CompTIA Module 4 Review

What are the two limitations of private information-sharing centers? a. Government approval and cost b. Access to data and participation c. Bandwidth and CPU d. Timing of reports and remote access

Access to data and participation

What does AIS stand for? a. Automated Indicator Sharing b. Advanced Intrusion System c. Application Integration Services d. Access Identity Security

Automated Indicator Sharing

Oskar has been receiving emails about critical threat intelligence information from a public information-sharing center. His team leader has asked him to look into how the process can be automated so that the information can feed directly into their technology security. What technology will Oskar recommend? a. Bidirectional Security Protocol (BSP) b. Linefeed Access c. Lightwire JSON Control d. Automated Indicator Sharing (AIS)

Automated Indicator Sharing (AIS)

SecDevOps applies automated courses of action to develop code as quickly and securely as possible. Which of the following is NOT an automated course of action? a. Continuous monitoring b. Continuous validation c. Continuous deterrent d. Continuous deployment

Continuous deterrent

Luka has been asked by his supervisor to monitor the dark web for any IOCs concerning their organization. The next week, Luca reports back that he was unable to find anything due to how looking for information on the dark web is different from using the regular web. Which of the following is not different about looking for information on the dark web? a. Dark web merchants open and close their sites without warning. b. It is necessary to use Tor or IP2. c. Dark web search engines are identical to regular search engines. d. The naming structure is different on the dark web.

Dark web search engines are identical to regular search engines.

Which of the following takes advantage of vulnerability in the web application so that a user can move from the root directory to other restricted directories? a. Software Diversity attack b. Zero-Day Exploit c. Directory traversal attack d. Deprovisioning

Directory traversal attack

A typical OS security configuration should include all but one of the following: a. Employing least functionality b. Disabling the Administrator from the ability to login c. Disabling default accounts/passwords d. Disabling unnecessary ports and services

Disabling the Administrator from the ability to login

Which tool is considered more robust than HIDS and HIPS? a. TAXII b. EDR c. STIX d. IOC

EDR

What does EDR stand for? a. Enterprise Data Routing b. Enhanced Data Recovery c. Endpoint Detection and Response d. External Data Repository

Endpoint Detection and Response

Which of the following tries to block a malicious attack by following specific rules? a. HIDS b. HIPS c. EDR d. HTTPS

HIPS

If you are using hidden fields to capture the state information, which type of attack can occur? a. Cross-site scripting b. Injection c. Hijack session d. Cookie tampering

Hijack session

What does IOC stand for? a. Inversion of Control b. Indicator of Control c. Internet of Computers d. Indicator of Compromise

Indicator of Compromise

An IOC occurs when what metric exceeds its normal bounds? a. IRR b. LRG c. EXR d. KRI

KRI

What does KRI stand for? a. Key Root Interrupt b. Key Risk Indicator c. Kernel Rootkit Infiltration d. Knowledge Recovery Index

Key Risk Indicator

Which of the following is NOT a tool that can be used to confine or restrict malware? a. Whitelisting b. Quarantine c. Sandbox d. Legacy boot

Legacy boot

Which boot security mode sends information on the boot process to a remote server? a. Secure Boot b. Measured Boot c. UEFI Native Mode d. Trusted Boot

Measured Boot

What statement is FALSE concerning Antivirus? a. Many AV products use signature-based monitoring, also called static analysis and uses only virus signatures b. Dynamic Analysis is also called heuristic, where many indicators are used to determine a virus c. On average, Antivirus Software is only 85% effective at detecting malware d. Antivirus (AV) software can examine a computer for file-based virus infections and monitor computer activity

On average, Antivirus Software is only 85% effective at detecting malware

Which of the following is a firmware driver used by UEFI? a. Bootloader b. Static ROM c. Option ROMs d. Volatile ROM

Option ROMs

What are the two concerns about using public information-sharing centers? a. Privacy and speed b. Security and privacy c. Regulatory approval and sharing d. Cost and availability

Privacy and speed

Which of the following is NOT an important OS security configuration? a. Restricting patch management b. Disabling default accounts c. Disabling unnecessary services d. Employing least functionality

Restricting patch management

Which is a language and format used to exchange cyberthreat intelligence (collects all the threats)? a. STIX b. IOC c. AIS d. HTTPS

STIX

Which stage conducts a test that will verify the code functions as intended? a. Production stage b. Staging stage c. Development stage d. Testing stage

Staging stage

What does STIX stand for? a. Security Test Implementation and eXecution b. Structured Threat Information Expression c. Systematic Threat Intelligence Exchange d. Secure Transaction Interchange XML

Structured Threat Information Expression

Which of the following is not an improvement of UEFI over BIOS? a. Support of USB 3.0 b. Access larger hard drives c. Stronger boot security d. Networking functionality in UEFI

Support of USB 3.0

Which of the following is an application protocol for exchanging cyberthreat intelligence over HTTPS? a. STIX b. TAXII c. AIP-TAR d. TCP-Over-Secure (ToP)

TAXII

Which privacy protection uses four colors to indicate the expected sharing limitations that are to be applied by recipients of the information? a. PCII b. TLP c. CISA d. FOIA

TLP

Which of the following best describes static code analysis? a. Testing uses a suite of pre-built attacks. b. Tests are run before the source code is compiled. c. Random input is used to trigger exceptions. d. Used after all components are integrated.

Tests are run before the source code is compiled.

Which of the following is NOT a limitation of a threat map? a. Threat actors usually mask their real locations so what is displayed on a threat map is incorrect. b. Many maps claim that they show data in real time, but most are simply a playback of previous attacks. c. Because threat maps show anonymized data it is impossible to know the identity of the attackers or the victims. d. They can be difficult to visualize.

They can be difficult to visualize

What does TLP stand for? a. Threat Level Protection b. Tactical Log Privacy c. Traversal Log Protection d. Traffic Light Protocol

Traffic Light Protocol

Which of the following is NOT an advantage to an automated patch update service? a. Specific types of updates that the organization does not test, such as hotfixes, can be automatically installed whenever they become available. b. Users can disable or circumvent updates just as they can if their computer is configured to use the vendor's online update service. c. Administrators can approve or decline updates for client systems, force updates to install by a specific date, and obtain reports on what updates each computer needs. d. Downloading patches from a local server instead of using the vendor's online update service can save bandwidth and time because each computer does not have to connect to an external server.

Users can disable or circumvent updates just as they can if their computer is configured to use the vendor's online update service.

Which model uses a sequential design process? a. Rigid model b. Secure model c. Agile model d. Waterfall model

Waterfall model

Securing endpoint computers primarily involves three major tasks. Which of the following is NOT one of the three major tasks? a. hardening endpoints for even greater protection b. confirming that the computer has started securely c. protecting the computer from attacks d. provisioning for increased zero-day exploits

provisioning for increased zero-day exploits