process by which an attacker takes data that is stored inside of a private network and moves it to an external network. Processor consumption is an IoC that monitors the per-process percentage of CPU time to show what causes the problem. Irregular peer-to-peer communication occurs when hosts within a network establish connections over unauthorized ports or data transfers.

Question 75

Which of the following describes a data’s state as it transitions from raw storage to process to production to analytical use within a data lake?

A. Region
B. Data zone
C. Availability Zone
D. VPC/Vnet

Answer 75

B. Data zone

Explanation:
OBJ-1.1: Data zones describe the state and location of data to help isolate and protect it from unauthorized/inappropriate use within a data lake. An availability zone is a physical or logical data center within a single region. A region describes a collection of data centers located within a geographic area and distributed across the globe. A Virtual Private Cloud (VPC) or a Virtual Network (VNet) allows for the creation of cloud resources within a private network that parallels the functionality of the same resources in a traditional, privately operated data center.

Question 76

Dion Training needs to implement EAP for authentication on its network. The users will utilize a traditional username and password using MS-CHAPv2 for authentication from the client. The server will utilize a server-side public key certificate that is used to create an encrypted tunnel between the supplicant (client) and the authentication server. Which of the following EAP implementations should the organization select to meet these requirements?

A. LEAP
B. EAP-TLS
C. PEAP
D. EAP-FAST

Answer 76

C. PEAP

Explanation:
OBJ-3.6: Protected Extensible Authentication Protocol (PEAP) uses an encrypted TLS tunnel between the client and the server, but it only utilizes a server-side public key certificate making is prone to password guessing and on-path attacks. PEAP only supports the use of EAP-MSCHAP or EAP-GTC (Generic Token Card) for client authentication. Lightweight Extensible Authentication Protocol (LEAP) utilizes MS-CHAP for client authentication but does not support the user of public key certificates for either the client or the server. EAP Transport Layer Security (EAP-TLS) is the strongest type of authentication used in EAP. EAP-TLS establishes an encrypted TLS tunnel between the client and the server using public key certificates for both the server and the client for mutual authentication. The client will normally use digital certificates located on a smart card or a certificate installed on the client device in the TPM for their portion of the authentication for additional security. EAP with Flexible Authentication via Secure Tunneling (EAP-FAST) creates a protected tunnel without using a digital certificate and then passes the user’s authentication credentials through the tunnel to the authentication server. Instead of relying on a digital certificate, the client is issued a Protected Access Credential (PAC) based on the server’s master key, but then this PAC must be securely distributed to the user’s client before utilizing EAP-FAST.

Question 77

Which of the following technologies allows a network to be abstracted from the physical hardware by creating a virtualized network overlay?

A. mGRE
B. WLAN
C. MPLS
D. SDWAN

Answer 77

D. SDWAN

Explanation:
OBJ-1.1: A software-defined wide area network (SDWAN) is a network that is abstracted from its hardware which creates a virtualized network overlay. Multipoint GRE (mGRE) is a protocol that can be used to enable one node to communicate with many nodes by encapsulating layer 3 protocols to create tunnels over another network. The mGRE protocol is often used in Dynamic Multipoint VPN (DMVPN) connections. Multiprotocol Label Switching (MPLS) is a routing technique in telecommunications networks that directs data from one node to the next based on short path labels rather than long network addresses, thus avoiding complex lookups in a routing table and speeding traffic flows. A wireless local area network (WLAN) is a wireless computer network that links two or more devices using wireless communication to form a local area network within a limited area such as a home, school, computer laboratory, campus, or office building.

Question 78

Your organization has just migrated to provisioning its corporate desktops as virtual machines and accessing them using thin clients. The organization believes this will enhance security since the desktop can be rewritten with a new baseline image every time the user logs into it. Based on this scenario, which of the following technologies has the organization adopted?

A. VDI
B. VPC
C. UEBA
D. VPN

Answer 78

A. VDI

Explanation:
OBJ-1.6: Virtual desktop infrastructure (VDI) is a virtualization implementation that separates the personal computing environment from a user’s physical computer. Virtual private cloud (VPC) is a private network segment made available to a single cloud consumer on a public cloud. A virtual private network (VPN) is a secure tunnel created between two endpoints connected via an insecure network, typically the internet. User and entity behavior analytics (UEBA) is a system that can provide an automated identification of suspicious activity by user accounts and computer hosts.

