CompTia practice questions Flashcards
1
Q
- An attacker sends a targeted email with a malicious attachment to a user in
your company. This attacker researched public information about the user to
send a “more personal” and targeted email to the user. Which of the following
is this type of attack?
a. Spear phishing
b. Typo squatting
c. Pharming
d. None of these answers are correct.
A
- A. Spear phishing is one of the most common social engineering attacks
where the attacker searches for public information about the victim to
send a targeted email to steal information. Typo squatting (or typosquatting) is a technique used by adversaries that leverages human error when
typing a URL in their web browser. Pharming is the term used to describe
a threat actor redirecting a victim from a valid website or resource to
a malicious one that could be made to appear as a valid site to the user.
From there, an attempt is made to extract confidential information from
the user or to install malware in the victim’s system.
2
Q
2. Which of the following is an example of a tool that can be used specifically to perform social engineering attacks? a. Maltego b. SET c. The Harvester d. Recon-NG
A
- B. The Social Engineering Toolkit (SET) is an example of a tool that can
be used specifically to perform social engineering attacks.
3
Q
- Which of the following best describes the difference between smishing and
vishing?
a. Vishing is a social engineering attack in which the attacker calls the user
over the phone and then persuades the user to reveal sensitive information or perform a given action. Smishing is a type of phishing campaign
using SMS text messages instead of email.
b. Vishing is a social engineering attack in which the attacker leaves a
voicemail and then persuades the user to reveal sensitive information or
perform a given action. Smishing is a type of typo squatting and pharming campaign using Bluetooth.
c. Vishing is a social engineering attack in which the attacker leaves a
voicemail and then persuades the user to reveal sensitive information or
perform a given action. Smishing is a type of typo squatting and pharming campaign using short Internet messaging systems.
d. None of these answers are correct.
A
- A. Vishing is social engineering attack in which the attacker calls the user
over the phone and then persuades the user to reveal sensitive information
or perform a given action. Smishing is a type of phishing campaign using
SMS text messages instead of email.
4
Q
- A(n) ______ is a small space that can usually only fit one person, used to combat tailgating.
a. tunnel-gap
b. tunnel-trap
c. piggyback
d. access control vestibule
A
- D. An access control vestibule is a small space that can usually fit only one
person, used to combat tailgating. Tunnel-gap or tunnel-traps are not correct social engineering terms. Piggyback is the act of following someone
while opening a door to enter a building or a room.
5
Q
Which of the following best describes pretexting?
a. Impersonation
b. Social engineering
c. Whaling
d. Pharming
A
A. Pretexting is the act of impersonating someone else.
6
Q
Which of the following refers to the act of incorporating malicious ads on
trusted websites, which results in users’ browsers being inadvertently redirected to sites hosting malware?
a. Malvertising
b. Pharming
c. Active ad exploitation
d. Whaling
A
B. Pharming is a social engineering technique where an attacker incorporates malicious ads on trusted websites, which results in users’ browsers
being inadvertently redirected to sites hosting malware.
7
Q
Which of the following is true about spear phishing?
a. Spear phishing attacks use the Windows Administrative Center.
b. Spear phishing attacks are phishing attempts that are constructed
in a very specific way and directly targeted to specific individuals or
companies.
c. Spear phishing, whaling, and phishing are the same type of attack.
d. Spear phishing attacks use the Windows PowerShell.
A
B. Spear phishing is phishing attempts that are constructed in a very specific way and directly targeted to specific individuals or companies.
8
Q
Derek is the CEO of a Fortune 500 company. He received an email with a
malicious attachment. Once Derek clicked on the attachment, malware was
installed on his system. Which of the following best describes this attack?
a. Smishing
b. Vishing
c. Whaling
d. Pretexting
A
C. Whaling is a social engineering attack similar to phishing and spear phishing. However, in whaling attacks the attacker targets executives and key personnel of an organization (aka the “big fish”).
9
Q
Which of the following is true about social engineering motivation
techniques?
a. Social proof can be used to create a feeling of urgency in a decisionmaking context. It is possible to use specific language in an interaction to
present a sense of urgency and manipulate the victim.
b. Scarcity can be used to create a feeling of urgency in a decision-making
context. It is possible to use specific language in an interaction to present
a sense of urgency and manipulate the victim.
c. Scarcity cannot be used to create a feeling of urgency in a decisionmaking context. It is possible to use specific language in an interaction to
present a sense of urgency and manipulate your victim.
d. Social proof cannot be used in an interrogation because it is illegal. It is
not legal to use specific language in an interaction to present a sense of
urgency and manipulate your victim.
A
B. Attackers use the social engineering scarcity technique to create a feeling of
urgency in a decision-making context. It is possible to use specific language in
an interaction to present a sense of urgency and manipulate the victim.
10
Q
Which of the following recommendations can be used in user security
awareness education?
a. Adhere to the organization’s clean desk policy, which states that all documents, electronics, personally owned devices, and other items be put
away (or locked away) when the user is not at his or her desk, or other
work area.
b. Always screen your email and phone calls carefully and keep a log of
events. This is also known as communications vetting.
c. Use encryption when possible to protect emails, phone calls, and data.
d. All of these answers are correct.
A
D. All of the available answers can be used as recommendations for user security awareness training and education.
11
Q
You logged in to your laptop and noticed a message saying that all your files
have been encrypted and to recover them you need to pay $1,000 in Bitcoins.
What has your system been infected with?
a. Ransomware
b. Worm
c. Keylogger
d. None of these answers are correct.
A
A. Ransomware is a type of malware that restricts access to a computer system and demands that a ransom be paid. It informs the user that in order to
decrypt the files or unlock the computer to regain access to the files, a payment would have to be made to one of several banking services (typically
crypto currencies like Bitcoin).
12
Q
What type of malware can look like legitimate software but then performs
negative actions to manipulate your system?
a. Trojan
b. Ransomware
c. Worm
d. None of these answers are correct
A
A. Trojans appear to perform desirable functions but are actually performing
malicious functions behind the scenes.
13
Q
Which malware type can allow an attacker to gain administrator privileges?
a. Keylogger
b. Rootkit
c. Ransomware
d. All of these answers are correct.
A
B. Rootkit is a type of malware designed to gain administrator-level control
over a computer system without being detected.
14
Q
What type of malware does not reside on the hard drive of a computer?
a. Ransomware
b. Botnets
c. Fileless malware
d. None of these answers are correct.
A
C. Fileless malware works differently from traditional malware that puts malicious executables within the file system; instead, it works in a memory-based
environment.
15
Q
Bots in a botnet typically receive instructions from which of the following?
a. A command-and-control (C2) server
b. A zombie system
c. A malvertising site
d. All of these answers are correct.
A
A. A group of compromised computers (bots), known as a botnet, is typically
controlled by a command-and-control (C2) server/system.
16
Q
An attacker using John the Ripper, which uses a wordlist, is an example of which of the following? a. Social engineering attack b. Dictionary password attack c. Buffer overflow attack d. Cross-site request forgery attack
A
B. A dictionary password attack pulls words from the dictionary or word lists
to attempt to discover a user’s password. A dictionary attack uses a predefined
dictionary to look for a match between the encrypted password and the
encrypted dictionary word
17
Q
An attacker using a large number of usernames with a few commonly used
passwords is considered what kind of attack?
a. Password spraying
b. Credential harvesting
c. Password cracking
d. None of these answers are correct
A
A. In password spraying an attacker attempts to compromise a system using a
large number of usernames with a few commonly used passwords.
18
Q
What type of attack occurs when an attacker captures credit card information
or information from other similar cards (gift cards, loyalty cards, identification
cards, and so on)?
a. Skimming
b. Shimming
c. SIM cloning
d. None of these answers are correct
A
A. Skimming is a type of attack in which an attacker captures credit card
information or information from other similar cards (gift cards, loyalty cards,
identification cards, and so on) from a cardholder surreptitiously. Attackers use
a device called a skimmer that can be installed at strategic locations such as
ATMs and gas pumps to collect card data.
19
Q
Which of the following techniques are used to attack machine learning (ML)
implementations?
a. Tainting of data to cause errors in the outcome of the ML solution
b. Overfitting attacks
c. ML transfer attacks
d. All of these answers are correct.
A
D. Tainting, overfitting, and transfer attacks are types of adversarial techniques
against machine learning (ML) implementations.
20
Q
You purchased a brand-new Internet of Things (IoT) device and noticed that
it started collecting personal information (PI) and attempted to send your data
by communicating with random IP addresses. You noticed that an implant
could have been installed during the manufacturing of the product. What type
of attack might this be?
a. Supply-chain attack
b. Cross-site scripting
c. Return to libc attack
d. Masquerading attack
A
A. A supply-chain attack occurs when attackers target security weaknesses in
the supply network and install malicious software or hardware implants to perform different nefarious activities.
21
Q
Which of the following attacks are made against cloud implementations?
a. API attacks
b. DNS attacks
c. VM escape attacks
d. All of these answers are correct.
A
D. Attackers can perform virtual machine (VM) escape, API, and DNS attacks
to compromise cloud-hosted applications and services.
22
Q
An attacker attempts to force an application to roll back the version of TLS
(from TLS version 1.3 to 1.0). What is the name of this type of attack?
a. Privilege escalation
b. Downgrade attack
c. Cracking
d. Fuzzing
A
B. A downgrade attack is a type of cryptographic attack that forces the rollback
of a strong algorithm in favor of an older, lower-quality algorithm or mode of
operation.
23
Q
What type of privilege escalation attack occurs when a user accesses functions
or content reserved for other normal users—for example, if one user reads
another’s email?
a. Horizontal
b. Vertical
c. Sudo abuse
d. None of these answers are correct.
A
A. The two types of privilege escalation attacks are vertical and horizontal. A horizontal privilege escalation attack occurs when a user accesses functions or content reserved for other users. Vertical privilege escalation occurs when a lower-privileged user accesses functions reserved for higher-privileged users— for example, if a standard user can access functions of an administrator. This is also known as privilege elevation and is the most common description. To protect against this type of situation, you should update the network device firmware. In the case of an operating system, it should again be updated, and use of some type of access control system is also advisable—for example, User Account Control (UAC).
24
Q
Which vulnerability can lead to stealing of cookies or redirecting users to
malicious sites and where the malicious code or script is permanently stored
on a vulnerable system?
a. DOM-based XSS
b. Stored XSS
c. Reflected XSS
d. All of these answers are correct.
A
B. Stored, or persistent, XSS attacks occur when the malicious code or script
is permanently stored on a vulnerable or malicious server, using a database.
These attacks are typically carried out on websites hosting blog posts (comment forms), web forums, and other permanent storage methods. An example
of a stored XSS attack is a user requesting the stored information from the
vulnerable or malicious server, which causes the injection of the requested
malicious script into the victim’s browser. In this type of attack, the vulnerable
server is usually a known or trusted site.
25
Which type of injection attack occurs when code is run within the address
space of another process, forcing it to load another library?
a. DLL injection
b. LDAP injection
c. SQL injection
d. None of these answers are correct.
A. DLL injection occurs when code is run within the address space of another
process by forcing it to load a dynamic link library (DLL). Ultimately, this
type of attack can influence the behavior of a program that was not originally
intended. This attack can be uncovered through penetration testing.
26
Which condition occurs when a program dereferences a pointer that it expects to
be valid but is null, which can cause the application to exit or the system to crash?
a. Address space layout randomization
b. Tunnel-trap
c. Format string
d. Null pointer dereferences
D. A null pointer dereference occurs when a program dereferences a pointer
that it expects to be valid but is null, which can cause the application to exit
or the system to crash. From a programmatical standpoint, the main way to
prevent this situation is to use meticulous coding. Programmers can use special memory error analysis tools to enable error detection for a null pointer
dereference.
27
Which type of attack occurs when an attacker tries to escape the web root
folder and access arbitrary files by using ../../ in an URL?
a. Directory traversal
b. Path traversal
c. Dot-dot-slash
d. All of these answers are correct.
D. Directory traversal, path traversal, and the ../ (“dot-dot-slash”) attack are
methods of accessing unauthorized parent (or worse, root) directories. They
are often used on web servers that have PHP files and are Linux or UNIXbased but can also be perpetrated on Microsoft operating systems (in which
case, it would be ..\ or the “dot-dot-backslash” attack).
28
What occurs when arithmetic operations attempt to create a numeric value
that is too big for the available memory space?
a. Stack overruns
b. Integer overflows
c. Format strings
d. Heap underruns
B. A dictionary password attack pulls words from the dictionary or word lists
to attempt to discover a user’s password. A dictionary attack uses a predefined
dictionary to look for a match between the encrypted password and the
encrypted dictionary word.
29
Race conditions are also known as ________ attacks.
a. Heap overflows
b. Time-of-check (TOC) or time-of-use (TOU)
c. Stack overflows
d. Buffer overflows
B. Race conditions are also known as time-of-check (TOC) or time-of-use
(TOU) attacks.
30
_______________code should be checked thoroughly so that a malicious user
can’t find out any additional information about the system.
a. Regression
b. Patched
c. Error exception handling
d. Remote code execution
C. Error handling or error exception handling code should be checked thoroughly so that a malicious user can’t find out any additional information about
the system. These error handling methods are sometimes referred to technically as pseudocodes.
31
```
Input validation vulnerabilities can be found by using which of the following
techniques?
a. A python debugger
b. Fuzzing
c. Heap flags
d. All of these answers are correct.
```
B. A fuzzer is a program that can send crafted messages to a vulnerable application or system to find input validation vulnerabilities.
32
```
Which type of attack occurs when an attacker might use a packet sniffer to
intercept data and retransmit it later?
a. Overflow
b. DLL injection
c. XSS
d. Replay
```
D. A replay attack is a network attack in which a valid data transmission is
maliciously or fraudulently repeated or delayed. It differs from session hijacking in that the original session is simply intercepted and analyzed for later use.
In a replay attack, an attacker might use a packet sniffer to intercept data and
retransmit it later. In this way, the attacker can impersonate the entity that
originally sent the data.
33
A web session ID is typically represented in a cookie. Which type of attack
occurs when an attacker could steal a valid user’s session ID and reuse it to
perform malicious transactions?
a. Session replay
b. Session fuzzing
c. SQL injection
d. All of these answers are correct.
A. Session replay attacks occur when an attacker steals a user’s valid session ID
and reuses that ID to perform malicious transactions and activities with a web
application.
34
__________ attacks leverage the trust that the application has in the targeted
user. For example, the attacker could inherit the privileges of the user to perform an undesired action, such as stealing sensitive information, creating users,
or downloading malware.
a. XSS
b. SQLi
c. XML injection
d. XSRF
D. Cross-site request forgery (XSRF) attacks leverage the trust that the application has in the targeted user. For example, the attacker could inherit the
privileges of the user to perform an undesired action, such as stealing sensitive
information, creating users, or downloading malware.
35
Which of the following are general best practices to protect APIs?
a. Secure API services to provide only HTTPS endpoints with a strong
version of TLS.
b. Validate parameters in the application and sanitize incoming data from
API clients.
c. Explicitly scan for common attack signatures; injection attacks often
betray themselves by following common patterns.
d. All of these answers are correct.
```
D. All of the available answers are best practices to help protect application
programming interfaces (APIs).
```
36
Which of the following is a type of denial-of-service (DoS) attack?
a. C2
b. Botnet
c. Resource exhaustion
d. None of these answers are correct.
C. Resource exhaustion is an attack against availability that is designed to
bring the network, or access to a particular TCP/IP host/server, to its knees
by flooding it with useless traffic. Resource exhaustion attacks are a form of
denial-of-service (DoS) attacks. They can also leverage software vulnerabilities
such as memory leaks and file descriptor leaks.
37
Which of the following attacks can reduce the performance of a computer,
especially in systems with shared memory or limited memory?
a. Heap underrun
b. Format string
c. XSS
d. Memory leak
D. A memory leak is a type of resource leak caused when a program does not
release memory properly. The lack of freed-up memory can reduce the performance of a computer, especially in systems with shared memory or limited
memory. A kernel-level leak can lead to serious system stability issues. The
memory leak might happen on its own due to poor programming, or it could
be that code resides in the application that is vulnerable and is later exploited
by an attacker who sends specific packets to the system over the network.
38
Which of the following is a common way to launch an SSL strip attack?
a. Creating a rogue wireless access point (hotspot)
b. Launching Metasploit
c. Fuzzing an application
d. Leveraging a memory leak
A. An attacker can launch an SSL strip attack in different ways. One of the
most common ways is to create a wireless hotspot and lure the victims to connect to it.
39
Which of the following is a driver manipulation attack where an attacker adds
a small library that intercepts API calls?
a. Kernel module attack
b. Request forgery
c. Refactoring
d. Shimming
D. Attackers can potentially modify drivers through the use of driver shimming (the adding of a small library that intercepts API calls) and driver refactoring (the restructuring of driver code).
40
Pass the hash are attacks usually performed in which of the following operating systems?
a. Apple iOS
b. macOS
c. Linux
d. Windows
D. Pass the hash attacks leverage deficiencies in Windows NTLM
implementations.
41
Which of the following is a type of related-key attack, which occurs when an
attacker observes the operation of a cipher using several different keys and
finds a mathematical relationship between those keys, allowing the attacker to
ultimately decipher data?
a. IV attack
b. Evil twin
c. WPA attack
d. None of these answers are correct.
A. An initialization vector (IV) attack is a type of related-key attack, which
occurs when an attacker observes the operation of a cipher using several different keys and finds a mathematical relationship between those keys, allowing
the attacker to ultimately decipher data.
42
Which of the following can be used to perform an on-path attack?
a. SQL injection
b. ARP cache poisoning
c. Buffer overflow
d. All of these answers are correct
B. ARP cache poisoning (also known as ARP spoofing) is an example of an
attack that leads to a man-in-the-middle scenario. An ARP spoofing attack can
target hosts, switches, and routers connected to a Layer 2 network by poisoning the ARP caches of systems connected to the subnet and by intercepting
traffic intended for other hosts on the subnet.
43
Which of the following describes when an attacker must first infect the
victim’s computer with a Trojan or a malicious browser extension or plug-in
to intercept transactions from a web browser?
a. On-path attack
b. LDAP injection
c. SQL injection
d. Keylogger injection
A. With an on-path attack, the attacker must first infect the victim’s computer
with a Trojan. The attacker usually gets the malware onto the victim’s computer through some form of trickery or deceit.
44
Which of the following describes when an attacker must first infect the
victim’s computer with a Trojan or a malicious browser extension or plug-in
to intercept transactions from a web browser?
a. On-path attack
b. LDAP injection
c. SQL injection
d. Keylogger injection
A. With an on-path attack, the attacker must first infect the victim’s computer
with a Trojan. The attacker usually gets the malware onto the victim’s computer through some form of trickery or deceit.
45
Which of the following attacks occurs when the threat actor sends numerous
unknown MAC addresses to a network switch to cause a DoS condition or to
sniff network connections over a switched network while disrupting network
performance?
a. CAM memory leak attack
b. MITM
c. ARP cache poisoning
d. MAC flooding attacks
D. Attackers launch MAC flooding attacks by sending numerous unknown
MAC addresses to a network switch to cause a DoS condition. In addition,when the Layer 2 forwarding table limit is exceeded, packets are flooded
to all ports in a virtual LAN (VLAN). This, in turn, enables the attacker to
sniff network connections over a switched network while disrupting network
performance.
46
Which of the following attacks occurs when the attacker changes the
registration of a domain name without the permission of the original owner/
registrant?
a. Directory traversal
b. Path traversal
c. Dot-dot-slash
d. Domain hijacking
D. Domain hijacking is a type of hijacking attack in which the attacker changes
the registration of a domain name without the permission of the original
owner/registrant. One of the most common methods to perform a domain
hijacking is using social engineering.
47
Which of the following protocols has been used for amplification attacks?
a. IPX
b. DNS
c. NetFlow
d. None of these answers are correct.
B. One specific type of DDoS attack is the DNS amplification attack. Amplification attacks generate a high volume of packets ultimately intended to flood a
target website.
48
```
Which of the following has been used by attackers to create malicious macros
in applications such as Excel or Word?
a. Keyloggers
b. VBA
c. DNS
d. NTP
```
B. Visual Basic for Applications (VBA) is an event-driven programming capability in Microsoft operating systems and applications. Attackers have used
VBA to create malicious macros in applications such as Excel or Word.
