Security+

An attacker has sent more information than expected in a single API call, and this has allowed the execution of arbitrary code. Which of the following would BEST describe this attack? ❍ A. Buffer overflow ❍ B. Replay attack ❍ C. Session hijacking ❍ D. DDoS

The Answer: A. Buffer overflow The results of a buffer overflow can cause random results, but sometimes the actions can be repeatable and controlled. In the best possible case for the hacker, a buffer overflow can be manipulated to execute code on the remote device. The incorrect answers: B. Replay attack A replay attack does not require the sending of more information than expected, and often a replay attack consists of normal traffic and expected application input. C. Session hijacking Session hijacking doesn't require any data overflows, and commonly the hijack occurs without any unusual input. D. DDoS A DDoS (Distributed Denial of Service) renders a service unavailable, and it involves the input of many devices to operate. A DDoS would not require sending more information than expected, and it rarely results in the execution of arbitrary code.

An organization is installing a UPS for their new data center. Which of the following would BEST describe this type of control? ❍ A. Compensating ❍ B. Preventive ❍ C. Managerial ❍ D. Detective

The Answer: A. Compensating A compensating security control doesn't prevent an attack, but it does restore from an attack using other means. In this example, the UPS does not stop a power outage, but it does provide alternative power if an outage occurs. The incorrect answers: B. Preventive A preventive control physically limits access to a device or area. C. Managerial A managerial control sets a policy that is designed to control how people act. D. Detective A detective control may not prevent access, but it can identify and record any intrusion attempts.

A company would like to securely deploy applications without the overhead of installing a virtual machine for each system. Which of the following would be the BEST way to deploy these applications? ❍ A. Containerization ❍ B. IaaS ❍ C. Proxies ❍ D. CASB

The Answer: A. Containerization Application containerization uses a single virtual machine to use as a foundation for separate application "containers." These containers are implemented as isolated instances, and an application in one container is not inherently accessible from other containers on the system. The incorrect answers: B. IaaS IaaS (Infrastructure as a Service) is a cloud-based service that provides the basic infrastructure for installing operating systems and applications. By itself, IaaS does not provide any method of application deployments or virtual machines. C. Proxies Proxies can be used as security devices, but they aren't used for deploying application instances without virtual machines. D. CASB A CASB (Cloud Access Security Broker) is a cloud security solution to manage visibility, compliance, threat prevention, and other security features for cloud-based applications.

Elizabeth, a security administrator, is concerned about the potential for data exfiltration using external storage drives. Which of the following would be the BEST way to prevent this method of data exfiltration? ❍ A. Create an operating system security policy to prevent the use of removable media ❍ B. Monitor removable media usage in host-based firewall logs ❍ C. Only allow applications that do not use removable media ❍ D. Define a removable media block rule in the UTM

The Answer: A. Create an operating system security policy to prevent the use of removable media Removable media uses hot-pluggable interfaces such as USB to connect storage drives. A security policy in the operating system can prevent any files from being written to a removable drive. The incorrect answers: B. Monitor removable media usage in host-based firewall logs A host-based firewall monitors traffic flows and does not commonly log hardware or USB drive access. C. Only allow applications that do not use removable media File storage access options are not associated with applications, so it's not possible to allow based on external storage drive usage. D. Define a removable media block rule in the UTM A UTM (Unified Threat Manager) watches traffic flows across the network and does not commonly manage the storage options on individual computers.

A user has assigned individual rights and permissions to a file on their network drive. The user adds three additional individuals to have read-only access to the file. Which of the following would describe this access control model? ❍ A. DAC ❍ B. MAC ❍ C. ABAC ❍ D. RBAC

The Answer: A. DAC DAC (Discretionary Access Control) is used in many operating systems, and this model allows the owner of the resource to control who has access. The incorrect answers: B. MAC MAC (Mandatory Access Control) allows access based on the security level assigned to an object. Only users with the object's assigned security level or higher may access the resource. C. ABAC ABAC (Attribute-based Access Control) combines many different parameters to determine if a user has access to a resource. D. RBAC RBAC (Role-based Access Control) assigns rights and permissions based on the role of a user. These roles are usually assigned by group.

Which of the following would be the BEST way to provide a website login using existing credentials from a third-party site? ❍ A. Federation ❍ B. 802.1X ❍ C. PEAP ❍ D. EAP-FAST

The Answer: A. Federation Federation would allow members of one organization to authenticate using the credentials of another organization. The incorrect answers: B. 802.1X 802.1X is a useful authentication protocol, but it needs additional functionality to authenticate across multiple user databases. C. PEAP PEAP (Protected Extensible Authentication Protocol) provides a method of authentication over a protected TLS (Transport Layer Security) tunnel, but it doesn't provide the federation needed for these requirements. D. EAP-FAST EAP-FAST (Extensible Authentication Protocol - Flexible Authentication via Secure Tunneling) is an updated version of LEAP (Lightweight EAP) that was commonly used after WEP (Wired Equivalent Privacy) was replaced with WPA (Wi-Fi Protected Access).

Which of these protocols use TLS to provide secure communication? (Select TWO) ❍ A. HTTPS ❍ B. SSH ❍ C. FTPS ❍ D. SNMPv2 ❍ E. DNSSEC ❍ F. SRTP

The Answer: A. HTTPS and C. FTPS TLS (Transport Layer Security) is a cryptographic protocol used to encrypt network communication. HTTPS is the Hypertext Transfer Protocol over TLS, and FTPS is the File Transfer Protocol over TLS.

An organization has identified a significant vulnerability in a firewall that was recently installed for Internet connectivity. The firewall company has stated there are no plans to create a patch for this vulnerability. Which of the following would BEST describe this issue? ❍ A. Lack of vendor support ❍ B. Improper input handling ❍ C. Improper key management ❍ D. End-of-life

The Answer: A. Lack of vendor support Security issues can be identified in a system or application at any time, so it's important to have a vendor that can support their software and correct issues as they are discovered. If a vendor won't provide security patches, then you may be susceptible to security vulnerabilities. The incorrect answers: B. Improper input handling A best practice for application security is to provide the proper handling of invalid or unnecessary input. Adding a patch to firewall software for a vulnerability would probably not be related to input handling. C. Improper key management Cryptographic keys can be used for many security purposes, but managing those keys isn't part of the patching process from a vendor. D. End-of-life In this case, the firewall is a relatively new product. If the product was no longer officially sold or supported by the company, this would be an end- of-life issue.

A network administrator has installed a new access point, but only a portion of the wireless devices are able to connect to the network. Other devices can see the access point, but they are not able to connect even when using the correct wireless settings. Which of the following security features was MOST likely enabled? ❍ A. MAC filtering ❍ B. SSID broadcast suppression ❍ C. 802.1X authentication ❍ D. Anti-spoofing

The Answer: A. MAC filtering Filtering addresses by MAC (Media Access Control) address will limit which devices can connect to the wireless network. If a device is filtered by MAC address, it will be able to see an access point but it will not be able to connect. The incorrect answers: B. SSID broadcast suppression A suppressed SSID (Service Set Identifier) broadcast will hide the name from the list of available wireless networks. Properly configured client devices can still connect to the wireless network, even with the SSID suppression. C. 802.1X authentication With 802.1X authentication, users will be prompted for a username and password to gain access to the wireless network. Enabling 802.1X would not restrict properly configured devices. D. Anti-spoofing Anti-spoofing features are commonly used with routers to prevent communication from spoofed IP addresses. This issue in this question doesn't appear to involve any spoofed addresses.

A system administrator, Daniel, is working on a contract that will specify a minimum required uptime for a set of Internet-facing firewalls. Daniel needs to know how often the firewall hardware is expected to fail between repairs. Which of the following would BEST describe this information? ❍ A. MTBF ❍ B. RTO ❍ C. MTTR ❍ D. MTTF

The Answer: A. MTBF The MTBF (Mean Time Between Failures) is a prediction of how often a repairable system will fail. The incorrect answers: B. RTO RTO (Recovery Time Objectives) define a set of objectives needed to restore a particular service level. C. MTTR MTTR (Mean Time to Restore) is the amount of time it takes to repair a component. D. MTTF MTTF (Mean Time to Failure) is the expected lifetime of a non- repairable product or system.

Which of these threat actors would be MOST likely to attack systems for direct financial gain? ❍ A. Organized crime ❍ B. Hacktivist ❍ C. Nation state ❍ D. Competitor

The Answer: A. Organized crime An organized crime actor is motivated by money, and their hacking objectives are usually based around objectives that can be easily exchanged for financial capital. The incorrect answers: B. Hacktivist A hacktivist is focused on a political agenda and not commonly on a financial gain. C. Nation state Nation states are already well funded, and their primary objective is not usually based on revenue or income. D. Competitor A competitor doesn't have any direct financial gain by disrupting a website or stealing customer lists, and often their objective is to disable a competitor's business or to harm their reputation. If there is a financial gain, it would often be an indirect result of an attack.

A security incident has occurred on a file server. Which of the following data sources should be gathered to address file storage volatility? (Select TWO) ❍ A. Partition data ❍ B. Kernel statistics ❍ C. ROM data ❍ D. Temporary file systems ❍ E. Process table

The Answer: A. Partition data and D. Temporary file systems Both temporary file system data and partition data are part of the file storage subsystem. The incorrect answers: B. Kernel statistics Kernel statistics are stored in memory. C. ROM data ROM data is a type of memory storage. E. Process table The process table keeps track of system processes, and it stores this information in RAM.

