C836 pre assessment

SSL/TLS

A bank wants to ensure user interactions with the online banking website are confidential. Which security solution should be implemented?

Hash functions

A company developing and distributing open source applications realizes that attackers are copying the publicly available, open source code and inserting malware into the code. Which type of cryptographic tool should the company use to protect the integrity of its open source applications?

File encryption

A company has files stored on a server that are critical to the organization's viability. The administrator has assigned the appropriate permissions to the files. How should the administrator provide additional confidentiality protection for the files at rest?

Availability

A company has had several successful denial of service (DoS) attacks on its email server. Which security principle is being attacked?

Technical obsolescence

A company has just completed an audit of disaster protection strategies. The company has decided it must keep and be able to retrieve backup data for a period of 30 years. The company has implemented tape backups using 8mm digital audio tapes. Which factor could impact the company's ability to access information from the backup tapes?

Attribute-based

A company wants to update its access control policy. The company wants to prevent hourly employees from logging in to company computers after business hours. Which type of access control policy should be implemented?

Availability

A company's website has suffered several denial of service (DoS) attacks and wishes to thwart future attacks. Which security principle is the company addressing?

Operations

A company's website policy states that "To gain access to the corporate website, each employee must provide a valid user name and password, and then answer one of six security questions accurately." Which type of security does the policy address?

Confidentiality

A file is stored in a marketing folder and is accessible only to members of the marketing group. An attacker uses a phishing scam to gain the credentials of a user who is a member of the marketing group, and then reads the file. Which leg of the CIA triad is being targeted?

Flash Drive

A military installation is evaluating backup solutions for its critical data. This installation operates in a harsh environment that is subjected to heat, humidity, and magnetic fields. Which physical media should be selected to ensure the integrity of backups is preserved given these harsh operating conditions?

Weak Passwords

A module in a security awareness course shows a user making use of two-factor authentication using a hardware token. Which security failure is being addressed by this training module?

Relocate the algorithm to encrypted storage.

A new software development company has determined that one of its proprietary algorithms is at a high risk for unauthorized disclosure. The company's security up to this point has been fairly lax. Which procedure should the company implement to protect this asset?

Brute force

A systems administrator enables operating system logging to capture unsuccessful log in attempts. Which attack can be uncovered by reviewing such logs?

Temperature

A university research group wants to collect data on animals that are native to southern Arizona, which is a hot, dry region. They plan to camp in tents for the summer at the edge of a national park and to use optical media to backup photos and research notes. Which physical or environmental factor may damage their optical media?

Limit user account privileges.

A user runs an application that has been infected with malware that is less than 24 hours old. The malware then infects the operating system. Which safeguard should be implemented to prevent this type of attack?

Availability

An attacker performs a buffer overflow attack on an organization's web server. The web server locks up and must be restarted to restore functionality. Which part of the CIA triad is under attack?

Availability

An organization has a requirement that all database servers and file servers be configured to maintain operations in the presence of a failure. Which principle of the CIA triad is this requirement implementing?

Integrity

An organization plans to encrypt data in transit on a network. Which aspect of data is the organization attempting to protect?

Apply the principle of least privilege.

An organization wants to minimize the impact of user credential theft by ensuring that only HR staff can access employee personal information. Which security mechanism should it implement?

Antivirus

An organization wants to prevent malware from infecting its workstations, mobile devices, and web applications. Which security tool should it implement?

Restrict account permissions.

How can an operating system be hardened in accordance to the principle of least privilege?

Integrity

Some malware hides itself by replacing some system administrator commands on a server, but the server continues to function normally for its users. Which component of the CIA triad has been compromised?

AES

What is an example of symmetric key encryption?

Integrity

Which aspect of the CIA triad is violated by an unauthorized database roll back or undo?

RSA

Which asymmetric cryptographic algorithm can provide confidentiality for data in motion?

Interception

Which attack category targets the confidentiality of data?

Encryption

Which file action implements the principle of confidentiality from the CIA triad?

Firewall

Which security solution can an organization deploy to prevent unauthorized external access to its internal network?

Port scanner

Which tool can be used to map devices on a network, along with their operating system types and versions?

A fuzzer

Which tool should an application developer use to help identify input validation vulnerabilities?

Integrity and availability

Which two principles of the CIA triad can be violated by a fabrication attack?

Integrity and availability

Which two principles of the CIA triad can be violated by an interruption attack?

Integrity and availability

Which two principles of the CIA triad can be violated by an modification attack?

A fuzzer

Which type of tool can be used to detect vulnerabilities in source code related to improper handling of user input?

SQL Injection

Which web attack is a server-side attack?

SQL Injection

Which web attack is possible due to a lack of input validation?