49
Which of the following threat actors typically aims to cause denial-of-service
conditions or deface websites due to a political or social belief?
a. Hacktivists
b. Semi-authorized hackers
c. Script kiddies
d. Nation state actors
A. The name hacktivist is often applied to different kinds of activities—from
hacking for social change, to hacking to promote political agendas, to fullblown cyberterrorism. Due to the ambiguity of the term, a hacktivist could be
inside a company or attack from the outside and will have varying amounts of
resources and funding. However, a hacktivist is usually far more competent
than a script kiddie.
50
Which of the following threat actors is typically motivated by money? (Choose
the best answer.)
a. Authorized hackers
b. Criminal syndicates and organized crime
c. Exploit groups
d. None of these answers are correct.
B. Cybercriminals might work on their own, or they might be part of criminal
syndicates and organized crime—a centralized enterprise run by people motivated mainly by money.
51
Which of the following attributes make threat actors different?
a. Level of sophistication
b. Resources
c. Funding
d. All of these answers are correct.
D. The level of sophistication/capability, resources, and funding are all attributes of threat actors that put them into different categories (that is, statesponsored actors, script kiddies, hacktivists, criminals).
52
Which incident response concept is designed to represent a cybersecurity incident and is made up of four parts?
a. FIRST
b. InfraGard
c. Diamond Model of Intrusion
d. All of these answers are correct.
C. The Diamond Model is designed to represent a cybersecurity incident
and is made up of four parts. Active intrusions start with an adversary who
targets a victim. The adversary will use various capabilities along some form
of infrastructure to launch an attack against the victim. Capabilities can be
various forms of tools, techniques, and procedures, while the infrastructure
is what connects the adversary and victim. The lines connecting each part of
the model depict a mapping of how one point reached another. This mapping helps you understand the motives, intent, sophistication, capabilities, and
resources that a threat actor may have.
53
Which of the following is an effective attack vector where an attacker could
modify or tamper hardware or software from a vendor to perform mass
compromise attacks?
a. Supply chain
b. Removable media
c. Wireless
d. Direct access
A. One of the most effective attacks for mass compromise is to attack the supply
chain of a vendor to tamper with hardware and/or software. This tampering might
occur in-house or earlier, while in transit through the manufacturing supply chain.
54
Which of the following elements could an attacker leverage to perform a
cloud-based attack?
a. Misconfigured VMs
b. Unpatched applications and operating systems
c. Misconfigured storage buckets
d. All of these answers are correct.
D. Attackers can leverage misconfigured and insecure cloud deployments
including unpatched applications, operating systems, and storage buckets.
55
```
Which term refers to the knowledge about an existing or emerging threat to
assets, including networks and systems?
a. Threat intelligence
b. Threat feed
c. Threat model
d. None of these answers are correct.
```
A. Threat intelligence refers to knowledge about an existing or emerging
threat to assets, including networks and systems. Threat intelligence includes
context, mechanisms, indicators of compromise (IoCs), implications, and
actionable advice.
56
Which technique is used when you leverage public information from DNS
records, social media sites, websites, search engines, and other sources for
reconnaissance?
a. OSINT
b. Threat maps
c. Threat models
d. Threat analysis
A. Open-source intelligence (OSINT) applies to offensive security (ethical hacking/penetration testing) and defensive security. In offensive security,
OSINT enables you to leverage public information from DNS records, social
media sites, websites, search engines, and other sources for reconnaissance—in
other words, to obtain information about a targeted individual or an organization. When it comes to threat intelligence, OSINT refers to public and free
sources of threat intelligence.
57
Which of the following could be threat and vulnerability research sources?
a. Vendor websites
b. Threat feeds
c. Vulnerability feeds
d. All of these answers are correct.
D. Vendor websites, threat feeds, and vulnerability feeds could all be used for
threat and vulnerability research.
58
```
Which framework was created by MITRE to describe adversary tactics and
techniques?
a. InfraGard
b. CVE
c. ATT&CK
d. CWE
```
C. The MITRE ATT&CK framework (https://attack.mitre.org) is a collection of different matrices of tactics and techniques. InfraGard is a collaborative
effort between the FBI and the private sector. The Common Vulnerability
and Exposure (CVE) is a standard to identify vulnerabilities created and maintained by MITRE. The Common Weakness Enumeration (CWE) is a standard to identify the weaknesses (root cause) of security vulnerabilities. CWE
was also created by MITRE
59
```
Which cloud service model offers computer networking, storage, load
balancing, routing, and VM hosting?
a. IaaS
b. PaaS
c. SaaS
d. None of these answers are correct.
```
A. Infrastructure as a service (IaaS) is a type of cloud service that offers computer networking, storage, load balancing, routing, and VM hosting. Platform
as a service (PaaS) provides various software solutions to organizations, especially the capability to develop applications in a virtual environment without
the cost or administration of a physical platform. Software as a service (SaaS)
is a cloud service model where the cloud provider offers the complete infrastructure and the application. Examples of SaaS include Gmail, Office 365,
Webex, Zoom, Dropbox, Google Drive, and many other applications you use
every day
60
Which of the following is a security concern in cloud deployments?
a. Encryption
b. Authentication methods
c. Identity management
d. All of these answers are correct.
D. Encryption, authentication methods, and identity management are all security concerns in cloud deployments and environments.
61
Which type of vulnerability is disclosed by an individual or exploited by an
attacker before the creator of the software can create a patch to fix the underlying issue?
a. Cross-site scripting
b. Zero-day
c. Information disclosure
d. None of these answers are correct.
B. A zero-day vulnerability is a type of vulnerability that is disclosed by an
individual or exploited by an attacker before the creator of the software can
create a patch to fix the underlying issue. Attacks leveraging zero-day vulnerabilities can cause damage even after the creator knows of the vulnerability
because it may take time to release a patch to prevent the attacks and fix damage caused by them.
62
Which of the following can be considered a weak configuration that can allow
attackers to perform an attack and compromise systems?
a. Default settings and passwords
b. Weak encryption
c. Open permissions
d. All of these answers are correct.
D. Default settings and passwords, weak encryption, and open permissions are
examples of the most prevalent types of weak configurations that can be leveraged by an attacker to perform malicious activities and compromise systems.
63
Which of the following is a weak protocol that should be avoided?
a. HTTP without encryption
b. Telnet
c. FTP without encryption
d. All of these answers are correct.
D. Protocols such as Telnet, FTP (without encryption), and HTTP without encryption should be avoided at all times because they are considered
unsecure.
64
Which of the following should be considered when assessing third-party risks?
a. Vendor management
b. Supply chain
c. Outsourced code development
d. All of these answers are correct.
D. Vendor management, system integration, lack of vendor support, supply
chain, and outsourced code development should all be assessed when performing an analysis of third-party risks.
65
In Windows, what is a broadly released fix for a product-specific securityrelated vulnerability?
a. Security update
b. Service pack
c. Threat model
d. None of these answers are correct.
A. A security update is a broadly released fix for a product-specific securityrelated vulnerability or group of vulnerability. Security vulnerabilities are rated
based on their severity, which is indicated in the Microsoft Security Bulletin as
critical, important, moderate, or low.
66
Which of the following is a disadvantage of running legacy platforms and
products?
a. They are often affected by security vulnerabilities.
b. They do not have modern security features.
c. When a device is past the last day of support, vendors will not investigate
or patch security vulnerabilities in those devices.
d. All of these answers are correct.
D. Legacy platforms and products that have passed the end of support date are
often affected by unfixed security vulnerabilities and do not have modern security features. When a device is past the last day of support, vendors will not
investigate or patch security vulnerabilities in those devices.
67
Which of the following could be categorized as different types of negative
impact that a security breach could have in a corporation?
a. Financial
b. Reputation
c. Availability loss
d. All of these answers are correct.
. D. A security breach could have direct financial impact to a corporation (such
as fines and lawsuits). The brand and reputation of a company can also be
damaged by major cybersecurity incidents and breaches. Cybersecurity incidents can also lead to outages and availability loss.
68
Which of the following can be used by attackers to obfuscate their tactics
when exfiltrating data from their target (victim)?
a. Encryption
b. Tunneling over a known protocol like DNS
c. Encoding
d. All of these answers are correct.
D. Attackers can leverage different types of obfuscation and evasion techniques
to go undetected (including encoding of data, tunneling, and encryption).
69
What is the act of proactively and iteratively looking for threats in your
organization that may have bypassed your security controls and monitoring
capabilities?
a. Threat intelligence
b. Threat hunting
c. Threat binding
d. None of these answers are correct.
B. Threat hunting is the act of proactively and iteratively looking for threats in
your organization.
70
```
Which of the following provides a matrix of adversary tactics, techniques, and
procedures that modern attackers use?
a. ATT&CK
b. CVSS
c. CVE
d. All of these answers are correct.
```
A. The MITRE ATT&CK is a collection of matrices that outline adversary
tactics, techniques, and procedures (TTPs) that modern attackers use.
71
Which identifier is assigned to disclosed vulnerabilities?
a. CVE
b. CVSS
c. ATT&CK
d. TTP
A. Most of the vulnerabilities disclosed to the public are assigned Common
Vulnerability and Exposure (CVE) identifiers. CVE is a standard created by
MITRE (www.mitre.org) that provides a mechanism to assign an identifier
to vulnerabilities so that you can correlate the reports of those vulnerabilities
among sites, tools, and feeds.
72
Which broad term describes a situation in which a security device triggers an
alarm, but no malicious activity or actual attack is taking place?
a. False negative
b. True negative
c. False positive
d. True positive
C. A false positive is a broad term that describes a situation in which a security device triggers an alarm, but no malicious activity or actual attack is taking place. In other words, false positives are false alarms, and they are also
called benign triggers.
73
```
Which of the following is a successful identification of a security attack or a
malicious event?
a. True positive
b. True negative
c. False positive
d. False negative
```
A. A true positive is a successful identification of a security attack or a malicious event. A true negative occurs when the intrusion detection device identifies an activity as acceptable behavior and the activity is actually acceptable.
False positives are false alarms, and false negative is the term used to describe a
network intrusion device’s inability to detect true security events under certain
circumstances—in other words, a malicious activity that is not detected by the
security device.
74
Which of the following occurs when a vulnerability scanner logs in to the
targeted system to perform deep analysis of the operating system, running
applications, and security misconfigurations?
a. Credentialed scan
b. Application scan
c. Noncredentialed scan
d. None of these answers are correct.
A. Vulnerability scanners can often log in to the targeted system to perform
deep analysis of the operating system, running applications, and security misconfigurations. This technique is called a credentialed scan.
75
Which of the following are functions of a SIEM?
a. Log collection
b. Log normalization
c. Log correlation
d. All of these answers are correct.
D. SIEMs can provide log collection, normalization, and correlation.
76
Which solution allows security analysts to collect network traffic metadata?
a. NetFlow
b. SIEM
c. SOAR
d. None of these answers are correct.
A. NetFlow is a technology invented by Cisco to collect network metadata
about all the different “flows” of traffic on your network.
77
Which solution provides capabilities that extend beyond traditional SIEMs?
a. SOAR
b. CVSS
c. CVE
d. IPFIX
A. Security Orchestration, Automation, and Response (SOAR) systems extend
beyond traditional SIEMs to allow organizations to collect security threat data
and alerts from multiple sources and to perform many different automated
response capabilities.
78
Which of the following can be capabilities and benefits of a SOAR solution?
a. Automated vulnerability assessment
b. SOC playbooks and runbook automation
c. Orchestration of multiple SOC tools
d. All of these answers are correct.
D. Unlike traditional SIEM platforms, SOAR solutions can also be used for
threat and vulnerability management, security incident response, and security
operations automation (including playbook and runbook automation, as well as
orchestration of multiple SOC tools).
79
Which term is used to define the practice of mimicking a threat actor by using
the same methodologies and tools to find and exploit vulnerabilities with the
permission of the system or network owner?
a. Ethical hacking
b. Pen testing
c. Penetration testing
d. All of these answers are correct.
D. Ethical hacking, pen testing, and penetration testing are all terms used to
define the process of finding vulnerabilities and mimicking what an attacker
could do against your systems and networks. Penetration testing is done after
obtaining permission from the system or network owner.
80
Which of the following is a type of penetration testing where the tester starts
out with a significant amount of information about the organization and its
infrastructure?
a. Known environment
b. Unknown environment
c. Partially known environment
d. None of these answers are correct.
A. In the known environment pen testing type, the pen tester starts out with
a significant amount of information about the organization and its infrastructure. The tester would normally be provided network diagrams, IP addresses,
configurations, and a set of user credentials, for example. If the scope includes
an application assessment, the tester might also be provided the source code of
the target application. The idea of this type of test is to identify as many security holes as possible.
81
Which of the following are elements of the penetration pre-engagement
phase?
a. Developing the rules of engagement document
b. Negotiating contracts
c. Creating the statement of work (SOW)
d. All of these answers are correct.
D. The pre-engagement tasks include items such as contract negotiations, the
statement of work (SOW), scoping, and the rules of engagement.
82
Which of the following elements are typically included in the rules of engagement document during a penetration testing?
a. Testing timeline
b. Location of the testing
c. The security controls that could potentially detect or prevent testing
d. All of these answers are correct.
D. The rules of engagement document typically includes the testing timeline,
location of the testing, time window of the testing, preferred method of communication, the security controls that could potentially detect or prevent testing, IP addresses or networks from which testing will originate, and the scope
of the engagement.
83
```
Which term is used when a penetration tester uses public records to perform
passive reconnaissance?
a. OSINT gathering
b. Scanning
c. Banner fingerprinting
d. Shodan
```
A. Open-source intelligence (OSINT) gathering is the term used when a penetration tester uses public records to perform passive reconnaissance.
84
Which of the following is an example of a blue team?
a. CSIRT
b. Pen testing teams
c. Offensive security teams
d. None of these answers are correct.
D. Active reconnaissance is carried out mostly by using network and vulnerability scanners. Nmap is an open-source network and port scanner. Nessus is
a vulnerability scanner sold by Tenable. Nikto is an open-source web application vulnerability scanner.
85
What term is used to describe how an organization integrates the defensive
capabilities of a blue team with the adversarial techniques used by the red
team?
a. Advanced red teaming
b. Adversarial emulation
c. Purple teaming
d. None of these answers are correct.
C. Purple teams integrate the defensive capabilities of a blue team with the
adversarial techniques used by the red team. Often the purple team is not a
separate team, but a solid dynamic between the blue and red teams.
86
Which term is often used to define the team that focuses in security governance, regulatory compliance, and risk management?
a. White team
b. Purple team
c. Red team
d. Blue team
A. White teams are individuals who are focused on governance, management,
risk assessment, and compliance.
87
Which of the following is a primary goal of configuration management?
a. Maintaining computer systems, servers, network infrastructure, and software in a desired, consistent state
b. Reducing the cost of acquiring computer systems, servers, network infrastructure, and software used for information security
c. Ensuring that any changes done to the infrastructure do not affect the
underlying organization’s IT budget
d. All of these answers are correct.
A. Configuration management is an ongoing process created with the goal of
maintaining computer systems, servers, network infrastructure, and software
in a desired, consistent state. One of the primary goals of configuration management is to ensure that your infrastructure performs as it’s expected to as
changes are made over time.
88
After a minimum desired state of security is defined, ________ should be taken
to assess the current security state of computers, servers, network devices, and
the network in general.
a. network diagrams
b. IPv4 schemas
c. baselines
d. None of these answers are correct.
C. After a minimum desired state of security is defined, baselines should
be taken to assess the current security state of computers, servers, network devices, and the network in general. Baseline configurations should
be properly documented and reviewed to include a set of specifications for
information systems or configuration items within those systems. Baseline
configurations are used by security professionals, along with network and system administrators, as a basis for future deployments, releases, or changes to
information systems and applications.
89
Which of the following is a benefit of standard naming conventions in an IT
infrastructure?
a. Appropriate naming conventions are used to avoid conflicts and to be
able to correlate data among disparate systems.
b. Appropriate naming conventions are used to reduce unnecessary spending of IT infrastructure.
c. Appropriate naming conventions are used to better create IPv6 network
schemas and for data sovereignty.
d. None of these answers are correct.
A. You should make sure that your organization has appropriate naming conventions for describing IT infrastructure, applications, and users. Appropriate
naming conventions are used to avoid conflicts and to be able to correlate data
among disparate systems.
90
Which of the following are privacy laws or regulations? (Choose two.)
a. PCI-DSS
b. CCPA
c. GDPR
d. FedRamp
B and C. The General Data Protection Regulation (GDPR) is a regulation
in the European Union and the European Economic Area focused on data
protection and privacy. Another example is the California Consumer Privacy
Act (CCPA). These regulations give consumers the right to know what personal information is being collected by companies, government, and any other
organizations.
91
```
Which of the following is a type of software or hardware-based data loss
prevention solution?
a. Endpoint DLP systems
b. Network DLP systems
c. Storage DLP systems
d. All of these answers are correct.
```
D. Data loss prevention (DLP) systems can be software or hardware-based
solutions and are categorized in three general types: endpoint, network, and
storage DLP systems
92
```
You were hired to deploy a system to prevent unauthorized use and transmission of confidential information. What should you prioritize to protect and
encrypt?
a. Data at rest
b. Data in use
c. Data in motion
d. All of the answers are correct.
```
D. You should always encrypt data at rest, in use, and in motion in order to
protect sensitive data.
93
Which of the following are used in digital signatures, in file and message
authentication, and as a way to protect and verify the integrity of sensitive
data?
a. Data masking
b. Tokenization
c. Hashes
d. Redaction
C. Hashes are used in digital signatures, in file and message authentication,
and as a way to protect the integrity of sensitive data—for example, data
entered into databases or perhaps entire hard drives. A hash is generated
through the use of a hash function to verify the integrity of the file or message,
most commonly after transit over a network.
94
What do you call a redundant site that has tables, chairs, bathrooms, and possibly some technical setup, but a lot of configuration of computers and data
restoration is necessary before the site can be properly utilized?
a. Hot site
b. Warm site
c. Cluster site
d. Cold site
A. A hot site is a near duplicate of the original site of the organization that
can be up and running within minutes (in some cases longer). Computers and
phones are installed and ready to go, a simulated version of the server room
stands ready, and the vast majority of the data is replicated to the site on a
regular basis in the event that the original site is not accessible to users for
whatever reason.
95
Which term is used to categorize a group of computers used to attract and trap
potential adversaries to counteract and analyze an attack?
a. Honeypot
b. Honeynet
c. Honeyfile
d. None of these answers are correct.
B. A honeypot is generally a single computer but could also be a file, group of
files, or an area of unused IP address space, whereas a honeynet is a group of
computers, servers, or an area of a network; a honeynet is used when a single
honeypot is not sufficient. Either way, the individual computers, or group of
servers, will usually not house any important company information. Various
analysis tools are implemented to study the attacker; these tools, along with
a centralized group of honeypots (or a honeynet), are known collectively as a
honeyfarm.
96
A security analyst creates a file called passwords.txt to lure attackers to access
it. Which term is used for this technique?
a. Honeynet
b. Honeypot
c. Honeyfarm
d. Honeyfile
D. Honeyfiles are used as bait files intended to lure adversaries to access them
and then send alarms to a security analyst to potentially learn the tactics and
techniques used by the attacker.
97
In a _________ you configure one or more DNS servers to provide false
results to attackers and redirect them to areas in the network where you can
observe their tactics and techniques.
a. DNS sinkhole
b. DNS tunnel
c. DNS Zone transfer
d. None of these answers are correct.
A. In a DNS sinkhole you configure one or more DNS servers to provide false
results to attackers and redirect them to areas in the network where you can
observe their tactics and techniques. DNS sinkholes have been used to contain
different types of malware such as the infamous WannaCry ransomware and to
disrupt certain malicious DNS operations in denial-of-service (DoS) and other
attacks.
98
Which of the following cloud service models will you use if you want to
host applications on virtual machines, deploy load balancers, and use storage
buckets?
a. IaaS
b. PaaS
c. SaaS
d. None of these answers are correct.