A company encourages users to encrypt all of their confidential materials on a central server. The organization would like to enable key escrow as a backup. Which of these keys should the organization place into escrow? ❍ A. Private ❍ B. CA ❍ C. Session ❍ D. Public

The Answer: A. Private With asymmetric encryption, the private key is used to decrypt information that has been encrypted with the public key. To ensure continued access to the encrypted data, the company must have a copy of each private key. The incorrect answers: B. CA A CA (Certificate Authority) key is commonly used to validate the digital signature from a trusted CA. This is not commonly used for user data encryption. C. Session Session keys are commonly used temporarily to provide confidentiality during a single session. Once the session is complete, the keys are discarded. Session keys are not used to provide long-term data encryption. D. Public In asymmetric encryption, a public key is already available to everyone. It would not be necessary to escrow a public key.

A data center manager has built a Faraday cage in the data center, and a set of application servers have been placed into racks inside the Faraday cage. Which of the following would be the MOST likely reason for the data center manager to install this configuration of equipment? ❍ A. Protect the servers against any unwanted electromagnetic fields ❍ B. Prevent physical access to the servers without the proper credentials ❍ C. Provide additional cooling to all devices in the cage ❍ D. Adds additional fire protection for the application servers

The Answer: A. Protect the servers against any unwanted electromagnetic fields A Faraday cage is a mesh of conductive material that will cancel electromagnetic fields. The incorrect answers: B. Prevent physical access to the servers without the proper credentials A Faraday cage does not provide any protection against system logins. C. Provide additional cooling to all devices in the cage A Faraday cage does not provide any additional cooling features. D. Adds additional fire protection for the application servers A Faraday cage does not provide any additional fire protection features.

An insurance company has created a set of policies to handle data breaches. The security team has been given this set of requirements based on these policies: • Access records from all devices must be saved and archived • Any data access outside of normal working hours must be immediately reported • Data access must only occur inside of the country • Access logs and audit reports must be created from a single database Which of the following should be implemented by the security team to meet these requirements? (Select THREE) A. Restrict login access by IP address and GPS location ❍ B. Require government-issued identification during the onboarding process ❍ C. Add additional password complexity for accounts that access data ❍ D. Conduct monthly permission auditing ❍ E. Consolidate all logs on a SIEM ❍ F. Archive the encryption keys of all disabled accounts ❍ G. Enable time-of-day restrictions on the authentication server

The Answer: A. Restrict login access by IP address and GPS location, E. Consolidate all logs on a SIEM, and G. Enable time-of-day restrictions on the authentication server Adding location-based policies will prevent direct data access from outside of the country. Saving log information from all devices and creating audit reports from a single database can be implemented through the use of a SIEM (Security Information and Event Manager). Adding a check for the time-of-day will report any access that occurs during non-working hours. The incorrect answers: B. Require government-issued identification during the onboarding process Requiring proper identification is always a good idea, but it's not one of the listed requirements. C. Add additional password complexity for accounts that access data Additional password complexity is another good best practice, but it's not part of the provided requirements. D. Conduct monthly permission auditing No requirements for ongoing auditing were included in the requirements, but ongoing auditing is always an important consideration. F. Archive the encryption keys of all disabled accounts If an account is disabled, there may still be encrypted data that needs to be recovered later. Archiving the encryption keys will allow access to that data after the account is no longer in use.

A security manager would like to ensure that unique hashes are used with an application login process. Which of the following would be the BEST way to add random data when generating a set of stored password hashes? ❍ A. Salting ❍ B. Obfuscation ❍ C. Key stretching ❍ D. Digital signature

The Answer: A. Salting Adding random data, or salt, to a password when performing the hashing process will create a unique hash, even if other users have chosen the same password. The incorrect answers: B. Obfuscation Obfuscation is the process of making something difficult for humans to read or understand. The obfuscation process isn't commonly associated with adding random information to hashes. C. Key stretching Key stretching is a process that uses a key multiple times for additional protection against brute force attacks. Key stretching by itself does not commonly add random data to the hashing process. D. Digital signature Digital signatures use a hash and asymmetric encryption to provide integrity of data. Digital signatures aren't commonly used for storing passwords.

An attacker calls into a company's help desk and pretends to be the director of the company's manufacturing department. The attacker states that they have forgotten their password and they need to have the password reset quickly for an important meeting. What kind of attack would BEST describe this phone call? ❍ A. Social engineering ❍ B.Tailgating ❍ C. Watering hole ❍ D. On-path

The Answer: A. Social engineering A social engineering attack takes advantage of authority and urgency principles in an effort to convince someone else to circumvent normal security controls. The incorrect answers: B. Tailgating A tailgating attack follows someone else with proper credentials through a door. This allows the attack to gain access to an area that's normally locked. C. Watering hole A watering hole attack uses a third-party site to perform attacks outside of a user's local (and usually more secure) network. D. On-path An on-path attack commonly occurs without any knowledge to the parties involved, and there's usually no additional notification that an attack is underway. In this question, the attacker contacted the help desk engineer directly.

A security administrator is adding additional authentication controls to the existing infrastructure. Which of the following should be added by the security administrator? (Select TWO) ❍ A.TOTP ❍ B. Least privilege ❍ C. Role-based awareness training ❍ D. Separation of duties ❍ E. Job rotation ❍ F. Smart Card

The Answer: A. TOTP and F. Smart Card TOTP (Time-based One-Time Passwords) and smart cards are useful authentication controls when used in conjunction with other authentication factors. The incorrect answers: B. Least privilege Least privilege is a security principle that limits access to resources based on a person's job role. Least privilege is managed through security policy and is not an authentication control. C. Role-based awareness training Role-based awareness training is specialized training that is based on a person's control of data within an organization. This training is not part of the authentication process. D. Separation of duties A security policy that separates duties across different individuals is separation of duties. This separation is not part of the authentication process. E. Job rotation Job rotation is a security policy that moves individuals into different job roles on a regular basis. This rotation is not part of the authentication process.

A security administrator has configured a virtual machine in a screened subnet with a guest login account and no password. Which of the following would be the MOST likely reason for this configuration? ❍ A. The server is a honeypot for attracting potential attackers ❍ B. The server is a cloud storage service for remote users ❍ C. The server will be used as a VPN concentrator ❍ D. The server is a development sandbox for third- party programming projects

The Answer: A. The server is a honeypot for attracting potential attackers A screened subnet is a good location to configure services that can be accessed from the Internet, and building a system that can be easily compromised is a common tactic for honeypot systems. The incorrect answers: B. The server is a cloud storage service for remote users Although cloud storage is a useful service, configuring storage on a server with an open guest account is not a best practice. C. The server will be used as a VPN concentrator VPN (Virtual Private Networking) concentrators should be installed on secure devices, and configuring an open guest account would not be considered a secure configuration. D. The server is a development sandbox for third-party programming projects It would not be secure to configure a development sandbox on a system with an open guest account.

A security administrator is concerned about data exfiltration resulting from the use of malicious phone charging stations. Which of the following would be the BEST way to protect against this threat? ❍ A. USB data blocker ❍ B. Personal firewall ❍ C. MFA ❍ D. FDE

The Answer: A. USB data blocker USB data blockers are physical USB cables that allow power connections but prevent data connections. With a USB data blocker attached, any power source can be used without a security concern. The incorrect answers: B. Personal firewall Personal firewall software is useful for blocking inbound network traffic, but it won't provide much security for physical USB connections. C. MFA MFA (Multi-Factor Authentication) is used during the authentication process. Incorporating multiple authentication factors won't prohibit the transfer of data over a USB connection. D. FDE FDE (Full Disk Encryption) is a security method for encrypting all data stored on a device. In this example, the encryption applied to the storage would not prevent the transfer of data through a malicious USB connection.

A corporate security team would like to consolidate and protect the private keys across all of their web servers. Which of these would be the BEST way to securely store these keys? ❍ A. Use an HSM Quick ❍ B. Implement full disk encryption on the web servers ❍ C. Use a TPM ❍ D. Upgrade the web servers to use a UEFI BIOS

The Answer: A. Use an HSM An HSM (Hardware Security Module) is a high-end cryptographic hardware appliance that can securely store keys and certificates for all devices. The incorrect answers: B. Implement full disk encryption on the web servers Full-disk encryption would only protect the keys if someone does not have the proper credentials, and it won't help consolidate all of the web server keys to a central point. C. Use a TPM A TPM (Trusted Platform Module) is used on individual devices to provide cryptographic functions and securely store encryption keys. Individual TPMs would not provide any consolidation of web server private keys. D. Upgrade the web servers to use a UEFI BIOS A UEFI (Unified Extensible Firmware Interface) BIOS (Basic Input/ Output System) does not provide any additional security or consolidation features for web server private keys.

A Linux administrator is downloading an updated version of her Linux distribution. The download site shows a link to the ISO and a SHA256 hash value. Which of these would describe the use of this hash value? ❍ A. Verifies that the file was not corrupted during the file transfer ❍ B. Provides a key for decrypting the ISO after download ❍ C. Authenticates the site as an official ISO distribution site ❍ D. Confirms that the file does not contain any malware

The Answer: A. Verifies that the file was not corrupted during the file transfer Once the file is downloaded, the administrator can calculate the file's SHA256 hash and confirm that it matches the value on the website. The incorrect answers: B. Provides a key for decrypting the ISO after download ISO files containing public information are usually distributed without any encryption, and a hash value would not commonly be used as a decryption key. C. Authenticates the site as an official ISO distribution site Although it's important to download files from known good sites, providing a hash value on a site would not provide any information about the site's authentication. D. Confirms that the file does not contain any malware A hash value doesn't inherently provide any protection against malware.

