Messer Security+ Flashcards

Question

A company is creating a security policy that will protect all corporate mobile devices: * All mobile devices must be automatically locked after a predefined time period. * Some mobile devices will be used by the remote sales teams, so the location of each device needs to be traceable. * All of the user’s information should be completely separated from company data. Which of the following would be the BEST way to establish these security policy rules? ❍ A. Containerization ❍ B. Biometrics ❍ C. COPE (Corporately Owned and Personally Enabled) ❍ D. VDI (Virtual Desktop Infrastructure) ❍ E. Geofencing ❍ F. MDM (Mobile Device Manager)

Answer 1

The Answer: F. MDM An MDM (Mobile Device Manager) provides a centralized management system for all mobile devices. From this central console, security administrators can set policies for many different types of mobile devices. The incorrect answers: A. Containerization Mobile device containerization allows an organization to securely separate user data from company data on a mobile device. Implementing this strategy usually requires a mobile device manager (MDM), and containerization alone won’t address all of the required security policies. B. Biometrics Biometrics can be used as another layer of device security, but you need more than biometrics to implement the required security policies in this question. C. COPE A device that is COPE (Corporately Owned and Personally Enabled) is commonly purchased by the corporation and allows the use of the mobile device for both business and personal use. The use of a COPE device does not address all of the required security policies. D. VDI A VDI (Virtual Desktop Infrastructure) separates the applications from the mobile device. This is useful for securing data, but it doesn’t implement all of the requirements in this question. E. Geofencing Geofencing could be used to prevent mobile device use from other countries, but you would still need an MDM to implement the other requirements.

Answer 2

The Answer: D. False negative A false negative is a result that fails to detect an issue when one actually exists. The incorrect answers: A. Exploit An exploit is an attack against a vulnerability. Vulnerability scans do not commonly attempt to exploit the vulnerabilities that they identify. B. Credentialed A credentialed scan would authenticate to the operating system and have access to files that would normally only be available to authorized users. C. Zero-day attack A zero-day attack focuses on previously unknown vulnerabilities. In this example, the vulnerability scan isn’t an attack, and the vulnerabilities are already known and patches are available.

Answer 3

The Answer: A. TOTP and F. Smart Card TOTP (Time-based One-Time Passwords) and smart cards are useful authentication controls when used in conjunction with other authentication factors. The incorrect answers: B. Least privilege Least privilege is a security principle that limits access to resources based on a person’s job role. Least privilege is managed through security policy and is not an authentication control. C. Role-based awareness training Role-based awareness training is specialized training that is based on a person’s control of data within an organization. This training is not part of the authentication process. D. Separation of duties A security policy that separates duties across different individuals is separation of duties. This separation is not part of the authentication process. E. Job rotation Job rotation is a security policy that moves individuals into different job roles on a regular basis. This rotation is not part of the authentication process.

Answer 4

The Answer: B. 802.1X 802.1X uses a centralized authentication server, and all users can use their normal credentials to authenticate to an 802.1X network. The incorrect answers: A. WPA2-PSK The PSK (Pre-shared Key) is the shared password that this network administration would like to avoid using in the future. C. WPS WPS (Wi-Fi Protected Setup) connects users to a wireless network using a shared PIN (Personal Identification Number). D. WPA2-AES WPA2 (Wi-Fi Protected Access 2) encryption with AES (Advanced Encryption Standard) is a common encryption method for wireless networks, but it does not provide any centralized authentication functionality

Answer 5

The Answer: D. grep and F. curl The curl (Client URL) command will retrieve a web page and display it as HTML at the command line. The grep command can then be used to search through the file for a specific string of text. The incorrect answers: A. tail The tail command will display the information at the end of a file. B. openssl OpenSSL is a cryptography library that is commonly used to support SSL/TLS encryption on web servers. C. scanless Scanless is a utility that can perform a port scan using a proxy service. E. Nmap The Nmap utility is a popular port scanning and reconnaissance utility. G. head The head command will display the information at the start of a file.

Answer 6

The Answer: A. DAC DAC (Discretionary Access Control) is used in many operating systems, and this model allows the owner of the resource to control who has access. The incorrect answers: B. MAC MAC (Mandatory Access Control) allows access based on the security level assigned to an object. Only users with the object’s assigned security level or higher may access the resource. C. ABAC ABAC (Attribute-based Access Control) combines many different parameters to determine if a user has access to a resource. D. RBAC RBAC (Role-based Access Control) assigns rights and permissions based on the role of a user. These roles are usually assigned by group.

Answer 7

The Answer: D. Smishing Smishing, or SMS phishing, is a social engineering attack that asks for personal information using SMS or text messages. The incorrect answers: A. Brute force A brute force attack is an attack that tries multiple password combinations in an effort to identify the correct authentication details. B. Prepending Prepending adds information before a domain name in an attempt to fool the victim into visiting a website managed by the attacker. C. Typosquatting Typosquatting is a technique that uses a misspelling of a domain name to convince victims they are visiting a legitimate website.

Answer 8

The Answer: D. Require an approval PIN for the cashier and a separate approval PIN for the manager. This separation of duties would be categorized as dual control, where two people must be present to perform the business function. In this example, the dual control is managed by using two separate PINs (Personal Identification Numbers) that would not be shared among individuals. The incorrect answers: A. Use a WAF to monitor all gift certificate transactions A WAF (Web Application Firewall) is commonly used to monitor the input to web-based applications. WAFs do not commonly ensure separation of duties. B. Disable all gift certificate transactions for cashiers A separation of duties would give each person half of the information needed to complete the transaction, or it would require both persons to be present. Limiting the transaction to one person would not provide any separation between duties. C. Implement a discretionary access control policy A discretionary access control policy (DAC) is commonly used in operating system to allow the data owner to decide who has access to data. A DAC would not provide a way to manage separation of duties.

Answer 9

The Answers: D. Different tables are required for different hashing methods, and E. A rainbow table won’t be useful if the passwords are salted. A rainbow table is built prior to an attack to match a specific password hashing technique. If a different hashing technique is used, a completely different rainbow table must be built. The use of a salt will modify the expected results of a hash. Since a salted hash will not be predictable, the rainbow table can’t be built for these hashes. The incorrect answers: A. The rainbow table is built in real-time during the attack One of the benefits of a rainbow table is that the table is built before an attack begins. This provides a significant speed increase at attack time. B. Rainbow tables are the most effective online attack type Rainbow tables are almost exclusively used as an offline attack type. The most common use of a rainbow table is for the attacker to obtain a list of password hashes from a system and then use the rainbow tables while offline. C. Rainbow tables require significant CPU cycles at attack time Rainbow tables are built prior to an attack, so most of the CPU (Central Processing Unit) calculations and time is spent building the tables before an attack begins.

Answer 10

The Answer: D. DNS poisoning A DNS poisoning can modify a DNS server to modify the IP address provided during the name resolution process. If an attacker modifies the DNS information, they can direct client computers to any destination IP address. The incorrect answers: A. Disassociation Disassociation attacks are commonly associated with wireless networks. The disassociation attack is used to remove devices from the wireless network, and it does not commonly redirect clients to a different website. B. DDoS A DDoS (Distributed Denial of Service) is used by attackers to cause services to be unavailable. In this example, the bank's website is operational but clients are not resolving the correct IP address. C. Buffer overflow Buffer overflows are associated with application attacks and can cause applications to crash or act in unexpected ways. A buffer overflow would not commonly redirect clients to a different website IP address.

Answer 11

The Answer: C. Hybrid A hybrid cloud model combines both private and public cloud infrastructures. The incorrect answers: A. SaaS Software as a Service (SaaS) is a cloud deployment model that provides on-demand software without any context about the software’s location. B. Community A community cloud model allows multiple organizations to share the same cloud resources, regardless of the resource’s location. D. Containerization Containerization can be used with mobile devices to partition user data and corporate data.

Answer 12

The Answer: C. Validate the processes and procedures for all outgoing employees The disabling of an employee account is commonly part of the offboarding process. One way to validate an offboarding policy is to perform an audit of all accounts and compare active accounts with active employees. The incorrect answers: A. Confirm that no unauthorized accounts have administrator access It’s always a good idea to periodically audit administrator accounts, but this audit won’t provide any validation that all former employee accounts have been disabled. B. Validate the account lockout policy Account lockouts occur when a number of invalid authentication attempts have been made to a valid account. Disabled accounts would not be locked out because they are not currently valid accounts. D. Create a report that shows all authentications for a 24-hour period A list of all authentications would be quite large, and it would not be obvious to see which authentications were made with valid accounts and which authentications were made with former employee accounts.

Answer 13

The Answer: A. MAC filtering Filtering addresses by MAC (Media Access Control) address will limit which devices can connect to the wireless network. If a device is filtered by MAC address, it will be able to see an access point but it will not be able to connect. The incorrect answers: B. SSID broadcast suppression A suppressed SSID (Service Set Identifier) broadcast will hide the name from the list of available wireless networks. Properly configured client devices can still connect to the wireless network, even with the SSID suppression. C. 802.1X authentication With 802.1X authentication, users will be prompted for a username and password to gain access to the wireless network. Enabling 802.1X would not restrict properly configured devices. D. Anti-spoofing Anti-spoofing features are commonly used with routers to prevent communication from spoofed IP addresses. This issue in this question doesn’t appear to involve any spoofed addresses.

Answer 14

The Answer: B. netstat The netstat command provides a list of network statistics, and the default view shows the traffic sessions between the local device and other devices on the network. The incorrect answers: A. tracert Traceroute lists the route between devices and shows the IP address information of the routers at each hop. C. dig The dig (Domain Information Groper) command queries DNS servers for the fully-qualified domain name and IP address information of other devices. D. netcat The netcat command is used for reading or writing data to the network. The netcat command itself doesn't provide any statistical information about the network connection.

Answer 15

The Answer: D. DDoS A DDoS (Distributed Denial of Service) is an attack that overwhelms or disables a service to prevent the service from operating normally. Packets from multiple devices that disable a server would be an example of a DDoS attack. The incorrect answers: A. Privilege escalation A privilege escalation attack allows a user to exceed their normal rights and permissions. In this example, user permission escalations were not required to perform this attack. B. Spoofing Spoofing is when a device pretends to be a different device or pretends to be something they aren’t. This attack explanation did not appear to emulate or pretend to be a different user or address than the actual attacker. C. Replay attack A replay attack captures information and then replays that information as the method of attack. In this question, no mention was made of a prior data capture.

Answer 16

The Answer: C. Reconstitution The recovery after a breach can be a phased approach that may take months to complete. The incorrect answers: A. Lessons learned Once the event is over, it’s useful to revisit the process to learn and improve for next time. B. Isolation and containment During an incident, it’s useful to separate infected systems from the rest of the network. D. Precursors Log files and alerts can often warn you of potential problems.

Answer 17

The Answer: D. CASB A CASB (Cloud Access Security Broker) is used to manage compliance with security policies when using cloud-based applications. The incorrect answers: A. DLP DLP (Data Loss Prevention) can identify and block PII (Personally Identifiable Information) and other private details from being transferred across the network. B. SIEM A SIEM (Security Information and Event Manager) is a management system for log consolidation and reporting. A SIEM cannot managed cloud-based security policies. C. IPS An IPS (Intrusion Prevention System) can identify and block known vulnerabilities on the network, but it does not provide policy management for cloud-based systems.

Answer 18

The Answer: A. Lack of vendor support Security issues can be identified in a system or application at any time, so it’s important to have a vendor that can support their software and correct issues as they are discovered. If a vendor won’t provide security patches, then you may be susceptible to security vulnerabilities. The incorrect answers: B. Improper input handling A best practice for application security is to provide the proper handling of invalid or unnecessary input. Adding a patch to firewall software for a vulnerability would probably not be related to input handling. C. Improper key management Cryptographic keys can be used for many security purposes, but managing those keys isn’t part of the patching process from a vendor. D. End-of-life In this case, the firewall is a relatively new product. If the product was no longer officially sold or supported by the company, this would be an endof-life issue.

Answer 19

The Answer: D. Tabletop exercise A tabletop exercise allows a disaster recovery team to evaluate and plan disaster recovery processes without performing a full-scale drill. The incorrect answers: A. After-action report An after-action report is commonly created after a disaster recovery drill to document which aspects of the plan worked or did not work. B. Business impact analysis A business impact analysis is usually created during the disaster recovery planning process. Once the disaster has occurred, it becomes much more difficult to complete an accurate impact analysis. C. Alternate business practice An alternate business practice may be one of the steps in completing a disaster recovery exercise, but it does not describe the exercise itself.

Answer 20

The Answer: C. DNS sinkhole A DNS (Domain Name System) sinkhole can be used to redirect and identify devices that may attempt to communicate with an external command and control (C2) server. The DNS sinkhole will resolve an internal IP address and can report on all devices that attempt to access the malicious domain. The incorrect answers: A. Honeynet A honeynet is a non-production network that has been specifically created to attract attackers. A honeynet is not commonly used to identify infected devices. B. Data masking Data masking provides a way to hide data by substitution, shuffling, encryption, and other methods. Data masking does not provide a method of identifying infected devices. D. DLP DLP (Data Loss Prevention) systems can identify and block private information from transferring between systems. DLP does not provide any direct method of identifying devices infected with malware.

Answer 21

The Answer: B. Containment The containment phase isolates the system from any other devices to prevent the spread of any malicious software. The incorrect answers: A. Lessons learned A post-incident meeting can help the incident response participants discuss the phases of the incident that went well and which processes can be improved for future events. C. Detection The detection phase occurred prior to the system administrator arriving and identified the potential infection. D. Reconstitution The reconstitution phase will recover the system and data back to the state prior to the malware infection.

Answer 22

The Answer: D. Remote wipe Most organizations will use a mobile device manager (MDM) to manage mobile phones and tablets. Using the MDM, specific security policies can be created for each mobile device, including the ability to remotely send a remote wipe command that will erase all data on a mobile device. The incorrect answers: A. Containerization Containerization on a mobile device will separate the user’s data from the company information. This allows the company to control their corporate data without modifying or accessing the end user’s data. B. Geofencing Geofencing would allow the company to limit functionality or access based on the location of the mobile device. Geofencing does not securely wipe data from a device. C. Screen locks Screen locks are important, but won’t help when you need to permanently remove data from a device.

Answer 23

The Answer: C. Dump A dump file contains the contents of system memory. In Windows, this file can be created from the Task Manager. The incorrect answers: A. Web Web server logs will document web pages that were accessed, but it doesn't show what information may be contained in the system RAM. B. Packet A packet trace would provide information regarding network communication, but it would not include any details regarding the contents of memory. D. DNS DNS (Domain Name System) server logs can show which domain names were accessed by internal systems, and this information can help identify systems that may be infected. However, the DNS log doesn't include any information about the memory contents of a server.

Answer 24

The Answer: B. Trusted Boot The Trusted Boot portion of the startup process verifies the operating system kernel signature and starts the ELAM (Early Launch Anti-Malware) process. The incorrect answers: A. Measured Boot Measured Boot occurs after the Trusted Boot process and verifies that nothing on the computer has been changed by malicious software or other processes. C. Secure Boot Secure Boot is a UEFI BIOS boot feature that checks the digital signature of the bootloader. The Trusted Boot process occurs after Secure Boot has completed. D. POST POST (Power-On Self-Test) is a hardware check performed prior to booting an operating system.

Answer 25

The Answer: D. A Windows Domain requires a username, password, and smart card The multiple factors of authentication used to login to this Windows Domain are a password (something you know), and a smart card (something you have). The incorrect answers: A. A printer uses a password and a PIN A password and a PIN (Personal Identification Number) are both something you know, so only one authentication factor is used. B. The door to a building requires a fingerprint scan A biometric scan (something you are) is a single factor of authentication. C. An application requires a TOTP code TOTP (Time-based One-Time Password) is usually provided using a hardware dongle or mobile app. This single factor of authentication is something you have.

Answer 26

The Answer: C. VDI A VDI (Virtual Desktop Infrastructure) would allow the field teams to access their applications from many different types of devices without the requirement of a mobile device management or concern about corporate data on the devices. The incorrect answers: A. Corporate-owned A corporate-owned device would solve the issue of device standardization, but the corporate data would be stored on the mobile devices in the field. B. COPE COPE (Corporate Owned and Personally Enabled) devices are purchased by the company but are used as both a corporate device and a personal device. This would standardize the devices, but the corporate data would still be at-risk in the field. D. BYOD BYOD (Bring Your Own Device) means that the employee would choose the mobile platform. This would not address the issue of mobile device management, data security in the field, or standardization of mobile devices and apps.

Answer 27

The Answer: A. Compensating A compensating security control doesn’t prevent an attack, but it does restore from an attack using other means. In this example, the UPS does not stop a power outage, but it does provide alternative power if an outage occurs. The incorrect answers: B. Preventive A preventive control physically limits access to a device or area. C. Administrative An administrative control sets a policy that is designed to control how people act. D. Detective A detective control may not prevent access, but it can identify and record any intrusion attempts.

Answer 28

The Answer: B. Blockchain The ledger functionality of a blockchain can be used to track or verify components, digital media, votes, and other physical or digital objects. The incorrect answers: A. Quantum computing Quantum computing uses quantum theory to perform high-speed calculations. Quantum computing doesn't inherently provide any tracking mechanisms. C. Hashing Cryptographic hashes are commonly used to provide integrity verifications, but they don't necessarily include any method of tracking components on an assembly line. D. Asymmetric encryption Asymmetric encryption uses different keys for encryption and decryption. Asymmetric encryption does not provide any method for tracking objects on an assembly line.

Answer 29

The Answer: D. CPU registers, memory, temporary files, remote monitoring data The most volatile data disappears quickly, so data such as the CPU registers and information in memory will be lost before temporary files and remote monitoring data are no longer available. The incorrect answers: A. CPU registers, temporary files, memory, remote monitoring data Memory is more volatile than temporary files. B. Memory, CPU registers, remote monitoring data, temporary files CPU registers are more volatile than memory, and temporary files are more volatile than remote monitoring data. C. Memory, CPU registers, temporary files, remote monitoring data CPU registers are more volatile than information in memory.

Answer 30

The Answer: A. Verifies that the file was not corrupted during the file transfer Once the file is downloaded, the administrator can calculate the file’s SHA256 hash and confirm that it matches the value on the website. The incorrect answers: B. Provides a key for decrypting the ISO after download ISO files containing public information are usually distributed without any encryption, and a hash value would not commonly be used as a decryption key. C. Authenticates the site as an official ISO distribution site Although it’s important to download files from known good sites, providing a hash value on a site would not provide any information about the site’s authentication. D. Confirms that the file does not contain any malware A hash value doesn’t inherently provide any protection against malware.