A. IaaS is a service that offers computer networking, storage, load balancing,
routing, and VM hosting. More and more organizations are seeing the benefits
of offloading some of their networking infrastructure to the cloud.
99
A. A community cloud is a mix of public and private cloud deployments where
multiple organizations can share the public portion.
100
Which of the following cloud deployments is a mix of public and private cloud
solutions where multiple organizations can share the public cloud portion?
a. Community cloud
b. PaaS
c. SaaS
d. MSSP cloud
A. A community cloud is a mix of public and private cloud deployments where
multiple organizations can share the public portion.
101
Google Drive, Office 365, and Dropbox are examples of which of the following types of cloud service?
a. SaaS
b. IaaS
c. PaaS
d. All of these answers are correct.
A. Google Drive, Office 365, and Dropbox are examples of the software as a
service (SaaS) cloud service model.
102
What type of company or organization provides services to manage your security devices and can also help monitor and respond to security incidents?
a. SaaS provider
b. PaaS provider
c. MSSP
d. Serverless provider
C. A managed security service provider (MSSP) provides services to manage your security devices and can also help monitor and respond to security
incidents.
103
Which of the following organizations delivers network, application, system,
and management services using a pay-as-you-go model?
a. SaaS provider
b. PaaS provider
c. XaaS provider
d. Managed service provider (MSP)
D. Managed service providers (MSPs) can deliver network, application, system,
and management services using a pay-as-you-go model. An MSP is an organization that can manage your network infrastructure, servers, and in some cases
your security devices. Companies that provide services to manage your security
devices and can also help monitor and respond to security incidents are called
managed security service providers (MSSPs).
104
Which term is used to describe an ecosystem of resources and applications in
new network services (including 5G and IoT)?
a. SaaS
b. VPC
c. Edge computing
d. None of these answers are correct.
C. The term edge computing describes an ecosystem of resources and applications in new network services (including 5G and IoT). One of the main benefits is to provide greater network speeds, low latency, and computational power
near the user.
105
Which of the following are computer systems that run from resources stored
on a central server or from the cloud instead of a local (on-premises) system?
a. Thin clients
b. Fog edge devices
c. VPCs
d. Containers
A. Thin clients are computer systems that run from resources stored on a central server or from the cloud instead of a local (on-premises) system. When
you use a thin client, you connect remotely to a server-based computing environment where the applications, sensitive data, and memory are stored.
106
```
Which of the following are technologies and solutions to manage, deploy, and
orchestrate containers?
a. Docker Swarm
b. Apache Mesos
c. Kubernetes
d. All of these answers are correct
```
D. Docker Swarm, Apache Mesos, and Kubernetes are technologies and solutions to manage, deploy, and orchestrate containers.
107
What condition could occur when an organization can no longer effectively
control and manage all the VMs on a network or in the cloud?
a. VM sprawl
b. VM escape
c. Hypervisor escape
d. Hypervisor sprawl
A. VM sprawl (otherwise known as virtualization sprawl) occurs when an organization can no longer effectively control and manage all the VMs on a network or in the cloud.
108
```
Which condition occurs when an attacker or malware compromises one VM
and then attacks the hypervisor?
a. VM escape
b. Hypervisor escape
c. VM sprawl
d. Hypervisor sprawl
```
A. In a VM escape attack, the guest VM breaks out of its isolated environment
and attacks the hypervisor or compromises other VMs hosted and controlled
by the hypervisor.
109
Which of the following is a software and hardware development and project
management methodology that has at least five to seven phases that follow in
strict linear order?
a. Waterfall
b. Agile
c. DevOps
d. SDLC
110
Which of the following is a software and hardware development and project
management methodology that has at least five to seven phases that follow in
strict linear order?
a. Waterfall
b. Agile
c. DevOps
d. SDLC
A. The traditional software development methodology is the waterfall model,
which is a software and hardware development and project management methodology that has at least five to seven phases that follow in strict linear order.
Each phase cannot start until the previous phase has been completed.
111
Which of the following is a benefit when you use log aggregation tools to
maintain and analyze logs of every element that goes into the provisioning of
applications?
a. The ability to scale horizontally
b. The ability to respond quickly and deprovision the application in the
event that something wrong
c. The ability to design an elastic infrastructure
d. None of these answers are correct.
B. You can integrate with log aggregation tools to maintain and analyze logs
of every element that goes into the provisioning. This allows you to respond
quickly and deprovision the application in the event that something went
wrong. When you go back, you can check the logs and accurately find and fix
the root cause of the error.
112
Which of the following elements can help software (code) integrity?
a. Unit testing
b. Integration testing
c. Identifying a code integrity manager
d. All of these answers are correct.
D. Unit testing, integration testing, and identifying a code integrity manager
can help software (code) integrity.
113
Which process includes identifying assets to the system or application, uncovering vulnerabilities, identifying threats, documenting threats, and rating those
threats according to their potential impact?
a. SECOPS
b. Principle of least privilege
c. Threat modeling
d. None of these answers are correct.
C. Threat modeling enables you to prioritize threats to an application based
on their potential impact. This modeling process includes identifying assets
to the system or application, uncovering vulnerabilities, identifying threats, documenting threats, and rating those threats according to their potential
impact. The more risk, the higher the rating. Threat modeling is often incorporated into the software development lifecycle (SDLC) during the design,
testing, and deployment phases.
114
Which of the following are important security principles that should be incorporated into the SDLC?
a. Input validation
b. Principle of least privilege
c. Failing securely
d. All of these answers are correct.
D. Input validation, principle of least privilege, and failing securely are all
important security principles that should be incorporated into the SDLC.
115
Which of the following might include syntax errors in the code and typechecking errors?
a. Misconfigured VMs
b. Unpatched applications and operating systems
c. Misconfigured storage buckets
d. Compile-time errors
D. Compile time refers to the duration of time during which the statements
written in any programming language are checked for errors. Compile-time
errors might include syntax errors in the code and type-checking errors. A
programmer can check these errors without actually running the program and
instead check it in the compile stage when it is converted into machine code.
116
Which of the following are top web application security risks?
a. Broken Access Control
b. XML External Entities (XXE)
c. Cross-Site Scripting (XSS)
d. All of these answers are correct.
D. One of the most popular OWASP projects is the Top 10 Web Application
Security Risks. You can find the latest Top 10 Web Application Security Risks
at https://owasp.org/www-project-top-ten. All of these answers are top web
application security risks.
117
Which of the following terms is often used when a compiler is modified to
generate variants of a binary (target application) that operates in the same way
when processing benign input but may operate in a different manner when
given malicious input?
a. ASLR
b. Random forest
c. Software diversity
d. None of these answers are correct.
C. In an example of software diversity, a compiler is modified to generate
variants of a binary (target application) that operates in the same way when
processing benign input; however, it may operate in a different manner when
given malicious input. This new aspect of software diversity is handled by generating variants of a program by building a binary with a diversifying compiler
that can randomize the code layout, stack variables, and random allocations of
heap objects at different locations in each variant.
118
Which of the following is a software development practice where programmers merge code changes in a central repository multiple times a day?
a. Continuous integration
b. DevSecOps
c. Waterfall
d. All of these answers are correct.
```
A. Continuous integration (CI) is a software development practice in which
programmers merge code changes in a central repository multiple times a day.
Continuous delivery (CD) sits on top of CI and provides a way for automating
the entire software release process. When you adopt CI/CD methodologies,
each change in code should trigger an automated build-and-test sequence.
This automation should also provide feedback to the programmers who made
the change.
```
119
Which of the following is the ability of an underlying infrastructure to react to
a sudden increase in demand by provisioning more resources in an automated
way?
a. Load balancing
b. Using Kubernetes
c. Elasticity
d. All of these answers are correct
C. Elasticity is the ability of an underlying infrastructure to react to a sudden
increase in demand by provisioning more resources in an automated way. Elasticity and scalability are often achieved by deploying technologies such as load
balancers and by deploying applications and resources in multiple geographical
locations (data centers around the world). Other technologies such as enabling
concurrent processing (parallel processing) and automated container deployments (that is, using Kubernetes) allow organizations to auto-scale.
120
D. Microsoft Active Directory (AD) allows administrators to organize elements of a network, such as users, computers, and devices, into a hierarchical
containment structure.
121
```
Which of the following best describes a directory structure used on Microsoft
Windows-based servers and computers to store data and information about
networks and domains?
a. Token Ring Network
b. Packet Passing Ring
c. AAA
d. Active Directory
e. TOPD
```
D. Microsoft Active Directory (AD) allows administrators to organize elements of a network, such as users, computers, and devices, into a hierarchical
containment structure.
122
Which of the following should be distributed among different physical
locations to provide redundancy for user authentication?
a. Linux servers
b. Azure Webservers
c. Smart cards
d. Directory services
D. Users authenticate against a directory service to ensure that it is highly
available at all times. A best practice requires that it be distributed in multiple
locations.
123
```
Which of the following is a contactless technology that is capable of matching
a human face from a digital image?
a. Fingerprint authentication
b. Retinal authentication
c. Facial recognition
d. Iris authentication
```
C. In biometrics, facial recognition is the most common and least accurate way
to identify a user; it has higher false rejection and higher false acceptance rates
than other biometric security methods.
124
```
What biometric security measure is characterized by the identification and
authentication of vocal modalities?
a. Retinal authentication
b. Voice verification
c. Facial recognition
d. Fingerprint authentication
```
B. Speaker verification is a 1:1 match where one speaker’s voice is matched to
one template, also called a voice print or voice model.
125
A physical item like a smart card (CAC) represents what multifactor
authentication (MFA) factor or attribute?
a. Something you know
b. Something you have
c. Something you are
d. Something you exhibit
B. You must have this physical item with you—something you have such as a
crypto card, token, or key fob that is used as a method to authenticate you as a
user.
126
```
Which of the following is an example of a biometric security measure that is
something you exhibit?
a. Personality trait or behavior
b. Geolocation or IP address
c. Facial recognition
d. Photo ID
```
A. Physical movements such as the way you walk, typing patterns, and mouse
movements are examples of a personality trait, behavior, or observable biometric that can be used to authenticate you as a person.
127
What does the abbreviation AAA mean?
a. Authentication, authorization, and accounting
b. Authorization, accounting, and accredited
c. Accounting, abbreviate, and accentuate
d. Accounting, allocation, and attenuate
A. Authentication, authorization, and accounting (AAA) is a framework for
intelligently controlling access to computer resources, enforcing policies, and
auditing usage. These processes working in concert are important for effective
network management and security.
128
Which of the following is a feature that provides a way of identifying a user
using a user ID and a password specific to that user?
a. The AAA authentication feature
b. Authorization, accounting, and accredited
c. Authorization and accounting
d. Diametric simulation
A. Authentication provides a method of identifying a user, typically by having
the user enter a valid username and password before access to the network is
granted. Authentication is based on each user having a unique set of login credentials for gaining network access.
129
```
Which method provides highly available, always-on, pay-as-you-grow systems
and services?
a. Enterprise Data Center
b. HAS highly available services
c. Cloud-based hosted systems
d. Next-generation data services
```
C. Enterprises that elect to use a cloud computing model need to pay only for
the resources that they use, with none of the maintenance and upkeep costs.
The price adjusts up or down depending on how much is consumed.
130
```
From a compliance perspective, which method of authentication hosting is
preferred?
a. Static code placement
b. Enterprise on-premises hosting
c. Cloud-based hosted systems
d. Third-party hosted data and systems
```
B. On-premises authentication is preferred. Many companies these days operate under some form of regulatory control, regardless of the industry. The
most common one is the Health Insurance Portability and Accountability Act
(HIPAA) for private health information, but there are other government and
industry regulations. For companies that are subject to such regulations, it is
imperative that they remain compliant and know where their data is at all times.
131
Which of the following is one of the primary goals of geographic dispersal of
data and data processing?
a. Ensuring availability of data in the event of a disaster or regional issue,
such as power outage
b. Reducing the cost of acquiring computer systems, servers, network
infrastructure, and software used for information security
c. Ensuring the application infrastructure does not affect the underlying
network
d. All of these answers are correct.
A. Geographic dispersal of computing and data assets if a disaster, natural or
person-made, occurs ensures the company can continue to function. In such
cases, the company relies on infrastructure in another city, state, or country to
be available.
132
Which of the following describes the disk redundancy method of RAID 5?
a. It uses more hard disks and stripes data and parity over all hard disks.
b. It is a parity hard disk proportional to the log of HDD numbers.
c. It is a JBOD, otherwise known as just a bunch of drives.
d. It duplicates data from one hard disk to another; typically, it is two hard
disks set up to copy data to both disks.
A. RAID 5 writes the parity over all disks, making it possible to continue to
run even if one disk fails. Recovery is done by removing the failed drive and
executing the recovery process, where the drive is rebuilt and added to the
array once completed.
133
Which hard disk resilience mechanism uses two hard disks to provide redundancy and copies everything to both hard disks?
a. RAID 0
b. RAID 3
c. RAID 6
d. RAID 10
A. RAID 0 is known as disk striping; it is the process of dividing data into
blocks and spreading the data blocks across multiple storage devices, such as
hard disks or solid-state drives (SSDs). In a Redundant Array of Independent
Disks (RAID) group, there is no parity. The more hard drives in a RAID 0
array, the higher probability of array failure.
134
When a network interface card fails in a server, a secondary NIC continues transmitting traffic uninterrupted. What mechanism allows this feature to operate?
a. Redundant NIC
b. NIC teaming
c. NIC failover
d. Mirrored NIC
B. By deploying NIC teaming on your server, you can maintain a connection to multiple physical switches and use a single IP address. Load balancing
becomes readily available, fault tolerance becomes instant instead of waiting
for DNS records to time out or update, and management becomes simpler.
135
Which high-availability power mechanism provides an additional power
supply that can share or split the power load?
a. Redundant supervisor modules
b. Redundant power supplies
c. Dual hard disks
d. RAID 5 power sources
B. Redundant power is a critical component in high-availability systems. In the
simplest solution, two power supplies can drive a load through bused (vertical
line shared among equipment) or N+1 configuration, where two power supply outputs are load-shared together or have one active and one or more in
standby mode.
136
SAN-connected servers utilize a special fiber interface card called what?
a. Network interface card (NIC)
b. Host bus adapter (HBA)
c. Storage area network device (SAND)
d. Data beam fiber (DBF) card
```
B. SAN-connected servers contain special fiber interface cards called host
bus adapters (HBAs). They are configured as pairs, typically called HBA1 and
HBA2. The fiber is then connected to a pair of SAN network switches.
```
137
You can host services in your own data center or in the cloud. What is considered a cloud-based service?
a. Azure Active Directory (AD)
b. Novell NDS Services
c. Outlook 2010
d. Data Center Hosted SAP
A. Azure Active Directory is a fully managed multi-tenant cloud-based offering
from Microsoft that offers identity and access capabilities for applications
running in an on-premises environment. It is not a replacement for on-premises
Active Directory Services but could be, or it can be used with it to extend
on-prem directory services and sync the directories to cloud applications.
138
Which backup method provides connected backup storage anywhere in the
world with private/public remote storage?
a. Incremental offline
b. Intermittent even days
c. Local backup session
d. Cloud-based backup
e. Tape backup to mainframe
D. Cloud-based backups are a model of data storage in which the data can be
accessed, managed, and stored in a remote cloud server via the Internet. Cloud
backups are maintained and supported by a cloud storage provider responsible
for keeping the user’s data available and accessible at any time.
139
You can now back up your organization’s critical data to the cloud, including
all your desktop computers and servers. What is one downside to hosting all
your backups in the cloud?
a. Restoral is available only during the work week.
b. They require a special VPN connection to each device.
c. Accessing them may be slow depending on your Internet connection.
d. Backups are rotated every 30 days.
C. Backups to a cloud services backup (IaaS) provider can be slower than
on-premises backups where they are connected at gigabit speeds. Depending
on the amount of data being backed up, restoring data from them could take
many hours or even days to complete.
140
What is the uptime measurement of available time for a highly available system, knowing that no system can be up forever?
a. 95.99 percent
b. 100 percent
c. 90 percent
d. 99.999 percent
D. A highly available system should be able to quickly recover from any sort
of failure state to minimize interruptions for the end user. Best practice for
achieving high availability is to eliminate single points of failure or any node
that would impact the system as a whole if it becomes dysfunctional. The highest level of uptime is considered “five nines,” or 99.999 percent, which refers to
a standard of reliability. Five nines is equivalent to downtime of only 5 minutes
and 15 seconds per year (1 minute and 18 seconds in a quarter, or 26 seconds
monthly). These are very high standards to meet.
141
Your company just had a catastrophic failure, and the entire data center and
campus are down. After you establish your chain of command, what is the first
service or system you need to bring up in order to start recovery?
a. Video telecom VTC systems and bridges
b. Desktop computers in network operations center
c. Active Directory and LDAP to authorized users
d. Network connectivity
D. Without the network, systems will be unable to communicate with each
other. When building the restore order for your organization, do not forget
this critical step, and make sure you add it to your desktop exercises.
142
An organization can add many levels of diversity to enhance its systems and
network resilience. Which components will help? (Select all that apply.)
a. Redundant Pathed Facility Power
b. Network interface card (NIC) teaming
c. Supplier and supply chain contracts
d. Security cameras at all junctions
A, B, C. These are all steps that can be taken to enhance an organization’s
resilience and provide fault tolerance and diversity
143
Which of the following embedded devices are field programmable and are a
reconfigurable integrated circuit that can perform logic gates such as AND
gate, OR gate, and NOT gate?
a. FPGA
b. PStat
c. BIOS
d. None of these answers are correct.
A. A field-programmable gate array (FPGA) is an integrated circuit designed
to be configured by a customer or designer after manufacturing—hence the
term field-programmable
144
```
Which of the following Supervisory Control and Data Acquisition systems are
part of the logistics ecosystem?
a. Just-in-time manufacturing
b. Fish tank controls
c. Industrial plant mixing platforms
d. None of these answers are correct
```
A. SCADA systems are capable of managing parts inventories for just-in-time
manufacturing, regulate industrial automation and robots, and monitor processes and quality control.
145
Which of the following embedded devices can read plant field device output
and input and can control or regulate devices like motors and generators?
a. PLC
b. PStat
c. Bios
d. None of these answers are correct.
A. A SCADA programmable logic controller (PLC) is an industrial computer
control system that continuously monitors the state of input devices and makes
decisions based on a custom program to control the state of output devices.
146
```
Which IoT device is considered a wearable device and is helpful for your
well-being?
a. Smart tennis shoes
b. Smart watch
c. Smart jackets
d. Smart headband
```
B. Smart watches can monitor your pulse, heart, blood pressure, exercises,
calories, and sleep patterns to help you become more fit.
147
Which of the following IoT devices are part of facility automation?
a. Lighting and air conditioning
b. Raspberry Pi
c. Garage door sensors
d. Computer Energy Star
A. Lighting and air conditioning controls are part of building automation and
can be controlled to help reduce the overexpense of energy use by properly
implementing sensors to know when people are in the building.
148
Security associated with specialized systems generally requires the user to set
up logging and auditing of passwords. What else should the user do to ensure
the system is secure?
a. Lock passwords in a password vault that only staff has access to.
b. Ensure the network operations center is aware of hard drive failures in
critical systems.
c. Always log passwords in the security operations center log book.
d. Always create and rotate very complex passwords.
D. Users should utilize the strongest encryption method available on devices,
always create and rotate very complex passwords, set up a continuous method
to log and audit access to the devices, and finally, ensure use of the latest manufacturer updates.
149
Today’s surveillance systems are cable of using technology to perform all of the
tasks listed here except for which of the following?
a. Monitoring the data center access
b. Pivoting from one system to another
c. Performing facial recognition
d. Authenticating application usage
D. Today’s modern surveillance systems are capable of performing facial recognition, monitoring data center access, and if exploited, pivoting to and compromising other systems in the network.
150
```
Which communication method is part of the IEEE’s 802.15.4 standard and has
a transmission rate of 250 kbps?
a. 5G
b. Narrow band
c. Baseband radio
d. Zigbee
```
D. Zigbee creates flexibility for developers and end users while delivering stellar interoperability. It was created on the IEEE’s 802.15.4 standard, using the
2.4-GHz band and a self-healing true mesh network, and has a defined rate of
250 kbps. It is best suited for intermittent data transmissions from a sensor or
input device.
