Practice study 2 Flashcards
A security administrator has performed an audit of the organization’s production web servers, and the results have identified banner information leakage, web services that run from a privileged account, and inconsistencies with SSL certificates. Which of the following would be the BEST way to resolve these issues? ❍ A. Server hardening ❍ B. Multi-factor authentication ❍ C. Use HTTPS ❍ D. Run operating system updates
A. Server hardening
Many applications and services include secure configuration guides that can assist in hardening the system. These hardening steps will make the
system as secure as possible while simultaneously allowing the application to run efficiently.
SY0-501, Objective 1.4 - Penetration Testing
The incorrect answers:
B. Multi-factor authentication
Although multi-factor authentication is always a good best practice, simply
enabling multiple authentication methods would not resolve the issues
identified during the audit.
C. Use HTTPS
Most web servers will use HTTPS to ensure that network communication
is encryption. However, the encrypted network traffic would not correct
the issues identified during the audit.
D. Run operating system updates
Keeping the system up to date is another good best practice, but the
issues identified during the audit were not bugs related to the operating
systems. All of the issues identified in the audit appear to be related to the
configuration of the web server, so any resolution will focus on correcting
these configuration issues.
A shipping company stores information in small regional warehouses around the country. The company does not keep an IT person at each warehouse, and most configuration changes are completed remotely. The
company keeps an IPS online at each warehouse to watch for suspicious traffic patterns. Which of the following would BEST describe the security control used at the warehouse?
❍ A. Administrative
❍ B. Compensating
❍ C. Physical
❍ D. Detective
D. Detective
An IPS can detect and record any intrusion attempt.
The incorrect answers:
A. Administrative
Administrative controls would be guidelines that would control how people
act, such as security policies and standard operating procedures.
B. Compensating
A compensating control can’t prevent an attack, but it can compensate
when an attack occurs. For example, a compensating control would be the
re-imaging process or a server restored from backup if an attack had been
identified.
C. Physical
A physical control would block
SY0-501, Objective 5.7 - Security Controls
An internal sales application is updated each day with new pricing information, feature updates, and security patches. The system administrators have traditionally pushed these updates to the end-user workstations every Friday night, but the sales management teams would prefer daily updates. Which of the following would be the BEST way to keep this application updated every day?
❍ A. IT configures an overnight testing environment and performs automated patch management
❍ B. The development team pushes the updates to the end-user workstations when ready
❍ C. The sales teams manually update the application on-demand
❍ D. The development team sends the updates directly to the sales managers
A. IT configures an overnight testing environment and
performs automated patch management
To properly deploy any changes, the IT team will need to perform testing to ensure that the change does not cause problems with any other application or the underlying operating system. After the testing is complete, the
update can be pushed out to the end-user device.
The incorrect answers:
B. The development team pushes the updates to the end-user
workstations when ready
Although the development team is usually very confident in the stability
of their application, they aren’t responsible for testing other applications
or the underlying operating system. Pushing an untested update could
potentially disable other applications or the entire operating system.
C. The sales teams manually update the application on-demand
Putting the responsibility for updates on the sales teams circumvents any
testing and requires that the sales teams actively remember to perform the
update.
D. The development team sends the updates directly to the sales managers
Not only does this option skip the testing process, but it requires the sales
managers to become experts at application updates and requires the sales
management team to troubleshoot
SY0-501, Objective 3.3 - Operating System Security
A security engineer is preparing to conduct a penetration test. Part of the preparation involves reading through social media posts for information
about a third-party website. Which of the following describes this practice?
❍ A. Grey box testing
❍ B. Passive reconnaissance
❍ C. Exfiltration
❍ D. Active reconnaissance
B. Passive reconnaissance
Passive reconnaissance is the process of obtaining as much information as possible from open sources, such as social media sites, corporate websites, online forums, and other publicly available locations.
The incorrect answers:
A. Grey box testing
A grey box test describes how much information the attacker knows about
the test. With a grey box, the attacker may have access to some information
about the test, but not all information is disclosed.
C. Exfiltration
Exfiltration describes the theft of data by an attacker.
D. Active reconnaissance
Active reconnaissance would show some evidence of data gathering.