Answer 31

The Answer: B. Biometric scanner A biometric scanner would require a person to be physically present to verify authentication. The incorrect answers: A. TOTP A TOTP (Time-based One-Time Password) generator may be associated with a single person, but the TOTP code does not guarantee that a person is physically present. C. PIN Although a PIN (Personal Identification Number) can be used as an authentication factor, the use of the PIN does not guarantee that a person is physically present. D. SMS SMS messages are commonly used as authentication factors. However, the use of a mobile device to receive the SMS message does not guarantee that the owner of the mobile device is physically present.

Answer 32

The Answer: B. Open permissions Just like your local systems, proper permissions and security controls are also required when information is added to a cloud-based system. If any of your systems leave an open door, your data may be accessible by anyone on the Internet. The incorrect answers: A. Improper error handling This issue wasn’t associated with any error messages, so this wouldn’t be categorized as a problem with error handling. C. Race condition If two processes occur simultaneously without any prior consideration, bad things could happen. In this example, a single vulnerability scan has identified the issue and other processes do not appear to be involved. D. Memory leak An application with a memory leak will gradually use more and more memory until the system or application crashes. The issue in this question was related to permissions and not available resources.

Answer 33

The Answer: D. Phishing Phishing is the process of manipulating a victim to disclose personal or private information. An email asking for login details from a server not under the control of the company would describe a phishing attempt. The incorrect answers: A. Whaling Whaling is phishing targeted towards individuals at a higher level of an organization. These persons are usually in upper management or have access to the financial operations of the company. B. Vishing Vishing, or voice phishing, is using voice communication for the phishing process. This phishing attempt used an email message, so it would not be categorized as vishing. C. Smishing Smishing, or SMS phishing, is an attacker using SMS or text messaging when phishing. Smishing text messages often include a link to a server where personal information or login credentials may be requested by the attacker.

Answer 34

The Answer: B. Mitigation Mitigation is a strategy that decreases the threat level. This is commonly done through the use of additional security systems and monitoring, such as an NGFW (Next-Generation Firewall). The incorrect answers: A. Transference Transference would move the risk from one entity to another. Adding an NGFW would not transfer any risk to another party. C. Acceptance The acceptance of risk is a position where the owner understands the risk and has decided to accept the potential results. D. Risk-avoidance With risk-avoidance, the owner of the risk decides to stop participating in a high-risk activity. This effectively avoids the risky activity and prevents any future issues.

Answer 35

The Answer: B. Perform an integrity measurement An integrity measurement is designed to check for the secure baseline of firewall settings, patch levels, operating system versions, and any other security components associated with the application. These secure baselines may vary between different application versions. The incorrect answers: A. Compare the production application to the sandbox A sandbox is commonly used as a development environment. Security baselines in a production environment can be quite different when compared to the code in a sandbox. C. Compare the production application to the previous version The newer version of an application may have very different security requirements than previous versions. D. Perform QA testing on the application instance QA (Quality Assurance) testing is commonly used for finding bugs and verifying application functionality. The primary task of QA is not generally associated with verifying security baselines.

Answer 36

The Answer: C. Job rotation Job rotation moves employees through different job roles as part of their normal work environment. This policy limits the potential for fraud and allows others to cover responsibilities if someone is out of the office. The incorrect answers: A. Split knowledge The use of split knowledge limits the information that any one person would know. In this example, having knowledge of part of the process would not have helped with processing the financial transfer. B. Least privilege Least privilege is a security policy that limits the rights and permissions of a user to only those tasks required for their job role. In this example, having properly configured privileges would not have provided any contingency for this delayed transaction. D. Dual control With dual control, two persons must be present to perform a business function. In this example, one of the employees is out of the office and dual control would not be possible.

Answer 37

The Answer: D. Someone is performing a traceroute to the DMZ server A traceroute maps each hop by slowly incrementing the TTL (Time to Live) value during each request. When the TTL reaches zero, the receiving router drops the packet and sends an ICMP (Internet Control Message Protocol) TTL Exceeded message back to the original station. The incorrect answers: A. Someone is performing a vulnerability scan against the firewall and DMZ server Vulnerability scans are usually very specific requests, and they won’t get to their destination if the TTL is zero. The question did not provide any information that would indicate an active vulnerability scan. B. Users are performing DNS lookups Properly working DNS (Domain Name System) responses would not have a TTL of zero, and nothing in the question indicated information that would commonly be included in a DNS query. C. A remote user is grabbing banners of the firewall and DMZ server Banners can provide useful reconnaissance information about a service, but the TTL of zero and the lack of connection to a specific service would not indicate a banner grabbing session.

Answer 38

The Answer: A. Buffer overflow The results of a buffer overflow can cause random results, but sometimes the actions can be repeatable and controlled. In the best possible case for the hacker, a buffer overflow can be manipulated to execute code on the remote device. The incorrect answers: B. Replay attack A replay attack does not require the sending of more information than expected, and often a replay attack consists of normal traffic and expected application input. C. Session hijacking Session hijacking doesn't require any data overflows, and commonly the hijack occurs without any unusual input. D. DDoS A DDoS (Distributed Denial of Service) renders a service unavailable, and it involves the input of many devices to operate. A DDoS would not require sending more information than expected, and it rarely results in the execution of arbitrary code.

Answer 39

The Answer: A. Private With asymmetric encryption, the private key is used to decrypt information that has been encrypted with the public key. To ensure continued access to the encrypted data, the company must have a copy of each private key. The incorrect answers: B. CA A CA (Certificate Authority) key is commonly used to validate the digital signature from a trusted CA. This is not commonly used for user data encryption. C. Session Session keys are commonly used temporarily to provide confidentiality during a single session. Once the session is complete, the keys are discarded. Session keys are not used to provide long-term data encryption. D. Public In asymmetric encryption, a public key is already available to everyone. It would not be necessary to escrow a public key.

Answer 40

The Answer: C. Kerberos Kerberos uses a ticket-based system to provide SSO (Single Sign-On) functionality. You only need to authenticate once with Kerberos to gain access to multiple resources. The incorrect answers: A. TACACS+ TACACS+ (Terminal Access Controller Access-Control System) is a common authentication method, but it does not provide any single signon functionality. B. LDAPS LDAPS (Lightweight Directory Access Protocol Secure) is a standard for accessing a network directory. This can provide an authentication method, but it does not provide any single sign-on functionality. D. 802.1X 802.1X is a standard for port-based network access control (PNAC), but it does not inherently provide any single sign-on functionality.

Answer 41

The Answer: D. Create separate VLANs for the corporate network and the manufacturing floor Creating VLANs (Virtual Local Area Networks) will segment a network without requiring additional switches. The incorrect answers: A. Connect the corporate network and the manufacturing floor with a VPN A VPN (Virtual Private Network) would encrypt all information between the two networks, but it would not provide any segmentation. This process would also commonly require additional hardware to provide VPN connectivity. B. Build an air gapped manufacturing floor network An air gapped network would require separate physical switches on each side of the gap, and this would require the purchase of an additional switch. C. Use personal firewalls on each device While personal firewalls provide protection for individual devices, they do not segment networks. It’s also uncommon for personal firewalls to be installed on manufacturing equipment.

Answer 42

The Answer: D. The VPN tunnel is configured for full tunnel A split tunnel is a VPN (Virtual Private Network) configuration that only sends a portion of the traffic through the encrypted tunnel. A split tunnel would allow work-related traffic to securely traverse the VPN, and all other traffic would use the non-tunneled option. In this example, the printer traffic is being redirected through the VPN instead of the local home network because of the non-split/full tunnel. The incorrect answers: A. The VPN uses IPSec instead of SSL There are many protocols that can be used to send traffic through an encrypted tunnel. IPsec is commonly used for site-to-site VPN connections, and SSL (Secure Sockets Layer) is commonly used for enduser VPN connections. However, either protocol can technically be used for any VPN tunnel, and the choice of protocol would have no difference on the operation of the local printer. B. Printer traffic is filtered by the VPN client VPN clients are usually tasked with sending traffic unfiltered through the encrypted tunnel. Although data could be filtered at some point along the communication path, it’s not commonly filtered by the VPN client. C. The VPN is stateful A stateful communication is commonly associated with firewalls, and it refers to the firewall’s ability to track traffic flows. Stateful communication would not be a technology commonly associated with a VPN, and it would not be part of the user’s printing issue.

Answer 43

The Answer: A. Protect the servers against any unwanted electromagnetic fields A Faraday cage is a mesh of conductive material that will cancel electromagnetic fields. The incorrect answers: B. Prevent physical access to the servers without the proper credentials A Faraday cage does not provide any protection against system logins. C. Provide additional cooling to all devices in the cage A Faraday cage does not provide any additional cooling features. D. Adds additional fire protection for the application servers A Faraday cage does not provide any additional fire protection features.

Answer 44

The Answer: D. Continuous monitoring It’s common for organizations to continually monitor services for any changes or issues. A nightly vulnerability scan across important servers would identify issues like this one. The incorrect answers: A. Templates Templates can be used to easily build the basic structure of an application instance. These templates are not used to identify or prevent the introduction of vulnerabilities. B. Elasticity Elasticity is important when scaling resources as the demand increases or decreases. Unfortunately, elasticity will not help with the identification of vulnerabilities. C. Master image A master image is used to quickly copy a server for easy deployment. This image will need to be updated and maintained to prevent the issues associated with unexpected vulnerabilities.

Answer 45

The Answer: A. Salting Adding random data, or salt, to a password when performing the hashing process will create a unique hash, even if other users have chosen the same password. The incorrect answers: B. Obfuscation Obfuscation is the process of making something difficult for humans to read or understand. The obfuscation process isn't commonly associated with adding random information to hashes. C. Key stretching Key stretching is a process that uses a key multiple times for additional protection against brute force attacks. Key stretching by itself does not commonly add random data to the hashing process. D. Digital signature Digital signatures use a hash and asymmetric encryption to provide integrity of data. Digital signatures aren't commonly used for storing passwords.

Answer 46

The Answer: D. Digital signature A certificate authority will digitally sign a certificate to add trust. If you trust the certificate authority, you can then trust the certificate. The incorrect answers: A. X.509 The X.509 standard defines the structure of a certificate. This standard format makes it easy for everyone to view the contents of a certificate, but it doesn’t provide any additional trust. B. Hash A hash can help verify that the certificate has not been altered, but it does not provide additional third-party trust. C. Symmetric encryption Symmetric encryption has the same issue as asymmetric encryption. The information in a certificate commonly needs to be viewable by others.

Answer 47

The Answer: C. RAID arrays and D. Dual power supplies RAID (Redundant Array of Independent Disks) and dual power supplies can both provide uptime and availability if a drive or component fails. Many RAID configurations can continue to operate if a drive fails, and a system with two power supplies can continue to operate if one of those was to fail. The incorrect answers: A. SIEM A SIEM (Security Information and Event Manager) is a useful part of any network configuration, but it does not provide for uptime and availability during a failure. B. Temperature monitors Temperature monitors can provide an early-warning notification of an HVAC (Heating, Ventilation, and Air Conditioning) issue, but they don't provide any redundancy if the cooling system fails. E. Hot and cold aisles Hot and cold aisles will provide the most efficient cooling, but they don't provide any redundant features. F. Biometric locks Biometric locks are commonly found on server room and data center entrances, but they don't provide any redundancy for the systems inside.

Answer 48

The Answer: D. Data custodian The data custodian manages access rights and sets security controls to the data. The incorrect answers: A. Data processor The data processor manages the operational use of the data, but not the rights and permissions to the information. B. Data owner The data owner is usually a higher-level executive who makes business decisions regarding the data. C. Privacy officer A privacy officer sets privacy policies and implements privacy processes and procedures.

Answer 49

The Answer: C. Expanded privacy compliance The labeling of PII (Personally Identifiable Information) is often associated with privacy and compliance concerns. The incorrect answers: A. Healthcare system integration Healthcare data would most likely be labeled as PHI (Protected Health Information). Personal information isn’t necessarily health-related. B. Simplified categorization Adding additional categories would not commonly be considered a simplification. D. Decreased search time Adding additional classifications would not necessarily provide any decreased search times.

Answer 50

The Answer: A. Use an HSM An HSM (Hardware Security Module) is a high-end cryptographic hardware appliance that can securely store keys and certificates for all devices. The incorrect answers: B. Implement full disk encryption on the web servers Full-disk encryption would only protect the keys if someone does not have the proper credentials, and it won’t help consolidate all of the web server keys to a central point. C. Use a TPM A TPM (Trusted Platform Module) is used on individual devices to provide cryptographic functions and securely store encryption keys. Individual TPMs would not provide any consolidation of web server private keys. D. Upgrade the web servers to use a UEFI BIOS A UEFI (Unified Extensible Firmware Interface) BIOS (Basic Input/Output System) does not provide any additional security or consolidation features for web server private keys.

Answer 51

The Answer: B. The alert was generated from an embedded script and C. The attacker’s IP address is 222.43.112.74 The details of the IPS (Intrusion Prevention System) alert show a script value embedded into JSON ( JavaScript Object Notation) data. The IPS log also shows the flow of the attack with an arrow in the middle. The attacker was IP address 222.43.112.74 with port 3332, and the victim was 64.235.145.35 over port 80. The incorrect answers: A. The alert was generated from a malformed User Agent header The user agent information is provided as additional supporting data associated with the alert. The agent itself is not the cause of this alert. D. The attacker’s IP address is 64.235.145.35 The attacker’s IP address is listed first, so the victim's IP address is 64.235.145.35. E. The alert was generated due to an invalid client port number The port number associated with the client, 3332, is a valid port number and not associated with the cause of the alert.

Answer 52

The Answer: B. SLE SLE (Single Loss Expectancy) describes the financial impact of a single event. The incorrect answers: A. ALE ALE (Annual Loss Expectancy) is the financial loss over an entire 12-month period. C. RTO RTO (Recovery Time Objectives) define a set of objectives needed to restore a particular service level. D. ARO The ARO (Annualized Rate of Occurrence) is the number of times an event will occur in a 12-month period

Answer 53

The Answer: C. SQL injection SQL (Structured Query Language) injection takes advantage of poor input validation to circumvent the application and perform queries directly to the database. The incorrect answers: A. CSRF CSRF (Cross-Site Request Forgery) takes advantage of a third-party trust to a web application. The attack demonstrated in this question does not use another user's credentials or access rights to obtain information. B. Buffer overflow A buffer overflow uses an application vulnerability to submit more information than an application can properly manage. The attack syntax in this question is specific to SQL injections, and it does not appear to be manipulating a buffer overflow vulnerability. D. SSL stripping SSL stripping allows an on-path attack to rewrite web site addresses to gain access to encrypted information. The attack in this question does not include a third-party or on-path entity.

Answer 54

The Answer: C. RAT A RAT (Remote Access Trojan) is malware that can control a computer using desktop sharing and other administrative functions. Because the installation program is often disguised as something else, the victim often doesn’t realize they’re installing malware. Once the RAT is installed, the attacker can control the desktop, capture screenshots, reboot the computer, and many other administrative functions. The incorrect answers: A. Man-in-the-middle A man-in-the-middle attack commonly occurs without any knowledge to the parties involved, and there’s usually no additional notification that an attack is underway. B. Worm A worm is malware that can replicate itself between systems without any user intervention, so a spreadsheet that requires additional a user to click warning messages would not be categorized as a worm. D. Logic bomb A logic bomb is malware that installs and operates silently until a certain event occurs. Once the logic bomb has been triggered, the results usually involve loss of data or a disabled operating system.

Answer 55

The Answer: C. PCI DSS The PCI DSS (Payment Card Industry Data Security Standard) specifies the minimum security requirements for storing and protecting credit card information. The incorrect answers: A. GDPR GDPR (General Data Protection Regulation) is a European Union regulation that governs data protection and privacy for individuals in the EU. B. ISO 27001 The ISO (International Organization for Standardization) 27001 standard focuses on the requirements for an Information Security Management System (ISMS). D. CSA CCM The CSA CCM (Cloud Security Alliance Cloud Controls Matrix) provides documents for implementing and managing cloud-specific security controls.

Answer 56

The Answer: B. Backdoor A backdoor would allow an attacker to access a system at any time without any user intervention. If there are inbound traffic flows that cannot be identified, it may be necessary to isolate that computer and examine it for signs of a compromised system. The incorrect answers: A. ARP poisoning ARP (Address Resolution Protocol) poisoning is a local exploit that is often associated with a man-in-the-middle attack. The attacker must be on the same local IP subnet as the victim, so this is not often associated with an external attack. C. Polymorphic virus Polymorphic viruses will modify themselves each time they are downloaded. Although a virus could potentially install a backdoor, a polymorphic virus would not be able to install itself without user intervention. D. Trojan horse A Trojan horse is malware that is hidden inside of a seemingly harmless application. Once the Trojan horse is executed, the malware will be installed onto the victim’s computer. Trojan horse malware could possibly install backdoor malware, but the Trojan horse itself would not be the reason for these traffic patterns.

Answer 57

The Answer: B. DLP DLP (Data Loss Prevention) technologies can identify and block the transmission of sensitive data across the network. The incorrect answers: A. IPS IPS (Intrusion Prevention System) signatures are useful for identifying known vulnerabilities, but they don't commonly provide a way to identify and block PII (Personally Identifiable Information) or sensitive data. C. SMTP SMTP (Simple Mail Transfer Protocol) is a protocol used to transfer email messages between servers. SMTP does not identify the transmission of sensitive data. D. IPsec IPsec (Internet Protocol Security) is a protocol suite for authenticating and encrypting network communication. IPsec does not include any features for identifying and alerting on sensitive information.

Answer 58

The Answer: A. The server is a honeypot for attracting potential attackers A screened subnet is a good location to configure services that can be accessed from the Internet, and building a system that can be easily compromised is a common tactic for honeypot systems. The incorrect answers: B. The server is a cloud storage service for remote users Although cloud storage is a useful service, configuring storage on a server with an open guest account is not a best practice. C. The server will be used as a VPN concentrator VPN (Virtual Private Networking) concentrators should be installed on secure devices, and configuring an open guest account would not be considered a secure configuration. D. The server is a development sandbox for third-party programming projects It would not be secure to configure a development sandbox on a system with an open guest account.

Answer 59

The Answer: B. Require the use of S/MIME S/MIME (Secure/Multipurpose Internet Mail Extensions) provides a way to integrate public key encryption and digital signatures into most modern email clients. This would encrypt all email information from client to client, regardless of the communication used between email servers. The incorrect answers: A. Implement Secure IMAP Secure IMAP (Internet Message Access Protocol) would encrypt communication downloaded from an email server, but it would not provide any security for outgoing email messages. C. Install an SSL certificate on the email server An SSL certificate on an email server could potentially be used to encrypt server-to-server communication, but the security administrator is looking for an encryption method between email clients. D. Use a VPN tunnel between email clients Email communication does not occur directly between email clients, so configuring a VPN between all possible email recipients would not be a valid implementation.

