Udemy CASP Practice Exam 6

Question 1

You are attempting to exploit a network-based vulnerability against a RedHat Linux server. You execute the following commands and receive the results below:
Based on the output above, which of the following exploits are you using?

A. SMTP Exploit
B . FTP Exploit
C. SNMP Exploit
D. SMB Exploit

Answer 1

A. SMTP Exploit

Explanation:
OBJ-2.4: If you see a question like this, don’t let it confuse you. Look for keywords and phrases that you recognize to answer the question. As you look at the command issued in the first line, you may not recognize it. That is because this is an older exploit script that is being run with the parameters of support (the user account we are trying to exploit), DionTraining (our penetration testing machine’s name), and RedHat (our target/victim server). Ignoring this line, look at the second line where you see a keyword that you should recognize: Sendmail. Sendmail is a service that runs on Linux machines to “send mail” using the SMTP protocol over port 25. This is the key to answering this question. As you continue through the script, you see it performed a DNS name resolution from RedHat to the server’s IP, connected to the server, and successfully sent the exploit. This exploit conducts a buffer overflow against a vulnerable Sendmail server resulting in the server providing a remote callback to a listening port on the attacker’s machine (port 2525). This is why the attacker then telnets into their localhost over port 2525 and runs the whoami command to determine what user they are connected to the victimized server as. In this case, they are reported as the root user, which means this SMTP exploit was successful.

Question 2

Dion Training has purchased a new office building and is outfitting their new conference room. Tamera installed a 10-foot screen and a projector in the conference room. Jason wants to install a device to allow team members the ability to watch movies or screencast presentations from their laptop to the project. To keep costs down, the device should be an all-in-one device that contains the CPU, RAM, storage, and peripherals in a single small form factor device with an integrated HDMI output, such as a Roku Streaming Stick or a Fire TV Stick. Which of the following types of operational technology would best meet these requirements?

A. SoC
B. ASIC
C. FPGA
D. ICS

Answer 2

A. SoC

Explanation:
OBJ-3.3: A System on a Chip (SoC) integrates practically all the components of a traditional chipset (which is comprised of as many as four chips that control communication between the CPU, RAM, storage, and peripherals) into a single chip. SoC includes the processor as well as a GPU (graphics processor), memory, USB controller, power management circuits, and wireless radios. A field programmable gate array (FPGA) is a type of processor that can be programmed to perform a specific function by a customer rather than at the time of manufacture. A FPGA can be configured by the end customer to run programming logic on the device for their specific use case or application. An application-specific integrated circuit (ASIC) is a type of processor designed to perform a specific function. ASICs are expensive to design and only work for a single application or function, such as the ASICs used to conduct switching in an Ethernet switch. Industrial control systems (ICS) provide mechanisms for workflow and process automation. These systems control machinery used in critical infrastructure, like power suppliers, water suppliers, health services, telecommunications, and national security services.

Question 3

A network technician is selecting the best way to protect a branch office from as many different threats from the Internet as possible using a single device. Which of the following should meet these requirements?

A .Configure a UTM device
B. Configure a network based firewall
C. Configure a NIDS device
D. Configure a host based firewall

Answer 3

A .Configure a UTM device

Explanation:
OBJ-1.1: Since this is a branch office and you want to protect it from as many threats as possible, using a Unified Threat Management (UTM) device would be best. A UTM will protect you from most things using a single device. A network-based firewall would provide basic protection, but a UTM will include anti-virus and other protections beyond just a firewall’s capabilities. Host-based firewalls are great, but the network-based firewall or UTM device is configured to protect all devices on a network whereas a host-based firewall only protects the single host device. A network-based intrusion detection system (NIDS) can detect threats, but it cannot stop or prevent them.

Question 4

Which protocol relies on mutual authentication of the client and the server for its security?

A. CHAP
B. RADIUS
C. Two factor authentication
D. LDAPS

Answer 4

D. LDAPS

Explanation:
OBJ-1.5: The Lightweight Directory Access Protocol (LDAP) uses a client-server model for mutual authentication. LDAP is used to enable access to a directory of resources (workstations, users, information, etc.). TLS provides mutual authentication between clients and servers. Since Secure LDAP (LDAPS) uses TLS, it provides mutual authentication.

Question 5

You received an incident response report indicating a piece of malware was introduced into the company’s network through a remote workstation connected to the company’s servers over a VPN connection. Which of the following controls should be applied to prevent this type of incident from occurring again?

A .SPF
B. NAC
C. ACL
D. MAC Filtering

Answer 5

B. NAC

Explanation:
OBJ-1.1: Network Access Control (NAC) is an approach to computer security that attempts to unify endpoint security technology (such as anti-virus, host intrusion prevention, and vulnerability assessment), user or system authentication, and network security enforcement. When a remote workstation connects to the network, NAC will place it into a segmented portion of the network (sandbox), scan it for malware and validate its security controls, and then based on the results of those scans, either connect it to the company’s networks or place the workstation into a separate quarantined portion of the network for further remediation. An access control list (ACL) is a network traffic filter that can control incoming or outgoing traffic. An ACL alone would not have prevented this issue. MAC Filtering refers to a security access control method whereby the MAC address assigned to each network card is used to determine access to the network. MAC filtering operates at layer 2 and is easy to bypass. Sender Policy Framework (SPF) is an email authentication method designed to detect forging sender addresses during email delivery.

Question 6

A system administrator wants to verify that external IP addresses cannot collect software versioning from servers on the network. Which of the following should the system administrator do to confirm the network is protected?

A. Review the ID3 logs on the network
B. Use Nmap to query known port
C. Analyze packet capture
D. Utilize netstat to locate active connections

Answer 6

C. Analyze packet capture

Explanation:
OBJ-1.4: Packet captures contain every packet that is sent and received by the network. By using a program like Wireshark to analyze the packet captures, you can see what kind of information and metadata is contained within the packets. By conducting this type of packet analysis, an attacker (or cybersecurity analyst) can determine if software versions are being sent as part of the packets and their associated metadata.

Question 7

An incident response team is publishing an incident summary report and is determining the evidence retention requirements for the data collected during a response. Which of the following incident response phases is currently being performed by the team?

A. Post incident activities
B. Preparation
C. Detection and analysis
D. Eradication and recovery

Answer 7

A. Post incident activities

Explanation:
OBJ-2.7: The post-incident activities phase is when report writing occurs, incident summary reports are published, evidence retention is determined, and lessons learned reports are created. An incident response has five stages: preparation, detection and analysis, containment, eradication and recovery, and post-incident activities.

Question 8

Following a root cause analysis of an edge router’s unexpected failure, a cybersecurity analyst discovered that the system administrator had purchased the device from an unauthorized reseller. The analyst suspects that the router may be a counterfeit device. Which of the following controls would have been most effective in preventing this issue?

A. Verify that all routers are patches to the latest release
B. Conduct secure supply chain management training
C. Increase network vulnerability scan frequency
D. Ensure antivirus signatures are up to date

Answer 8

B. Conduct secure supply chain management training

Explanation:
OBJ-4.2: Anti-counterfeit training is part of the NIST 800-53r4 control set (SA-19(1)) and should be a mandatory part of your supply chain management training within your organization. All other options may produce security gains in the network. They are unlikely to reliably detect a counterfeit item or prevent its introduction into the organization’s supply chain. Training on detection methodologies (i.e., simple visual inspections) and training for acquisition personnel will better prevent recurrences.

Question 9

Which of the following is the most important feature to consider when designing a system on a chip?

A. Space and power savings
B. Type of real time operating system in use
C. Ability to be reconfigured after manufacture
D. Ability to interfaces with industrial control systems

Answer 9

A. Space and power savings

Explanation:
OBJ-3.3: A system on a chip is an integrated circuit that integrates all or most components of a computer or other electronic system. These components almost always include a central processing unit, memory, input/output ports, and secondary storage – all on a single substrate or microchip, the size of a coin. This makes the savings of space and power the most important feature to consider when designing a system on a chip.

Question 10

Tierra works as a cybersecurity analyst for a large multi-national oil and gas company. She responds to an incident at her company in which their public-facing web server has been defaced with the words, “Killers of the Arctic.” She believes this was done in response to her company’s latest oil drilling project in the Arctic Circle. Which threat actor is most likely to blame for the website defacement?

A. Script kiddie
B. Hacktivist
C. Organized crime
D. APT

Answer 10

B. Hacktivist

Explanation:
OBJ-2.1: It appears this hack was motivated by a pro-environmentalist agenda based on the message of the website defacement. This is an example of hacktivism. In 2012, five top multi-national oil companies were targeted by members of Anonymous as a form of digital protest against drilling in the Arctic, a practice that these hacktivists believe has contributed to the melting of the ice caps in that region.

Question 11

Taylor needs to sanitize hard drives from some leased workstations before returning them to a supplier at the end of the lease period. The workstations’ hard drives contained sensitive corporate data. Which is the most appropriate choice to ensure that data exposure doesn’t occur during this process?

A. Clear, validate and document the sanitization of the drives
B. The drives must be destroyed to ensure no data loss
C. Clear the drives
D. Purge, validate and document the sanitization of the drives

Answer 11

D. Purge, validate and document the sanitization of the drives

Explanation:
OBJ-4.3: Purging the drives, validating that the purge was effective, and documenting the sanitization is the best response. Purging includes methods that eliminate information from being feasibly recovered even in a lab environment. For example, performing a cryptographic erasure (CE) would sanitize and purge the drives’ data without harming the drives themselves. Clearing them leaves the possibility that some tools would allow data recovery. Since the scenario indicates that these were leased drives that must be returned at the end of a lease, they cannot be destroyed.

Question 12

Dion Training wants to have a new practice exam web application developed and is now accepting requests for proposals (RFPs) for the project. As part of the RFP, each development firm must submit a copy of their current financials to ensure they have enough resources to remain in business for the duration of the proposed project. What type of vendor risk is being mitigated by this requirement in the RFP process?

A .Vendor Lock In
B. vendor lockout
C. Vendor viability
D. Vendor visibility

Answer 12

C. Vendor viability

Explanation:
OBJ-4.2: This scenario describes one method of mitigating the risk of a vendor no longer being viable. Vendor viability occurs when a vendor has a viable and in-demand product and the financial means to remain in business on an ongoing basis. Vendor lockout occurs when a vendor’s product is developed in a way that makes it inoperable with other products, the ability to integrate it with other vendor products is not a feasible option or does not exist. Vendor Lock-in occurs when a customer is dependent on a vendor for products or services because switching is either impossible or would result in substantial complexity and costs. Vendor visibility is a term used to define how transparent a supplier is with their payment and shipment status details.

Question 13

Which of the following vulnerabilities can be prevented by using proper input validation? (Select ANY that apply)

A .SQL Injection
B. XML Injection
C. Directory traversal
D. Cross site scripting

Answer 13

A .SQL Injection
B. XML Injection
C. Directory traversal
D. Cross site scripting

Explanation:
OBJ-1.3: Proper input validation can prevent cross-site scripting, SQL injection, directory traversal, and XML injections from occurring. When an application accepts string input, the input should be subjected to normalization or sanitization procedures before being accepted. Normalization means that a string is stripped of illegal characters or substrings and converted to the accepted character set. This can prevent SQL and XML injections from occurring. Input validation is also good at preventing cross-site scripting (XSS) in any forms that accept user input. Directory traversals can be prevented by conducting input validation in file paths or URLs accepted from the user. This prevents a canonicalization attack from disguising the nature of the malicious input that could cause a directory traversal.

