Security 2 Flashcards
An attacker would like to target a company and redirect their legitimate traffic to other sites. Which of the following attacks would be used to cause this malicious
URL redirection?
A.
Botnet
B.
Backdoor
C.
DNS Poisoning
D.
Phishing
C
When performing a risk analysis, which of the following is considered a threat?
A.
The potential exploitation of vulnerability
B.
The transference of risk to another party
C.
The presence of a risk in the environment
D.
The lack of mitigation for vulnerabilities
A
A recent security audit revealed the company is lacking deterrent security controls. Which of the following could be implemented to address this finding?
A.
Rogue machine detection
B.
Continuous security monitoring
C.
Security cameras
D.
Intrusion detection system
C
A research user needs to transfer multiple terabytes of data across a network. The data is not confidential, so for performance reasons, does not need to be
encrypted. However, the authentication process must be confidential. Which of the following is the BEST solution to satisfy these requirements?
A.
Secured LDAP
B.
Kerberized FTP
C.
SCP
D.
SAML 2.0
B
Which of the following is a contract with a service provider that typically includes performance parameters like MTBF and MTTR?
A.
SLA
B.
NDA
C.
ISA
D.
MOU
E.
ALE
A
Several computers in an organization are running below the normal performance baseline. A security administrator inspects the computers and finds the following
pieces of information:
– Several users have uninstalled the antivirus software
– Some users have installed unauthorized software
– Several users have installed pirated software
– Some computers have had automatic updating disabled after being deployed
– Users have experienced slow responsiveness when using the Internet browser
– Users have complete control over critical system properties
Which of the following solutions would have prevented these issues from occurring? (Select TWO).
A.
Using snapshots to revert unwanted user changes
B.
Using an IPS instead of an antivirus
C.
Placing users in appropriate security groups
D.
Disabling unnecessary services
E.
Utilizing an application whitelist
F.
Utilizing an application blacklist
C, E
An administrator must select an algorithm for creating hashes of critical system files in order to later detect any unauthorized changes. Which of the following could
the administrator use? (Select TWO).
A.
3DES
B.
Diffie-Hellman
C.
CHAP
D.
RIPEMD
E.
RSA
F.
AES-256
G.
SHA-512
D, G
A recent regulatory audit discovers a large number of former employees with active accounts. Terminated users are removed from the HR system but not from
Active Directory. Which of the following processes would close the gap identified?
A.
Send a recurring email to managers with a link to IT Security policies.
B.
Perform routine audits against the HR system and Active Directory.
C.
Set an account expiration date for all Active Directory accounts to expire annually.
D.
Conduct permissions reviews in Active Directory for group membership.
B
After responding to a virus detection notification, a security technician has been tasked with discovering how the virus was downloaded to the client computer.
Which of the following would BEST provide the technician with information related to the attack vector?
A.
Vulnerability scanning logs
B.
NIPS alerts
C.
Surveillance videos
D.
Proxy logs
D
An employee connects to a public wireless hotspot during a business trip. The employee attempts to go to a secure website, but instead connects to an attacker
who is performing a man-in-the-middle attack. Which of the following should employees do to mitigate the vulnerability described in the scenario?
A.
Connect to a VPN when using public wireless networks
B.
Only connect to WPA2 networks regardless of whether the network is public or private
C.
Ensure a host-based firewall is installed and running when using public wireless networks
D.
Check the address in the web browser before entering credentials
D
During a recent audit, it was discovered that several database services were running with local user accounts named “admin” and “dbadmin”. The following controls
will prevent network administrators from using these types of usernames for services in the future? (Select TWO)
A.
Use shared account policies
B.
Prohibit generic or default accounts
C.
Perform continuous access monitoring
D.
Perform user account access reviews
E.
Require dedicated service accounts
B, E
A major banking institution has been the victim of recurring, widespread fraud. The fraud has all occurred on the bank’s web portal. Recently, the bank implemented
a requirement for all users to obtain credentials in person at a physical office. However, this has not reduced the amount of fraud against legitimate customers.
Based on a review of the logs, most fraudulent transactions appear to be conducted with authentic credentials. Which of the following controls should be
strengthened to reduce the fraud through the website?
A.
Authentication
B.
DAC
C.
Identification
D.
Authorization
D
During an audit of a software development organization, an auditor found that the organization did not properly follow industry best practices including peer review
and board approval prior to moving applications into the production environment. The auditor recommended adapting a formal process incorporating these steps.
To remediate the finding, the organization implemented:
A.
incident management.
B.
a configuration management board.
C.
asset management.
D.
change management.
D
A web server at an organization has been the target of distributed denial of service attacks. Which of the following, if correctly configured, would BEST mitigate
these and future attacks?
A.
SYN cookies
B.
Implicit deny
C.
Blacklisting
D.
