Practice Tests Flashcards
You’ve hired a third-party to gather information about your company’s servers and data. The third party will not have direct access to your internal network but can gather information from any other source. Which of the following would best describe this approach?
A. Backdoor Testing
B. Passive Reconnaissance
C. OS Fingerprinting
D. Grey box pen Testing
B. Passive Reconnaissance
Which of these protocols use TLS to provide secure communication? (Select Two)
A. HTTPS B. SSH C. FTPS D. SNMPv2 E. DNSSEC F. SRTP
A. HTTPS
C. FTPS
HTTPS - Hypertext Transfer Protocol over TLS
FTPS - File Transfer Protocol over TLS
TLS (Transport Layer Security) is a cryptographic protocol used to encrypt network communication. TLS is a newer version of SSL
Which of these threat actors would be MOST likely to attack systems for direct financial gain?
A. Organized Crime
B. Hacktivist
C. Nation State
D. Competitor
A. Organized Crime
Its not competitor because it doesn’t have any DIRECT financial gain
A security incident has occurred on a file server. Which of the following data sources should be gathered to address file storage volatility? (Select TWO)
A. Partition data B. Kernel statistics C. ROM data D. Temporary file systems E. Process table
A. Partition data
D. Temporary file systems
Both temporary file system data and partition data are part of the file storage subsystem
An IPS at your company has found a sharp increase in traffic from all-in-one printers. After researching, your security team has found a vulnerability associated with these devices that allow the device to be remotely controlled by a third-party. Which category would BEST describe these devices?
A. IoT
B. RTOS
C. MFD
D. SoC
C. MFD - Multifunction Device
Which of the following would attempt to exploit a vulnerability associated with a specific application?
A. Vulnerability scan
B. Active reconnaissance
C. Penetration test
D. Port scan
C. Penetration Test
Elizabeth, a security administrator, is concerned about
the potential for data exfiltration using external storage
drives. Which of the following would be the BEST way to
prevent this method of data exfiltration?
A. Create an operating system security policy to prevent the use of the removable media
B. Monitor removable media usage in host-based firewall logs
C. Only whitelist applications that do not use removable media
D. Define a removable media block rule in the UTM
A. Create an operating system security policy to prevent the use of the removable media.
Removeable media uses hot-pluggable interfaces such as USB to connect storage devices. A security policy in the operating system can prevent any files from being written to a removable drive
Tayla is a help desk administrator for a major
transportation company. Her help desk has suddenly
been overwhelmed by phone calls from customers. The
customers are complaining that their browser is giving a
message that the company’s website is untrusted. Which
of the following would be the MOST likely reason for
this issue?
A. The web server is not running the latest version of software
B. The corporate firewall is misconfigured
C. A content filter is blocking web server traffic
D. The web server has a certificate issue
D. The web server has a certificate issue
Any web server issues relating to trust are generally associated with the status of the web server certificate. If a certificate has expired or the fully-qualified domain name on the certificate does not match the name of the web server, the end users will see errors in their browser
An insurance company has created a set of policies to
handle data breaches. The security team has been given
this set of requirements based on these policies:
• Access records from all devices must be
saved and archived
• Any data access outside of normal working hours
must be immediately reported
• Data access must only occur inside of the country
• Access logs and audit reports must be created from a
single database
Which of the following should be implemented by the
security team to meet these requirements?
(Select THREE)
A. Restrict login access by IP address and GPS location
B. Require government-issued identification during the onboarding process
C. Add additional password complexity for accounts that access data
D. Conduct monthly permissions auditing
E. Consolidate all logs on a SIEM
F. Archive the encryption keys of all disabled accounts
G. Enable time-of-day restrictions on the authentication server
A. Restrict login access by IP address and GPS location,
E. Consolidate all logs on a SIEM, and
G. Enable time-of-day restrictions on
the authentication server
Adding location-based policies will prevent direct data access from outside
of the country. Saving log information from all devices and creating audit
reports from a single database can be implemented through the use of a
SIEM (Security Information and Event Manager). Adding a check for the
time-of-day will report any access that occurs during non-working hours.
