Exam 1 Flashcards
(100 cards)
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
What are the three main goals of information security? (Select the three best answers.) A. Auditing B. Integrity C. Nonrepudiation D. Confidentiality E. Risk assessment F. Availability
Answers: B, D, and F. Confidentiality, Integrity, and Availability
Explanation: Confidentiality, Integrity, and Availability (known as CIA or the CIA triad) are the three main goals of information security. Another goal within information security is Accountability. See the section titled “Security 101” in Chapter 1, “Introduction to Security,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Which of the following describes an application that accepts more input than it was originally expecting? A. Buffer overflow B. Denial of service (DoS) C. Sandbox D. Brute force
Answer: A. Buffer overflow
Explanation: Buffer overflows occur when an application or an operating system accepts more input than it expects. This could cause a radical behavior in applications especially if the affected memory already has other data in it. A denial of service is a network attack perpetuated on servers to stop them from performing their proper functions for users. Sandbox is when a web script runs in its own environment so that it won’t interfere with other processes; this is often used in testing environments. Brute force is a type of password cracking attack. See the section titled “Securing Other Applications” in Chapter 4, “Application Security,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
A security assessment of an existing application has never been made. Which of the following is the best assessment technique to use to identify an application’s security posture? A. Functional testing B. Threat modeling C. Baseline reporting D. Protocol analysis
Answer: C. Baseline reporting
Explanation: Baseline reporting is the best answer for identifying the application’s security posture. A Security Posture Assessment (SPA) is used to find out the baseline security of an application, a system, or a network, as long as the application (or system or network) already exists. By checking past results and comparing them with current (and future) results, a security professional can see whether an application is secure, or has a “secure posture.” Some applications come with built-in baseline reporting tools, which allow you to tell whether a system is compliant and secure. The other three answers don’t (by definition) associate with the “security posture” of an application. Functional testing is a method of verifying a program by inputting information to the program and analyzing the output. Threat modeling defines a set of possible attacks that could exploit a vulnerability. Protocol analysis deals with examining packet streams with a sniffer or protocol analyzer. See the section titled “Using Tools to Monitor Systems and Networks” in Chapter 11, “Monitoring and Auditing,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Why would a system administrator have both a user-level account and an administrator-level account?
A. To prevent privilege escalation
B. To prevent admin account lockout
C. To prevent password sharing
D. To prevent loss of access through implicit deny
Answer: A. To prevent privilege escalation
Explanation: Some organizations that use UAC might employ a policy where all administrators are expected to log on as their standard user account. With UAC enabled, the “administrator” will not be able to accomplish administrative tasks unless he types in his administrator-level account username and password at the UAC prompt. It’s really UAC that is used to prevent privilege escalation for all users. See the section titled “Securing Wired Networks and Devices” in Chapter 7, “Securing Network Media and Devices,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
What is the best reason why security researchers use virtual machines?
A. To offer a secure virtual environment where they can conduct online deployments
B. To offer an environment where they can discuss security research
C. To offer an environment where network applications can be tested
D. To offer an environment where malware might be executed but with minimal risk to equipment
Answer: D. To offer an environment where malware might be executed but with minimal risk to equipment.
Explanation: The best reason why security researchers use virtual machines is to offer an environment where malware might be executed but with minimal risk to the equipment. This is because the virtual machine is isolated from the actual operating system, and the virtual machine can simply be deleted if it is affected by viruses or other types of malware. Although the other answers are possible reasons why a security researcher would use a virtual machine, the best answer is that it offers the isolated environment where a malicious activity can occur but be easily controlled and monitored. See the section titled “Virtualization Technology” in Chapter 3, “OS Hardening and Virtualization,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
You need to monitor network devices on your network. Which of the following protocols will best help you complete this task? A. ICMP B. SNMP C. SMTP D. NetBIOS
Answer: B. SNMP
Explanation: The Simple Network Management Protocol (SNMP) is meant to be used within network monitoring programs, which are used to monitor the parameters of devices on your network. ICMP stands for Internet Control Message Protocol, which among other things is an integral part of the ping command. SMTP stands for Simple Mail Transfer Protocol, which is used to send mail. NetBIOS stands for Network Basic Input/Output System and provides name services. See the section titled “Using Tools to Monitor Systems and Networks” in Chapter 11, “Monitoring and Auditing,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