Question 14

A company wants to ensure that its mobile devices are configured to protect any data stored on them if they are lost or stolen. Which of the following should you enable and enforce through their MDM?

A. Enable SSO
B. Enable OS Updates
C. Full storage encryption
D. Remove backups

Answer 14

C. Full storage encryption

Explanation:
OBJ-3.1: Mobile device management (MDM) software suites are designed to manage the use of smartphones and tablets within an enterprise. Full storage encryption is used to encrypt the user and system data stored in the device’s internal storage. The encryption key is stored in a protected portion of the device and can be used to remotely wipe the device if it is lost or stolen. Single sign-on (SSO) is an authentication technology that allows a user to authenticate once and receive authorizations for multiple services. Operating system updates are made freely available by the software manufacturer to fix problems in a particular software version, including any security vulnerabilities. Updates can be classified as hotfixes (available only to selected customers and for a limited problem), patches (generally available), and service packs (installable collections of patches and software improvements). A backup is a copy of user and system data that can enable the recovery of data after data loss or a disaster.

Question 15

You are working as a junior cybersecurity analyst and utilize a SIEM to support investigations into ongoing incidents. The SIEM is configured to collect data from numerous sources across the network, including network sensors, routers, switches, firewalls, hosts, and servers. Unfortunately, due to the number of data sources, you have data about a particular event being detected by different sensors and devices. Which of the following must you ensure to make sense of all the data being collected by your SIEM before analyzing it?

A. Data recovery
B. Data correlation
C. Data retention
D. Data sanitization

Answer 15

B. Data correlation

Explanation:
OBJ-2.6: Data correlation is the first step in making sense of data from across numerous sensors. This will ensure the data is placed concerning other pieces of data within the system. For example, if your IDS detected an incident, host logs were collected, and your packet capture system collected the network traffic, the SIEM could be used to correlate all three pieces of information from these different systems to allow an analyst to understand the event better. By conducting data correlation, it allows an analyst to identify a pattern more clearly and take action. Data correlation should be performed as soon as the SIEM indexes the data.

Question 16

What is the utilization of insights gained from threat research and threat modeling to proactively discover evidence of an adversarial TTP within a network or system called?

A. Penetration testing
B. Incident response
C. Threat hunting
D. Information assurance

Answer 16

C. Threat hunting

Explanation:
OBJ-2.1: Threat hunting is the utilization of insights gained from threat research and threat modeling to proactively discover evidence of an adversarial TTP within a network or system. Penetration testing uses active tools and security utilities to evaluate security by simulating an attack on a system. A penetration test verifies that a threat exists, actively tests and bypasses security controls, and finally exploits vulnerabilities on the system. Information assurance (IA) is the practice of assuring information and managing risks related to the use, processing, storage, and transmission of information or data and the systems and processes used for those purposes. Incident response is an organized approach to addressing and managing the aftermath of a security breach or cyberattack, also known as an IT incident, computer incident, or security incident. The goal is to handle the situation to limit damage and reduce recovery time and costs.

Question 17

A recent vulnerability scan found several vulnerabilities on an organization’s public-facing IP addresses. To reduce the risk of a breach, which of the following vulnerabilities should be prioritized for remediation?

A. A website utilizing a self signed SSL cert
B. A buffer overflow that is known to allow remote code execution
C. An HTTP response that reveals an internal IP address
D. A crypto graphically weak encryption cipher

Answer 17

B. A buffer overflow that is known to allow remote code execution

Explanation:
OBJ-2.3: The most serious vulnerability discovered is one that could allow remote code execution to occur. Since this buffer overflow vulnerability is known to allow remote code execution, it must be mitigated first to prevent a security breach most effectively. While the other issues should be addressed eventually, you need to prioritize the most critical one (remote code execution) on a public-facing IP address. A public-facing IP address means the device is accessible from the internet.

Question 18

Which of the following authentication protocols was developed by Cisco to provide authentication, authorization, and accounting services?

A. TACAS+
B. CHAP
C. RADIUS
D. Kerberos

Answer 18

A. TACAS+

Explanation:
OBJ-1.5: TACACS+ is an extension to TACACS (Terminal Access Controller Access Control System) and was developed as a proprietary protocol by Cisco. The Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that operates on port 1812 and provides centralized Authentication, Authorization, and Accounting management for users who connect and use a network service, but Cisco did not develop it. Kerberos is a network authentication protocol designed to provide strong mutual authentication for client/server applications using secret-key cryptography developed by MIT. Challenge-Handshake Authentication Protocol (CHAP) is used to authenticate a user or network host to an authenticating entity. CHAP is an authentication protocol but does not provide authorization or accounting services.

Question 19

Dion Training installed a new router 183 days ago and it stopped working today due to a faulty power supply. The network technicians replaced the power supply and the router was returned to service within 4 hours. Which of the following terms would BEST represent the 183 days in this scenario?

A. MTTR
B. RPO
C. RTRO
D. MTBF

Answer 19

D. MTBF

Explanation:
OBJ-4.1: The mean time between failures (MTBF) measures the average time between when failures occur on a device. The mean time to repair (MTTR) measures the average time it takes to repair a network device when it breaks. The recovery time objective (RTO) is the duration of time and a service level within which a business process must be restored after a disaster to avoid unacceptable consequences associated with a break in continuity. The recovery point objective (RPO) is the interval of time that might pass during a disruption before the quantity of data lost during that period exceeds the Business Continuity Plan’s maximum allowable threshold or tolerance.

Question 20

During her login session, Sally is asked by the system for a code sent to her via text (SMS) message. Which of the following concerns should she raise to her organization’s AAA services manager?

A. SMS messages may be accessible to attackers via VOIP or other systems
B. SMS should be encrypted to be secure
C. SMS is a costly method of providing a second factor of authentication
D. SMS should be paired with a third factor

Answer 20

A. SMS messages may be accessible to attackers via VOIP or other systems

Explanation:
OBJ-1.5: NIST’s SP 800-63-3 recommends that SMS messages be deprecated as a means of delivering a second factor for multifactor authentication because they may be accessible to attackers. SMS is unable to be encrypted (at least without adding additional applications to phones). A third factor is typically not a user-friendly recommendation and would be better handled by replacing SMS with the proposed third factor. SMS is not a costly method since it can be deployed for less than $20/month at scale.

Question 21

After an employee complains that her computer is running abnormally slow, so you conduct an analysis of the NetFlow data from her workstation. Based on the NetFlow data, you identify a significant amount of traffic from her computer to an IP address in a foreign country over port 6667 (IRC). Which of the following is the most likely explanation for this?

A. Malware has been installed on her computer and is using the IRC protocol to communicate
B. This is routine machine to machine communicastions in a corporate network
C. THe employee is using Internet Relay chat to communicate with her friends and family overseas
D. The computer has likely been compromised by an APT

Answer 21

A. Malware has been installed on her computer and is using the IRC protocol to communicate

Explanation:
OBJ-2.2: Internet Relay Chat (IRC) used to be extremely popular but was replaced by modern chat applications like Facebook Messenger, Google Hangouts, Slack, and numerous others. These days, IRC traffic is infrequent on most corporate networks. Therefore, this would be classified as suspicious and require additional investigation. The unencrypted nature of the protocol makes it easy to intercept and read communications on this port. Still, even so, many types of malware use IRC as a communication channel. Due to this cleartext transmission, an APT would avoid using IRC for their C2 channel to blend in with regular network traffic and avoid detection. IRC is not normally used for machine-to-machine communications in corporate networks. Because the scenario mentioned a connection to a foreign country, as part of your investigation, you should ask the employee if they have friends or family overseas in the country to rule out the possibility that this is acceptable traffic.

Question 22

A software assurance laboratory performs a dynamic assessment on an application by automatically generating random data sets and inputting them to cause an error or failure condition. Which of the following is the laboratory performing?

A. Fuzzing
B. Security regression testing
C. User acceptance testing
D. Stress testing

Answer 22

A. Fuzzing

Explanation:
OBJ-1.3: Fuzzing or fuzz testing is an automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program. The program is then monitored for exceptions such as crashes, failing built-in code assertions, or potential memory leaks. User Acceptance Testing is the process of verifying that a created solution/software works for the user. Security regression testing ensures that changes made to a system do not harm its security, are therefore of high significance, and the interest in such approaches has steadily increased. Stress testing verifies the system’s stability and reliability by measuring its robustness and error handling capabilities under heavy load conditions.

Question 23

You are working for a brand new startup company that allows you to use your laptop, tablet, or other devices while at work. The company does provide some rules and guidelines that you must follow based on their policy. Which of the following policies should you look at to ensure you understand these rules and guidelines?

A. SLA
B. MOU
C. NDA
D. BYOD

Answer 23

D. BYOD

Explanation:
OBJ-4.1: BYOD (Bring Your Own Device) refers to the policy of permitting employees to bring personally owned devices to their workplace and to use those devices to access privileged company information and applications. A memorandum of understanding (MOU) is important because it defines the responsibilities of each party in an agreement, provides the scope and authority of the agreement, clarifies terms, and outlines compliance issues. A non-disclosure agreement (NDA) is a legal contract or part of a contract between at least two parties that outlines confidential material, knowledge, or information that the parties wish to share for certain purposes, but wish to restrict access to. A service level agreement (SLA) is a commitment between a service provider and a client for particular aspects of the service, such as quality, availability, or responsibilities.

Question 24

You are conducting a password audit. Which of these options is the least complex password?

Question 25

Dion Training is hiring a penetration testing firm to conduct an assessment of its corporate network. As part of the contract, the company has specified that it will not provide any network details to the penetration testing firm. Instead, the company wants to see how much information about the network can be found by the penetration testers using open-source research and scanning the corporate network. What type of assessment is this considered?

A. Semi trusted environment testing
B. Partially known environment testing
C. Known environment testing
D. Unknown environment testing

Answer 25

D. Unknown environment testing

Explanation:
OBJ-2.4: An unknown environment penetration test requires no previous information and usually takes the approach of an uninformed attacker. The penetration tester has no prior information about the target system or network in an unknown environment penetration test. These tests provide a realistic scenario for testing the defenses, but they can be costlier and more time-consuming to conduct as the tester is examining a system from an outsider’s perspective. A partially known environment tester has the user’s access and knowledge levels, potentially with elevated privileges on a system. These partially known environment penetration testers typically have some knowledge of a network’s internals, potentially including design and architecture documentation and an account internal to the network. A known environment test is known by several different names, including clear-box, open-box, auxiliary, or logic-driven testing. It falls on the opposite end of the spectrum from an unknown environment test because the penetration testers have full access to source code, architecture documentation, and so forth. A known environment penetration tester can also perform static code analysis, so familiarity with source code analyzers, debuggers, and similar tools are necessary for this type of testing. A semi-trusted environment test is made up term and is used as a distractor in this question.

