Chapter 8

You manage the information systems for a large co-location data center. Networked environmental controls are used to manage the temperature within the data center. These controls use embeded smart technology allowing them to be managed using a mobile device app over an Internet connection. You are concerned about the security of these devices. What can you do to increase their security posture?

Verify that your network's existing security infrastructure is working properly.

Which commands should you use to display both listening and non-listening sockets on your Linux system?

netstat -a

You need to increase the security of your Linux system by finding and closing open ports. Which of the following commands should you use to locate open ports?

nmap

Which command should you use to scan for open TCP ports on your LINUX system?

nmap -sT

Which of the following describes a configuration baseline?

A list of common security settings that a group or all devices share

Which of the following describes a logic bomb?

A program that performs a malicious activitiy at a specific time or after a triggering event.

In a variation of the brute force attack, an attacker may use a predefined list (dictionary) of commonly used usernames and passwords to gain access to existing user accounts. Which countermeasures best addresses the issue?

A strong password policy

What is the main difference between a worm and a virus?

A worm can replicate itself, while a virus requires a host for distribution

You have a file server named srv3 that holds files used by the Development department. You want to allow users to access the files over the network, and control access to files when files are access through the network or through a local logon. Which solution should you implement?

Add Mark Mangum to the ACL for the Confidential.xls file with Deny permissions

While browsing the Internet, you notice that the browser displays ads that are targeted towards recent keyword searches you have performed. What is this an example of?

Adware

What will the netstat -a command show?

All listening and non-listening sockets

Many popular operating systems allow for quick and easy sharing of files and printers with other network memebrs. Which of the following is not a measure by which file and printer sharing is hardened?

Allowing NetBIOS traffic outside of your secured network

Which of the following measures are you most likely to implement to protect against a worm or Trojan horse?

Anti-virus software

Which of the following statements about the use of anti-virus software is correct?

Anti-virus software should be configured to download updated viruses definition files as soon as they become available.

Which of the following is the best recommendation for applying hotfixes to your servers?

Apply only the hotfixes that apply to software running on your systems

What is another name for a logic bomb?

Asynchronous attack

Developers in your company have created a Web application that interfaces with a database serve. During development, programmers created a special user account that bypasses that normal security. What is this an example of?

Backdoor

NetBus and back orifice are remote control tool. They allow you to connect to a remote system over a network and operate it as if you were sitting at a local keyboard. Unfortuntely, these two programs are also examples of what type of security concern?

Backdoor trojans

A collection of zombie computers have been set up to collect personal information. What type of malware do the zombie computers represent?

Botnet

You have just purchased a new network device and are getting ready to connect it to your network. Which of the following should you do to increase its security?

Change default account passwords Apply all patches and updates

You want to give all managers the ability to view and edit a certain file. To do so, you need to edit the discretionary access control list (DACL) associated with the file. You want to be able to easily add and remove managers as their job positions change. What is the best way to accomplish this?

Create a security group for the managers. Add all users as members of the group. Add the group to the file's DACL

When securing a newly deployed server, which of the following rules of thumb should be followed?

Determine the unneeded services and their dependencies before altering the system.

Which of the following actions should you take to reduce the attack surface of a server?

Disable unused services

You have multiple users who are computer administrators. You want each administrator to be able to shut down systems and install drivers. What should you do?

Grant the group the necessary user rights Create a security group for the administrators; add all user accounts to the group.

For users who are memebrs of the Sales team, you want to force their computers to use a specific desktop background and remove access to adminstrative tols from the Start menu. Which solution should you use?

Group policy

Which of the following solutions would you use to control the actions that users can perform on a computer such as shutting down the system, logging in through the network, or loading and unloading device drivers?

Group policy

You have contracted with a vendor to supply a custom application that runs on Windows workstations. As new application version and patches are released, you want to be able to automatically apply these to multiple computers. Which tool would be the best choice to use?

Group policy

Which of the following tools can you use on a windows network to automatically distribute and install software and operating system patches on workstations?