A network administrator would like each user to authenticate with their personal username and password when connecting to the company's wireless network. Which of the following should the network administrator configure on the wireless access points? ❍ A. WPA2-PSK ❍ B. 802.1X ❍ C. WPS ❍ D. WPA2-AES

The Answer: B. 802.1X 802.1X uses a centralized authentication server, and all users can use their normal credentials to authenticate to an 802.1X network. The incorrect answers: A. WPA2-PSK The PSK (Pre-shared Key) is the shared password that this network administration would like to avoid using in the future. C. WPS WPS (Wi-Fi Protected Setup) connects users to a wireless network using a shared PIN (Personal Identification Number). D. WPA2-AES WPA2 (Wi-Fi Protected Access 2) encryption with AES (Advanced Encryption Standard) is a common encryption method for wireless networks, but it does not provide any centralized authentication functionality.

Rodney, a security engineer, is viewing this record from the firewall logs: UTC 04/05/2018 03:09:15809 AV Gateway Alert 136.127.92.171 80 -> 10.16.10.14 60818 Gateway Anti-Virus Alert: XPACK.A_7854 (Trojan) blocked. Which of the following can be observed from this log information? ❍ A. The victim's IP address is 136.127.92.171 ❍ B. A download was blocked from a web server ❍ C. A botnet DDoS attack was blocked ❍ D. The Trojan was blocked, but the file was not

The Answer: B. A download was blocked from a web server A traffic flow from a web server port number (80) to a device port (60818) indicates that this traffic flow originated on port 80 of the web server. A file download is one of the most common ways to deliver a Trojan, and this log entry shows that the file containing the XPACK.A_7854 Trojan was blocked. The incorrect answers: A. The victim's IP address is 136.127.92.171 The format for this log entry uses an arrow to differentiate between the attacker and the victim. The attacker IP address is 136.127.92.171, and the victim's IP address is 10.16.10.14. C. A botnet DDoS attack was blocked A botnet attack would not commonly include a Trojan horse as part of a distributed denial of service (DDoS) attack. D. The Trojan was blocked, but the file was not A Trojan horse attack involves malware that is disguised as legitimate software. The Trojan malware and the file are the same entity, so there isn't a way to decouple the malware from the file.

Which of the following would be commonly provided by a CASB? (Select TWO) ❍ A. List of all internal Windows devices that have not installed the latest security patches ❍ B. List of applications in use ❍ C. Centralized log storage facility ❍ D. List of network outages for the previous month ❍ E. Verification of encrypted data transfers ❍ F. VPN connectivity for remote users

The Answer: B. A list of applications in use E. Verification of encrypted data transfers A CASB (Cloud Access Security Broker) can be used to apply security policies to cloud-based implementations. Two common functions of a CASB are visibility into application use and data security policy use. Other common CASB functions are the verification of compliance with formal standards and the monitoring and identification of threats. The incorrect answers: A. List of all internal Windows devices that have not installed the latest security patches A CASB focuses on policies associated with cloud-based services and not internal devices. C. Centralized log storage facility Using Syslog to centralize log storage is most commonly associated with a SIEM (Security Information and Event Manager). D. List of network outages for the previous month A network availability report would be outside the scope of a CASB. F. VPN connectivity for remote users VPN concentrators are commonly used to provide security connectivity for remote users.

A security manager has created a report showing intermittent network communication from external IP addresses to certain workstations on the internal network. These traffic patterns occur at random times during the day. Which of the following would be the MOST likely reason for these traffic patterns? ❍ A. ARP poisoning ❍ B. Backdoor ❍ C. Polymorphic virus ❍ D. Trojan horse

The Answer: B. Backdoor A backdoor would allow an attacker to access a system at any time without any user intervention. If there are inbound traffic flows that cannot be identified, it may be necessary to isolate that computer and examine it for signs of a compromised system. The incorrect answers: A. ARP poisoning ARP (Address Resolution Protocol) poisoning is a local exploit that is often associated with a man-in-the-middle attack. The attacker must be on the same local IP subnet as the victim, so this is not often associated with an external attack. C. Polymorphic virus Polymorphic viruses will modify themselves each time they are downloaded. Although a virus could potentially install a backdoor, a polymorphic virus would not be able to install itself without user intervention. D. Trojan horse A Trojan horse is malware that is hidden inside of a seemingly harmless application. Once the Trojan horse is executed, the malware will be installed onto the victim's computer. Trojan horse malware could possibly install backdoor malware, but the Trojan horse itself would not be the reason for these traffic patterns.

A company's security policy requires that login access should only be available if a person is physically within the same building as the server. Which of the following would be the BEST way to provide this requirement? ❍ A.TOTP ❍ B. Biometric scanner ❍ C. PIN ❍ D. SMS

The Answer: B. Biometric scanner A biometric scanner would require a person to be physically present to verify authentication. The incorrect answers: A. TOTP A TOTP (Time-based One-Time Password) generator may be associated with a single person, but the TOTP code does not guarantee that a person is physically present. C. PIN Although a PIN (Personal Identification Number) can be used as an authentication factor, the use of the PIN does not guarantee that a person is physically present. D. SMS SMS messages are commonly used as authentication factors. However, the use of a mobile device to receive the SMS message does not guarantee that the owner of the mobile device is physically present.

A manufacturing company would like to track the progress of parts as they are used on an assembly line. Which of the following technologies would be the BEST choice for this task? ❍ A. Quantum computing ❍ B. Blockchain ❍ C. Hashing ❍ D. Asymmetric encryption

The Answer: B. Blockchain The ledger functionality of a blockchain can be used to track or verify components, digital media, votes, and other physical or digital objects. The incorrect answers: A. Quantum computing Quantum computing uses quantum theory to perform high-speed calculations. Quantum computing doesn't inherently provide any tracking mechanisms. C. Hashing Cryptographic hashes are commonly used to provide integrity verifications, but they don't necessarily include any method of tracking components on an assembly line. D. Asymmetric encryption Asymmetric encryption uses different keys for encryption and decryption. Asymmetric encryption does not provide any method for tracking objects on an assembly line.

A system administrator has been called to a system that is suspected to have a malware infection. The administrator has removed the device from the network and has disconnected all USB flash drives. Which of these incident response steps is the administrator following? ❍ A. Lessons learned ❍ B. Containment ❍ C. Detection ❍ D. Reconstitution

The Answer: B. Containment The containment phase isolates the system from any other devices to prevent the spread of any malicious software. The incorrect answers: A. Lessons learned A post-incident meeting can help the incident response participants discuss the phases of the incident that went well and which processes can be improved for future events. C. Detection The detection phase occurred prior to the system administrator arriving and identified the potential infection. D. Reconstitution The reconstitution phase will recover the system and data back to the state prior to the malware infection.

A business manager is documenting a set of steps for processing orders if the primary Internet connection fails. Which of these would BEST describe these steps? ❍ A. Communication plan ❍ B. Continuity of operations ❍ C. Stakeholder management ❍ D. Tabletop exercise

The Answer: B. Continuity of operations It's always useful to have an alternative set of processes to handle any type of outage or issue. Continuity of operations planning ensures that the business will continue to operate when these issues occur. The incorrect answers: A. Communication plan A communication plan is a predefined list of contacts and processes used to inform key members of the organization. C. Stakeholder management Stakeholder management describes the ongoing relationship between the IT team and the business customer. D. Tabletop exercise A tabletop exercise usually consists of a meeting where members of a recovery team or disaster recovery talk through a disaster scenario.

The security policies in a manufacturing company prohibit the transmission of customer information. However, a security administrator has received an alert that credit card numbers were transmitted as an email attachment. Which of the following was the MOST likely source of this alert message? ❍ A. IPS ❍ B. DLP ❍ C. SMTP ❍ D. IPsec

The Answer: B. DLP DLP (Data Loss Prevention) technologies can identify and block the transmission of sensitive data across the network. The incorrect answers: A. IPS IPS (Intrusion Prevention System) signatures are useful for identifying known vulnerabilities, but they don't commonly provide a way to identify and block PII (Personally Identifiable Information) or sensitive data. C. SMTP SMTP (Simple Mail Transfer Protocol) is a protocol used to transfer email messages between servers. SMTP does not identify the transmission of sensitive data. D. IPsec IPsec (Internet Protocol Security) is a protocol suite for authenticating and encrypting network communication. IPsec does not include any features for identifying and alerting on sensitive information.

What kind of security control is associated with a login banner? ❍ A. Preventive ❍ B. Deterrent ❍ C. Corrective ❍ D. Detective ❍ E. Compensating ❍ F. Physical

The Answer: B. Deterrent A deterrent control does not directly stop an attack, but it may discourage an action. The incorrect answers: A. Preventive A preventive control physically limits access to a device or area. C. Corrective A corrective control can actively work to mitigate any damage. D. Detective A detective control may not prevent access, but it can identify and record any intrusion attempts. E. Compensating A compensating security control doesn't prevent an attack, but it does restore from an attack using other means. F. Physical A physical control is real-world security, such as a fence or door lock.

Which of the following risk management strategies would include the purchase and installation of an NGFW? ❍ A.Transference ❍ B. Mitigation ❍ C. Acceptance ❍ D. Risk-avoidance

The Answer: B. Mitigation Mitigation is a strategy that decreases the threat level. This is commonly done through the use of additional security systems and monitoring, such as an NGFW (Next-Generation Firewall). The incorrect answers: A. Transference Transference would move the risk from one entity to another. Adding an NGFW would not transfer any risk to another party. C. Acceptance The acceptance of risk is a position where the owner understands the risk and has decided to accept the potential results. D. Risk-avoidance With risk-avoidance, the owner of the risk decides to stop participating in a high-risk activity. This effectively avoids the risky activity and prevents any future issues.

