Lesson 10 - Using Support and Scripting Tools

Question 1

What is VNC?

Answer 1

Virtual Network Computing is a remote access tool and protocol. VNC is the basis of macOS screen-sharing.

Question 2

What is the default TCP port for a Remote Desktop server?

Answer 2

Port 3389

Question 3

What is MSRA?

Answer 3

Microsoft Remote Assistance is a Windows remote-support feature allowing a user to invite a technical support professional to provide assistance over a network using chat. The user can also grant the support professional control over his or her desktop. Remote Assistance uses the same RDP protocol as Remote Desktop

Question 4

What is the Windows feature Quick Assist?

Answer 4

Quick Assist is a Windows support feature allowing remote screen-sharing over the internet. Replaces MSRA and can be accessed by (CTRL+START+Q). Quick Assist works over the encrypted HTTPS port TCP/443.

Question 5

What is SSH?

Answer 5

Secure Shell is an application protocol supporting secure tunneling and remote terminal emulation and file copy. SSH runs over TCP port 22. SSH uses encryption to protect each session.

Question 6

What are the two general classes of tools that provide enterprise monitoring and remote access?

Answer 6

-Remote monitoring and management (RMM)
-Desktop management or unified endpoint management (UEM)/mobile-device management (MDM)

Question 7

You are updating a procedure that lists security considerations for remote access technologies. One of the precautions is to check that remote access ports have not been opened on the firewall without authorization. Which default port for VNC needs to be monitored?

Answer 7

Virtual Network Computing (VNC) uses TCP port 5900 by default.

Question 8

True or false? You can configure a web server running on Linux to accept remote terminal connections from clients without using passwords.

Answer 8

True. This can be configured using public key authentication with the Secure Shell (SSH) protocol. The server can be installed with the public keys of authorized users.

Question 9

You are joining a new startup business that will perform outsourced IT management for client firms. You have been asked to identify an appropriate software solution for off-site support and to ensure that service level agreement (SLA) metrics for downtime incidents are adhered to. What general class of remote access technology will be most suitable?

Answer 9

Remote monitoring and management (RMM) tools are principally designed for use by managed service providers (MSPs). As well as remote access and monitoring, this class of tools supports management of multiple client accounts and billing/reporting.

Question 10

Users working from home need to be able to access a PC on the corporate network via RDP. What technology will enable this without having to open the RDP port to Internet access?

Answer 10

Configure a virtual private network (VPN) so that remote users can connect to the corporate LAN and then launch the remote desktop protocol (RDP) client to connect to the office PC.

Question 11

What are the two main factors that govern backup operations?

Answer 11

-Frequency (period between backup jobs)
-Retention (period that any given backup job is kept for)

Question 12

What is a backup chain?

Answer 12

A backup chain is a sequence of jobs starting with a full backup and followed by either incremental or differential backups to implement a media rotation scheme.

Question 13

What are the three main types of backups?

Answer 13

• Full only: the backup job produces a file that contains all the data from the source
• Full with incremental: the chain starts with a full backup and then runs incremental jobs that select only new files and files modified since the previous job.
• Full with differential: the chain starts with a full backup and then runs differential jobs that select new files and files modified since the original full job.

Question 14

What is a synthetic full backup?

Answer 14

A synthetic full backup is a job type that combines incremental backup jobs to synthesize a full backup job. Synthetic full backups have the advantage of being easy to restore from while also being easy on bandwidth across the network as only changes are transmitted.

Question 15

What is the GFS backup rotation scheme?

Answer 15

GFS: Grandfather-father-son is a backup rotation scheme that labels tapes/devices used for backup jobs in generations, with the youngest generation having a shorter retention period than the oldest.

Question 16

What is the 3-2-1 backup rule?

Answer 16

Backup best practice states that at any given time there should be at least three copies of data stored on two media types, with one copy held off site.

Question 17

What backup issue does the synthetic job type address?

Answer 17

A synthetic full backup reduces data transfer requirements and, therefore, backup job time by synthesizing a full backup from previous incremental backups rather than directly from the source data.

Question 18

You are documenting workstation backup and recovery methods and want to include the 3-2-1 backup rule. What is this rule?

Answer 18

It states that you should have three copies of your data across two media types, with one copy held offline and off site. The production data counts as one copy.

Question 19

For which backup/restore issue is a cloud-based backup service an effective solution?

