Network Security Quiz 2

Phases of software development life cycle

The phases of the software development life cycle in order are: Planning , Requirements , Design , Coding , Testing , Training and Transition , and Ongoing Operations and Maintenance .

Kevin would like to utilize a security control that can implement access restrictions across all of the SaaS solutions used by the organization. What control would best meet Kevin's needs?

CASB

Lilo is concerned about vehicles approaching the entrance to a building. What physical security control should Lilo implement.

Bollard

Lilo is conducting a penetration test for a client. The client provided Lilo with limited but important information on the configuration of the systems under test. What type of pentest is Lilo performing?

Gray-box test

Logging into an AWS environment to perform maintenance work is most commonly done through which tool?

SSH

Lyndsey wants to implement a striped drive solution. What RAID level does this describe?

RAID 0

Substitution Cipher

a type of coding or ciphering system that changes one character or symbol into another

Steganography

Art of using cryptographic techniques to embed secret messages within another file

Taylor is designing a pentest platform that needs to be able to expand and contract as needs change. Which of the following terms describes Taylor's goal?

Elasticity

Integrity

Data is not altered

Confidentiality

data remains private

Which of the CVSS metrics would contain information about the difficulty of exploiting the vulnerability?

AC

Taylor performs a backup that captures the changes since the last backup. What type of backup has Taylor performed?

an incremental backup

Which of the following techniques is considered passive reconnaissance?

WHOIS Lookups

Dr. Hwang is the CIS department chair and wishes to send a message to CIS students that does not need to be kept secret but students need to be assured that the message actually came from Dr. Hwang. What key should Dr. Hwang use to sign the message?

Dr Hwang's private key

Kelly installs a backdoor in a database server that was exploited as part of a penetration test which will provide ongoing access to the server in the future. Which term describes this action?

Persistence

Taylor is reviewing authentication frameworks for wireless networks. Which framework is Taylor likely to find most useful for wireless environments?

EAP

Miguel sends backups to a company that keeps them in a secure vault. What type of backup solution has Miguel implemented?

offline

Terry is investigating a security incident where the attacker entered a very long string into an input field, which was followed by a system command. What type of attack likely took place?

Buffer Overflow

The SWIFT club has 80 members and they all need the ability to communicate with one another securely using an asymmetric encryption system. The system allows any two members to communicate without other members eavesdropping. If an 81st member is added to the club, how many new keys must be added to the system?

2

In what cloud security model does the cloud service provider bear the least responsibility for implementing security controls?

IaaS

Sam wants to set an account policy that raises an alert if a user logs in from two different locations in a timeframe that is too short for reasonable travel. What type of account policy should Sam set?

Impossible travel time

Precompiled SQL statements that only require variables to be input are an example of what type of application security control?

Parametized Queries

Morgan is testing software by sending invalid and even random data to the application. What type of code testing is Morgan conducting?

fuzzing

Nonrepudiation

proving sender is original sender

Michael is wanting to implement numerous smaller servers for the data center and then deploy a load balancer to gain scalability. What type of scalability is Michael trying to implement?

Horizontal scalability

The Student Data Center (SDC) on campus ties together local computing capabilities within the SDC with capabilities from multiple public-cloud providers. Which deployment model best describes this environment?

Hybrid Cloud

Jen is engaged in a penetration test and wishes to eavesdrop on communications between a user and a web server. What type of attack would Jen likely use?

Man-in-the-middle

Terry identified a new security vulnerability and computed its CVSS base score as 3.5. Which risk category would this vulnerability fall into?

Low

What type of recovery site has all the infrastructure and data needed to operate the organization?

a hot site

Cipher

a method used to scramble or obfuscate characters to hide their value

Calculate the impact sub-score (ISS) given the following CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.56

Aubrey needs to implement LDAP service. What type of service is Aubrey attempting to enable?

a directory service

Which of the following measures would database administrators consider to be the best defense against data exposure?

data minimization

When making a change to a web application in use by an organization to fix a bug, the work should be completed in the _____________ environment.

production

Sana is deploying the organization's websites in the local AWS availability zone as well as an availability zone across the country. This plan will provide enhanced uptime and scalability, but why did Sana choose an availability zone on the far side of the country?

