Sybex Testbank Flashcards
(38 cards)
Grace ran a vulnerability scan and detected an urgent vulnerability in a public-facing web server. This vulnerability is easily exploitable and could result in the complete compromise of the server. Grace wants to follow best practices regarding change control while also mitigating this threat as quickly as possible. What would be Grace’s best course of action?
A. Initiate a high-priority change through her organization’s change management process and wait for the change to be approved.
B. Implement a fix immediately and document the change after the fact.
C. Schedule a change for the next quarterly patch cycle.
D. Initiate a standard change through her organization’s change management process.
B. Implement a fix immediately and document the change after the fact.
In this situation, Grace is facing a true emergency. Her web server has a critical vulnerability that is exposed to the outside world and may be easily exploited. Grace should correct the issue immediately, informing all relevant stakeholders of the actions that she is taking. She can then follow up by documenting the change as an emergency action in her organization’s change management process. All of the other approaches in this question introduce an unacceptable delay.
During a port scan of a server, Miguel discovered that the following ports are open on the internal network:
TCP port 25
TCP port 80
TCP port 110
TCP port 443
TCP port 1433
TCP port 3389
The scan results provide evidence that a variety of services are running on this server. Which one of the following services is not indicated by the scan results?
A. Web
B. Database
C. SSH
D. RDP
C. SSH
Web servers commonly run on ports 80 (for HTTP) and 443 (for HTTPS). Database servers commonly run on ports 1433 (for Microsoft SQL Server), 1521 (for Oracle), or 3306 (for MySQL). Remote Desktop Protocol services commonly run on port 3389. There is no evidence that SSH, which uses port 22, is running on this server.
While developing a web application, Chris sets his session ID length to 128 bits based on OWASP’s recommended session management standards. What reason would he have for needing such a long session ID?
A. To avoid duplication.
B. To allow for a large group of users.
C. To prevent brute-forcing.
D. All of the above.
C. To prevent brute-forcing.
OWASP recommends a large session ID value to avoid brute-force attacks. 2^128 is 340,282,366,920,938,463,463,374,607,431,768,211,456, a number that is far larger than you would need to avoid duplication of numbers, even for very large groups of users across the entire world. If you encounter a question like this and don’t know the answer, you can apply logic. In this case, the number is so large that it doesn’t make sense to use it for simply duplication avoidance, and any reasonable number of users—including the entire population of the world—would require fewer bits.
Kwame received an alert from his organization’s SIEM that it detected a potential attack against a web server on his network. However, he is unsure whether the traffic generating the alert actually entered the network from an external source or whether it came from inside the network. The NAT policy at the network perimeter firewall rewrites public IP addresses, making it difficult to assess this information based on IP addresses. Kwame would like to perform a manual log review to locate the source of the traffic. Where should he turn for the best information?
A. Application server logs
B. Database server logs
C. Firewall logs
D. Antimalware logs
C. Firewall logs
All of the data sources listed in this question may provide Kwame with further information about the attack. However, firewall logs would be best positioned to answer his specific question about the source of the attack. Since the firewall is performing network address translation (NAT), it would likely have a log entry of the original (pre-NAT) source IP address of the traffic.
Camilla is participating in the eradication and recovery stage of an incident response process. Which one of the following activities would not normally occur during this phase?
A. Vulnerability mitigation.
B. Restoration of permissions.
C. Verification of logging/communication to security monitoring.
D. Analysis of drive capacity consumption.
D. Analysis of drive capacity consumption.
Vulnerability mitigation, restoration of permissions, and the verification of logging and communication to security monitoring are all activities that normally occur during the eradication and recovery phase of incident response. The analysis of drive capacity consumption is the assessment of an indicator of compromise (IoC), which occurs during the detection and analysis phase of incident response.
After arriving at an investigation site, Brian determines that three powered-on computers need to be taken for forensic examination. What steps should he take before removing the PCs?
A. Power them down, take pictures of how each is connected, and log each system in as evidence.
B. Take photos of each system, power them down, and attach a tamper-evident seal to each PC.
C. Collect live forensic information, take photos of each system, and power them down.
D. Collect a static drive image, validate the hash of the image, and securely transport each system
C. Collect live forensic information, take photos of each system, and power them down.
Brian should determine whether he needs live forensic information, but if he is not certain, the safest path for him is to collect live forensic information, take photos so that he knows how each system was set up and configured, and then power them down. He would then log each system as evidence and will likely create forensic copies of the drives once he reaches his forensic work area or may use a portable forensic system to make drive images onsite. Powering a running system down can result in the loss of significant forensic information, meaning that powering a system down before collecting some information is typically not recommended. Collecting a static image of a drive requires powering the system down first.
Greg is concerned about the use of DDoS attack tools against his organization, so he purchased a mitigation service from his ISP. What portion of the threat model did Greg reduce?