151
A major constraint on embedded systems deals with the size of the unit and
capability. What is one of the concerns related to security?
a. The amount of energy required to load the boot loader at startup
b. The ability to reboot the system remotely with a password
c. The amount of code required to implement a secure algorithm
d. The amount of power and amperage available to power on the unit at
startup
C. Cryptography constraints for building secure embedded systems hardware
and software have to do with the amount of code required to implement a
secure algorithm and the processing power required to crunch the number.
152
Which of the following is considered a system on a chip?
a. The desktop computer used to perform number calculations that can be
used to create documents
b. The ability to reboot the system remotely with a password
c. A cell phone and cell phone–type device with personal data access
d. A tablet with WiFi and/or cell LTE connectivity capabilities
C and D. A system on a chip (SoC) is essentially an integrated circuit or an IC
that takes a single platform and integrates an entire electronic or computer
system onto it.
153
Which is one application of a real-time operating system being used in the
commercial space that helps save lives?
a. Nucleus RTOS from Mentor, used in medical devices
b. Raspberry PI using the optional POE module for power
c. A SOC that can be used to provide fusion
d. The Arduino med-xcapp heart register system connected to a WiFi
network
A. Nucleus RTOS from Mentor is a real-time operating system (RTOS) software component that rapidly switches between tasks, giving the impression
that multiple programs are being executed at the same time on a single processing core. In fact, the processing core can execute only one program at any
one time.
154
Which low-power device has been used in commercial applications to reduce
human interaction capabilities and keep people safe?
a. Catapults with wireless controllers that can move objects across enemy
lines and determine troop sizes
b. Drones used in harsh environments such as refineries and terminals
where flammable gases can be dangerous to humans
c. Robotic window washers, which ensure that windows are washed without
the need for a human to be on a scaffolding
d. Microdots that enable spies to see inside facilities to ensure it’s safe for
them to carry out operations
```
B. Embedded computers used in unmanned system applications are often characterized by their low SWaP-C (size, weight, power, and cost) profiles, small
form factor (SFF), and rugged operating ranges, which are vital components
for unmanned aerial vehicles (UAVs),
```
155
```
Which of the following access controls allows security guards to view visitors
prior to access engagement and entry?
a. Access control vestibule
b. Bollard
c. Barricade
d. Guard station
```
A. An access control vestibule, formerly known as a mantrap, allows security
guards to see visitors before they are allowed through the second door. Guards
can use cameras and voice communication to ascertain identity.
156
Which of the following helps control access in and out of a facility?
a. Fencing and guard gates
b. Bollards and barricades
c. Access control vestibules
d. Signage and dogs
C. Vestibules are an excellent access control addition. Entries with panels built
from prefabricated composite or metal are used as a way for companies to control the heat and airflow in their facilities.
157
```
Which motion detection method uses infrared or laser technology as its
primary method?
a. Radar detection
b. Optical detection
c. Object detection
d. Proximity detection
```
B. Optical detectors convert incoming optical energy into electrical signals.
The two main types of optical detectors are photon detectors and thermal
detectors. Photon detectors produce one electron for each incoming photon of
optical energy. The electron is then detected by the electronic circuitry
158
What sort of guard can patrol an area 24/7/365 with very little downtime?
a. Patrol cars
b. Reception desk
c. Armed guards
d. Robot sentries
D. Robot sentries act as 24/7/365 guards, continuously monitoring and alerting on differentials. Robot sentries report anything out of the ordinary to the
appropriate personnel, who then can take additional action.
159
The reception desk plays a critical role in physical security controls of most
companies. How do receptionists accomplish such a critical role?
a. They greet visitors with a smile and ask their names.
b. They place visitors in a vestibule until they provide ID.
The reception desk plays a critical role in physical security controls of most
companies. How do receptionists accomplish such a critical role?
c. They provide visitors with a tracking beacon.
d. They verify the identity of visitors, contact the employees being visited,
and hold guests until they are picked up.
D. The reception desk plays a front-line role in the physical security program
of a company. Receptionists do this by creating a buffer between the corporate offices, employees, and contractors. Visitors are unable to pass until the
employees meeting them come and pick them up. This reduces loitering and
inquisitive visitors.
160
Which type of lock uses a fingerprint to unlock a device?
a. Cable lock
b. Key lock
c. Multifunction lock
d. Biometric lock
D. Biometric locks provide a unique way of making sure people are who they
say they are by monitoring or matching human characteristics such as a fingerprint, retina, or voice prior to unlocking and granting access.
161
Which lock type requires a skeleton key?
a. Warded/lever lock
b. Skeleton door
c. Master lock
d. Cyclone dutch
A. A skeleton key normally work with warded or lever locks. With a warded
lock, a skeleton key lacks interior notches to interfere with or correspond with
the wards, or obstructions, thereby allowing it to open the lock.
162
Which type of sensor can read when something is nearby?
a. Moisture
b. Noise
c. Proximity
d. Temperature
C. A proximity reader is capable of reading a prox card that is within a few millimeters of the reader/pad; it does this through induction.
163
Which place can you safely and securely have people working inside?
a. Safe
b. Crate
c. Vault
d. None of these answers are correct.
C. A vault can consist of an entire room or even multiple rooms. Vaults allow
everything inside to be protected through multiple layers of security measures,
including guards, alarms, cameras, locks, gates, and secure doors.
164
```
Which secure data destruction method is best for hard drives and other forms
of magnetic media?
a. Burning
b. Degaussing
c. Rivets
d. Pulverizing
```
D. Pulverizing grinds devices down to bare-metal scraps. There is nothing left
that would allow recovery, unlike shredding and degaussing.
165
Which is one of the three digital signature scheme algorithms?
a. A key generation algorithm that selects a private key
b. A key generation algorithm that selects a data path
c. A file encryption algorithm that encrypts files
d. A triple-DES communication encryption algorithm
A. A key generation algorithm that selects a private key uniformly at random
from a set of possible private keys is one of three digital signature scheme
algorithms. This algorithm outputs the private key and a corresponding
public key.
166
Which of the following properties are not ideal cryptographic hash function
properties?
a. Provides a quick response to any mathematical subfunction
b. Is unable to compute the hash value for any given message
c. Is quick to compute the cryptographic key’s salt value
d. Is infeasible to find two different messages with the same hash value
D. Cryptographic hash functions have many information-security applications,
notably in digital signatures, message authentication codes (MACs), and other
forms of authentication.
167
The complexity of quantum properties lies in the principles of quantum
mechanics that are behind quantum cryptography. Which is one of the
primary principles?
a. Changing the zero bit in the x state moves the bit 35 degrees left.
b. Measuring the quantum property adds two qubits.
c. Quantum mechanics cannot fix a laser while in operation.
d. You can’t measure a quantum property without changing or disturbing it.
D. Quantum cryptography, or quantum key distribution (QKD), uses a series
of photons (light particles) to transmit data from one location to another over
a fiber-optic cable. By comparing measurements of the properties of a fraction
of these photons, the two endpoints can determine what the key is and if it is
safe to use.
168
When a sender transmits photons through a filter that randomly gives one of
four possible polarizations and bit designations, what is it set as?
a. 35-degree left (zero bit)
b. Horizontal (zero bit)
c. Vertical (45 bit)
d. Top 45-degree left (seven bit)
B. Photons travel to a receiver, which uses two beam splitters (horizontal/vertical and diagonal) to “read” the polarization of each photon.
169
A blockchain is a specific type of database that differs from a typical database
in the way it stores information. Which is the most accurate description of
storage in a blockchain?
a. Data is stored in blocks that are then chained together.
b. Data is stored in segments that are linked.
c. Data is linked to a SQL database stored in blocks.
d. Data is chained to specific blocks in a linked mathematical code.
A. A blockchain is essentially a digital ledger of transactions that are duplicated and distributed across the entire network of computer systems on the
blockchain.
170
Today’s cipher suite is a set of algorithms that help secure a network connection that uses Transport Layer Security (TLS). The set of algorithms that
cipher suites usually contain includes which of the following?
a. A bulk repository hashing key
b. A bulk encryption algorithm
c. A hash exchange and management algorithm
d. Key exchange repository for storage
B. Cipher suites usually contain a set of algorithms that include a key exchange
algorithm, bulk encryption algorithm, and message authentication code (MAC)
algorithm. The key exchange algorithm is used to exchange a key between two
devices.
171
Steganography is the practice of hiding a secret message inside or even on top
of something that is not secret. Which of the following is not a tool that can be
used to perform steganography on data?
a. Steghide
b. Foremost
c. Stegais
d. Future
D. Steghide, Foremost, Xiao, Stegais, and Concealment are tools that can be
used to conceal data in images and audio files.
172
IoT low-power devices have limited power. What effect does that have on a
cryptographic algorithm that does not compromise security?
a. Smaller symmetric key sizes
b. The use of dual asymmetric keys
c. The use of 32-bit 3DES encryption
d. The use of shorter RC4 encryption keys
A. The most common use cases are mobile devices and portable systems.
Because of the low-power draw requirements, you may use smaller symmetric
key sizes and elliptic-curve asymmetric encryption.
173
Timing attacks that use side channels to analyze the time taken to execute a
cryptographic algorithm are based on which method?
a. Smaller keys for quicker analysis
b. Larger keys for faster mathematical calculations
c. Time
d. Length
C. Time is used in generating keys used in cryptography. They have been
mostly replaced with more randomness.
174
Which of the following runs a password through an algorithm to produce an
enhanced key, usually at least 128 bits long?
a. IV
b. Steganography
c. Entropy
d. Key stretching
D. Key stretching runs a password through an algorithm to produce an
enhanced key.
175
```
Which of the following are key derivation functions (KDFs) that are primarily
used for key stretching? (Select two.)
a. Symmetric key algorithms
b. Asymmetric key algorithms
c. Bcrypt
d. PBKDF2
```
C and D. Bcrypt and Password-Based Key Derivation Function 2 (PBKDF2)
are key derivation functions (KDFs) that are primarily used for key stretching,
which provides a means to “stretch” a key or password, making an existing key
or password stronger and protecting against brute-force attacks.
176
How would you create a chain of trust when using DNS?
a. Configure a CNAME record and point to MS5.
b. Set up SPF records in DNS with a metric of 5.
c. Configure and deploy SDNS.
d. Configure and use DNSSEC.
D. DNSSEC is used in securing the chain of trust that exists between the
Domain Name System (DNS) records that are stored at each domain level.
177
In which way would you be able to secure LDAP?
a. Install Microsoft LDAP on all AD Primary Domain Controllers.
b. Install a properly formatted PKI certificate.
c. Uninstall LDAP and install secure LDAP.
d. Use a site connector in AD and select Secure.
```
B. You can enable LDAPS by installing a properly formatted certificate from a
certificate authority (CA) according to the guidelines.
```
178
How does using SSH help secure communications?
a. By automatically disabling TFTP and Telnet
b. By using asymmetric (public key) cryptography
c. By using an encryption key fob and special code
d. By configuring a shell on the remote host
B. SSH uses asymmetric (public key) RSA cryptography for both connection
and authentication.
179
S/MIME utilizes which cryptographic mathematic key type?
a. Symmetric
b. Asymmetric
c. Biometric Sequence
d. AD Key Encryption
B. S/MIME is based on asymmetric cryptography that uses a pair of mathematically related keys to operate: a public key and a private key
180
Authentication Header (AH)/Encapsulating Security Payloads (ESP) optional
packet header is used to guarantee which of the following?
a. Packet delivery in congested networks
b. QoS in cryptographic traffic
c. Connectionless integrity
d. Data origin packet forwarding
C. AH is an optional packet header used to guarantee connectionless integrity
and data origin authentication for IP packets.
181
Which email protocol allows the user to download all the messages and still
retain a copy of the email on the email server?
a. POP3
b. NMAP
c. IMAPS
d. ADFS
C. IMAPS downloads a message only when you click on it, and attachments
aren’t automatically downloaded. IMAPS operates on port 993 (SSL/TLS).
182
What Hypertext Transfer Protocol provides encrypted communications?
a. SMTP
b. NMAP
c. IMAPS
d. HTTPS
D. HTTPS uses an encryption protocol to encrypt communications. The protocol is called Transport Layer Security (TLS).
183
Time synchronization begins with configuring NTP on servers, devices, and
hosts. Which time zone should you configure your NTP server to utilize?
a. CST/CDT (Central time zone)
b. EST/EDT (Eastern time zone)
c. PST/PDT (Pacific time zone)
d. UTC (Coordinated Universal Time)
D. Enterprises looking to deploy time synchronization should utilize three
public servers, set up a local internal NTP server that is used for all internal
hosts as a reference timekeeper, and only have the internal NTP server make
requests to the public servers. You should ensure that you are standardizing on
UTC time across all systems; it will make researching attacks and issues more
relevant.
184
What type of remote access is the most widely used and secure method
considering all your assets are located behind a firewall?
a. VPN
b. APN
c. Private line terminal
d. A rate-limited policy applied to inbound interfaces
A. A virtual private network (VPN) provides privacy and security to users by
creating a private network connection across a public network connection.
VPNs are used to access company networks protected by firewalls that deny
inbound and outbound access to/from systems on the network.
185
A Domain Name System (DNS) has a secure counter protocol called DNSSEC. If you can’t implement DNSSEC, which of the following are ways to
secure DNS without migrating to DNSSEC? (Select all that apply.)
a. Limit or disable zone transfers.
b. Use trusted DNS forwarders.
c. Use firewalls and limit communications to the DNS server.
d. Use caching-only DNS servers
A, B, C, D. All the responses are correct. You should use caching-only DNS
servers, use DNS forwarders, use DNS advertisers and resolvers, protect DNS
from cache pollution, enable DDNS for secure connections only, disable zone
transfers, and use firewalls to control communication to and from the DNS
servers.
186
Just how destructive are viruses?
a. Viruses have cost companies billions.
b. Viruses have cost companies hundreds of dollars.
c. Viruses have cost companies millions of dollars.
d. Viruses are mostly an annoyance and cost very little
A. According a report published by Cybersecurity Ventures in May 2019, damages from ransomware cost businesses an astonishing $11 billion in lost revenue, productivity, and remediation.
187
What is one of the ways that antimalware software detects malware and hostile
code?
a. Scanning ports of the malware to determine if it is hostile
b. Making behavior-based observations
c. Copying the suspect file and compressing it
d. Realizing that malware is mostly an annoyance
B. Antimalware software that uses behavior-based malware detection can
detect previously unknown threats by identifying malware based on characteristics and behaviors.
188
What is one of the primary functions of endpoint detection and response
(EDR)?
a. Securing the endpoint by disabling the EDR function
b. Scanning the ports of the system to determine if the open ports are
listening
c. Providing forensics and analysis tools to research identified threats.
d. Providing endpoint integrity by encrypting the hard disk
C. One of the primary functions of endpoint detection and response (EDR) is
providing forensics and analysis tools to research identified threats and search
for suspicious activities (similar to threat hunting).
189
What is one of the ways that DLP protects from data loss and misuse?
a. Monitoring and controlling endpoint activities
b. Locking data in a bitwise vault
c. Observing behavior-based activities
d. Stopping malware from executing by placing it in a sandbox
A. Data loss prevention (DLP) software and tools monitor and control endpoint activities, filter data streams on corporate networks, and monitor data in
the cloud to protect data at rest and in motion.
190
What new specification does Unified Extensible Firmware Interface (UEFI)
bring that wasn’t in the standard BIOS?
a. Lowers the threshold for encrypting hard disks
b. Increases hard disk partition size
c. Provides extra fields to annotate the type of drive
d. Stops viruses from executing during shutdown
B. The newer specification addresses several limitations of the BIOS, including
restrictions on hard disk partition size and the amount of time the BIOS takes
to perform its tasks.
191
What is the tokenization process?
a. Using a single token to encrypt all hard disks
b. Turning nonsensitive data into encrypted data
c. Turning insensitive data into sensitive data
d. Turning sensitive data into nonsensitive data
D. Database tokenization is the process of turning sensitive data into nonsensitive data called tokens that can be used in a database or internal system without
bringing it into scope.
192
What do secure cookies store?
a. Information about all the sites a user visited over 24 hours
b. All of the cookies that were collected over two days
c. Information about the application session after users log out
d. Information about a user session after the user logs in to an application
D. The secure session cookies store information about a user session after the
user logs in to an application. This information is very sensitive because an
attacker can use a session cookie to impersonate the victim.
193
What process does patch management help users accomplish?
a. Helps acquire, test, and install multiple patches (code changes) on existing applications
b. Manages the deployment of security codes to systems
c. Helps remove patches that do not match the operating system
d. Manages the Key repository store in the patch management system
A. Patch management is a process that helps acquire, test, and install multiple
patches (code changes) on existing applications and software tools on a computer, enabling systems to stay updated on existing patches and determining
which patches are the appropriate ones.
194
A self-encrypting drive (SED) installed into a mixed-disk configuration or a
configuration containing unencrypted drives operates in which manner?
a. Operates as an SE disk
b. Operates as a encrypted disk
c. Operates as an unencrypted disk
d. Rejects the drive and powers down
C. When a self-encrypting drive (SED) is installed into a mixed-disk configuration or a configuration containing unencrypted drives, it operates as an
unencrypted disk. Likewise, a pool consisting of all SEDs might replicate to a
pool with only a few SEDs or no SEDs at all.
195
As part of the root of trust, any code from outside a system that is intended to
run on a secure CPU requires which component?
a. A signed certificate from a CA that is applied to the CPU
b. Dedicated RAM that can be accessed by any root authority
c. Dedicated ROM that can be accessed by the hardware root of trust
d. Validated code that is secure and signed by a CSR/root
C. Code from the outside needs to be validated prior to running it on a secure
CPU. This tamper resistance can be implemented in many ways—for example,
using a dedicated ROM that can only be accessed by the hardware root of trust.
196
UEFI is a replacement for a standard BIOS, UEFI, and the Trusted Platform
Module. TPM uses what to sign the log recorded by the UEFI?
a. Nothing; it’s automatically signed each time it is booted.
b. It uses an enforced signature code and entry.
c. It uses four elements that include the log, the UEFI, the system time,
and a binary signature.
d. It uses a unique key to digitally sign the log.
D. The TPM uses a unique key to digitally sign the log recorded by the UEFI.
197
Sandboxing is a strategy that isolates a test environment for applications to
protect them from what?
a. Malware and viruses
b. Application information spillage and unauthorized disclosure
c. Enforcement of access to system and startup log files
d. Sandthrow attack elements that facilitate hacker access
A. Sandboxing is a strategy that isolates a test environment for applications. It
provides an extra layer of security that prevents malware or harmful applications from negatively affecting your system.
198
During an audit of your servers, you notice that most servers have large
amounts of free disk space and have low memory utilization. Which of the
following statements is correct if you migrate some of the servers to a virtual
environment?
a. You might end up spending more on licensing but less on hardware and
equipment.
b. You need to deploy load balancing and clustering.
c. Your baselining tasks will become simpler.
d. Servers will encounter latency and lowered throughput issues.
A. If you migrate some of these low-resource servers to a virtual environment,
you could end up spending more on licensing but less on hardware, due to the
nature of virtualization. In fact, the goal is to have the gains of hardware savings outweigh the losses of licensing. Load balancing and clustering deal with
an operating system utilizing the hardware of multiple servers. This will not be
the case when you go virtual, nor would it have been the case anyway, because
clustering and load balancing are used in environments where the server
is very resource-intensive. Baselining, unfortunately, will remain the same;
you should analyze all of your servers regularly, whether they are physical or virtual. These particular servers should not encounter latency or lowered
throughput because they are low-resource servers in the first place. If, however, you considered placing a Windows Server that supports 5000 users into a
virtual environment, you should definitely expect latency
199
```
Which of the following can help defend against pivoting during a
compromise?
a. WAF
b. Network segmentation
c. WAP
d. All of these answers are correct.
```
B. You can defend against pivoting by providing proper access control, network segmentation, DNS security, reputation security, and proper patch
management.
200
Which of the following is a true statement about VPNs?
a. A remote-access VPN must include a host installed on the client.
b. A clientless VPN can connect multiple concentrators together.
c. A remote-access VPN may include a host installed on the client.
d. A clientless VPN installs software on the host to establish the VPN
connection.
