Exam 2 Flashcards

Question

# The 100 multiple-choice questions provided here help you to determine how prepared you are for the actual exam and which topics you need to review further. Which of the following is the best description of a security advantage when using a standardized server image? A. All antivirus software will be current. B. All current updates for the OS will already have been applied. C. All mandated security configurations will already have been applied to the OS. D. OS licensing will be easier to track.

Answer 1

Answer: C. All mandated security configurations will already have been applied to the OS. Explanation: Organizations develop standardized images for their server operating systems. They are standardized according to organizational policy. So, any mandated security configurations should be applied to the OS before it is made into an image to be used on the network. Unfortunately, that only gets the OS image to a certain point in time. Any new AV definitions, security updates to the OS, and so on, will need to be applied afterward according to organizational policy. OS licensing trackability should not change. Whether you track your OS licenses on paper or with a scanning program, they should be tracked in the same manner as with physical operating systems. See the section titled “Virtualization Technology” in Chapter 3, “OS Hardening and Virtualization,” for more information.

Answer 2

Answer: D. Least privilege Explanation: Least privilege is when users are given only the amount of rights necessary to do their job. Since the IT director only gave you specific rights and no more, and because other very specific rights are given to other network administrators, the least privilege rule applies here. Job rotation is when multiple users are cycled through different related tasks. Discretionary access control (DAC) is an access control model that has rules set by the user. Because the IT director has already set rights and permissions, this scenario does not involve DAC. Mandatory vacation is when a user is forced to take consecutive days vacation away from the office. See the section titled “Access Control Models Defined” in Chapter 9, “Access Control Methods and Models,” for more information.

Answer 3

Answers: A. Disabled SSID and D. MAC filtering Explanation: Utilizing a network sniffer (or packet analyzer) can aid an attacker in discerning the SSID of an AP as well as which MAC addresses are being allowed in. By drilling down through the frames of information that are captured, the attacker can easily find the SSID name, and with a little work can deduce the MAC addresses that have access to the network. Then, the person need only spoof the MAC address and connect to the AP’s SSID manually and have access to the wireless network. The other answers concern authentication and encryption methods, which will be much more difficult to circumvent. 802.1X is network access control that uses various types of authentication methods including EAP-TLS. WEP and WPA2 are encryption methods, and while WEP is deprecated, it is difficult to get past when used in conjunction with 802.1X. See the section titled “Authentication Models and Components” in Chapter 8, “Physical Security and Authentication Models,” for more information.

Answer 4

Answer: A. VPN concentrator Explanation: The VPN concentrator is the best solution listed. A hardware device such as this can handle 250 concurrent, secure, remote connections to the network. Web security gateways are used to block access to specific websites. Web proxies cache website content for later use. Software-based firewalls can allow for remote secure access but not for the amount of concurrent connections needed. A hardware-based firewall or VPN concentrator is the best solution. See the section titled “Authentication Models and Components” in Chapter 8, “Physical Security and Authentication Models,” for more information.

Answer 5

Answer: B. Review and apply vendor-provided hardening documentation Explanation: Third-party applications will usually come with a slew of documentation, including a list of hardening methods. This vendor documentation should be applied while updating the application as part of the entire application security process. It is the best answer as far as what to do in conjunction with the update. Running a port scan is a good idea at some point, but it has less to do with the application, and more to do with finding unnecessary ports and services. If the application is installed on an Internet-facing server, there probably won’t be a firewall involved. If the application server is in a DMZ, it will probably be behind a firewall, but by definition, even if the DMZ-based application serves users on the Internet, this isn’t considered to be directly Internet-facing. Otherwise, the firewall should usually be set up to allow an application to auto-update, but you never know; some applications might need to be updated manually, depending on the security level of the application and organizational policy. See the section titled “Firewalls and Network Security” in Chapter 6, “Network Perimeter Security,” for more information.

Answer 6

Answer: D. Vulnerability scan Explanation: If the data is becoming corrupted more than once even after an update to the affected systems, you should perform a vulnerability scan to find out what the possible threats and vulnerabilities are to those systems. A data integrity check would simply tell you that the data has been corrupted and therefore integrity is not intact. Penetration testing determines whether a system can be compromised by exploiting a particular threat. A hardware baseline review will tell you how your hardware is performing and how secure it is compared to the last baseline. Baselines are examples of vulnerability assessments, but in this case we need a software-based vulnerability assessment. See the section titled “Conducting Risk Assessments” in Chapter 10, “Vulnerability and Risk Assessment,” for more information.

Answer 7

Answer: C. Implicit deny Explanation: The principle of implicit deny is used to deny all traffic that isn’t explicitly (or specifically) allowed or denied. In other words, if the type of traffic hasn’t been associated with a rule, the implicit deny rule will kick in, thus protecting the device. Access control lists are used to filter packets and will include rules such as permit any, or explicit denies to particular IP addresses. See the section titled “Access Control Models Defined” in Chapter 9, “Access Control Methods and Models,” and the section titled “Firewalls and Network Security” in Chapter 6, “Network Perimeter Security,” for more information.