Question 26

Which of the following type of sites would be used if your organization plans to switch to teleworking and remote operations in the event of a disaster?

A. Warm site
B. Cloud Site
C. Hot Site
D. Cold Site

Answer 26

B. Cloud Site

Explanation;
OBJ-4.4: A cloud site is a virtual recovery site that allows you to create a recovery version of your organization’s enterprise network in the cloud. Cloud sites are useful when your disaster recovery plan includes migrating to a telework or remote operations environment. A hot site is a real-time replication of an existing network environment. All data generated and stored at the primary site is immediately replicated and backed up at the disaster recovery site. A warm site is a type of facility an organization uses to recover its technology infrastructure when its primary data center goes down. A warm site features an equipped data center but no customer data. A cold site is a backup facility with little or no hardware equipment installed. A cold site is essentially an office space with basic utilities such as power, cooling system, air conditioning, and communication equipment, etc.

Question 27

Tamera just purchased a Wi-Fi-enabled Nest Thermostat for her home. She has hired you to install it, but she is worried about a hacker breaking into the thermostat since it is an IoT device. Which of the following is the BEST thing to do to mitigate Tamera’s security concerns? (Select TWO)

A. Upgrade the firmware of the wireless access point to the latest version to improve the security of the network
B. Disable wireless connectivity to the thermostat to ensure a hacker cannot access it
C. Configure the thermostat to use a segregated part of the network by install it into a screened subnet
D. Enable two factor authentication on the devices website (if supported by the company)
E. Configure the thermostat to use the WEP encryption standard for additional confidentiality
F. Configure the thermostat to connect to the wireless network using WPA2 encryption and a long, strong password

Answer 27

C. Configure the thermostat to use a segregated part of the network by install it into a screened subnet
F. Configure the thermostat to connect to the wireless network using WPA2 encryption and a long, strong password

Explanation;
OBJ-3.3: The BEST options are to configure the thermostat to use the WPA2 encryption standard (if supported) and place any Internet of Things (IoT) devices into a DMZ/screened subnet to segregate them from the production network. While enabling two-factor authentication on the device’s website is a good practice, it will not increase the IoT device’s security. While disabling the wireless connectivity to the thermostat will ensure it cannot be hacked, it also will make the device ineffective for the customer’s normal operational needs. WEP is considered a weak encryption scheme, so you should use WPA2 over WEP whenever possible. Finally, upgrading the wireless access point’s firmware is good for security, but it isn’t specific to the IoT device’s security. Therefore, it is not one of the two BEST options.

Question 28

A company has had several virus infections over the past few months. The root cause was determined to be known vulnerabilities in the software applications in use by the company. What should an administrator implement to prevent future outbreaks?

A. incident response team
B. Patch management
C. Accept use policies
D. Host based intrusion detection systems

Answer 28

B. Patch management

Explanation:
OBJ-3.2: Since the viruses exploited known vulnerabilities, there should be patches available from the manufacturer/vendor. Patch management is the process of distributing and applying updates to the software to prevent vulnerabilities from being exploited by an attacker or malware. Proper patch management is a technical control that would prevent future outbreaks. An acceptable use policy (AUP) is a document stipulating constraints and practices that a user must agree to for access to a corporate network or the Internet. While some items in the AUP might help prevent a malware infection (such as not allowing users to download and run programs from the internet), it is considered an administrative control, and choosing a technical control like patch management would better protect the network. An incident response team or emergency response team is a group of people who prepare for and respond to any emergency incident, such as a natural disaster or an interruption of business operations. An incident response team will respond to the virus infections, but they would not prevent them from occurring. Host-based intrusion detection systems (HIDS) help organizations to identify threats inside the network perimeter by monitoring host devices for malicious activity that, if left undetected, could lead to serious breaches. A HIDS may detect the effects of a virus infection, such as a client becoming a zombie in a botnet, but it will not prevent these outbreaks from occurring.

Question 29

Dion Training is analyzing their student practice exam experience. During the analysis, the staff measured the current resiliency of the system by calculating the MTTR and MTBF for the system. The MTTR was measured at 9.1 hours and the MTBF was measured at 3.2 years. Susan, the Chief Operations Officer, stated that the MTTR should be at most 4 hours and the MTBF should be at least 4 years. The team at Dion Training will use all of these measurements and goals to create a technical implementation plan to reach Susan’s requirements. Based on the measurements and goals provided, which of the following types of analysis has the team at Dion Training just performed?

A. Business impact analysis
B. Privacy impact analysis
C. Gap analysis
D. Tradeoff analysis

Answer 29

C. Gap analysis

Explanation:
OBJ-4.1: A gap analysis measures the difference between the current state and desired state to assess the scope of work included in a project. By measuring ALE, MTTR, MTBF, TCO, and other factors, the organization can identify how closely it is performing to the desired outcomes or requirements. A tradeoff analysis compares potential benefits to potential risks and determines a course of action based on adjusting factors that contribute to each area. A business impact analysis describes the collaborative effort to identify those systems and software that perform essential functions, meaning the organization cannot run without them. A privacy impact assessment is conducted by an organization for it to determine where its privacy data is stored and how that privacy data moves throughout an information system. It evaluates the impacts that may be realized by a compromise to the confidentiality, integrity, and/or availability of the data.

Question 30

You are attending a cybersecurity conference and just watched a security researcher demonstrating the exploitation of a web interface on a SCADA/ICS component. This caused the device to malfunction and be destroyed. You recognize that the same component is used throughout your company’s manufacturing plants. Which of the following mitigation strategies would provide you with the most immediate protection against this emergent threat?

A. Logically or physically isolate the SCADA/ICS component from the enterprise network
B> Replace the affected SCADA/ICS components with more secure models, from a different manufacturer
C. Evaluate if the web interface must remain open for the system to function; if it isnt needed, block the web interface
D. Demand that the manufacturer of the component release a patch immediately and deploy the patch as soon as possible

Answer 30

C. Evaluate if the web interface must remain open for the system to function; if it isnt needed, block the web interface

Explanation:
OBJ-3.3: The most immediate protection against this emergent threat would be to block the web interface from being accessible over the network. Before doing this, you must evaluate whether the interface needs to remain open for the system to function properly. If it is not needed, you should block it to minimize the SCADA/ICS component’s attack surface. Ideally, your SCADA/ICS components should already be logically or physically isolated from the enterprise network. Since the question doesn’t mention the networks as an area of concern, we can assume they are already following the industry best practice of logical or physical segmentation between the SCADA/ICS network and the enterprise network. On the exam, make sure you focus on the question being asked. In this case, the question focuses on the web interface. Developing a patch can be a time-consuming process, therefore waiting for the manufacturer to provide a patch will not provide immediate protection to your components. The same is true for replacing the affected components. Even if you could get the company to authorize the funding for such a purchase, it would take time to order, ship, receive, and install the new components. Additionally, you would cause unwanted downtime in the factory during the installation of the components, making it an ineffective option when simply blocking the web interface is free, quick, and effective.

Question 31

An internet marketing company decided that they didn’t want to follow the rules for GDPR because it would create too much work for them. They wanted to buy insurance, but no insurance company would write them a policy to cover any fines received. They considered how much the fines might be and decided to ignore the regulation and its requirements. Which of the following risk strategies did the company choose?

A. Avoidance
B. Mitigation
C. Transference
D. Acceptance

Answer 31

D. Acceptance

Explanation:
OBJ-4.1: The internet marketing company initially tried to transfer the risk (buy insurance) but then decided to accept the risk. To avoid the risk, the company would have changed how it did business or would prevent European customers from signing up on their mailing list using geolocation blocks.

Question 32

The local electric power plant contains both business networks and ICS/SCADA networks to control their equipment. Which technology should the power plant’s security administrators look to implement first as part of configuring better defenses for the ICS/SCADA systems?

A. Log consolidation
B. Automated patch deployment
C. Intrusion prevention system
D. Antivirus software

Answer 32

C. Intrusion prevention system

Explanation:
OBJ-3.3: Since this question is focused on the ICS/SCADA network, the best solution would be implementing an Intrusion Prevention System. ICS/SCADA machines utilize very specific commands to control the equipment and to prevent malicious activity. You could set up strict IPS rules to prevent unknown types of actions from being allowed to occur. Log consolidation is a good idea, but it won’t prevent an issue and therefore isn’t the most critical thing to add first. Automated patch management should not be conducted, as ICS/SCADA systems must be tested before conducting any patches. Often, patches will break ICS/SCADA functionality. Anti-virus software may or may not be able to run on the equipment, as well, since some ICS/SCADA systems often do not rely on standard operating systems like Windows.

Question 33

What is the biggest disadvantage of using single sign-on (SSO) for authentication?

A. The identity provider issues the authorization
B. It introduces a single point of failure
C. Systems must be configured to utilize the federation
D. Users need to authenticate with each server as they log on

Answer 33

B. It introduces a single point of failure

Explanation:
OBJ-1.5: Single sign-on is convenient for users since they only need to remember one set of credentials. Unfortunately, single sign-on also introduces a single point of failure. If the identity provider is offline, then the user cannot log in to any of the resources they may wish to utilize across the web. Additionally, if the single sign-on is compromised, the attacker now has access to every site that the user would have access to using the single set of credentials.

Question 34

You have just installed a new hard disk drive into your computer, but the motherboard does not recognize it within the BIOS/UEFI. You have verified the drive is properly connected to the motherboard and the power supply with the correct cables, but it still is not recognized. Which of the following actions would BEST solve this problem?

A. Configure a RAID in the BIOS/UEFI
B. Format the new hard drive as FAT-32
C. Update the firmware of the motherboard
D. Format the new hard drive as NTFS

Answer 34

C. Update the firmware of the motherboard

Explanation:
OBJ-3.2: This type of error (drive not recognized) is usually the result of the motherboard’s firmware not supporting a newer hard drive model or the cables not being properly connected. Since we already established that the cables were properly connected, we have to consider the firmware as the issue. To troubleshoot this issue, you should restart the computer and enter the BIOS/UEFI configuration. If the BIOS/UEFI does not recognize the hard drive, then the motherboard’s firmware will need to be updated. If the BIOS/UEFI cannot detect the hard drive, then the operating system cannot detect the drive either (since it relies on the underlying BIOS/UEFI to make the connection). This means that you cannot format the hard drive or configure a RAID.

Question 35

Which of the following vulnerabilities is the greatest threat to data confidentiality?

A. phpinfo information disclosure vulnerability
B. Web application SQL injection vulnerability
C. HTTP TRACE/TRACK methods enabled
D. SSL Server with SSLv3 enabled vulnerability

Answer 35

B. Web application SQL injection vulnerability

Explanation:
OBJ-2.3: Each vulnerability mentioned poses a significant risk, but the greatest threat comes from the SQL injection. An SQL injection could allow an attacker to retrieve our data from the backend database directly. Using this technique, the attacker could also alter the data and put it back, and nobody would notice everything that had been changed, thereby also affecting our data integrity. The HTTP TRACE/TRACK methods are normally used to return the full HTTP request to the requesting client for proxy-debugging purposes and allow the attacker to access sensitive information in the HTTP headers. Since this only exposes information in the headers, it minimizes the risk to our system’s data confidentiality. An SSL server with SSLv3 enabled is not ideal since this is an older encryption type, but it still provides some confidentiality. The phpinfo information disclosure vulnerability prints out detailed information on both the system and the PHP configuration. This information by itself doesn’t disclose any information about the data stored within the system, though, so it isn’t a great threat to our data’s confidentiality.