For example, performing a ping scan or DNS query wouldn’t exploit a
vulnerability, but it would show that someone was gathering information.
SY0-501, Objective 1.4 - Penetration Testing
A company’s IT security team has used a known exploit against an internal server. This exploit allowed the security team to gain access to the operating system without using any authentication. Which of the
following describes the actions of the security team?
❍ A. Active reconnaissance
❍ B. Vulnerability scan
❍ C. Zero-day attack
❍ D. Penetration test
D. Penetration test
A penetration test will attempt to exploit a vulnerability to gain access to data or a system.
The incorrect answers:
A. Active reconnaissance
Active reconnaissance will gather information about a system, but it will
stop short of exploiting a vulnerability.
B. Vulnerability scan
A vulnerability scan will identify any known vulnerabilities that may be
associated with a system. However, a vulnerability scan will not attempt to
exploit a vulnerability.
C. Zero-day attack
A zero-day attack is an attempt to exploit a system using a vulnerability
SY0-501, Objective 1.4 - Penetration Testing
An organization is using Shibboleth to implement SAML. Which of the
following would BEST describe this configuration?
❍ A. An internal help desk needs centralized logins to all switches and routers
❍ B. A user logging in once to the Windows Domain will not need to re-authenticate to other resources
❍ C. A university needs to provide login access to a research server with user accounts from many different schools
❍ D. The login credentials to a message board hash all passwords with a salt
C. A university needs to provide login access to a research
server with user accounts from many different schools
SAML (Security Assertion Markup Language) is an open standard for authentication and authorization. Shibboleth is open-source software that
implemenents SAML to provide federated authentication, which would fit the scenario where many different account types need to login to a shared resource.
The incorrect answers:
A. An internal help desk needs centralized logins to all switches
and routers
Internal authentication methods are usually centralized using RADIUS
(Remote Authentication Dial-In User Service), TACACS+ (Terminal
Access Controller Access-Control System Plus), or a similar authentication
framework. There would be no need for Shibboleth and SAML for internal
centralized authentication.
B. A user logging in once to the Windows Domain will not need to
re-authenticate to other resources
The Kerberos protocol provides the SSO (Single Sign On) functionality
used in Windows. Shibboleth and SAML are not associated with this SSO
process.
D. The login credentials to a message board hash all passwords with a salt
A good best practice is to store passwords as a salted hash. This
SY0-501, Objective 4.2 - Federated Identities
Which of the following would be MOST associated with the testing phase of the secure deployment process?
❍ A. Performance baselines are created
❍ B. Updated application code is installed on end user computers
❍ C. Code is written and executed in a sandbox
❍ D. QA techs will evaluate the functionality of the application
D. QA techs will evaluate the functionality of the application
The QA (Quality Assurance) process tests the usability and features of an application to ensure that it will work as designed on the end user systems.
The incorrect answers:
A. Performance baselines are created
The performance of an application is usually created during the staging
phase once the application code has been frozen.
B. Updated application code is installed on end user computers
Applications aren’t updated on the end user devices until the testing and
staging phases are complete.
C. Code is written and executed in a sandbox
The development teams write their software and test the functionality of
the code in their own self-contained sandbox environment.
SY0-501, Objective 3.4 - Secure Deployments
Which of the following allows an attacker to access a Bluetooth-enabled device and transfer contact lists, email, pictures, and other data without prior authorization? ❍ A. Bluejacking ❍ B. Spoofing ❍ C. Evil twin ❍ D. Bluesnarfing
D. Bluesnarfing
Bluesnarfing was one of the first major vulnerabilities associated with Bluetooth.
The incorrect answers:
A. Bluejacking
Bluejacking allowed a third-party to send unsolicited messages to another
device using Bluetooth.
B. Spoofing
Spoofing is when one device pretends to be another. The Bluesnarfing
vulnerability doesn’t require a device to be spoofing another.
C. Evil twin
An evil twin is a malicious device that is configured identically to a
legitimate device. These are often associated with wireless network attacks.