Answer 8

Answer: B. 26n Explanation: The 26 refers to “a” through “z” (lowercase), which comes to 26 characters in total. The n is a variable that refers to the length of the password. When calculating a password, the amount of characters should be raised to a particular power that will be equal to the length of the password. So, if our policy in the above example dictated a password that was 8 characters long, then it would be 26 to the power of 8 or 268. In this case n = 8, but it doesn’t have to—it could be 10, 14, or whatever the security administrator sets the password length to in the password policy. See the section titled “Rights, Permissions, and Policies” in Chapter 9, “Access Control Methods and Models,” for more information.

Answer 9

Answer: D. Information disclosure Explanation: Using P2P software and social networking software (and websites) can lead to information disclosure. This could be due to user error, not following guidelines, using a weak password, and so on. One direct reason for this is when users place personal information where it can be easily found. Data loss prevention is a technique used to stop data leakage—it often entails the use of a hardware-based device. A denial of service is when a server is attacked with a flood of packets and there is a stoppage of service. Shoulder surfing is when someone attempts to gain personal information about another person by looking about the person’s desk or watching him while he is working on his computer. See the section titled “Social Engineering” in Chapter 15, “Policies, Procedures, and People,” for more information.

Answer 10

Answer: B. Single sign-on Explanation: Single sign-on means the ability to log in to multiple systems using a single username/password combination (or other type of authentication method). This is what Greg needs in this scenario. Access control lists contain rules determining which IP addresses and users are allowed access to networks and data. Multifactor authentication is when two or more types of information (or physical security devices) are necessary to gain access to a system—for example, the combination of a username/password and a smart card. The Common Access Card is an authenticating smart card used by the DoD for personnel. See the section titled “Authentication Models and Components” in Chapter 8, “Physical Security and Authentication Models,” for more information.

Answer 11

Answer: A. MD5 Explanation: The MD5 hashing algorithm is used by NTLM2 authentication. MD5 stands for Message-Digest algorithm 5. It uses a 128-bit key and is a widely used hashing algorithm. LM hash is used with passwords of 14 or less characters. If you use a password of 15 characters or more on newer versions of Windows, the OS will store a constant string as the LM hash, which is effectively a null password, and thereby uncrackable. The real password will be stored as an NTLM2 hash and (in this case calculated with MD5) will be used solely. AES is the Advanced Encryption Standard used widely in wireless networks. SHA is the Secure Hash Algorithm, which employs a 160-bit hash. Newer versions of SHA are more secure than MD5. See the section titled “Hashing Basics” in Chapter 12, “Encryption and Hashing Concepts,” for more information.

Answer 12

Answer: D. Secure coding concepts Explanation: Secure coding concepts such as input validation will help to harden an application within the systems development life cycle (SDLC). While disabling unnecessary services and accounts, and patching the application are all important, these could all be considered application or server hardening, not hardening within the SDLC. See the section titled “Secure Programming” in Chapter 4, “Application Security,” for more information.

Answer 13

Answer: C. Lack of management software Explanation: A lack of management software can cause slower deployment of HSMs. Because the HSM is an external device, it requires software to manage it allowing the HSM to communicate with the computer it is connected to. The lack of decent management software could cause some decision makers at organizations to be slow to adopt the solution. RBAC stands for role-based access control, which assigns roles to users based on sets of permissions. USB removable encryption is a decent solution for encrypting data, but an HSM can house extremely secure keys in comparison and have tamper protection as well—so USB removable encryption isn’t really a substitute for an HSM. Multifactor authentication means that a user needs to have two forms of ID, or needs to be authenticated in two or more ways to a system. See the section titled “Securing Computer Hardware and Peripherals” in Chapter 2, “Computer Systems Security,” for more information.

Answer 14

Answer: C. A worm is self-replicating. Explanation: Worms are self-replicating once they are executed, whereas viruses are not. Viruses may spread out and infect one or more files, but the actual virus cannot replicate itself. Viruses and worms can both be difficult to remove—it depends on their severity and age. Worms and viruses can both be detected with antivirus software. Viruses can be larger or smaller than worms. The two are similar in general aside from self-replication. See the section titled “Computer Systems Security Threats” in Chapter 2, “Computer Systems Security,” for more information.

Answer 15

Answer: A. NIDS Explanation: A NIDS (network intrusion detection system) is designed to identify network attacks such as a Smurf attack (a type of DoS). Firewalls can block particular packets or IP addresses but don’t identify actual attacks. Content filters are used to secure users’ web browsing sessions, filtering out unwanted websites. Load balancers are used to distribute workload among multiple servers. See the section titled “NIDS Versus NIPS” in Chapter 6, “Network Perimeter Security,” for more information.

Answer 16

Answer: A. Port 443 inbound Explanation: The web server needs to have inbound port 443 open to accept secure requests for SSL sessions from clients. The outbound port doesn’t actually matter; it’s the inbound port that is important for the server. Inbound port 80 is used by default for regular HTTP connections. See the section titled “Security Protocols” in Chapter 13, “PKI and Encryption Protocols,” for more information.

Answer 17

Answer: B. Something a user is Explanation: Biometrics is the science of authenticating individuals according to their physical characteristics, or something the person is. A thumbprint is an example of something a user is; other examples include retina scans and even brain scans. An example of something a user knows would be a password or PIN. An example of something a user has would be a smart card or other ID card. An example of something a user does would be a signature or voice recognition. See the section titled “Physical Security” in Chapter 8, “Physical Security and Authentication Models,” for more information.