Answer 60

The Answer: A. Containerization Application containerization uses a single virtual machine to use as a foundation for separate application "containers." These containers are implemented as isolated instances, and an application in one container is not inherently accessible from other containers on the system. The incorrect answers: B. IaaS IaaS (Infrastructure as a Service) is a cloud-based service that provides the basic infrastructure for installing operating systems and applications. By itself, IaaS does not provide any method of application deployments or virtual machines. C. Proxies Proxies can be used as security devices, but they aren't used for deploying application instances without virtual machines. D. CASB A CASB (Cloud Access Security Broker) is a cloud security solution to manage visibility, compliance, threat prevention, and other security features for cloud-based applications.

Answer 61

The Answer: D. Penetration test A penetration test can be used to actively exploit potential vulnerabilities in a system or application. This could cause a denial of service or loss of data, so the best practice is to perform the penetration test during nonproduction hours or in a test environment. The incorrect answers: A. Tabletop exercise A tabletop exercise is used to talk through a security event with an incident response team around a conference room table. This is commonly performed as a training device instead of performing a full-scale disaster drill. B. Vulnerability scanner Vulnerability scanners may identify a vulnerability, but they do not actively attempt to exploit the vulnerability. C. Password cracker A password cracker is usually an offline brute force tool used against a list of password hashes. A password cracker may be able to identify weak passwords, but it would not identify any other types of vulnerabilities.

Answer 62

The Answer: A. Server hardening Many applications and services include secure configuration guides that can assist in hardening the system. These hardening steps will make the system as secure as possible while simultaneously allowing the application to run efficiently The incorrect answers: B. Multi-factor authentication Although multi-factor authentication is always a good best practice, simply enabling multiple authentication methods would not resolve the issues identified during the audit. C. Enable HTTPS Most web servers will use HTTPS to ensure that network communication is encryption. However, the encrypted network traffic would not correct the issues identified during the audit. D. Run operating system updates Keeping the system up to date is another good best practice, but the issues identified during the audit were not bugs related to the operating systems. All of the issues identified in the audit appear to be related to the configuration of the web server, so any resolution will focus on correcting these configuration issues.

Answer 63

The Answer: D. Detective An IPS can detect and record any intrusion attempt. The incorrect answers: A. Administrative Administrative controls would control how people act, such as security policies and standard operating procedures. B. Compensating A compensating control can’t prevent an attack, but it can compensate when an attack occurs. For example, a compensating control would be the re-imaging process or a server restored from backup if an attack had been identified. C. Physical A physical control would block access. For example, a door lock or security guard would be a physical control.

Answer 64

The Answer: A. Data owner The data owner is accountable for specific data, and is often a senior officer of the organization. The incorrect answers: B. Data protection officer The data protection officer (DPO) is responsible for the organization's data privacy. The DPO commonly sets processes and procedures for maintaining the privacy of data. C. Data steward The data steward manages access rights to the data. In this example, the IT team would be the data steward. D. Data processor The data processor is often a third-party that processes data on behalf of the data controller

Answer 65

The Answer: B. OSINT OSINT (Open Source Intelligence) describes the process of obtaining information from open sources, such as social media sites, corporate websites, online forums, and other publicly available locations. The incorrect answers: A. Partially known environment A partially known environment test describes how much information the attacker knows about the test. The attacker may have access to some information about the test, but not all information is disclosed. C. Exfiltration Exfiltration describes the theft of data by an attacker. D. Active footprinting Active footprinting would show some evidence of data gathering. For example, performing a ping scan or DNS query wouldn’t exploit a vulnerability, but it would show that someone was gathering information.

Answer 66

The Answer: D. SOAR SOAR (Security Orchestration, Automation, and Response) provides security teams with integration and automation of processes and procedures. The incorrect answers: A. Active footprinting Active footprinting will gather information about a system, but it does not provide any ongoing monitoring or response features. B. IaaS IaaS (Infrastructure as a Service) is a type of cloud service that provides the basic hardware required to install an OS and application. IaaS does not provide ongoing monitoring for security events or automation features. C. Vulnerability scan A vulnerability scan will identify any known vulnerabilities that may be associated with a system. However, a vulnerability scan will not identify real-time infections or automate the response.

Answer 67

The Answer: C. Invoice scam Invoice scams attempt to take advantage of the miscommunication between different parts of the organization. Fake invoices are submitted by the attacker, and these invoices can sometimes be incorrectly paid without going through the expected verification process. The incorrect answers: A. Spear phishing Spear phishing is a directed attack that attempts to obtain private or personal information. In this example, the result was to obtain payment and not to gather private information. B. Watering hole attack A watering hole attack requires users to visit a central website or location. This example did not require the user to visit any third-party websites. D. Credential harvesting Credential harvesting attempts to transfer password files and authentication information from other computers.

Answer 68

The Answer: D. VM escape A VM (Virtual Machine) escape is a vulnerability that allows communication between separate VMs. The incorrect answers: A. Containerization Containerization is an application deployment architecture that uses a self-contained group of application code and dependencies. Many separate containers can run on a single system B. Service integration Service Integration and Management (SIAM) allows the integration of many different service providers into a single management system. This simplifies the application management and deployment process when using separate cloud providers. C. SDN SDN (Software-Defined Networking) separates the control plane of networking devices from the data plane. This allows for more automation and dynamic changes to the infrastructure.

Answer 69

The Answer: D. DNS poisoning An attacker that gains access to a DNS (Domain Name System) server can modify the configuration files and redirect users to a different website. Anyone using a different DNS server may not see any problems with connectivity to the original site. The incorrect answers: A. Bluejacking Bluejacking allows a third-party to send unsolicited messages to another device using Bluetooth. The attack in this example did not use Bluetooth as an attack vector. B. Wireless disassociation Wireless disassociation would cause users on a wireless network to constantly disconnect. Wireless disassociation would not cause a redirection of a website URL (Uniform Resource Locator). C. DDoS DDOS (Distributed Denial of Service) would attack a service from many different devices and cause the service to be unavailable. In this example, the service did not have any availability problems to valid users.

Answer 70

The Answer: C. Authentication The process of proving who you say you are is authentication. In this example, the password and smart card are two factors of authentication, and both reasonably prove that the person logging in is authentic. The incorrect answers: A. Federation Federation provides a way to authenticate and authorize between two different organizations. In this example, the authentication process uses internal information without any type of connection or trust to a third-party. B. Accounting Accounting will document information regarding a user’s session, such as login time, data sent and received, files transferred, and logout time. D. Authorization The authorization process assigns users to resources. This process commonly occurs after the authentication process is complete.

Answer 71

The Answer: C. Partially known environment A partially known environment test is performed when the attacker knows some information about the victim, but not all information is available. The incorrect answers: A. Known environment A known environment test is performed when the attacker has complete details about the victim’s systems and infrastructure. B. Passive footprinting Passive footprinting is the process of gathering information from publicly available sites, such as social media or corporate websites. D. Ping scan A ping scan is a type of network scan that can identify devices connected to the network. A ping scan is not a type of penetration test.

Answer 72

The Answer: D. Photo and video use The exfiltration of company confidential information is relatively simple with an easily transportable camera or video recorder. Organizations associated with sensitive products or services must always be aware of the potential for information leaks using photos or video. The incorrect answers: A. Unauthorized software on rooted devices Although unauthorized software use can be a security issue, it isn’t as significant as the exfiltration of company confidential information. B. Remote access clients on the mobile devices It’s sometimes convenient to have a remote access client available, and this type of access can certainly be a concern if the proper security is not in place. However, the much more significant security issue in this list would be associated with the ease of photos and videography when working with confidential information. C. Out of date mobile operating systems Having an outdated operating system can potentially include security vulnerabilities, but these vulnerabilities do not have the significance of an active data exfiltration method.

Answer 73

The Answer: D. Elasticity Elasticity is the process of providing resources when demand increases and scaling down when the demand is low. The incorrect answers: A. Availability Availability describes the ability to use a service, but it doesn’t directly describe the ability of the service resources to grow or shrink based on demand. B. Orchestration The process of automating the configuration, maintenance, and operation of an application instance is called orchestration. The description of the application requirement didn’t mention the use of automation when scaling resources. C. Imaging Imaging is a technique that allows a system administrator to build a specific operating system and application configuration. This configuration can then be saved as an “image” and easily deployed to other systems.

Answer 74

The Answer: D. Wireshark Wireshark is a protocol analyzer, and it can provide information about every frame that traverses the network. From a security perspective, the protocol decode can show the exploitation process and details about the payloads used during the attempt. The incorrect answers: A. Netstat The netstat command can display connectivity information about a device, but it won’t provide any additional details about an exploit attempt. B. Nmap An Nmap scan is a useful tool for understanding the potential exploit vectors of a device, but it won’t show information about an active exploitation attempt. C. Nessus Nessus is a vulnerability scanner that can help identify potential exploit vectors, but it’s not useful for showing active exploitation attempts by a third-party.

Answer 75

The Answer: D. FTPS FTPS (File Transfer Protocol Secure) provides mechanisms for transferring files using encrypted communication. The incorrect answers: A. SNMPv3 SNMPv3 (Simple Network Management Protocol version 3) uses encrypted communication to manage devices, but it is not used for secure file transfers between devices. B. SRTP SRTP (Secure Real-Time Transport Protocol) is used for secure voice over IP and media communication across the network. C. DNSSEC DNSSEC (Domain Name System Secure Extensions) are used on DNS servers to validate DNS responses using public key cryptography.

Answer 76

The Answer: C. VLAN A VLAN (Virtual Local Area Network) is a common method of logically segmenting a network. The devices in each segmented VLAN can only communicate with other devices in the same VLAN. A router is used to connect VLANs, and this router can often be used to control traffic flows between VLANs. The incorrect answers: A. VPN A VPN (Virtual Private Network) is an encryption technology that can be used to secure network connections between sites or remote enduser communication. VPNs are not commonly used to segment internal network communication. B. RBAC RBAC (Role-Based Access Control) describes a control mechanism for managing rights and permissions in an operating system. RBAC is not used for network segmentation. D. NAT NAT (Network Address Translation) is used to modify the source or destination IP address or port number of a network traffic flow. NAT would not be used when segmenting internal networks.

Answer 77

The Answer: B. Jump server A jump server is a highly secured device commonly used to access secure areas of another network. The technician would first connect to the jump server using SSH or a VPN tunnel, and then "jump" from the jump server to other devices on the inside of the protected network. This would allow technicians at an MSP (Managed Service Provider) to securely access devices on their customer's network. The incorrect answers: A. HSM An HSM (Hardware Security Module) is a secure method of cryptographic key backup and hardware-based cryptographic offloading. C. NAC NAC (Network Access Control) is a broad term describing access control based on a health check or posture assessment. NAC will deny access to devices that don't meet the minimum security requirements. D. Air gap An air gap is a segmentation strategy that separates devices or networks by physically disconnecting them from each other.

Answer 78

The Answer: D. MTBF The MTBF (Mean Time Between Failures) is the average time expected between outages. This is usually an estimation based on the internal device components and their expected operational lifetime. The incorrect answers: A. MTTR MTTR (Mean Time to Repair) is the time required to repair a product or system after a failure. B. RPO RPO (Recovery Point Objectives) define how much data loss would be acceptable during a recovery. C. RTO RTO (Recovery Time Objectives) define the minimum objectives required to get up and running to a particular service level.

Answer 79

The Answer: C. Geofencing Geofencing uses location information from GPS (Global Positioning System), 802.11 wireless, and other methods to use as an access control method. The incorrect answers: A. WAF A WAF (Web Application Firewall) is used to protect exploits against web-based applications. B. VPN A VPN (Virtual Private Network) is commonly used to provide access to local resources from outside the local network. A VPN-connected user would not be physically located in the corporate office. D. Proxy A proxy is used to make network or application requests on behalf of another person or device. A proxy does not ensure that someone would be physically located in the headquarters building.

Answer 80

The Answer: A. PIN and fingerprint A PIN (Personal Identification Number) is something you know, and a fingerprint is something you are. The incorrect answers: B. USB token and smart card A USB token and a smart card are both something you have. Both of these describe a single factor of authentication. C. Username, password, and email address A password is something you know, but a username and email address claim an identity but do not authenticate or prove the identity. D. Face scan and voiceprint Both a face scan and a voiceprint are biometric factors, or something you are. Both of these describe a single factor of authentication.

Answer 81

The Answer: B. RADIUS The RADIUS (Remote Authentication Dial-In User Service) protocol is a common method of centralizing authentication for users. Instead of having separate local accounts on different devices, users can authenticate with account information that is maintained in a centralized database. The incorrect answers: A. PAP PAP (Password Authentication Protocol) is an authentication method that can validate a username and password, but PAP does not provide any mechanism for a centralized authentication database. C. IPsec IPsec is commonly used as an encrypted tunnel between sites or endpoints. It’s useful for protecting data sent over the network, but IPsec isn’t used to centralize the authentication process. D. MS-CHAP MS-CHAP (Microsoft Challenge-Handshake Authentication Protocol) was commonly used in Microsoft’ PPTP (Point-to-Point Tunneling Protocol), but vulnerabilities related to the use of DES (Data Encryption Standard) encryption make it relatively easy to brute force the NTLM hash used in MS-CHAP.

Answer 82

The Answer: C. Least privilege The policy of least privilege limits the rights and permissions of a user account to only the access required to accomplish their objectives. This policy would limit the scope of an attack originating from a user in the IT department. The incorrect answers: A. Separation of duties A separation of duties policy ensures that multiple users are required to complete a single business process. Limiting the access of a user account to match their normal job requirements would not be a separation of duties. B. Offboarding The offboarding process describes the policies and procedures associated with someone leaving the organization or someone who is no longer an employee of the company. D. Discretionary Access Control With discretionary access control (DAC), access and permissions are determined by the owner or originator of the files or resources.

Answer 83

The Answer: C. Insecure protocols An insecure protocol will transmit information "in the clear," or without any type of encryption or protection. The incorrect answers: A. Weak encryption A weak encryption cipher will appear to protect data, but instead can be commonly circumvented to reveal the plaintext. In this example, the email addresses and passwords were not encrypted and could be viewed in a packet capture. B. Improper patch management Maintaining systems to the latest patch version will protect against vulnerabilities and security issues. Sending information in the clear over the network is not commonly associated with an unpatched system. D. Open ports Open ports are usually associated with a service or application on a device. An open port is not commonly associated with any encryption or protected network communication.

Answer 84

The Answer: A. Brute force A WPS personal identification number (PIN) was designed to have only 11,000 possible iterations, making a brute force attack possible if the access point doesn’t provide any protection against multiple guesses. The incorrect answers: B. Client hijacking The processes of adding a device through WPS occurs well before any app or client is used. C. Cryptographic vulnerability The vulnerability in WPS is based on a limited number of PIN options and not a cryptographic shortcoming. D. Spoofing Spoofing an existing device would not provide access to a WPS-enabled network.

Answer 85

The Answer: B. Acceptance Risk acceptance is a business decision that places the responsibility of the risky activity on the organization itself. The incorrect answers: A. Mitigation If the organization was to purchase additional backup facilities and update their backup processes to include offline backup storage, they would be mitigating the risk of a ransomware infection. C. Transference Purchasing insurance to cover a risky activity is a common method of transferring risk from the organization to the insurance company. D. Risk-avoidance To avoid the risk of ransomware, the organization would need to completely disconnect from the Internet and disable all methods that ransomware might use to infect a system. This risk response technique would most likely not apply to ransomware.

Answer 86

The Answer: C. Hacktivist A hacktivist often has a political statement to make, and their hacking efforts would commonly result in a public display of that information. The incorrect answers: A. Organized crime Organized crime is usually motivated by money. An organized crime group is more interested in stealing information than defacing sites. B. Nation state Nation states are highly sophisticated hackers, and their efforts are usually focused on obtaining confidential government information or disrupting governmental operations. D. Competitor A competitor may be interested in making another company look bad, but the reason for the denial of services is not commonly based on a political agenda.

Answer 87

The Answer: D. Disconnect the web servers from the network The unusual log entries on the web server indicate that the system may have been exploited. In that situation, the servers should be isolated to prevent access to or from those systems. The incorrect answers: A. Check the IPS logs for any other potential attacks Before looking for additional exploits, the devices showing a potential exploit should be isolated and contained. B. Create a plan for removing malware from the web servers The recovery process should occur after the systems have been isolated and contained. C. Disable any breached user accounts This is part of the recovery process, and it should occur after isolation and containment of the exploited servers.

Answer 88

The Answer: A. The antivirus application identified three viruses and quarantined two viruses The logs are showing the name of files on the local device and a quarantine disposition, which indicates that two of the files were moved (quarantined) to a designated area of the drive. This will prevent the malicious files from executing and will safely store the files for any future investigation. The second file in the list failed the quarantine process, and was most likely because the library was already in use by the operating system and could not be moved. The incorrect answers: B. The host-based firewall blocked two traffic flows A host-based firewall will allow or deny traffic flows based on IP address, port number, application, or other criteria. A host-based firewall does not block traffic flows based on the name of an existing file, and the firewall process would not quarantine or move files to other folders. C. A host-based whitelist has blocked two applications from executing The “quarantine” disposition refers to a file that has been moved from one location to another. A whitelist function would simply stop the application from executing without changing the location of an application file. D. A network-based IPS has identified two known vulnerabilities The logs from a network-based IPS (Intrusion Prevention System) would not commonly be located on a user’s laptop, and those logs would display allow or deny dispositions based on the name of a known vulnerability. A network-based IPS would also not commonly move (quarantine) files on an end-user’s computer

Answer 89

The Answer: A. Sideloading If Apple’s iOS has been circumvented using jailbreaking, then apps can be installed without using the Apple App Store. This installation process that circumvents the App Store is called sideloading. The incorrect answers: B. MMS install Text messages that prompt to install an application will link to the App Store version of the application. C. OTA updates OTA (Over the Air) updates are commonly provided from the carrier and are not part of mobile app installations. D. Tethering Tethering uses a mobile phone as a communications medium to the Internet, and it does not have any relationship to the apps that are installed on the mobile device.

Answer 90

The Answer: A. RAID 1 RAID (Redundant Array of Independent Disks) type 1 maintains a mirror (or exact duplicate) of data across multiple drives. If a single drive was to fail, the mirror would continue to operate with the redundant data. The incorrect answers: B. RAID 5 RAID 5 provides redundancy through striping with parity. Although RAID 5 arrays would continue to operate through a single drive failure, the data is not replicated across drives. C. RAID 0 RAID 0 is a striped storage system with no parity, and a single drive failure does not maintain uptime or any redundancy of data. D. RAID 10 RAID 10 or RAID 1+0 maintains mirrored drives that contain striped data.