SY0-501, Objective 1.2 - Bluejacking and Bluesnarfing
A company is launching a new internal application that will not startup until a username and password is entered and a smart card is plugged into the computer. Which of the following BEST describes this process? ❍ A. Federation ❍ B. Accounting ❍ C. Authentication ❍ D. Authorization
C. Authentication
The process of proving who you say you are is authentication. In this example, the password and smart card are two factors of authentication, and both reasonably prove that the person logging in is authentic.
The incorrect answers:
A. Federation
Federation provides a way to authenticate and authorize between two
different organizations. In this example, the authentication process uses
internal information without any type of connection or trust to a
third-party.
B. Accounting
Accounting will document information regarding a user’s session, such as
login time, data sent and received, files transferred, and logout time.
D. Authorization
The authorization process assigns users to resources. This process
SY0-501, Objective 4.1 - AAA and Authentication
An online retailer is planning a penetration test as part of their PCI DSS validation. A third-party organization will be performing the test, and the online retailer has provided the Internet-facing IP addresses for their public web servers but no other details. What penetration testing methodology is the online retailer using? ❍ A. White box ❍ B. Passive reconnaissance ❍ C. Grey Box ❍ D. Ping scan
C. Grey Box
A grey box test is performed when the attacker knows some information about the victim, but not all information is available.
The incorrect answers:
A. White box
A white box test is performed when the attacker has complete details about
the victim’s systems and infrastructure.
B. Passive reconnaissance
Passive reconnaissance is the process of gathering information from
publicly available sites, such as social media or corporate websites.
D. Ping scan
A ping scan is a type of network scan that can identify devices
SY0-501, Objective 1.4 - Penetration Testing
A manufacturing company makes radar used by commercial and military organizations. A recently proposed policy change would allow the use of
mobile devices inside the facility. Which of the following would be the MOST significant security issue associated with this change in policy?
❍ A. Unauthorized software on rooted devices
❍ B. Remote access clients on the mobile devices
❍ C. Out of date mobile operating systems
❍ D. Photo and video use
D. Photo and video use
The exfiltration of company confidential information is relatively simple with an easily transportable camera or video recorder. Organizations associated with sensitive products or services must always be aware of the
potential for information leaks using photos or video.
The incorrect answers:
A. Unauthorized software on rooted devices
Although unauthorized software use can be a security issue, it isn’t as
significant as the exfiltration of company confidential information.
B. Remote access clients on the mobile devices
It’s sometimes convenient to have a remote access client available, and this
type of access can certainly be a concern if the proper security is not in
place. However, the much more significant security issue in this list would
be associated with the ease of photos and videography when working with
confidential information.
C. Out of date mobile operating systems
Having an outdated operating system can potentially include security
vulnerabilities, but these vulnerabilities
SY0-501, Objective 2.5 - Mobile Device Enforcement
A company is designing an application that will be used at their remote storefronts. It is expected that this application will have a high demand and will require significant computing resources during the summer. During the winter, there will be little to no application use and resource use should be minimal. Which of these characteristics BEST describe this application requirement? ❍ A. Availability ❍ B. Orchestration ❍ C. Imaging ❍ D. Elasticity
D. Elasticity
Elasticity is the process of providing resources when demand increases and scaling down when the demand is low.
The incorrect answers:
A. Availability
Availability describes the ability to use a service, but it doesn’t directly
describe the ability of the service resources to grow or shrink based on
demand.
B. Orchestration
The process of automating the configuration, maintenance, and operation
of an application instance is called orchestration. The description of the
application requirement didn’t mention the use of automation when
scaling resources.
C. Imaging
Imaging is a technique that allows a system administrator to build a
specific operating system and application configuration. This configuration
can then be saved as an “image” and easily deployed to other systems.
SY0-501, Objective 3.8 - Resiliency and Automation
Vala, a security analyst, has received an alert from her IPS regarding active exploit attempts from the Internet. Which of the following would provide
detailed information about these exploit attempts?
❍ A. Netstat command
❍ B. Nmap scan
❍ C. Vulnerability scan
❍ D. Protocol analyzer
D. Protocol analyzer
A protocol analyzer can provide information about every frame that traverses the network. From a security perspective, the protocol decode can show the exploitation process and details about the payloads used during the attempt.
The incorrect answers:
A. Netstat command
The netstat command can display connectivity information about a device,
but it won’t provide any additional details about an exploit attempt.