Question 79

Dion Training wants to implement a software-defined network when installing a new enterprise network. The company prefers to use open-source software to reduce the risk of vendor lock-in. Which of the following approaches to implementing a software-defined network should Dion Training utilize?
A. Peering SDN
B. Hybrid SDN
C. Open SDN
D. SDN Overlay

Answer 79

C. Open SDN

Explanation:
OBJ-1.1: Open SDN uses open standards and open-source software as a strategy to reduce the risks of vendor lock-in. Hybrid SDN uses a combination of traditional and software-defined networks in the same environment to achieve its objectives. SDN Overlay allows the use of software to create and manage new virtual networks which leverage your existing hardware. All network management and configuration is performed using software and new virtual networking devices are defined within that software. This virtualized overlay moves the data across the existing physical network devices, but that hardware no longer is directly configured or managed by administrators. Peering SDN is not a real type of SDN and is therefore incorrect.

Question 80

You are conducting threat hunting on your organization’s network. Every workstation on the network uses the same configuration baseline and contains a 500 GB HDD, 4 GB of RAM, and the Windows 10 Enterprise operating system. You know from previous experience that most of the workstations only use 40 GB of space on the hard drives since most users save their files on the file server instead of the local workstation. You discovered one workstation that has over 250 GB of data stored on it. Which of the following is a likely hypothesis of what is happening, and how would you verify it?

A. The host might be offline and conducted backups locally – you should contact a system administrator to have it analyzed
B. The host might be the victim of a remote access trojan – you should reimage the machine immediately
C. The host might use as a staging area for data exfiltration – you should conduct volume based trend analysis on the host’s storage device
D. The host might be used as a command and control node for a botnet – you should immediately disconnect the host from the network

Answer 80

C. The host might use as a staging area for data exfiltration – you should conduct volume based trend analysis on the host’s storage device

Explanation:
OBJ-2.7: Based on your previous experience, you know that most workstations only store 40 GB of data. Since client workstations don’t usually need to store data locally, and you noticed that a host’s disk capacity has suddenly diminished, you believe it could indicate that it is used to stage data for exfiltration. To validate this hypothesis, you should configure monitoring and conduct volume-based trend analysis to see how much data is added over the next few hours or days. If you suspect the machine is the victim of a remote access trojan, you should not reimage it immediately. By reimaging the host, you would lose any evidence or the ability to confirm your hypothesis. Based on the scenario, you have no evidence that the system is offline or conducting backups locally. If you did suspect this, you could confirm this by checking the network connectivity or analyzing the files stored on the system. If you suspect the host used as a command and control (C2) node for a botnet, you should conduct network monitoring to validate your hypothesis before disconnecting the host from the network. If the host were a C2 node, that would not explain the excessive use of disk space observed.

Question 81

You are conducting threat hunting for an online retailer. Upon analyzing their web server, you identified that a single HTML response returned as 45 MB in size, but an average response is normally only 275 KB. Which of the following categories of potential indicators of compromise would you classify this as?

A. Data exfiltration
B. Introduction of new accounts
C. Beaconing
D. Unauthorized privilege

Answer 81

A. Data exfiltration

Explanation:
OBJ-2.2: If attackers use SQL injection to extract data through a Web application, the requests issued by them will usually have a larger HTML response size than a normal request. For example, if the attacker extracts the full credit card database, then a single response for that attacker might be 20 to 50 MB, where a normal response is only 200 KB. Therefore, this scenario is an example of a data exfiltration indicator of compromise. Based on the scenario, there is no evidence that a user is conducting a privilege escalation or using unauthorized privileges. There is also no evidence of a new account having been created or beaconing occurring over the network.

Question 82

Dion Training is creating a new mobile application and needs to select an appropriate encryption algorithm to protect the user’s data transmitted by the app to the company’s remote servers. The company wants to choose an asymmetric encryption algorithm that supports fast key agreements and provides extremely high levels of security using only a 384-bit key. Which of the following encryption algorithms should be selected to meet these requirements?