Your development team has installed a new application and database to a cloud service. After running a vulnerability scanner on the application instance, you find that the database is available for anyone to query without providing any authentication. Which of these vulnerabilities is MOST associated with this issue? ❍ A. Improper error handling ❍ B. Open permissions ❍ C. Race condition ❍ D. Memory leak

The Answer: B. Open permissions Just like your local systems, proper permissions and security controls are also required when information is added to a cloud-based system. If any of your systems leave an open door, your data may be accessible by anyone on the Internet. The incorrect answers: A. Improper error handling This issue wasn't associated with any error messages, so this wouldn't be categorized as a problem with error handling. C. Race condition If two processes occur simultaneously without any prior consideration, bad things could happen. In this example, a single vulnerability scan has identified the issue and other processes do not appear to be involved. D. Memory leak An application with a memory leak will gradually use more and more memory until the system or application crashes. The issue in this question was related to permissions and not available resources.

You've hired a third-party to gather information about your company's servers and data. The third-party will not have direct access to your internal network but can gather information from any other source. Which of the following would BEST describe this approach? ❍ A. Backdoor testing ❍ B. Passive footprinting ❍ C. OS fingerprinting ❍ D. Partially known environment

The Answer: B. Passive footprinting Passive footprinting focuses on learning as much information from open sources such as social media, corporate websites, and business organizations.

A recent audit has found that existing password policies do not include any restrictions on password attempts, and users are not required to periodically change their passwords. Which of the following would correct these policy issues? (Select TWO) A. Password complexity B. Password expiration C. Password history D. Password lockout E. Password recovery

The Answer: B. Password expiration and D. Password lockout Password expiration would require a new password after the expiration date. Password lockout would disable an account after a predefined number of unsuccessful login attempts. The incorrect answers: A. Password complexity A complex password would make it more difficult to brute force, but it would not solve the issues listed in this question. C. Password history Having a password history would prevent the reuse of any previous passwords. E. Password recovery The password recovery process provides a method for users to recover an account that has been locked out or has a forgotten password.

Which of the following would be the BEST way to confirm the secure baseline of a deployed application instance? ❍ A. Compare the production application to the sandbox ❍ B. Perform an integrity measurement ❍ C. Compare the production application to the previous version ❍ D. Perform QA testing on the application instance

The Answer: B. Perform an integrity measurement An integrity measurement is designed to check for the secure baseline of firewall settings, patch levels, operating system versions, and any other security components associated with the application. These secure baselines may vary between different application versions. The incorrect answers: A. Compare the production application to the sandbox A sandbox is commonly used as a development environment. Security baselines in a production environment can be quite different when compared to the code in a sandbox. C. Compare the production application to the previous version The newer version of an application may have very different security requirements than previous versions. D. Perform QA testing on the application instance QA (Quality Assurance) testing is commonly used for finding bugs and verifying application functionality. The primary task of QA is not generally associated with verifying security baselines.

A company's outgoing email server currently uses SMTP with no encryption. The security administrator would like to implement encryption between email clients without changing the existing server-to-server communication. Which of the following would be the BEST way to implement this requirement? ❍ A. Implement Secure IMAP ❍ B. Require the use of S/MIME ❍ C. Install an SSL certificate on the email server ❍ D. Use a VPN tunnel between email clients

The Answer: B. Require the use of S/MIME S/MIME (Secure/Multipurpose Internet Mail Extensions) provides a way to integrate public key encryption and digital signatures into most modern email clients. This would encrypt all email information from client to client, regardless of the communication used between email servers. The incorrect answers: A. Implement Secure IMAP Secure IMAP (Internet Message Access Protocol) would encrypt communication downloaded from an email server, but it would not provide any security for outgoing email messages. C. Install an SSL certificate on the email server An SSL certificate on an email server could potentially be used to encrypt server-to-server communication, but the security administrator is looking for an encryption method between email clients. D. Use a VPN tunnel between email clients Email communication does not occur directly between email clients, so configuring a VPN between all possible email recipients would not be a valid implementation.

A company would like to protect the data stored on laptops used in the field. Which of the following would be the BEST choice for this requirement? ❍ A. MAC ❍ B. SED ❍ C. CASB ❍ D. SOAR

The Answer: B. SED A SED (Self-Encrypting Drive) provides data protection of a storage device using full-disk encryption in the drive hardware. The incorrect answers: A. MAC MAC (Mandatory Access Control) is an access control system that assigns labels to objects in an operating system. MAC would not prevent external access to data on a laptop's storage drive. C. CASB CASB (Cloud Access Security Broker) is a solution for administering and managing security policies in the cloud. CASB will not provide any security for data stored on laptops and other mobile devices. D. SOAR SOAR (Security Orchestration, Automation, and Response) describes a process for automating security activities. SOAR would not provide a mechanism for protecting data on a laptop's storage drive.

Which of the following describes a monetary loss if one event occurs? ❍ A. ALE ❍ B. SLE ❍ C. RTO ❍ D. ARO

The Answer: B. SLE SLE (Single Loss Expectancy) describes the financial impact of a single event. The incorrect answers: A. ALE ALE (Annual Loss Expectancy) is the financial loss over an entire 12-month period. C. RTO RTO (Recovery Time Objectives) define a set of objectives needed to restore a particular service level. D. ARO The ARO (Annualized Rate of Occurrence) is the number of times an event will occur in a 12-month period.

Jennifer is reviewing this security log from her IPS: The Details: 118 ALERT 2018-06-01 13:07:29 [163bcf65118-179b547b] Cross-Site Scripting in JSON Data 222.43.112.74:3332 -> 64.235.145.35:80 URL/index.html - Method POST - Query String "-" User Agent: curl/7.21.3 (i386-redhat-linux-gnu) libcurl/7.21.3 NSS/3.13.1.0 zlib/1.2.5 libidn/1.19 libssh2/1.2.7 Detail: token="<script>" key="key7" value="<script>alert(2)</script>" 28 Practice Exam A - Questions Which of the following can be determined from this log information? (Select TWO) ❍ A. The alert was generated from a malformed User Agent header ❍ B. The alert was generated from an embedded script ❍ C. The attacker's IP address is 222.43.112.74 ❍ D. The attacker's IP address is 64.235.145.35 ❍ E. The alert was generated due to an invalid client port number

The Answer: B. The alert was generated from an embedded script and C. The attacker's IP address is 222.43.112.74 The details of the IPS (Intrusion Prevention System) alert show a script value embedded into JSON ( JavaScript Object Notation) data. The IPS log also shows the flow of the attack with an arrow in the middle. The attacker was IP address 222.43.112.74 with port 3332, and the victim was 64.235.145.35 over port 80. The incorrect answers: A. The alert was generated from a malformed User Agent header The user agent information is provided as additional supporting data associated with the alert. The agent itself is not the cause of this alert. D. The attacker's IP address is 64.235.145.35 The attacker's IP address is listed first, so the victim's IP address is 64.235.145.35. E. The alert was generated due to an invalid client port number The port number associated with the client, 3332, is a valid port number and not associated with the cause of the alert.

Which part of the PC startup process verifies the digital signature of the OS kernel? ❍ A. Measured Boot ❍ B. Trusted Boot ❍ C. Secure Boot ❍ D. POST

The Answer: B. Trusted Boot The Trusted Boot portion of the startup process verifies the operating system kernel signature and starts the ELAM (Early Launch Anti-Malware) process. The incorrect answers: A. Measured Boot Measured Boot occurs after the Trusted Boot process and verifies that nothing on the computer has been changed by malicious software or other processes. C. Secure Boot Secure Boot is a UEFI BIOS boot feature that checks the digital signature of the bootloader. The Trusted Boot process occurs after Secure Boot has completed. D. POST POST (Power-On Self-Test) is a hardware check performed prior to booting an operating system.

A security administrator has gathered this information: Proto Recv-Q Send-Q Local Address Foreign Address (state) tcp6 416 tcp6 0 tcp6 0 tcp6 0 0 2601:4c3:4080:82.63976 yv-in-x5e.1e100..https CLOSE_WAIT 0 2601:4c3:4080:82.63908 atl14s80-in-x0a..https ESTABLISHED 0 fe80::4de1:1d4:8.36253 fe80::38b0:a2b1:.1025 ESTABLISHED 0 fe80::4de1:1d4:8.1024 fe80::38b0:a2b1:.1024 ESTABLISHED Which of the following is being used to create this information? ❍ A. tracert ❍ B. netstat ❍ C. dig ❍ D. netcat

The Answer: B. netstat The netstat command provides a list of network statistics, and the default view shows the traffic sessions between the local device and other devices on the network. The incorrect answers: A. tracert Traceroute lists the route between devices and shows the IP address information of the routers at each hop. C. dig The dig (Domain Information Groper) command queries DNS servers for the fully-qualified domain name and IP address information of other devices. D. netcat The netcat command is used for reading or writing data to the network. The netcat command itself doesn't provide any statistical information about the network connection.

A file server has a full backup performed each Monday at 1 AM. Incremental backups are performed at 1 AM on Tuesday, Wednesday, Thursday, and Friday. The system administrator needs to perform a full recovery of the file server on Thursday afternoon. How many backup sets would be required to complete the recovery? ❍ A. 2 ❍ B. 3 ❍ C. 4 ❍ D. 1

The Answer: C. 4 Each incremental backup will archive all of the files that have changed since the last full or incremental backup. To complete this full restore, the administrator will need the full backup from Monday and the incremental backups from Tuesday, Wednesday, and Thursday. The incorrect answers: A. 2 If the daily backup was differential, the administrator would only need the full backup and the differential backup from Thursday. B. 3 Since the incremental backup only archives files that have changed, he will need all three daily incremental backups as well as Monday's full backup. D. 1 To recover incremental backups, you'll need the full backup and all incremental backups since the full backup.

