CIST 1011: Week 9-13 (Test 2)
You have just received a call from one of your customers. He informs you that after turning his computer on, he received the following error: *Error loading operating system* *BOOTMGR is missing * *Press Ctrl+Alt+Del to restart* Every time he restarts his computer, the same error is shown. Which of the following tools is BEST for fixing this issue?
*bootrec*
As you are working on your Windows 10 computer during a fierce thunder storm, lightning strikes the nearby transformer, and your office loses all power. Since your laptop's battery is dead, your computer instantly turns off. Once power to the building has been restored, you turn your computer on and notice that you are now getting a missing DLL error message. Which of the following tools is MOST likely to rectify this issue?
*sfc*
You want to scan the integrity of all protected system files on your Windows 10 system, but not repair them. Which command should you use?
*sfc* / *verifyonly*
A user reports that his machine will no longer boot properly. After asking several questions to determine the problem, you suspect the user unknowingly downloaded malware from the internet, and that the malware corrupted the boot block. Based on your suspicions, which of the following actions would you MOST likely take to correct the problem? (Select TWO.)
-Boot from the Windows Installation DVD and use the Recovery Environment to run a startup repair. -Reimage the machine.
You have a Windows system with two SATA hard drives, one used for the operating system and the other used for storing data. You have traced recent problems to a fault in the system motherboard. You replaced the motherboard and reconnected all the hardware. When you started the computer, the system showed the startup information screen, but then returned an error that an operating system could not be found. What should you do? (Select TWO. Each option is part of the complete solution.)
-Change the boot order in the UEFI configuration -Verify the operating system SATA drive is configure as the boot drive in the UEFI configuration.
Following your Windows installation, you enabled the built-in Administrator account. You remove the password for this account. You enable Remote Desktop on your computer using the default settings. From home, you try to access your computer using Remote Desktop using the Administrator account, but you are unable to log on. Which of the following MUST be completed before you can access your computer using Remote Desktop?
-Configure a password for the Adminstrator account
Joe, a bookkeeper, works in a cubicle environment and is often called away from his desk. Joe doesn't want to sign out of his computer each time he leaves. Which of the following are the BEST solutions for securing Joe's workstation? (Select TWO).
-Configure the screen saver to require a password -Configure the screen to be applied after short period of nonuse
One of the Windows workstations you manage has three user accounts defined on it. Two of the users are limited users while the third (your account) is an administrative user. Each limited and administrative user has been assigned a strong password. File and folder permissions have been assigned to prevent users from accessing each other's files. Which of the following would MOST likely increase the security of this system? (Select TWO).
-Disable autorun on the system -Set a screensaver password
Which of the following are examples of social engineering? (Select TWO).
-Dumpster Diving -Shoulder surfing
What are the most common means of virus distribution? (Select TWO).
-Email -Malacious websites
You are configuring the local security policy of a Windows system. You want to prevent users from reusing old passwords. You also want to force them to use a new password for at least five days before changing it again. Which of the following policies are BEST to configure? (Select TWO).
-Enforce password history -Minimum password age
Which of the following security measures is a form of biometrics?
-Fingerprint scanner
You have a computer that runs Windows 7, and you want to install Windows 10. You are not concerned about keeping any of the existing data currently on the drive, and you want to do a clean install. After placing Windows 10 installations DVD in the optical drive, you restart the computer, but it does not boot to the DVD, and you are unable to install Windows. Which of the following are the BEST methods for installing Windows from DVD? (Select TWO. Each choice is a complete solution.)
-From the UEFI or BIOS firmware, change the boot order. -While the computer is rebooting, press the boot menu function key.
You need to boot a Windows 10 system into Safe Mode. Which steps will accomplish this task? (Select TWO. Each choice is a complete solution.)
-In the Safe Mode, select Start> Settings> Update & security> Recovery> Advanced startup> Restart Now -In the Safe Mode, press the [Shift] key on the keyboard while you click Restart
You provide desktop support at the branch office of a bank. One of the Windows workstations you manage is used to set up new customer accounts and fill out customer loan applications. Each user account on the system has been assigned a strong password. File and folder permissions have been assigned to prevent users from accessing each other's files. Which of the following would MOST likely increase the security of this system? (Select TWO. Each option is a complete solution.)
-Install a privacy filter on the monitor -Secure the computer system to the desk with a cable lock
Which of the following best describes spyware?
-It monitors the actions you take on your machine and sends the informationm back to its originating source
You are configuring the local security policy of a Windows system. You want to require users to create passwords that are at least 10 characters long. You also want to prevent logon after three unsuccessful logon attempts. Which of the following policies are BEST to configure? (Select TWO).
