SEC - Six - U Flashcards

Question

Question 25: After a user enters an incorrect password, many authentication systems record this activity in an authentication log. What phase of the identity and access management process is taking place? Authorization Identification Accounting Authentication

Answer 1

Authorization Identification Correct answer Accounting Your answer is incorrect Authentication Overall explanation Logging the activity of an incorrect password entry is part of the accounting phase of the identity and access management process. Accounting involves creating an unalterable record of authentication activity, which helps in tracking and monitoring user actions. The identification phase occurs when the user provides their username or user ID. The authentication phase occurs when the user attempts to verify their identity by entering a password, which in this case was incorrect. Authorization does not take place because the authentication attempt was unsuccessful. This question comes from Security+ exam objective 4.6 Given a scenario, implement and maintain identity and access management. For more information, see Sybex Security+ Study Guide Chapter 8. Domain 4.0 Security Operations

Answer 2

Correct answer Penetration testing Network monitoring Intrusion detection Your answer is incorrect Configuration analysis Overall explanation Penetration tests interact with systems and seek to exploit vulnerabilities. Therefore, they are an active test of security controls. Configuration analysis involves reviewing system settings and configurations without actively engaging with the system, making it a passive activity. Network monitoring involves observing and analyzing network traffic without interacting with it, making it a passive activity. Intrusion detection involves monitoring systems for signs of unauthorized access or anomalies without actively engaging with the systems, making it a passive activity. This question comes from Security+ exam objective 4.3 Explain various activities associated with vulnerability management. For more information, see Sybex Security+ Study Guide Chapter 5. Domain 4.0 Security Operations

Answer 3

SOX Correct answer GLBA GDPR Your answer is incorrect PCI DSS Overall explanation Financial institutions are required to preserve the privacy of consumer records by the Gramm-Leach-Bliley Act (GLBA). The Payment Card Industry Data Security Standard (PCI DSS) does apply to financial records, but its scope is limited to credit and debit card records. The General Data Protection Regulation (GDPR) would apply to these records if they were about European Union residents but that is not the case here. The Sarbanes Oxley Act (SOX) regulates the financial accounting practices of publicly traded companies and is not applicable here. This question comes from Security+ exam objective 5.1 Summarize elements of effective security governance. For more information, see Sybex Security+ Study Guide Chapter 16. Domain 5.0 Security Program Management and Oversight

Answer 4

Correct answer Data processor Data owner Data regulator Your answer is incorrect Data controller Overall explanation In this scenario, the cloud service provider is processing data on behalf of Alan’s organization, making it a data processor. Alan’s firm remains the data owner and controller. Neither organization serves as a regulator, as those responsibilities are reserved for government agencies and self-regulatory bodies. This question comes from Security+ exam objective 5.1 Summarize elements of effective security governance. For more information, see Sybex Security+ Study Guide Chapter 17. Domain 5.0 Security Program Management and Oversight

Answer 5

3DES Correct answer CCMP TKIP Your answer is incorrect SAE Overall explanation WPA2 uses the Counter Mode Cipher Block Chaining Message Authentication Code Protocol (CCMP) to provide enhanced security using AES. The Temporal Key Integrity Protocol (TKIP) is used by WPA to rapidly cycle encryption keys and overcome the weaknesses of WEP. WPA3 uses Simultaneous Authentication of Equals (SAE). This question comes from Security+ exam objective 4.1 Given a scenario, apply common security techniques to computing resources. For more information, see Sybex Security+ Study Guide Chapter 13. Domain 4.0 Security Operations

Answer 6

CFO CIO CEO Your answer is correct CISO Overall explanation The incident response team should be overseen by the Chief Information Security Officer (CISO), who has the authority and responsibility for cybersecurity activities. The CISO is best positioned to provide direct oversight and ensure that the team's actions align with the organization's security policies and objectives. The CEO has overall responsibility for the organization but typically does not focus on the day-to-day oversight of cybersecurity efforts. The CIO is responsible for the overall IT strategy and infrastructure but may not have the specialized focus on security that the CISO has. The CFO handles financial aspects and would not typically oversee cybersecurity activities. This question comes from Security+ exam objective 5.1 Summarize elements of effective security governance. For more information, see Sybex Security+ Study Guide Chapter 16. Domain 5.0 Security Program Management and Oversight