A security administrator needs to identify all computers on the company network infected with a specific malware variant. Which of the following would be the BEST way to identify these systems? ❍ A. Honeynet ❍ B. Data masking ❍ C. DNS sinkhole ❍ D. DLP

The Answer: C. DNS sinkhole A DNS (Domain Name System) sinkhole can be used to redirect and identify devices that may attempt to communicate with an external command and control (C2) server. The DNS sinkhole will resolve an internal IP address and can report on all devices that attempt to access the malicious domain. The incorrect answers: A. Honeynet A honeynet is a non-production network that has been specifically created to attract attackers. A honeynet is not commonly used to identify infected devices. B. Data masking Data masking provides a way to hide data by substitution, shuffling, encryption, and other methods. Data masking does not provide a method of identifying infected devices. D. DLP DLP (Data Loss Prevention) systems can identify and block private information from transferring between systems. DLP does not provide any direct method of identifying devices infected with malware.

A security administrator is collecting information associated with a ransomware infection on the company's web servers. Which of the following log files would provide information regarding the memory contents of these servers? ❍ A. Web ❍ B. Packet ❍ C. Dump ❍ D. DNS

The Answer: C. Dump A dump file contains the contents of system memory. In Windows, this file can be created from the Task Manager. The incorrect answers: A. Web Web server logs will document web pages that were accessed, but it doesn't show what information may be contained in the system RAM. B. Packet A packet trace would provide information regarding network communication, but it would not include any details regarding the contents of memory. D. DNS DNS (Domain Name System) server logs can show which domain names were accessed by internal systems, and this information can help identify systems that may be infected. However, the DNS log doesn't include any information about the memory contents of a server.

A security administrator has been using EAP-FAST wireless authentication since the migration from WEP to WPA2. The company's network team now needs to support additional authentication protocols inside of an encrypted tunnel. Which of the following would meet the network team's requirements? ❍ A. EAP-TLS ❍ B. PEAP ❍ C. EAP-TTLS ❍ D. EAP-MSCHAPv2

The Answer: C. EAP-TTLS EAP-TTLS (Extensible Authentication Protocol - Tunneled Transport Layer Security) allows the use of multiple authentication protocols transported inside of an encrypted TLS (Transport Layer Security) tunnel. This allows the use of any authentication while maintaining confidentiality with TLS. The incorrect answers: A. EAP-TLS EAP-TLS does not provide a mechanism for using multiple authentication types within a TLS tunnel. B. PEAP PEAP (Protected Extensible Authentication Protocol) encapsulates EAP within a TLS tunnel, but does not provide a method of encapsulating other authentication methods. D. EAP-MSCHAPv2 EAP-MSCHAPv2 (EAP - Microsoft Challenge Handshake Authentication Protocol v2) is a common implementation of PEAP.

An organization's content management system (CMS) currently labels files and documents as "Unclassified" and "Restricted." On a recent updated to the CMS, a new classification type of "PII" was added. Which of the following would be the MOST likely reason for this addition? ❍ A. Healthcare system integration ❍ B. Simplified categorization ❍ C. Expanded privacy compliance ❍ D. Decreased search time

The Answer: C. Expanded privacy compliance The labeling of PII (Personally Identifiable Information) is often associated with privacy and compliance concerns. The incorrect answers: A. Healthcare system integration Healthcare data would most likely be labeled as PHI (Protected Health Information). Personal information isn't necessarily health-related. B. Simplified categorization Adding additional categories would not commonly be considered a simplification. D. Decreased search time Adding additional classifications would not necessarily provide any decreased search times.

Which of these cloud deployment models would share resources between a private virtualized data center and externally available cloud services? ❍ A. SaaS ❍ B. Community ❍ C. Hybrid ❍ D. Containerization

The Answer: C. Hybrid A hybrid cloud model combines both private and public cloud infrastructures. The incorrect answers: A. SaaS Software as a Service (SaaS) is a cloud deployment model that provides on-demand software without any context about the software's location. B. Community A community cloud model allows multiple organizations to share the same cloud resources, regardless of the resource's location. D. Containerization Containerization can be used with mobile devices to partition user data and corporate data.

Which of the following standards provides information on privacy and managing PII? ❍ A. ISO 31000 ❍ B. ISO 27002 ❍ C. ISO 27701 ❍ D. ISO 27001

The Answer: C. ISO 27701 The ISO (International Organization for Standardization) 27701 standard extends the ISO 27001 and 27002 standards to include detailed management of PII (Personally Identifiable Information) and data privacy. The incorrect answers: A. ISO 31000 The ISO 31000 standard sets international standards for risk management practices. B. ISO 27002 Information security controls are the focus of the ISO 27002 standard. D. ISO 27001 The ISO 27001 standard is the foundational standard for Information Security Management Systems (ISMS).

A member of the accounting team was out of the office for two weeks, and an important financial transfer was delayed until they returned. Which of the following would have prevented this delay? ❍ A. Split knowledge ❍ B. Least privilege ❍ C. Job rotation ❍ D. Dual control

The Answer: C. Job rotation Job rotation moves employees through different job roles as part of their normal work environment. This policy limits the potential for fraud and allows others to cover responsibilities if someone is out of the office. The incorrect answers: A. Split knowledge The use of split knowledge limits the information that any one person would know. In this example, having knowledge of part of the process would not have helped with processing the financial transfer. B. Least privilege Least privilege is a security policy that limits the rights and permissions of a user to only those tasks required for their job role. In this example, having properly configured privileges would not have provided any contingency for this delayed transaction. D. Dual control With dual control, two persons must be present to perform a business function. In this example, one of the employees is out of the office and dual control would not be possible.

A security administrator is designing an authentication process for a new remote site deployment. They would like the users to provide their credentials when they authenticate in the morning, and they do not want any additional authentication requests to appear during the rest of the day. Which of the following should be used to meet this requirement? ❍ A.TACACS+ ❍ B. LDAPS ❍ C. Kerberos ❍ D. 802.1X

The Answer: C. Kerberos Kerberos uses a ticket-based system to provide SSO (Single Sign-On) functionality. You only need to authenticate once with Kerberos to gain access to multiple resources. The incorrect answers: A. TACACS+ TACACS+ (Terminal Access Controller Access-Control System) is a common authentication method, but it does not provide any single sign- on functionality. B. LDAPS LDAPS (Lightweight Directory Access Protocol Secure) is a standard for accessing a network directory. This can provide an authentication method, but it does not provide any single sign-on functionality. D. 802.1X 802.1X is a standard for port-based network access control (PNAC), but it does not inherently provide any single sign-on functionality.

An IPS at your company has found a sharp increase in traffic from all-in-one printers. After researching, your security team has found a vulnerability associated with these devices that allows the device to be remotely controlled by a third-party. Which category would BEST describe these devices? ❍ A. IoT ❍ B. RTOS ❍ C. MFD ❍ D. SoC

The Answer: C. MFD An all-in-one printer that can print, scan, and fax is often categorized as an MFD (Multifunction Device). The incorrect answers: A. IoT Wearable technology and home automation devices are commonly called IoT (Internet of Things) devices. B. RTOS RTOS (Real-time Operating Systems) are commonly used in manufacturing and automobiles. D. SoC Multiple components that run on a single chip are categorized as an SoC (System on a Chip).

A user connects to a third-party website and receives this message: Your connection is not private. NET::ERR_CERT_INVALID Which of the following attacks would be the MOST likely reason for this message? ❍ A. Brute force ❍ B. DoS ❍ C. On-path ❍ D. Disassociation

The Answer: C. On-path An on-path attack is often associated with a third-party who is actively intercepting network traffic. This entity in the middle would not be able to provide a valid SSL certificate for a third-party website, and this error would appear in the browser as a warning. The incorrect answers: A. Brute force A brute force attack is commonly associated with password hacks. Brute force attacks would not cause the certificate on a website to be invalid. B. DoS A DoS (Denial of Service) attack would prevent communication to a server and most likely provide a timeout error. This error is not related to a service availability issue. D. Disassociation Disassociation attacks are commonly associated with wireless networks, and they usually cause disconnects and lack of connectivity. The error message in this example does not appear to be associated with a network outage or disconnection.

A web-based manufacturing company processes monthly charges to credit card information saved in the customer's profile. Which of the following standards would be required to maintain this payment information? ❍ A. GDPR ❍ B. ISO 27001 ❍ C. PCI DSS ❍ D. CSA CCM

The Answer: C. PCI DSS The PCI DSS (Payment Card Industry Data Security Standard) specifies the minimum security requirements for storing and protecting credit card information. The incorrect answers: A. GDPR GDPR (General Data Protection Regulation) is a European Union regulation that governs data protection and privacy for individuals in the EU. B. ISO 27001 The ISO (International Organization for Standardization) 27001 standard focuses on the requirements for an Information Security Management System (ISMS). D. CSA CCM The CSA CCM (Cloud Security Alliance Cloud Controls Matrix) provides documents for implementing and managing cloud-specific security controls.