-Minumum password length -Account lockout threshold
Which of the following is the process of fixing problems detected by anti-virus software so that the computer is restored to its original state?
-Remediation
You have purchased a used computer from a computer liquidator. When you boot the computer, you find that there has been a password set on the BIOS. You need to clear the password so that you can edit the CMOS settings. What should you do?
-Remove the motherboard battery for a few seconds.
You provide desktop support at the branch office of a bank. One of the Windows workstations you manage is used by a bank employee to set up new customer accounts and fill out customer loan applications. Each user account on the system has been assigned a strong password. A cable lock has been installed to prevent it from being stolen. Which of the following steps could be completed to BEST increase the security of this system? (Select TWO).
-Remove the optical drive -Disable all USB in the BIOS/UEFI firmware configuration
Anna, a home office user, employs a technician to check the security on a computer that was hacked. The technician discovers that the user's password is the name of Anna's dog and hasn't been changed in over a year. Which of the following security best practices should the technician recommend? (Select TWO).
-Set a password expiration period -Require a strong password
A user is trying to log into her notebook computer. She enters the correct password for her user account, but the system won't let her authenticate, claiming the wrong password has been entered. Which of the following is MOST likely causing the problem?
-She has enabled Num Lock, causing numbers to be sent from the keyboard instead of the letters
Which type of malicious activity can be described as numerous unwanted and unsolicited email messages sent to a wide range of victims?
-Spamming
You are a security consultant. An organization has hired you to review their security measures. The organization is chiefly concerned that it could become the victim of a social engineering attack. Which of the following actions would you MOST likely recommend mitigating the risk?
Teach users how to recognize and respond to social engineering attacks.
You just bought a new computer. This system uses UEFI firmware and comes with Windows 10 preinstalled. You recently accessed the manufacturer's support website and saw that a UEFI
The update file has been tempered with.
You are an IT technician for your company. One of your employees calls and tells you that every time they turn their computer on, they hear three beeps. Which of the following BEST describes an accurate reply to this employee?
Three repeated beeps may mean different things. First, we need to check the motherboard documentation.
What is a program that appears to be a legitimate application, utility, game, or screensaver, but performs malicious activities surreptitiously?
Trojan
You are a security consultant and have been hired to evaluate an organization's physical security practices. All employees must pass through a locked door to enter the main work area. Access is restricted using a biometric fingerprint lock. A receptionist is located next to the locked door in the reception area. She uses an iPad application to log any security events that may occur. She also uses her iPad to complete work tasks as assigned by the organization's CEO. Network jacks are provided in the reception area such that employees and vendors can access the company network for work-related purposes. Users within the secured work area have been trained to lock their workstations if they will be leaving them for any period of time. Which of the following recommendations are you MOST likely to make to this organization to increase their security? (Select TWO)
-Train the receptionist to keep her iPad in a locked drawer when not in use. -Disable the network jacks in the reception area
Which security measure can be used to generate and store cryptographic keys?
-Trusted Platform Module (TPM)
You manage two computers with the following user accounts: • Wrk1 has user accounts Mary and Admin. The Mary account does not have a password set; The Admin account does. • Wrk2 has user accounts Mary and Julia. The Mary account has a password set; the Julia account does not. You are working from Wrk2 and would like to access a shared folder on Wrk1. Which of the following credentials would BEST allow you to access the shared folder?
-Type 'Admin' for the username and specify the password
While trying to log on, a user accidentally typed the wrong password three times, and now the system is locked because he entered too many incorrect passwords. He still remembers his password, but he just typed it wrong. He needs access as quickly as possible. Which of the following would allow the user to log on?
-Unlock the account
You turn on your desktop computer. You can hear the fans start up, but the monitor remains blank. You wait a while, but it doesn't appear that anything else is happening. The hard drive activity light doesn't show activity, and you never hear the sound that plays when Windows loads. Which of the following are the most likely cause of the problem? (Select THREE).
-Video Card -Memory -Processor
Defines an employee's rights to use company property.
Acceptable Use Policy
While browsing the internet, you notice that your browser displays pop-ups containing advertisements that are related to recent keyword searches you have performed. What is this an example of?
Adware
Which of the following security practices are the BEST example of the principle of least privilege?
All users on a Windows workstation are limited users except for one user, who is responsible for maintaining the system.
Bob calls and complains that he has suddenly started getting a lot of unwanted email. Which of the following is the BEST type of software to install to help solve Bob's problem?
Anti-Spam
An employee working from home accesses the company network using a VPN connection. When connecting, the employee is prompted for a PIN that changes at predetermined intervals. Which of the following will the employee MOST likely use to obtain the PIN?