Geographic dispersal

Mackenzie was offered an on-the-job training opportunity that includes defending the organization's systems from attack as part of a security training exercise. What role is Mackenzie playing in this exercise?

Blue Team

Lilo is configuring a web server to use digital certificates and wishes to allow clients to quickly verify the status of the certificate without contacting a remote server. What technology can Lilo use to accomplish this outcome?

Certificate stapling

What type of cipher operates on one character at a time?

Stream cipher

An individual's name, location, and role in the organization are all examples of what?

attributes

Sam is using full disk encryption technology to protect the contents of laptops against theft. What goal of cybersecurity is Sam attempting to achieve?

confidentiality

Mac needs to utilize application-level virtualization in which multiple servers operate independently while sharing an operating system. What type of resource does Mac need to use?

containers

Which of the following controls will NOT affect scan results?

Audit requirements

What type of attack does an account lockout policy help to prevent?

Brute force

Taylor is seeking the Cloud Reference Architecture which offers a high-level taxonomy for cloud services. What document should Taylor access?

NIST SP thing

Benny needs to create an account for an application (e.g. a VM instance) to access other resources. What type of account should Benny use?

Service account

Sam has detected lateral network traffic that is not compliant with the organization's security policy creating a belief that a cybersecurity compromise has already occurred. Sam decides to search for evidence of the compromise, which type of security assessment technique should Sam utilize?

Threat Hunting

Taylor is conducting a penetration test and deploys a toolkit on a compromised system which is then used to gain access to other systems. What term best describes Taylor's activity?

Lateral movement

Maria wants to use an individuals job requirements as the basis for an access control scheme. Which scheme is best suited to this implementation?

RBAC

Sam wants to implement a RAID array upon which data is striped across drives, with drives used for parity (checksum) of the data. Sam also wants to ensure that the system can handle more than one drive failing at a time. What RAID type should Sam use?

Raid 6

Sam is conducting a penetration test in preparation for an external pentest engagement. Sam attempts a session hijacking attack which will require a __________ to be successful.

Session Cookie

What is an HSM used for?

To generate, manage, and securely store cryptographic keys

Jen is configuring a cloud environment and needs to define network traffic that is allowed into the organization's cloud environment while blocking other network traffic. What resource would a cloud provider typically offer to meet this need?

security groups

Lilo needs to provide access control in enterprise-systems applications such as database, microservice, and API access which requires considerable flexibility. Which access control scheme is Lilo likely to use?

ABAC

Mindy works for an automobile parts manufacturer and has access to a cloud environment that is exclusive to organizations that provide services or parts to a major automobile manufacturer. What model of of cloud computing does this environment represent?

Community Cloud

When CIS students receive an email from Dr. Hwang that has been digitally signed, what key should the students use to verify the digital signature?

Dr Hwang's public key

Kara discovered the web server was being overwhelmed by traffic causing a CPU bottleneck. Using an interface from the cloud provider, Kara added a second web server and a load balancer to balance the load between the two servers. What term best describes Kara's action?

Horizontal scaling

Taylor is saving hash values of data archives so that these same archives in the future can be tested to ensure that the archive has not been changed or modified. What goal of cybersecurity is Taylor attempting to achieve?

Integrity

Authentication

Verifying the claimed identity of system users

Kim creates open-source software tools and wants to assure users that the code they received is authentic code provided by the author. What technique can Kim use to provide this assurance?

Code signing

Sam is responsible for the deployment of IoT gateway devices located in close proximity to sensors that are collecting data. The gateway performs preprocessing of the data before sending results to the cloud. What term best describes this approach?

fog computing

During a periodic review of security controls, Maria discovered that individuals who breach the network security perimeter would be able to then attack IoT systems that operate manufacturing. Manufacturing is a closed system and does not require internet connectivity. What type of solution is best suited for this?

Air gap

Bob would like to send Alice a secure message using an asymmetric encryption algorithm. What key should Bob use to encrypt the message?

Alice's public key