URL filter
A
A network has been impacted by downtime resulting from unauthorized devices connecting directly to the wired network. The network administrator has been
tasked to research and evaluate technical controls that would effectively mitigate risks associated with such devices. Which of the following capabilities would be
MOST suitable for implementation in this scenario?
A.
Host hardening
B.
NIDS
C.
VLAN trunking
D.
Loop protection
E.
Port security
E
A security engineer notices that unknown devices are connecting to the company’s wireless network and trying to access the database server. The wireless access
point is configured with WPA for encryption and the network administrator setup an digit pin for easy setup to the wireless access point. Which of the following is the
MOST likely type of attack?
A.
IV attack
B.
WPS attack
C.
Bluesnarfing attack
D.
Replay attack
B
A system administrator is troubleshooting an issue affecting some FTP connections. Some employees are unable to upload or download files, although the firewall
is allowing the default FTP port. Which of the following can the administrator do to fix this case?
A.
Disable the use PASV in the FTP client
B.
Configure all FTP clients to use BIN transfer
C.
Enable inbound TCP port 20 on the firewall
D.
Enable both port 21 and 22 on the firewall
A
A PKI architect is implementing a corporate enterprise solution. The solution must incorporate key escrow and recovery agents, as well as a tiered architecture.
Which of the following is required to implement the architecture correctly?
A.
Certificate revocation list
B.
Strong ciphers
C.
Intermediate authorities
D.
IPSec between CAs
C
A systems administrator is working with a third party to establish the automated transfer of large amounts of proprietary data. The interface will need to use secured
credentials and the transmission will consist of data that has been encrypted prior to transit and needs no additional protection. Which of the following would be the
MOST efficient method of data transmission given the established requirements?
A.
SSH
B.
TFTP
C.
FTP
D.
FTPS
A
A high traffic website is experiencing numerous brute force attacks against its user base. The attackers are using a very large botnet to carry out the attack. As a
result, many users passwords are being compromised Which of the following actions is appropriate for the website administrator to take in order to reduce the
threat from this type of attack in the future. .
A.
Temporarily ban each IP address after five failed login attempts
B.
Prevent users from using dictionary words that they have used before.
C.
Prevent users from using passwords they have used before.
D.
Require user passwords to be at least ten characters in length
D
A security administrator is responsible for deployment of a new two factor authentication solution. The administrator has been informed that the solution will use soft
tokens. Which of the following are valid token password schemes for the two factor solution being deployed? (Select TWO)
A.
CHAP
B.
PAP
C.
NTLMv2
D.
HMAC
E.
Smart card
F.
Time-based
A, D
The border firewall rules were recently modified by a network administrator to allow access to a new service on Server 1 using the default https port. When testing
the new rules internal to the company network there are no issues and when testing from an external connection it does not work. The host running the service
does not receive external packets. Other services hosted on Server 1 are responding fine to to both internal and external connection attempts. Which of the
following is MOST likely configured improperly?
A.
Network access control lists
B.
802.1x
C.
Port security
D.
Implicit deny
A
Joe has been in the same IT position for the last 27 years and has developed a lot of homegrown applications that the company utilizes. The company is concerned
that Joe is the only one who can administer these applications. The company should enforce which of the following best security practices and avoid Joe being a
single point of failure?
A.
Separation of duties
B.
Least privilege
C.
Job rotation
D.
Mandatory vacation
C
The Chief Security Officer (CSO) is concerned with unauthorized access at the company’s off-site datacenter. The CSO would like to enhance the security posture
of the datacenter. Which of the following would BEST prevent unauthorized individuals from gaining access to the datacenter?
A.
Security guard
B.
Video monitoring
C.
Magnetic entry cards
D.
Fencing
A
Which of the following is MOST effective at cracking hashed passwords?
A.
Rainbow tables
B.
Dictionary attack
C.
Birthday attack
D.
Brute force attack
A
An enterprise needs to be able to receive files that contain PII from many customers at different times. The data must remain encrypted during transport and while
at rest. Which of the following encryption solutions would meet both of these requirements?
A.
PGP
B.
SCP
C.
SSL
D.
TLS
A
A company provides wireless access for employees and a guest wireless network for visitors. The employee wireless network is encrypted and requires a
password. The guest wireless network does not use an encrypted connection and does not require a password. An administrator walks by a visitor’s laptop and
notices the following command line output:
reaver – I mon – b 7a : E5 : 9A : 42 : 2C : C1 – vv
Starting…..
[+] Trying pin 12345678
[+] 93.41% complete @ 2015-01-10 10:30:21 (15 seconds)
[!] WARNING: 10 failed connections in a row
[+] Trying pin 12345688
…
Which of the following should the administrator implement and why?
A.
Initiate employee password changes because the visitor has captured passwords and is attempting offline cracking of those passwords.
B.
Implement two-factor wireless authentication because the visitor will eventually brute force the network key.
C.
Apply WPA or WPA2 encryption because the visitor is trying to crack the employee network that is encrypted with WEP.
D.
Disable WPS because the visitor is trying to crack the employee network.