Key fob
Wendy had been searching the internet for a great deal on jewelry. While looking at one site, a pop-up was displayed that told her she had just been chosen as the winner of a nice prize. Being excited to win, Wendy clicked on the link provided to claim her prize. The next day, when Wendy tried to turn on her computer, her computer displayed the Blue Screen of Death (BSOD). after interviewing Wendy, you suspect that the pop-up she clicked on installed some malicious software that has caused her computer to lock up. Which of the following is the BEST place to begin repairing wendy's computer?
Boot the computer from the Windows installation disc and run Startup Repair
Rodney, a user in the research department, reports that he is experiencing blue screen errors while using his Windows computer. You ask Rodney if anything has changed on the computer recently. Rodney explains that he recently installed a TV tuner board in an expansion slot. Now he has to reboot the computer every time he loads the TV tuner application to watch TV. You need to fix Rodney's computer and prevent Rodney from using the TV until you can install an updated driver. What should you do?
Boot the system into Safe Mode. Disable the TV tuner driver in Device Manager.
You just bought a new notebook. This system uses UEFI firmware and came with Windows 10 preinstalled. However, you want to use Linux on this system. You download your favorite distribution and install it on the system, removing all Windows partitions on the hard disk in the process. When the installation is complete, you find that the operating system won't load when the system is rebooted. Which of the following would allow your computer to boot to Linux?
Disable SecureBoot in the UEFI configuration
Employees in a small business have a habit of transferring files between computers using a USB flash drive and often bring in files from outside the company. Recently, a computer was infected with malware from a USB flash drive even though the employee did not access any files. Which of the following options would prevent this issue in the future?
Disable autorun
One of the Windows workstations you manage has four user accounts defined on it. Two of the users are limited users while the third (your account) is an administrative user. The fourth account is the Guest user account, which has been enabled to allow management employees convenient workstation access. Each limited and administrative user has been assigned a strong password. File and folder permissions have been assigned to prevent users from accessing each other's files. Autorun has been disabled on the system. Which of the following actions is MOST likely to increase the security of this system?
Disable the Guest account
Your client has hired you to evaluate their wired network security posture. As you tour their facility, you note the following: -Server systems are kept in a locked server room. -User accounts on desktop systems have strong passwords assigned. -A locked door is used to control access to the work area. Users must use ID badges to enter the area. -Users connect their personal mobile devices to their computers using USB cables. -Users work in three 8-hour shifts per day. Each computer is shared by three users. Each user has a limited account on the computer they use. Based on this information, which of the following would you MOST likely recommend your client do to increase security?
Disable the USB ports on the user's workstations
Nathan, a long-time Mac user, has been using his Mac computer for some time now with no issues. Recently, however, he reported that his Mac will unexpectedly tell him that his computer must be restarted by holding down the Power button for several seconds or by pressing the Restart button. Assuming that this is a symptom of kernel panic, which of the following steps would be the BEST first step for troubleshooting this issue?
Do a safe boot
A technician was able to stop a security attack on a user's computer. When conducting a forensic investigation, which of the following actions should be performed FIRST?
Document what's on the screen
A technician upgrades the hard drive on a computer in the accounting department and decides to donate the old drive to a local trade school. Which of the following is the BEST method to ensure that the accounting data can't be recovered?
Drive wipe
A technician wants to destroy the data on a hard drive and repurpose it as a spare drive. Which of the following data destruction methods allow the reuse of the hard drive?
Drive wipe
You want to configure your computer so that a password is required before the operating system will load. What should you do?
Configure a user password in the BIOS/UEFI.
Jose, a medical doctor, has a mobile device that contains sensitive patient information. He is concerned about unauthorized access to the data if the device is lost or stolen. Which of the following is the BEST option to prevent this from happening?
Configure the device to remote wipe as soon as it reported lost
You work for a company that offers their services through the internet. Therefore, it is critical that your website performs well. As the member of the IT technician staff, you receive a call from a former employee who informs you that customers are complaining that they can't access your website. After doing a little research, you have determined that you are a victim of a denial of service attack. As a first responder, which of the following is the next BEST step to perform?
Contain the issue
Which of the following functions are performed by the TPM?
Create a hash based on installed system system components
Which type of biometric authentication uses the ridges of your skin?
Fingerprint
You have implemented a regular backup schedule for a Windows system, backing up data files every night and creating a system image backup once a week. For security reasons, your company has decided to not store a redundant copy of the backup media at an offsite location. Where would be the next best place to keep your backup media?