Group policy WSUS

By definition, what is the process of reducing security exposure and tightening security controls?

Hardening

Which of the following terms describes a Windows oeprating system patch that corrects a specific problem and is released in a short term, periodic base(typically monthly)?

Hotfix

You manage the information systems for a large manufacturing firm. Supervisory control and data acquistion (SCADA) devices are used on the manfucaturing floor to manager your organization's automated factory equipment. The SCADA devices use embedded smart technology, allowing them to be managed using a mobile device app over an Internet connection. You are concerned about the security of these devices. What can you do to increase their security posture?

Install the latest firmware updates from the device manufacturer Verify that your network's existing security infrastrucutre is working properly.

You have installed anti-malware software that checks for viruses in e-mail attachments. You configure the software to quarantine any file with problems. You receive an e-mail with an important attachment, but the attachment is not there. Instead, you see a message that the file has been quarentined by the anti-malware software. What has happened to the file?

It has been moved to a secure folder on your computer

Which of the following best describes spyware?

It monitors the actions you take on your machine and sends the information back to its originating source

You have 2 folders that contain documents used by various departments: The development group has been given the Write permission to the Design folder. The sales group has been given the Write permission to the Products folder. No other permissions have been given to either group. User Mark Tillman needs to have read permission to the Design folder and the write permission to the Products folder. You want to use groups as much as possible. What should you do?

Make mark a member of the Sales group; add Mark's user account directly to the ACL for the Design folder

You have a file server named srv3 that holds files used by the Development department. You want to allow users to access the files over the network, and control access to files when files are access through the network or through a local logon. Which solution should you implement?

NTFS and share permissions

You have placed an FTP server in your DMZ behind your firewall. The FTP server will be used to distribute software updates and demonstration versions of your products. Users report they are unable to access the FTP server. What should you do to enable access?

Open ports 20 and 21 for inbound and outbound connections

Which of the following is most vulnerable to a brute force attack?

Password authentication

Which of the following password attacks uses preconfigured matrices of hashed dictionary words?

Rainbow table

You recently discovered several key files of your antivirus program have been deleted. You suspect that a virus deleted the files. Which type of virus deletes key antivirus program files?

Retro

You have heard about a new malware program that presents itself to users as a virus scanner. When users run the software, it installs itself as a hidden program that has administrative access to various operating system components. The program then tracks system activity and allows an attacker to remotely gain adminstrator access to the computer. Which of the following terms best describes this software?

Rootkit

FTPS uses which mechanism to provide security for authentication and data transfer?

SSL

Match the group policy type with the function it can perform

Software that should be installed on a specific computer Computer configuration Software that should be installed for a specific user User configuration Scripts that should run at startup or shutdown Computer configuration Scripts that should run at logong or logoff User configuration Network communication security settings Computer configuration

Which type of virus intercepts system requests and alters service outputs to conceal its presence?

Stealth

You have recently experienced a security incident with one of your servers. After some research, you determine that hotfix #568994 has recently been released would have protected the server. Which of the following recommendations should you follow when applying the hotfix?

Test the hotfix, then apply it to all servers

Arrange the group policy objects in the order in which they are applied

The local group policy on the computer GPOs linked to the domain that contains the user or computer object GPOs linked to the organizational unit that contains the object

Why do attackers prefer static environment devices to conduct distributed network attacks?

These devices are typically more difficult to monitor than traditional network devices These devices tend to employ much weaker security than traditional network devices.

What is a program that appears to be a legitimate application, utility, game, or screensaver that performs malicious activities surreptitiously?

Trojan horse

A user named Bob Smith has been assigned a new desktop workstation to complete his day to day work. The computer runs windows 7. when provisioning Bob's user account in your organization's domain, you assigned an account name of Bsmith with an initial password of bw2Fs3d. On first logon, ob is prompted to change his password, so he changes it to the name of his dog(fido). What should you do to increase the security of Bob's account?

Use Group policy to require strong passwords on user accounts. Train users not to use passwords that are easy to guess