B. Nmap scan
An Nmap scan is a useful tool for understanding the potential exploitation
vectors of a device, but it won’t show information about an active
exploitation attempt.
C. Vulnerability scan
A vulnerability scan can help identify potential exploit vectors, but
SY0-501, Objective 2.2 - Software Security Tools
A user in the accounting department would like to send a spreadsheet to a list of third-party vendors. The size of the spreadsheet is too large to email, and the spreadsheet contains private information that must not be intercepted in-transit. Which of the following could be used to transfer this spreadsheet to the vendors? (Select TWO) ❍ A. IMAPS ❍ B. SRTP ❍ C. DNSSEC ❍ D. FTPS ❍ E. HTTPS ❍ F. SNMPv3
D. FTPS and E. HTTPS
FTPS (File Transfer Protocol Secure) and HTTPS (HyperText Transfer Protocol Secure) both provide mechanisms for transferring files using encrypted communication.
The incorrect answers:
A. IMAPS
IMAPS (Internet Message Access Protocol Secure) is a protocol exclusive
to email communication.
B. SRTP
SRTP (Secure Real-Time Transport Protocol) is used for secure voice over
IP and media communication across the network.
C. DNSSEC
DNSSEC (Domain Name System Secure Extensions) are used on DNS
servers to validate DNS responses using public key cryptography.
F. SNMPv3
SNMPv3 (Simple Network Management Protocol version 3) uses
encrypted communication to manage devices, but it is not used for secure
file transfers between devices.
SY0-501, Objective 2.6 - Secure Protocols
A system administrator would like to segment the network by department. The marketing, accounting, and manufacturing departments would have
their own private networks, and the network communication between departments would be restricted to provide security. Which of the
following should be configured on this network?
❍ A. VPN
❍ B. RBAC
❍ C. VLAN
❍ D. NAT
C. VLAN
A VLAN (Virtual Local Area Network) is a common method of logically segmenting a network. The devices in each segmented VLAN can only communicate with other devices in the same VLAN. A router is used to connect VLANs, and this router can often be used to control traffic flows between VLANs.
The incorrect answers:
A. VPN
A VPN (Virtual Private Network) is an encryption technology that can
be used to secure network connections between sites or remote enduser
communication. VPNs are not commonly used to segment internal
network communication.
B. RBAC
RBAC (Role-Based Access Control) describes a control mechanism for
managing rights and permissions in an operating system. RBAC is not used
for network segmentation.
D. NAT
NAT (Network Address Translation) is used to modify the source or
destination IP address or port number of a network traffic flow. NAT would
not be used when segmenting internal networks.
SY0-501, Objective 3.2 - Network Segmentation
A transportation company has installed a new application in their data center to assist with client reservations. The application works properly
in the test environment, but it doesn’t respond when moved to the production data center network. The security team does not find any rules in the data center firewall that would be specific to this application.
Which of the following is the MOST likely reason for this issue?
❍ A. The firewall is not configured with the correct application
encryption certificate
❍ B. The application is being blocked by an implicit deny rule
❍ C. The application service is not started
❍ D. A VPN configuration is required for the application traffic flows
B. The application is being blocked by an implicit deny rule
If network traffic does not match an explicit rule in the firewall rulebase, the traffic will be blocked. This implicit deny rule is the default for any non-matching traffic flows.
The incorrect answers:
A. The firewall is not configured with the correct application
encryption certificate
Encryption certificates for applications are configured on the application
server and not the firewall.
C. The application service is not started
A non-operational application service would certainly cause a
communications issue, but it would not be the most likely reason. The
question already identified a missing security rule that would prevent all
application traffic flows, and this would prevent all traffic regardless of the
application service’s status.
D. A VPN configuration is required for the application traffic flows
VPNs are not a common requirement for application use. Without a
specific firewall security rule, all application traffic would be blocked
regardless of the transportation method.
SY0-501, Objective 2.1 - Firewalls
A company has determined that a device on the manufacturing floor used to cut aluminum is not repairable and it’s estimated that it will operate
approximately ninety days before it must be replaced. Which of the following describes this estimate?