Answer 91

The Answer: B. CASB A CASB (Cloud Access Security Broker) is used to implement and manage security policies when working in a cloud-based environment. The incorrect answers: A. VPN A VPN (Virtual Private Network) can provide an encrypted tunnel for data transfers, but it doesn't provide any monitoring or threat identification. C. NGFW An NGFW (Next-Generation Firewall) is a useful security tool, but it doesn't provide any cloud-based security policy monitoring. D. DLP DLP (Data Loss Prevention) can monitor data to prevent the transfer of sensitive information, but it doesn't identify threats or force the transfer of encrypted data.

Answer 92

The Answer: A. Physical A physical control includes real-world security features such as fences, locks, or bollards. The incorrect answers: B. Corrective A corrective control is designed to mitigate any potential damage. A bollard does not provide any mitigation functions. C. Detective A detective security control may not prevent access, but it can identify and record a security event. A bollard does not identify or record security events. D. Compensating A compensating attack doesn't provide any prevention, but it can restore access through other means. A bollard does not have any method of compensating for a potential attack.

Answer 93

The Answer: B. Default configuration When a device is first installed, it will often have a default set of credentials, such as admin/password or admin/admin. Many times, these default credentials are never changed and can allow access by anyone who knows the default configuration. The incorrect answers: A. Improper error handling Error messages can sometimes provide additional information about a system. In this case, there were no error messages to provide additional reconnaissance. C. Weak cipher suite A weak cipher suite implies that the cryptography used in a system may be circumvented or decrypted. In this question, there wasn’t any cryptography to consider as a weakness. D. NULL pointer dereference A NULL pointer dereference is a programming issue that causes application crashes and a potential denial of service. In this question, the issue wasn’t relating to crashes or DoS issues.

Answer 94

The Answer: D. Watering hole A watering hole attack infects a third-party visited by the intended victims. An industry convention would be a perfect location to attack security professionals. The incorrect answers: A. Smishing Smishing, or SMS phishing, is a phishing attack over text messaging. A security administrator attending an industry event would not be the best possible scenario for smishing. B. Supply chain A supply chain attack infects part of the product manufacturing process in an attempt to also infect everything further down the chain. An industry trade event would not be a common vector for a supply chain attack. C. Impersonation Impersonation attacks use misdirection and pretext to allow an attacker to pretend they are someone else. An industry trade show is not a common environment for an impersonation attack.

Answer 95

The Answers: A. UPS and F. Dual power supplies A UPS (Uninterruptible Power Supply) can provide backup power when the main power source is unavailable, and dual power supplies can maintain uptime when power surges cause physical damage to one of the power supplies in a system. The incorrect answers: B. NIC teaming NIC (Network Interface Card) teaming can be used for redundant network paths from a server, but it won't help with power-related issues. C. Incremental backups Backups are an important part of any recovery plans, but they won't avoid any power issues. D. Port aggregation Port aggregation is used to increase network bandwidth between switches or devices. Port aggregation won't provide any protection for power surges or power outages. E. Load balancing Load balancers provide a way to manage busy services by increasing the number of available servers and balancing the load between them. A load balancer won't provide any help with power issues, however.

Answer 96

The Answer: B. OCSP stapling The use of OCSP (Online Certificate Status Protocol) requires communication between the client and the CA that issued a certificate. If the CA is an external organization, then validation checks will communicate across the Internet. The certificate holder can verify their own status and avoid client Internet traffic by storing the status information on an internal server and “stapling” the OCSP status into the SSL/TLS handshake. The incorrect answers: A. CSR A CSR (Certificate Signing Request) is used during the key creation process. The public key is sent to the CA to be signed as part of the CSR. C. Key escrow Key escrow will provide a third-party with access to decryption keys. The escrow process is not involved in real-time server revocation updates. D. Hierarchical CA A hierarchical CA design will create intermediate CAs to distributed the certificate management load and minimize the impact if a CA certificate needs to be revoked. The hierarchical design is not involved in the certification revocation check process.

Answer 97

The Answer: C. ESP The ESP (Encapsulation Security Payload) protocol encrypts the data that traverses the VPN. The incorrect answers: A. AH The AH (Authentication Header) is used to hash the packet data for additional data integrity. B. Diffie-Hellman Diffie-Hellman is an algorithm used for two devices to create identical shared keys without transferring those keys across the network. D. SHA-2 SHA-2 (Secure Hash Algorithm) is a hashing algorithm, and does not provide any data encryption.

Answer 98

The Answer: B. Resource exhaustion The available storage on the local filesystem has been depleted, and the information shows 0 bytes available. More drive space would need to be available for the server to return to normal response times. The incorrect answers: A. Buffer overflow A buffer overflow allows an attacker to manipulate the contents of memory. A filesystem at 100% utilization does not describe the contents in memory. C. SQL injection A SQL injection is a network attack type used to access database information directly. A SQL injection would not cause significant storage drive utilization. D. Race condition A race condition is a programming issue where a portion of the application is making changes that are not seen by other parts of the application. A race condition does not commonly use all available storage space on the device.

Answer 99

The Answer: A. Minimization Data minimization is a guideline that limits the amount of collected information to necessary data. This guideline is part of many data privacy regulations, including HIPAA (Health Insurance Portability and Accountability Act) and GDPR (General Data Protection Regulation). The incorrect answers: B. Tokenization Tokenization replaces sensitive data with a non-sensitive placeholder. Tokenization is commonly used for NFC (Near-Field Communication) payment systems. C. Anonymization Anonymization changes data to remove or replace identifiable information. For example, an anonymized purchase history database might change the first and last names to random values but keep the purchase information intact. D. Masking Data masking hides some of the original data to protect sensitive information.

Answer 100

The Answer: A. tracert and E. dig Tracert (traceroute) provides a summary of hops between two devices. In this example, tracert can be used to determine the local ISP’s IP addresses and more information about the physical location of the attacker. The dig (Domain Information Groper) command can be used to perform a reverse-lookup of the IPv4 address and determine the IP address block owner that may be responsible for this traffic. The incorrect answers: B. arp The arp (Address Resolution Protocol) command shows a mapping of IP addresses to local MAC addresses. This information doesn’t provide any detailed location information outside of the local IP subnet. C. ping The ping command can be used to determine if a device may be connected to the network, but it doesn’t help identify any geographical details. D. ipconfig The ipconfig command shows the IP address configuration of a local device, but it doesn’t provide any information about a remote computer. F. netcat Netcat reads or writes information to the network. Netcat is often used as a reconnaissance tool, but it has limited abilities to provide any location information of a device.

Answer 101

The Answer: D. Open-source intelligence Open-source intelligence, or OSINT, describes reconnaissance gathering from publicly available sources. In this example, information about domain names and IP address would be easily retrieved from a query to a public DNS (Domain Name System) server. The incorrect answers: A. Information sharing center The IT security community has a number of sharing centers for threat intelligence. These sharing centers focus on security threats and don't generally provide information about specific company domain names or IP addresses. B. Vulnerability databases Vulnerability databases usually contain information about vulnerable operating systems and applications. IP address and domain name details aren't commonly associated with vulnerability databases. C. Automated indicator sharing Automated indicator sharing (AIS) is a standard format and transfer mechanism for distributing security intelligence between different organizations.

Answer 102

The Answer: D. Perform regular audits and vulnerability scans A focus of PCI DSS (Payment Card Industry Data Security Standard) is to keep credit card information private. The only option in this list that matches this requirement is scheduled and ongoing audits. The incorrect answers: A. Implement RAID for all storage systems RAID (Redundant Array of Independent Disks) is an important consideration for any project that stores data, but using a RAID array is not part of PCI DSS compliance. Although PCI DSS compliance does require backups, RAID is not a backup technology. B. Connect a UPS to all servers Integrating a UPS (Uninterruptible Power Supply) is an important way to maintain power during an outage, but it's not required for PCI DSS compliance. C. DNS should be available on redundant servers Name resolution can be an important service on the network, but maintaining redundant DNS servers isn't required for PCI DSS compliance.

Answer 103

The Answer: C. Metasploit Metasploit is an exploitation framework that can use known vulnerabilities to gain access to remote systems. Metasploit performs penetration tests and can verify the existence of a vulnerability. The incorrect answers: A. FTK Imager FTK Imager is a third-party storage drive imaging tool and it can support many different drive types and encryption methods. FTK Imager will not identify software vulnerabilities. B. Autopsy Autopsy is a forensics tool that can view and recover data from storage devices. Autopsy does not identify operating system or application vulnerabilities. D. Netcat Netcat is a utility that can read and write data to the network. Netcat would not be the best choice for identifying system vulnerabilities.

Answer 104

The Answer: D. Something you have The use of the hardware token generator requires that the user be in possession of the device during the login process. The incorrect answers: A. Something you know The number, or token, created by the token generator isn’t previously known by the user, and there’s no requirement to remember the tokens once the authentication process is complete. B. Something you do The process of pressing the button on the token generator isn’t something that would be unique to an individual user. C. Something you are The token generator works without any type of biometric scan or voiceprint.

Answer 105

The Answer: B. The service provider will provide 99.999% uptime An SLA (Service Level Agreement) is a contract that specifies the minimum terms for provided services. It’s common to include uptime, response times, and other service metrics in an SLA. The incorrect answers: A. The customer will connect to partner locations over an IPsec tunnel A service level agreement describes the minimum service levels provided to the customer. You would not commonly see descriptions of how the service will be used in the SLA contract. C. The customer applications use HTTPS over tcp/443 The protocols used by the customer’s applications aren’t part of the service requirements from the ISP. D. Customer application use will be busiest on the 15th of each month The customer’s application usage isn’t part of the service requirements from the ISP.

Answer 106

The Answer: C. Influence campaign Influence campaigns are carefully crafted attacks that exploit social media and traditional media. The incorrect answers: A. On-path An on-path attack uses an attacker in the middle of a conversation to capture or modify information as it traverses the network. B. Watering hole A watering hole attack uses a carefully selected attack location to infect visitors to a specific website. D. Phishing A phishing attack traditionally uses email in an effort to convince the victim to disclose private or sensitive information.

Answer 107

The Answer: C. Tokenization Tokenization is a technique that replaces user data with a non-sensitive placeholder, or token. Tokenization is commonly used on mobile devices to purchase using a credit card without transmitting the credit card number. The incorrect answers: A. Masking Data masking hides sensitive data by hiding the information or replacing it with a non-sensitive alternative. An example of masking would be replacing an account number on a receipt with hash marks. B. DLP DLP (Data Loss Prevention) solutions can identify and block sensitive data from being sent over the network. DLP does not provide any additional security or protection for real-time financial transactions. D. NGFW An NGFW (Next-Generation Firewall) is an application-aware security technology. NGFW solutions can provide additional controls for specific applications, but they won't provide any additional account protections when sending financial details.

Answer 108

The Answer: C. Customer information is transferred between countries Data sovereignty laws can mandate how data is handled. Data that resides in a country is usually subject to the laws of that country, and compliance regulations may not allow the data to be moved outside of the country The incorrect answers: A. IPsec connects data centers over public Internet links Connecting remote locations using IPsec tunnels over public Internet connections is a common method of securely linking sites together. If someone was to capture the data traversing these links, they would find that all of the data was encrypted. B. Fulfillment requests are shipped within the customer’s country There are no significant security issues associated with shipments within the same country. D. The data centers are located geographically distant from each other A best practice for many international organizations is to have data centers in geographically diverse locations to minimize the impact of any single data center outage.

Answer 109

The Answer: B. SAE WPA3 (Wi-Fi Protected Access 3) enhances the PSK (Pre-Shared Key) authentication process by privately deriving session keys instead of sending the key hashes across the network. The incorrect answers: A. 802.1X 802.1X is a standard for authentication using AAA (Authentication, Authorization and Accounting) services. 802.1X is commonly used in conjunction with LDAP, RADIUS, or a similar authentication service. C. WEP WEP (Wired Equivalent Privacy) is an older wireless encryption algorithm that was ultimately found to have cryptographic vulnerabilities. D. WPS WPS (Wi-Fi Protected Setup) is a standard method of connecting devices to a wireless network without requiring a PSK or passphrase.

Answer 110

The Answer: B. Block all unknown outbound network traffic at the Internet firewall Keylogging software has two major functions; record keystrokes, and transmit those keystrokes to a remote location. Local file scanning and software best-practices can help prevent the initial installation, and controlling outbound network traffic can block unauthorized file transfers. The incorrect answers: A. Prevent the installation of all software Blocking software installations may prevent the initial malware infection, but it won’t provide any control of outbound keylogged data. C. Install host-based anti-virus software A good anti-virus application can identify malware before the installation occurs, but anti-virus does not commonly provide any control of network communication. D. Scan all incoming email attachments at the email gateway Malware can be installed from many sources, and sometimes the source is unexpected. Scanning or blocking executables at the email gateway can help prevent infection but it won’t provide any control of outbound file transfers.

Answer 111

The Answer: E. The client computer does not have the proper certificate installed The error message states that the server credentials could not be validated. This indicates that the certificate authority that signed the server’s certificate is either different than the CA certificate installed on the client’s workstation, or the client workstation does not have an installed copy of the CA’s certificate. This validation process ensures that the client is communicating to a trusted server and there are no man-in-the-middle attacks occurring. The incorrect answers: A. The user’s computer is in the incorrect VLAN The RADIUS server certificate validation process should work properly from all VLANs. The error indicates that the communication process is working properly, so an incorrect VLAN would not be the cause of this issue. B. The RADIUS server is not responding If the RADIUS server had no response to the user, then the process would simply timeout. In this example, the error message indicates that the communication process is working between the RADIUS server and the client’s computer. C. The user’s computer does not support WPA3 encryption The first step when connecting to a wireless network is to associate with the 802.11 access point. If WPA3 encryption was not supported, the authentication process would not have occurred and the user’s workstation would not have seen the server credentials. D. The user is in a location with an insufficient wireless signal The error message regarding server validation indicates that the wireless signal is strong enough to send and receive data on the wireless network.

Answer 112

The Answer: D. Two different messages share the same hash A well-designed hashing algorithm will create a unique hash value for every possible input. If two different inputs create the same hash, the hash algorithm has created a collision. The incorrect answers: A. Two different messages have different hashes In normal operation, two different inputs will create two different hash outputs. B. The original message can be derived from the hash Hashing is a one-way cipher, and you cannot derive the original message from a hash value. C. Two identical messages have the same hash Two identical messages should always create exactly the same hash output.

Answer 113

The Answer: B. Use HTTPS over port 443 for all server communication, and D. Create a web server certificate and sign it with the internal CA Using the secure HTTPS (Hypertext Transfer Protocol Secure) protocol will ensure that all network communication is protected between the web server and the client devices. If someone manages to capture the network traffic, they would be viewing encrypted data. A signed certificate from a trusted internal CA (Certificate Authority) allows web browsers to trust that the web server is the legitimate server endpoint. If someone attempts an on-path attack, the certificate presented will not validate and a warning message will appear in the browser. The incorrect answers: A. Add DNSSEC records on the internal DNS servers DNSSEC (Domain Name System Security Extensions) records are useful to validate the IP address of a device, but they would not prevent an on-path attack. DNSSEC also doesn’t provide any security of the network communication itself. C. Use IPsec for client connections IPsec (IP Security) would provide encrypted communication, but it is not commonly used between a web client and web server. It would also require additional configuration changes on the client devices. E. Require FTPS for all file transfers Web server communication occurs with HTTP or the encrypted HTTPS protocols. The FTPS (File Transfer Protocol Secure) protocol is not commonly used between web clients and servers.

Answer 114

The Answer: C. Chain of custody A chain of custody is a documented record of the evidence. The chain of custody also documents the interactions of every person who comes into contact with the evidence. The incorrect answers: A. Perfect forward secrecy Perfect forward secrecy (PFS) is an encryption technique that limits the use of session keys. PFS is not used to insure the integrity of evidence. B. Non-repudiation Non-repudiation ensures that the author of a document cannot be disputed. Non-repudiation does not provide any method of tracking and managing digital evidence. D. Legal hold A legal hold is a technique for preserving important evidence, but it doesn't provide any mechanism for the ongoing integrity of that evidence.

Answer 115

The Answer: D. Air gap An air gapped network removes all connectivity between components and ensures that there would be no possible communication path between the test network and the production network. The incorrect answers: A. Virtualization Although virtualization provides the option to connect devices in a private network, there’s still the potential for a misconfigured network configuration or an application to communicate externally. B. VLANs VLANs (Virtual Local Area Networks) are a common segmentation technology, but a router could easily connect the VLANs to the production network. C. Cloud computing Cloud-based technologies provide for many network options, and it’s common to maintain a connection between the cloud and the rest of the network.

Answer 116

The Answer: C. SaaS The SaaS (Software as a Service) model generally has no local application installation, no ongoing maintenance tasks, and no local infrastructure requirements. A third-party provides the application and the support, and the user simply logs in, uses the service, and logs out. The incorrect answers: A. PaaS PaaS (Platform as a Service) is a model that provides a building block of features, and requires the end user to customize their own application from the available modules. There can be a significant development effort to build an application with a PaaS model. B. Private A private model requires that the end user purchase, install, and maintain their own application hardware and software. The SaaS model doesn’t require any initial hardware or software capital purchase. D. IaaS IaaS (Infrastructure as a Service) is a model that provides the user with the hardware needed to get up and running, and the end user is responsible for the operating system, the application, and any ongoing maintenance tasks.

Answer 117

The Answer: B. Obfuscation Obfuscation is the process of taking something that is normally understandable and making it very difficult to understand. Many developers will obfuscate their source code to prevent others from following the logic used in the application. The incorrect answers: A. Confusion Confusion is a concept associated with data encryption where the encrypted data is drastically different than the plaintext. C. Encryption Encrypting source code will effectively make it impossible to use unless you have the decryption key. In this example, the source code remained usable, but the readability of the source code was dramatically affected by the changes. D. Diffusion Diffusion is an encryption concept where changing one character of the input will cause many characters to change in the output.

Answer 118

The Answer: D. Lack of patch updates on an Internet-facing database server One of the easiest ways for a competitor to obtain information is through an existing Internet connection. An unpatched server could be exploited to obtain customer data that would not normally be available otherwise. The incorrect answers: A. Data center access with only one authentication method Most competitors don’t have access to walk around inside of your building, and they certainly wouldn’t have access to secure areas. A single authentication method would commonly prevent unauthorized access to a data center for both employees and non-employees, although more authentication factors would provide some additional security. B. Spoofing of internal IP addresses when accessing an intranet server Intranet servers are not accessible from the outside. This makes them an unlikely target for competitors and other non-employees. C. Employee VPN access uses a weak encryption cipher A weak encryption cipher can be a security issue, but a potential exploitation would need the raw network traffic to begin any decryption attempts. Although this scenario would technically be possible if someone was to catch an employee on a public wireless network, it’s not the most significant security issue in the available list.