An MSP is designing a new server room for a large company. Which of the following should be included in the design to provide redundancy? (Select TWO) ❍ A. SIEM ❍ B. Temperature monitors ❍ C. RAID arrays ❍ D. Dual power supplies ❍ E. Hot and cold aisles ❍ F. Biometric locks

The Answer: C. RAID arrays and D. Dual power supplies RAID (Redundant Array of Independent Disks) and dual power supplies can both provide uptime and availability if a drive or component fails. Many RAID configurations can continue to operate if a drive fails, and a system with two power supplies can continue to operate if one of those was to fail. The incorrect answers: A. SIEM A SIEM (Security Information and Event Manager) is a useful part of any network configuration, but it does not provide for uptime and availability during a failure. B. Temperature monitors Temperature monitors can provide an early-warning notification of an HVAC (Heating, Ventilation, and Air Conditioning) issue, but they don't provide any redundancy if the cooling system fails. E. Hot and cold aisles Hot and cold aisles will provide the most efficient cooling, but they don't provide any redundant features. F. Biometric locks Biometric locks are commonly found on server room and data center entrances, but they don't provide any redundancy for the systems inside.

A user has opened a helpdesk ticket complaining of poor system performance, excessive pop up messages, and the cursor moving without anyone touching the mouse. This issue began after they opened a spreadsheet from a vendor containing part numbers and pricing information. Which of the following is MOST likely the cause of this user's issues? ❍ A. On-path ❍ B. Worm ❍ C. RAT ❍ D. Logic bomb

The Answer: C. RAT A RAT (Remote Access Trojan) is malware that can control a computer using desktop sharing and other administrative functions. Because the installation program is often disguised as something else, the victim often doesn't realize they're installing malware. Once the RAT is installed, the attacker can control the desktop, capture screenshots, reboot the computer, and many other administrative functions. The incorrect answers: A. Man-in-the-middle A man-in-the-middle attack commonly occurs without any knowledge to the parties involved, and there's usually no additional notification that an attack is underway. B. Worm A worm is malware that can replicate itself between systems without any user intervention, so a spreadsheet that requires additional a user to click warning messages would not be categorized as a worm. D. Logic bomb A logic bomb is malware that installs and operates silently until a certain event occurs. Once the logic bomb has been triggered, the results usually involve loss of data or a disabled operating system.

The embedded OS in a company's time clock appliance is configured to reset the file system and reboot when a file system error occurs. On one of the time clocks, this file system error occurs during the startup process and causes the system to constantly reboot. Which of the following BEST describes this issue? ❍ A. DLL injection ❍ B. Resource exhaustion ❍ C. Race condition ❍ D. Weak configuration

The Answer: C. Race condition A race condition occurs when two processes occur at similar times, usually with unexpected results. The file system problem is usually fixed before a reboot, but a reboot is occurring before the fix can be applied. This has created a race condition that results in constant reboots. The incorrect answers: A. DLL injection One method of exploiting an application is to take advantage of the libraries reference by the application rather than the application itself. DLL (Dynamic Link Library) injection manipulates the library as the attack vector. B. Resource exhaustion If the time clock was running out of storage space or memory, it would most likely be unusable. In this example, the issue isn't based on a lack of resources. D. Weak configuration If the system is poorly configured, there may be unintended access to a service or data. This time clock issue wasn't related to any misconfiguration or weak configuration on the time clock appliance.

A data breach has occurred in a large insurance company. A security administrator is building new servers and security systems to get all of the financial systems back online. Which part of the incident response process would BEST describe these actions? ❍ A. Lessons learned ❍ B. Isolation and containment ❍ C. Reconstitution ❍ D. Precursors

The Answer: C. Reconstitution The recovery after a breach can be a phased approach that may take months to complete. The incorrect answers: A. Lessons learned Once the event is over, it's useful to revisit the process to learn and improve for next time. B. Isolation and containment During an incident, it's useful to separate infected systems from the rest of the network. D. Precursors Log files and alerts can often warn you of potential problems.

A user with restricted access has typed this text in a search field of an internal web-based application: USER77' OR '1'='1 After submitting this search request, all of the database records are displayed on the screen. Which of the following would BEST describe this search? ❍ A. CSRF ❍ B. Buffer overflow ❍ C. SQL injection ❍ D. SSL stripping

The Answer: C. SQL injection SQL (Structured Query Language) injection takes advantage of poor input validation to circumvent the application and perform queries directly to the database. The incorrect answers: A. CSRF CSRF (Cross-Site Request Forgery) takes advantage of a third-party trust to a web application. The attack demonstrated in this question does not use another user's credentials or access rights to obtain information. B. Buffer overflow A buffer overflow uses an application vulnerability to submit more information than an application can properly manage. The attack syntax in this question is specific to SQL injections, and it does not appear to be manipulating a buffer overflow vulnerability. D. SSL stripping SSL stripping allows an on-path attack to rewrite web site addresses to gain access to encrypted information. The attack in this question does not include a third-party or on-path entity.

A security team has been provided with a non- credentialed vulnerability scan report created by a third- party. Which of the following would they expect to see on this report? ❍ A. A summary of all files with invalid group assignments ❍ B. A list of all unpatched operating system files ❍ C. The version of web server software in use ❍ D. A list of local user accounts

The Answer: C. The version of web server software in use A scanner like Nmap can query services and determine version numbers without any special rights or permissions, which makes it well suited for non-credentialed scans. The incorrect answers: A. A summary of all files with invalid group assignments Viewing file permissions and rights requires authentication to the operating system, so you would not expect to see this information if the scan did not have credentials. B. A list of all unpatched operating system files Viewing detailed information about the operating system files requires authentication to the OS, and an uncredentialed scan does not have those permissions. D. A list of local user accounts Local user accounts are usually protected by the operating system, so you would need to have credentials to view this information.

A company is deploying a new mobile application to all of its employees in the field. Some of the problems associated with this rollout include: • The company does not have a way to manage the mobile devices in the field • Company data on mobile devices in the field introduces additional risk • Team members have many different kinds of mobile devices Which of the following deployment models would address these concerns? ❍ A. Corporate-owned ❍ B. COPE ❍ C. VDI ❍ D. BYOD

The Answer: C. VDI A VDI (Virtual Desktop Infrastructure) would allow the field teams to access their applications from many different types of devices without the requirement of a mobile device management or concern about corporate data on the devices. The incorrect answers: A. Corporate-owned A corporate-owned device would solve the issue of device standardization, but the corporate data would be stored on the mobile devices in the field. B. COPE COPE (Corporate Owned and Personally Enabled) devices are purchased by the company but are used as both a corporate device and a personal device. This would standardize the devices, but the corporate data would still be at-risk in the field. D. BYOD BYOD (Bring Your Own Device) means that the employee would choose the mobile platform. This would not address the issue of mobile device management, data security in the field, or standardization of mobile devices and apps.

A company hires a large number of seasonal employees, and their system access should normally be disabled when the employee leaves the company. The security administrator would like to verify that their systems cannot be accessed by any of the former employees. Which of the following would be the BEST way to provide this verification? ❍ A. Confirm that no unauthorized accounts have administrator access ❍ D. Create a report that shows all authentications for a ❍ B. Validate the account lockout policy ❍ C. Validate the processes and procedures for all outgoing employees 24-hour period

The Answer: C. Validate the processes and procedures for all outgoing employees The disabling of an employee account is commonly part of the offboarding process. One way to validate an offboarding policy is to perform an audit of all accounts and compare active accounts with active employees. The incorrect answers: A. Confirm that no unauthorized accounts have administrator access It's always a good idea to periodically audit administrator accounts, but this audit won't provide any validation that all former employee accounts have been disabled. B. Validate the account lockout policy Account lockouts occur when a number of invalid authentication attempts have been made to a valid account. Disabled accounts would not be locked out because they are not currently valid accounts. D. Create a report that shows all authentications for a 24-hour period A list of all authentications would be quite large, and it would not be obvious to see which authentications were made with valid accounts and which authentications were made with former employee accounts.

Which of these best describes two-factor authentication? ❍ A. A printer uses a password and a PIN ❍ B. The door to a building requires a fingerprint scan ❍ C. An application requires a TOTP code ❍ D. A Windows Domain requires a username, password, and smart card

The Answer: D. A Windows Domain requires a username, password, and smart card The multiple factors of authentication used to login to this Windows Domain are a password (something you know), and a smart card (something you have). The incorrect answers: A. A printer uses a password and a PIN A password and a PIN (Personal Identification Number) are both something you know, so only one authentication factor is used. B. The door to a building requires a fingerprint scan A biometric scan (something you are) is a single factor of authentication. C. An application requires a TOTP code TOTP (Time-based One-Time Password) is usually provided using a hardware dongle or mobile app. This single factor of authentication is something you have.

A manufacturing company has moved an inventory application from their internal systems to a PaaS service. Which of the following would be the BEST way to manage security policies on this new service? ❍ A. DLP ❍ B. SIEM ❍ C. IPS ❍ D. CASB

The Answer: D. CASB A CASB (Cloud Access Security Broker) is used to manage compliance with security policies when using cloud-based applications. The incorrect answers: A. DLP DLP (Data Loss Prevention) can identify and block PII (Personally Identifiable Information) and other private details from being transferred across the network. B. SIEM A SIEM (Security Information and Event Manager) is a management system for log consolidation and reporting. A SIEM cannot managed cloud-based security policies. C. IPS An IPS (Intrusion Prevention System) can identify and block known vulnerabilities on the network, but it does not provide policy management for cloud-based systems.

A security administrator has been asked to respond to a potential security breach of the company's databases, and they need to gather the most volatile data before powering down the database servers. In which order should they collect this information? ❍ A. CPU registers, temporary files, memory, remote monitoring data ❍ B. Memory, CPU registers, remote monitoring data, temporary files ❍ C. Memory, CPU registers, temporary files, remote monitoring data ❍ D. CPU registers, memory, temporary files, remote monitoring data

The Answer: D. CPU registers, memory, temporary files, remote monitoring data The most volatile data disappears quickly, so data such as the CPU registers and information in memory will be lost before temporary files and remote monitoring data are no longer available. The incorrect answers: A. CPU registers, temporary files, memory, remote monitoring data Memory is more volatile than temporary files. B. Memory, CPU registers, remote monitoring data, temporary files CPU registers are more volatile than memory, and temporary files are more volatile than remote monitoring data. C. Memory, CPU registers, temporary files, remote monitoring data CPU registers are more volatile than information in memory.