❍ A. MTTR (Mean Time to Repair)
❍ B. RPO (Recovery Point Objectives)
❍ C. RTO (Recovery Time Objectives)
❍ D. MTTF (Mean Time to Failure)
D. MTTF
The MTTF (Mean Time to Failure) is the expected lifetime of a nonrepairable product or system.
The incorrect answers:
A. MTTR
MTTR (Mean Time to Repair) is the time required to repair a product or
system after a failure. In this example, the device is not repairable.
B. RPO
RPO (Recovery Point Objectives) define how much data loss would be
acceptable during a recovery.
C. RTO
RTO (Recovery Time Objectives) define the minimum objectives required
to get up and running to a particular service level.
SY0-501, Objective 5.2 - Business Impact Analysis
Janet, a manager in the marketing department, is promoting the company by posting pictures from her mobile device to a popular social media
image sharing service. She has manually disabled the location services in the social media app, but she has asked the IT department to disable this functionality for all apps on the device. Which of the following should be disabled to meet this requirement?
❍ A. USB OTG
❍ B. WiFi Direct
❍ C. Geotagging
❍ D. Tethering
C. Geotagging
Geotagging adds location information to document metadata. With geotagging enabled, photos and videos can include longitude and latitude details as part of the shared file. Disabling geotagging will still allow the
sharing of the media, but the location information will not be saved when the image or video is created.
The incorrect answers:
A. USB OTG
USB OTG (USB On-The-Go) allows two mobile devices to be cabled
directly together for transferring information. USB OTG is not commonly
associated with location services.
B. WiFi Direct
WiFi Direct is another common method of connecting mobile devices
directly together over a wireless network without the need for an access
point. Location services are not part of WiFi Direct.
D. Tethering
Tethering is the process of connecting a cable between a computer and
mobile phone to provide Internet access for the computer. The tethering
process is not related to location services.
SY0-501, Objective 2.5 - Mobile Device Enforcement
Which of the following would be considered multi-factor authentication?
❍ A. PIN and fingerprint
❍ B. USB token and smart card
❍ C. Username, password, and email address
❍ D. Face scan and voiceprint
A. PIN and fingerprint
A PIN (Personal Identification Number) is something you know, and a fingerprint is something you are.
The incorrect answers:
B. USB token and smart card
A USB token and a smart card are both something you have. Both of these
describe a single factor of authentication.
C. Username, password, and email address
A password is something you know, but a username and email address
claim an identity but do not authenticate or prove the identity.
D. Face scan and voiceprint
Both a face scan and a voiceprint are biometric factors, or something you
are. Both of these describe a single factor of authentication.
SY0-501, Objective 4.1 - AAA and Authentication
Sam, a security administrator, is configuring the authentication process used by technicians when logging into a router. Instead of using accounts that are local to the router, Sam would like to pass all login requests to a centralized database. Which of the following would be the BEST way to implement this requirement?
❍ A. NTLM (NT LAN Manager)
❍ B. RADIUS (Remote Authentication Dial-In User Service)
❍ C. IPsec
❍ D. MS-CHAP (Microsoft Challenge-Handshake Authentication Protocol)
B. RADIUS
The RADIUS (Remote Authentication Dial-In User Service) protocol is a common method of centralizing authentication for users. Instead of having separate local accounts on different devices, users can authenticate with account information that is maintained in a centralized database.
The incorrect answers:
A. NTLM
NTLM (NT LAN Manager) authentication was first used in LAN Manager,
a precursor to the modern Windows operating systems. Unfortunately,
vulnerabilities with NTLM would limit its use as an authentication
method.
C. IPsec
IPsec is commonly used as an encrypted tunnel between sites or endpoints.
It’s useful for protecting data sent over the network, but IPsec isn’t used to
centralize the authentication process.
D. MS-CHAP
MS-CHAP (Microsoft Challenge-Handshake Authentication Protocol) was
commonly used in Microsoft’ PPTP (Point-to-Point Tunneling Protocol),
but vulnerabilities related to the use of DES (Data Encryption Standard)
encryption make it relatively easy to brute force the NTLM hash used in
MS-CHAP.
SY0-501, Objective 4.2 - Identity and Access Services
A security administrator is part of a project that will enhance the security of the desktops and servers in the company. An audit has recently found
some old company login credentials on a public Internet message board. Which of the following policies should the security administrator enforce
to limit the impact of this type of breach?