Answer 18

Answer: C. NAC Explanation: MAC filtering is when only a select list of MAC addresses is allowed to communicate with an AP or router. This is an example of network access control (NAC), a way of controlling how computers connect to the network in a secure fashion. VPN stands for virtual private network, which allows for the secure remote connection of computers to a network. NAT stands for network address translation, which takes care of the connection from LAN clients through a router and out to the Internet. A DMZ is a demilitarized zone—a place separate from the LAN where servers reside that can be reached by users on the Internet. See the section titled “Securing Wireless Networks” in Chapter 7, “Securing Network Media and Devices,” for more information.

Answer 19

Answer: D. The security posture on the network is enabled, and remediation must take place before the user can access the Internet. Explanation: The security posture can be defined as the risk level to which a system is exposed. If enabled, a system will need to meet particular security requirements. In this case, the user cannot access the Internet with her laptop until the antivirus software is updated (the remediation). If disabled, the user would not need to update her system. An IDS will not block access to the network. Instead, an IDS will detect malicious activity on the network. An IPS is not designed to prevent internal users from accessing the network—it is designed to prevent malicious activity on the network. See the section titled “Monitoring Methodologies” in Chapter 11, “Monitoring and Auditing,” for more information.

Answer 20

Answer: A. Minimum age Explanation: This question refers to Windows Server products. The minimum age password policy must be set to enforce an effective password history policy. If this is not done (in conjunction with the password history policy) then the user will be able to reuse old passwords. For example, if the minimum age was set to the default of zero, then the user could simply change his password as many times as needed, without waiting, to get past the password history policy, and ultimately reuse an old password. The minimum age must always be less than the maximum age setting and must be more than zero to enforce a password history policy properly. Note: If you configure the maximum age in Windows Server 2008 or Server 2003, the minimum age will automatically be configured to a day less than the maximum age. While maximum age might be another good possible answer to this question, the best and most direct answer would be minimum age. Expiration of passwords, password length, and lockout time for accounts won’t affect this scenario. See the section titled “Rights, Permissions, and Policies” in Chapter 9, “Access Control Methods and Models,” for more information.

Answer 21

Answer: D. Change management Explanation: Change management is a structured way of changing the state of a computer system or IT procedure. The idea behind this is that change is going to happen, but the organization should adapt with change and be knowledgeable of any proposed changes before they occur. Other people in your organization might require that patches not be installed to a particular server; you should get their permission first as part of the change management process before installing the patch. Due process is the principle that an organization must respect and safeguard a person’s rights. Separation of duties is when more than one person is required to complete a particular task. Fault tolerance is the capability of your network to continue functioning after an error or attack occurs. See the section titled “Legislative and Organizational Policies” in Chapter 15, “Policies, Procedures, and People,” for more information.

Answer 22

Answer: A. Memory, system processes, and network processes Explanation: Memory is cleared when the computer is shut down (unless hibernation mode has been implemented). This removes system and network processes from memory. Archival storage, the master boot record, system disk, e-mail, and log files will all still be available. Although two other answers had possibilities within them, they weren’t altogether correct. See the section titled “Implementing Security Applications” in Chapter 2, “Computer Systems Security,” for more information.

Answer 23

Answer: B. AES Explanation: AES128 is a 128-bit cipher, meaning it has a key length of 128 bits. However, a more secure solution would be to use AES256 (256-bit key length). SHA -1 is 160-bit, and SHA-2 is 256 or 512-bit in key length. DES is 56-bit, and its successor 3DES is 168-bit. See the section titled “Encryption Algorithms” in Chapter 12, “Encryption and Hashing Concepts,” for more information.

Answer 24

Answer: C. Disable unused ports Explanation: If you need to physically secure a switch, you should first disable unused ports so that a person who has gained unauthorized access to your server room or data center cannot plug a laptop into one of those ports and access the network. It would also be wise to check (or create) a security baseline at some point after this. Access control lists are generally set up on routers, not on switches. Regardless, they deal with the logical, not the physical. The same holds true for accounts, they are of a logical nature, and are usually set up on servers and routers. See the section titled “Network Design” in Chapter 5, “Network Design Elements and Network Threats,” for more information.

Answer 25

Answer: A. PEAP-TLS Explanation: PEAP (Protected Extensible Authentication Protocol) creates a TLS tunnel by acquiring a PKI certificate from a CA. It is known simply as PEAP or as PEAP-TLS. It is similar to EAP-TTLS. FTPS is FTP over SSL. Explicit mode means that the FTPS client must explicitly request security from the FTPS server. Implicit FTPS connections do not allow negotiation—there is no request for security; it is expected from the server. MD5 is a cryptographic hash function. See the section titled “Authentication Models and Components” in Chapter 8, “Physical Security and Authentication Models,” for more information.

Answer 26

Answers: B and D. Usually, HIDS cannot detect network attacks, and A HIDS can negatively impact system performance. Explanation: A HIDS usually cannot detect network attacks, whereas a NIDS can. A HIDS will definitely have a negative impact on system performance because it uses resources in the form of CPU and RAM; however, a HIDS is reliable when it comes to detecting attacks on an individual computer. Also, a HIDS can be updated. See the section titled “Implementing Security Applications” in Chapter 2, “Computer Systems Security,” for more information.