Question 36

A cybersecurity analyst has received an alert that sensors continuously observe well-known call home messages at their network boundary. Still, the organization’s proxy firewall is properly configured to successfully drop the messages before leaving the network. Which of the following is MOST likely the cause of the call home messages being sent?

A. An attacker is performing reconnaissance of the organizations workstations
B. A malicious insider is trying to exfiltrate information to a remote network
C. Malware is running on a company workstation or server
D. An infected workstation is attempting to reach a command and control server

Answer 36

D. An infected workstation is attempting to reach a command and control server

Explanation:
OBJ-2.2: A call home message is an indicator of compromise known as beaconing. Beaconing usually occurs after a stage 1 malware program has been implanted on an organization’s workstation or server, but that isn’t the most correct answer to this question. Instead, beaconing indicates that a workstation or server is infected and tries to communicate with the attacker’s command and control server. This beaconing will continue until the infected system (workstation or server) is found and cleared of the malware or until the botnet gives the infected host further instructions to perform (such as to attack). “Malware is running on a company workstation or server” is incorrect because we do not have positive verification of that based on this scenario. A beacon does not have to be malware. For example, it can simply be a single ping packet or DNS request being sent out every day at a certain time using the Windows task scheduler. Be careful on the exam to answer the question being asked and choose the “most” accurate answer. Since the call home signal is coming from the internal network and attempting to connect to an external server, it cannot be evidence of an attacker performing reconnaissance on your workstations. Also, nothing in the question is indicative of an insider threat trying to exfiltrate information since a call home message is generally minimal in size and not large enough to exfiltrate data.

Question 37

Dion Training is in early discussions with a large university to license its cybersecurity courses as part of their upcoming semester. Both organizations have decided to enter into an exploratory agreement while negotiating the detailed terms of the upcoming contract. Which of the following documents would best serve this purpose?

A. ISA
B. MOU
C. SLA
D. NDA

Answer 37

B. MOU

Explanation:
OBJ-4.3: A Memorandum of understanding (MOU) is used as a preliminary or exploratory agreement to express their intent for the two companies to work together. A service level agreement (SLA) is a contractual agreement setting out the detailed terms under which a service is provided. The interconnection security agreement (ISA) governs the relationship between any federal agency and a third party interconnecting their systems. A non-disclosure agreement (NDA) is the legal basis for protecting information assets.

Question 38

Consider the following snippet from a log file collected on the host with the IP address of 10.10.3.6.
What type of activity occurred based on the output above?

A. Denial of service attack targeting 10.10.3.6
B. Fragmentation attack targeting 10.10.3.6
C. Port scan targeting 10.10.3.6
D. Port scan targeting 10.10.3.2

Answer 38

C. Port scan targeting 10.10.3.6

Explanation:
OBJ-2.2: Port Scanning is the name for the technique used to identify open ports and services available on a network host. Based on the logs, you can see a sequential scan of some commonly used ports (20, 21, 22, 23, 25, 80, 135, 443, 445) with a two-second pause between each attempt. The scan source is 10.10.3.2, and the destination of the scan is 10.10.3.6, making “Port scan targeting 10.10.3.6” the correct choice. IP fragmentation attacks are a common form of denial of service attack, in which the perpetrator overbears a network by exploiting datagram fragmentation mechanisms. A denial-of-service (DoS) attack occurs when legitimate users cannot access information systems, devices, or other network resources due to a malicious cyber threat actor’s actions.

Question 39

Dion Training has contracted a cloud service provider to host their enterprise services. The company wants to create the same basic architecture that they would have in an on-premise data center by interconnecting all of their cloud-based resources. Which of the following should they use to create this type of architecture?

A .Region
B. Data zone
C. VPC/Vnet
D. Availability zone

Answer 39

C. VPC/Vnet

Explanation:
OBJ-1.1: A Virtual Private Cloud (VPC) or a Virtual Network (VNet) allows for the creation of cloud resources within a private network that parallels the functionality of the same resources in a traditional, privately operated data center. An availability zone is a physical or logical data center within a single region. A region describes a collection of data centers located within a geographic area and distributed across the globe. Data zones describe the state and location of data to help isolate and protect it from unauthorized/inappropriate use within a data lake.

Question 40

You identified a critical vulnerability in one of your organization’s databases. You researched a solution, but it will require the server to be taken offline during the patch installation. You have received permission from the Change Advisory Board to implement this emergency change at 11 pm once everyone has left the office. It is now 3 pm; what action(s) should you take now to best prepare for implementing this evening’s change? (SELECT ALL THAT APPLY)

A. Identify any potential risks associated with installing the patch
B. Take the server offline at 10pm in preparation for the change
C. Ensure all stakeholders are informed of the planned outage
D. Document the change in the change management system
E. Validate the installation of the patch in a staging environment
F. Take the opportunity to install a new feature pack that has been requested

Answer 40

A. Identify any potential risks associated with installing the patch
C. Ensure all stakeholders are informed of the planned outage
D. Document the change in the change management system
E. Validate the installation of the patch in a staging environment

Explanation:
OBJ-2.3: You should send out a notification to the key stakeholders to ensure they are notified of the planned outage this evening. You should test and validate the patch in a staging environment before installing it on the production server. You should identify any potential risks associated with installing this patch. You should also document the change in the change management system. You should not take the server offline before your change window begins at 11 pm, which could affect users who are relying on the system. You should not take this opportunity to install any additional software, features, or patches unless you have received approval from the Change Advisory Board (CAB).

Question 41

Which of the following is usually not considered when evaluating the attack surface of an organization?

A. Software applications
B. Software development lifecycle model
C. Websites and cloud entities
D. External and internal users

Answer 41

B. Software development lifecycle model

Explanation:
OBJ-1.3: The software development lifecycle model used by a company is purely an internal function relevant only to the development of custom software within the organization. Regardless of whether a waterfall or agile methodology is chosen, it does not directly affect the organization’s attack surface. The attack surface represents the set of things that could be attacked by an adversary. External and internal users, websites, cloud entities, and software applications used by an organization are all possible entry points that an adversary could attempt an attack upon.

Question 42

Your organization recently suffered a large-scale data breach. The hackers successfully exfiltrated the personal information and social security numbers of your customers from your network. The CEO notified law enforcement about the breach. They will assist with the investigation and conduct evidence collection so that the hackers can be brought up on charges. What actions should your organization take in response to this event?

A. Require all employees to commit to an NDA about the data breach in writing
B. Ask a member of law enforcement to meet with your employees
C. Block all employee access to social media from the company’s network and begin monitoring your employees email
D. Require all employees to commit to an NDA about the data breach verbally

Answer 42

B. Ask a member of law enforcement to meet with your employees

Explanation:
OBJ-2.7: Since the data breach is now the subject of an active law enforcement investigation, your organization should request that a law enforcement agent speaks with your employees to give them clear guidance on what they should and should not say to people outside of the investigation. Additionally, the company’s system administrators and analysts should not perform any actions on the network until they receive law enforcement guidance. This will ensure that the employees do not accidentally destroy and tamper with potential evidence of the crime.

Question 43

You are conducting a wireless penetration test against an organization. During your attack, you created an evil twin of their wireless network. Many of the organization’s laptops are now connected to your evil twin access point. Which of the following exploits should you utilize next to gather credentials from the victims browsing the internet through your access point?

A. Fragmentation attack
B. Downgrade attack
C. Deauthentication attack
D. Karma attack

Answer 43

B. Downgrade attack

Explanation:
OBJ-3.7: A downgrade attack forces a client to use a weaker SSL version that the attacker can crack. Since the devices are connected through your access point, you can establish a weaker SSL-based HTTPS connection between their web browser and the actual web server they wanted. This forcing of the client to use a weaker version is known as a downgrade attack, and it allows the attacker to capture the packets and later crack them offline since SSL-based HTTPS is weak enough to crack due to vulnerabilities in its design. A fragmentation attack obtains the pseudorandom generation algorithm (PRGA) of network packets used in WEP. Deauthentication attacks are used in the service of an evil twin, replay, cracking, denial of service, and other attacks. All 802.11 Wi-Fi protocols include a management frame that a client can use to announce that it wishes to terminate a connection with an access point. The victim’s device will be kicked off the access point by spoofing the victim’s MAC address and sending the deauthentication frame to the access point. A karma attack is a variant of the evil twin attack. A karma attack exploits the behavior of a wireless client trying to connect to its preferred network list. This list contains the SSIDs of access points the device has connected to in the past. When a wireless device is looking to connect to the internet, it firsts beacons to determine if any of these previously connected networks are within range.

Question 44

You are planning to exploit a network-based vulnerability against a Windows server. You have determined that it is vulnerable to the EternalBlue exploit because the system hasn’t installed the MS17-010 security patch. From your research, you know that this exploit would allow you to conduct arbitrary remote code execution by exploiting a fault in the communication protocol used by Windows file and print servers. Which of the following types of exploits are you planning?

A. SNMP Exploit
B. SMB Exploit
C. SMTP exploit
D. FTP Exploit

Answer 44

B. SMB Exploit

Explanation:
OBJ-2.4: Server Message Block (SMB) allows clients to read from and write to a server service, providing core authentication and communications for Windows file and print servers. The EternalBlue exploit was released in early 2017, and it can be used against Windows (Vista SP2 through Server 2016, both 32-bit and 64-bit versions).

Question 45

You are planning to exploit a network-based vulnerability against an organization as part of a penetration test. You attempted to connect your laptop to a port in their conference room. You were redirected to a captive portal for not meeting the organization’s approved security baseline for a Windows 10 laptop. Which of the following types of exploits should you use to bypass NAC and access the network?

A. Spoof the MAC address of the rooms VOIP phone to your laptop
B. Conduct a denial of service attack against the network policy server
C. Perform a remote code execution on the NAC controller
D. Harvest the user credentials of an employee and use those to connect

Answer 45

A. Spoof the MAC address of the rooms VOIP phone to your laptop

Explanation:
OBJ-2.5: Network access control (NAC) is used to prevent unhealthy devices from accessing an organization’s internal network. To break into a network that uses NAC, you must perform a NAC bypass attack. One popular NAC bypass method is to spoof the MAC or IP address of a printer or VOIP device since they cannot natively participate in NAC and are often allow listed by administrators. Another method is to configure your attacking device to use IPv6 instead of IPv4. Most routers and switches support IPv4 and IPv6, but many system administrators only configure NAC for their IPv4 devices out of habit. The final method would be to set up a rogue wireless access point to create an on-path condition. This would allow an authorized device to connect to your wireless access point and then use its authorized status to connect to the network.