A. Likelihood
B. Total attack surface
C. Impact
D. Adversary capability
C. Impact
By purchasing a mitigation service, Greg is reducing the potential impact of a DDoS attack. This service can’t reduce the likelihood that an attacker will launch an attack or the capability of that adversary. Greg did not change his own infrastructure, so he did not reduce the total attack surface.
Scott has been asked to select a software development model for his organization and knows that there are a number of models that may make sense for what he has been asked to accomplish. Use your knowledge of SDLC models to identify an appropriate model for each of the following requirements.
Scott’s organization needs basic functionality of the effort to become available as soon as possible and wants to involve the teams that will use it heavily to ensure that their needs are met. What model should Scott recommend?
A. Waterfall
B. Spiral
C. Agile
D. Rapid Application Development
C. Agile
The Agile method is heavily driven by user stories and customer involvement. Sprints deliver functional code, meaning that some elements of the product may be ready early.
Isaac’s organization has deployed a security tool that learns how network users typically behave and then searches for differences that match attack behaviors. What type of system can automatically analyze this data to build detection capability like this?
A. Signature-based analysis
B. A Babbage machine
C. Machine learning
D. Artificial network analysis
C. Machine learning
Machine learning (ML) in systems like this relies on datasets to build profiles of behavior that it then uses to identify abnormal behavior. They also use behavioral data that is frequently associated with attacks and malware and use that to compare to the user behavior patterns. Signature-based analysis uses hashing or other related techniques to verify if files match a known malware package. The Babbage machine is a mechanical computer, and artificial network analysis was made up for this question.
Himari discovers the vulnerability shown here on several Windows systems in her organization. There is a patch available, but it requires compatibility testing that will take several days to complete. What type of file should Himari be watchful for because it may directly exploit this vulnerability?
A. Private key files
B. Word documents
C. Image files
D. Encrypted file
C. Image files
The vulnerability shown here affects PNG processing on systems running Windows. PNG is an acronym for Portable Network Graphics and is a common image file format.
Michelle wants to provide metrics for her security team’s incident response capabilities. Which of the following is not a common measure for teams like hers?
A. Mean time to detect.
B. Mean time to respond.
C. Mean time to remediate.
D. Mean time to compromise.
D. Mean time to compromise.
Mean time to compromise is not a typical metric or key performance indicator for security teams. Mean time to detect, mean time to respond, and mean time to remediate are all common metrics for teams.
Mika, a computer forensic examiner, receives a PC and its peripherals that were seized as forensic evidence during an investigation. After she signs off on the chain of custody log and starts to prepare for her investigation, one of the first things she notes is that each cable and port was labeled with a color-coded sticker by the onsite team. Why are the items labeled like this?
A. To ensure chain of custody.
B. To ensure correct reassembly.
C. To allow for easier documentation of acquisition.
D. To tamper-proof the system.
B. To ensure correct reassembly.
Reassembling the system to match its original configuration can be important in forensic investigations. Color-coding each cable and port as a system is disassembled before moving helps to ensure proper reassembly. Mika should also have photos taken by the onsite investigators to match her reassembly work to the onsite configuration.
Mika wants to run an Nmap scan that includes all TCP ports and uses service detection. Which of the following nmap commands should she execute?
A. nmap -p0 -all -SC
B. nmap -p 1-32768 -sVS
C. nmap -p 1-65535 -sV -sS
D. nmap -all -sVS
C. nmap -p 1-65535 -sV -sS
Scanning the full range of TCP ports can be done using a SYN scan (-sS) and declaring the full range of possible ports (1-65535). Service version identification is enabled with the -sV flag.
Jackie is reviewing the risk scores found in a vulnerability report and notes that the risk she is reviewing scores a 1.0. What recommendation should Jackie make about the vulnerability?
A. It should be patched immediately because the risk score is high.
B. The risk is very low and can likely be ignored.
C. The risk is low and should be patched in the next patch cycle.
D. It should be patched immediately because it is in the top 10 percent of risks.
C. The risk is low and should be patched in the next patch cycle.
While a risk as low as 1.0 on the CVSS scale is unlikely to cause immediate harm, if a patch is available and does not introduce additional risk, it should still be installed at the next patch window.
Nathan downloads a BIOS/UEFI update from Dell’s website, and when he attempts to install it on the PC, he receives an error that the hash of the download does not match the hash stored on Dell’s servers. What type of protection is this?
A. Full-disk encryption
B. Firmware protection
C. Operating system protection
D. None of the above
B. Firmware protection
BIOS and UEFI are the firmware that controls system startup. In Dell’s implementation of this technology, a SHA-256 hash of the new firmware is compared to a known good hash on Dell’s servers. If an issue is detected, administrators are notified so that they can take appropriate action.
Joe discovered a critical vulnerability in his organization’s database server and received permission from his supervisor to implement an emergency change after the close of business. He has eight hours before the planned change window. In addition to planning the technical aspects of the change, what else should Joe do to prepare for the change?