A .ECC
B. AES
C. ChaCha
D. RSA

Answer 82

A .ECC

Explanation:
OBJ-3.6: Elliptic curve cryptography is a public-key cryptographic algorithm based on the algebraic structure of elliptic curves over finite fields. ECC allows smaller key sizes compared to non-elliptic curve cryptography methods while still providing the equivalent level of security. ECC is heavily used in mobile devices and low-powered device encryption. For example, the P384 curve uses a 384-bit key and is approved for the encryption of data up to the Top Secret level by the National Security Agency. Rivest, Shamir, and Adleman (RSA) is an asymmetric algorithm that uses the complexity of factoring large prime numbers to provide security. RSA requires a larger key size of 7680-bit to have the equivalent protection of ECC encrypted data using a 384-bit key. The Advanced Encryption Standard (AES) is the current standard for the U.S. federal government’s symmetric block encryption cipher. AES can use a key size of 128-bits, 192-bits, or 256-bits with a 128-bit block size. ChaCha is a variant of Salsa20 that is a modern and efficient symmetric stream cipher that uses a 128-bit or 256-bit encryption key. ChaCha is widely used in combination with the Poly1305 hashing algorithm in the TLS implementation of the Google Chrome browser and the Android operating system. ChaCha is also used by OpenSSH and the random number generator in BSD operating systems as a replacement to the older RC4 algorithm.

Question 83

What type of malware is designed to be difficult for malware analysts to reverse engineer?

A. Armored virus
B. Rootkit
C. Trojan
D. Logic bomb

Answer 83

A. Armored virus

Explanation:
OBJ-2.4: Armored viruses are a type of virus that use various techniques to protect it from being reverse engineered. This includes changing its code during execution and encrypting its payloads.

Question 84

What remediation strategies are the MOST effective in reducing the risk to an embedded ICS from a network-based compromise? (Select TWO)

A. Disabling unused services
B. Segmentation
C. NIDS
D. Patching

Answer 84

A. Disabling unused services
B. Segmentation

Explanation:
OBJ-3.3: Segmentation is the best method to reduce the risk to an embedded ICS system from a network-based compromise. Additionally, you could disable unused services to reduce the footprint of the embedded ICS. Many of these embedded ICS systems have a large number of default services running. So, by disabling the unused services, we can better secure these devices. By segmenting the devices off the main portion of the network, we can also better protect them. A NIDS might detect an attack or compromise, but it would not reduce the risk of the attack succeeding since it can only detect it. Patching is difficult for embedded ICS devices since they usually rely on customized software applications that rarely provide updates.

Question 85

If an administrator cannot fully remediate a vulnerability, which of the following should they implement?

A. A compensating control
B. An engineering tradeoff
C. Access requirements
D. A policy

Answer 85

A. A compensating control

Explanation:
OBJ-3.2: Based on the question’s wording, a compensating control would be most accurate for the given scenario. Compensating controls may be considered when an entity cannot meet a requirement explicitly, as stated due to legitimate technical or documented business constraints but has sufficiently mitigated the risk associated with the requirement by implementing other controls. Access requirements are a form of logical controls that can be implemented to protect a system and could be a form of compensating control if used appropriately. A policy is a statement of intent and is implemented as a procedure or protocol within an organization. An engineering tradeoff is a situational decision that involves diminishing or losing one quality, quantity, or property of a set or design in return for gains in other aspects. Often, an engineering tradeoff occurs when we trade security requirements for operational requirements or vice versa.

Question 86

Dion Training hosts its learning management servers in the cloud. The cloud provider they selected uses a proprietary virtual machine format for their compute instances which more efficiently uses the vCPUs processing power and leads to immediate cost savings for Dion Training each month. Unfortunately, these compute instances are not cross-cloud compatible and cannot be interconnected with other storage or compute resources outside of this cloud provider’s architecture. The cloud provider also has an option to use a standard, open-source virtual machine format instead that offers complete interoperability with other cloud providers but costs an additional 20% more on average. What vendor risk is Dion Training assuming if they decide to use the proprietary compute instances instead of the standard type?