A recent report shows the return of a vulnerability that was previously patched four months ago. After researching this issue, the security team has found that a recent patch has reintroduced this vulnerability on the servers. Which of the following should the security administrator implement to prevent this issue from occurring in the future? ❍ A.Templates ❍ B. Elasticity ❍ C. Master image ❍ D. Continuous monitoring

The Answer: D. Continuous monitoring It's common for organizations to continually monitor services for any changes or issues. A nightly vulnerability scan across important servers would identify issues like this one. The incorrect answers: A. Templates Templates can be used to easily build the basic structure of an application instance. These templates are not used to identify or prevent the introduction of vulnerabilities. B. Elasticity Elasticity is important when scaling resources as the demand increases or decreases. Unfortunately, elasticity will not help with the identification of vulnerabilities. C. Master image A master image is used to quickly copy a server for easy deployment. This image will need to be updated and maintained to prevent the issues associated with unexpected vulnerabilities.

A manufacturing company would like to use an existing router to separate a corporate network and a manufacturing floor that use the same physical switch. The company does not want to install any additional hardware. Which of the following would be the BEST choice for this segmentation? ❍ A. Connect the corporate network and the manufacturing floor with a VPN ❍ B. Build an air gapped manufacturing floor network ❍ C. Use personal firewalls on each device ❍ D. Create separate VLANs for the corporate network and the manufacturing floor

The Answer: D. Create separate VLANs for the corporate network and the manufacturing floor Creating VLANs (Virtual Local Area Networks) will segment a network without requiring additional switches. The incorrect answers: A. Connect the corporate network and the manufacturing floor with a VPN A VPN (Virtual Private Network) would encrypt all information between the two networks, but it would not provide any segmentation. This process would also commonly require additional hardware to provide VPN connectivity. B. Build an air gapped manufacturing floor network An air gapped network would require separate physical switches on each side of the gap, and this would require the purchase of an additional switch. C. Use personal firewalls on each device While personal firewalls provide protection for individual devices, they do not segment networks. It's also uncommon for personal firewalls to be installed on manufacturing equipment.

An attacker has discovered a way to disable a server by sending specially crafted packets from many remote devices to the operating system. When the packet is received, the system crashes and must be rebooted to restore normal operations. Which of the following would BEST describe this attack? ❍ A. Privilege escalation ❍ B. Spoofing ❍ C. Replay attack ❍ D. DDoS

The Answer: D. DDoS A DDoS (Distributed Denial of Service) is an attack that overwhelms or disables a service to prevent the service from operating normally. Packets from multiple devices that disable a server would be an example of a DDoS attack. The incorrect answers: A. Privilege escalation A privilege escalation attack allows a user to exceed their normal rights and permissions. In this example, user permission escalations were not required to perform this attack. B. Spoofing Spoofing is when a device pretends to be a different device or pretends to be something they aren't. This attack explanation did not appear to emulate or pretend to be a different user or address than the actual attacker. C. Replay attack A replay attack captures information and then replays that information as the method of attack. In this question, no mention was made of a prior data capture.

A server administrator at a bank has noticed a decrease in the number of visitors to the bank's website. Additional research shows that users are being directed to a different IP address than the bank's web server. Which of the following would MOST likely describe this attack? ❍ A. Disassociation ❍ B. DDoS ❍ C. Buffer overflow ❍ D. DNS poisoning

The Answer: D. DNS poisoning A DNS poisoning can modify a DNS server to modify the IP address provided during the name resolution process. If an attacker modifies the DNS information, they can direct client computers to any destination IP address. The incorrect answers: A. Disassociation Disassociation attacks are commonly associated with wireless networks. The disassociation attack is used to remove devices from the wireless network, and it does not commonly redirect clients to a different website. B. DDoS A DDoS (Distributed Denial of Service) is used by attackers to cause services to be unavailable. In this example, the bank's website is operational but clients are not resolving the correct IP address. C. Buffer overflow Buffer overflows are associated with application attacks and can cause applications to crash or act in unexpected ways. A buffer overflow would not commonly redirect clients to a different website IP address.

An organization maintains a large database of customer information for sales tracking and customer support. Which person in the organization would be responsible for managing the access rights to this data? ❍ A. Data processor ❍ B. Data owner ❍ C. Privacy officer ❍ D. Data custodian

The Answer: D. Data custodian The data custodian manages access rights and sets security controls to the data. The incorrect answers: A. Data processor The data processor manages the operational use of the data, but not the rights and permissions to the information. B. Data owner The data owner is usually a higher-level executive who makes business decisions regarding the data. C. Privacy officer A privacy officer sets privacy policies and implements privacy processes and procedures.

Which cryptographic method is used to add trust to a digital certificate? ❍ A. X.509 ❍ B. Hash ❍ C. Symmetric encryption ❍ D. Digital signature

The Answer: D. Digital signature A certificate authority will digitally sign a certificate to add trust. If you trust the certificate authority, you can then trust the certificate. The incorrect answers: A. X.509 The X.509 standard defines the structure of a certificate. This standard format makes it easy for everyone to view the contents of a certificate, but it doesn't provide any additional trust. B. Hash A hash can help verify that the certificate has not been altered, but it does not provide additional third-party trust. C. Symmetric encryption Symmetric encryption has the same issue as asymmetric encryption. The information in a certificate commonly needs to be viewable by others.

A security engineer runs a monthly vulnerability scan. The scan doesn't list any vulnerabilities for Windows servers, but a significant vulnerability was announced last week and none of the servers are patched yet. Which of the following best describes this result? ❍ A. Exploit ❍ B. Credentialed ❍ C. Zero-day attack ❍ D. False negative

The Answer: D. False negative A false negative is a result that fails to detect an issue when one actually exists. The incorrect answers: A. Exploit An exploit is an attack against a vulnerability. Vulnerability scans do not commonly attempt to exploit the vulnerabilities that they identify. B. Credentialed A credentialed scan would authenticate to the operating system and have access to files that would normally only be available to authorized users. C. Zero-day attack A zero-day attack focuses on previously unknown vulnerabilities. In this example, the vulnerability scan isn't an attack, and the vulnerabilities are already known and patches are available.

A company has just purchased a new application server, and the security director wants to determine if the system is secure. The system is currently installed in a test environment and will not be available to users until the rollout to production next week. Which of the following would be the BEST way to determine if any part of the system can be exploited? ❍ A. Tabletop exercise ❍ B. Vulnerability scanner ❍ C. Password cracker ❍ D. Penetration test

The Answer: D. Penetration test A penetration test can be used to actively exploit potential vulnerabilities in a system or application. This could cause a denial of service or loss of data, so the best practice is to perform the penetration test during non- production hours or in a test environment. The incorrect answers: A. Tabletop exercise A tabletop exercise is used to talk through a security event with an incident response team around a conference room table. This is commonly performed as a training device instead of performing a full-scale disaster drill. B. Vulnerability scanner Vulnerability scanners may identify a vulnerability, but they do not actively attempt to exploit the vulnerability. C. Password cracker A password cracker is usually an offline brute force tool used against a list of password hashes. A password cracker may be able to identify weak passwords, but it would not identify any other types of vulnerabilities.

Employees of an organization have received an email offering a cash bonus for completing an internal training course. The link in the email requires users to login with their Windows Domain credentials, but the link appears to be located on an external server. Which of the following would BEST describe this email? ❍ A. Whaling ❍ B. Vishing ❍ C. Smishing ❍ D. Phishing

The Answer: D. Phishing Phishing is the process of manipulating a victim to disclose personal or private information. An email asking for login details from a server not under the control of the company would describe a phishing attempt. The incorrect answers: A. Whaling Whaling is phishing targeted towards individuals at a higher level of an organization. These persons are usually in upper management or have access to the financial operations of the company. B. Vishing Vishing, or voice phishing, is using voice communication for the phishing process. This phishing attempt used an email message, so it would not be categorized as vishing. C. Smishing Smishing, or SMS phishing, is an attacker using SMS or text messaging when phishing. Smishing text messages often include a link to a server where personal information or login credentials may be requested by the attacker.

How can a company ensure that all data on a mobile device is unrecoverable if the device is lost or stolen? ❍ A. Containerization ❍ B. Geofencing ❍ C. Screen locks ❍ D. Remote wipe

The Answer: D. Remote wipe Most organizations will use a mobile device manager (MDM) to manage mobile phones and tablets. Using the MDM, specific security policies can be created for each mobile device, including the ability to remotely send a remote wipe command that will erase all data on a mobile device. The incorrect answers: A. Containerization Containerization on a mobile device will separate the user's data from the company information. This allows the company to control their corporate data without modifying or accessing the end user's data. B. Geofencing Geofencing would allow the company to limit functionality or access based on the location of the mobile device. Geofencing does not securely wipe data from a device. C. Screen locks Screen locks are important, but won't help when you need to permanently remove data from a device.

