Practice Test #3 Flashcards
Your chief financial officer (CFO) has forwarded to you an e-mail that she thinks is suspicious. The message looks like an official e-mail from your company’s accountant, but it is asking for specific bank account numbers for the company. What kind of social engineering attack is this an example of?
A) whaling
B) kiting
C) vishing
D) spear-phishing
Whaling
Whaling is correct. In a whaling attack, the target victim is usually a high-profile member of the organization, such as an executive, who has much more critical information to expose than the average user.
You are setting up security for several new smartphones for your company’s executive team. Which of the following security controls can you implement for Bluetooth communications to prevent bluesnarfing attacks against the devices?
A) bluejacking
B) link-level security
C) call-back security
D) smartphone lock password
Link-level security
Link-level security is correct. Link-level security authenticates the actual communications link before data transmission begins. Data encryption can also be performed in this mode after the link is authenticated.
Which of the following security measures would best protect wireless clients from network attacks while they are connecting remotely?
A) use wireless client authentication
B) set the clients to use only the 802.11n standard
C) enable encryption when working in the office
D) install a host-based firewall
Install a host-based firewall
Install a host-based firewall is correct. The host-based firewall software can be used to protect a user’s confidential local data against many types of possible attacks for both incoming and outgoing connections on both wireless and wired networks when the user is away from the office.
During testing of an internal application, you find that every time the application encounters issues, it exits to a debugging screen with elevated access permissions and internal directory structure information. Which of the following secure coding concepts should be implemented to improve application security?
A) fuzzing
B) cross-site scripting
C) error and exception handling
D) input validation
Error and exception handling
Error and exception handling is correct. Your application needs to handle errors and exceptions without providing escalated privileges or revealing the internal details of the system or application. An error should not cause the program to halt or crash to an insecure state.
You are setting up a new wireless network in your small office. Which of the following security measures should you implement to help protect the confidentiality of the network?
A) WPA3 encryption
B) avoid channel overlaps
C) careful antenna placement
D) authentication to the LDAP server
WPA3 encryption
WPA3 encryption is correct. By using Wi-Fi Protected Access version 3 (WPA3), the strongest encryption currently available for wireless networks, you ensure that if wireless traffic is ever intercepted, its contents cannot be revealed because it is encrypted.
You are defining a password policy for your organization’s users. Which of the following password policies is most important to help prevent brute-force attacks on your users’ passwords?
A) minimum password length and complexity
B) usernames not related to company roles
C) minimizing use of special characters
D) account expiration
Minimum password length and complexity
Minimum password length and complexity is correct. By enforcing a minimum length and complexity level of passwords, you ensure that users can’t use weak passwords that are too short or consist of dictionary words.
A user has been disciplined for downloading inappropriate content to her work computer system. Under which policy would such rules and consequences be covered?
A) mandatory vacation policy
B) service-level agreement
C) due care
D) acceptable use policy
Acceptable Use Policy
Acceptable use policy is correct. An acceptable use policy (AUP) is a set of established guidelines for the appropriate use of computer networks within an organization. The policy is a written agreement, read and signed by an employee, that outlines the organization’s terms, conditions, and rules for Internet and internal network use.
Which file-manipulation command is used to print lines that match patterns?
A) tail
B) grep
C) head
D) cat
Grep
Grep is correct. The grep command is used to print lines that match patterns.
A quality assurance tester has found that he can easily crash your company’s web application by entering an e-mail address that’s over 50 characters long in the contact address field. Which of the following application security flaws is causing the issue?
A) SQL injection
B) privilege escalation
C) buffer overflow
D) cross-site scripting
Buffer overflow
Buffer overflow is correct. The contact address field does not have proper input validation controls, causing the lengthy e-mail address to overflow the memory buffer allocated for that field.
After a recent hacking attack on your organization’s primary web server, you have resolved several vulnerabilities and are confident that no more existing vulnerabilities can be exploited. Which of the following actions should you take?