Leslie is projecting timelines to complete various analysis reports. Which list presents the correct order in which each analysis should be performed?
A. Threat, risk
B. Risk, threat
C. Threat, vulnerability
D. Business impact, risk
A. Threat, risk
Because a risk assessment relies on organizing threats to maximize potential opportunity, it cannot be conducted before a threat assessment
Rodney, a security engineer, is viewing this record from the firewall logs:
UTC 04/05/2018 03:09:15809 AV Gateway Alert
136.127.92.171 80 -> 10.16.10.14 60818
Gateway Anti-Virus Alert:
XPACK.A_7854 (Trojan) blocked.
Which of the following can be observed from this log information?
A. The victim’s IP address is 136.127.92.171
B. A download was blocked from a web server
C. A botnet DDoS attack was blocked
D. The Trojan was blocked, but the file was not
B. A download was blocked from a web server
A traffic flow from a web server port number (80) to a device port (60818) indicates that this traffic flow originated on port 80 of the web server. A file download is one of the most common ways to deliver a Trojan, and this log entry shows that the file containing the XPACK.A_7854 Trojan was blocked.
Richard, an engineer, has been posting pictures of a
not-yet-released company product on an online forum.
Richard believed the forum was limited to a small group,
but his pictures were actually posted on a publicly
accessible area of the site. Which of the following
company policies should be discussed with Richard?
A. Personal Email
B. Unauthorized software
C. Social media
D. Certificate issues
C. Social Media
A group of universities sponsor a monthly speaking event
that is attended by faculty from many different schools.
Each month, a different university is selected to host
the event. The IT staff for the event would like to allow
access to the local wireless network using the faculty
member’s normal authentication credentials. These
credentials should properly authenticate, even when the
faculty member is not physically located at their home
campus. Which of the following authentication methods
would be the BEST choice for this requirement?
A. RADIUS federation
B. 802.1X
C. PEAP
D. EAP-FAST
A. RADIUS Federation
RADIUS (Remote Authentication Dial-In User Service) with federation would allow members of one organization to authenticate using the credentials of another organization
802.1X is a useful authentication protocol, but it needs additional
functionality to authenticate across multiple user databases.
PEAP (Protected Extensible Authentication Protocol) provides a method of
authentication over a protected TLS (Transport Layer Security) tunnel, but
it doesn’t provide the federation needed for these requirements.
A system administrator, Daniel, is working on a contract that will specify
a minimum required uptime for a set of Internet-facing firewalls. Daniel
needs to know how often the firewall hardware is expected to fail between
repairs. Which of the following would BEST describe this information?
A. MTBF
B. RTO
C. MTTR
D. MTTF
A. MTBF
The MTBF (Mean Time Between Failures) is a prediction of how often a repairable system will fail
RTO (Recovery Time Objectives) define a set of objectives needed to restore a particular service level.
MTTR (Mean Time to Restore) is the amount of time it takes to repair a component
MTTF (Mean Time to Failure) is the expected lifetime of a non-repairable product or system
An attacker calls into a company’s help desk and pretends to be the director of the company’s manufacturing department. The attacker states that they have forgotten their password and they need to have the password reset quickly for an important meeting. The help desk engineer requests the employee’s ID number and sends a password reset validation code to the user’s registered mobile device number. What kind of attack is the help desk engineer preventing by following these processes?
A. Social engineering
B. Tailgating
C. Vishing
D. Man-in-the-middle
A. Social Engineering
A social engineering attack takes advantage of authority and urgency principles in an effort to convince someone else to circumvent normal normal security controls.
Not Vishing
Because these attacks use the phone to obtain private information from others. In this question the attacker was not asking for confidential information
A security administrator has been using EAP-FAST wireless authentication since the migration from WEP to WPA2. The company’s network team now needs to support additional authentication protocols inside of an encrypted tunnel. Which of the following would meet the network team’s requirements?