Answer 119

The Answer: A. DDoS A DDoS (Distributed Denial of Service) can easily exploit a memory leak. Unused memory is not properly released, and eventually the leak uses all available memory. The system eventually crashes due to lack of resources. The incorrect answers: B. Data theft A memory leak doesn’t provide any additional access to data, so the theft of private information would not be an expected result. C. Unauthorized system access A memory leak can prevent all access to the system, but it doesn’t allow any unauthorized access to the system. D. Rootkit installation A rootkit installation would need to be executed on the operating system, and a memory leak doesn’t provide any opportunity for this installation to run.

Answer 120

The Answer: B. Create a hash of the data A hash will create a unique value that can be quickly validated at any time in the future. If the hash value changes, then the data must have also changed. The incorrect answers: A. Use a tamper seal on all storage devices A physical tamper seal will identify if a device has been opened, but it cannot identify any changes to the data on the storage device. C. Create an image of each storage device for future comparison A copy of the data would allow for comparisons later, but the process of doing the comparison would take much more time than validating a hash value. It’s also possible that someone could tamper with both the original data and the copy of the data. D. Take screenshots of file directories with file sizes It’s very easy to change the contents of a file without changing the size of the file.

Answer 121

The Answer: D. Complexity Adding different types of characters to a password requires technical controls that increase password complexity. The incorrect answers: A. Length Adding all of these character types to a password do not necessarily change the length of the password. B. Lockout A good best-practice is to automatically lock an account with multiple invalid authentication attempts. However, a lockout policy does not enforce any password requirements. C. Reuse The controls that prohibit the reuse of passwords do not control the characters used in the password.

Answer 122

The Answer: C. Diamond model The diamond model was created by the United State intelligence community as a way to standardize the attack reporting and the analysis of the intrusions. The incorrect answers: A. MITRE ATT&CK framework MITRE provides the ATT&CK framework as a knowledgebase of attack types, techniques, and mitigation options. B. ISO 27701 The ISO 27701 standard focuses on the implementation and maintenance of a privacy information management system (PIMS). D. NIST RMF The NIST (National Institute of Standards and Technology) RMF (Risk Management Framework) is a guide to help understand, manage, and rate the risks found in an organization.

Answer 123

The Answer: B. Replay attack To perform a replay attack, the attacker needs to capture the original non-encrypted content. If an application is not using encrypted communication, the data capture process is a simple process for the attacker The incorrect answers: A. Buffer overflow A buffer overflow takes advantage of an application vulnerability and can perform this overflow over both an encrypted or non-encrypted channel. C. Resource exhaustion Resource exhaustion can take many different forms, but those resource issues don't necessarily require the network communication to be send in the clear. D. Directory traversal Directory traversal is commonly associated with moving around the file system of a server. Non-encrypted communication is not a prerequisite in a directory traversal attack.

Answer 124

The Answer: B. File integrity check A file integrity check (i.e., Tripwire, System File Checker, etc.) can be used to monitor and alert if there are any changes to a file. The incorrect answers: A. HIPS HIPS (Host-based Intrusion Prevention System) would help identify any security vulnerabilities, but there’s nothing relating to this issue that would indicate that this issue was caused by an operating system or application vulnerability. A HIPS would not commonly alert on the modification of a specific file. C. Application allow list In this example, we’re not sure how the file was changed or if a separate application or editor was even used. If the change was made with a valid application, an allow list would not provide any feedback or alerts. D. WAF A WAF (Web Application Firewall) is used to protect web-based applications from malicious attack. The example in this question was not related to a web-based application.

Answer 125

The Answer: A. LDAP LDAP (Lightweight Directory Access Protocol) is a common protocol to use for centralized authentication. Other protocols such as RADIUS, TACACS+, or Kerberos would also be valid options for 802.1X authentication. The incorrect answers: B. HTTPS HTTPS (Hypertext Transfer Protocol Secure) is commonly used to encrypt web server communication. HTTPS is not an authentication protocol. C. SNMPv3 SNMPv3 (Simple Network Management Protocol version 3) is used to manage servers and infrastructure devices. SNMP is not an authentication protocol. D. MS-CHAP MS-CHAP (Microsoft Challenge Handshake Authentication Protocol) was commonly used to authenticate devices using Microsoft’s Point-toPoint Tunneling Protocol (PPTP). Security issues related to the use of DES (Data Encryption Standard) encryption in MS-CHAP eliminate it from consideration for modern authentication.

Answer 126

The Answer: D. Embedded system An embedded system usually does not provide access to the OS and may not even provide a method of upgrading the system firmware. The incorrect answers: A. End-of-life A device at its end-of-life is no longer supported by the vendor. In this example, the vendor support status isn’t mentioned. B. Weak configuration A weak configuration would leave the system easily accessible by an attacker. In this example, the described scenario doesn’t describe any weak configurations. C. Improper input handling Improper handling of user input can sometimes result in an exploit. In this example, no specific user input issues were described.

Answer 127

The Answer: A. Pulping Pulping places the papers into a large washing tank to remove the ink, and the paper is broken down into pulp and recycled. The information on the paper is not recoverable after pulping The incorrect answers: B. Degaussing Degaussing removes the electromagnetic field of storage media and electronics. Degaussing will not have any effect on paper items. C. NDA A non-disclosure agreement is only valid to the people who have signed the agreement. In this case, it can be assumed that the papers were obtained by a third-party after being placed in the trash. D. Fenced garbage disposal areas Although a fenced disposal area would have protected this information while it was on-site, the papers could have been obtained once they left the facility. The best choice for this question would be the option that would render the information on the pages unreadable.

Answer 128

The Answer: A. HIPS and D. Host-based firewall logs If the laptop is not communicating across the corporate network, then the only evidence of the traffic would be contained on the laptop itself. A HIPS (Host-based Intrusion Prevention System) and host-based firewall logs may contain information about recent traffic flows to systems outside of the corporate network. The incorrect answers: B. UTM appliance logs A unified threat management appliance is commonly located in the core of the network. The use of a cellular hotspot would circumvent the UTM and would not be logged. C. Web application firewall events Web application firewalls are commonly used to protect internal web servers. Outbound Internet communication would not be logged, and anyone circumventing the existing security controls would also not be logged. E. Next-generation firewall logs Although a next-generation firewall keeps detailed logs, any systems communicating outside of the normal corporate Internet connection would not appear in those logs.

Answer 129

The Answer: B. Elliptic curve ECC (Elliptic Curve Cryptography) uses smaller keys than non-ECC encryption and has smaller storage and transmission requirements. These characteristics make it an efficient option for mobile devices. The incorrect answers: A. AES AES (Advanced Encryption Standard) is a useful encryption cipher, but the reduced overhead of elliptic curve cryptography is a better option for this scenario. C. Diffie-Hellman Diffie-Hellman is a key-agreement protocol, and Diffie-Hellman does not provide for any encryption or authentication. D. PGP PGP’s public-key cryptography requires much more overhead than the elliptic curve cryptography option.

Answer 130

The Answer: B. A list of Microsoft patches that have not been applied to a server A vulnerability scan will identify known vulnerabilities, but it will stop short of exploiting these vulnerabilities. The incorrect answers: A. A list of usernames and password hashes from a server This type of secure information cannot be obtained through a vulnerability scan. C. A copy of image files from a private file share A private file share would prevent any access by unauthorized users, including vulnerability scans. D. The BIOS configuration of a server Private information, such as a device’s BIOS configuration, is not available from a vulnerability scan.

Answer 131

The Answer: A. Rogue access point A rogue access point is an unauthorized access point added by a user or attacker. This access point may not necessarily be malicious, but it does create significant security concerns and unauthorized access to the corporate network. The incorrect answers: B. Domain hijack A domain hijacking would be associated with unauthorized access to a domain name. In this example, the wireless IP addressing and performance issues do not appear to be related to a domain hijack. C. DDoS A DDOS (Distributed Denial of Service) would cause outages or slow performance to a service. A DDoS would not commonly modify or update any local IP addresses. D. MAC flooding MAC (Media Access Control) flooding can certainly create performance issues, but the unmatching IP address scheme on the wireless network does not appear to be related to a MAC flood.

Answer 132

The Answer: C. NetFlow logs NetFlow information can provide a summary of network traffic, application usage, and details of network conversations. The NetFlow logs will show all conversations from this device to any others in the network. The incorrect answers: A. DNS server logs DNS server logs will document all name resolutions, but an attacker may not use a DNS server and may prefer accessing devices by IP address. B. Penetration test A penetration test may identify any vulnerabilities that exist on the server, but it won't provide any information about traffic flows or connections initiated by an attacker. D. Email header An email header usually contains information of email servers used to transfer the message and security signatures to verify the sender. An email header would not contain information on traffic flows associated with this attacker.

Answer 133

The Answer: C. Symmetric Symmetric encryption uses the same key for both encryption and decryption. The incorrect answers: A. Asymmetric Asymmetric encryption uses different keys for encryption and decryption. B. Key escrow Key escrow is when a third-party holds the decryption keys for your data. D. Out-of-band key exchange Keys can be transferred between people or systems over the network (inband) or outside the normal network communication (out-of-band). In this example, the key wasn’t exchanged between people or systems, since the system administrator is the same person who encrypted and decrypted.

Answer 134

The Answer: B. Scan outgoing traffic with DLP DLP (Data Loss Prevention) systems are designed to identify sensitive data transfers. If the DLP finds a data transfer with financial details, personal information, or other private information, the DLP can block the data transfer The incorrect answers: A. Enable MFA on the email client MFA (Multi-Factor Authentication) can provide more security during the authentication process, but the description of the malware did not associate the exploit with the login process. The malware will most likely wait for the user to login before exfiltrating the data. C. Require users to enable the VPN when using email A VPN (Virtual Private Network) can protect data between systems, but it won't prevent malware from sending data once it connects to the email system. D. Update the list of malicious URLs in the firewall Blocking known URLs (Uniform Resource Locators) in a firewall is a useful way to prevent access to known malicious sites, but it won't prevent malware from sending email messages.

Answer 135

The Answer: A. Eradication The IR (Incident Response) process is preparation, identification, containment, eradication, recovery, and lessons learned. Once a system has been contained, any malware or breached user accounts should be removed from the system. The incorrect answers: B. Preparation Before an incident occurs, you should compile contact information, incident handling hardware and software, analysis resources, and other important tools and policies. C. Recovery The focus of the recovery process is to get all of the systems back to normal. This phase removes malware, deletes breached user accounts, and fixes any vulnerabilities. D. Identification Identification of an event can be challenging, but it usually consists of IPS reports, anti-virus alerts, configuration change notifications, and other indicators. E. Containment In this example, the containment and isolation occurred when the affected servers were removed from the network.

Answer 136

The Answer: C. Mandatory vacations It’s difficult to maintain fraudulent activities if the person executing the fraud is out of the office. In financial environments, it’s not uncommon to require at least a week of consecutive vacation time at some point during the year. The incorrect answers: A. Background checks Background checks are useful to discover information prior to hiring someone, but these checks are not commonly performed after someone is an employee. B. Clean desk policy If confidential information was left available on someone’s desk, then it would be appropriate to institute a clean desk policy. In this example, the fraudulent activity did not include any mention of confidential information on a desk. D. Acceptable use policy The acceptable use policy (AUP) of an organization describes how company assets are to be used, especially computers, Internet connections, and mobile devices.

Answer 137

The Answer: B. Uses burned-in cryptographic keys and E. Includes built-in protections against brute-force attacks A TPM (Trusted Platform Module) is hardware that is part of a computer’s motherboard, and it’s specifically designed to assist and protect with cryptographic functions. Full disk encryption (FDE) can use the burned-in TPM keys to verify that the local device hasn’t changed, and there are security features in the TPM that will prevent brute-force or dictionary attacks against the full disk encryption login credentials. The incorrect answers: A. Allows the encryption of multiple volumes The use of a TPM is not associated with the number of volumes that may be encrypted with FDE. C. Stores certificates in a hardware security module A hardware security module (HSM) is high-end cryptographic hardware specifically designed for large-scale secured storage on the network. An HSM server is a separate device that is not associated with an individual device’s TPM. D. Protects against EMI leakage The leakage of EMI (Electromagnetic Interference) from keyboards, storage drives, or network connections can be a security concern, but it is not related to the use of a trusted platform module.

Answer 138

The Answer: A. Mandatory Mandatory access control uses a series of security levels (i.e., public, private, secret) and assigns those levels to each object in the operating system. Users are assigned a security level, and they would only have access to objects that meet or are below that assigned security level. The incorrect answers: B. Rule-based Rule-based access control determines access based on a series of systemenforced rules. An access rule might require that a particular browser be used to complete a web page form, or that access to a file or system is only allowed during certain times of the day. C. Discretionary Discretionary access control allows the owner of an object to assign access. If a user creates a spreadsheet, the user can then assign users and groups to have a particular level of access to that spreadsheet. D. Role-based Role-based access control assigns a user’s permissions based on their role in the organization. For example, a manager would have a different set of rights and permissions than a team lead.

Answer 139

The Answer: D. ACL An ACL (Access Control List) is a security control commonly implemented on routers to allow or restrict traffic flows through the network. The incorrect answers: A. VPN A VPN (Virtual Private Network) can be used to secure data traversing the network, but it’s not commonly used to control traffic flows on an internal network. B. IPS An IPS (Intrusion Prevention System) is designed to identify and block known vulnerabilities traversing the network. An IPS is not used to control other traffic flows. C. NAT NAT (Network Address Translation) is a method of modifying the source and/or destination IP addresses of network traffic. NAT is not a security control.

Answer 140

The Answer: A. Disaster recovery plan A disaster recovery plan is a comprehensive set of processes to follow for large-scale outages that affect the organization. Natural disasters, technology failures, and human-created disasters would be reasons to implement a disaster recovery plan. The incorrect answers: B. Stakeholder management Stakeholder management describes the relationship that IT has with the their customers. Although stakeholder management is an important ongoing process, the priority after a major event is to start the disaster recovery process. C. Communication plan A communication plan is a list of everyone who needs to be contacted during an incident. The communication plan will be important documentation after a disaster recovery process has started. D. Retention policies Retention policies are specify the type and amount of data that must be backed up and stored. These policies are often self-imposed or part of a larger set of rules and regulations.

Answer 141

The Answer: A. Rootkit A rootkit traditionally modifies core system files and becomes effectively invisible to the rest of the operating system. The modification of system files and specialized kernel-level drivers are common rootkit techniques. The incorrect answers: B. RAT A RAT (Remote Administration Tool) is often installed as a Trojan horse and used for malicious purposes. Although these utilities are sometimes installed subversively, they can still be identified through normal malware scans and host-based firewall software. C. Bot A bot is relatively active malware that can usually be seen in a process list and by examining network communication. Botnet participants can often be identified using traditional anti-malware software. D. Ransomware Ransomware makes itself quite visible on your system, and it usually presents warning messages and information on how to remove the ransomware from the system. E. Keylogger A keylogger is a utility that captures keyboard and mouse input and sends that information to another device. This usually means that the keylogger has a visible component in the list of processes and traffic that can be seen on the network.

Answer 142

The Answer: C. Date and time when the file was created The data and time the file was created is commonly found in the metadata of a file. The incorrect answers: A. IPS signature name and number The metadata is stored in the word processing file, and the IPS will not change the information stored in the file. B. Operating system version Word processing files are not specific to an operating system, so it would not be common to find OS information stored in the metadata of a word processing file. D. Alert disposition The alert information created when the macro virus was discovered would not be included as part of the word processing file metadata.

Answer 143

The Answer: A. Access control vestibule An access control vestibule is commonly used to control the flow of people through a particular area. Unlocking the one door of the vestibule commonly restricts the other door from opening, thereby preventing someone from walking through without stopping. It’s common in large data centers to have a single room as the access control vestibule where users are checked in and out of the facility The incorrect answers: B. Air gap An air gap is a technical control that creates a physical separation between devices or networks. An air gap is not used to manage the flow of people. C. Faraday cage A Faraday cage is used to block electromagnetic fields, and it is useful in environments where electromagnetic and radio signals can be an issue. D. Protected distribution A protected distribution system (PDS) is a physically secure cabled network. Cable and fiber in a protected distribution are protected from taps, cuts, or similar security breaches.

Answer 144

The Answer: B. Steganography Steganography is the process of hiding information within another document. For example, one common method of steganography will embed data or documents within image files. The incorrect answers: A. Digital signatures A digital signature is a cryptographic method to check the integrity, authentication, and non-repudiation of a message. Digital signatures are not used to hide information within image files. C. Block cipher A block cipher is used to encrypt fixed-length groups of data. Block ciphers do not hide data within another object. D. Perfect forward secrecy Perfect forward secrecy is a key exchange method that creates a new and unique set of session keys for each session.

Answer 145

The Answer: C. Credentialed A credentialed scan uses valid access rights to perform the scanning functions. This type of scan is designed to show what someone on the inside with these rights would be able to exploit. The incorrect answers: A. Black box Black box information is generally associated with penetration testing. Someone performing a black box penetration test will not have any prior knowledge of the systems under attack. B. Passive Passive information gathering is usually associated with penetration testing. Passive reconnaissance is the process of gathering information from outside sources, such as social media sites and online forums. D. Agile An agile environment is often associated with a development life-cycle model that focuses on rapid development and constant collaboration.

Answer 146

The Answer: C. ARO The ARO (Annualized Rate of Occurrence) describes the number of instances that an event would occur in a year. For example, if the organization expect to lose seven laptops to theft in a year, the ARO for laptop theft is seven. The incorrect answers: A. ALE The ALE (Annual Loss Expectancy) is the expected cost for all events in a single year. If it costs $1,000 to replace a single laptop (the SLE) and you expect to lose seven laptops in a year (the ARO), the ALE for laptop theft is $7,000. B. SLE SLE (Single Loss Expectancy) is the monetary loss if a single event occurs. If one laptop is stolen, the cost to replace that single laptop is the SLE, or $1,000. D. MTTR MTTR (Mean Time to Repair) is the time required to repair a product or system after a failure.

Answer 147

The Answer: D. Create a separate daily backup archive for all applicable tax records The important consideration for a data retention mandate is to always have access to the information over the proposed time frame. In this example, a daily backup would ensure that tax information is constantly archived over a seven year period and could always be retrieved if needed. If data was inadvertently deleted from the primary storage, the backup would still maintain a copy The incorrect answers: A. Create an automated script to remove all tax information more than seven years old The requirement is to maintain data for at least seven years, but there’s no requirement to remove that data once it’s more than seven years old. For example, some financial information may need to be retained well beyond the seven year mandate. B. Print and store all tax records in a seven-year cycle Paper has its place, but creating physical output of tax records and storing them for seven years would include a significant cost in time, materials, and inventory space. The requirement to store data for seven years doesn’t require the information to be stored in a physical form. C. Allow users to download tax records from their account login Including a feature to allow users access to their records is useful for the user community, but it doesn’t provide any data protection for the seven year retention period.