A department store policy requires that a floor manager approves each transaction when a gift certificate is used for payment. The security team has found that some of these transactions have been processed without the approval of a manager. Which of the following would provide a separation of duties to enforce this store policy? ❍ A. Use a WAF to monitor all gift certificate Quick transactions ❍ B. Disable all gift certificate transactions for cashiers ❍ C. Implement a discretionary access control policy ❍ D. Require an approval PIN for the cashier and a separate approval PIN for the manager

The Answer: D. Require an approval PIN for the cashier and a separate approval PIN for the manager This separation of duties would be categorized as dual control, where two people must be present to perform the business function. In this example, the dual control is managed by using two separate PINs (Personal Identification Numbers) that would not be shared among individuals. The incorrect answers: A. Use a WAF to monitor all gift certificate transactions A WAF (Web Application Firewall) is commonly used to monitor the input to web-based applications. WAFs do not commonly ensure separation of duties. B. Disable all gift certificate transactions for cashiers A separation of duties would give each person half of the information needed to complete the transaction, or it would require both persons to be present. Limiting the transaction to one person would not provide any separation between duties. C. Implement a discretionary access control policy A discretionary access control policy (DAC) is commonly used in operating system to allow the data owner to decide who has access to data. A DAC would not provide a way to manage separation of duties.

A CISO (Chief Information Security Officer) would like to decrease the response time when addressing security incidents. Unfortunately, the company does not have the budget to hire additional security engineers. Which of the following would assist the CISO with this requirement? ❍ A. ISO 27701 ❍ B. PKI ❍ C. IaaS ❍ D. SOAR

The Answer: D. SOAR SOAR (Security Orchestration, Automation, and Response) is designed to make security teams more effective by automating processes and integrating third-party security tools. The incorrect answers: A. ISO 27701 The ISO (International Organization for Standardization) 27701 standard focuses on privacy and securing PII. B. PKI A PKI (Public Key Infrastructure) describes the processes and procedures associated with maintaining digital certificates. C. IaaS IaaS (Infrastructure as a Service) describes a cloud service that provides the hardware required for deploying application instances and other cloud- based applications.

A remote user has received a text message requesting login details to the corporate VPN server. Which of the following would BEST describe this message? ❍ A. Brute force ❍ B. Prepending ❍ C.Typosquatting ❍ D. Smishing

The Answer: D. Smishing Smishing, or SMS phishing, is a social engineering attack that asks for personal information using SMS or text messages. The incorrect answers: A. Brute force A brute force attack is an attack that tries multiple password combinations in an effort to identify the correct authentication details. B. Prepending Prepending adds information before a domain name in an attempt to fool the victim into visiting a website managed by the attacker. C. Typosquatting Typosquatting is a technique that uses a misspelling of a domain name to convince victims they are visiting a legitimate website.

A security analyst has identified a number of sessions from a single IP address with a TTL equal to zero. One of the sessions has a destination of the Internet firewall, and a session immediately after has a destination of your DMZ server. Which of the following BEST describes this log information? ❍ A. Someone is performing a vulnerability scan against the firewall and DMZ server ❍ B. Users are performing DNS lookups ❍ C. A remote user is grabbing banners of the firewall and DMZ server ❍ D. Someone is performing a traceroute to the DMZ server

The Answer: D. Someone is performing a traceroute to the DMZ server A traceroute maps each hop by slowly incrementing the TTL (Time to Live) value during each request. When the TTL reaches zero, the receiving router drops the packet and sends an ICMP (Internet Control Message Protocol) TTL Exceeded message back to the original station. The incorrect answers: A. Someone is performing a vulnerability scan against the firewall and DMZ server Vulnerability scans are usually very specific requests, and they won't get to their destination if the TTL is zero. The question did not provide any information that would indicate an active vulnerability scan. B. Users are performing DNS lookups Properly working DNS (Domain Name System) responses would not have a TTL of zero, and nothing in the question indicated information that would commonly be included in a DNS query. C. A remote user is grabbing banners of the firewall and DMZ server Banners can provide useful reconnaissance information about a service, but the TTL of zero and the lack of connection to a specific service would not indicate a banner grabbing session.

A company has decided to perform a disaster recovery exercise during an annual meeting with the IT directors and senior directors. A simulated disaster will be presented, and the participants will discuss the logistics and processes required to resolve the disaster. Which of the following would BEST describe this exercise? ❍ A. After-action report B. Business impact analysis C. Alternate business practice D. Tabletop exercise

The Answer: D. Tabletop exercise A tabletop exercise allows a disaster recovery team to evaluate and plan disaster recovery processes without performing a full-scale drill. The incorrect answers: A. After-action report An after-action report is commonly created after a disaster recovery drill to document which aspects of the plan worked or did not work. B. Business impact analysis A business impact analysis is usually created during the disaster recovery planning process. Once the disaster has occurred, it becomes much more difficult to complete an accurate impact analysis. C. Alternate business practice An alternate business practice may be one of the steps in completing a disaster recovery exercise, but it does not describe the exercise itself.

When a home user connects to the corporate VPN, they are no longer able to print to their local network printer. Once the user disconnects from the VPN, the printer works normally. Which of the following would be the MOST likely reason for this issue? ❍ A. The VPN uses IPSec instead of SSL ❍ B. Printer traffic is filtered by the VPN client ❍ C. The VPN is stateful ❍ D. The VPN tunnel is configured for full tunnel

The Answer: D. The VPN tunnel is configured for full tunnel A split tunnel is a VPN (Virtual Private Network) configuration that only sends a portion of the traffic through the encrypted tunnel. A split tunnel would allow work-related traffic to securely traverse the VPN, and all other traffic would use the non-tunneled option. In this example, the printer traffic is being redirected through the VPN instead of the local home network because of the non-split/full tunnel. The incorrect answers: A. The VPN uses IPSec instead of SSL There are many protocols that can be used to send traffic through an encrypted tunnel. IPsec is commonly used for site-to-site VPN connections, and SSL (Secure Sockets Layer) is commonly used for end- user VPN connections. However, either protocol can technically be used for any VPN tunnel, and the choice of protocol would have no difference on the operation of the local printer. B. Printer traffic is filtered by the VPN client VPN clients are usually tasked with sending traffic unfiltered through the encrypted tunnel. Although data could be filtered at some point along the communication path, it's not commonly filtered by the VPN client. C. The VPN is stateful A stateful communication is commonly associated with firewalls, and it refers to the firewall's ability to track traffic flows. Stateful communication would not be a technology commonly associated with a VPN, and it would not be part of the user's printing issue.

A security administrator needs to identify all references to a Javascript file in the HTML of a web page. Which of the following tools should be used to view the source of the web page and search through the file for a specific filename? (Select TWO) ❍ A. tail ❍ B. openssl ❍ C.scanless ❍ D. grep ❍ E. Nmap ❍ F. curl ❍ G. head

The Answer: D. grep and F. curl The curl (Client URL) command will retrieve a web page and display it as HTML at the command line. The grep command can then be used to search through the file for a specific string of text. The incorrect answers: A. tail The tail command will display the information at the end of a file. B. openssl OpenSSL is a cryptography library that is commonly used to support SSL/TLS encryption on web servers. C. scanless Scanless is a utility that can perform a port scan using a proxy service. E. Nmap The Nmap utility is a popular port scanning and reconnaissance utility. G. head The head command will display the information at the start of a file.

A company is creating a security policy that will protect all corporate mobile devices: • All mobile devices must be automatically locked after a predefined time period. • Some mobile devices will be used by the remote sales teams, so the location of each device needs to be traceable. • All of the user's information should be completely separated from company data. Which of the following would be the BEST way to establish these security policy rules? ❍ A. Containerization ❍ B. Biometrics ❍ C. COPE ❍ D. VDI ❍ E. Geofencing ❍ F. MDM

The Answer: F. MDM An MDM (Mobile Device Manager) provides a centralized management system for all mobile devices. From this central console, security administrators can set policies for many different types of mobile devices. The incorrect answers: A. Containerization Mobile device containerization allows an organization to securely separate user data from company data on a mobile device. Implementing this strategy usually requires a mobile device manager (MDM), and containerization alone won't address all of the required security policies. B. Biometrics Biometrics can be used as another layer of device security, but you need more than biometrics to implement the required security policies in this question. C. COPE A device that is COPE (Corporately Owned and Personally Enabled) is commonly purchased by the corporation and allows the use of the mobile device for both business and personal use. The use of a COPE device does not address all of the required security policies. D. VDI A VDI (Virtual Desktop Infrastructure) separates the applications from the mobile device. This is useful for securing data, but it doesn't implement all of the requirements in this question. E. Geofencing Geofencing could be used to prevent mobile device use from other countries, but you would still need an MDM to implement the other requirements.

Which of the following is true of a rainbow table? (Select TWO) ❍ A. The rainbow table is built in real-time Quick during the attack ❍ B. Rainbow tables are the most effective online attack type ❍ C. Rainbow tables require significant CPU cycles at attack time ❍ D. Different tables are required for different hashing methods ❍ E. A rainbow table won't be useful if the passwords are salted

The Answers: D. Different tables are required for different hashing methods, and E. A rainbow table won't be useful if the passwords are salted A rainbow table is built prior to an attack to match a specific password hashing technique. If a different hashing technique is used, a completely different rainbow table must be built. The use of a salt will modify the expected results of a hash. Since a salted hash will not be predictable, the rainbow table can't be built for these hashes. The incorrect answers: A. The rainbow table is built in real-time during the attack One of the benefits of a rainbow table is that the table is built before an attack begins. This provides a significant speed increase at attack time. B. Rainbow tables are the most effective online attack type Rainbow tables are almost exclusively used as an offline attack type. The most common use of a rainbow table is for the attacker to obtain a list of password hashes from a system and then use the rainbow tables while offline. C. Rainbow tables require significant CPU cycles at attack time Rainbow tables are built prior to an attack, so most of the CPU (Central Processing Unit) calculations and time is spent building the tables before an attack begins.