You are configuring an 802.11n wireless network. You need to have the best combination of encryption and authorization. Which of the following options should you select? A. WPA2-PSK B. WEP and 802.1x C. WPA-Enterprise D. WPA and TKIP
Answer: C. WPA-Enterprise
Explanation: WPA-Enterprise offers a decent level of encryption (WPA) as well as a powerful means of authorization (Enterprise). Enterprise usually means you are using a separate RADIUS server or something similar to handle the authorization side of things and are not relying on the wireless device itself. While WPA2-PSK offers a better level of encryption, it does not offer authorization the way an enterprise configuration does. WEP and 802.1x does offer a form of authorization, but WEP is deprecated and is not recommended in any scenario. WPA and TKIP offers the same level of encryption as WPA-Enterprise but does not offer authorization. See the section titled “Securing Wireless Networks and Devices” in Chapter 7, “Securing Network Media and Devices,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Tim needs to collect data from users that utilize an Internet-based application. Which of the following should he reference before doing so? A. Secure code review B. SOX C. Acceptable use policy D. Privacy policy
Answer: D. Privacy policy
Explanation: Tim should refer to his organization’s privacy policy before collecting any data from users of the Internet-based application. This policy will dictate whether he is allowed to collect the information he requires. Secure code reviews check for incorrect and possibly risky coding techniques in applications. SOX stands for Sarbanes-Oxley Act, which sets standards for management and public accounting organizations. Acceptable use policies (AUP) state how a network or system may be used. See the section titled “Legislative and Organizational Policies” in Chapter 15, “Policies, Procedures, and People,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
You have been asked to set up a web server that will service regular HTTP requests as well as HTTP secure requests. Which of the following ports would you use by default? (Select the two best answers.) A. 21 B. 25 C. 80 D. 135 E. 443 F. 445
Answers: C. 80 and E. 443
Explanation: The default port for HTTP requests is port 80. The default port for HTTP Secure (HTTPS) requests is port 443. Port 21 is FTP. Port 25 is SMTP. Port 135 is known as the DCE endpoint manager port or RPC (Remote Procedure Call); it is a DCOM related port that is used to remotely manage services and is generally considered insecure. Port 445 is the Server Message Block (SMB) port that deals with Microsoft directory services. See the section titled “Ports and Protocols” in Chapter 5, “Network Design Elements and Network Threats,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Sandy is comparing six different computers on a network. She wants to know which of the systems is more susceptible to attack. Which is the best tool for her to use? A. Vulnerability scanner B. Port scanner C. Ping scanner D. Baseline reporting
Answer: A. Vulnerability scanner
Explanation: The vulnerability scanner will be able to scan for various vulnerabilities on multiple computers. A port scanner would be the next choice but will only tell Sandy which ports are open, not what vulnerabilities the computers have, and by default it will only work with one computer at a time (although this is configurable). Ping scanners can find out what computers exist on the network but won’t display any vulnerabilities. Baseline reporting is used to compare a system’s current configuration to an older configuration to find out its security posture. See the section titled “Assessing Vulnerability with Security Tools” in Chapter 10, “Vulnerability and Risk Assessment,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Which of the following reduces the chances of a single point of failure on a server when it fails? A. Virtualization B. Clustering C. RAID D. Cold site
Answer: B. Clustering
Explanation: Clustering enables a technician to use two or more servers together. In a failover cluster, a failure on the working server will cause that server to be disabled, but the next server in the cluster will then become active; so most single points of failure can be overcome. Virtualization of a server creates an entirely new server in a virtual machine, but it will have the same possibility of a single point of failure as a physical server. RAID (Redundant Array of Inexpensive Disks) reduces the chances of a server’s single point of failure by allowing for fault tolerant disks—but only for disks, and only certain kinds of RAID. If any other points on the server fail, RAID will not be able to recover. A cold site does not have servers ready to go in the case there is a single point of failure on a particular server. However, hot sites could usually recover from these types of issues, though the users might have to physically go to the building depending on the configuration. See the section titled “Redundancy Planning” in Chapter 14, “Redundancy and Disaster Recovery,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Which of the following statements is true about a certificate revocation list (CRL)? A. It should be kept secret. B. It must be encrypted. C. It should be kept public. D. It should be used to sign other keys.
Answer: C. It should be kept public.