Answer 148

The Answer: B. CASB A CASB (Cloud Access Security Broker) allows the security administrator to manage security policies for cloud-based applications. The incorrect answers: A. HSM An HSM (Hardware Security Module) manages certificates, digital keys, and can often offload cryptographic functions. An HSM is not used for visibility and control of cloud-based applications. C. 802.1X 802.1X is an authentication standard for port-based network access control, or NAC. 802.1X does not provide visibility or control of cloud-based applications. D. EDR EDR (Endpoint Detection and Response) is a security solution for end-user devices to protect against malicious software and threats.

Answer 149

The Answer: D. ARP poisoning The duplicate MAC (Media Access Control) address from 192.168.1.1 and 192.168.1.103 indicates MAC spoofing or ARP (Address Resolution Protocol) poisoning. There should not be duplicate MAC addresses associated with two IP addresses on the same subnet. The incorrect answers: A. DDoS A DDoS (Distributed Denial of Service) attack would not duplicate a MAC address on an IP subnet. B. Wireless disassociation Wireless disassociation uses specially crafted wireless management frames to disconnect wireless devices from a network. A duplicate MAC address does not indicate a wireless disassociation attack. C. Rogue access point A rogue access point would have its own MAC address and it would not be duplicated on the local IP subnet.

Answer 150

The Answer: C. Stored procedures Stored procedures are SQL queries that execute on the server side instead of the client application. The client application calls the stored procedure on the server, and this prevents the client from making any changes to the actual SQL queries. The incorrect answers: A. Input validation Input validation would examine the input from the client and make sure that it is expected. In this example, moving the SQL queries to the backend server process would not require any validation of the SQL queries. As a best practice, any additional input from the client would still need validation. B. Code signing Code that has been digitally signed by the application developer can be evaluated to ensure that nothing has changed with the application code since it was published. D. Obfuscation Obfuscation makes something that is normally understandable very difficult to understand. The move of SQL queries to the server changes the processing of the application itself, but it isn’t a method of obfuscation.

Answer 151

The Answer: D. FAR FAR (False Acceptance Rate) is the likelihood that an unauthorized user will be accepted. The FAR should be kept as close to zero as possible. The incorrect answers: A. TOTP A TOTP (Time-based One-Time Password) is an algorithm that provides a pseudo-random number as an authentication factor. A TOTP does not describe the accuracy of a biometric system. B. FRR FRR (False Rejection Rate) is the likelihood that an authorized user will be rejected. If the FRR is incrementing, then authorized users will not gain access to the data center. This value is not associated with unauthorized access. C. HOTP HOTP (HMAC-based One-Time Password) is an algorithm that provides an authentication factor based on a one-time password. An HOTP does not describe the accuracy of a biometric system.

Answer 152

The Answer: B. MTTR MTTR (Mean Time To Restore) is the amount of time required to get back up and running. This is sometimes called Mean Time To Repair. The incorrect answers: A. MTBF MTBF (Mean Time Between Failures) is a prediction of how long the system will be operational before a failure occurs. C. RPO An RPO (Recovery Point Objective) is a qualifier that determines when the system is recovered. A recovered system may not be completely repaired, but it will be running well enough to maintain a certain level of operation. D. RTO An RTO (Recovery Time Objective) is the service level goal to work towards when recovering a system and getting back up and running

Answer 153

The Answer: B. Insider None of these servers were accessible from the outside, and the only servers with any logged connections were those that also were susceptible to the latest vulnerabilities. To complete this attack, you would need a very specific knowledge of the exact systems that were vulnerable and a way to communicate with those servers. For either of those reasons, the Insider threat as would be the most likely from the available list. The incorrect answers: A. Competitor Although an unethical competitor could be interested in disabling certain systems, the specificity of this attack and the lack of accessibility to the systems would seem to dismiss a competitor. C. Nation state A nation state would have the resources needed to attack a network, gain access to the internal systems, and then somehow monitor the update processes for each server. However, the scope and breadth of such an attack would be complex, and this would make the nation state a very speculative option and not the most likely option from the available list. D. Script kiddie Script kiddies don’t generally have access to an internal network, and they aren’t discerning enough to track the status of which systems may have been recently updated.

Answer 154

The Answer: D. Ignore the JRE vulnerability alert It’s relatively common for vulnerability scans to show vulnerabilities that don’t actually exist, especially if the scans are not credentialed. An issue that is identified but does not actually exist is a false positive, and it can be dismissed once the alert has been properly researched. The incorrect answers: A. Install the latest version of JRE on the server The system administrator verified that JRE was not currently installed on the server, so it would not be possible for that vulnerability to actually exist. Installing an unneeded version of JRE on the server could potentially open the server to actual vulnerabilities. B. Quarantine the server and scan for malware The JRE false positive isn’t an indication of malware, and no mention is made of the report including any additional vulnerabilities or reports of malware. C. Harden the operating system of the web server Although it’s always a good best practice to harden the operating system of an externally-facing server, this vulnerability scan report doesn’t indicate any particular vulnerability with the operating system itself. If the scan identified specific OS vulnerabilities, then additional hardening may be required.

Answer 155

The Answer: D. Trojan A Trojan horse is malicious software that pretends to be something benign. The user will install the software with the expectation that it will perform a particular function, but in reality it is installing malware on the computer. The incorrect answers: A. Ransomware Ransomware will lock a system and present a message to the user with instructions on how to unlock the system. This usually involves sending the attacker money in exchange for the unlock key. B. Adware Adware is obvious due to the increased number of advertisements that will be displayed after the infection. C. Logic bomb A logic bomb will execute when a certain event occurs, such as a specific date and time

Answer 156

The Answer: B. Tokenization Tokenization replaces sensitive data with a token, and this token can be used as a functional placeholder for the original data. Tokenization is commonly used with credit card processing and mobile devices. The incorrect answers: A. Minimization Minimization is a data collection policy that limits the amount of personal or private information that can be gathered. With minimization, information outside of the required scope would not be collected. C. Retention Data retention specifies the amount of time that data should be stored or saved. Retention policies do not commonly replace sensitive data. D. Masking Data masking hides some of the original data to protect it from view. While hidden, this data cannot be used for any functional purpose.

Answer 157

The Answers: C. Source: ANY, Destination: ANY, Protocol: TCP, Port: 80, Deny; D. Source: ANY, Destination: ANY, Protocol: TCP, Port: 443, Allow Most web servers use tcp/80 for HTTP (Hypertext Transfer Protocol) communication and tcp/443 for HTTPS (Hypertext Transfer Protocol Secure). HTTP traffic sends traffic in the clear, so the first firewall rule would block any tcp/80 traffic before it hits the web server. The second rule allows HTTPS encrypted traffic to continue to the web server over tcp/443. The incorrect answers: A. Source: ANY, Destination: ANY, Protocol: TCP, Port: 23, Deny The insecure Telnet protocol commonly uses tcp/23, but most web servers would not be listening on tcp/23. An explicit tcp/23 deny rule would not provide any additional web server security. B. Source: ANY, Destination: ANY, Protocol: TCP, Port: 443, Deny The encrypted HTTPS protocol uses tcp/443, so the security administrator would not want to deny that traffic through the firewall. E. Source: ANY, Destination: ANY, Protocol: TCP, Port: 80, Allow Since the application owner requires encrypted communication, allowing HTTP over tcp/80 should not be allowed through the firewall.

Answer 158

The Answer: D. Smart card with picture ID A smart card commonly includes a certificate that can be used as a multifactor authentication of something you have. These smart cards are commonly combined with an employee identification card, and often require a separate PIN (Personal Identification Number) as an additional authentication factor. The incorrect answers: A. USB-connected storage drive with FDE FDE (Full Disk Encryption) will protect the data on a drive, but it doesn’t provide a factor of authentication. B. Employee policy manual Employee policy manuals aren’t commonly associated with a specific individual, so they are not a good factor of authentication. C. Null-modem serial cable A null-modem serial cable is an important accessory for any field technician, but it doesn’t provide any authentication factors.

Answer 159

The Answer: A. ISO 27701 The ISO (International Organization for Standardization) 27701 framework is designed to enhance privacy controls towards adding or improving a Privacy Information Management System (PIMS). The incorrect answers: B. PCI DSS The PCI DSS (Payment Card Industry Data Security Standard) is a set of security rules and guidelines for storing credit card information. C. SSAE SOC 2 The SSAE SOC 2 (Statement on Standards for Attestation Engagements, System and Organization Controls 2) is an auditing standard for IT systems. D. CSA CCM The CSA CCM (Cloud Security Alliance Cloud Controls Matrix) provides security information and guidelines for cloud-based applications.

Answer 160

The Answer: A. Dumpster diving A company can often throw out useful information, and attackers will literally climb through the trash bin to obtain this information. The incorrect answers: B. Shoulder surfing Shoulder surfing is viewing someone else’s screen, which is effectively over their shoulder. C. Tailgating If you follow someone through a locked door without providing any credentials or using an access card, you would be tailgating. D. Phishing Phishing is the process of tricking someone into providing their personal information.

Answer 161

The Answer: A. RTOS This tracking system requires an RTOS (Real-Time Operating System) that can instantly react to input without any significant delays or queuing in the operating system. Operating systems used by the military, automobile manufacturers, and industrial equipment developers often use RTOS to ensure that certain transactions can be processed without any significant delays. The incorrect answers: B. IoT IoT (Internet of Things) devices are generally associated with home automation and do not have a requirement for real-time operation. C. ICS An ICS (Industrial Control System) is often a dedicated network used exclusively to manage and control manufacturing equipment, power generation equipment, water management systems, and other industrial machines. Although some industrial control systems may use an RTOS, using a real-time operating system is not a requirement of an ICS. D. MFD A multifunction device (MFD) is commonly associated with a device that can print, scan, and fax. There are no real-time OS requirements in a typical MFD.

Answer 162

The Answer: D. Certificate pinning Certificate pinning embeds or “pins” a certificate inside of an application. When the application contacts a service, the service certificate will be compared to the pinned certificate. If the certificates match, the application knows that it can trust the service. If the certificates don’t match, then the application can choose to shut down, show an error message, or make the user aware of the discrepancy. An SSL proxy will use a different certificate than the service certificate, so an application using certificate pinning can identify and react to this situation. The incorrect answers: A. OCSP stapling OCSP (Online Certificate Status Protocol) stapling is a method that has the certificate holder verify their own certificate status. The OCSP status is commonly “stapled” into the SSL handshake process. B. Offline CAs An offline CA (Certificate Authority) is a common way to prevent the exploitation of a root authority. If the CA is offline, then you can’t hack it. However, an online or offline CA won’t prevent the use of an SSL proxy. C. Certificate chaining Intermediate certificates are often listed between a web server’s SSL certificate and the root certificate. This list of intermediate certificates is called a “chain.” It’s important to configure web servers with the proper chain, or the end user may receive an error in their browser that the server can’t be trusted.

Answer 163

The Answer: C. Switch log A rogue access point would be difficult to identify once it’s on the network, but at some point the access point would need to physically connect to the corporate network. An analysis of switch interface activity would be able to identify any new devices and their MAC addresses. The incorrect answers: A. UTM log A UTM (Unified Threat Management) gateway is an all-in-one device that provides firewall services, URL filtering, spam filtering, and more. From the UTM’s perspective, the traffic from a rogue access point would look similar to all other traffic on the network. B. WAF log A WAF (Web Application Firewall) would not be able to determine if web server traffic was from a rogue access point or a legitimate wired device. D. DLP log DLP (Data Loss Prevention) is important for stopping the transfer of confidential data, but it would not be able to identify traffic from a rogue access point.

Answer 164

The Answer: A. Recovery The recovery phase focuses on getting things back to normal after an attack. This is the phase that removes malware, fixes vulnerabilities, and recovers the damaged systems. The incorrect answers: B. Lessons learned Once an event is over, it’s useful to have a post-incident meeting to discuss the things that worked and things that didn’t. C. Containment When an event occurs, it’s important to minimize the impact. Isolation and containment can help to limit the spread and effect of an event. D. Identification Identifying the event is an important step that initiates the rest of the incident response processes.

Answer 165

The Answer: C. IaaS IaaS (Infrastructure as a Service) describes a cloud model that provides the base hardware of a system. The administrator of the system would still need to install an OS and applications on the IaaS system. The incorrect answers: A. SaaS SaaS (Software as a Service) is a cloud model that provides everything for the end user. End users on a SaaS model would not usually have access to the operating system or the application code. B. DaaS DaaS (Desktop as a Service) describes a virtual computing environment with managed desktops in the cloud. D. PaaS PaaS (Platform as a Service) provides the foundational building blocks for application development and requires the users to build their own applications on the cloud platform.

Answer 166

The Answer: C. SQL injection The SQL injection is contained in the application data. The attacker was attempting to circumvent the authentication through the use of equivalent SQL statements ('x'='x'). The incorrect answers: A. Phishing Phishing attempts are a social engineering method of gaining access to private or sensitive information. This example does not appear to contain any private information. B. Brute force A brute force attempt would include many failed attempts at a password. This log does not appear to have any repeated password attempts. D. Cross-site scripting Cross-site scripting takes advantage of the trust a user has for a site. This example does not appear to take advantage of any previous authentication or trust.

Answer 167

The Answer: A. Tabletop exercise A tabletop exercise is a walk-through exercise where the disaster recovery process can be discussed in a conference room without making any changes to the existing systems. The incorrect answers: B. Hot site fail-over A fail-over to a hot site would involve significant changes to the infrastructure, services, and operations teams. C. Simulation A simulation is a useful test of disaster recovery processes, but it often requires a change to the existing systems to properly test the simulated disaster. D. Penetration test A penetration test will identify vulnerabilities, but it will not provide any evaluation of the disaster recovery process or policies.

Answer 168

The Answer: C. Create firewall rules that match the application traffic flow By default, firewalls implicitly deny all traffic. Firewall rules must be built that match the traffic flows, and only then will traffic pass through the firewall. The incorrect answers: A. Create a single firewall rule with an explicit deny By default, the firewall has an implicit deny as the last policy in the firewall rule base. If traffic does not match any other firewall rule, then the implicit deny drops that traffic. Manually configuring an explicit deny doesn’t provide any additional traffic control because of the already-existing implicit deny, and it doesn’t allow any traffic to pass through the firewall because it’s a rule that denies all traffic. B. Build a separate VLAN for the application VLAN (Virtual Local Area Network) separation can be used to manage traffic flows or provide additional security options, but a VLAN alone won’t bypass an existing firewall deny rule. D. Disable spanning tree protocol Spanning tree protocol (STP) is configured on most switches to prevent any layer 2 switching loops. Disabling spanning tree won’t bypass any firewall security controls, and it would put the network at risk if a misconfiguration creates a switching loop. A good best practice is to always use STP on a switched network.

Answer 169

The Answer: B. UPS HA (High Availability) means that the service should always be on and available. The only device on this list that would provide HA is the UPS (Uninterruptible Power Supply). If power is lost, the UPS will provide electricity using battery power or a gas-powered generator. The incorrect answers: A. SIEM A SIEM (Security Information and Event Management) system consolidates data from devices on the network and provides log searching and reporting features. A SIEM does not provide any HA functionality. C. DLP DLP (Data Loss Prevention) is a method of identifying and preventing the transfer of personal or confidential information through the network. DLP does not provide any HA functionality. D. VPN concentrator A VPN (Virtual Private Network) concentrator is used as an endpoint to an endpoint VPN solution. VPN concentrators do not provide any HA functionality.

Answer 170

The Answer: C. ALE The ALE (Annual Loss Expectancy) is the total amount of the loss over an entire year. The incorrect answers: A. SLE SLE (Single Loss Expectancy) describes the loss for a single incident. B. SLA SLA (Service Level Agreement) is a contractual agreement that specifies a minimum service level. D. ARO An ARO (Annualized Rate of Occurrence) is the number of times an event is expected to occur in a year.

Answer 171

The Answer: B. Input validation In this example, the attacker is attempting to use a remote code execution vulnerability. Input validation can be used to create a very specific filter of allowed input, and a strict validation process would have prevented the web server from processing this attack information. The incorrect answers: A. Static code analyzer A static code analyzer is useful when evaluating the security of existing source code. In this example, the input is dynamic and is initiated by the attacker. C. Allow list An allow list would limit user access to an application, but it would not limit the type of input from the users. D. Secure cookies Secure cookies ensure that the information contained in the browser cookie is encrypted and only viewable by the end user. Secure cookies would not prevent a remote code execution attack.

Answer 172

The Answer: A. Digitally sign it with Sam’s private key The sender of a message digitally signs with their own private key to ensure integrity, authentication, and non-repudiation of the signed contents. The digital signature is validated with the sender’s public key The incorrect answers: B. Digitally sign it with Sam’s public key Since everyone effectively has access to public keys, adding a digital signature with a publicly available key doesn’t provide any security features. C. Digitally sign it with Jack’s private key Jack’s private key would only be available to Jack, so Sam could not possibly use Jack’s private key when performing any cryptographic functions. D. Digitally sign it with Jack’s public key As with Sam’s public key that would be available to anyone, using Jack’s public key would not provide any security features.

Answer 173

The Answer: B. Archive the decryption keys associated with the user account Without the decryption keys, it will be impossible to access any of the user’s protected files once they leave the company. Given the other possible answers, this one is the only one that would result in unrecoverable data loss if not properly followed. The incorrect answers: A. Perform an on-demand audit of the user’s privileges The user’s account will be disabled once they leave the organization, so an audit of their privileges would not be very useful. C. Document the user’s outstanding tasks Creating documentation is important, but it’s not as important as retaining the user’s data with the decryption keys. D. Obtain a signed copy of the Acceptable Use Policies Acceptable Use Policies (AUPs) are usually signed during the on-boarding process. You won’t need an AUP if the user is no longer accessing the network.

Answer 174

The Answer: D. Order of volatility Order of volatility ensures that data will be collected before it becomes unrecoverable. For example, information stored in a router table is more volatile than data stored on a backup tape, so the router table data will be collected first and the backup tape data will be collected second. The incorrect answers: A. Chain of custody Chain of custody ensures that the integrity of evidence is maintained. The contents of the evidence are documented, and each person who contacts the evidence is required to document their activity. B. Data hashing Data hashing creates a unique message digest based on stored data. If the data is tampered with, a hash taken after the change will differ from the original value. This allows the forensic engineer to identify that information has been changed. C. Legal hold A legal hold is a legal technique to preserve relevant information. This will ensure the data remains accessible for any legal preparation that needs to occur prior to litigation.

Answer 175

The Answer: D. Weak cipher suite Creating a password hash is a one-way process that can’t be reversed. If the hash has not been salted, then a rainbow table lookup would be an easy way to find the plaintext passwords. Since none of the answers in this question included rainbow tables as an option, the most reasonable of the remaining choices would be a weak cipher suite that allowed for a very fast brute force attack of the password hashes. The incorrect answers: A. Improper certificate management As a best practice, passwords are never stored or transmitted as plain text or in a form that could be recovered to plain text. If a certificate was mis-managed, the attacker might be able to decode network traffic or perform on-path attacks. However, they would not be able to view a user’s password, since those passwords are already hashed. Since all ten thousand accounts were downloaded, it’s unlikely the attacker collected them one user at a time over the network. B. Phishing Phishing is a useful attack for gathering information from one user at a time, but it doesn’t scale when you need to collect data from ten thousand accounts. C. Untrained users Individual users might accidentally disclose their password information, but you would not expect ten thousand users to perform the same security breach simultaneously.