Answer 19

The issue of provisioning an off-site copy of a backup. Cloud storage can also provide extra capacity.

Question 20

What frequent tests should you perform to ensure the integrity of backup settings and media?

Answer 20

You can perform a test restore and validate the files. You can run an integrity check on the media by using, for example, chkdsk on a hard drive used for backup. Backup software can often be configured to perform an integrity check on each file during a backup operation. You can also perform an audit of files included in a backup against a list of source files to ensure that everything has been included.

Question 21

What is regulated data?

Answer 21

Regulated data is info that has storage- and handling- compliance requirements defined by national and state legislation and/or industry regulations.

Question 22

What is PII?

Answer 22

Personally identifiable information (PII) is data that can be used to identify, contact, or locate an individual or to impersonate them.

Question 23

What is Personal Government-issued Information?

Answer 23

Personal Government-issued Information is issued to individuals by federal or state government is also PII

Question 25

What is considered prohibited content?

Answer 25

Prohibited content is any information that is not applicable to work.

Question 26

What is the EULA?

Answer 26

End-user license agreement is the contract governing the installation and use of software.

Question 27

What is DRM?

Answer 27

Digital rights management is copyright protection technologies for digital media. DRM solutions usually try to restrict the number of devices allowed for playback of a licensed digital file, ie music or ebook.

Question 28

What is an IRP?

Answer 28

An incident response plan is a set of procedures and guidelines for dealing with security incidents.

Question 29

What is a CSIRT?

Answer 29

Computer Security Incident Response Team is a team with responsibility for incident response

Question 30

What is digital forensics?

Answer 30

Digital forensics is the science of collecting evidence from computer systems to a standard that will be accepted in a court of law.

Question 31

What is data sanitization?

Answer 31

The process of thoroughly and completely removing data from a storage medium so that file remnants cannot be recovered.

Question 32

How does disk erasing/wiping software work?

Answer 32

Disk erasing/wiping software ensures that old data is destroyed by writing to each location on a hard disk drive, either using zeros or in a random pattern leaving the disk "clean" and ready for new user.

Question 33

What is a Secure Erase (SE)?

Answer 33

Secure Erase (SE) performs zero-filling on HDDs and marks all blocks as empty on SSDs. The SSD firmware's automatic garbage collectors then perform the actual erase of each block over time. If this process is not completed (and there is no progress indicator), there is a risk of remnant recovery, though this requires removing the chips from the device to analyze them in specialist hardware.

Question 34

What is Instant Secure Erase (ISE)?

Answer 34

Instant Secure Erase (ISE)/Crypto Erase uses the capabilities of self-encrypting drives (SEDs) as a reliable sanitization method for both HDDs and SSDs. An SED encrypts all its contents by using a media encryption key (MEK). Crypto Erase destroys this key, rendering the encrypted data unrecoverable.

Question 35

What are the three types of physical destruction?

Answer 35

- Shredding - Incinerating - Degaussing (exposed to powerful electromagnet)

Question 36

You are updating data handling guidance to help employees recognize different types of regulated data. What examples could you add to help identify healthcare data?

Answer 36

Personal healthcare data is medical records, insurance forms, hospital/laboratory test results, and so on. Healthcare information is also present in de-identified or anonymized data sets.

Question 37

An employee has a private license for a graphics editing application that was bundled with the purchase of a digital camera. The employee needs to use this temporarily for a project and installs it on her computer at work. Is this a valid use of the license?

Answer 37

No. The license is likely to permit installation to only one computer at a time. It might or might not prohibit commercial use, but regardless of the license terms, any installation of software must be managed by the IT department.

Question 38

Why are the actions of a first responder critical in the context of a forensic investigation?

Answer 38

Digital evidence is difficult to capture in a form that demonstrates that it has not been tampered with. Documentation of the scene and proper procedures are crucial.

Question 39

What does chain-of-custody documentation prove?

Answer 39

Who has had access to evidence collected from a crime scene and where and how it has been stored.

Question 40

Your organization is donating workstations to a local college. The workstations have a mix of HDD and SSD fixed disks. There is a proposal to use a Windows boot disk to delete the partition information for each disk. What factors must be considered before proceeding with this method?

Answer 40

Using standard formatting tools will leave data remnants that could be recovered in some circumstances. This might not be considered high risk, but it would be safer to use a vendor low-level format tool with support for Secure Erase or Crypto Erase.