Answer 7

Certificate chaining Certificate attachment Correct answer Certificate stapling Your answer is incorrect Certificate pinning Overall explanation Certificate stapling attaches an OCSP validation to the digital certificate, saving the client and server the time of repeatedly querying the OCSP server for certificate validity. Certificate pinning is a technique used to prevent changes in the valid certificate for a domain. Certificate chaining is used to delegate authority to subordinate certificate authorities. Certificate attachment is not a valid technique. This question comes from Security+ exam objective 1.4 Explain the importance of using appropriate cryptographic solutions. For more information, see Sybex Security+ Study Guide Chapter 7. Domain 1.0 General Security Concepts

Answer 8

Spyware Logic bomb Your answer is incorrect Ransomware Correct answer Bloatware Overall explanation Bloatware is most likely causing the performance degradation on the new company laptop. These are unnecessary applications pre-installed by the manufacturer that consume system resources, slowing down the device even if it hasn't been used for intensive tasks. Spyware gathers information about a user without their knowledge, which can slow down a system, but it is not typically pre-installed by manufacturers. A logic bomb is malicious code that activates under specific conditions, but it would not usually be pre-installed on a new laptop. Ransomware encrypts files and demands payment for their release, causing significant disruption, but it is not typically pre-installed and does not align with the description of numerous unnecessary applications. This question comes from Security+ exam objective 2.4 Given a scenario, analyze indicators of malicious activity. For more information, see Sybex Security+ Study Guide Chapter 3. Domain 2.0 Threats, Vulnerabilities, and Mitigations

Answer 9

Chosen ciphertext Known plaintext Known ciphertext Your answer is correct Chosen plaintext Overall explanation This is a tricky question, because any of the answers other than chosen ciphertext could be correct. We can rule out that answer because Joan cannot choose her own ciphertext. She can however, choose the plaintext used to create the ciphertext. When she does choose her own plaintext, she must, therefore, have knowledge of the plaintext. Once she encrypts the message, she also has access to the ciphertext. However, the best term to describe this attack is a chosen plaintext attack because it is the most specific of the three names. Every chosen plaintext attack is also a known plaintext and a known ciphertext attack. This question comes from Security+ exam objective 1.4 Explain the importance of using appropriate cryptographic solutions. For more information, see Sybex Security+ Study Guide Chapter 7. Domain 1.0 General Security Concepts

Answer 10

Water cooler attack On-path attack Correct answer Spear phishing attack Your answer is incorrect Brute force attack Overall explanation Privileged users are clearly susceptible to all of these attacks. However, there is no reason to believe that they are more likely to be victims of water cooler attacks, brute force attacks, or on-path attacks than any other user. Spear phishing attacks target specific people and are more likely to target privileged users because of their elevated privileges. This question comes from Security+ exam objective 5.6 Given a scenario, implement security awareness practices. For more information, see Sybex Security+ Study Guide Chapter 16. Domain 5.0 Security Program Management and Oversight

Answer 11

Reflected XSS Correct answer XSRF Your answer is incorrect Stored XSS DOM XSS Overall explanation In this attack, the attacker executed a request against a third-party website by taking advantage of the fact that the user already had an established session with that site. This is an example of a cross-site request forgery (XSRF) attack. Stored XSS involves injecting malicious scripts into a website's database, which are then served to users. Reflected XSS occurs when malicious scripts are reflected off a web server and executed immediately by the user's browser. DOM XSS involves the modification of the Document Object Model in the user's browser to execute scripts. This question comes from Security+ exam objective 2.4 Given a scenario, analyze indicators of malicious activity. For more information, see Sybex Security+ Study Guide Chapter 6. Domain 2.0 Threats, Vulnerabilities, and Mitigations