In a locked fireproof safe
You have recently had an issue where a user's Windows computer was infected with a virus. After removing the virus from the computer, which of the following is the NEXT step you should take?
Install all OS updates
You have installed anti-malware software that checks for viruses in e-mail attachments. You configure the software to quarantine any files with problems. You receive an email with an important attachment, but the attachment is not there. Instead, you see a message that the file has been quarantined by the anti-malware software. Which of the following BEST describes what happened to the file?
It has been moved to a folder on your computer
While reviewing video files from your organization's security cameras, you notice a suspicious person using piggy-backing to gain access to your building. The individual in question did not have a security badge. Which of the following would you MOST likely implement to keep this from happening in the future?
Mantraps
A malicious person calls an employee from a cell phone. She tells the employee that she is the vice president over the accounting department in the employee's company. She relates that she has forgotten her password and demands that the employee give her his password so that she can access the reports she needs for an upcoming presentation. She threatens to fire the employee if he does not comply. Which of the following BEST describes the type of attack that just occurred?
Masquerading
You have booted your Windows workstation into Safe Mode and enabled Boot Logging. To which log file is the boot logging information now being written?
Ntbtlog.txt.
Match each security policy on the left with the appropriate description on the right. Each security policy may be used once, more than once, or not at all. -Provides a high-level overview of the organization's security program
Organizational Security Policy
A user within your organization received an email relating how an account containing a large sum of money has been frozen by the government of a small African nation. The user was offered a 25 percent share of this account if she would help the sender transfer it to a bank in the United States. The user responded to the sender and was instructed to send her bank account number so that it could be used to facilitate the transfer. She complied, and then the sender used the information to drain her bank account. What type of attack occurred?
Phishing
Joe, a user, receives an email from a popular video streaming website. The email urges him to renew his membership. The message appears official, but Joe has never had a membership before. When Joe looks closer, he discovers that a hyperlink in the email points to a suspicious URL. Which of the following security threats does this describe?
Phishing
Several users have forwarded you an email stating that your company's health insurance provider has just launched a new website for all employees. To access the site, they are told to click a link in the email and provide their personal information. Upon investigation, you discover that your company's health insurance provider did not send this email. Which of the following BEST describes the type of attack that just occurred?
Phishing
Which of the following is a form of attack that tricks victims into providing confidential information, such as identity information or logon credentials, through emails or websites that impersonate an online entity that the victim trusts, such as a financial institution or well-known e-commerce site?
Phishing
You have purchased new computers and will be disposing of your old computers. These computers were previously used for storing highly-sensitive customer order information, including credit card numbers. To properly protect the accidental discovery of the company's sensitive information, which of the following steps MUST be completed prior to getting rid of the computers?
Physically destroy the hard drives with a hammer
A technician assists Joe, an employee in the sales department who needs access to the client database, by granting him administrator privileges. Later, Joe discovers he has access to the salaries in the payroll database. Which of the following security practices was violated?
Principle of least privilege
During an airline flight, a laptop user makes last-minute changes to a presentation that contains sensitive company information. Which of the following would make it difficult for other passengers to view this information on the laptop display?
Privacy filter
The chain of custody is used for what purposes?
Retaining evidence integrity by identifying people coming into contact with the evidence,
You're troubleshooting a computer that runs Windows 10. The operating system has halted. and a blue screen is displayed on the monitor with an error message. What is the first step you should take to troubleshoot the issue?
Search for the error in Microsoft's knowledge base.
You have a computer that runs Windows 10. Where would you go to verify that the system has recognized the anti-malware software installed on the system?
Security and Maintenance
Marcus was attempting to tweak the way his Windows 10 workstation boots when he inadvertently corrupted his system boot files. It will now no longer boot to a logon prompt. He boots the system from the Windows installation disc and accesses the Recovery Environment. What should he do next?
Select Troubleshoot > Advanced Options > Startup Repair
Which of the following are common forms of social engineering attacks?
Sending hoax virus information emails
While organizing a storage cabinet, a technician discovers a box of hard drives that are incompatible with current hardware and may contain sensitive data. Which of the following is the BEST method for disposing of these drives?
Shredding
You have a set of DVD-RW discs that have been used to archive files for your latest development project. You need to dispose of the discs. Which of the following methods should you use to BEST prevent extracting data from the discs?
Shredding
A security technician is conducting a forensic analysis. Which of the following actions is MOST likely to destroy critical evidence?
Shutting down the system
Which of the following is not a form of biometrics?
Smart card
Which of the following security technologies stores identification information in a magnetic strip, radio frequency transmitter, or hardware contact to authorize access to a computer?