Answer 27

Answer: D. Hierarchical list of critical systems Explanation: A disaster recovery plan should contain (among other things) a list of critical systems in order from the most critical to the least critical. Access control lists don’t fail, but the router that they are contained within may fail and therefore the routers should be listed as critical systems. Anything could be a single point of failure. If a single point of failure cannot be tolerated, it needs to be mitigated in the form of fault tolerance (UPS, RAID, clustering, and so on). Generally, an organization will only have one hot site due to the fact that they are very expensive to maintain. See the section titled “Disaster Recovery Planning and Procedures” in Chapter 14, “Redundancy and Disaster Recovery,” for more information.

Answer 28

Answer: A. LANMAN Explanation: LANMAN is an outdated hash used in Windows—it is the original hash used to store passwords. NTLM (and the newer NTLMv2) hash are used in newer versions of Windows to replace LANMAN. AES is the Advanced Encryption Standard, a popular encryption method. MD5 is a different hash function used in the downloading of files among other things. Passwd is a text-based file used in Linux that stores user information and permissions. See the section titled “Hashing Basics” in Chapter 12, “Encryption and Hashing Concepts,” for more information.

Answer 29

Answer: C. The computer is missing the authentication agent. Explanation: In a network access control (NAC) enabled network, computers must have the authentication agent installed; otherwise, the NAC system will not ask for the credentials (and the computer will not get access to the network). The authentication agent is also known as a supplicant (for example in 802.1X systems). The patch level, antivirus definitions, and service packs (SPs) are separate from the NAC system. See the section titled “Authentication Models and Components” in Chapter 8, “Physical Security and Authentication Models,” for more information.

Answer 30

Answers: A. Firewall and D. VPN Explanation: A firewall can be used in conjunction with a virtual private network (VPN) service to allow users remote access to your network. The firewall might incorporate the VPN, or the VPN might be controlled by a separate server or concentrator. Subnetting is not necessary for remote access, but it is a security method used to compartmentalize networks. Network address translation (NAT) is used to translate LAN addresses through to the Internet. Network access control (NAC) is used to authenticate computers and users in a secure fashion on the LAN. See the section titled “Authentication Models and Components” in Chapter 8, “Physical Security and Authentication Models,” for more information.

Answer 31

Answer: C. Logic bomb Explanation: A logic bomb is code designed to be set off on a specific day. This may cause a virus to execute or other malicious activity to occur at that specific time. A bot, short for robot, is also known as a zombie, which is a compromised computer controlled by a central source. Spyware is unwanted software that tracks Internet access. Adware is the pop-up ads you see when you go to various websites. It is also software similar to spyware that will track your Internet access to expose you to specific ads. See the section titled “Computer Systems Security Threats” in Chapter 2, “Computer Systems Security,” for more information.

Answer 32

Answer: C. MSCHAPv2 Explanation: PEAP uses MSCHAPv2 most commonly. This supports authentication via Microsoft Active Directory databases. MSCHAPv1 does not allow this and is not used in PEAP. MD5 is not an authentication method, and is not used by PEAP, but it is used in EAP-MD5 (as a hashing algorithm), which is also challenge-based. PEAP is a derivative of EAP (Extensible Authentication Protocol). See the section titled “Authentication Models and Components” in Chapter 8, “Physical Security and Authentication Models,” for more information.

Answer 33

Answer: D. ACLs Explanation: Access control lists (ACLs) need to be configured properly for users to gain remote access through a firewall/router and on to the main network. Tokens are used in authentication schemes (often local) but are usually generated without little configuration. Biometrics is the authentication of individuals through physical characteristics. Supplicants (authentication agents) are usually loaded on computers in an 802.1X NAC network, which is usually local and usually done with little configuration. See the section titled “Authentication Models and Components” in Chapter 8, “Physical Security and Authentication Models,” for more information.

Answer 34

Answer: C. RBAC Explanation: Role-based access control (RBAC) is when individuals are assigned groups of permissions that constitute a role. While a person in HR might not assign job functions within the operating system directly, the person will commonly assign the job functions for each user in some type of paper or electronic document, and deliver that document to a security administrator who then implements those job functions within the operating system. Mandatory access control (MAC) is a model that determines permissions by a computer system. Discretionary access control (DAC) is when permissions are determined by the owner. An ACL is an access control list, which defines what IP addresses (or users) can access particular networks or resources. See the section titled “Access Control Models Defined” in Chapter 9, “Access Control Methods and Models,” for more information.

Answer 35

Answer: B. Perform a bit level erasure or overwrite the drive. Explanation: Hard drives should be sanitized. This can be done with bit-level erasure software that completely obliterates any data that was previously on the drive. Formatting the drive is not enough as data can still be recovered from a formatted drive. Even if you plan on disposing of the drives with a third-party facility, the drive should still be sanitized beforehand. Most organizations will not burn hard drives. It might even be illegal in your municipality. Instead, after sanitization, hard drives are often pulverized. See the section titled “Legislative and Organizational Policies” in Chapter 15, “Policies, Procedures, and People,” for more information.