Answer 176

The Answer: D. Honeypot A honeypot simulates a production environment without putting any of the production data at risk. As attackers attempt to exploit the honeypot, their techniques and methods are logged. With these logs, administrators can gain additional insights into the attacks and processes used by the attackers. The incorrect answers: A. IPS An IPS would identify known attacks against an application or device, but it would not provide any proactive identification or detailed security information. B. Hashing Hashing can be used as an integrity check, but it's not used to obtain information about an attack. C. Obfuscation Obfuscation is the process of making something difficult for humans to read or understand. Obfuscation does not provide any additional information about attack methods or techniques.

Answer 177

The Answer: C. Service A service account is commonly used by local services on a system, but service accounts are not generally enabled for interactive logins. Web servers, database servers, and other local servers use service accounts. The incorrect answers: A. User A user account is associated with an interactive user or person. Because user accounts have additional functionality over service accounts, the best practice is to avoid assigning user account access to a service. B. Privileged A privileged account is an Administrator or root account, and it generally has complete access to the operating system. This should be your most protected account type, and you would not associate a privileged account to a service. D. Guest A guest account often has very limited operating system access, so it would not be a useful account type to use for a service.

Answer 178

The Answer: C. Runbook A runbook is a set of steps required to complete a task. An example of a runbook would be the process of resetting a password, creating a website certificate, or backing up application data. The incorrect answers: A. MDM An MDM (Mobile Device Manager) provides management and configuration of remote devices. An MDM does not provide a list of processes. B. DLP DLP (Data Loss Prevention) is a security solution for identifying and blocking the transfer of sensitive information across the network. A DLP would not provide a checklist of security tasks. D. Zero trust Zero trust is a security philosophy that considers all devices to be untrusted. Inherent trust and trusted connections between devices are not part of a zero trust model. Zero trust does not provide linear checklists for security tasks.

Answer 179

The Answer: B. Snapshot Virtual machines (VMs) have a snapshot backup feature that can capture both a full backup of the virtual system and incremental changes that occur over time. It’s common to take a snapshot of a VM for backup purposes and before making any significant changes to the VM. If the changes need to be rolled back, a previous snapshot can be selected and instantly applied to the VM. The incorrect answers: A. Full A full backup is used to copy every file system object to the backup media. To restore the operating system, the entire full backup session would be restored to the file system. In a virtual environment, a partition of a virtual machine is stored as a single file, so it’s much easier to back up that single file as a snapshot than backing up the individual files that are stored inside of that virtual partition. C. Differential A differential backup will copy all files that have been changed since the last full backup. As mentioned above, using the snapshot feature of a VM is much more efficient than copying individual files in the file system. D. Incremental An incremental backup will copy all files that have been changed since the last incremental backup. The VM’s snapshot feature is much more efficient way to backup and restore incremental changes to a virtual machine.

Answer 180

The Answer: B. Owner The owner of an object is the one who controls access in a discretionary access control model. The object and type of access is at the discretion of the owner, and they can determine who can access the file and the type of access they would have. The incorrect answers: A. Administrator Administrators generally label objects when using mandatory access control, but they are not involved with discretionary access control. C. Group Assigning rights and permissions to a group and then assigning users to the group are common when using role-based access control. D. System The system does not determine individual user rights and permissions when using discretionary access control.

Answer 181

The Answer: B. In-transit Data in-transit is data that is in the process of moving across the network. As the information passes through switches and routers, it is considered to be in-transit. The incorrect answers: A. In-use Data in-use is in the memory of a system and is accessible to an application. C. At-rest Data at-rest resides on a storage device. D. Highly available High availability (HA) is usually associated with redundancy or faulttolerance. Data moving through the network would not be considered highly available.

Answer 182

The Answer: A. Service level agreement A service level agreement (SLA) is used to contractually define the minimum terms for services. In this example, the medical imaging company would require an SLA from the network provider for the necessary throughput and uptime metrics. The incorrect answers: B. Memorandum of understanding A memorandum of understanding (MOU) is an informal letter of intent. The MOU is not a signed contract, and there are no contractual obligations associated with the content of an MOU. C. Non-disclosure agreement A non-disclosure agreement (NDA) is used between entities to prevent the use and dissemination of confidential information. D. Acceptable use policy An acceptable use policy (AUP) commonly details the rules of behavior for employees using an organization’s network and computing resources.

Answer 183

The Answer: B. SRTP SRTP (Secure Real-Time Transport Protocol) is an encrypted version of the RTP (Real-Time Transport Protocol) VoIP (Voice over IP) protocol. SRTP uses AES (Advanced Encryption Standard) to encrypt the voice and video over a VoIP connection. The incorrect answers: A. TLS TLS (Transport Layer Security) is the modern version of SSL (Secure Sockets Layer), and it’s commonly used for encrypting communication to a web server. C. SSH SSH (Secure Shell) is used to encrypt terminal communication. The best practice is to use SSH instead of the insecure Telnet protocol. D. S/MIME S/MIME (Secure/Multipurpose Internet Mail Extensions) provides security for the content of an email message.

Answer 184

The Answer: D. Urgency The need to complete this task as quickly as possible (immediately) is the primary social engineering principle in this description. Any task that encourages a person to act quickly (instead of thinking about it) is associated with urgency The incorrect answers: A. Familiarity If the email making this request was from someone we knew, then the social engineering principle of familiarity would be included. In this example, the email was from an unknown third-party. B. Social Proof Social proof encourages action by convincing the user that this is normally expected. If the email stated that others have completed this task in the past, social proof would imply that it’s perfectly acceptable for you to complete this task as well. C. Authority In this example, the request was made by an unknown third-party. If the request was from someone at a higher level in the company, then the social engineering principle of authority would be used.

Answer 185

The Answer: A. OCSP stapling OCSP (Online Certificate Status Protocol) stapling allows the certificate holder verify their own certificate status. The OCSP status is commonly “stapled” into the SSL handshake process. Instead of contacting the certificate authority to verify the certificate, the verification is included with the initial network connection to the server. The incorrect answers: B. Certificate chaining Intermediate certificates are often listed in a "chain" between a web server’s SSL certificate and the root certificate. It’s important to configure web servers with the proper chain, or the end user may receive an error in their browser that the server can’t be trusted. A certificate chain does not provide the end station with any revocation information. C. CRL A CRL (Certificate Revocation List) is a list of revoked certificates that is maintained by the certificate authority. To view the CRL, an end-user client would directly access the CA. D. Certificate pinning Certificate pinning embeds or “pins” a certificate inside of an application. When the application contacts a service, the service certificate will be compared to the pinned certificate. If the certificates match, the application knows that it can trust the service. If the certificates don’t match, then the application can choose to shut down, show an error message, or make the user aware of the discrepancy. Certificate pinning does not necessarily provide any revocation checks.

Answer 186

The Answer: B. Compensating Instead of preventing an attack, a compensating control is used to restore systems using other means. A streamlined backup and restore process compensates for the limited security features of the EDR (Endpoint Detection and Response) software. The incorrect answers: A. Managerial Managerial controls are policies that determine how processes should be followed, but they won't provide a method for recovering from a ransomware infection. C. Preventive A preventive control will block access. The EDR software on a workstation is an example of a preventive control. D. Detective A detective control may not be able to block an attack, but it can identify and alert if an attack is underway.

Answer 187

The Answer: D. Change management Change management is the process for making any type of change. This could be a software upgrade, a hardware replacement, or any other type of modification to the existing environment. Having a formal change management process minimizes the risk of a change and makes everyone aware of the changes as they occur. The incorrect answers: A. Agile Agile is a systems development life cycle model that focuses on creating content as quickly as possible and refining the content until the final product is complete. B. Continuity planning Continuity planning focuses on keeping the business running when a disruption occurs. Disaster recovery planning is a type of continuity plan. C. Usage auditing Usage auditing is used to determine how resources are used. For example, a system administrator may perform a usage audit to determine which resources are used with a particular application or service.

Answer 188

The Answer: B. Federation Federation provides a way to authenticate and authorize between two entities using a separate trusted authentication platform. For example, a web site could allow authentication using an existing account on a thirdparty social media site. The incorrect answers: A. SSO SSO (Single Sign-On) does not inherently require authentication to be processed by a third-party. SSO allows a user to authenticate one time and gain access to all assigned resources. No additional authentication is required after the initial SSO login process is complete. C. Transitive trust A transitive trust states that if Domain A trusts Domain B, and Domain B trusts Domain C, then Domain A trusts Domain This trust relationship is not associated with the authentication process that occurs in any of these domains. D. X.509 certificates signed by a trusted CA Assigning a certificate to each user or device is commonly used as an authentication factor, and this would require the company to implement some type of authentication process to create and assign certificates.

Answer 189

The Answer: C. Rootkit A rootkit modifies operating system files to become part of the core OS. The kernel, user, and networking libraries in Windows are core operating system files. The incorrect answers: A. RAT A RAT (Remote Access Trojan) is a remote administration tool that installs itself as a service or application on the host computer. RATs do not commonly modify core operating system files. B. Logic bomb A logic bomb waits for a predefined event to begin operation. Logic bombs do not commonly modify core operating system files. D. Bot Bot (robot) malware infects devices to make them part of a larger network of bots. These infections do not commonly modify core operating system files.

Answer 190

The Answer: B. Directory traversal Directory traversal attempts to read or access files that are outside the scope of the web server's file directory. The pair of dots in a file path (..) refers to the parent directory, so this example is attempt to move back two parent directories before proceeding into the /Windows directory. In a properly configured web server, this traversal should not be possible. The incorrect answers: A. Buffer overflow A buffer overflow would attempt to store information into an area of memory that overflows the boundary of the buffer. The information in the log does not show any overflow attempt. C. DoS A DoS (Denial of Service) is designed to make a system or service unavailable. Although running any unknown command can be unpredictable, it would be unusual for a these commands to cause any downtime. D. Cross-site scripting A cross-site scripting attack would normally include a script that would reference another site that was trusted by the browser. In this example, the commands appear to be related to the existing URL and not a third-party site.

Answer 191

The Answer: C. Salting Passwords are often stored as hashes, but the hashes themselves are often subject to brute force or rainbow table attacks. It’s common to add some additional random data (a salt) to a password before the hashing process. This ensures that each password is truly random when stored, and it makes it more difficult for an attacker to discover all of the stored passwords. The incorrect answers: A. Hashing Hashing is a one-way cryptographic function that takes an input, such as a password, and creates a fixed size string of random information. The process of adding additional information to the original data before the hashing process is called salting. B. PFS PFS (Perfect Forward Secrecy) is a method of encryption that uses temporary session keys for the encryption and decryption process. Once the encrypted communication is complete, the session keys are discarded. PFS is not used to add additional random information to a password hashing process. D. Asymmetric encryption Asymmetric encryption is an encryption method that uses one key for encryption and a different key for decryption. Asymmetric encryption does not add additional random information to a hash.

Answer 192

The Answer: A. Continuous deployment Continuous deployment automates every aspect of deploying software. After the developer creates the code, the testing and deployment process is completely hands-off and does not need any human intervention. The incorrect answers: B. Continuity of operations Continuity of operations is used during disaster recovery or incident recovery. This process provides options for keeping the business processes available during or after the incident. C. Continuous delivery Continuous delivery automates the testing process, but it requires human intervention for the final deployment to production. D. Continuous integration With continuous integration, code is constantly written and merged into the central repository many times each day.

Answer 193

The Answer: A. A visual summary of a risk assessment A risk matrix, or risk heat map, is often presented as a graphical chart comparing the likelihood of risk with the consequence. The incorrect answers: B. Identification of risk at each step of a project plan A risk register is a detailed identification and documentation of risk, the application of possible solutions, and ongoing monitoring of the risk at each step of a project. C. A list of cybersecurity requirements based on the identified risks Risk control assessment provides a security administrator with the information needed to build proper security controls for the documented risk. D. Ongoing group discussions regarding cybersecurity Risk awareness involves constant monitoring and analysis of current trends, risks, and response options. This information can be gathered from group discussions, expert presentations, and security conferences and programs.

Answer 194

The Answer: C. Kerberos Kerberos is a network authentication protocol that provides single sign-on and mutual authentication using cryptographic “tickets” for the behindthe-scenes authentication process. The incorrect answers: A. RADIUS The RADIUS (Remote Authentication Dial-in User Service) authentication protocol is commonly used across many different devices and operating systems, but it does not use cryptographic tickets. B. LDAP LDAP (Lightweight Directory Access Protocol) is another common standard that is often used for authentication, but LDAP does not use cryptographic tickets. D. TACACS TACACS (Terminal Access Controller Access-Control System) is a flexible remote authentication protocol, but it does not use cryptographic tickets during the authentication process.

Answer 195

The Answer: D. The source of the attack is 10.1.111.7 and E. The attacker sent an unusual HTTP packet to trigger the IPS The second line of the IPS log shows the type of alert, and this record indicates that a suspicious HTTP packet was sent. The last line of the IPS log shows the protocol, destination, and source IP address information. The source IP address is 10.1.111.7. The incorrect answers: A. The attacker sent a non-authenticated BGP packet to trigger the IPS The alert for this IPS log does not indicate any non-authenticated packets or BGP packets. B. The source of the attack is 192.168.11.1 The last line of the log identifies the protocol and IP addresses. The “src” address is the source of the packet and is identified as 10.1.111.7. C. The event was logged but no packets were dropped The first line of the log shows the name of the IPS that identified the issue, the date and time, and disposition. In this log entry, the packet was rejected from IP address 10.1.111.7.

Answer 196

The Answer: D. Active footprinting Active footprinting sends traffic across the network that can be viewed and/or logged. Performing a port scan will send network traffic to a server, and most port scan attempts can be identified and logged by an IPS. The incorrect answers: A. Initial exploitation An exploit attempt is common when performing a penetration test, but a port scan is not exploiting any vulnerabilities. B. Escalation of privilege If a penetration test is able to exploit a system and obtain a higher level of rights and permissions, then the test is successful at escalating the access privileges. A port scan does not gain access to a system, and it will not provide any privilege escalation. C. Pivot Once a penetration test has exploited a vulnerability and gained access to a system, the tester will use this foothold as a pivot point to access to other devices. Since the inside of the network is usually less secure than the perimeter, this pivot can often provide many more opportunities than the initial exploitation.

Answer 197

The Answer: B. Weak encryption A common issue is weak or outdated security configurations. Older encryptions such as DES and WEP should be updated to use newer and stronger encryption technologies. The incorrect answers: A. Invalid frequency band The 2.4 GHz frequency band is a valid frequency range for 802.11g networks. C. Incorrect IP address and subnet mask None of the listed configuration settings show any issues with the IP address or subnet mask. D. Invalid software version The software version of the access point does not have any configuration options and would not be considered invalid.

Answer 198

The Answer: C. Memory leak A memory leak is when a poorly written application allocates memory for use by the application, but then does not release that memory after it is no longer needed. If the application runs on a system for an extended period of time, this memory leak can grow so large that it eventually uses all available memory and crashes the operating system. The incorrect answers: A. Integer overflow An integer overflow attempts to store a large number into a smaller sized memory space. This can sometimes improperly change the value of memory areas that are outside of the smaller space. B. NULL pointer dereference If an application is written to reference a portion of memory, but nothing is currently allocated to that area of memory, a NULL pointer dereference will occur. This can cause the application to crash, display debug information, or create a denial of service (DoS). D. Data injection The unwanted injection of data into a database, library, or any other dataflow is an injection attack. An application that does not properly release sections of memory is a badly written application and would not be related to a data injection attack.

Answer 199

The Answer: A. DDoS A DDoS (Distributed Denial of Service) is the failure of a service caused by many different remote devices. In this example, the DDoS is related to a bandwidth utilization exhaustion caused by excessive server requests. The incorrect answers: B. Wireless jamming Wireless jamming is caused by interference of the wireless spectrum. In this example, a wireless network was not part of the web server or any issues associated with the server. C. MAC cloning MAC (Media Access Control) address cloning is when a third-party device changes their MAC address to be the same as another station. In this example, the issue is related to a large number of inbound IP addresses. D. Rogue access point A rogue access point is an unauthorized wireless access point. This issue does not appear to be related to a wireless network.

Answer 200

The Answer: B. Passive footprinting Passive footprinting gathers information from as many open sources as possible without performing any vulnerability checks or scans. Passive footprinting would include gathering information from social media, online forums, or social engineering. The incorrect answers: A. Pivot Once an exploit is successful, the attacker will use an exploited system as a foothold point and pivot to other parts of the network from this point. C. White box testing Prior to performing a penetration test, an attacker may already have information about the target network. If information on all of the devices in the scope of the penetration test are made available to the attacker, the test is considered to be a white box penetration test. D. Persistence If a system has been exploited, it’s common for the attacker to create a normal user account or backdoor to maintain access if the vulnerability becomes patched.

Answer 201

The Answer: E. ESP ESP (Encapsulation Security Payload) encrypts the data in the IP packet. In IPsec (Internet Protocol Security) transport mode, the IP header is not encrypted and is used for routing. In tunnel mode, both the original IP header and data are encrypted and encapsulated within a separate IP header. The incorrect answers: A. ECB ECB (Electronic Codebook) is a block cipher mode where each block is encrypted with the same key. For IPsec (and most use cases), ECB is too simple to ensure data confidentiality. B. AH The AH (Authentication Header) contains a hash of the IPsec packet to provide integrity protection of the data. The AH does not encrypt data. C. PEAP PEAP (Protected Extensible Authentication Protocol) is an authentication protocol that encapsulates EAP in a TLS (Transport Layer Security) tunnel to ensure a protected authentication process. PEAP is not used to protect IPsec data. D. HMAC HMAC (Hash-based Message Authentication Code) is a hashing algorithm commonly used with the AH field of IPsec. HMAC does not provide any data confidentiality.

Answer 202

The Answer: A. Private A private model requires that the end user purchase, install, and maintain their own application hardware and software. This model also provides a high level of security. The incorrect answers: B. Community A community cloud model allows multiple organizations to share the same cloud resources. A cloud built in a company data center for personal use would not provide any community cloud features. C. Hybrid A hybrid cloud model combines both private and public cloud infrastructures. The description provided in the question does not include any public resources. D. Public A public cloud is built on an infrastructure that would be open to all users on the Internet.