A. EAP-TLS
B. PEAP
C. EAP-TTLS
D. EAP-MSCHAPv2
C. EAP-TTLS
EAP-TTLS (Extensible Authentication Protocol - Tunneled Transport Layer Security) allows the use of multiple authentication protocols transported inside of an encrypted TLS (Transport Layer Security) tunnel. This allows the use of any authentication while maintaining confidentiality with TLS
Not EAP-TLS
Does not provide a mechanism for using multiple authentication types within a TLS tunnel.
Which of the following would be commonly provided by a CASB? (Select TWO)
A. List of all internal Windows devices that have not installed the latest security patches
B. List of applications in use
C. Centralized log storage facility
D. List of network outages for the previous month
E. Verification of encrypted data transfers
F. VPN connectivity for remote users
B. A list of applications in use
E. Verification of encrypted data transfers
A CASP (Cloud Access Security Broker) can be used to apply security policies to cloud-based implementations. Two common functions of a CASB are visibility into application use and data security policy use. Other common CASB functions are the verification of compliance with formal standards and the monitoring and identification of threats.
The embedded OS in a company’s time clock appliance is configured to reset the file system and reboot when a file system error occurs. On on of the time clocks, this file system error occurs during the startup process causes the system to constantly reboot. This loop continues until the time clock is powered down. Which of the following BEST describes this issue?
A. DLL injection
B. Resource exhaustion
C. Race condition
D. Weak configuration
C. Race condition
A race condition occurs when two processes occur at similar times, usually with unexpected results. The file system problem is usually fixed before a reboot, but a reboot is occurring before the fix can be applied. This has created a race condition that results in constant reboots.
A recent audit has found that existing password policies
do not include any restrictions on password attempts,
and users are not required to periodically change their
passwords. Which of the following would correct these
policy issues? (Select TWO)
A. Password complexity B. Password expiration C. Password history D. Password lockout E. Password recovery
B. Password expiration
D. Password lockout
Password expiration would require a new password after the expiration
date. Password lockout would disable an account after a predefined
number of unsuccessful login attempts.
What kind of security control is associated
with a login banner?
A. Preventive B. Deterrent C. Corrective D. Detective E. Compensating F. Physical
B. Deterrent
A deterrent control does not directly stop an attack, but it may discourage
an action.
Your security team has been provided with an uncredentialled vulnerability
scan report created by a third-party. Which of the following would you
expect to see on this report?
A. A summary of all files with invalid group assignments
B. A list of all unpatched operating system files
C. The version of web server software in use
D. A list of local user accounts
C. The version of web server software in use
A scanner like Nmap can query services and determine version numbers
without any special rights or permissions, which makes it well suited for
non-credentialed scans.
The security team of a small manufacturing company is investigating a
compromised server that resulted in a defaced internal website home
page. The web server had been running for a year, but no security patches
were ever applied. Logs from the web server show a large number of
attacks containing well-known exploits occurred just before the server was
defaced. Which of these would be the MOST likely source of this attack?
A. Hacktivist
B. Script kiddie
C. Insider
D. Nation state
B. Script kiddie
A script kiddie commonly runs pre-made scripts without any knowledge of
what the script is actually doing. The script kiddie is simply hoping that at
least one of the many exploit attempts will be successful.
Which of these would be MOST significant security concern for
an insider threat?
A. Passwords written on sticky notes
B. An unpatched file server
C. A VPN concentrator that uses an older encryption cipher
D. Limited bandwidth available on the Internet link
A. Passwords written on sticky notes
A password written down and left in an open area can be used by any
insider who happens to walk by
A security administrator would like to limit access from a user VLAN to
the server VLAN. All traffic to the server VLAN communicates through
the core router. Users should only be able to connect to servers using
standard protocols. Which of the following options would be the BEST
way to implement this security feature?
A. Configure a reverse proxy
B. Define an ACL on the core router
C. Replace the core router with a layer 3 firewall
D. Add a load balancer for each server cluster
B. Define an ACL on the core router
Configuring an ACL (Access Control List) is a feature already included with
the router. The ACL will allow the filtering of traffic by IP address and port
number.