Answer 36

Answer: A. CHARGEN Explanation: CHARGEN, the character generator, uses port 19. It is commonly used by a Fraggle attack. Echo uses port 7. Telnet uses port 23. SMTP uses port 25. See the section titled “Ports and Protocols” in Chapter 5, “Network Design Elements and Network Threats,” for more information.

Answer 37

Answer: C. Locking cabinet Explanation: A locking cabinet is the best way listed to prevent the theft of physical devices such as USB flash drives and laptops. But only if the locking cabinet...is locked. GPS tracking can aid in finding devices after they were stolen. Encryption helps in keeping data secure even if the device is stolen (although it isn’t a perfect solution). Hashing provides integrity of data. However, GPS tracking, encryption, and hashing won’t stop the physical devices from being stolen. It’s important to keep physical devices locked up when not in use and monitored by video surveillance or other means. See the section titled “Securing Computer Hardware and Peripherals” in Chapter 2, “Computer Systems Security,” for more information.

Answer 38

Answer: B. Video surveillance Explanation: Video surveillance would be the most undeniable source of proof listed. A card key log from a proximity reader system could have been tampered with or the unauthorized person might have obtained a legitimate card key. Security logs are not good sources of proof, and although a security guard’s testimony could be compelling, it could still be deniable. Video surveillance (for example CCTV systems) is the best form of proof because it would be the hardest to tamper with or spoof. See the section titled “Physical Security” in Chapter 8, “Physical Security and Authentication Models,” for more information.

Answer 39

Answer: A. Wardriving Explanation: Your boss is trying to prevent wardriving. By streamlining your AP, you reduce the chance of a wardriver being able to access (or even “see”) your wireless network. An evil twin is an AP put in place maliciously that has the same SSID as an already existing AP on your network. Rogue APs are access points that are not part of your wireless network. The above techniques in the scenario might reduce RF interference; however, RF interference is not a reconnaissance method. See the section titled “Securing Wireless Networks” in Chapter 7, “Securing Network Media and Devices,” for more information.

Answer 40

Answer: B. Quantitative risk assessment Explanation: Quantitative risk assessment measures risk using exact monetary values. Whereas qualitative risk assessment assigns numeric values to the probability of risk. Business impact analysis is the differentiation of critical and non urgent functions and is part of a DRP or BCP. A vulnerability assessment is an analysis of security weakness in an organization. See the section titled “Conducting Risk Assessments” in Chapter 10, “Vulnerability and Risk Assessment,” for more information.

Answer 41

Answer: D. Proxy server Explanation: A proxy server, specifically a caching proxy, will minimize traffic with the Internet. Users that access the same websites will get their information from the proxy server instead of from the Internet. An IP proxy server will hide information about the internal structure of the network. Proxy servers are available that can handle both of these functions. A NIDS, network intrusion detection system, detects attacks on the network. A firewall closes off ports on the network; and although some firewalls also come with proxy functionality, it is not the best answer for this scenario. Protocol analyzers, also known as network sniffers, can analyze packets of information that have been captured. See the section titled “Firewalls and Network Security” in Chapter 6, “Network Perimeter Security,” for more information.

Answer 42

Answer: A. Confidentiality Explanation: The concept of confidentiality ensures that only authorized users can view secure data. Integrity ensures that data has not been tampered with. Availability ensures that data is accessible and ready. Authenticity ensures that data comes from who the data is supposed to come from and that it is a reputable source. See the section titled “Security 101” in Chapter 1, “Introduction to Security,” for more information.

Answer 43

Answer: C. Change management strategy Explanation: Change management is a structured way of making changes to networking equipment and other systems. It is done in a way where everyone involved is notified of a change. If a person was to add networking devices to an ad hoc wireless network without consulting anyone else, it could cause many issues, including, but not limited to, loss of access to the network. Incident management (and incident response) is a set of procedures that a person goes through when examining a computer or network-related security incident. Patch management is the planning, testing, implementing, and auditing of patches that are installed on systems. Auditing strategies in patch management involve making sure the patch holds properly over time. In general, auditing strategies are implemented to properly record and review what happens to data within the various servers and other computers on the network. See the section titled “Legislative and Organizational Policies” in Chapter 15, “Policies, Procedures, and People,” for more information.

Answer 44

Answer: D. Application hardening Explanation: Application hardening is the securing of an application, disabling of unnecessary services, disabling unused accounts, removal of unnecessary applications, and so on. Secure code review is the analysis of code to make sure it cannot be corrupted—this is done through input validation, checking for unmanaged code, checking for sensitive data, and so on. Baselining is the process or measuring changes in a system. Patch management strategy is the entire four-step process involved when adding patches to a system. See the section titled “Hardening Operating Systems” in Chapter 3, “OS Hardening and Virtualization,” for more information.

Answer 45

Answers: A. Logic bomb and E. Pharming Explanation: Antivirus programs are meant to scan for viruses, worms, and Trojans. They are least likely to discover logic bombs since they don’t manifest themselves right away. Pharming is a type of social engineering attack that antivirus programs are not designed to detect. See the section titled “Computer Systems Security Threats” in Chapter 2, “Computer Systems Security,” for more information.