Question 46

Dion Development Group utilizes Amazon Web Services as their cloud service provider. The company likes to keep everything with the same cloud provider to simplify its business operations. During their rapid development cycles, the development team decided to use the AWS Key Management Service (KMS) to manage all the cryptographic keys across their AWS-based applications and services. Which of the following types of KMS is the company utilizing?

A. Cloud Native Key Management System
B. Multi cloud key management system
C. External key origination
D. Cloud service using external key management systems

Answer 46

A. Cloud Native Key Management System

Explanation:
OBJ-3.4: A Cloud Native Key Management System uses a KMS that is configured and operated by the same provider being used to run the organization’s cloud services. An External Key Origination uses keys generated by a KMS not managed by the same cloud provider that will use the keys. An External Key Origination model is commonly used to meet legal or regulatory compliance requirements when the cloud customer must wholly own the keys. A Cloud Service Using External Key Management Systems allows the customer to leverage a cloud service offering to provide KMS-hosted external services on-premises or through an alternate cloud service provider. The KMS hardware can be acquired by the customer or the KMS may be a service offering of the cloud provider. Either way, the HSM is exclusively used by the customer who owns the keys. A Multi-Cloud Key Management System (MCKMS) is a key management system that can be used by multiple clouds. A MCKMS incorporates the features of a Cloud Native Key Management System, an External Key Origination, and a Cloud Service Using External Key Management Systems.

Question 47

Which of the following cryptographic protocols provides comparable levels of protection to RSA but with smaller key sizes?

A. ChaCha
B. ECDSA
C. DSA
D. Salsa20

Answer 47

B. ECDSA

Explanation:
OBJ-3.6: Elliptic-Curve Digital Signature Algorithm (ECDSA) is an asymmetric algorithm that utilizes the properties of elliptic curves to provide comparable levels of protection as RSA with a much smaller key size. The digital signature algorithm (DSA) is a cryptographic algorithm that uses logarithmic and modulus math to generate and verify digital signatures. The DSA is faster than RSA at generating digital signatures, but it is slower than RSA when verifying them. Salsa20 is a modern and efficient symmetric stream cipher that uses a 128-bit or 256-bit encryption key. Salsa20 is not used in many cryptographic implementations, but a variant of Salsa20 known as ChaCha is widely adopted by Google for use in Android devices and the Google Chrome browser. ChaCha is a variant of Salsa20 that is a modern and efficient symmetric stream cipher that uses a 128-bit or 256-bit encryption key. ChaCha is widely used in combination with the Poly1305 hashing algorithm in the TLS implementation of the Google Chrome browser and the Android operating system. ChaCha is also used by OpenSSH and the random number generator in BSD operating systems as a replacement to the older RC4 algorithm.

Question 48

Dion Training is trying to register for a new digital certificate for a newly deployed webserver. The technician has filled out the certificate enrollment template but each time they attempt to submit it they receive the “operation failed” error. Which of the following is MOST likely causing this error?

A. Incorrect permissions
B. Chain issues
C. Cipher mismatch error
D. Wrong certificate type

Answer 48

A. Incorrect permissions

Explanation:
OBJ-3.7: An incorrect permissions error is generated when a template is used for certificate enrollment but the template’s permissions are misconfigured. This can result in a “cannot enroll for this type of certificate” or an “operation failed” error. A cipher mismatch error is generated by a modern web browser if an old or deprecated cipher suite is being requested for use by the webserver. Alternatively, this error can also occur if the client is using an older operating system that doesn’t support a more modern cipher suite. Chain issues occur when the root, subordinate, or leaf certificate fails to pass a validity check. Since the certificate authorities must all pass the validity checks for the certification issued to be considered valid, if any of these are invalid then the entire chain is considered invalid, too. A wrong certificate type error is generated when a certificate designed for a specific use case is used for a different reason. For example, if a user attempts to log in to a website using an email certificate instead of an identification certificate, a wrong certificate type error will be generated.

Question 49

Dion Training is accepting requests for proposals from three cloud hosting providers to outsource the hosting of their learning management systems. In reviewing the proposals, Jason identified that one of the cloud providers offers free data transfer into the cloud but charges high rates for data transfer out of their cloud. Which of the following vendor risks does this data transfer pricing policy represent?

A. Vendor visibility
B. Vendor lock in
C. Vendor lockout
D. Vendor viability

Answer 49

B. Vendor lock in

Explanation:
OBJ-4.2: This pricing policy represents a vendor lock-in risk since it could become cost-prohibitive to migrate to another cloud provider in the future due to the large outbound data transfer costs. Vendor Lock-in occurs when a customer is dependent on a vendor for products or services because switching is either impossible or would result in substantial complexity and costs. Vendor lockout occurs when a vendor’s product is developed in a way that makes it inoperable with other products, the ability to integrate it with other vendor products is not a feasible option or does not exist. Vendor viability occurs when a vendor has a viable and in-demand product and the financial means to remain in business on an ongoing basis. Vendor visibility is a term used to define how transparent a supplier is with their payment and shipment status details.

Question 50

You have just finished running a vulnerability scan of the network and are reviewing the results. The first result in the report shows the following vulnerability:

You log into the MySQL server and verify that you are currently running version 3.5.3. Based on the item shown on the image, what best describes how you should categorize this finding?

A. True positive
B. True negative
C. False negative
D. False positive

Answer 50

D. False positive

Explanation:
OBJ-2.7: You should categorize the results as a false positive. Based on the scenario and output, your server is not vulnerable to a remote code execution for the identified vulnerability. You are already running MySQL v3.5.3 that is greater than v3.3.x or above. This indicates that the vulnerability scanner falsely identified your MySQL version as an earlier and more vulnerable version. The system incorrectly identified a vulnerability, but the vulnerability doesn’t exist on your system. Therefore this is a false positive.

Question 51

A penetration tester is conducting an assessment of a wireless network that is secure using WPA2 Enterprise encryption. Which of the following are major differences between conducting reconnaissance of a wireless network versus a wired network? (SELECT TWO)

A. Network access control
B. Authentication
C. Physical accessibility
D. MAC Filtering
E. Port security
F. Encryption

Answer 51

C. Physical accessibility
F. Encryption

Explanation:
OBJ-2.4: Most wireless networks utilize end-to-end encryption, whereas wired networks do not. Physical accessibility is another major difference between wireless and wired networks since wireless networks can be accessed from a distance using powerful antennas. Authentication, MAC filtering, and network access control (NAC) can be implemented equally on wired and wireless networks. Port security is only applicable to wired networks.

Question 52

Julie was just hired to conduct a security assessment of Dion Training’s security policies. During her assessment, she noticed that many users were sharing group accounts to conduct their work roles. Julie recommended that the group accounts be eliminated and instead have an account created for each user. What improvement will this recommended action provide for the company?

A. Increase individual accountability
B. More efficient baseline management
C. Increase password security
D. More routing auditing

Answer 52

A. Increase individual accountability

Explanation:
OBJ-1.5: To adequately provide accountability, the use of shared or group accounts should be disabled. This allows you to log and track individual user actions based on individual user accounts. This enables the organization to hold users accountable for their actions, too.

Question 53

Dion Training is conducting a risk analysis of their current staffing and has identified that only Tim can update the website when a new course is being released. Tim has been with the company for years and has no plans to leave his current position, but only having one person who can perform this job function does seem risky to the management team. Which of the following policies or procedures would BEST help mitigate this risk?

A. Least Privilege
B. Job rotation
C. Separation of duties
D. Password policies

Answer 53

B. Job rotation

Explanation:
OBJ-4.1: Implementing a job rotation policy would mitigate this risk. Job rotation is a security policy that prevents any one individual from performing the same role or tasks for too long. Job rotation also helps to ensure that the organization is not tied too firmly to any one individual because of their institutional knowledge in a single position. Separation of duties is a security policy that states that duties and responsibilities should be divided among individuals to prevent ethical conflicts or abuse of powers. Least privilege is a security policy that states someone or something should be allocated the minimum necessary rights, privileges, or information to perform the specific role. Password policies define the length, complexity, history, age, and other password requirements.+

Question 54

Which file on a Linux system contains the passwords for each user on the system?

A. /etc/password
B. /etc/shadow
C. /etc/users
D. /etc/passwd

Answer 54

B. /etc/shadow

Explanation:
OBJ-1.5: The /etc/shadow file stores the actual password in an encrypted format (more like the hash of the password) for the user’s account with additional properties related to the user password. Basically, it stores secure user account information. All fields are separated by a colon (:) symbol. It contains one entry per line for each user listed in /etc/passwd file.

Question 55

Your company was recently the victim of a cross-site scripting attack. The system administrators claim this wasn’t possible since they performed input validation using REGEX to alert on any strings that contain the term “[Ss]cript” in them. Which of the following statements concerning this attack is true?

A. The attacker has modified the logs to cover their tracks and prevent a successful investigation
B. The REGEX expression to filtering using “[Ss]cript” is insufficient since an attacker could use SCRIPT or SCRipt or %53ript to evade it
C. An SQL injection must have occurred since their input validation would have prevented

 or 
 from being used
D. The server has insufficient logging and monitoring configured

Answer 55

B. The REGEX expression to filtering using “[Ss]cript” is insufficient since an attacker could use SCRIPT or SCRipt or %53ript to evade it

Explanation:
OBJ-2.2: The most likely explanation is that the REGEX filter was insufficient to eliminate every single possible cross-site scripting attack that could occur. Since cross-site scripting relies on the

 and 

HTML tags to launch, the system administrators had a good idea of creating input validation using a REGEX for those keywords. Unfortunately, they forgot to include a more inclusive version of this REGEX to catch all variants. For example, simply using [Ss][Cc][Rr][Ii][Pp][Tt] would have been much more secure, but even this would miss %53CrIPT would evade this filter. To catch all the letter S variants, you would need to use [%53%%73Ss], which includes the capital S in hex code, the lower case s in hex code, the capital S, and the lowercase s. While using a SQL injection is possible, their REGEX input validation would still have allowed a cross-site scripting attack to occur, so this option must be eliminated. As for the logging options, both are possible in the real world, but they do not adequately answer this scenario. The obvious flaw in their input validation is their REGEX filter.

Question 56

Dion Training is evaluating the security of its endpoint configurations. During the evaluation, one of the analysts identified that data being stored on an internal solid state device is being encrypted using BitLocker. The analyst is concerned that the data-at-rest could be compromised if someone was able to collect the encryption key stored in the system’s RAM. Which of the following endpoint security controls would eliminate this vulnerability while still providing data-at-rest for the data stored on an internal solid state device or hard disk drive?

A. Self encryption drive (SED)
B. Attestation services
C. Local drive encryption
D. Secure encrypted enclaves

Answer 56

A. Self encryption drive (SED)

Explanation:
OBJ-3.2: A self-encrypting drive (SED) is a type of solid state device (SSD) or hard disk drive (HDD) that conducts transparent encryption of all data as it is written to the device using an embedded hardware cryptographic processor. A self-encrypting drive uses transparent encryption by implementing a cryptographic hardware processor with embedded encryption keys to prevent the theft of encryption keys from the system’s RAM. Local drive encryption protects the contents of a solid state device (SSD) or hard disk drive (HDD) when the operating system is not running through the use of software-based encryption such as BitLocker, FileVault, or TrueCrypt. Attestation services are used to ensure the integrity of the computer’s startup and runtime operations. Hardware-based attestation is designed to protect against threats and malicious code that could be loaded before the operating system is loaded. Secure encrypted enclaves protect CPU instructions, dedicated secure subsystems in a system on a chip (SoC), or a protected region of memory in a database engine by only allowing data to be decrypted on the fly within the CPU, SoC, or protected region.

