Module 9.1

Question 1

What does an organization need to do to harden an operating system and keep it secure?

Answer 1

A good administrator will:

• Configure the operating system to protect against outside threats.
• Remove any unnecessary programs and services.
• Ensure that security patches and updates are installed in a timely manner to correct faults and mitigate risks.

An organization should:

• Maintain a systematic approach for addressing system updates.
• Establish procedures for monitoring security-related information.
• Evaluate updates for applicability.
• Plan the installation of application updates and patches.
• Install updates using a documented plan.

Question 2

• Another critical way to secure an operating system is to identify potential vulnerabilities.
• Establish this to compare how a system is performing against baseline expectations.

Answer 2

A Baseline

Question 3

This antivirus product can appear while internet browsing and most display an ad or popup that looks like an actual Windows warning. Clicking anywhere inside the window may download and install malware instead.

Answer 3

Watch out for rogue antivirus products

Question 4

Uses legitimate programs to infect a computer. These viruses are hard to detect and use scripting languages such as Windows PowerShell.

Answer 4

Fileless attacks are difficult to detect and remove

Question 5

Scripting languages such as Python, Bash (the command-line language for Apple’s macOS and most Linux distributions) or Visual Basic for Applications (or VBA, used in Microsoft macros) can be used to create scripts that are malware.

Answer 5

Scripts can also be malware

Question 6

Unapproved or non-compliant software may be unintentionally installed on a computer. It can interfere with the organization’s software or network services and should be removed immediately.

Answer 6

Always remove unapproved software

Question 7

Patch Management

Answer 7

• To stay one step ahead of cybercriminals, keep systems secure and up to date by regularly installing patches.
• Patches are code updates that prevent a new virus, worm, or other malware from making a successful attack.
• Operating systems such as Windows routinely check for updates that can protect a computer from the latest security threats.
• As a cybersecurity professional, it’s good practice to test a patch before deploying it throughout the organization.
• A patch management tool can be used to manage patches locally instead of using the vendor’s online update service.

Question 8

Patch Management benefits

Answer 8

• Administrators can approve or decline updates.
• Administrators can force the update of systems on a specific date.
• Administrators can obtain reports on the update(s) needed by each system.
• There is no need for each computer to connect to the vendor’s service to download patches; instead, it gets the verified update from a local server.
• Users cannot disable or circumvent updates.

Question 9

It runs on a device to restrict incoming and outgoing network activity for that device.

Answer 9

Host-based firewall

Question 10

A software installed on a device or server to monitor suspicious activity and detect malicious requests.

Answer 10

Host-intrusion detection system (HIDS)

Question 11

A software that monitors a device for known attacks and anomalies (deviations in bandwidth, protocols and ports), or finds red flags by assessing the actual protocols in packets.

Answer 11

Host-intrusion prevention system (HIPS)

Question 12

Integrated security solution that continuously monitors, collects and analyzes data from an endpoint device and responds to any threats it detects.

Answer 12

Endpoint detection and response (EDR)

Question 13

provide a centralized way to ensure that sensitive data is not lost, misused or accessed by unauthorized users.

Answer 13

Data loss prevention (DLP)

Question 14

A network security device that combines a traditional firewall with
other network-device-filtering functions.

Answer 14

Next-generation firewall (NGFW)

Question 15

The Windows feature allows users to encrypt files, folders, or an
entire hard drive.

Answer 15

Encrypting File System (EFS)

Question 16

encrypts the entire contents of a drive (including temporary files and
memory).

Answer 16

Full disk encryption (FDE)

Question 17

A specialized chip on the motherboard that stores information about the host system, such as encryption keys, digital certificates, and passwords.

Answer 17

Trusted Platform Module (TPM)

Question 18

Ensures that the system can be trusted and has not been altered while the operating system loads.

Answer 18

Boot integrity

Question 19

Stored on a small memory chip on the motherboard. The BIOS is the first program that runs when you turn on the computer.

Answer 19

Firmware (software instructions about basic computer functions)

Question 20

A newer version of BIOS, defines a standard interface between the operating system, firmware, and external devices.

Answer 20

Unified Extensible Firmware Interface (UEFI)

Question 21

A security standard to ensure that a device boots using trusted software.

Answer 21

Secure Boot

Question 22

Provides stronger validation than Secure Boot

Answer 22

Measured Boot

Question 23

The hardware platform has enhanced security features such as a special CPU, boot, and a dedicated AES encryption engine.

Answer 23

Security-focused hardware

Question 24

Apple Data Protection and FileVault data storage encryption are
supported by the hardware-based AES encryption engine.

Answer 24

Encrypted storage

Question 25

The Boot ROM protects low-level hardware and only allows genuine and unaltered Apple OS software to run.

Answer 25

Secure boot

Question 26

Processed in the security hardware system. This keeps it segregated from the OS and running application software, including malware.

Answer 26

Secure biometric data

Question 27

Helps find lost or stolen macOS devices through its location tracking function. It also enables remote device locking and storage erasing if critical data is at risk.

Answer 27

Find My Mac

Question 28

Antimalware technology prevents the execution of malware through signature-based malware detection. It also alerts users to the existence of malware and provides the option to remove detected malware files.

Answer 28

XProtect

Question 29

Detects and removes existing malware infections when detection rules are automatically updated by Apple. It also monitors for malware infections at system restart and user login.

Answer 29

Malware Removal Tool (MRT)

Question 30

Ensures that only authentic, digitally-signed software that has been created by an Apple-notarized software developer is permitted to be installed.

Answer 30

Gatekeeper

Question 31

* Use cable locks to secure devices * Keep telecommunication rooms locked * Use security cages (Faraday cages) around equipment to block electromagnetic fields.

Answer 31

Computer Equipment

Question 32

* A standard keyed entry lock is the most common type of door lock and are often easy to force open. * A deadbolt lock can be added for extra security. * A cipher lock uses buttons that are pressed in a given sequence to open the door.

Answer 32

Door locks

Question 33

* RFID uses radio waves to identify and track objects. * RFID tags are small, require little power, contain an integrated circuit connecting to an antenna, and can be attached to any item that an organization wants to track.

Answer 33

Radio frequency identification (RFID) systems