E.
Apply MAC filtering because the visitor already has the network password.
D
A firewall administrator has been instructed to block common Microsoft file sharing ports due to a recent malware outbreak. Which of the following ports should be
blocked by the firewall? (Select TWO).
A.
TCP/137
B.
UDP/137
C.
TCP/139
D.
UDP/139
E.
TCP/443
F.
UDP/443
G.
TCP/445
H.
UDP/445
C, G
A technician wants to verify the authenticity of the system files of a potentially compromised system. Which of the following can the technician use to verify if a
system file was compromised? (Select TWO).
A.
AES
B.
PGP
C.
SHA
D.
MD5
E.
ECDHE
C, D
A company hosts sites for multiple vendors and provides information to users globally. Which of the following is a critical security consideration in this environment?
A.
Proxy servers to enforce a single access mechanism to the data warehouse
B.
Firewalls to ensure that the data warehouse is not accessible to the Internet
C.
Access controls to prevent users from accessing the entire data warehouse
D.
Query protocols should use non-standard ports to protect user result-sets
C
A security administrator wishes to implement a secure method of file transfer when communicating with outside organizations. Which of the following protocols
would BEST facilitate secure file transfers? (Select TWO).
A.
SCP
B.
TFTP
C.
SNMP
D.
FTP
E.
SMTP
F.
FTPS
A, F
As their data set rapidly grows and changes, a company is experiencing availability problems with their database. The security manager recommends switching to a
more scalable system with dynamic schemas. Which of the following would meet the security manager’s requirements?
A.
SSDs
B.
NoSQL
C.
MariaDB
D.
RDBMS
B
Which of the following should be implemented to enforce the corporate policy requiring up-to-date antivirus and OS patches on all computers connecting to the
network via VPN?
A.
VLAN
B.
NAT
C.
NAC
D.
DMZ
C
A business has set up a Customer Service kiosk within a shopping mall. The location will be staffed by an employee using a laptop during the mall business hours,
but there are still concerns regarding the physical safety of the equipment after business hours. Which of the following controls would BEST address this security
concern?
A.
Host-based firewall
B.
Cable locks
C.
Locking cabinets
D.
Surveillance video
C
Which of the following BEST represents a security challenge faced primarily by organizations employing a mobility BYOD strategy?
A.
Balancing between the security of personal information and the company’s information sharing requirements.
B.
Balancing between the assurance of individual privacy rights and the security of corporate data.
C.
Balancing between device configuration enforcement and the management of cryptographic keys.
D.
Balancing between the financial security of the company and the financial security of the user.
B
The Chief Security Officer (CSO) has issued a new policy that requires that all internal website be configured for HTTPS traffic only. The network administrator has
been tasked to update all internal sites without incurring additional costs. Which of the following is the BEST solution for the network administrator to secure each
internal website?
A.
Use certificates signed by the company CA.
B.
Use a signing certificate as a wild card certificate.
C.
Use certificates signed by a public CA.
D.
Use a self-signed certificate on each internal server
A
A third party has been contracted to perform a remote penetration test of the DMZ network. The company has only provided the third party with the billing
department contact information for final payment and a technical point of contact who will receive the penetration test results. Which of the following tests will be
performed?
A.
Gray Box
B.
White Box
C.
Black Box
D.
False Positive
C
A security administrator receives reports from various organizations that a system on the company network is port scanning hosts on various networks across the
Internet. The administrator determines that the compromised system is a Linux host and notifies the owner that the system will be quarantined and isolated from the
network. The system does not contain confidential data, and the root user was not compromised. The administrator would like to know how the system was
compromised, what the attackers did, and what remnants the attackers may have left behind. Which of the following are the administrator’s NEXT steps in the
investigation? (Select TWO).
A.
Reinstall the procps package in case system utilities were modified.
B.
Look for recently modified files in user and tmp directories.
C.
Switch SELinux to enforcing mode and reboot.
D.
Monitor perimeter firewall for suspicious traffic from the system.
E.
Check running processes and kernel modules.
F.
Remove unnecessary accounts and services.
B, E
A security manager has noticed several unrecognized devices connecting to the company’s internal wireless network. Only company-issued devices should be
connected to the network. Which of the following controls should be implemented to prevent the unauthorized devices from connecting to the wireless network?
(Select TWO).
A.
MAC filtering
B.
Create a separate wireless VLAN
C.
Implement 802.11n
D.
Enable WPA2
E.
Configure DHCP reservations
A, D
A vulnerability in the underlying SSL/TLS library used by a web server has been announced. The vulnerability allows an attacker to access the web server’s
memory. Which of the following actions should be taken after the vulnerability is patched? (Select TWO).
A.
Implement a web application firewall
B.
Instruct users of the website to change their passwords
C.
Replace the server’s private key
D.
Reissue the SSL certificate
E.
Create a new recovery agent
F.
Change the cipher order on the server
C, D