Question 57

Which of the following terms represents the maximum amount of data, as measured in time, that an organization is willing to lose during an outage?

A. MTTR
B. MTBF
C. RTO
D. RPO

Answer 57

D. RPO

Explanation:
OBJ-4.4: The recovery point objective (RPO) is the interval of time that might pass during a disruption before the quantity of data lost during that period exceeds the Business Continuity Plan’s maximum allowable threshold or tolerance. The recovery time objective (RTO) is the duration of time and a service level within which a business process must be restored after a disaster to avoid unacceptable consequences associated with a break in continuity. The mean time to repair (MTTR) measures the average time it takes to repair a network device when it breaks. The mean time between failures (MTBF) measures the average time between when failures occur on a device.

Question 58

You are investigating a suspected compromise. You have noticed several files that you don’t recognize. How can you quickly and effectively check if the files have been infected with malware?

A. Diassemble the files and conduct static analysis onm them using IDA pro
B. Run the strings tool against each file to identify common malware identifiers
C. Scan the files using a local AV/anti malware engine
D. Submit the files to an open source intelligence provider like VIrusTotal

Answer 58

D. Submit the files to an open source intelligence provider like VIrusTotal

Explanation:
OBJ-2.7: The best option is to submit them to an open-source intelligence provider like VirusTotal. VirusTotal allows you to quickly analyze suspicious files and URLs to detect types of malware. It then automatically shares them with the security community, as well. Disassembly and static analysis would require a higher level of knowledge and more time to complete. Running the Strings tool can help identify text if the code is not encoded in a specific way within the malware, but you have to know what you are looking for, such as a malware signature. You should never scan the files using a local anti-virus or anti-malware engine if you suspect the workstation or server has already been compromised because the scanner may also be compromised.

Question 59

Which of the following vulnerabilities involves leveraging access from a single virtual machine to other machines on a hypervisor?

A. VM migration
B. VM data remnant
C. VM Escape
D. VM sprawl

Answer 59

C. VM Escape

Explanation:
OBJ-2.5: Virtual machine escape vulnerabilities are the most severe issue that may exist in a virtualized environment. In this attack, the attacker can access a single virtual host and then leverages that access to intrude on the resources assigned to different virtual machines. Data remnant is the residual representation of digital data that remains even after attempts have been made to remove or erase it. Virtualization sprawl is a phenomenon that occurs when the number of virtual machines on a network reaches a point where the administrator can no longer manage them effectively. Virtual machine migration is the task of moving a virtual machine from one physical hardware environment to another.

Question 60

The Security Operations Center Director for Dion Training received a pop-up message on his workstation that said, “You will regret firing me; just wait until Christmas!” He suspects the message came from a disgruntled former employee who may have set up a piece of software to create this pop-up on his machine. The director is now concerned that other code might be lurking within the network that could negatively affect Christmas. He directs his team of cybersecurity analysts to begin searching the network for this suspicious code. What type of malware should they be searching for?

A. Trojan
B. Logic bomb
C. Adware
D. Worm

Answer 60

B. Logic bomb

Explanation:
OBJ-2.1: A logic bomb is a piece of code intentionally inserted into a software system that will set off a malicious function when specified conditions are met. For example, a programmer may hide a piece of code that starts deleting files should they ever be terminated from the company. The director is concerned that a logic bomb may have been created and installed on his system or across the network before the analyst was fired.

Question 61

What technique is an attacker using if they review data and publicly available information to gather intelligence about the target organization without scanning or other technical information-gathering activities?

A. Active scanning
B. Passive reconnaissance
C. Vulnerability scanning
D. Patch management

Answer 61

B. Passive reconnaissance

Explanation:
OBJ-2.4: Passive reconnaissance combines publicly available data from various sources about an organization and does not use active scanning or data gathering methods. Vulnerability scanning is an inspection of the potential points of exploitation on a computer or network to identify security holes. A vulnerability scan is usually conducted to detect and classify system weaknesses in computers, networks, and communications equipment and predict the effectiveness of countermeasures. Patch management is the process that helps acquire, test, and install multiple patches (code changes) on existing applications and software tools on a computer, enabling systems to stay updated on existing patches and determining which patches are the appropriate ones.

Question 62

A company utilizes a patching server to update its PCs regularly. After the latest patch deployment, all of the older PCs with non-gigabit Ethernet cards become disconnected from the network and now require a technician to fix the issue locally at each PC. What could be done to prevent this problem next time?

A. Disable automatic driver updates to PCs from the patching server
B. Require the patching server to update the oldest PCs off hours
C. Enable automatic rebooting of the PCs after patching is completed
D. Throttle the connection speed of the patching server to match older PCs

Answer 62

A. Disable automatic driver updates to PCs from the patching server

Explanation:
OBJ-3.2: The most likely cause of this issue was a forced driver update being pushed from the update server to the older PCs, breaking their ability to use their network cards. It is best to disable automatic driver updates for PCs from the patching server by default and instead test them individually first.

Question 63

Dion Consulting Group has been hired to analyze the cybersecurity model for a new videogame console system. The manufacturer’s team has come up with four recommendations to prevent intellectual property theft and piracy. As the cybersecurity consultant on this project, which of the following would you recommend they implement first?

A. Ensure that each individual console has a unique key for decrypting individual licenses and tracking which console has purchased which game
B. Ensure that all games require excessive storage sizes so that it is difficult for unauthorized parties to distribute
C. Ensure that all screen capture content is visibly watermarked
D. Ensure that all games for the console are distributed as encrypted so that they can only be decrypted on the game console

Answer 63

A. Ensure that each individual console has a unique key for decrypting individual licenses and tracking which console has purchased which game

Explanation:
OBJ-1.5: Ensuring that each console has a unique key will allow the console manufacturer to track who has purchased which games when using digital rights management licensing. This can be achieved using a hardware root of trust, such as a TPM module in the processor. While encrypting the games during distribution will provide some security, the games could be decrypted and distributed by unauthorized parties if the encryption key were ever compromised. The recommendation of making the game arbitrarily large will frustrate both authorized and unauthorized, which could negatively impact sales, so it is a poor recommendation to implement. Visibly watermarking everything will only aggravate the user, provide a negative customer experience, and not help fight software piracy.

Question 64

A network technician at a warehouse must implement a solution that will allow a company to track shipments as they enter and leave the facility. The warehouse workers must scan each package as it enters the warehouse using a sensor. Which of the following technologies should they utilize to meet these requirements?

A. WiFi
B. RFID
C. Bluetooth
D. NFC

Answer 64

B. RFID

Explanation:
OBJ-3.1: Radio-frequency identification (RFID) uses electromagnetic fields to automatically identify and track tags attached to objects. The warehouse could utilize RFID to allow for the accurate scanning of items using radio frequency tracking tags and sending data of up to 2 KB to a sensor at rapid speeds. Bluetooth is a short-range wireless technology standard that is used for exchanging data between fixed and mobile devices over short distances using UHF radio waves in the ISM band from 2.402 GHz to 2.48 GHz and building personal area networks. Bluetooth would not allow the worker to have full coverage throughout the warehouse due to the short distance requirement between a transmitter and receiver. Near-Field Communication (NFC) is a set of communication protocols for communication between two electronic devices over a distance of 4 cm or less. NFC offers a low-speed connection with a simple setup that can be used to bootstrap more capable wireless connections. Wi-Fi is a family of wireless network protocols, based on the IEEE 802.11 family of standards, which are commonly used for local area networking of devices and Internet access, allowing nearby digital devices to exchange data by radio waves. Wi-Fi can provide high speeds and cover a maximum distance of up to 150 meters.

Question 65

Dion Training wants to mitigate against the threat of a brute force attack or key disclosure compromise on its webservers. To protect against this threat, the company has instituted a policy of revoking and reissuing its public/private keys every 12 months. Which of the following cryptographic techniques has Dion Training implemented to mitigate these threats?

A. Cryptographic obfuscation
B. Crypto shredding
C. Key rotation
D. Rekeying

Answer 65

C. Key rotation

Explanation:
OBJ-3.7: Key rotation is the process of purposely changing keys periodically to mitigate against brute force attacks and key disclosure compromises. During key rotation, the previous key is also revoked and invalidated. Rekeying is the process of changing an individual key during a communication session. Most communication protocols use session key rekeying to protect the data being transmitted. A rekeying is normally triggered based on the volume of data communicated or the amount of time since the last rekeying. Crypto shredding is used to destroy a decryption key to effectively destroy the data that key was used to protect. This technique ensures that the data will remain encrypted if the key is fully destroyed and the encryption algorithm itself remains secure. Cryptographic obfuscation is used to transform protected data into an unreadable format. For example, the Linux user passwords stored in the /etc/shadow file are obfuscated to protect them.

Question 66

You have been asked to review the SIEM event logs for suspected APT activity. You have been given several indicators of compromise, such as a list of domain names and IP addresses. What is the BEST action to take to analyze the suspected APT activity?

A. Analyze the trends of the events while manually reviewing them to see if any indicators match
B. Use the IP addresses to search through event logs
C. Scan for vulnerabilities with exploits known to previously have been used by an APT
D. Create an advanced query that includes all of the indicators and review any matches

Answer 66

A. Analyze the trends of the events while manually reviewing them to see if any indicators match

Explanation:

OBJ-2.2: You should begin by analyzing the event’s trends while manually reviewing them to determine if any of the indicators match. If you only searched through the event logs using the IP addresses, this would not be sufficient as many APTs hide their activity by compromising and using legitimate networks and their IP addresses. If you only use the IP addresses to search the event logs, you would miss any events correlated only to the domain names. If you create an advanced query will all of the indicators, your search of the event logs will find nothing because no single event will include all of these IPs and domain names. Finally, while scanning for vulnerabilities known to have been used by the APTs is a good practice, it would only be effective in determining how to stop future attacks from occurring, not determine whether or not an attack has already occurred.

Question 67

Dion Training is acquiring Cyber Learning. Both organizations currently have their own PKI implementations built around a single certificate authority at each organization. During the acquisition, Dion Training wants to establish a trust relationship between the Dion Training and Cyber Learning certificate authorities so that users and devices from each organization can use resources from the other organization during the acquisition. Which of the following trust models would BEST meet these requirements?

A. Bridge model
B. Hierarchical model
C. Cross certification model
D. Single CA model

Answer 67

C. Cross certification model

Explanation:
OBJ-3.5: A cross certification model is most appropriate when connecting two organizations during an acquisition or merger. A cross certification model is a trust model that allows a trust relationship to be established between two certification authorities. Cross certification allows users and devices of two organizations to be recognized by the other, regardless of which organization’s root CA signed their certificate. A bridge model is a trust model that allows a local CA to connect to a centralized bridge CA which maintains bilateral arrangements with the local CAs from other organizations. This model forms a star topology of trust, where all trust and verification occur through the central bridge node. A single CA is used to issue certificates to users and users only trust certificates issued by that CA. A hierarchical model allows a root certificate authority to trust multiple intermediate or subordinate certificate authorities in a parent/child relationship. Through this trust model, all members trust the root server and, therefore, they can also trust each other.