Answer 203

The Answer: A. Bot A bot (robot) is malware that installs itself on a system and then waits for instructions. It’s common for botnets to use thousands of bots to perform DDoS (Distributed Denial of Service) attacks. The incorrect answers: B. Logic bomb A logic bomb waits for a predefined event to occur. The scope of devices infected with a logic bomb are relatively small and localized as compared to a botnet. C. Ransomware Ransomware locks a system and prevents it from operating. The locked device does not commonly participate in a DDoS. D. Keylogger A keylogger will silently capture keystrokes and transmit an archive of those keystrokes to a third-party. A keylogger does not commonly participate in a DDoS.

Answer 204

The Answer: C. Legal hold A legal hold is a legal technique to preserve relevant information. This process will ensure the data remains accessible for any legal preparation that occurs prior to litigation. The incorrect answers: A. Chain of custody Chain of custody ensures that the integrity of evidence is maintained. The contents of the evidence are documented, and each person who contacts the evidence is required to document their activity. B. Data loss prevention Data loss prevention (DLP) is a technique for identifying sensitive information transmitted across the network, such as Social Security numbers, credit card numbers, and other PII (Personally Identifiable Information). DLP is not a legal technique. D. Order of volatility The order of volatility is a list of how long data will remain available before it is unrecoverable. For example, information stored in a router table is more volatile than data stored on a backup tape.

Answer 205

The Answer: B. Cable lock A cable lock would attach the laptop to a solid object and prevent it from being moved or taken. The incorrect answers: A. Biometrics Biometrics can provide a useful authentication factor, but they won't stop a laptop from moving. C. Protected distribution A protected distribution describes a hardened series of conduits for network cable and fiber. A protected distribution would not prevent a laptop from being stolen. D. Faraday cage A Faraday cage prevents the transmission of electromagnetic signals. Using a Faraday cage around a laptop would not prevent laptop theft.

Answer 206

The Answer: B. Anomaly-based Anomaly-based detection will build a baseline of what it considers to be normal. Once the baseline is established, the IPS (Intrusion Prevention System) will then block any traffic that deviates from the baseline. The incorrect answers: A. Heuristic Heuristic IPS technology uses artificial intelligence to identify attacks that have no prior signature. C. Behavior-based Behavior-based IPS technology will alert if a particular type of bad behavior occurs. For example, a URL with an apostrophe and SQL command would indicate a SQL injection, and someone trying to view /etc/shadow would indicate an attempt to gain access to a protected part of the file system. This is universally considered to be bad behavior, and it would be flagged by a behavior-based IPS. D. Signature-based A signature-based IPS is looking for a specific traffic flow pattern, and once that traffic matches the signature the traffic can be blocked.

Answer 207

The Answer: A. ping 10.11.1.1 arp -a The arp (Address Resolution Protocol) command can be used to view the local ARP cache. The cache contains a lookup table containing IP addresses and their associated MAC (Media Access Control) address. If an engineer pings a device on the local network and then views the ARP cache, they will see the MAC address that was resolved during the ARP process. The incorrect answers: B. tracert 10.11.1.1 The tracert (traceroute) command will display the IP addresses of routers between two devices. MAC addresses are not displayed in the traceroute output. C. dig 10.11.1.1 The dig (Domain Information Groper) command is used to gather information from DNS (Domain Name System) servers. MAC address information is not viewable with the dig command. D. ipconfig /all The ipconfig command will display IP address and MAC address information for the local Windows computer, but it does not show the MAC address information of the default gateway

Answer 208

The Answer: D. netstat The netstat command can view inbound and outbound statistics for all connections to a device. The incorrect answers: A. netcat The netcat command can read or write information to the network. Netcat can be used to create an open connection on a device or to access a connection on a remote machine. B. nmap The Nmap utility is commonly used to locate open ports and identify services running on a remote device. C. net view The Windows net view command is used to list the available file shares on a Windows computer

Answer 209

The Answer: A. Patch management This question describes an actual breach that occurred in 2017 to web servers at a large credit bureau. This breach resulted in the release of almost 150 million customer names, Social Security numbers, addresses, and birth dates. A web server vulnerability announced in March of 2017 was left unpatched, and attackers exploited the vulnerability two months later in May. The attackers were in the credit bureau network for 76 days before they were discovered. A formal patch management process would have clearly identified this vulnerability and would have given the credit bureau the opportunity to mitigate or patch the vulnerability well before it would have been exploited. The incorrect answers: B. Full disk encryption Full disk encryption (FDE) would prevent unauthenticated access to the data, but the web server would be an authorized user and would have normal access to the areas of the operating system that are necessary for normal operation. Enabling FDE would not provide any additional security against a data breach. C. Disable unnecessary services It’s always a good best practice to disable unnecessary services, but this breach attacked a very necessary web service. D. Application allow lists Application allow lists would prevent unauthorized applications from running, but it would not prevent an attack to the web service application.

Answer 210

The Answer: A. MITRE ATT&CK The MITRE ATT&CK framework is a knowledgebase that contains points of intrusion, methods used for attackers to move around, and a list of security techniques to prevent future attacks. The incorrect answers: B. Diamond model The diamond model is a way to summarize the aftermath of an intrusion. Documentation for this model includes information about the adversary, capability, infrastructure, and the victim. C. Tabletop exercise A tabletop exercise is used to step through a disaster recovery scenario in a conference room without going through the time-consuming steps of an actual simulation. Problems with processes and procedures can often be resolved during the tabletop exercise. D. ISO 27701 The ISO (International Organization for Standardization) 27701 standard focuses on the processes associated with a privacy information management system (PIMS).

Answer 211

The Answer: B. Containment The containment phase isolates events that can quickly spread and get out of hand. A file transfer from a database server can quickly be contained by disabling any ability to continue the file transfer. The incorrect answers: A. Eradication Eradication focuses on removing the cause of the event and restoring the systems back to their non-compromised state. C. Lessons learned After the event is over, the lessons learned phase helps everyone learn and improve the process for the next event. D. Preparation Before an event occurs, it’s important to have the contact numbers, tools, and processes ready to go.

Answer 212

The Answer: D. Securely derive a session key The Diffie-Hellman process can combine public and private keys to derive the same session key on both sides of a conversation without sending that session key across the network. The incorrect answers: A. Real-time video encryption The high speeds require for real-time video encryption and decryption would not be an efficient use for asymmetric encryption. Most high-speed or large-scale encryption uses symmetric encryption. B. Store passwords The best practice for password storage is to use hashes instead of encryption. Hashes ensure that a stored password can't be reverse engineered to produce the original password. C. Protect data on mobile devices The limited CPU and power available on a mobile device requires a more efficient form of confidentiality than asymmetric encryption. It's common for mobile devices to use elliptic curve cryptography (ECC), for example.

Answer 213

The Answer: B. Full disk encryption With full disk encryption, everything written to the laptop’s local drive is stored as encrypted data. If the laptop was stolen, the thief would not have the credentials to decrypt the drive data. The incorrect answers: A. Remote wipe Although a remote wipe function is useful, it’s a reactive response that does not provide any data protection prior to the wipe. C. Biometrics Biometric authentication can limit access to the operating system, but the laptop’s storage drive can still be removed and read from another computer. D. BIOS user password Adding a power-on BIOS password would help prevent any unauthorized access to the operating system, but the password doesn’t provide any protection for the data on the laptop’s storage drive.

Answer 214

The Answer: D. Guest network with captive portal A guest network would allow access to the Internet but prevent any access to the internal network. The captive portal would prompt each guest for authentication or to agree to terms of use before granting access to the network. The incorrect answers: A. NAT NAT (Network Address Translation) is a method of modifying IP addresses when traversing the network, but NAT itself does not provide any additional security mechanisms. B. Ad hoc wireless workstations Ad hoc wireless devices are able to communicate with each other without the use of an access point. There are no additional security features included with an ad hoc connection. C. Intranet The intranet is a private internal network used by company employees. It’s common to provide the highest protection to the intranet resources, so a company would not commonly connect the intranet to a public conference room.

Answer 215

The Answer: C. dd The Linux dd command is commonly used to create an image of a partition or disk. The incorrect answers: A. Memdump The memdump command is used to make a copy of everything stored in local system memory. This dump of memory does not contain any local storage drive files. B. chmod The Linux chmod (change mode) command is used to modify the access rights and permissions of files stored on the system. The chmod command is not used to create system images. D. tcpdump The tcpdump utility is used to capture and store network packets. The tcpdump utility does not create images from stored data.

Answer 216

The Answer: C. Managerial A managerial control is a guideline that would control how people act, such as security policies and standard operating procedures. The incorrect answers: A. Compensating A compensating security control doesn’t prevent an attack, but it does restore from an attack using other means. A security policy does not provide a way to restore from an attack. B. Detective A detective control may not prevent access, but it can identify and record any intrusion attempts. Security policies do not provide any identification or recording of intrusions. D. Physical A physical control would block access. For example, a door lock or security guard would be a physical control.

Answer 217

The Answer: C. Maintain reliable backup data Organized crime is often after data, and can sometimes encrypt or delete data on a service. A good set of backups can often resolve these issues quickly and without any ransomware payments to an organized crime entity. The incorrect answers: A. Prevent users from posting passwords near their workstations Criminal syndicate members usually access systems remotely. Although it’s important that users don’t write down their passwords, the organized crime members aren’t generally in a position to see them. B. Require identification cards for all employees and guests Since the criminal syndicate members rarely visit a site, having identification for employees and visitors isn’t the largest concern associated with this threat actor. D. Use access control vestibules at all data center locations Access control vestibules control the flow of people through an area, and organized crime members aren’t usually visiting a data center.

Answer 218

The Answer: C. Implement a secure configuration of the web service The tech support resources for many services will include a list of hardening recommendations. This hardening may include account restrictions, file permission settings, internal service configuration options, and other settings to ensure that the service is as secure as possible. The incorrect answers: A. Build a backup server for the application Of course, you should always have a backup. Although the backup may help recover quickly from an attack, the backup itself won’t protect the application from attacks. B. Run the application in a cloud-based environment The location of the application service won’t provide any significant protection against attacks. Some cloud-based services may include some additional security features, but many do not. Given the options available, running the application in the cloud would not be the best option available. D. Send application logs to the SIEM via syslog It’s always useful to have a consolidated set of logs, but the logs on the SIEM (Security Information and Event Management) server won’t protect the application from attacks.

Answer 219

The Answer: A. Enable WPA3 encryption A MAC (Media Access Control) address can be spoofed on a remote device, which means anyone within the vicinity of the access point can view legitimate MAC addresses and spoof them to avoid the MAC filter. To ensure proper authentication, the system administrator can enable WPA3 (Wi-Fi Protected Access version 3) with a shared key, or configure 802.1X to integrate with an existing authentication database. The incorrect answers: B. Remove unauthorized MAC addresses from the filter Since MAC addresses are visible when capturing packets, any unauthorized users affected by the removal of a MAC address would simply obtain the remaining MAC addresses in use and spoof those addresses to gain access. C. Modify the SSID name The SSID (Service Set Identifier) is the name associated with the wireless network. The name of the access point is not a security feature, so changing the name would not provide any additional access control. D. Modify the channel The frequencies used by the access point are chosen to minimize interference with nearby wireless devices. These wireless channels are not security features and changing the frequency would not limit unauthorized access.

Answer 220

The Answer: C. Playbook A playbook describes a broad set of steps to follow to manage a security event. For example, a playbook might describe the processes to follow when investigating a data breach or when recovering from a ransomware attack. The incorrect answers: A. Managerial controls Managerial security controls describe administrative security methods, such as security policies and rules. B. DAC DAC (Discretionary Access Control) describes an access control method where the user decides which users can access their data and the permissions associated with that access. D. Order of volatility The order of volatility describes the lifetime associated with digital data. These volatility rates are important when determining which forensic data should be gathered first.

Answer 221

The Answer: C. 802.1X IEEE 802.1X is a standard for port-based network access control (NAC). When 802.1X is enabled, devices connecting to the network do not gain access until they provide the correct authentication credentials. This 802.1X standard refers to the client as the supplicant, the switch is commonly configured as the authenticator, and the backend authentication server is a centralized user database such as Active Directory. The incorrect answers: A. Federation Federation would allow members of one organization to authenticate to the network of another organization using their normal credentials. B. AES AES (Advanced Encryption Standard) is a common encryption protocol, and it does not describe a supplicant, authenticator, or authentication server. D. PKI PKI (Public Key Infrastructure) is a method of describing the public-key encryption technologies and its supporting policies and procedures. PKI does not require the use of supplicants, authenticators, or authentication servers.

Answer 222

The Answer: A. NFC and D. Biometrics The wall sensor will be activated with the phone’s NFC (Near-field Communication) electronics and would authenticate using the biometric fingerprint reader on the phone. The incorrect answers: B. Remote wipe Although remote wipe can be a useful management tool for a mobile device, there’s no need to include remote wipe capabilities with this particular application. The door unlocking process would still require authentication using the user’s fingerprint if the phone was lost or stolen. C. Containerization This application doesn’t appear to store any confidential local data, so keeping the enterprise data separate from the personal data isn’t a significant concern. E. Push notification A push notification will cause alerts to appear on the phone without any user intervention. In this app, all of the actions are initiated by the user.

Answer 223

The Answers: B. Bollards and D. Fencing Both bollards and fencing provide physical security controls that can direct people through an area by limiting their access to other areas The incorrect answers: A. Cable locks A cable lock would help keep a computer or laptop securely fastened to a table or desk, but it wouldn't help direct people to a particular entrance. C. Biometrics Biometrics provide a unique authentication factor, but they aren't commonly used to direct people to a particular building entrance. E. Industrial camouflage Industrial camouflage would not draw any attention to the entrance, and would ultimately make the entrance more difficult to find. F. Video surveillance Video surveillance would make it easy to monitor and view visitors approaching the building, but it would not provide any directions to the front doors.

Answer 224

The Answer: A. Run a credentialed vulnerability scan A credentialed scan would provide login access and allow the scan to run as a standard user on the network. The incorrect answers: B. Capture packets of the application traffic flows from the internal network A non-intrusive packet capture would not provide any significant vulnerability information, and it would not be possible to test for additional vulnerabilities with just the packets. C. Identify an exploit and perform a privilege escalation There’s no guarantee that any of the systems will be vulnerable to an exploit, and there’s also no guarantee that such an exploit would provide any user access. D. Scan the network during normal working hours Scanning a network from the outside or without credentials would not provide a list of vulnerabilities from the user’s perspective, regardless of the time of day.

Answer 225

The Answer: B. SQL injection A SQL (Structured Query Language) injection takes advantage of poorly written web applications. These web applications do not properly restrict the user input, and the resulting attack bypasses the application and “injects” SQL commands directly into the database itself. The incorrect answers: A. Session hijack If a third-party obtained the session ID of an already-authenticated user, they could effectively communicate directly to the application without a username and password. A session hijack by itself would not allow for direct database communication. C. Cross-site scripting A cross-site scripting attack commonly uses scripts at one web site to execute commands on other sites. These types of attacks take advantage of the trust of a local browser, but they don’t commonly have direct access to a database. D. On-path An on-path attack is often used to capture, monitor, or inject information into an existing data flow. An on-path attack is not commonly used for SQL injection attacks.

Answer 226

The Answer: D. Permission and usage audit A permission and usage audit will verify that all users have the correct permissions and that all users meet the practice of least privilege. The incorrect answers: A. Location-based policies Location-based policies would assign rights and permissions based on physical location. For example, a location-based policy might allow users to login from local IP address ranges but not from locations outside of the corporate offices. B. On-boarding process The on-boarding process is used when a new person is hired or transferred into the organization. In this example, none of the users were identified as new employees. C. Account deprovisioning Account deprovisioning is the disabling of an account and archiving of user information. This process usually occurs when an employee has left the organization.

Answer 227

The Answer: A. Ledger The ledger is a shared document with a list of all blockchain transactions. The ledger is shared among everyone in the blockchain, and all transactions are available to view on this central ledger. The incorrect answers: B. HSM An HSM (Hardware Security Module) provides secure key storage and cryptographic functions for servers and applications. An HSM does not provide tracking services. C. SIEM A SIEM (Security Information and Event Manager) is commonly used to consolidate log files and create reports. A SIEM is not used to monitor blockchain transactions. D. SED A SED (Self-Encrypting Drive) ensures confidentiality by automatically encrypting everything saved to the drive. A SED does not provide any tracking functionality

Answer 228

The Answer: D. Domain hijacking A domain hijacking will modify the primary DNS (Domain Name System) settings for a domain and will allow an attacker to direct users to any IP address. The incorrect answers: A. DDoS A DDoS (Distributed Denial of Service) would prevent users from accessing a service. In this example, users were accessing an unauthorized service. B. Disassociation attack A disassociation attack is a wireless attack that operates by removing devices from a wireless network. C. Evil twin An evil twin is a wireless access point that looks similar to the authentic AP. In this example, the issue is not related to a single wireless network and is occurring on many different devices.

Answer 229

The Answer: C. Air gap An air gap is a physical separation between networks. Air gapped networks are commonly used to separate networks that must never communicate to each other. The incorrect answers: A. Firewall A firewall would provide a method of filtering traffic between networks, but firewalls can often be misconfigured and inadvertently allow some traffic to pass. Although this is one option, it’s not the best option given the alternative of an air gap. B. Protected distribution A protected distribution is a physically secure cabled network. This usually consists of a sealed metal conduit to protect from taps and cable cuts. A protected distribution does not restrict traffic between networks. D. VLANs A VLAN (Virtual Local Area Network) is a logical method of segmenting traffic within network switches. Although this segmentation is effective, it’s not as secure as an air gap.

Answer 230

The Answer: A. Recognizing social engineering Impersonating the CEO is a common social engineering technique. There are many ways to recognize a social engineering attack, and it’s important to train everyone to spot these situations when they are occurring The incorrect answers: B. Using emails for personal use It’s important that everyone understands the proper use of email and avoid personal use of the corporate email service. In this instance, however, the receptionist was not using email for personal use. C. Proper use of social media The attack vector used in this situation was email. Social media sites were not used in this particular example. D. Understanding insider threats Although the attacker wasn’t identified, we could assume that an employee would already have access to the internal corporate employee directory.

Answer 231

The Answer: C. Containerization The storage segmentation of containerization keeps the enterprise apps and data separated from the user’s apps and data. During the offboarding process, only the company information is deleted and the user’s personal data is retained. The incorrect answers: A. Policy management Policies can often be managed through a mobile device manager, allowing the security administrator to limit the use of certain apps, camera functions, or data storage. These management functions are important, but they don’t necessarily affect the separation of storage or removal of data inside of the mobile device. B. Geofencing Geofencing restricts or allows features when a mobile device is in a particular location. Geofencing will not have any effect on the separation of data inside of a mobile device. D. Storage encryption If a mobile device is lost or stolen, storage encryption ensures that the data will remain confidential. The encryption process itself does not provide any separation between enterprise data and user data.

Messer Security+ Flashcards

(255 cards)