Answer 12

Correct answer NTP TLS SSH Your answer is incorrect OCSP Overall explanation The Network Time Protocol (NTP) is used to synchronize the clocks of devices to a standardized time source. NTP is quite useful in helping to ensure consistent timestamps on log entries. TLS is used to secure communications over a network, but it does not address time synchronization. SSH provides secure remote access to devices, but it does not synchronize device clocks. OCSP (Online Certificate Status Protocol) checks the revocation status of digital certificates, but it does not synchronize device clocks. This question comes from Security+ exam objective 4.5 Given a scenario, modify enterprise capabilities to enhance security. For more information, see Sybex Security+ Study Guide Chapter 12. Domain 4.0 Security Operations

Answer 13

Correct answer Staging environment Test environment Your answer is incorrect Production environment Development environment Overall explanation After successfully completing user acceptance testing, the most appropriate environment for Fran's code module is the staging environment. The staging environment serves as the final preparation area before deployment to the production environment, ensuring that the code works correctly in a setting that closely mimics the live production environment. The development environment is for creating and modifying new code and is no longer appropriate once testing is complete. The production environment is the live environment where the application is used by end users, and the code should only be moved here after passing through staging. The test environment is used for initial testing and has already been completed, so it is no longer the correct stage for the code module. This question comes from Security+ exam objective 5.1 Summarize elements of effective security governance. For more information, see Sybex Security+ Study Guide Chapter 16. Domain 5.0 Security Program Management and Oversight

Answer 14

Full tunnel IPSec Your answer is incorrect TLS Correct answer Split tunnel Overall explanation A split tunnel VPN policy allows Vic to specify that only traffic destined to the home office should be routed through the VPN. If Vic used a full tunnel policy, engineers would not be able to access systems on the customer’s local network. Vic may use either an IPSec or TLS VPN to meet this requirement. That technology decision is separate from determining what traffic is sent through the VPN. This question comes from Security+ exam objective 3.2 Given a scenario, apply security principles to secure enterprise infrastructure. For more information, see Sybex Security+ Study Guide Chapter 12. Domain 3.0 Security Architecture

Answer 15

Sales director System administrator Your answer is correct Accounts payable clerk Executive user Overall explanation While basic awareness of wire transfer fraud schemes is beneficial for everyone in the company, the accounts payable clerk is the individual most in need of this training. This role is directly responsible for initiating wire transfers and is therefore the primary target for fraudsters attempting these schemes. System administrators, executive users, and sales directors may benefit from general awareness, but they are not typically the ones processing wire transfers. This question comes from Security+ exam objective 5.6 Given a scenario, implement security awareness practices. For more information, see Sybex Security+ Study Guide Chapter 16. Domain 5.0 Security Program Management and Oversight

Answer 16

On-path Eavesdropping Correct answer ARP poisoning Your answer is incorrect DNS poisoning Overall explanation An ARP poisoning attack likely took place, as this attack involves sending false MAC address information to a network switch, causing the switch to associate the incorrect MAC address with a particular IP address. This can disrupt network traffic and potentially lead to further attacks like eavesdropping or an on-path attack, but those cannot be confirmed without more information. DNS poisoning involves manipulating the DNS server to redirect traffic to malicious sites, which is unrelated to the scenario of false MAC address information being sent. An on-path attack involves intercepting and potentially altering communication between two parties, which might be facilitated by ARP poisoning but is not explicitly indicated by the provided information. Eavesdropping refers to unauthorized listening to private communications, which could be a result of ARP poisoning but is not specifically indicated in this scenario. This question comes from Security+ exam objective 2.4 Given a scenario, analyze indicators of malicious activity. For more information, see Sybex Security+ Study Guide Chapter 12. Domain 2.0 Threats, Vulnerabilities, and Mitigations