Question 68

What type of cloud service would provide you with a complete development and deployment environment in the cloud for you to create customized cloud-based apps?

A. PaaS
B. DaaS
C. IaaS
D. SaaS

Answer 68

A. PaaS

Explanation:
OBJ-1.6: Platform as a service (PaaS) is a complete development and deployment environment in the cloud, with resources that enable you to deliver everything from simple cloud-based apps to sophisticated, cloud-enabled enterprise applications. You purchase the resources you need from a cloud service provider on a pay-as-you-go basis and access them over a secure Internet connection. PaaS includes infrastructure (servers, storage, and networking) and middleware, development tools, business intelligence (BI) services, database management systems, and more. PaaS allows you to avoid the expense and complexity of buying and managing software licenses, the underlying application infrastructure and middleware, container orchestrators, or the development tools and other resources. You manage the applications and services you develop, and the cloud service provider typically manages everything else. Infrastructure as a Service (IaaS) is a cloud computing service that enables a consumer to outsource computing equipment purchases and running their own data center. Software as a Service (SaaS) is a cloud computing service that enables a service provider to make applications available over the Internet to end-users. This can be a calendar, scheduling, invoicing, word processor, database, or other programs. For example, Google Docs and Office 365 are both word processing SaaS solutions. Desktop as a Service (DaaS) provides a full virtualized desktop environment from within a cloud-based service. This is also known as VDI (Virtualized Desktop Infrastructure) and is coming in large enterprise businesses focused on increasing their security and minimizing their operational expenses.

Question 69

Dion Training is determining which EAP implementation to use for authentication on their network. The company hasn’t decided whether to use PAP, CHAP, or MS-CHAP for user authentication with a traditional username and password yet. The server will utilize a server-side public-key certificate that is used to create an encrypted tunnel between the supplicant (client) and the authentication server. To keep their user authentication available for any of the three options being considered, which of the following EAP implementations should the organization select?

A. EAP-TTLS
B. LEAP
C. EAP-FAST
D. EAP-TLS

Answer 69

A. EAP-TTLS

Explanation:
OBJ-3.6: EAP Tunneled Transport Layer Security (EAP-TTLS) uses a server-side certificate to establish a protected tunnel through which the user’s authentication credentials are transmitted to the authentication server. EAP-TTLS can use any inner authentication protocol, including PAP, CHAP, MSCHAP, or GTC, whereas PEAP can only use EAP-MSCHAP and EAP-GTC. EAP Transport Layer Security (EAP-TLS) is the strongest type of authentication used in EAP. EAP-TLS establishes an encrypted TLS tunnel between the client and the server using public-key certificates for both the server and the client for mutual authentication. The client will normally use digital certificates located on a smart card or a certificate installed on the client device in the TPM for their portion of the authentication for additional security. EAP with Flexible Authentication via Secure Tunneling (EAP-FAST) creates a protected tunnel without using a digital certificate and then passes the user’s authentication credentials through the tunnel to the authentication server. Instead of relying on a digital certificate, the client is issued a Protected Access Credential (PAC) based on the server’s master key, but then this PAC must be securely distributed to the user’s client before utilizing EAP-FAST. Lightweight Extensible Authentication Protocol (LEAP) utilizes MS-CHAP for client authentication but does not support the use of public-key certificates for either the client or the server.

Question 70

Dion Training wants to require students to log on using multifactor authentication to increase the security of the authorization and authentication process. Currently, students log in to diontraining.com using a username and password. What proposed solution would best meet the goal of enabling multifactor authentication for the student login process?

A. Require students to enter a cognitive password requirement (such as What is your dogs name?’)
B. Require students to enter a unique six digit number that is sent to them by SMS after entering their username and password
C. Require student to create a unique pin that is entered after their username and password are accepted
D. Require students to choose an image to serve as a secondary password after logon

Answer 70

B. Require students to enter a unique six digit number that is sent to them by SMS after entering their username and password

Explanation:
OBJ-1.5: All of the options presented are knowledge factors (something you know) except the six-digit number sent by SMS to your smartphone. This SMS sent number is an example of a possession factor or something you have. In this case, it verifies you have your smartphone. By combining this possession factor with the already in use knowledge factor (username and password), you can establish multifactor security for the login process.

Question 71

What control provides the best protection against both SQL injection and cross-site scripting attacks?

A. network layer firewalls
B. Input validation
C. CSRF
D. Hypervisors

Answer 71

B. Input validation

Explanation:
OBJ-1.3: Input validation prevents the attacker from sending invalid data to an application and is a strong control against both SQL injection and cross-site scripting attacks. A network layer firewall is a device that is designed to prevent unauthorized access, thereby protecting the computer network. It blocks unauthorized communications into the network and only permits authorized access based on the IP address, ports, and protocols in use. Cross-site request forgery (CSRF) is another attack type. A hypervisor controls access between virtual machines.

Question 72

Dion Security Group is analyzing the encryption implementation of one of its customers. An analyst has discovered that they are using a mode of operation that uses an initialization vector and an incrementing value that is added to the key to generate the keystream uses in encryption. Which of the following modes of operation is being used by the customer?

A. Counter mode
B. Galois/counter mode
C. Output feedback
D. Cipher block chaining

Answer 72

A. Counter mode

Explanation:
OBJ-3.6: Counter (CTR) mode enables symmetric block ciphers to work with large sets of data by using an initialization vector and adding an incrementing counter value to the key to generate a keystream. Counter mode does not use padding in its operations and simply discards any unused space in the final block. Output feedback (OFB) enables symmetric block ciphers to work with large sets of data by using an initial chaining vector (ICV) during the first round of encryption and then combining the output of the previous rounds into the subsequent rounds. Galois/counter mode (GCM) provides a method of authenticated encryption with associated data (AEAD) that enables symmetric block ciphers to work with large sets of data. GCM is a specialized variant of the older counter mode that adds the authenticated data feature to ensure the integrity and authenticity of the data. Cipher block chaining (CBC) is a simple mode of enabling symmetric block ciphers to work with large sets of data and is an older method that is vulnerable to the padding-oracle attack.

Question 73

You just received an email from Bob, your investment banker, stating that he completed the wire transfer of $10,000 to your bank account in Vietnam. The problem is, you do not have a bank account in Vietnam, so you immediately call Bob to ask what happened. Bob explains that he received an email from you requesting the transfer. You insist you never sent that email to Bob initiating this wire transfer. What aspect of PKI could be used to BEST ensure that a sender sent a particular email message and avoid this type of situation?

A .CRL
B. Recovery agents
C. Trust models
D. Non repudiation

Answer 73

D. Non repudiation

Explanation:
OBJ-1.7: Non-repudiation occurs when a sender cannot claim they didn’t send an email when they did. A digital signature should be attached to each email sent to achieve non-repudiation. This digital signature is comprised of a digital hash of the email’s contents, and then encrypting that digital hash using the sender’s private key. The receiver can then unencrypt the digital hash using the sender’s public key to verify the message’s integrity.

Question 74

Dion Training is developing a new system and needs to determine which features to implement as part of its data protection scheme. The lead security engineering has recommended an implementation that would use a form of encryption that allows the data to have integrity and authenticity checks performed upon it during the encryption process. Which cryptographic concept is the programmer referring to in his implementation?

A. Key streching
B. Cipher block chaining
C. Forward secrecy
D. AEAD

Answer 74

D. AEAD

Explanation:
OBJ-3.5: Authenticated encryption with associated data (AEAD) is a form of encryption that provides confidentiality of the plaintext, a way to check its integrity, and a method of verifying its authenticity. Forward secrecy (FS), also known as perfect forward secrecy (PFS), is a feature of specific key agreement protocols that gives assurances that session keys will not be compromised even if long-term secrets used in the session key exchange are compromised. Key stretching is a technique that strengthens potentially weak input for cryptographic key generation, such as passwords or passphrases created by people, against brute force attacks. Cipher block chaining (CBC) is a simple mode of enabling symmetric block ciphers to work with large sets of data. CBC is an older method that is vulnerable to the padding-oracle attack and should therefore not be used.

Question 75

You are conducting an incident response and have traced the attack source to some compromised user credentials. After performing log analysis, you discover that the attack was successfully authenticated from an unauthorized foreign country. Your management is now asking for you to implement a solution to help mitigate this type of attack from occurring again. Which of the following should you implement?

A .Password complexity
B. Content based authentication
C. Single sign on
D. Self service password reset

Answer 75

B. Content based authentication

Explanation:
OBJ-1.5: Context-based authentication can consider several factors before permitting access to a user, including their location (e.g., country, GPS location, etc.), the time of day, and other key factors to minimize the threat of compromised credentials from being utilized by an attacker. A self-service password reset is defined as any process or technology that allows users who have either forgotten their password or triggered an intruder lockout to authenticate with an alternate factor and repair their problem without calling the help desk. While helpful, this alone would not help prevent an attacker from using the compromised credentials. Single sign-on (SSO) is an authentication scheme that allows a user to log in with a single ID and password to any of several related yet independent software systems. Again, this is helpful since it will minimize the number of usernames and passwords that a user must remember. Still, if their credentials are stolen, then the attacker can now access every system the user had access to, extending the problem. Password complexity is also a good thing to use, but it won’t address the challenge presented in how to prevent the use of compromised credentials. If the password complexity is increased, this will prevent a brute force credential compromise. However, if the credentials are compromised any other way, the attacker could still log in to our systems and cause trouble.

Question 76

Tim is working to prevent any remote login attacks to the root account of a Linux system. What method would be the best option to stop attacks like this while still allowing normal users to connect using ssh?

A. Add root to the sudoers group
B. Add a network IPS rule to block root logins
C. Add an iptables rule blocking root logins
D. Change sshd_config to deny root login

Answer 76

D. Change sshd_config to deny root login

Explanation:
OBJ-3.2: Linux systems use the sshd (SSH daemon) to provide ssh connectivity. If Tim changes the sshd_config to deny root logins, it will still allow any authenticated non-root user to connect over ssh. The sshd service has a configuration setting that is named PermitRootLogin. If you set this configuration setting to no or deny, all root logins will be denied by the ssh daemon. If you didn’t know about this setting, you could still answer this question by using the process of elimination. An iptables rule is a Linux firewall rule, and this would block the port for ssh, not the root login. Adding root to the sudoers group won’t help either since the sudoers group allows users to login as root. If you have a network IPS rule to block root logins, the IPS would have to see the traffic being sent within the SSH tunnel. This is not possible since SSH connections are encrypted end-to-end by default. Therefore, the only possible right answer is to change the sshd_config setting to deny root logins.

Question 77

Which type of RAID should be used for a virtualization server that must have the fastest speed and highest redundancy level?