C. A remote-access VPN is typically used for client access to a headend device,
which connects them to the corporate network. Most remote access VPNs use
IPsec or SSL/TLS connections.
201
```
In which type of attack does an attacker generate a high number of requests
over port 53?
a. CAM memory leak attack
b. MITM
c. ARP cache poisoning
d. DNS amplification
```
D. One specific type of DDoS is the DNS amplification attack. Amplification
attacks generate a high volume of packets ultimately intended to flood a target
website. In the case of a DNS amplification attack, the attacker initiates DNS
requests with a spoofed source IP address. The attacker relies on reflection;
responses are not sent back to the attacker but are instead sent “back” to the
victim server. Because the DNS response is larger than the DNS request (usually), it amplifies the amount of data being passed to the victim. An attacker
can use a small number of systems with little bandwidth to create a sizable
attack. However, a DNS amplification attack can also be accomplished with
the aid of a botnet, which has proven to be devastating to sections of the Internet during the period when the attack was carried out.
202
In which of the following attacks does the attacker change the registration of a
domain name without the permission of the original owner/registrant?
a. Directory traversal
b. Path traversal
c. Dot-dot-slash
d. Domain hijacking
D. Domain hijacking is a type of hijacking attack in which the attacker changes
the registration of a domain name without the permission of the original
owner/registrant. One of the most common methods used to perform a
domain hijacking is using social engineering.
203
```
Which type of network security control could be used to control access to a
network based on the security posture?
a. DNS
b. NAC
c. WAF
d. None of these answers are correct.
```
B. Some companies (such as Cisco) offer hardware-based NAC solutions,
whereas other organizations offer paid software-based NAC solutions and
free ones such as PacketFence (https://packetfence.org), which is open source.
The IEEE 802.1X standard, known as port-based network access control, or
PNAC, is a basic form of NAC that enables the establishment of authenticated
point-to-point connections, but NAC has grown to include software; 802.1X is
now considered a subset of NAC.
204
Which type of management access would require an alternative path?
a. Keyloggers
b. Out-of-band management
c. DNS
d. NTP
B. As administrator, you might need to take an alternate path to manage network devices. In this case, you might require out-of-band management. This
is common for devices that do not have a direct network connection, such as
UPSs, PBX systems, and environmental controls.
205
Which feature present in most switches is used to provide access control by
restricting the MAC address that can connect?
a. DHCP snooping
b. MITM detection
c. ARP cache poisoning detection
d. Port security
D. Port security is a security feature present in most routers and switches, and
it is used to provide access control by restricting the Media Access Control
(MAC) addresses that can be connected to a given port. This differs from a MAC access list because it works only on the source MAC address without
matching the MAC destination.
206
```
Which type of appliance secures a network by keeping machines behind it
anonymous?
a. DHCP server
b. WLAP
c. WAP
d. IP proxy server
```
D. IP proxy secures a network by keeping machines behind it anonymous; it
does this through the use of NAT. For example, a basic four-port router can
act as an IP proxy for the clients on the LAN it protects. An IP proxy can
be the victim of many network attacks, especially DoS attacks. Regardless of
whether the IP proxy is an appliance or a computer, it should be updated regularly, and its log files should be monitored periodically and audited according
to organization policies.
207
Which type of ACL would control access based on MAC address?
a. Layer 3
b. Layer 4
c. Layer 5
d. Layer 2
D. A Layer 2 access control list (ACL) operates at the data link layer of the
OSI model and implements filters based on Layer 2 information. An example
of this type of access list is a MAC access list, which uses information about
MAC addresses to create the filter.
208
Which routing protocol is one of the most common ones used in route manipulation attacks?
a. OSPF
b. RIP
c. IGRP
d. BGP
D. There are different route manipulation attacks, but one of the most common is the Border Gateway Protocol (BGP) hijacking attack. BGP is a
dynamic routing protocol used to route Internet traffic. An attacker can launch
a BGP hijacking by configuring or compromising an edge router to announce
prefixes that have not been assigned to his or her organization. If the malicious
announcement contains a route that is more specific than the legitimate advertisement or presents a shorter path, the victim’s traffic may be redirected to
the attacker. In the past, threat actors have leveraged unused prefixes for BGP
hijacking to avoid attention from the legitimate user or organization.
209
Which QoS feature can be used for guaranteed bandwidth?
a. WRED
b. DSCP
c. ToS
d. CBWFQ
D. As administrator, you can use QoS capabilities to control application prioritization. Protocol discovery features in Cisco AVC show the mix of applications currently running on the network. This information helps you define
QoS classes and policies, such as how much bandwidth to provide to missioncritical applications and how to determine which protocols should be policed.
Per protocol bidirectional statistics are available, such as packet and byte
counts, as well as bit rates. After you classify the network traffic, you can apply
class-based weighted fair queuing (CBWFQ) for guaranteed bandwidth.
210
Which type of IPv6 address is structured like a unicast address?
a. Multicast
b. RIP
c. IGRP
d. Anycast
D. An anycast address is assigned to a group of interfaces on multiple nodes.
Packets are delivered to the “first” interface only. Anycast is structured like
unicast addresses.
211
```
Which type of packet capture solution would be implemented as a command
on a network switch?
a. Tap
b. Span port
c. Sniffer
d. None of these answers are correct.
```
A. To capture packets and measure throughput, you need a tap on the network
before you can start monitoring. Most tools that collect throughput leverage
a single point configured to provide raw data, such as pulling traffic from a
switch or router. If the access point for the traffic is a switch, typically a network port is configured as a Switched Port Analyzer (SPAN) port, sometimes
also called port mirroring or port spanning. The probe capturing data from a SPAN port can be either a local probe or data from a SPAN port that is routed
to a remote monitoring tool.
212
Which of the following enables you, as security administrator, to identify an
issue based on a change in normal behavior?
a. Baselining
b. Spanning
c. Packet capture
d. None of these answers are correct.
A. Baselining is the process of measuring changes in networking, hardware,
software, applications, and so on. The process of documenting and accounting
for changes in a baseline is known as baseline reporting. Baseline reporting
enables you to identify the security posture of an application, system, or network. The security posture can be defined as the risk level to which a system,
or other technology element, is exposed. Security posture assessments (SPAs)
use baseline reporting and other analyses to discover vulnerabilities and weaknesses in systems.
213
Which tool would help you identify whether the correct permissions are in
place for files or folders on a system you are monitoring?
a. NIPS
b. NIDS
c. FIM
d. None of these answers are correct.
C. File integrity is important when securing log files, and File Integrity
Monitoring (FIM) helps you maintain this integrity. Encrypting the log files
through the concept known as hashing is a good way to verify the integrity of
the log files if they are moved and/or copied. You could also flat-out encrypt
the entire contents of the file so that other users cannot view it. Integrity
means that data has not been tampered with. Authorization is necessary
before data can be modified in any way; this is done to protect the data’s
integrity.
214
What WPA version utilizes Simultaneous Authentication of Equals (SAE)?
a. WPA3
b. WPA2
c. WPA
d. None of these answers are correct.
A. WPA3 includes a more robust authentication mechanism than WPA2. It
also provides a higher level of encryption capabilities. It enables a very robust
authentication based on passwords by utilizing a technology called Simultaneous Authentication of Equals (SAE). This innovation in Wi-Fi security
replaces the preshared key (PSK). SAE helps protect against brute-force password attacks and offline dictionary attacks.
215
Which protocol is based on AES and provides stronger security over TKIP?
a. WPA
b. CCMP
c. WPA2
d. All of these answers are correct.
B. Counter-mode/CBC-MAC protocol or CCMP is based on the Advanced
Encryption Standard (AES). It provides a stronger mechanism for securing
privacy and integrity over Temporal Key Integrity Protocol (TKIP), which was
previously used with WPA. An advantage to CCMP is that it utilizes 128-bit
keys as well as a 48-bit initialization vector. This enhancement greatly reduces
the possibility of replay attacks. One drawback to using CCMP over TKIP is
that it requires additional processing power. That is why you will typically see
it supported on newer hardware.
216
```
Which of the following is a data link layer authentication technology that
defines port-based access control?
a. 802.1X
b. 802.11ac
c. 802.11a
d. None of these answers are correct.
```
A. 802.1X is an IEEE standard that defines port-based network access control
(PNAC). Not to be confused with 802.11X WLAN standards, 802.1X is a
data link layer authentication technology used to connect hosts to a LAN or
WLAN. 802.1X allows you to apply a security control that ties physical ports
to end-device MAC addresses, and prevents additional devices from being connected to the network. It is a good way of implementing port security, much
better than simply setting up MAC filtering.
217
```
Which of the following components of 802.1X would be an access point or
switch?
a. Authorization server
b. Authentication server
c. Supplicant
d. Authenticator
```
D. Following are the three components to an 802.1X connection:
■ Supplicant: A software client running on a workstation. This is also known
as an authentication agent.
■ Authenticator: A wireless access point or switch.
■ Authentication server: An authentication database, most likely a RADIUS
server.
218
Which of the following components of 802.1X runs on a client workstation?
a. Authorization server
b. Authentication server
c. Authenticator
d. Supplicant
D. The supplicant is a software client running on a workstation. It is also
known as an authentication agent.
219
```
Which of the following components of 802.1X includes an authentication
database?
a. EAP-FAST
b. EAP-TTLS
c. EAP-TLS
d. PEAP
```
D. The Protected Extensible Authentication Protocol (PEAP) uses MSCHAPv2, which supports authentication via Microsoft Active Directory
databases. It competes with EAP-TTLS and includes legacy password-based
protocols. It creates a TLS tunnel by acquiring a public key infrastructure (PKI)certificate from a server known as a certificate authority (CA). The TLS tunnel
protects user authentication much like EAP-TTLS.
220
Which type of EAP authentication uses Secure Tunneling?
a. EAP-TLS
b. EAP-FAST
c. EAP-TTLS
d. PEAP
B. EAP-FAST uses a protected access credential instead of a certificate to
achieve mutual authentication. FAST stands for Flexible Authentication via
Secure Tunneling.
221
_______________is automatically used when you select WPA-Personal.
a. PKI
b. WPA
c. PSK
d. Open
C. The preshared key (PSK) used to enable connectivity between wireless
clients and the WAP is a complex passphrase. PSK is automatically used when
you select WPA-Personal in the Security Mode section. The other option is
WPA-Enterprise, which uses a RADIUS server. So, if you ever see the term
WPA2-PSK, this means that the WAP is set up to use the WPA2 protocol with
a preshared key, and not an external authentication method such as RADIUS.
222
```
Which of the following was created to give users easy connectivity to wireless
access points?
a. WPA
b. WPS
c. WEP
d. All of these answers are correct.
```
B. Wi-Fi Protected Setup (WPS) is a security vulnerability. Created originally
to give users easy connectivity to a wireless access point, later all major manufacturers suggested that it be disabled (if possible). In a nutshell, the problem
with WPS was the eight-digit code. It effectively worked as two separate smaller
codes that collectively could be broken by a brute-force attack within hours.
223
Which of the following can help with the proper placement of access points?
a. WEP
b. Channel overlaps
c. RADIUS
d. Site survey
D. Strategic wireless access point (WAP) placement is vital. That is why it is
essential to perform a site survey before deploying wireless equipment. A site
survey is typically performed using Wi-Fi Analyzer tools to produce a heat
map of all wireless activity in the area.
224
Which of the following has benefits for contactless payments?
a. NFC
b. USB
c. LTE
d. None of these answers are correct.
A. Near-field communication (NFC) has obvious benefits for contactless payment systems or any other non-contact-oriented communications between
devices. However, for optimal security, you should use contact-oriented readers and cards.
225
```
Which of the following is utilized to alert when users enter or exit an
organization’s physical borders?
a. Point-to-point deployment
b. Geofencing
c. Infrared
d. All of these answers are correct.
```
B. Geofencing is an excellent way to be alerted to users entering and exiting an
organization’s physical premises. It can provide security for wireless networks
by defining the physical borders and allowing or disallowing access based on
the physical location of the user, or more accurately, the user’s computer or
mobile device.
226
Which is a way to reduce the impact of mobile device theft?
a. Full device encryption
b. Application management
c. Context-aware authentication
d. None of these answers are correct.
A. You should encrypt data communication between a device and the organization and enable full device encryption of data stored on the device or in
removable storage.
227
```
Which MDM feature allows software updates to be pushed to devices
remotely?
a. GPS
b. OTG
c. WAP
d. OTA
```
D. One of the characteristics of an MDM solution is the use of over-the-air
(OTA) device management updates. OTA historically refers to the deployment
and configuration performed via a messaging service, such as Short Message
Service (SMS), Multimedia Messaging Service (MMS), or Wireless Application
Protocol (WAP). Now it’s used to indicate remote configuration and deployment of mobile devices.
228
Which of the following terms means loading third-party apps from a location
outside the official application store for that device?
a. Carrier unlocking
b. SIM card cloning
c. Jailbreaking
d. Sideloading
D. Insecure user configurations such as rooting and jailbreaking can be
blocked from MDM, as can sideloading—the art of loading third-party apps
from a location outside the official application store for that device. Note that
sideloading can occur in several ways: by direct Internet connection (usually
disabled by default), by connecting to a second mobile device via USB OTG
(USB On-The-Go) or Bluetooth, by copying apps directly from a microSD
card, or by tethering to a PC or Mac.
229
```
Which of the following terms means sending unsolicited messages to
Bluetooth-enabled devices?
a. Bluesnarfing
b. Bluejacking
c. Bluehacking
d. None of these answers are correct.
```
B. Bluejacking is the sending of unsolicited messages to Bluetooth-enabled
devices such as mobile phones. You can stop bluejacking by setting the affected
Bluetooth device to undiscoverable or by turning off Bluetooth altogether.
230
Which of the following is one of the best ways to ensure that data is secured
and that applications work properly without interference from potential
attackers?
a. Application whitelisting
b. Encryption
c. Application management
d. None of these answers are correct.
B. Encryption is one of the best ways to ensure that data is secured and that
applications work properly without interference from potential attackers.
However, you should consider whole device encryption, which encrypts the
internal memory and any removable (SD) cards.
231
```
Which of the following describes a policy in which the company supplies
employees with phones?
a. BYOD
b. COPE
c. VDI
d. None of these answers are correct.
```
B. Companies may implement strategies such as choose your own device
(CYOD), where employees select a device from a company-approved list, or
corporate-owned, personally enabled (COPE), where the company supplies
employees with phones that can also be used for personal activities.
232
In cloud computing environments, which type of policy would be used to
control access to CPU and memory allocation and the like?
a. Resource policies
b. Key policies
c. Wireless policies
d. None of these answers are correct.
. A. Resource policies in cloud computing environments are meant to control
access to a set of resources. A policy is deployed to manage the access to the
resource itself.
233
```
Which of the following is utilized by a cloud computing environment to
handle API keys?
a. Private key
b. Secrets management tool
c. Web key
d. All of these answers are correct.
```
B. In cloud computing environments, the management of things like API keys,
passwords, and certificates is typically handled by some kind of secrets management tool. It provides a mechanism for managing the access and auditing
the secrets used in the cloud environment
234
In cloud computing environments, what term is used for storage instances?
a. Buckets
b. Servers
c. Instances
d. Containers
A. In cloud computing environments, storage is referred to as buckets. The
access to these buckets is controlled by an Identity and Access Management
(IAM) policy.
235
```
In cloud computing environments, which type of subnet would have a route to
the Internet?
a. Private subnet
b. Internet subnet
c. Cloud subnet
d. Public subnet
```
D. In cloud computing environments, the concept of a public subnet is one
that has a route to the Internet. A private subnet would be a subnet in the
cloud environment that does not have a route to the Internet.
236
```
Which of the following is a tool used to control access to cloud-based
environments?
a. SCOR
b. IAM
c. VPC
d. CASB
```
D. A cloud access security broker (CASB) is a tool that organizations utilize
to control access to and use of cloud-based computing environments and
resources. Many cloud-based tools are available for corporate and personal
use. The flexible access nature of these tools makes them a threat to data leak
prevention and the like. It is very easy to make the mistake of copying a file
that contains sensitive data into the wrong folder and making it available to the
world. This is the type of scenario that CASB solutions help mitigate.
237
```
Which of the following solutions would help enable remote worker access
more efficiently?
a. IAM
b. SWG
c. CASB
d. None of these answers are correct.
```
B. The concept of a Secure Web Gateway (SWG) is top of mind these days.
At the time of this writing, we are currently in a global pandemic that has
forced millions to work from home. For many years, the solution for providing
employees a way to work from home was simply a remote-access VPN back
into the office. This solution allowed all of the traffic from the employees’
computers to flow back through the corporate network, which would in turn
traverse the same security controls that were in place if the employees were
plugged into the corporate network. With the advent of cloud-based access to applications and storage, this solution is no longer the most efficient way of
securing remote workers. This is where the SWG comes into play. A Secure
Web Gateway enables you to secure your remote workers’ Internet access
while not overloading the corporate Internet pipe. This approach is sometimes
thought of as a cloud firewall. However, an SWG typically has many other
protection mechanisms in place, including things like CASB. One example of
an SWG is Cisco Umbrella.
238
```
Which Open Systems Interconnection (OSI) layer do many cloud-based
firewalls focus on?
a. Presentation
b. Application
c. Network
d. Session
```
B. Cloud-based firewalls can work at all layers of the OSI model. However, in
many cloud computing environments, the firewall is used at the application
layer to control access and mitigate threats to applications being hosted by the
cloud environment.
239
Which type of cloud control is typically provided by the actual cloudcomputing environment vendor?
a. Third-party
b. Cloud native
c. Commercial
d. Retail
B. A cloud native control is typically provided by the actual cloud-computing
environment vendor. A non-cloud native control is provided by a third-party
vendor. For instance, each cloud computing environment has security controls
built into its platform. However, these controls might not be sufficient for all
use cases. That is where third-party solutions come into play. Many companies
out there today provide these third-party solutions to supplement those areas
where cloud native controls are lacking. Of course, most virtual machine–based
controls can be deployed in any cloud computing environment. However, for
it to be native, it must go through various integration, testing, and certification
efforts. Because each cloud computing environment is built differently and
on different platforms, the controls must be adapted to work as efficiently as
possible with the specifications of the environment. Many times, the decision
between utilizing cloud native versus third-party solutions comes down to the
actual requirements of the use case and the availability of the solution that fits
those requirements.
240
Which type of service provider also manages the authentication and authorization process on behalf of other systems?
a. Service provider (SP)
b. Identity provider (IdP)
c. Principal
d. None of these answers are correct.
B. An identity provider (IdP) is a service provider that also manages the
authentication and authorization process on behalf of other systems in the
federation.
241
```
Which of the following is best defined as the process of providing the identity
of a subject or user?
a. Identity
b. Authentication
c. Authorization
d. All of these answers are correct.
```
B. Authentication is the process of proving the identity of a subject or user.
Once a subject has identified itself in the identification step, the enforcer
has to validate the identity—that is, be sure that the subject (or user) is the
one it is claiming to be. This is done by requesting that the subject (or user)
provide something that is unique to the requestor. This could be something
known only by the user, usually referred to as authentication by knowledge, or
owned only by the user, usually referred to as authentication by ownership, or it
could be something specific to the user, usually referred to as authentication by
characteristic.
242
Which standard format is used for most certificates?
a. X.509
b. EFS
c. X.409
d. PEM
A. Most certificates are based on the X.509 standard, which is a common PKI
standard developed by the ITU-T that often incorporates the single sign-on
(SSO) authentication method.
243
Which of the following is an open standard for exchanging authentication
and authorization data between identity providers?
a. RSA
b. RADIUS
c. Duo
d. SAML
D. SAML is an open standard for exchanging authentication and authorization
data between identity providers. SAML is used in many single sign-on (SSO)
implementations.
244
Which of the following types of accounts would be used for a web server?
a. Server account
b. Generic account
c. User account
d. Service account
D. A service account is typically used on a server to provide a separate set of
credentials and permissions to an application or service that is running. For
instance, a server that is running Apache web server might have an apache_
user account. That account would then be provided with only the access it
needs to be able to perform the functions that services provide.