❍ A. Create a Group Policy to specify a minimum password length
❍ B. Encrypt all authentication traffic on the network
❍ C. Decrease the password expiration timeframe
❍ D. Store all passwords as salted hashes
C. Decrease the password expiration timeframe
Decreasing the password expiration timeframe would require users to change their password more often, therefore limiting the impact of a breached username and password.
The incorrect answers:
A. Create a Group Policy to specify a minimum password length
It’s always a good idea to have passwords with at least eight characters, but
the issue in this question was related to login credentials that were made
public. A minimum password length would limit the impact of this breach.
B. Encrypt all authentication traffic on the network
If captured data can’t be viewed, then it will remain confidential. In this
example, the credentials were already made public, so encrypting future
communication wouldn’t limit the impact of this breach.
D. Store all passwords as salted hashes
Secure storage of passwords is important, but once the password is public
the salted hash is no longer protecting password.
SY0-501, Objective 4.4 - Account Policy Enforcement
A system administrator is setting up an IPsec tunnel on a firewall with the following parameters: Peer: 10.1.1.2 Version: IKEv1 mode Authentication: Pre-Shared Key Encryption: DES Authentication hash: SHA256 DH Group: Group 5 Lifetime: 1 hour Which of the following would best describe these configuration settings? ❍ A. The authentication mode is not associated with an IPsec tunnel ❍ B. The IKE version is invalid ❍ C. The encryption standard is too weak ❍ D. The peer address is invalid
C. The encryption standard is too weak
DES (Data Encryption Standard) encryption is a weak encryption protocol that could be easily circumvented through the use of a brute-force attack. Using 3DES (Triple DES) or an AES (Advanced Encryption Standard) variant would be a better choice for encryption.
The incorrect answers:
A. The authentication mode is not associated with an IPsec tunnel
Pre-shared keys are commonly used with IPsec tunnel configurations,
although stronger authentication methods are certainly available.
B. The IKE version is invalid
Both IKEv1 (Internet Key Exchange v1) and IKEv2 are both valid options
for IPsec tunnel configurations.
D. The peer address is invalid
The peer address should be a valid IP address for the remote device at the
other end of the IPsec tunnel. The address listed in this configuration is a
valid IP address.
SY0-501, Objective 2.3 - Common Security Issues
A company has connected their wireless access points and have enabled WPS. Which of the following security issues would be associated with this configuration? ❍ A. Brute force ❍ B. Client hijacking ❍ C. Cryptographic vulnerability ❍ D. Spoofing
A. Brute force
A WPS personal identification number (PIN) was designed to have only 11,000 possible iterations, making a brute force attack very possible if the access point doesn’t provide any protection against multiple guesses.
The incorrect answers: B. Client hijacking The processes of adding a device through WPS occurs well before any app or client is used. C. Cryptographic vulnerability The vulnerability in WPS is based on a limited number of PIN options and not a cryptographic shortcoming. D. Spoofing Spoofing an
SY0-501, Objective 1.2 - WPS Attacks
An organization has traditionally purchased insurance to cover a ransomware attack, but the costs of maintaining the policy have increased above the acceptable budget. The company has now decided to cancel the insurance policies and deal with ransomware issues internally. Which of the following would best describe this action? ❍ A. Mitigating the risk ❍ B. Accepting the risk ❍ C. Transferring the risk ❍ D. Avoiding the risk
B. Accepting the risk
Risk acceptance is a business decision that places the responsibility of the risky activity on the organization itself.
The incorrect answers:
A. Mitigating the risk
If the organization was to purchase additional backup facilities and update
their backup processes to include offline backup storage, they would be
mitigating the risk of a ransomware infection.
C. Transferring the risk
Purchasing insurance to cover a risky activity is a common method of
transferring risk from the organization to the insurance company.
D. Avoiding the risk
To avoid the risk of ransomware, the organization would need to
completely disconnect from the Internet and disable all methods that
ransomware might use to infect a system. This risk response technique
would most likely not apply to ransomware.
SY0-501, Objective 5.3 - Risk Assessment