A. Vendor Lock In
B. Vendor lock out
C. Vendor viability
D. Vendor visibility

Answer 86

B. Vendor lock out

Explanation:
OBJ-4.2: This scenario describes vendor lockout. Vendor lockout occurs when a vendor’s product is developed in a way that makes it inoperable with other products, the ability to integrate it with other vendor products is not a feasible option or does not exist. Vendor Lock-in occurs when a customer is dependent on a vendor for products or services because switching is either impossible or would result in substantial complexity and costs. Vendor viability occurs when a vendor has a viable and in-demand product and the financial means to remain in business on an ongoing basis. Vendor visibility is a term used to define how transparent a supplier is with their payment and shipment status details.

Question 87

You have been hired as a consultant to help Dion Training develop a new disaster recovery plan. Dion Training has recently grown in the number of employees and information systems infrastructure used to support its employees. Unfortunately, Dion Training does not currently have any documentation, policies, or procedures for its student and faculty networks. What is the first action you should take to assist them in developing a disaster recovery plan?

A. Develop a data retention policy
B. Conduct a risk assessment
C. Conduct a vulnerability scan
D. Identify the organizations assets

Answer 87

D. Identify the organizations assets

Explanation:
OBJ-4.4: The first step to developing an effective disaster recovery plan is to identify the assets. The organization must understand exactly what assets they own and operate. Once identified, you can then determine what assets and services are essential to business operations, what risks are facing them, and how best to recovery in the event of a disaster. To best understand the organization’s risks, they will undertake an organization-wide risk assessment and conduct a vulnerability scan of its assets.

Question 88

Dion Consulting group is conducting an initial inventory of their client’s workstations and servers to better understand the attack surface exposed to an external threat actor. What phase of the risk management lifecycle is Dion Training currently operating in?

A. Review
B. Assess
C. Control
D. Identify

Answer 88

D. Identify

Explanation:
OBJ-4.1: This is the identify phase. The identify phase is used to inventory assets and for the identification of all risk items in an organization. The assess phase is used to analyze identified risks to determine their associated level of risk before any mitigations or controls are implemented. The control phase is used to identify effective methods for risk reduction for identified risks in an organization. The review phase is used to periodically re-evaluate the risks in an organization by determining if the risk level has changed and identified controls are still effective.

Question 89

Which analysis framework makes no allowance for an adversary retreat in its analysis?

A. MITRE ATT&CK framework
B. Lockheed Martin cyber kill chain
C. AlienVault (AT&T Cybersecurity Kill Chain)
D. Diamond Model of Intrusion Analysis

Answer 89

B. Lockheed Martin cyber kill chain

Explanation:
OBJ-2.1: The Lockheed Martin cyber kill chain implicitly assumes a unidirectional workflow. Therefore, it fails to consider that an adversary may retreat during an attack. MITRE and Diamond’s models are more dynamic systems that allow for a broader range of adversary behaviors. AlienVault was specifically designed to avoid the rigidity of the Lockheed Martin cyber kill chain.

Question 90

An outside organization has completed a penetration test for a company. One of the report items states that an attacker may have the ability to read TLS traffic from the webserver due to a software bug. What is the MOST likely mitigation for this reported item?

A. Configure the firewall to block traffic on port 443
B. Install an IDS on the network
C. Implement a VPN for employees
D. Ensure patches are deployed

Answer 90

D. Ensure patches are deployed

Explanation:
OBJ-3.2: A patch is designed to correct a known bug or fix a known vulnerability. Since the server is allowing an attacker to read TLS traffic, which should be encrypted and unreadable, this is a software bug in the webserver’s code that must be fixed using a patch. An intrusion detection system is a device or software application that monitors and reports on any malicious activity or policy violations on a network or system. An IDS would not mitigate or stop the attacker from reading the TLS traffic, it would only report that it is occurring. A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules to establish a barrier between a trusted and untrusted network. If you configured the firewall to block traffic on port 443 (HTTPS/SSL/TLS), it would block all of the webserver’s legitimate users, as well. A virtual private network extends a private network across a public network and enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network. A VPN would not stop an attacker from being able to read the TLS traffic from the webserver.