245
Which tool can be used to validate who is logged in to a Windows system?
a. Winlogon
b. PSLoggedOn
c. whoami
d. None of these answers are correct.
B. A tool you can use to validate who is logged in to a Windows system is the
PsLoggedOn application. For this application to work, it has to be downloaded
and placed somewhere on your local computer that will be remotely checking hosts. After it’s installed, simply open a command prompt and execute the
command C:\PsTools\psloggedon.exe\\HOST_TO_CONNECT.
246
```
Which command can be used on a Linux system to determine who is
logged in?
a. WinlogON
b. PSlogOn
c. whoami
d. whoareyou
```
C. For Linux machines, various commands can show who is logged in to a system, such as the w, who, users, whoami, and last “user name” commands.
247
```
Which method can be used in determining the physical location of a user
trying to authenticate?
a. Username
b. Geolocation
c. Group
d. Domain
```
B. Geolocation is the actual method of determining the physical location of
the user trying to authenticate.
248
```
Which attribute would be used if you wanted to restrict when a user is able to
log in?
a. Geolocation
b. Geotagging
c. Time-based
d. None of these answers are correct.
```
C. A time-based attribute can be used when authenticating and authorizing
a user. When a user logs in and provides his or her identity, that user can be
given specific access based on the time he or she connects. For instance, if you do not expect that someone should be connecting to your wireless network at
3 a.m., then you can set a policy that blocks access between specific hours of
operation.
249
```
Which of the following is the process of information being attached in
metadata to files such as pictures?
a. Geolocation
b. Geotagging
c. Lockout
d. None of these answers are correct.
```
B. Geotagging is the process of attaching location information in the metadata
of files, such as pictures taken from a smartphone.
250
Which of the following is a type of technology used by inserting a hardware
USB device into a computer for authentication?
a. Password key
b. Password vault
c. Trusted Platform Module
d. None of these answers are correct.
A. Password keys are a technology typically deployed by corporations when
implementing two-factor authentication. The primary use case is remote
access to the organization’s environment. However, many organizations also
use them internally. These keys are especially important to use for access to
highly sensitive data or applications that serve that data—for instance, financial
applications or anything involving intellectual property, such as source code.
Many types of password keys are on the market these days. They come in various form factors and are utilized in different ways. For instance, some are used
by inserting into a computer USB port. Some are simply one-time password
tokens used as a second factor when authenticating, whereas others are a combination of different functions.
251
Which of the following can be used to store a set of credentials for later use?
a. Password key
b. Password vault
c. Password authentication module
d. All of these answers are correct.
B. A password vault is also often referred to as a password manager. It is simply a piece of software that is utilized to store and manage credentials. Typically, the credentials are stored in an encrypted database. Having an encrypted
database protects the credentials from being compromised if the database is
obtained by a threat actor through the compromise of a system holding the
database.
252
```
Which of the following is utilized to verify a user based on something only
that person knows?
a. Knowledge-based authentication
b. Password vault
c. Password key
d. Hardware security module
```
A. NIST defines knowledge-based authentication (KBA) as authentication of
an individual based on knowledge of information associated with his or her
claimed identity in public databases. Knowledge of such information is considered to be private rather than secret, because it may be used in contexts other than authentication to a verifier, thereby reducing the overall assurance
associated with the authentication process. A popular use case for this type of
authentication is to recover a username or reset a password. Typically, a set
of predetermined questions is asked of the user. These questions must have
already been provided by the end user at the time of account setup or provided
as an authenticated user at a later time. The idea is that the information that
was provided is something that only the user would know. That is why it is
important to utilize a set of questions that cannot be easily guessed or are not
public knowledge.
253
Which of the following is a system that is utilized to allow a user to log in once
but gain access to multiple systems without being asked to log in again?
a. Password key
b. Password vault
c. Two-factor authentication
d. Single sign-on
D. Using single sign-on (SSO), a user can log in once but gain access to multiple systems without being asked to log in again. This system is complemented
by single sign-off, which is basically the reverse; logging off signs off a person
from multiple systems. SSO is meant to reduce password fatigue or password
chaos, which occurs when a person can become confused and possibly even disoriented when having to log in with several different usernames and passwords.
This system is also meant to reduce IT help desk calls and password resets.
254
Which of the following is a system where a user’s identity and attributes are
shared across multiple identity management systems?
a. Trusted Platform Module
b. Knowledge-based authentication
c. Password authentication
d. Federated identity management
D. Single sign-on (SSO) is a derivative of federated identity management (also
called FIM or FIdM). In this system, a user’s identity and attributes are shared
across multiple identity management systems. These various systems can be
owned by one organization; for example, Microsoft offers the Forefront Identity Manager software, which can control user accounts across local and cloud
environments.
255
Which of the following is an open standard for exchanging authentication and
authorization data between identity providers?
a. KBA
b. SAML
c. SSO
d. None of these answers are correct.
B. Security Assertion Markup Language (SAML) is an open standard for
exchanging authentication and authorization data between identity providers.
SAML is used in many single sign-on (SSO) implementations.
The OASIS Security Assertion Markup Language standard is currently the
most-used standard for implementing federated identity processes. SAML
is an XML-based framework that describes the use and exchange of SAML
assertions in a secure way between business entities. The standard describes
the syntax and rules to request, create, use, and exchange these assertions.
256
Which of the following is an authentication scheme where the access control
policy is generally determined by the owner?
a. MAC
b. DAC
c. RBAC
d. SAML
B. Discretionary access control (DAC) is an access control policy generally
determined by the owner. Objects such as files and printers can be created
and accessed by the owner. Also, the owner decides which users are allowed to
have access to the objects and what level of access they may have. The levels of
access, or permissions, are stored in access control lists (ACLs).
257
Which of the following is an authentication scheme where the access control
policy is determined by a computer system, not by a user or owner?
a. 802.1X
b. MAC
c. RBAC
d. SAML
B. Mandatory access control (MAC) is an access control policy determined by
a computer system, not by a user or owner, as it is in DAC. Permissions are
predefined in the MAC model. Historically, it has been used in highly classified government and multilevel military systems, but you can find lesser implementations of it in today’s more common operating systems as well. The
MAC model defines sensitivity labels that are assigned to subjects (users) and
objects (files, folders, hardware devices, network connections, and so on).
258
```
Which of the following is a security principle where users are given only the
privileges needed to do their job?
a. Single sign-on
b. Least privilege
c. Knowledge-based authentication
d. All of these answers are correct.
```
B. Least privilege is a security principle in which users are given only the privileges needed to do their job and not one iota more. A basic example would be
the Guest account in a Windows computer. This account (when enabled) can
surf the web and use other basic applications but cannot make any modifications to the computer system. However, least privilege as a principle goes much
further. One of the ideas behind the principle is to run the user session with
only the processes necessary, thus reducing the amount of CPU power needed.
259
Which of the following is an access model that works with sets of permissions
instead of individual permissions that are label-based?
a. MAC
b. RBAC
c. DAC
d. ABAC
B. Role-based access control (RBAC) is an access model that, like MAC, is
controlled by the system, and, unlike DAC, not by the owner of a resource.
However, RBAC is different from MAC in the way that permissions are configured. RBAC works with sets of permissions instead of individual permissions that are label-based. A set of permissions constitutes a role. When users
are assigned to roles, they can then gain access to resources.
260
```
Which of the following is a type of key used in PKI that should always be kept
secret and stored securely?
a. Private key
b. Public key
c. Wireless key
d. None of these answers are correct.
```
A. Users need a private key to encrypt the digital signature of a private email.
The difference in type of key is the level of confidentiality. A public key certificate obtained by a web browser is public and might be obtained by thousands of individuals. The private key used to encrypt the email is not to be shared
with anyone.
261
```
Which of the following is utilized by a web server and viewed by the
web browser?
a. Private key
b. Public key
c. Web key
d. All of these answers are correct
```
B. A public key certificate obtained by a web browser is public and might be
obtained by thousands of individuals. A private key used to encrypt email is not
to be shared with anyone.
262
Which standard format is used for most certificates?
a. X.509
b. EFS
c. X.409
d. PEM
A. Most certificates are based on the X.509 standard, which is a common PKI
standard developed by the ITU-T that often incorporates the single sign-on
(SSO) authentication method.
263
Which of the following is a component of an X.509 certificate that includes
information such as serial number and digital signature?
a. Hash name
b. Certificate code
c. Bar code
d. Certificate authority
D. Components of an X.509 certificate include the following:
■ Owner (user) information, including public key
■ Certificate authority information, including name, digital signature, serial
number, issue and expiration dates, and version
264
```
Which of the following certificates allow for connections to the main website
as well as subdomains?
a. Directory certificates
b. Public certificates
c. Extended certificates
d. Wildcard certificates
```
D. Many companies have subdomains for their websites. Generally, if you connect to a secure website that uses subdomains, a single certificate allows for connections to the main website and the subdomains. This is known as a wildcard
certificate; for example, *.h4cker.org, meaning all subdomains of h4cker.org.
265
Which of the following fields in a certificate can specify additional hostnames?
a. Hostname
b. Subject Alternative Name
c. Validation name
d. None of these answers are correct.
B. By modifying the Subject Alternative Name (SAN) field, an organization
can specify additional hostnames, domain names, IP addresses, and so on.
266
```
Which of the following is a restricted version of BER in that it allows the use
of only one encoding type?
a. DER
b. CER
c. P12
d. BER
```
B. Canonical Encoding Rules (CER) is a restricted version of BER in that it
allows the use of only one encoding type; all others are restricted.
267
Which is a way to add a layer of security to avoid root CA compromise?
a. Online
b. Offline
c. Multipath
d. Singlepath
B. If a root CA is compromised, all of its certificates are then also compromised, which could affect an entire organization and beyond. The entire
certificate chain of trust can be affected. One way to add a layer of security
to avoid root CA compromise is to set up an offline root CA. Because it is
offline, it cannot communicate over the network with the subordinate CAs, or
any other computers for that matter. Certificates are transported to the subordinate CAs physically using USB flash drives or other removable media. Of
course, you would need to have secure policies regarding the use and transport
of media, and would need to incorporate data loss prevention (DLP), among
other things. But the offline root CA has some obvious security advantages
compared to an online root CA. Consider this offline mindset when dealing
with critical data and encryption methods.
268
Which is a method to use for blocking on-path attacks?
a. Online
b. Pinning
c. Offline
d. Chaining
B. One way to add security to a certificate validation process is to use certificate pinning, also known as SSL pinning or public key pinning. It can help
detect and block many types of on-path attacks by adding an extra step beyond
normal X.509 certificate validation. Essentially, a client obtains a certificate
from a CA in the normal way but also checks the public key in the server’s certificate against a hashed public key used for the server name. This functionality must be incorporated into the client side, so it is important to use a secure and
up-to-date web browser on each client in order to take advantage of certificate
pinning.
269
How can you use traceroute to shore up cybersecurity in an organization?
a. Discovering where hosts and systems are located on a Linux-based
network
b. Tracing traffic to the Internet and where it came from
c. Tracing all routes to Windows hosts that are running on a private
network
d. Tracing attackers that enter your network and identifying them
A. Using the Linux traceroute command enables you to document hosts’
locations on your local network and map out the current location/configuration and connected devices. A baseline network diagram should be used and
continuously updated to document systems.
270
What process does nslookup use to obtain domain names from IP addresses?
a. nslook, where a lookup is made of the NS database
b. Reverse DNS lookup
c. Forward DNS lookup
d. iptrace domain lookup service
B. nslookup is a simple but practical command-line tool. It is principally used
to find the IP address that corresponds to a host or the domain name that corresponds to an IP address (a process called reverse DNS lookup).
271
```
The command-line utility head can read a number of files. How many lines
can it read by default?
a. 100 lines
b. 500 lines
c. 10 lines
d. 50 lines
```
C. The Linux-centric head command reads the first 10 lines of a given
filename
272
The command-line tool cat is a universal Linux tool that allows you to view
almost any file. What is the process it uses to do this?
a. Copying the file to special space on the swapfile
b. Copying standard input to standard output
c. Duplicating the file to a temp file and showing the original
d. Copying the file from the file system and displaying it to tty1
B. The cat command is a widely used and universal tool. It copies standard
input to standard output. The command supports scrolling if the text file
doesn’t fit the current screen.
273
A shell can have two types of variables. What are they?
a. /var/log
b. Environment and local variables
c. /var/variables
d. Local variables and system variables
B. A shell can have two types of variables: environment variables that are
exported to all processes spawned by the shell and shell (local) variables.
274
```
Every time it starts a session, the shell builds what area that will contain
variables that define system properties?
a. env and tmp variables
b. Shellconf spaces
c. The tty1 and tty2 terminals
d. Environment
```
D. The environment is an area that the shell builds every time it starts a session. This area contains variables that define system properties.
275
```
The Wireshark GUI tool is a packet analysis tool and is available under what
platforms?
a. CubeOS
b. CP/M
c. Windows, Linux, and macOS
d. MSDos5.0
```
C. Wireshark is available on Windows, Linux, and macOS. There are both
command-line and GUI versions.
276
```
The packet replay tool tcpreplay can replay packets at different intervals.
What command-line code is required?
a. unique ip
b. pps-packets
c. mbps-string
d. pps-multi
```
D. The pps-multi command sets the number of packets to send for each time
interval. This option must appear in combination with the following option:
pps. This option takes an integer number as its argument. The value of the
number is constrained to being greater than or equal to one. The default number for this option is one; therefore, you should use --pps-multi=# to set pps.
277
The disk duplication tool dd can be used to create a complete image of a hard
disk. What is the proper syntax?
a. # dd hdadisk.img
b. # dd if = /dev/hda of = ~/hdadisk.img
c. # dd if = /dev/hda image
d. # dd /dev/hda /hdadisk.img
B. You can use the dd tool to create a complete image of the hard disk /dev/hda
by using # dd if = /dev/hda of = ~/hdadisk.img. This image can be used to
preserve forensic evidence of a computer system that was attacked or used to
exploit other systems.
278
What is one of the most notable and widely used exploitation frameworks?
a. backtrack
b. chrona
c. twocows
d. Metasploit
D. Three of the most notable exploitation frameworks are Metasploit, Core
Impact, and Immunity Canvas, although there are a number of less famous
frameworks.
279
Passwords are only as good as the complexity and length that the creator used.
What popular password cracker enables highly parallelized password-cracking
capabilities and is available on nearly every operating system platform?
a. Rainbow Crack
b. Active Directory Fast Crack
c. Hashcat
d. L0phtCrack
C. Hashcat is one of the most popular and widely used password crackers in
existence. It is available on every operating system and supports more than
300 different types of hashes. It enables highly parallelized password-cracking
capabilities, enabling you to crack multiple different passwords on multiple
different devices at the same time and to support a distributed hash-cracking
system via overlays. Cracking is optimized with integrated performance tuning
and temperature monitoring.
280
Data sanitization is the process of deliberately, permanently, and irreversibly
removing or destroying the data stored on a memory device to make it unrecoverable. Which of the following is a method to ensure no data is recoverable
no matter what software recovery process is used?
a. Low-level format or fdisk /s
b. Data erasure writing 0s and 1s
c. Physical destruction shredding
d. Kali Linux installed on the drive
C. There are three methods to achieve data sanitization: physical destruction,
cryptographic erasure, and data erasure. However, the downside of these techniques is that they damage the storage media and do not allow it to be sold or
reused. The only real method to ensure the data is unrecoverable is to shred
the hard drive or data as it is.
281
Which high-level document is a step-by-step procedure that should be created
as part of an incident response plan that can target specific incident handling
like malware and ransomware?
a. Playbooks
b. Play stations
c. Lessons learned after action report
d. Security incident field report
A. Playbook documents are step-by-step procedures and should be high level
and focused on specific areas such as malware, insider threats, unauthorized
access, ransomware, and phishing.
282
Which legal portion of an incident response plan requires notification or
disclosure within 72 hours of discovery of a data incident?
a. DR Disclosure Federal Law
b. NIST Disclosure Law
c. New Jersey Privacy Law
d. GDPR
D. Data breach notification laws are becoming more common: the European
Union’s General Data Protection Regulation (GDPR), for instance, requires
that companies report data security incidents within 72 hours of discovery
283
Which incident response plan item will provide an understanding of the
severity of an incident so that it can be prioritized quickly and correctly?
a. Disaster recovery report
b. Incident response report
c. Triage matrix
d. Threat matrix
C. A triage matrix provides an understanding of the severity of an incident so
that it can be prioritized quickly and correctly.
284
```
Which phase of the incident response process should be performed within two
weeks of the end of an incident?
a. Identification
b. Preparation
c. Lessons learned
d. Remediation
```
C. The lessons learned phase of the incident response process should be performed no later than two weeks from the end of the incident. A Post Incident
Response (PIR) meeting ensures information is fresh on the team’s mind.
285
Which exercise simulates a real-life scenario of an incident response plan and
is used to the test and highlight areas where your team excels and areas that
need to be addressed?
a. Tabletop
b. Containment exercises
c. Recovery process
d. Cyber kill chain
A. The tabletop exercise is often used to validate and/or improve an organization’s incident response (IR) plan. Real-life scenarios are used to put the
response plan to the test, highlighting areas where your team excels and areas
to be addressed.
286
What Diamond Model places the basic components of malicious activity at
one of the four points on a diamond shape? What are the four points?
(Choose two.)
a. Malware and infection vectors
b. Personas and biometrics
c. Adversary and infrastructure
d. Capability and victim
C and D. The Diamond Model places the basic components of malicious activity at one of the four points on a diamond shape: adversary, infrastructure,
capability, and victim. The model provides for analysis of threats related to
intrusion.
287
The ATT&CK Framework has 11 tactics and hundreds of techniques. Which
tactic describes the way an adversary implements a technique?
a. Collection
b. Procedures
c. Privilege escalation
d. Impact
B. Procedures describe the way adversaries implement a technique. A procedure concerns the particular instance use and can be useful for understanding exactly how the technique is used and for replication of an incident
with adversary emulation as well for specifics on how to detect the instance
in use.
288
```
Which of the following is one of the five key stakeholders of the incident
response team?
a. Security Operations
b. Security Guards
c. Public Library
d. Legal
```
D. There are five key stakeholders for any IR team; they are IT Services, Security Management, Legal, Human Resources, and Public Relations.
289
In a communication plan, escalating communication information on a regular
schedule or timeline is important. What is the appropriate frequency of this
communication?
a. Once an hour
b. Once every six hours
c. As key information is available
d. As every item is uncovered
C. When your team is engaged with an incident, you should have them set up
proactive alerting. They don’t need to call everyone every time, but your handlers need to plan ahead. Your incident response team needs to keep key contacts up to date so that when they have to notify contacts, it doesn’t come as a
surprise. Notifying key contacts with only incident-relevant data as it becomes
available reduces overcommunication of nonimportant data.
290
Which of the following is a formal document that contains details on how to
respond to a cyber attacks and unplanned incidents?
a. Incident response model
b. Disaster continuity plan
c. Disaster recovery plan
d. Containment process
C. A disaster recovery (DR) plan is a formal document created by organizations that contains detailed instructions on how to respond to unplanned
incidents such as natural disasters, power outages, cyber attacks, or other disruptive events.
291
```
Not implementing a disaster recovery plan properly can lead to which of the
following?
a. Satisfied customers
b. Brand awareness
c. Lost revenue
d. Faster recovery
```
C. Disruptions lead to lost revenue, brand damage, and dissatisfied customers.
The longer the recovery time, the greater the adverse impact to the business.
292
What is one thing that a BCP plan contains that a DR plan does not?
a. A standby data center
b. Continuity of a DRP in conjunction with a BCP
c. A continuity plan for the entire organization
d. A disaster recovery model
C. Many people think a disaster recovery (DR) plan is the same as a business
continuity plan (BCP), but a DR plan focuses mainly on restoring an IT infrastructure and operations after a crisis. It’s actually just one part of a complete
business continuity plan, because a BCP looks at the continuity of the entire
organization.
293
```
Which of the following ensures the restoration of organizational functions in
the shortest possible time?
a. COOP
b. MITRE ATT&CK
c. Diamond Model
d. Cyber kill chain
```
A. A continuity of operations plan (COOP) ensures the restoration of organizational functions in the shortest possible time, even if services resume at a
reduced level of effectiveness or availability.