Answer 46

Answer: C. Private key Explanation: A private key is used by smart cards during login to a network. Often the smartcard will be used along with another form of authentication, creating a multifactor authentication scheme. Public keys are used in asymmetric encryption environments. A key is basically one component of a cipher or algorithm. A shared key is often used in public key environments and asymmetric encryption environments, in which two users share the same key. See the section titled “Physical Security” in Chapter 8, “Physical Security and Authentication Models,” for more information.

Answer 47

Answer: B. Patch management Explanation: If the IT director is worried about operating system vulnerabilities, then a solid patch management strategy should be implemented. By keeping the OS up to date, there should be fewer OS vulnerabilities and therefore fewer threats to the OS. Locking cabinets should be used to store devices and data when not in use. Antispam software is used to prevent unwanted e-mails from reaching users. Encryption is used to keep data confidential. See the section titled “Legislative and Organizational Policies” in Chapter 15, “Policies, Procedures, and People,” for more information.

Answer 48

Answer: C. VLAN Explanation: A virtual LAN (VLAN) is used to logically separate groups of computers. It is often done to separate departments in a virtual manner without having to change the physical cabling design. MAC filtering is a method implemented on access points to allow only specific systems onto the wireless network. Cloud computing is a group of various services offered by third-party organizations—the services are hosted on the Internet. SaaS (Software as a Service) is an example of cloud computing. See the section titled “Network Design” in Chapter 5, “Network Design Elements and Network Threats,” for more information.

Answer 49

Answer: A. Hardware chip that stores keys Explanation: A TPM (Trusted Platform Module) is a chip that resides on a motherboard that stores encrypted keys used to encrypt the entire hard drive of a computer. A hardware security module (HSM) is a high-speed secure removable storage device. An example of a third-party certificate authority (CA) is a company such as VeriSign that develops and distributes trusted certificates. USB encryption is a removable type of encryption; for example, a USB flash drive might be encrypted with AES256 to keep data secure. See the section titled “Securing Computer hardware and Peripherals” in Chapter 2, “Computer Systems Security,” for more information.

Answer 50

Answer: D. Vulnerability scanning Explanation: Vulnerability scanning is considered to be an example of passive security testing. The acts of port scanning, penetration testing, and testing by way of attack (such as a DoS) are all considered to be active security testing. See the section titled “Conducting Risk Assessments” in Chapter 10, “Vulnerability and Risk Assessment,” for more information.

Answer 51

Answer: B. Fingerprint scanner Explanation: A fingerprint scanner is the only option that can offer a third factor of authentication. Elliptic curve is a type of asymmetric encryption, not a type of authentication. Passphrases and PINs fall into the same category as passwords, so they are not considered a separate type of authentication. See the section titled “Physical Security” in Chapter 8, “Physical Security and Authentication Models,” for more information.

Answer 52

Answer: C. Fuzzing Explanation: Fuzzing (fuzz testing) is the automated insertion of random data into a computer program. It is used to find vulnerabilities by the people who developed the program and by attackers. Secure code review is the analysis of source code by authorized individuals in an attempt to find problems and security issues. Vulnerability testing is a scan done on computers and networks to find their vulnerability level. Compiling is the transformation of source code, generally done to create executable programs. See the section titled “Secure Programming” in Chapter 4, “Application Security,” for more information.

Answer 53

Answer: A. Power and connectivity Explanation: A cold site need only have power and data/telco connectivity ready to go in the case of an emergency. The organization is expected to provide servers and other computers, phones, as well as configure them all. Warm sites might have computers and servers available but not configured. Hot sites will have redundant servers and networking devices, and patched client computers. Plus everything will be configured and ready to go at short notice. See the section titled “Redundancy Planning” in Chapter 14, “Redundancy and Disaster Recovery,” for more information.

Answer 54

Answer: C. Minimizing organizational risk caused by users Explanation: Users are an aspect of risk to an organization (whether they mean to be or not!). By committing to a training schedule and other user awareness policies, an organization can reduce that risk. See the section titled “Legislative and Organizational Policies” in Chapter 15, “Policies, Procedures, and People,” for more information.

Answer 55

Answer: B. Baseline reporting Explanation: Baseline reporting will tell you what has happened in the past on your FTP server. By creating a baseline, you can compare current results with past results, helping you to determine whether the activity is normal. Secure code review is done to analyze whether the source code of a program has vulnerabilities. A security policy will dictate how an organization will approach risk and how it will deal with vulnerabilities. A DRP is a disaster recovery plan. See the section titled “Using Tools to Monitor Systems and Networks” in Chapter 11, “Monitoring and Auditing,” for more information.

Answer 56

Answer: A. Account lockout duration Explanation: The account lockout duration is the amount of time that users will not be allowed to attempt to log in to the network after they have reached the threshold of account login failures. By default this setting is 30 minutes on many security policies. The account lockout threshold is the amount of times that the user is allowed to attempt to log in. The default on many policies is five, but often organizations change this to three (known as the three-strikes-and-you’re-out rule). Password complexity requirements can be enabled within a policy; if so, the users need to incorporate three of four methods of password complexity including uppercase characters, numeric characters, special characters, and so on. Minimum password age is the amount of days that a password must exist before a user is allowed to change it. See the section titled “Rights, Permissions, and Policies” in Chapter 9, “Access Control Methods and Models,” for more information.