Explanation: Certificate revocation lists (CRLs) should be published regularly so that users know whether an issuer’s certificate is valid. If the CRL was secret, it would defy its purpose. The CRL is not usually encrypted but will be digitally signed by the certificate authority (CA). The CRL does not sign any keys; instead the CA takes care of this. See the section titled “Public Key Infrastructure” in Chapter 13, “PKI and Encryption Protocols,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
HIDS and NIDS are similar intrusion detection systems. However, one is for individual computers, and the other is for networks. Which of the following would a HIDS be installed to monitor? A. System files B. CPU performance C. Network adapter performance D. Temporary Internet files
Answer: A. System files
Explanation: HIDS, or host-based intrusion detection system, is software installed to an individual computer to monitor important files and watch for intrusions. System files are some of the most important files that will be monitored by a HIDS. Temporary Internet files are not nearly as important and are usually removed automatically by way of a policy in many organizations. CPU and network adapter performance is usually monitored by some type of performance monitoring program; these are often built into the operating system. See the section titled “Implementing Security Applications” in Chapter 2, “Computer Systems Security,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Thumb drives can be used to compromise systems and enable unauthorized access. What kind of malware was most likely installed to the thumb drive? A. Bot B. Logic bomb C. Virus D. Trojan
Answer: D. Trojan
Explanation: Trojans are used to access a system without authorization. They can be installed to USB flash drives, can be remote access programs, or could be unwittingly stumbled upon when accessing disreputable websites. The key phrase here is “unauthorized access”; that is what the Trojan is trying to do. A bot is a computer that performs actions without the user’s consent and is often controlled by a remote master computer. Though the bot doesn’t enable unauthorized access, a Trojan might carry a bot program as part of its payload. Logic bombs are generally a method of transferring malware and are meant to initiate a malicious function at a specific time. Viruses infect a computer but are not used for unauthorized access. See the section titled “Computer Systems Security Threats” in Chapter 2, “Computer Systems Security,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
You are the systems administrator for your organization. You have been tasked to block database ports at the firewall. Which port should you block? A. 3389 B. 1433 C. 443 D. 53
Answer: B. 1433
Explanation: Port 1433 is used by Microsoft SQL Server databases and should be blocked at the firewall if you want to block SQL Server activity. Port 3389 is used by the Remote Desktop Protocol. Port 443 is used by HTTPS. Port 53 is used by DNS. See the section titled “Ports and Protocols” in Chapter 5, “Network Design Elements and Network Threats,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Your boss speculates that an employee in a sensitive position is committing fraud. What is the best way to identify if this is true? A. Mandatory vacations B. Separation of duties C. Due diligence D. Acceptable usage policy
Answer: A. Mandatory vacations
Explanation: Mandatory vacations should be implemented to help detect (and possibly stop) fraud, sabotage, or other malicious activity on the part of a person working in a sensitive position in an organization. Separation of duties (and job rotation) are employed when more than one person is utilized to complete a task. While this might be a way to identify fraud, it does not take into account the possibility that one user is still committing fraud without the other user(s) noticing. It also doesn’t take into account the chance that all users involved in the job rotation system could be committing fraud together. Mandatory vacations are a better method of detecting ongoing fraud. Due diligence ensures that IT risks are known and managed. Acceptable usage policies define the rules that restrict how a system may be used. See the section titled “Legislative and Organizational Policies” in Chapter 15, “Policies, Procedures, and People,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Your organization’s network has a main office and two remote sites that connect back to the main office solely. You have been tasked with blocking TELNET access into the entire network. Which would be the best way to go about this?
A. Block port 25 on the main office’s firewall
B. Block port 25 on each of the L2 switches at the remote sites
C. Block port 23 on each of the L2 switches at the remote sites
D. Block port 23 on the main office’s firewall
Answer: D. Block port 23 on the main office’s firewall
Explanation: You should block port 23 on the main office’s firewall because by default TELNET uses port 23. Port 25 is used by SMTP. By blocking port 23 on the main office’s firewall you will by default be blocking it for the entire network in the scenario. L2 (layer 2) switches deal with MAC addresses and other principles of the Data Link Layer of the OSI Model. They do not usually have the option to block particular TCP/IP ports. See the section titled “Ports and Protocols” in Chapter 5, “Network Design Elements and Network Threats,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Tom is getting reports from several users that they are unable to download specific items from particular websites although they can access other pages of those websites. Also, they can download information from other websites just fine. Tom’s IDS is also sending him alarms about possible malicious traffic on the network. What is the most likely cause why the users cannot download the information they want?
A. The firewall is blocking web activity.
B. The NIDS is blocking web activity from those specific websites.
C. The NIPS is blocking web activity from those specific websites.
D. The router is blocking web activity.
Answer: C. The NIPS is blocking web activity from those specific websites.