A) run a port scan
B) put the web server back into production
C) perform penetration testing
D) run an antivirus scan
Perform penetration testing
Perform penetration testing is correct. Penetration testing evaluates the security of a system by actively simulating an attack and is best suited for testing solutions used to resolve past vulnerabilities.
After an incident, your organization has been directed to comply with data loss prevention regulations concerning your customers’ data transactions. You must ensure that any outbound e-mail messages containing customer Social Security numbers cannot be viewed while in transit. Which of the following security controls can provide this functionality?
A) anti-malware scanning of all outbound e-mail messages with an SSN
B) an anti-spam filter that blocks outbound e-mail containing an SSN
C) a web proxy server that quarantines outbound e-mail containing an SSN
D) a content filter that encrypts outbound e-mail containing an SSN
A content filter that encrypts outbound e-mail containing an SSN
A content filter that encrypts outbound e-mail containing an SSN is correct. To protect your clients’ SSN numbers in transit, you should use a content filter to analyze outbound e-mail and encrypt any messages that contain an SSN.
You need to utilize certificates for a new web application so that users can trust that the application is connecting to an authenticated server that belongs to your organization. In cryptography, which of the following information assurance objectives is met by using digital certificates?
A) confidentiality
B) integrity
C) nonrepudiation
D) authentication
Authentication
Authentication is correct. Encrypted digital certificates are used to identify users electronically on a network and satisfy the information assurance objective of authentication.
Which of the following is an example of a weak configuration?
A) setting a maximum password
B) setting an account expiry date
C) using your primary administrator account as a default
D) not disabling the account to disallow use
Not disabling the account to disallow use
Not disabling the account to disallow use is correct. To best protect an account, you should disable it so it cannot be used.
You are designing and coding a new web application to replace a legacy web application that was recently removed because of excessive security vulnerabilities. Which of the following coding techniques is most helpful to prevent vulnerabilities in your application during the development stage?
A) keeping attack surfaces to a minimum
B) application documentation
C) code review
D) design review
Keeping attack surfaces to a minimum
Keeping attack surfaces to a minimum is correct. An attack surface is an aspect of your software application that is vulnerable for an attacker to exploit, such as an open port or running network service. Determine the minimum number of acceptable attack surfaces required and keep to that framework throughout the entire development cycle of the product.
A sales engineer for your company is traveling with his laptop computer, which contain highly confidential technical information regarding the internal details of a software application. Which of the following techniques can be implemented to provide the strongest protection of the data on the laptop?
A) use of a virtual machine
B) BIOS password
C) cloud-based data retrieval
D) use of an onboard TPM
Use of an onboard TPM
Use of an onboard TPM is correct. You can encrypt the contents of the laptop’s hard drive and have the trusted platform module (TPM) on the laptop’s motherboard store the encryption key. Only the sales engineer’s password can allow access to the data.
Which of the following is not a constraint to be considered within an embedded or specialized system?
A) compute
B) power
C) heat
D) cryptography
Heat
Heat is correct. Heat is not generally a factor within an embedded and specialized system.
You are a cybersecurity leader for a program that doesn’t currently utilize threat intelligence. You would like to begin using a program that helps you better describe how adversaries use capabilities within an infrastructure to attack a victim. Which of the following best suits this desire?
A) cyber kill chain
B) MITRE ATT&CK
C) NIST cybersecurity framework
D) the diamond model of intrusion analysis
The diamond model of intrusion analysis
The Diamond Model of Intrusion Analysis is correct. The Diamond Model categorizes the relationships and characteristics of an attack’s four main components: the model describes that an adversary deploys a capability over some infrastructure against a victim. These are known as events and form the diamond. Analysts then populate each part of the diamond with the information they gather during the analysis process.
You have just discovered that several user accounts are still active for employees who have long since left the organization or were let go from the company. After changing the passwords and disabling the accounts, which of the following would be best to implement to prevent this security issue from recurring?