A. RAID 0
B. RAID 5
C. RAID 1
D. RAID 10

Answer 77

D. RAID 10

Explanation:
OBJ-1.4: RAID 10 offers the fastest speed, best reliability, and highest redundancy but is more costly as the overall disk storage will be greatly reduced. A RAID 10 combines disk mirroring and disk striping to protect data stored in the array and required a minimum of four disks. A RAID 0 provides disk striping (speed/performance) but not mirroring with a minimum of two disks. A RAID 1 provides mirroring (redundancy) but not disk striping with a minimum of two disks. A RAID 5 provides block-level striping with distributed parity to provide redundancy using a minimum of three disks.

Question 78

Your company has recently migrated much of your data center to the cloud. Now, your boss needs a method to monitor all services used in supporting your customers to be properly billed based on their usage. Which of the following cloud computing concepts is your boss describing?

A. Measured services
B. On demand
C. Rapid elasticity
D. Resource pooling

Answer 78

A. Measured services

Explanation:
OBJ-1.6: Measured service is a term that IT professionals apply to cloud computing that references services where the cloud provider measures or monitors the provision of services for various reasons, including billing, effective use of resources, or overall predictive planning. Rapid elasticity is used to describe scalable provisioning or the capability to provide scalable cloud computing services. Rapid elasticity is very critical to meet the fluctuating demands of cloud users. The downside of rapid elasticity implementations is that they can cause significant loading of the system due to the high resource number of allocation and deallocation requests. On-demand refers to the fact that a consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service provider. Resource pooling refers to the concept that allows a virtual environment to allocate memory and processing capacity for a VMs use.

Question 79

You are working as part of the server team for an online retail store. Due to the upcoming holidays, your boss is worried that the current servers may not be able to handle the increased demand during a big sale. Which of the following cloud computing concepts can quickly allow services to scale upward during busy periods and scale down during slower periods based on the changing user demand?

A. On demand
B. Rapid elasticity
C. Resource pooling
D. Metered services

Answer 79

B. Rapid elasticity

Explanation:
OBJ-1.2: Rapid elasticity is used to describe scalable provisioning or the capability to provide scalable cloud computing services. Rapid elasticity is very critical to meet the fluctuating demands of cloud users. The downside of rapid elasticity implementations is that they can cause significant loading of the system due to the high resource number of allocation and deallocation requests. Resource pooling refers to the concept that allows a virtual environment to allocate memory and processing capacity for a VMs use. On-demand refers to the fact that a consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service provider. Metered services are pre-paid, a-la-carte, pay-per-use, or committed offerings. A metered service like a database may charge its users based on the actual usage of the service resources on an hourly or monthly basis. For example, Dion Training used the AWS Lambda serverless product in some of our automation. This service charges us $0.20 for every 1 million requests processed.

Question 80

A web developer wants to protect their new web application from an on-path attack. Which of the following controls would best prevent an attacker from stealing tokens stored in cookies?

A. Hashing the cookie value
B. Setting the secure attribute on the cookie
C. Forcing the use of TLS for the web application
D. Forcing the use of SSL for the web application

Answer 80

B. Setting the secure attribute on the cookie

Explanation:
OBJ-1.3: When a cookie has the Secure attribute, the user agent includes the cookie in an HTTP request only if transmitted over a secure channel (typically HTTPS). Although seemingly useful for protecting cookies from active network attackers, the Secure attribute protects only the cookie’s confidentiality. Forcing the web application to use TLS or SSL does not force the cookie to be sent over TLS/SSL, so you still need to set the cookie’s Secure attribute. Hashing the cookie provides the cookie’s integrity, not confidentiality; therefore, it will not solve the issue presented by this question.

Question 81

You are trying to find some files that were deleted by a user on a Windows workstation. What two locations are most likely to contain those deleted files?

A. Registry
B. Unallocated space
C. Slack space
D. Recycle bin

Answer 81

C. Slack space
D. Recycle bin

Explanation:
OBJ-2.8: Files that users have deleted are most likely found in the Recycle Bin or slack space. Slack space is the space left after a file has been written to a cluster. Slack space may contain remnant data from previous files after the pointer to the files was deleted by a user. Unallocated space has not been partitioned and, therefore, would typically not have been written to. The registry will not store files that have been deleted but may contain a reference to the file, such as the file’s name.

Question 82

Assuming that Dion Training trusts Thor Teaches, and Thor Teaches trusts Udemy, then we can assume Dion Training also trusts Udemy. What concept of IAM does the previous statement represent?

A. Certificate authority trust
B. Domain level trust
C. Public key trust
D. Transitive trust

Answer 82

D. Transitive trust

Explanation:
OBJ-1.5: Transitive trust occurs when X trusts Y, and Y trusts Z; therefore, X trusts Z. This is because the trust flows from the first part (Dion Training) through the second party (Thor Teaches) to the third party (Udemy).

Question 83

You are reverse engineering a malware sample using the Strings tool when you notice the code inside appears to be obfuscated. You look at the following line of output on your screen:
Based on the output above, which of the following methods do you believe the attacker used to prevent their malicious code from being easily read or analyzed?

A.

Question 84

Your organization is preparing for its required quarterly PCI DSS external vulnerability scan. Who is authorized to perform this scan?

A. Any qualified individual
B. Anyone
C. Only an approved scanning vendor
D. Only employees of the company

Answer 84

C. Only an approved scanning vendor

Explanation:
OBJ-4.3: The Payment Card Industry Data Security Standard (PCI-DSS) is a prescriptive framework. It is not a law but a formal policy created by the credit card industry that organizations must follow to accept credit and bank cards for payment. Quarterly required external vulnerability scans must be run by a PCI-DSS approved scanning vendor (ASV). This question may seem beyond the scope of the exam. Still, the objectives allow for “other examples of technologies, processes, or tasks about each objective may also be included on the exam although not listed or covered” in the objectives’ bulletized lists. The content examples listed in the objectives are meant to clarify the test objectives and should not be construed as a comprehensive listing of this examination’s content. Therefore, questions like this are fair game on test day. That said, your goal isn’t to score 100% on the exam; it is to pass it. Don’t let questions like this throw you off on test day. If you aren’t sure, take your best guess and move on!

Question 85

Dion Automation Group specializes in installing ICS and SCADA systems. You have been asked to program a PLC to open the fill valve when the level of liquid in a tank reaches a sensor located at 1 foot above the bottom of the tank. Also, the value should shut again once the level reaches another sensor at 9 feet above the bottom of the tank. Which of the following would you use to create the control sequence used by the PLC?

A.Safety instrumented system
B. Ladder logic
C. Data historian
D. Human machine interface

Answer 85

B. Ladder logic

Explanation:
OBJ-3.3: Ladder Logic is a graphical, flowchart-like programming language used to program the special sequential control sequences used by a programmable logic controller (PLC). The human-machine interface (HMI) provides the input and output controls on a PLC to allow a user to configure and monitor the system. The HMI is the manual way to open and shut the valve, but it is not used to create the programming or automated sequences described in the scenario. The data historian is a type of software that aggregates and catalogs data from multiple sources within an industrial control system’s control loop. A Safety Instrumented System (SIS) is composed of sensors, logic solvers, and final control elements (devices like horns, flashing lights, and/or sirens) used to return an industrial process to a safe state after predetermined conditions are detected.

Question 86

Which of the following cybersecurity postures relies on moving your defenses from static, network-based boundaries to focusing on users, assets, and resources?

A. Screened subnets
B. Zero trust
C. Availability zones
D. Regions

Answer 86

B. Zero trust

Explanation:
OBJ-1.1: Zero trust is a cybersecurity posture that relies on moving your defenses from static, network-based perimeters to focusing on users, assets, and resources. Zero trust is implemented through microsegmentation and accepts the deperimeterization of enterprise networks caused by the cloud, remote work, mobile, outsourcing, and other factors. An availability zone is a logical data center in a region used by an Amazon Web Services customer. A region is a geographic location with a collection of availability zones mapped to physical data centers. A screened subnet, formerly known as DMZ, is a network architecture that uses a single firewall with three network interfaces: public, private, and semi-trusted.

Question 87

You are building a virtualization server that runs on Windows Server 2016. The server will host multiple virtual machines, each with a different operating system. Which type of hypervisor should you select for this environment?

A. Bare metal
B. IaaS
C. Type 2
D. Type 1

Answer 87

C. Type 2

Explanation:
OBJ-1.6: A Type 2 hypervisor runs on top of an existing operating system. In this case, the scenario states that the virtualization server is already running Windows 2016, so you must install your hypervisor on Windows 2016. A Type 1 hypervisor, also known as bare metal, uses a specialized hypervisor OS to run the virtual machines (such as VM Ware’s ESXi). Infrastructure as a Service (IaaS) is a cloud computing service that enables a consumer to outsource computing equipment purchases and running their own data center.

Question 88

Joseph is interpreting a vulnerability that has a CVSS (v3.1) base score of 8.3. In what risk category would this vulnerability fit?

A. Medium
B. Critical
C. Low
D. High

Answer 88

D. High

Explanation:
OBJ-2.3: CVSS metrics are categorized as critical, high, medium, low, or none based on their numerical score. Vulnerabilities with CVSS base scores rated 9.0 or above are classified as critical. CVSS scores between 7.0 and 8.9 are classified as high. CVSS scores between 4.0 and 6.9 are classified as medium. CVSS scores between 0.1 and 3.9 are classified as low. CVSS scores of 0.0 are classified as none.

Question 89

What problem can you solve by using Wireshark?

A. Resetting the administrator password on three different servers
B. Tracking source code version changes
C. Performing packet capture and analysis on a network
D. Validating the creation dates of web pages on a server

Answer 89

C. Performing packet capture and analysis on a network

Explanation:
OBJ-2.4: Wireshark is a free and open-source packet analyzer. It is used for network troubleshooting, analysis, software and communications protocol development, and education. It cannot perform any of the other three options.

Question 90

Dion Training has just installed a new hub/control system to control the lights, HVAC, and power to the devices in their studio. The new hub/control system relies on Zigbee for wireless communication and networking between the different devices. Which of the following types of operational technology best describes the network and devices they installed?

A. IoT
B. FPGA
C. ASIC
D. SoC

Answer 90

A. IoT

Explanation:
OBJ-3.3: Internet of Things (IoT) is a term used to describe a global network of appliances and personal devices that have been equipped with sensors, software, and network connectivity. IoT normally relies on Zigbee or Z-wave to facilitate the networking of the devices, including hub/control systems, smart devices, wearables, and sensors. A System on a Chip (SoC) integrates practically all the components of a traditional chipset (which is comprised of as many as four chips that control communication between the CPU, RAM, storage, and peripherals) into a single chip. SoC includes the processor as well as a GPU (graphics processor), memory, USB controller, power management circuits, and wireless radios. A field programmable gate array (FPGA) is a type of processor that can be programmed to perform a specific function by a customer rather than at the time of manufacture. A FPGA can be configured by the end customer to run programming logic on the device for their specific use case or application. An application-specific integrated circuit (ASIC) is a type of processor designed to perform a specific function. ASICs are expensive to design and only work for a single application or function, such as the ASICs used to conduct switching in an Ethernet switch.