294
What are some of the incidents that an incident response team might be
prepared for and respond to? (Select all that apply.)
a. Attackers gaining access to the web server
b. Hackers obtaining passwords from executives
c. A nasty computer virus that the antivirus contained
d. A power outage in the data center
A, B, D. An incident response team is a group of people who prepare for and
respond to any emergency incident, such as a natural disaster or an interruption of business operations.
295
NIST SP 800-53 requires that all federal agencies retain data for how many
years?
a. Ten years on magnetic media or 20 years on paper
b. Three years on magnetic media
c. Seven years on magnetic media
d. Seven years on magnetic media and 10 years on paper
B. NIST SP 800-53 outlines the requirements that contractors and federal
agencies need to take to meet the Federal Information Security Management
Act (FISMA). It requires data retention for a minimum of three years.
296
Which is one of the benefits of storing historical vulnerability scans?
a. Previous scans compared with current scans can provide insight into
what has changed.
b. Historical scans are required for department leads to understand bandwidth issues and plan for upgrades.
c. Historical scans can be a good data source to feed into your disaster
recovery management system.
d. None of these answers are correct.
A. Historical vulnerability scans can provide significant insight after an incident. By comparing the previous scans with the most recent, you can also look
for variances in devices and systems that may have been changed
297
Which devices on a given network should a vulnerability scanner scan?
a. Laptops and workstations
b. Multifunction printers
c. Routers and switches
d. All of these answers are correct.
D. Network vulnerability scans should include all devices with an IP address
(workstations, laptops, printers and multifunction printers, IoT devices, routers, switches, hubs, IDS/IPS, servers, wireless networks, and firewalls) and all
the software running on them.
298
When is the best time to implement a SIEM sensor on your corporate networks that support critical assets?
a. During the incident to capture as much evidence as possible
b. Before the incident to capture as much evidence as possible
c. After the incident to capture as much evidence as possible
d. All of these answers are correct.
B. Sensors should be deployed before an incident. Sensor placement around
the network allows for greater visibility and can aid in forensic investigation by
quickly identifying the depths of the spread
299
When you are tuning sensitivity of the SIEM for collecting and alerting on
suspect data, what is the risk of an alert being missed because of poor tuning?
a. Configurations enhance the usability of the SIEM.
b. The SIEM collects all of the potential incident data required.
c. A breach can go unnoticed for months.
d. A breach is alerted and recognized immediately.
C. SIEMs can tune sensitivity to what is considered suspect behavior or suspicious files (risk-based prioritization) to help reduce or increase the amount of
data/matches during an investigation.
300
Which log files that you store in a read-only mode can help with your incident
response investigation?
a. Windows server logs
b. Linux server logs
c. Routers and switch log files and logging
d. All of these answers are correct.
D. The log data you collect from your systems and devices may seem pretty
routine. These logs could contain the precise evidence needed to investigate
and successfully eradicate incidents from your network.
301
```
Which Session Initiation Protocol is used to establish, maintain, and tear down
a call session?
a. MGCP
b. RS232
c. H.323
d. SIP
```
D. Session Initiation Protocol (SIP) is a signaling protocol used to establish,
maintain, and tear down a call when terminated. SIP allows the calling parties’
called user agents to locate one another using the network.
302
You need to log data from remote Linux-based applications and devices.
Which of the following are your best options? (Select all that apply.)
a. syslog
b. rsyslog
c. syslog-ng
d. Event Viewer
A, B, C. Syslog is available on most network devices (for example, routers,
switches, and firewalls), as well as printers and Linux-based systems. A syslog
server listens for and then logs data messages coming from syslog clients. Rsyslog and syslog-ng build on syslog capabilities by adding support for advanced
filtering and configuration. Event Viewer is a Windows-based tool that enables
users or administrators to view event logs on Windows-based remote or local
systems.
303
Which journalctl command allows you to search through Linux log files and
select a specific time window, date, and time?
a. journalctl time select
b. sh journalctl file “filename” -select “datatime”
c. journalctl -since YYYY-MM-DD HH:MM:SS
d. journalctl -date -filename
C. If you need to access logs for a specific time window—for instance, journalctl -since 2021-03-15 15:05:00—the time format is YYYY-MM-DD
HH:MM:SS. journalctl is a valuable tool used to collect logs and sort through
mountains of data to help you find a needle in a haystack.
304
Which of the following is used for centralized logging across various platforms
and supports a myriad of different log types and formats?
a. NXLog
b. Application log
c. Security log
d. System log
A. NXLog can process high volumes of event logs from many different
sources. Log processing includes rewriting, correlating, alerting, filtering, pattern matching, log file rotation buffering, and prioritized processing. Application, system, and security logs are Windows-specific Event Viewer logs.
305
Which of the following can map out historical trends for capacity planning
and quickly identify abnormal usage and top talkers?
a. Metadata
b. Dnsenum
c. Bandwidth monitors
d. DNSSEC
C. Bandwidth monitors track bandwidth use over all areas of the network,
including devices, applications, servers, WAN, and Internet links. One benefit
of deploying bandwidth monitors is that they map out historical trends for
capacity planning. With bandwidth monitors, you can quickly identify abnormal bandwidth usage, top talkers, and unique communications, all useful in
finding infected systems that may be exfiltrating data or scanning the network
looking to spread to other hosts.
306
Which type of data does not seem to have any relevance or bearing on an
investigation by itself but when combined with additional context is valuable?
a. Metadata
b. RFC data
c. Syslog
d. SIEM data
A. Metadata is created from every activity you perform, whether it’s on your
personal computer or online, every email, web search, and social or public
application. Metadata is defined as “data that provides information about other
data.” On its own, it might not seem like much, but when combined with additional context can lead to a break in a case.
307
How does NetFlow create flow sessions from unidirectional sets of packets?
a. Unidirectional flows are sent to dynamic collectors.
b. NetFlow uses flows from stateless packets to build an aggregation of
flow records.
c. NetFlow statefully tracks flows or sessions, aggregating packets associated with each flow into flow records.
d. None of these answers are correct
C. A flow is a unidirectional set of packets sharing common session attributes,
such as source and destination, IP, TCP/UDP ports, and type of service. NetFlow statefully tracks flows or sessions, aggregating packets associated with
each flow into flow records, which are bidirectional flows.
308
What tool can you use to capture network traffic and perform analysis of the
captured data to identify potential malicious activity or problems with network
traffic?
a. systemd
b. TTL
c. Metadata scanner
d. Protocol analyzer
D. Protocol analyzers allow network engineers and security teams to capture
network traffic and perform analysis of the captured data to identify potential
malicious activity or problems with network traffic. The network traffic data
can be observed in real time for troubleshooting purposes, monitored by an alerting tool such as a SIEM to identify active network threats, and/or retained
to perform forensic analysis.
309
Lists are used in every manner of computer and application access. When you
allow an application in your system, what type of list do you use?
a. Approved list
b. Block list
c. Allow list
d. Deny list
A. You spend time up front building a whitelist of approved applications for
the application approved list. Then with your central management or endpoint
security solution, you roll out the whitelist enterprisewide to all endpoints.
310
```
A block list or deny list is a basic access control capability that denies specific
types of what from executing?
a. LDAP directories
b. Applications
c. API interfaces
d. Scheduled events
```
B. An application block list or deny list is a basic access control mechanism
that denies specific applications or code on the list from being installed or run.
311
What is the main function of the quarantine capability?
a. To safely submit random files to the cloud
b. To safely copy suspect files
c. To safely delete suspect files
d. To safely store suspect files
D. The main action of the quarantine function is to safely store reported
objects such as malware, infected files, or potentially unwanted applications.
During an investigation, this storage log should be one of the places investigators check for evidence and history of suspect files.
312
Which attack vector(s) needs to be considered for mobile platforms?
a. Hardware
b. Firmware
c. Mobile OS
d. All of these answers are correct
D. With mobile device management (MDM), it is important to establish a
baseline understanding of the changes that are common to specific types of mobile devices. Mobile platforms have several attack vectors that you need
to consider: hardware, firmware, mobile OS, applications, and the device
combination.
313
Data loss prevention is a type of which of the following?
a. Corporate protection of physical assets
b. Assistance with storage of data
c. Loss prevention process
d. End-to-end goal
D. Data loss prevention (DLP) is an end-to-end goal that ensures users do
not send sensitive or critical information outside the corporate network. The
term routinely describes software products that help a network administrator
control the data that users can view or transfer. Intellectual property, corporate
data, and customer data are some of the types of data you would use DLP to
help protect against exfiltration.
314
```
Which of the following is a reason you should isolate a host from the network
and other hosts?
a. Virus, Trojan, or other attack
b. Operating system defect
c. Downgrading the OS system
d. Downloading updates
```
A. Once a compromised endpoint has been infected because malware, a virus,
or a Trojan was detected, or it is part of a much wider attack, it should be quarantined and isolated.
315
Which of the following are not part of the containment phase?
a. Change passwords.
b. Disable network connectivity.
c. Turn off the display.
d. Place the infected host in a sandbox
C. When you know where the issue is and what systems have been affected,
you should contain those systems so that threats cannot spread through the
network. To do this, you disable network access for the affected computers and
devices, or you place them in a sandbox network. You also should change passwords so intruders no longer have access.
316
Network segmentation is an approach that divides a network into multiple
networks. Which of the following is a benefit of a segmented network?
a. Smaller broadcast domain
b. Fewer hosts per segment
c. Ability to apply granular policies
d. All of these answers are correct
D. Network segmentation is an architectural approach that divides a network
into multiple networks, subnets, or segments. It allows network administrators to control the flow of traffic between these networks based on a granular
policy.
317
Which system alerts for suspected phishing emails, endpoint attacks, failed
user logins, malware, and other threat information come from a variety of
detection sources, such as SIEMs, systems, switches, and logging services?
a. SOAR
b. Runbook
c. Playbook
d. Content filter
A. A SOAR system alerts for suspected phishing emails, endpoint attacks, failed
user logins, malware, and other threat information that come from a variety
of detection sources, such as SIEMs, systems, switches, and logging services.
IT operations use a SOAR runbook for reference for routine procedures that
administrators perform. A SOAR playbook provides manual orchestration of
incident response. Web content filtering is the practice of blocking access to
web content that may be deemed offensive or inappropriate, or even contain
dangerous items.
318
Which of the following is the first step when litigation has been filed or will
soon be filed, with a focus on saving data in its current state?
a. Data recovery
b. Data collection
c. Data destruction
d. Data preservation
D. Data preservation is the first step when litigation has been filed or will be
soon filed, with a focus on the preservation of data in its current state, such as
emails, SMS, MMS, and deleted messages (still on disk and not destroyed) on
all devices including cell phones, PCs, and mobile devices.
319
Which of the following is true regarding the correct format for forensic video
evidence?
a. Video settings should always match the video recorder; otherwise, the
playback will be corrupted.
b. Video formats and settings can vary.
c. Videos are typically recorded at the same FPS and resolution.
d. The frames per second (FPS) and resolution cannot be changed.
```
B. File formats can vary, as well as settings for recording video, such as frames
per second (FPS) and video resolution. These features can all factor into how
and what video information is stored.
```
320
Chain of custody in forensic investigations requires investigators to perform
which of the following?
a. Tag some evidence so that it can be chronologically stored in a locked
storage facility.
b. Clearly and accurately document the collection process, methods, and
path of evidence from collection to presentation
c. Store evidence in humidity-free lockers to ensure integrity and chain of
custody.
d. Take responsibility for all evidence collection after the site has been
turned over from the analyst
B. It has become imperative that evidence collection standards and procedures
are consistent, documented, and coherent in the chain of custody. Strict guidelines are to be followed, and accurate documentation must be kept.
321
Which of following describes the use of a tag in forensic investigations?
a. Tags provide a history identifying when items sold.
b. Tags can contain date/time and investigator initials to help determine
who collected items and when.
c. Tags allow forensic investigators to sell the items later after the
investigation has been completed.
d. Tags help investigators determine whether the evidence was collected
onsite or during the reverse-engineering process.
B. Evidence tagging helps identify collected items. A tag can consist of something as little as a sticker with the date, time, control number, and name or
initials of the investigator. Using a control number is an easy way to identify a
piece of evidence in documentation, such as a chain of custody. The combination of a tag and photographs can provide the exact location and condition in
which the item was collected.
322
When you are collecting evidence, the order of volatility requires you to do
what?
a. Start evidence collection with the most volatile data/information.
b. Start evidence collection after the volatile data has been removed from
the site.
c. Start with the least volatile evidence to make sure your evidence is intact
when received at the office.
d. Ensure that the most volatile data/information that is collected is
handled by the police only.
A. The collection of evidence should start with the most volatile item and end
with the least volatile. The order of volatility is the order in which the digital
evidence is collected.
323
Which artifacts can be collected during a forensic investigation of a suspected
workstation that will help or contribute to the validity of the investigation?
a. Data and evidence stored in appropriate containers
b. Art, photos, and images that contain facts about the attack and that can
be used to piece together a picture of what took place
c. Log files collected from previous years, log file configuration settings for
global policies, and SCCM data
d. All logs, the registry, the RDP cache, and Windows Error Reporting
(WER)
```
D. Forensic artifacts are objects that have forensic value. They are not behaviorally driven; they do not necessarily reflect the behavior or intent of a threat
actor or adversary. Some of the artifacts that can be extracted from suspect
hosts are logs, the registry, the browser history, the RDP cache, and Windows
Error Reporting (WER).
```
324
What volatile memory item contains more trusted information than disk, magnetic, or optical storage?
a. ROM
b. RAM
c. RTU
d. CPU
B. RAM is considered volatile memory. It is perceived to be more trusted than
nonvolatile memory, like ROM, disk, magnetic, or optical storage. Investigations using live forensic techniques require special handling because the volatile data in RAM can contain code used by attackers.
325
When dealing with a forensic investigation, you must take images of suspect
hard drives. Which of the following best describes the process to ensure a
hard drive hasn’t been tampered with after the collection/image has been
completed?
a. Checksums provide a thin piece of paper that acts as a seal over the
evidence to ensure no one opens that checked evidence.
b. Checksums provide checks and balances during an investigation to
ensure investigators are working from the most important data to the
least important.
c. Checksums provide a check and sum for each bit of data collected, and
when they are combined with a hash, you can track data.
d. Checksums of a newly imaged drive/data can be created, so if the device/
data is modified, the checksum will not match, letting you know it was
modified.
D. Checksums may also be called hashes. Small changes in a file produce different-looking checksums. You can use checksums to check files and other data
for errors that occur during transmission or storage, as well as for evidence in a
forensic investigation to ensure it hasn’t been tampered with
326
Which statement regarding on-premises and cloud-based systems is true?
a. Maintaining a chain of custody isn’t very challenging in a cloud
environment versus a traditional forensics environment.
b. On-premises and cloud-based are simply terms describing where data is
stored.
c. When a cyber incident happens, legal jurisdiction and the laws that
govern the region do not normally present unique challenges.
d. In traditional forensics environments, the external security team has
control over who is conducting forensics operations on a machine
B. Cloud-based and on-premises are simply terms that describe where systems
store data. Many of the same vulnerabilities that affect on-premises systems
also affect cloud-based systems.
327
```
What happens when digital evidence is not properly preserved and collected in
accordance with forensic best practices?
a. It becomes volatile.
b. It is known as nonprovenant.
c. It becomes an artifact.
d. It is not admissible in court.
```
D. A copy of digital evidence must be properly preserved and collected in
accordance with forensic best practices. Otherwise, the digital evidence may be
inadmissible in court, or spoliation sanctions may be imposed.
328
```
What should organizations have to perform to preserve information during
e-discovery?
a. Legal hold process
b. Nonrepudiation
c. Order of nonvolatility
d. Counterintelligence
```
A. Organizations should have a legal hold process to perform e-discovery to
preserve and gather such information.
329
Which of the following is the extraction of data from damaged, deleted, or
purposely destroyed evidence sources in a forensically sound manner?
a. E-discovery
b. Admissibility
c. Data recovery
d. Strategic intelligence
C. Forensic data recovery is the extraction of data from damaged, deleted, or
purposely destroyed evidence sources in a forensically sound manner. This
method of recovering data means that any evidence resulting from it can later
be relied on in a court of law.
330
Which term best defines the assurance that someone cannot deny the validity
of something—where a statement’s author cannot dispute its authorship?
a. Snapshots
b. Timestamps
c. Checksums
d. Nonrepudiation
D. Nonrepudiation makes it difficult to successfully deny who and where
a message came from as well as the authenticity and integrity of that message. Digital signatures can offer nonrepudiation when it comes to online
transactions.
331
Which of the following is information gathered and activities conducted to
protect against espionage, other intelligence activities, or sabotage conducted
by or on behalf of other elements?
a. Counterintelligence
b. Strategic intelligence
c. Artificial intelligence
d. Intellectual property (IP) intelligence
A. Counterintelligence is information gathered and activities conducted to
protect against espionage, other intelligence activities, or sabotage conducted
by or on behalf of other elements. The intelligence is designed to quickly direct
resources to the most significant problems first and address them head on.
332
Which controls are typically addressed by an organization’s management?
a. Managerial controls
b. Physical controls
c. Operational controls
d. None of these answers are correct.
A. Managerial controls are techniques and concerns addressed by an organization’s management (managers and executives). Generally, these controls
focus on decisions and the management of risk. They also concentrate on
procedures, legal and regulatory policies, the software development lifecycle
(SDLC), the computer security lifecycle, information assurance, and vulnerability management/scanning. In short, these controls focus on how the security
of your data and systems is managed.
333
Which controls are designed to increase individual and group system security?
a. Physical controls
b. Operational controls
c. Corrective controls
d. All of these answers are correct
B. Operational controls are the controls executed by people. They are
designed to increase individual and group system security. They include user
awareness and training, fault tolerance and disaster recovery plans, incident
handling, computer support, baseline configuration development, and environmental security. The people who carry out the specific requirements of these
controls must have technical expertise and understand how to implement what
management desires of them
334
Which controls include auditing and cryptography?
a. Technical controls
b. Operational controls
c. Managerial controls
d. None of these answers are correct.
A. Technical controls are the logical controls executed by the computer system.
Technical controls include authentication, access control, auditing, and cryptography. The configuration and workings of firewalls, session locks, RADIUS
servers, or RAID 5 arrays would be within this category, as well as concepts
such as least privilege implementation.
335
```
Which controls are employed before an event and are designed to prevent an
incident?
a. Managerial controls
b. Compensating controls
c. Corrective controls
d. Preventative controls
```
D. Preventative controls are employed before an event and are designed to
prevent an incident. Examples include biometric systems designed to keep
unauthorized persons out, network intrusion prevention systems (NIPSs) to
prevent malicious activity, and RAID 1 to prevent loss of data. They are also
sometimes referred to as deterrent controls. Preventative controls enforce security policy and should prevent incidents from happening. The only way to
bypass a preventative control is to find a flaw in its implementation or logic.
These controls are usually not optional. Examples of preventative controls are
access lists, passwords, and fences
336
```
For which of these controls is the primary aim monitoring and detecting any
unauthorized behavior?
a. Corrective controls
b. Managerial controls
c. Physical controls
d. Detective controls
```
D. Detective controls aim at monitoring and detecting any unauthorized
behavior or hazard. These types of controls are generally used to alert of a
failure in other types of controls such as preventative, deterrent, and compensating controls. Detective controls are very powerful while an attack is taking
place, and they are useful in the post-mortem analysis to understand what
has happened. Audit logs, intrusion detection systems, motion detection, and
Security Information and Event Management (SIEM) systems are examples of
detective controls.
337
Which of the following controls are used after an event?
a. Physical controls
b. Corrective controls
c. Preventative controls
d. None of these answers are correct.
B. Corrective controls are used after an event. They limit the extent of damage
and help the company recover from damage quickly. Tape backup, hot sites,
and other fault tolerance and disaster recovery methods are also included here.
They are sometimes referred to as compensating controls. Corrective controls include all the controls used during an incident to correct the problem.
Quarantining an infected computer, sending a guard to block an intruder, and
terminating an employee for not having followed the security policy are all
examples of corrective controls.