Answer 17

Authority Familiarity Your answer is correct Consensus Intimidation Overall explanation This message is attempting to influence behavior by telling a customer that they differ from the energy consumption habits of their energy-efficient neighbors. This is an example of consensus, or social proof, where individuals are influenced to change their behavior based on the actions and behaviors of others around them. Authority would involve leveraging the influence of a respected or authoritative figure to convince someone to take action, which is not the case here. Familiarity relies on using a sense of personal connection or known relationships to influence behavior, which is not directly being used in this message. Intimidation uses fear or threats to compel someone to take action, which is not the tactic employed in this comparison of energy usage. This question comes from Security+ exam objective 2.2 Explain common threat vectors and attack surfaces. For more information, see Sybex Security+ Study Guide Chapter 4. Domain 2.0 Threats, Vulnerabilities, and Mitigations

Answer 18

The attacker conducted a privilege escalation attack Correct answer The attacker cloned the employee’s RFID device Your answer is incorrect The security system malfunctioned The attacker stole the device from the employee without their knowledge Overall explanation The attacker likely cloned the employee’s RFID device, which would allow them to gain access using a duplicate device without the employee’s knowledge. Cloning an RFID device involves copying the signal or data from the original device to a new one, which can then be used to access secure areas. A security system malfunction would typically not show access being made by a specific employee; it would more likely show an error or lack of entry in the logs. If the attacker stole the device from the employee, the employee would not have had the device in their possession the entire time. A privilege escalation attack usually pertains to gaining higher access privileges within a computer system, not physically accessing secure areas. This question comes from Security+ exam objective 2.4 Given a scenario, analyze indicators of malicious activity. For more information, see Sybex Security+ Study Guide Chapter 9. Domain 2.0 Threats, Vulnerabilities, and Mitigations

Answer 19

Economies of scale Correct answer Elasticity Your answer is incorrect Agility Scalability Overall explanation Fred is likely taking advantage of all of the characteristics listed in this question. However, the situation described in the scenario, adding additional servers when demand spikes and then removing those servers from the pool when demand falls again, is the definition of elasticity. This question comes from Security+ exam objective 3.1 Compare and contrast security implications of different architecture models. For more information, see Sybex Security+ Study Guide Chapter 10. Domain 3.0 Security Architecture

Answer 20

When senior leaders arrive on scene to take command Correct answer When the organization is returned to its normal operating environment When the organization completes the initial response effort Your answer is incorrect When the organization has a stable operating environment set up in an alternate facility Overall explanation The disaster recovery plan is deactivated when the organization is returned to its normal operating environment. This marks the end of the disaster recovery process, as the goal is to restore normal operations and ensure all systems are functioning as they were before the emergency. Completing the initial response effort is just the first phase of the disaster recovery process, and deactivating the plan at this stage would be premature. Setting up a stable operating environment in an alternate facility is a temporary measure and does not signify the return to normal operations. The arrival of senior leaders to take command is part of the response coordination and does not indicate the end of the disaster recovery efforts. This question comes from Security+ exam objective 5.1 Summarize elements of effective security governance. For more information, see Sybex Security+ Study Guide Chapter 17. Domain 5.0 Security Program Management and Oversight

Answer 21

Unskilled attacker Correct answer Insider Your answer is incorrect Competitor Organized crime Overall explanation The most likely culprit is an insider with access to the accounting system. There are no signs of IPS or firewall anomalies, which reduces the likelihood that this was an external attack. An unskilled attacker typically lacks the skills and access required for this level of manipulation within an accounting system. Organized crime might be involved in financial fraud, but the lack of external signs suggests an insider is more likely. A competitor would likely target more strategic data rather than direct financial theft and manipulation of internal records. This question comes from Security+ exam objective 2.1 Compare and contrast common threat actors and motivations. For more information, see Sybex Security+ Study Guide Chapter 2. Domain 2.0 Threats, Vulnerabilities, and Mitigations

SEC - Six - U Flashcards

(45 cards)