Explanation: The most likely answer is that the network intrusion prevention system (NIPS) is blocking the specific traffic because it has detected that particular downloads could be malicious. A NIDS would only detect this and send alarms to Tom; it would not prevent the traffic. The firewall will usually block entire websites from being accessed, not just prevent specific downloads. The router will not block web activity, although it could block access to particular IP addresses. However, if this was the case, the users would not be able to access the website in question at all. See the section titled “NIDS Versus NIPS” in Chapter 6, “Network Perimeter Security,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Users on your network are identified with tickets. Which of the following systems is being used? A. Kerberos B. RADIUS C. TACACS+ D. LDAP
Answer: A. Kerberos
Explanation: Kerberos is the only authentication system listed that uses tickets to identify users—the ticketing system proves the identity of users. RADIUS uses authentication schemes such as CHAP and EAP. RADIUS and TACACS+ are normally used for remote authentication of users, whereas Kerberos is used in Domains. TACACS+ uses TCP, and RADIUS uses UDP for connections. LDAP is used for accessing and modifying directory services data. See the section titled “Authentication Models and Components” in Chapter 8, “Physical Security and Authentication Models,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Which of the following invalidates SQL injection attacks that were launched from a lookup field of a web server? A. Input validation B. Security template C. NIDS D. Buffer overflow protection
Answer: A. Input validation.
Explanation: Input validation is a process that ensures the correct usage of data. It is important when dealing with any types of forms on a web server. Because these forms can be compromised by various attacks, forms should be coded in such a way where any input from the user will be validated by the web page before it is accepted. For example, if you were to type in six digits in a ZIP code field when it expects only a maximum of five digits, input validation should deny that entry, and if coded properly will ask the user to re-enter the information. Security templates import many secure policies at one time. A NIDS protects an entire network from intrusion. Buffer overflow protection ensures that memory is storing data the way that the developer intended. Input validation also prevents buffer overflow attacks in addition to other types of attacks such as SQL injection attacks. See the section titled “Securing Other Applications” in Chapter 4, “Application Security,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
You want to curtail users from e-mailing confidential data outside your organization. Which of the following would be the best method?
A. Block port 110 on the firewall.
B. Prevent the usage of USB flash drives.
C. Install a network-based DLP device.
D. Implement PGP.
Answer: C. Install a network-based DLP device.
Explanation: A network-based data loss prevention (DLP) device is the best solution listed. This device normally sits on the perimeter of the network and can be configured to analyze traffic for confidential information and prevent it from going outside the network. DLP devices can also be storage-based and endpoint-based, but in this case the network-based DLP would be best. Blocking port 110 on the firewall might stop all outbound POP3 e-mails from leaving the network, and while that would probably stop confidential e-mails from going out, it would cause a whole slew of other problems—as you might imagine! Preventing the usage of flash drives probably wouldn’t affect the scenario either way. PGP is used to encrypt and digitally sign e-mails, which is a decent option when attempting to keep data confidential but won’t help when you want to keep that confidential data from leaving the network. See the section titled “Firewalls and Network Security” in Chapter 6, “Network Perimeter Security,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
What should be incorporated with annual awareness security training? A. Signing of a user agreement B. Implementation of security controls C. User rights and permissions review D. Succession planning
Answer: A. Signing of a user agreement
Explanation: Security awareness training should be coupled with the signing of a user agreement. This agreement states that the user acknowledges and accepts specific rules of behavior, conduct, and nondisclosure of the training. Some organizations might add other policies that the user must agree to as well. Security controls deal with the proper implementation of a security plan. User rights and permissions reviews are part of security audits. Succession planning is the process of developing and readying new servers and other equipment in the case that the current equipment fails, is compromised, or becomes outdated. See the section titled “Legislative and Organizational Policies” in Chapter 15, “Policies, Procedures, and People,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
A critical system in the server room was never connected to a UPS. The security administrator for your organization has initiated an authorized service interruption of the server to fix the problem. Which of the following best describes this scenario? A. Succession planning B. Fault tolerance C. Continuity of operations D. Disaster recovery
Answer: B. Fault tolerance
Explanation: Because the security administrator is deliberately interrupting service in a proactive effort to fix the problem, this scenario would be best described as fault tolerance. Also, the fact that a UPS is being installed to make the system tolerant of power loss lends to the fault tolerance answer. If the administrator was planning how a new server was to be implemented, then it would be succession of planning. Continuity of operations and disaster recovery deal with the scenario of an actual disaster and the planning for recovery from that disaster. See the section titled “Redundancy Planning” in Chapter 14, “Redundancy and Disaster Recovery,” for more information.
The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further.
Which of the following devices is used to optimize and distribute data workloads across multiple computers or networks? A. VPN concentrator B. Protocol analyzer C. Proxy server D. Load balancer
Answer: D. Load balancer
Explanation: A load balancer is used to distribute workload across multiple computers or a computer cluster. It could be done by a dedicated hardware or software. VPN concentrators are devices used for remote access. Protocol analyzers are used to examine packets of information that are captured from a computer. Proxy servers act as go-betweens for client computers and the Internet and often cache information that comes from websites. See the section titled “Redundancy Planning” in Chapter 14, “Redundancy and Disaster Recovery,” for more information.