338
Which of the following are also known as alternative controls?
a. Physical controls
b. Compensating controls
c. Detective controls
d. None of these answers are correct
B. Compensating controls, also known as alternative controls, are mechanisms
put in place to satisfy security requirements that are either impractical or too
difficult to implement. For example, instead of using expensive hardwarebased encryption modules, an organization might opt to use network access
control (NAC), data loss prevention (DLP), and other security methods. Or,
on the personnel side, instead of implementing separation of duties, an organization might opt to do additional logging and auditing. You should approach
compensating controls with great caution. They do not give the same level of
security as their replaced counterparts.
339
Which regulation was established in the European Union?
a. GDPR
b. SOX
c. GLB
d. None of these answers are correct
A. The General Data Protection Regulation is a European Union (EU) law
that was enacted in 2018. Its overall focus is on data protection and privacy
for individuals. Although it is a law enacted in the EU, it applies to any organization collecting information about people in the EU. This means that if
your organization collects and handles the personal data of EU citizens, then
this regulation applies to you. For instance, if you run a business that offers
goods or services in the EU and that business requires you to collect information about your customers, then you would be required to follow the GDPR
requirements. Not following them could result in large fines. This is one of the
factors that makes GDPR a larger concern to organizations than many other
laws that have been in place for many years. GDPR penalties can be very high.
For additional information on GDPR, refer to https://gdpr.eu/.
340
which act governs the disclosure of financial and accounting information?
a. GLB
b. SOX
c. HIPAA
d. All of these answers are correct.
B. The Sarbanes–Oxley Act (SOX), enacted in 2002, governs the disclosure of
financial and accounting information.
341
Which act governs the disclosure and protection of health information?
a. HIPAA
b. GLB
c. SOX
d. None of these answers are correct.
A. The Health Insurance Portability and Accountability Act (HIPAA), enacted
in 1996, governs the disclosure and protection of health information.
342
Which of the following is a nonprofit organization established in 2000 to provide security best practice guidance for enhancing the security of cyberspace?
a. Cloud Security Alliance
b. International Organization for Standardization
c. National Institute of Standards and Technology
d. Center for Internet Security
D. The Center for Internet Security (CIS) is a nonprofit organization that was
established in 2000. Its overall goal is to provide security best practice guidance for enhancing the security of cyberspace.
343
Which of the following developed the Risk Management Framework in 2017?
a. Cloud Security Alliance
b. International Organization for Standardization
c. National Institute of Standards and Technology
d. Center for Internet Security
C. The National Institute of Standards and Technology (NIST) developed the
Risk Management Framework (RMF) in 2017 as a result of an executive order
from the president, which required all federal agencies to comply with it. For
mor information about the NIST RMF, visit www.nist.gov/cyberframework/
risk-management-framework.
344
Which of the following developed the Cybersecurity Framework in 2014?
a. Cloud Security Alliance
b. International Organization for Standardization
c. National Institute of Standards and Technology
d. Center for Internet Security
C. The National Institute of Standards and Technology (NIST) developed the
Cybersecurity Framework (CSF) in 2014 as a result of executive order 13636
from the president. The NIST CSF is made of five core functions: Identify,
Protect, Detect, Respond, and Recover. For more information about the NIST
CSF, visit www.nist.gov/cyberframework.
345
Which of the following is a nonprofit organization established in 2008
with the goal of promoting security best practices in cloud computing
environments?
a. Cloud Security Alliance
b. International Organization for Standardization
c. National Institute of Standards and Technology
d. Center for Internet Security
A. The Cloud Security Alliance (CSA) is a nonprofit organization established
in 2008 with the goal of promoting security best practices in cloud computing environments. The Cloud Controls Matrix is a framework established by
the CSA for cloud computing. This organization also developed the reference architecture to help cloud providers with guidance on developing secure
interoperability best practices. For more information related to CSA, visit
https://cloudsecurityalliance.org/.
346
```
Which of the following was created to provide a standardized solution for
security automation?
a. SOX
b. GLB
c. SCAP
d. OVA
```
C. Security Content Automation Protocol (SCAP) was created to provide
a standardized solution for security automation. The SCAP mission is to
maintain system security by ensuring security configuration best practices are
implemented in the enterprise network, verifying the presence of patches, and
maintaining complete visibility of the security posture of systems and the organization at all times.
347
```
In which types of organizational policies would you find information on
handling of personal information?
a. Privacy policies
b. Public policies
c. Wireless policies
d. None of these answers are correct.
```
A. The Privacy Act of 1974 sets many standards when it comes to the security
of personally identifiable information (PII). However, most organizations
will go further and define their own privacy policy, which explains how users’
identities and other similar information will be secured. For example, if an
organization has an Internet-based application that internal and external users
access, the application will probably retain some of their information—possibly details of their identity. Not only should this information be secured,
but the privacy policy should state in clear terms what data is allowed to be
accessed, and by whom, as well as how the data will be retained and distributed
(if at all). An organization might also enact a policy that governs the labeling
of data to ensure that all employees understand what data they are handling
and to prevent the mishandling of confidential information. Before any system
administrators or other personnel gather information about these users, they
should consult the privacy policy.
348
```
Which type of policy would define rules that restrict how a computer may be
used?
a. Privacy policy
b. Acceptable use policy
c. Credential policy
d. All of these answers are correct.
```
B. Acceptable use policies (AUPs) define the rules that restrict how a computer, network, or other system may be used. They state what users are and are
not allowed to do when it comes to the technology infrastructure of an organization. Often, employees must sign an AUP before they begin working on any
systems. This policy protects the organization but also defines to employees
exactly what they should and should not be working on.
349
```
Which of the following describes when more than one person is required to
complete a particular task or operation?
a. Separation of duties
b. Acceptable use
c. Mandatory vacation
d. Job rotation
```
A. Separation of duties defines when more than one person is required to
complete a particular task or operation. This distributes control over a system,
infrastructure, or particular task.
350
```
Which concept includes ensuring that IT infrastructure risks are known and
managed?
a. Separation of duties
b. Job rotation
c. Offboarding
d. Due diligence
```
D. When it comes to information security, due diligence means ensuring that
IT infrastructure risks are known and managed. An organization needs to
spend time assessing risk and vulnerabilities and might state in a policy how it
will give due diligence to certain areas of its infrastructure.
351
_______ is the mitigation action that an organization takes to defend against
the risks that have been uncovered during due diligence.
a. Acceptable use
b. Separation of duties
c. Due process
d. Due care
D. Due care is the mitigation action that an organization takes to defend
against the risks that have been uncovered during due diligence.
352
```
Which of the following is the principle that an organization must respect to
safeguard personnel’s rights?
a. Clean desk space
b. Due process
c. Least privilege
d. User training
```
B. Due process is the principle that an organization must respect and safeguard
personnel’s rights. The purpose is to protect the employee from the state and
from frivolous lawsuits.
353
```
Which of the following is information used to uniquely identify, contact, or
locate a person?
a. PII
b. EOL
c. EOSL
d. CBT
```
A. All employees should be trained on personally identifiable information
(PII). This information is used to uniquely identify, contact, or locate a person.
This type of information could be a name, birthday, Social Security number,
biometric information, and so on. Employees should know what identifies
them to the organization and how to keep that information secret and safe
from outsiders. Another key element of user education is the dissemination of
the password policy. Employees should understand that passwords need to be
complex and know the complexity requirements. They should also understand
that they should never give out their password or ask for another person’s password to any resource.
354
Which of the following is a letter of intent, in regard to a BPA?
a. Interconnection security agreement (ISA)
b. Business partnership agreement (BPA)
c. Memorandum of understanding (MOU)
d. None of these answers are correct.
C. A memorandum of understanding (MOU) is not an agreement at all, but
an understanding between two organizations or government agencies. It does
not specify any security controls either. However, a memorandum of agreement
(MOA) does constitute a legal agreement between two parties wishing to work
together on a project but still does not detail any security controls.
355
Which type of contract can establish the profits each partner will get?
a. Interconnection security agreement (ISA)
b. Business partnership agreement (BPA)
c. Memorandum of understanding (MOU)
d. None of these answers are correct.
B. A business partnership agreement (BPA) is a type of contract that can establish the profits each partner will get, what responsibilities each partner will have, and exit strategies for partners. Often this type of agreement applies to
supply chain and business partners.
356
```
Which classification is typically used in government and represents the highest
sensitivity of data?
a. Confidential
b. Top secret
c. Secret
d. None of these answers are correct.
```
B. Top secret means the highest sensitivity of data; few people should have
access, and security clearance may be necessary. Information is broken into
sections on a need-to-know basis.
357
```
Which type of account is not tied to a specific user but would be critical for a
web server to run?
a. User
b. Service
c. Computer
d. None of these answers are correct.
```
B. When you’re discussing policies for systems internal to your organization
or devices that are owned by your organization, such as servers and laptops, it
is also important to detail policies regarding how they should be deployed. For
instance, service accounts should follow a specific credential policy. Often service accounts have higher-level permissions to enable the specific service. That
means these accounts can cause more damage if they are compromised. They
should always be configured using the least privilege approach. There should
also be a service account for each service.
358
```
Which is a structured way of changing the state of a computer system,
network, or IT procedure?
a. Asset management
b. Change management
c. Policy management
d. None of these answers are correct.
```
B. Change management is a structured way of changing the state of a computer system, network, or IT procedure. The idea behind this is that change
is necessary, but that an organization should adapt with change and be knowledgeable of it. Any change that a person wants to make must be introduced
to the heads of each department that it might affect. They must approve the
change before it goes into effect. Before this happens, department managers
will most likely make recommendations and/or give stipulations. When the
necessary people have signed off on the change, it should be tested and then
implemented. During implementation, it should be monitored and documented carefully.
359
```
What type of risk would a nation state threat actor be considered to a private
corporation?
a. External
b. Internal
c. Multilateral
d. None of these answers are correct.
```
A. Risks to your organization or environment can come in many shapes and
forms. The primary concern of most organizations is external risk. This is,
of course, the biggest concern to most because it is risk that comes from an
external entity who could have many different motivations and therefore
targets the inside of your organization. Many imagine an external “hacker”
as someone sitting in a basement hammering away at the keyboard in front
of 10 different monitors in a black hoodie. That, of course, is usually not the
case. External risk most likely is from an organized threat actor or an organization of threat actors who have various motivations. To carry out their
attacks, they will use many different methods. The primary goal of external
attackers is to gain access to your organization’s computing environment,
gain a foothold, and keep it as long as possible to carry out their objectives,
whatever they may be.
360
Your organization has just hired a new employee. However, the employee
is really a spy looking to steal your intellectual property. Which type of risk
would this be considered?
a. External
b. Internal
c. Multivendor
d. All of these answers are correct
B. Many organizations tend to overlook internal risks. The majority of internal risk stems from employees or those internal to the organization such as
contractors. While the motivation of external cybercriminals may be to gain
and keep access, the internal threat actor already has access to the organization’s environment. This person’s motivations are usually different from those
of external threat actors—although the goal may be the same in the end. Most
internal attacks result in the exfiltration or destruction of sensitive data that
belongs to the organization. The theft of intellectual property (IP) is a primary
goal of internal and external threat actors.
361
Which of the following is defined as the identification, assessment, and
prioritization of risks, and the mitigating and monitoring of those risks?
a. Risk management
b. Risk mitigation
c. Risk tolerance
d. None of these answers are correct.
A. Risk management can be defined as the identification, assessment, and prioritization of risks, and the mitigating and monitoring of those risks. Specifically, when we talk about computer hardware and software, risk management
is also known as information assurance (IA). The two common models of IA
include the well-known CIA, and the DoD’s “Five Pillars of IA,” which comprise the concepts of the CIA triad (confidentiality, integrity, and availability)
but also include authentication and nonrepudiation.
362
```
Which of the following usually entails not carrying out a proposed plan
because the risk factor is too great?
a. Risk transference
b. Risk assessment
c. Risk mitigation
d. Risk avoidance
```
D. Some organizations opt to avoid risk. Risk avoidance usually entails not carrying out a proposed plan because the risk factor is too great. An example of
risk avoidance: If a high-profile organization decided not to implement a new
and controversial website based on its belief that too many attackers would
attempt to exploit it.
363
Which of the following is an example of risk transference?
a. Risk appetite
b. Risk avoidance
c. Cybersecurity insurance
d. All of these answers are correct.
C. An example of risk transference (also known as risk sharing) would be an
organization that purchases cybersecurity insurance for a group of servers in
a data center. The organization still takes on the risk of losing data in the case
of server failure, theft, and disaster, but transfers the risk of losing the money
those servers are worth in case they are lost.
364
Which of the following is the attempt to determine the number of threats or
hazards that could possibly occur in a given amount of time to your computers
and networks?
a. Risk avoidance
b. Risk assessment
c. Risk mitigation
d. Risk acceptance
B. Risk assessment is the attempt to determine the number of threats or hazards that could possibly occur in a given amount of time to your computers
and networks.
365
_____________ risk assessment is an assessment that assigns numeric values to
the probability of a risk and the impact it can have on the system or network.
a. Quantitative
b. Qualitative
c. Measured
d. None of these answers are correct.
B. Qualitative risk assessment is an assessment that assigns numeric values to
the probability of a risk and the impact it can have on the system or network.
366
_______________ is the total reduction or elimination of a risk.
a. Risk assessment
b. Risk transference
c. Risk mitigation
d. Risk acceptance
C. NIST defines risk mitigation as “prioritizing, evaluating, and implementing
the appropriate risk-reducing controls/countermeasures recommended from
the risk management process.”
367
```
Which type of disaster can be defined as being caused by the influence of
humans?
a. Person-made
b. Environmental
c. Weather-made
d. None of these answers are correct.
```
A. Person-made disasters can be defined as being caused by the influence of
humans.
368
```
___________ defines the average number of failures per million hours of
operation for a product in question.
a. Mean time between failures (MTBF)
b. Mean time to repair (MTTR)
c. Mean time between recovery (MTBR)
d. None of these answers are correct
```
A. Mean time between failures (MTBF) defines the average number of failures
per million hours of operation for a product in question.
369
___________ is the measured period of time between failures of a system.
a. Mean time between failures (MTBF)
b. Mean time to failure (MTTF)
c. Mean time between recovery (MTBR)
d. None of these answers are correct.
A. Although it’s impossible to predict the future accurately, it can be quantified on an average basis using concepts such as mean time between failures
(MTBF).
370
What term is used to describe the crown jewels of an organization?
a. Intellectual property
b. Important data
c. Sensitive data
d. None of these answers are correct.
A. Regardless of what industry you are responsible for protecting, the ultimate
goal is to protect your intellectual property. This is, of course, the crown jewels
and can be in many different forms. For a company that develops software, the
crown jewels are the source code of the product it is selling. Even a company
that produces food products has intellectual property that it is trying to protect, such as a secret recipe
371
Which organization requires that any publicly traded company provide a
public notification and disclosure of a data breach?
a. FBI
b. SEC
c. CIA
d. All of these answers are correct.
B. The US Securities and Exchange Commission (SEC) requires that any
publicly traded company provide a public notification and disclosure of a data
breach.
372
```
Which type of data classification would cause grave damage to national
security?
a. Top secret
b. Confidential
c. Unclassified
d. None of these answers are correct.
```
A. Unauthorized access to top secret information would cause grave damage to
national security.
373
Which type of data classification would cause no damage to national security?
a. Secret
b. Confidential
c. Top secret
d. Unclassified
D. Unauthorized access to unclassified information would cause no damage to
national security
374
```
Unauthorized access to this type of data could cause severe damage to an
organization?
a. Nonsensitive
b. Sensitive
c. Public
d. Private
```
D. Unauthorized access to private information could cause severe damage to
the organization. Examples of information or assets that could receive this type
of classification are human resources (HR) information (for example, employee
salaries) and medical records.
375
What information can be used to distinguish or trace an individual’s identity?
a. PHI
b. PII
c. HIPAA
d. None of these answers are correct.
B. According to the Executive Office of the President, Office of Management
and Budget (OMB) and the U.S. Department of Commerce, Office of the
Chief Information Officer, personally identifiable information, or PII, refers to
“information which can be used to distinguish or trace an individual’s identity.”
376
________ is a term used to explain the concept of reducing the amount of
personal information consumed by online entities.
a. Data masking
b. Data minimization
c. Data usage
d. Data processing
B. Data minimization is a term used to explain a concept or approach to privacy design. The overall concept of data minimization is simply to minimize
the amount of your personal information that is consumed by online entities.
Data minimization is a privacy tool that is used in many different ways. For
instance, a website may choose to not store your personal information if it is
not needed—as opposed to many that store it and even resell it for a profit.
Additionally, it can be used to develop policies regarding the amount of time
the data that is collected about you is actually maintained before being permanently deleted. Individuals can also use tools that will clear information from
applications such as web browsers. As you know, web browsers collect a large
amount of data, which could in turn be compromised. Minimizing this data
reduces the risk of such a compromise.
377
Which of the following is used to obfuscate sensitive data?
a. Data minimization
b. Data processing
c. Data masking
d. Data control
C. Another privacy enhancing technology concept is data masking. The goal
of data masking is to protect or obfuscate sensitive data. This goal must be
achieved while not rendering the data unusable in any way. An example of data
masking being used in a real-world environment would be data that is displayed on terminal screens in banks or doctors’ offices. Social Security numbers can be masked to show only the last four digits so that they can be used
for verification purposes while not exposing the full Social Security number.
378
```
Which role is usually part of the management team and maintains ownership
of a subset of data?
a. Data custodian
b. Data owner
c. Data processor
d. All of these answers are correct.
```
B. The data owner, also called the information owner, is usually part of the
management team and maintains ownership of and responsibility over a
specific piece or subset of data. Part of the responsibility of this role is to
determine the appropriate classification of the information, ensure that the
information is protected with controls, to periodically review classification and
access rights, and to understand the risk associated with the information.
379
During which phase of the information lifecycle is data obtained?
a. Disposal
b. Storage
c. Usage
d. Collection
D. The General Data Protection Regulation (GDPR) in the European Union
(EU) defines the information lifecycle in four different phases. It is sometimes
named differently based on the source; however, the phases themselves are still
the same. Starting with the collection of data, this is obviously the phase where
the data is consumed by the data processor. GDPR states that when collecting data there must be a defined consent from the data owner as well as a clear
definition of how the data will be used. The overall intent is to follow the principle of collecting only data that is necessary and not overcollecting.
380
```
Which process that is required by GDPR involves identifying the risk of data
compromise to an individual?
a. Impact assessment
b. Data control
c. Terms of agreement
d. All of these answers are correct.
```
A. Before data is collected, stored, secured, and disposed of throughout the
information lifecycle, it is important to understand how that data, if compromised, could impact the privacy of the individuals whose data it holds. To
accomplish this, an organization should complete an impact assessment on any
new projects that are to be instated where data will be collected as well as any
time the scope of the data use will change. These impact assessments are also
sometimes called Privacy Impact Assessments (PIAs) or Data Privacy Impact
Assessments (DPIAs). The result of an impact assessment should produce
some kind of report that will identify specific high risks to the data subjects
and provide recommendations on how that risk can be minimized. A PIA or
DPIA is also something that is required in the GDPR.
381
```
Which concept adopted and required by GDPR helps protect the personal
information of an individual?
a. Data classification
b. Data inspection
c. Data collection
d. Terms of agreement
```
D. Another privacy concept that has been adopted by the General Data Protection Regulation (GDPR) in the European Union (EU) is the terms of
agreement. In many cases, this is called the data processing agreement. The
overall purpose of the data processing agreement is to protect the personal
information and the individuals the data is about. The agreement is actually a
legal contract that is agreed upon by any entities that will fit the role of data
processor in the information lifecycle. This is one of the basic requirements of
GDPR and will lead to fines if not followed by an organization collecting data.
382
```
Which document must be provided to individuals defining how their data will
be used?
a. GDPR
b. Data collection
c. Terms of agreement
d. Privacy notice
```
D. Along with the agreement of how data will be collected, utilized, and processed by an organization, the organization must also provide notification to
the individuals it is collecting data from or about. Again, this is a requirement
for the General Data Protection Regulation (GDPR) in the European Union
(EU). GDPR ensures that individuals are notified about how their data is
being used. This is done via a privacy notice. The notice itself is a document
sent from the collecting organization stating how it is conforming to data
privacy principles.