A) change HR policy to notify you of any employee status changes
B) regular audit of personnel credentials
C) set account expiration dates
D) use password rotation
Regular audit of personnel credentials
Regular audit of personnel credentials is correct. By regularly checking user accounts and permissions, you ensure that current users only have the rights and permissions required for their current positions. If you find accounts from users who have left the organization, you can disable those accounts.
You are performing penetration testing on a network device designed and developed by your company. You want to simulate a testing environment where the user trying to hack into the device has no previous knowledge of its design. Which of the following testing techniques should you use?
A) unknown environment testing
B) vulnerability testing
C) known environment testing
D) partially known environment testing
Unknown environment testing
Unknown environment testing is correct. Unknown environment testing is an excellent way to test your system’s security by simulating an actual attack, because the tester is seeing this system for the first time.
Where are the serial numbers of revoked certificates posted?
A) CRL
B) CAL
C) PKI
D) trusted root web site
CRL
CRL is correct. Revoked certificate serial numbers are stored in certificate revocation lists (CRLs). Certificates may be revoked because of fraudulent use, certificate theft, or compromise. Applications can refer to a CRL to ensure that certificates in use are valid.
Which of the following actions should you perform first if responding to an attack on your network firewall?
A) make a copy of the firewall logs and error messages
B) reinstall the operating system
C) escalate the issue to your manager
D) reboot the device to restore normal operation
Make a copy of the firewall logs and error messages
Make a copy of the firewall logs and error messages is correct. To preserve forensic evidence of the attack, you should make a copy of the firewall’s log files before performing any other action that could destroy the evidence.
To keep up with increasing numbers of visitors and transactions on your company’s website, you have replaced your single web server with four web servers. Which of the following devices should you install to share bandwidth and processing for incoming requests to the new web servers?
A) NAT-aware firewall
B) load balancer
C) network analyzer
D) additional routers and switches
Load balancer
Load balancer is correct. A load balancer can process all incoming web requests and redirect the requests to one of the four web servers either based on how much current processing load each web server is utilizing or by using round-robin methods.
An officially signed digital certificate for a new web server application can be obtained from which of these options?
A) certificate policy management system
B) certificate authority
C) authorization server
D) authentication authority
Certificate authority
Certificate authority is correct. A certificate authority (CA) is an organization or entity that issues and manages digital certificates. The CA is responsible for authenticating and identifying users before issuing a certificate.
You have performed a risk assessment for your organization’s backup database server, the results of which indicate that the cost of security countermeasures for the backup server is budgeted at $20,000. The total impact of a failure and loss of data for the backup server is $4500. Which of the following solutions should you implement?
A) purchase insurance against the loss of the backup database server
B) transfer the cost of the risk to the company’s operations department
C) use the security budget toward protection of your primary database server instead
D) use the security budget toward backup hardware and media to mitigate potential loss with the backup server
Use the security budget toward protection of your primary database server instead
Use the security budget toward protection of your primary database server instead is correct. The amount of loss in the event of an issue with your backup database server is much less than the actual cost of the security countermeasures used to mitigate the risk. In this case, you could use the security budget for increased protection for your primary server instead.
As part of your business continuity planning, you need to consider how to achieve maximum availability of your network services if a situation arises where cloud availability is degraded or lost and the organization needs to work locally. In this scenario, which of the following can be implemented to better ensure the high availability of network servers and the services they provide?
A) hardware redundancy
B) cloud computing
C) virtualization
D) load balancing
Hardware redundancy
Hardware redundancy is correct. Hardware redundancy means that you always have spare servers or spare parts available in the event that hardware fails. For example, a server may have redundant power supplies so that if one supply fails, the system continues to run. Within the scenario, if the requirement is to be able to maximize effectiveness within a cloud-degraded or cloud-disrupted environment, being sure you have redundancy for your local equipment is key.