Smart card
Joe, an executive, receives an email that appears to be from the financial institution that provides his company credit card. The text of the email includes Joe's name and the company name and states that there is a problem with Joe's credit card. The email provides a link to verify the credit card, but when Joe hovers over the link, he thinks the web address seems strange. Which of the following BEST describes this type of attack?
Social engineering
A security incident is currently occurring on the company network. You discover that the attack involves a computer system that is attached to the network. You're unsure what kind of damage is being done to the network systems or data. Which of the following actions should you take FIRST?
Stop the attack and contain the damage by disconnecting the system from the network.
An intruder waits near an organization's secured entrance until an employee approaches the entrance and unlocks it with a security badge. The intruder falls in line behind the employee, who assumes the intruder is another employee and holds the door open for her. Which of the following BEST describes the type of attack that just occurred?
Tailgating
An unauthorized person gains access to a secured area by following an authorized person through a door controlled by a badge reader. Which of the following security threats does this sentence describe?
Tailgating
You have 5 salespersons who work out of your office and who frequently leave their laptops laying on their desks in their cubicles. You are concerned that someone might walk by and take one of these laptops. Which of the following is the BEST protection to implement to address your concerns?
Use cable locks to chain the laptops to the desks
You have purchased new computers and will be disposing of your old computers. Instead of recycling the computers, you decide to resell them by placing an ad on the Internet. These recycling the computers, you decide to resell them by placing an ad on the Internet. These computers were previously used for storing sensitive information. To properly protect the accidental discovery of the company's sensitive information, which of the following steps MUST be completed prior to getting rid of the computers?
Use data wiping software to clear the hard drives
You are responsible for disposing of several old workstations formerly used by accountants in your organization's Finance department. Before being shipped to a computer recycler, you decide to make sure any old data on the hard drives is erased. To do this, you use the Windows XP Installation CDs that came with these systems to delete all partitions from the hard drives. Which of the following BEST describes what needs to be done before the systems are ready to be recycled?
Use disk wiping software to fully erase the drives on the systems
How can you keep a Windows 10 system from automatically restarting after a critical system error occurs?
Use the Disable automatic restart after failure option on the Advanced Startup Options menu.
What is the best countermeasure against social engineering?
User awareness training
Which of the following is the most common form of authentication?
Username and password
What is the common name for a program that has no useful purpose, but attempts to spread itself to other systems and often damages resources on the systems where it is found?
Virus
A large number of compromised computers are infected with malware that allows an attacker (herder) to control them to spread email spam and launch denial-of-service attacks. Which of the following does this security threat describe?
Zombie/botnet
Which of the following is an example of a strong password?
a8bT11$yi
You are troubleshooting a Windows 10 system that won't boot. The system appears to initialize just fine and post completes correctly. However, Windows doesn't load, and an error message is displayed on the screen, indicating the operating system couldn't be found. You determine that the Master Boot Record (MBR) is corrupt. To fix the issue, you do the following: 1. Boot the system from the Windows 10 installation DVD. 2. Access the Recovery Environment. 3. Open a Command window. Enter the command you can run at the command prompt to address this issue.
bootrec /fixmbr
Which are examples of a strong password? (Select TWO).
il0ve2EatIceCr3am TuxP3nginsRn0v3l
One day, while trying to start your Windows 10 computer, the system displays the following error: *Windows could not start. Could not read from the selected boot disk. Check boot path and disk hardware.* Which of the following will most likely fix the problem?
Boot into recovery enviroment and run the *bootrec*/*rebuildbcd* command
A public library has purchased a new laptop computer to replace their older desktop computers and is concerned that they are vulnerable to theft. Which of the following laptop features should be used to physically secure the laptop?
A cable lock
What is a cookie?
A file saved on your hard drive that tracks website preferences and use
Which of the following is an important aspect of evidence gathering?
Backing up all log files and audit trails
What do biometrics use to authenticate identity?
Biological attributes
Employees currently access a data center using RFID badges. The company is concerned that an unauthorized person could gain access using a lost or stolen badge. Which of the following could be implemented to increase the physical security?
Biometric locks
Your anti-malware software has detected a virus on your Windows 10 system. However, the anti- malware software is unable to remove it. When you try to delete the files, you can't because they are in use. Which of the following actions would be BEST to try first?
Boot into Safe Mode and try removing the malware.
You have been asked to draft a document related to evidence gathering that contains details about personnel in possession and control of evidence from the time of discovery up through the time of presentation in court. What type of document is this?
Chain of custody
Which of the following indicates a system case cover has been removed?
Chassis intrusion detecion.