Answer 57

Answer: B. SELinux Explanation: Security-Enhanced Linux (SELinux) is a feature that supports mandatory access control and includes modifications that add security to Linux distributions helping to prevent malicious and suspicious code from executing. System File Checker (SFC) is a utility in Windows that checks the integrity of system files and replaces them if necessary. Tripwire is Linux-based open source software designed to check data integrity and alert users to changes. Vmlinuz is a compressed bootable version of the Linux kernel. See the section titled “Access Control Models Defined” in Chapter 9, “Access Control Methods and Models,” for more information.

Answer 58

Answer: D. WPA2 Explanation: WPA2 (Wi-Fi Protected Access version 2) is the most secure of the protocols listed when it comes to wireless networking security. WPA (or WPA version 1) is still widely used, but if possible wireless networks should be upgraded to WPA2. SSH is Secure Shell, which allows data to be sent and received securely between two networked systems. WEP (Wired Equivalent Privacy) is deprecated and not recommended for use. See the section titled “Securing Wireless Networks” in Chapter 7, “Securing Network Media and Devices,” for more information.

Answer 59

Answer: B. User rights and permissions reviews Explanation: Routine system audits will check for user rights and permissions as well as analyze log files, for example, the Security log in Windows. The development and implementation of the security policy that enabled the security log should have been done long before actual auditing takes place. Penetration testing and port scanning are not included in routine system audits but might be part of more elaborate security audits. Routine system audits are noninvasive (passive) allowing the systems to be audited to continue functioning as normal. See the section titled “Conducting Audits” in Chapter 11, “Monitoring and Auditing,” for more information.

Answer 60

Answer: A. Deny all Explanation: The deny all rule is a default rule found in a corporate firewall’s access control lists (ACLs). It is an example of the implicit deny concept. Permit all is not a default rule as it would be quite dangerous. Netsh advfirewall firewall is a command used in Windows to view personal firewall information. Add address=192.168.0.0/16 is a way to disable (or enable) private addressing space. See the section titled “Firewalls and Network Security” in Chapter6, “Network Perimeter Security,” for more information.

Answer 61

Answers: B and C. Require strong passwords, and rename the local default accounts. Explanation: By renaming the local default accounts (which includes the administrator account), users will have a difficult time attempting to select a username with administrative access. Most people know that the default administrative account in Windows is the administrator account; by renaming it you add a layer of security. Strong passwords is always a good idea and can help prevent an unauthorized user from logging on to the member server. On some Windows systems, by default, the administrator account has a blank password. It is common procedure to rename the account and configure a complex password. Disabling account lockout policies makes the server less secure. By default services do run under the local system account. Disabling the local default accounts would also disable the administrator account, and the question specifies that administrator access should not be limited. It is not a good idea to provide backdoors into any servers or devices; if backdoors are found, they should be eliminated or reported to the vendor of the software. See the section titled “Rights, Permissions, and Policies” in Chapter 9, “Access Control Methods and Models,” for more information.

Answer 62

Answer: D. Risk elimination Explanation: Risk cannot simply be eliminated. It can be mitigated by way of securing systems and implementing security policies; it can be transferred by way of insurance policies; it can be accepted to a certain extent, but it cannot be eliminated. See the section titled “Conducting Risk Assessments” in Chapter 10, “Vulnerability and Risk Assessment,” for more information.

Answer 63

Answer: C. Vishing Explanation: Vishing is a type of phishing social engineering attack, but it is done over the phone, whereas regular phishing is usually done by e-mail. Pharming is an attack designed to redirect a website’s traffic to another website. Spoofing is an attack where a person or a program masquerades as another one. See the section titled “Malicious Attacks” in Chapter 5, “Network Design Elements and Network Threats,” for more information.

Answer 64

Answer: B. Hot and cold aisles Explanation: To regulate cooling in a datacenter or server room, hot and cold aisles should be used. The cold aisle is on one side of the server racks. Air is drawn into the servers and exhausted into the hot aisle and ventilated out of the server room. See the section titled “Environmental Controls” in Chapter 15, “Policies, Procedures, and People,” for more information.

Answer 65

Answer: D. Clean desk policy Explanation: An organization might institute a clean desk policy in the hopes that USB flash drives, discs, and other items are not left lying around. Password history is a policy that can be implemented that disallows users from configuring a same password they had used previously. GPS tracking can be used to find portable devices but will usually be too late to prevent data theft. Video surveillance is great as a record of who entered a building but is not a proactive way to prevent data theft. See the section titled “Legislative and Organizational Policies” in Chapter 15, “Policies, Procedures, and People,” for more information.

Answer 66

Answer: C. Penetration testing Explanation: Penetration testing will give you a detailed account of whether a network has the capability to detect and respond to a denial-of-service attack. Penetration testing is a type of active testing that should be performed during off hours because it uses many resources on the network and on the computer running the test. The other three answers are types of passive analysis. They might tell you whether the network has the capability to detect an attack but cannot tell you whether the network has the capability to respond to an attack. The network intrusion detection system (NIDS) only detects attacks and warns an administrator if it finds one. So in actuality, chances are your penetration tests will inform you that the network cannot respond to a denial-of-service attack. See the section titled “Conducting Risk Assessments” in Chapter 10, “Vulnerability and Risk Assessment,” for more information.