A. Ensure that all stakeholders are informed of the planned outage.
B. Document the change in his organization’s change management system.
C. Identify any potential risks associated with the change.
D. All of the above.
D. All of the above.
Joe has time to conduct some communication and change management before making the change. Even though this change is urgent, Joe should take advantage of that time to communicate with stakeholders, conduct a risk assessment, and initiate change management processes. These tasks will likely be abbreviated forms of what Joe would do if he had time to plan a change normally, but he should make every effort to complete them.
Ling recently completed the security analysis of a web browser deployed on systems in her organization and discovered that it is susceptible to a zero-day integer overflow attack. Who is in the best position to remediate this vulnerability in a manner that allows continued use of the browser?
A. Ling
B. The browser developer
C. The network administrator
D. The domain administrator
B. The browser developer
Ling or the domain administrator could remove the software from the system, but this would not allow continued use of the browser. The network administrator could theoretically block all external web browsing, but this is not a practical solution. The browser developer is the only one in a good situation to correct an overflow error because it is a flaw in the code of the web browser.
Syslog, APIs, email, STIX/TAXII, and database connections are all examples of what for a SOAR?
A. IOCs
B. Methods of data ingestion
C. SCAP connections
D. Attack vectors
B. Methods of data ingestion
SOAR systems offer many ways to ingest data, and syslog, APIs, email, STIX/TAXII feeds, and database connections are all common ways for data to be acquired.
Aadesh is creating a vulnerability management program for his company. He has limited scanning resources and would like to apply them to different systems based on the sensitivity and criticality of the information that they handle. What criteria should Aadesh use to determine the vulnerability scanning frequency?
A. Data remanence
B. Data privacy
C. Data classification
D. Data sovereignty
C. Data classification
Data classification is a set of labels applied to information based on their degree of sensitivity and/or criticality. It would be the most appropriate choice in this scenario. Data retention requirements dictate the length of time that an organization should maintain copies of records. Data remanence is an issue where information thought to be deleted may still exist on systems. Data privacy may contribute to data classification but does not encompass the entire field of data sensitivity and criticality in the same manner as data classification. For example, a system may process proprietary business information that would be very highly classified and require frequent vulnerability scanning. Unless that system also processed personally identifiable information, it would not trigger scans under a system based solely on data privacy.
Adam works for a large university and sees the following graph in his PRTG console when looking at a yearlong view. What behavioral analysis could he leverage based on this pattern?
A. Identify unexpected traffic during breaks like the low point at Christmas.
B. He can determine why major traffic drops happen on weekends.
C. He can identify top talkers.
D. Adam cannot make any behavioral determinations based on this chart.
A. Identify unexpected traffic during breaks like the low point at Christmas.
Adam will quickly note that weekends see small drops, but Christmas vacation and summer break both see significant drops in overall traffic. He can use this as a baseline to identify unexpected traffic during those times or to understand what student and faculty behavior mean to his organization’s network usage.
Latisha is the ISO for her company and is notified that a zero-day exploit has been released that can result in remote code execution on all Windows workstations on her network because of an attack against Windows domain services. She wants to limit her exposure to this exploit but needs the systems to continue to be able to access the Internet. Which of the following approaches is best for her response?
A. Firewalling
B. Patching
C. Isolation
D. Segmentation
A. Firewalling
Latisha knows that Windows domain services can be blocked using a network firewall. As long as she builds the correct ruleset, she can prevent external systems from sending this type of traffic to her Windows workstations. She may still want to segment her network to protect the most important workstations, but her first move should be to use her firewalls to prevent the traffic from reaching the workstations.
Helen is seeking to protect her organization against attacks that involve the theft of user credentials. In most organizations, which one of the following threats poses the greatest risk of credential theft?
A. DNS poisoning
B. Phishing
C. Telephone-based social engineering
D. Shoulder surfing
B. Phishing
Although all the techniques listed may be used to engage in credential theft, phishing is, by far, the most common way that user accounts become compromised in most organizations.
Scott needs to ensure that the system he just rebuilt after an incident is secure. Which type of scan will provide him with the most useful information to meet his goal?
A. An authenticated vulnerability scan from a trusted internal network.
B. An unauthenticated vulnerability scan from a trusted internal network.
C. An authenticated scan from an untrusted external network.
D. An unauthenticated scan from an untrusted external network.
A. An authenticated vulnerability scan from a trusted internal network.
Since Scott needs to know more about potential vulnerabilities, an authenticated scan from a trusted internal network will provide him with the most information. He will not gain a real attacker’s view, but in this case, having more detail is important.
Mila ran a vulnerability scan of a server in her organization and found the vulnerability shown here. What is the use of the service affected by this vulnerability?
A. Web server
B. Database server
C. Email server
D. Directory server
C. Email server
The Post Office Protocol v3 (POP3) is used for retrieving email from an email server.