Which of the following are publicly accessible ledgers that record online transactions, based on peer-to-peer technology?
A) blockchain
B) steganography
C) symmetric cryptography
D) perfect forward secrecy
Blockchain
Blockchain is correct. Blockchains are publicly accessible ledgers that record online transactions, based on peer-to-peer technology. A party initiates a block, which is then verified by all the distributed systems and added to the chain (or rejected if not verified). Each block is bound to the other, and the distributed nature of blockchain means that the ledger is accessible to anyone, making it difficult to cheat the system. Generally, the larger the blockchain, the safer.
You are having an issue with a network device that is causing denial of service on your internal router because of a flood of network packets to a router port. Which of the following methods can you use to identify the source, destination, and data of the network packets to resolve this issue?
A) make sure the router firmware is up to date
B) use a protocol analyzer to monitor traffic to the router port
C) scan the router for malware
D) perform a ping sweep on network clients
Use a protocol analyzer to monitor traffic to the router port
Use a protocol analyzer to monitor traffic to the router port is correct. A protocol analyzer monitoring the affected router port can determine the source, destination, and data payload of the network packets. From there, you can find the affected device and determine if there is a malware issue or other malfunction.
For centralized authentication services, you want to use an encrypted authentication service to securely authenticate remote access users who connect to your office via a VPN. Which of the following authentication services should you use?
A) PAP
B) LDAP
C) local username and password
D) LDAPS
LDAPS
LDAPS is correct. You can configure a Lightweight Directory Access Protocol (LDAP) server to use Transport Layer Security (TLS) or Secure Sockets Layer (SSL), also known as LDAPS, to encrypt authentication communications. This ensures that client credentials, such as usernames and passwords, are not sent in cleartext over the network.
You’re investigating a potential data breach. Which of the following should prompt an alert as suspicious behavior?
A) one hundred fifty successful user logins between 8:30am and 5:00pm
B) five failed login attempts for the admin user at 3:30am
C) one failed login attempt by an end user
D) three successful login attempts for the admin user between 8:30am and 6:00pm
Five failed login attempts for the admin user at 3:30am
Five failed login attempts for the admin user at 3:30 AM is correct. It is suspicious behavior if someone is unsuccessfully trying to log in to the admin account during off-work hours.
You are setting up performance logging to monitor CPU, memory, and disk usage for an important database server. Which of the following actions should you perform to accurately measure performance spikes?
A) scan the system for malware
B) disable nightly backups
C) create a system baseline
D) make sure all system software patches are up to date
Create a system baseline
Create a system baseline is correct. To properly measure system performance, you need to create a system baseline that shows the normal operating performance levels. Then you will be able to measure future performance data against the baseline to reveal performance anomalies.
You are a cybersecurity analyst that is implementing a new SOAR tool within your organization. You want to develop a set of rules to automate features such as threat response, threat intelligence enrichment, and other activities that the SOAR platform can orchestrate. Which is the appropriate name for this set of rules?
A) policy
B) SIEM
C) runbook
D) playbook
Runbook
Runbook is correct. A runbook is a set of rules that can be largely automated and, while it can indeed include human elements, often is used to automate features such as threat response, threat intelligence enrichment, and other activities that the security orchestration, automation, and response (SOAR) platform can orchestrate. These rules are generally condition-based, so instead of following a step-by-step pattern, they are triggered by preset conditions.
You have implemented several organizational security policies that govern the day-to-day use of computer resources in the company, including content filters on web browsing and restrictions on instant messaging and social media. Which of the following mitigation techniques should you use to ensure that your policies are being adhered to?
A) use password rotation
B) change HR policy to notify you of any employee status changes
C) conduct routine user account and permission audits
D) set account expiration dates
Conduct routine user account and permission audits
Set account expiration dates is correct. By regularly auditing user accounts and permissions, you ensure that current users only have the rights and permissions required for their current positions. If you find accounts from users who have left the organization, you can disable those accounts.