Answer 67

Answer: A. Copy the log files to a server in a remote location. Explanation: The best practice to securing log files is to make sure that they are copied to a remote location—better yet to another server in a remote location where they can be easily accessible if the original server fails. This remote location should be in another city, not across the street in another building. Logging all failed and successful login attempts can create gigantic log files—the kind that might be impossible to manage. Most organizations will not do this. Increasing the size of log files won’t necessarily secure them, but it is a good idea when it comes to the management of log files. The default size of log files in most operating systems is not large enough for today’s big organizations. The hashing of log files is a good idea when securing the log files so that integrity can be maintained but is not necessarily the best practice. It should be used in conjunction with copying the files to a secure location. See the section titled “Conducting Audits” in Chapter 11, “Monitoring and Auditing,” for more information.

Answer 68

Answer: B. Contain the problem. Explanation: The first thing you should do is contain the problem. That can mean attracting the unauthorized user to a honeypot or honeynet or shutting down the affected systems. Afterward, depending on policy, you might notify management and possibly contact the police. Finally, you would determine the monetary impact after assessing the damage to the affected systems, if there were any. See the section titled “Legislative and Organizational Policies” in Chapter 15, “Policies, Procedures, and People,” for more information.

Answer 69

Answer: D. HSM Explanation: A hardware security module (HSM) provides encryption and can be an external device that can integrate with an existing server. A trusted platform module (TPM) is an encrypting chip that resides on a motherboard. FDE stands for full disk encryption, which can be implemented with a TPM. CAC stands for Common Access Card, a smart ID card used by the DoD. See the section titled “Securing Computer Hardware and Peripherals” in Chapter 2, “Computer Systems Security,” for more information.

Answer 70

Answer: C. Rootkit Explanation: Rootkits are designed to gain administrative control over an OS without being detected, and perform malicious operations. Worms and viruses affect files but not the kernel of the OS. Logic bombs are ways of delivering malicious software at a specific date. See the section titled “Computer Systems Security Threats” in Chapter 2, “Computer Systems Security,” for more information.

Answer 71

Answers: A and D. Retain the user’s data for a specific amount of time, and disable the user’s account. Explanation: If a user is terminated, standard policy is to disable that user’s account and to retain the user’s data for a specific amount of time, which should be stated within the policy. It is not wise to delete a user’s account, because all audited information and encryption keys associated with the user account will be lost. See the section titled “Legislative and Organizational Policies” in Chapter 15, “Policies, Procedures, and People,” for more information.

Answer 72

Answer: B. Developers copying data from production to test environments with USB sticks Explanation: By default, if data is copied to a USB stick, it is not encrypted. There is virtually no security in this scenario, and the worst part is that the USB sticks are physically travelling from one department to another. To rectify the situation, the developers could consider using AES256 to encrypt the data on the USB flash drives. The accounting personnel are using SFTP, the backup tapes are encrypted, and the back office staff is using SSH. All these other scenarios at least have some kind of security in mind. See the section titled “Securing Computer Hardware and Peripherals” in Chapter 2, “Computer Systems Security,” for more information.

Answer 73

Answer: C. Provider cloud Explanation: Provider clouds can offer Infrastructure as a Service (IaaS), which can alleviate some of the stress an organization’s network might suffer from. In addition provider clouds can offer software (SaaS) and platforms (PaaS). VPN concentrators and remote access are not good choices for heavily utilized networks. They are meant for smaller groups of remote users. Telephony is not a solution for heavily utilized networks—quite the opposite; often networks are the solution for telephony usage. See the section titled “Network Design” in Chapter 5, “Network Design Elements and Network Threats,” for more information.

Answer 74

Answer: D. Application hardening Explanation: Part of application hardening is renaming (or disabling) default accounts and setting complex passwords. If this is not done, it becomes very easy for attackers to compromise the application. OS hardening is not correct in this instance because it is the database that can be compromised using the default database username/password. Databases are considered to be applications, not operating systems. Patch management won’t affect the default user account. The account has to be secured manually. Virtualization of operating systems doesn’t come into play here, although it could help to have backup virtual images made in the case that the database server is compromised. See the section titled “Hardening Operating Systems” in Chapter 3, “OS Hardening and Virtualization,” for more information.

Answer 75

Answer: C. Carbon dioxide Explanation: Carbon dioxide fire extinguishers are the best fire suppression system to use if you don’t want your equipment to be damaged. All the other answers can seriously damage equipment such as networking devices and servers. A carbon dioxide fire extinguisher is gaseous. There is only a slight chance of ESD damage, but that is rare. See the section titled “Environmental Controls” in Chapter 15, “Policies, Procedures, and People,” for more information.

Answer 76

Answer: B. Revoke the certificate. Explanation: If a certificate is compromised before its regular expiration date, you should revoke the certificate. At this point it should be added to the certificate revocation list and published. The certificate should not be used again. It should not be validated or registered. It should also not be put in escrow unless a third party specifically requests it. See the section titled “Public Key Infrastructure” in Chapter 13, “PKI and Encryption Protocols.”

Exam 2 Flashcards

(100 cards)