DCOM 258 Final Exam Review
Of the following, which statement correctly describes the difference between a secure cipher and a secure hash?
A cipher can be reversed; a hash cannot.
What does it mean if a hashing algorithm creates the same hash for two different downloads?
A collision has occurred.
Imagine that you are an attacker. Which would be most desirable when attempting to compromise encrypted data?
A weak key
When encrypting credit card data, which would be the most secure algorithm with the least CPU utilization?
AES
You are attempting to move data to a USB flash drive. Which of the following enables a rapid and secure connection?
AES-256
You have been alerted to suspicious traffic without a specific signature. Under further investigation, you determine that the alert was a false indicator. Furthermore, the same alert has arrived at your workstation several times. Which security device needs to be configured to disable false alarms in the future? (Select the best answer.)
Anomaly-based IDS
Which of the following encryption concepts is PKI based on?
Asymmetric
Which of the following is a record of the tracked actions of users?
Audit trails
One of your co-workers complains to you that he cannot see any security events in the Event Viewer. What are three possible reasons for this? (Select the three best answers.)
Auditing has not been turned on. The co-worker is not an administrator. Auditing for an individual object has not been turned on.
Which action should be taken to protect against a complete disaster in the case that a primary company's site is permanently lost?
Back up all data to tape, and store those tapes at a sister site in another city
Which of the following requires a baseline? (Select the two best answers.)
Behavior-based monitoring Anomaly-based monitoring
What type of attack sends two different messages using the same hash function, which end up causing a collision?
Birthday attack
A network stream of data needs to be encrypted. Jason, a security administrator, selects a cipher that will encrypt 128 bits at a time before sending the data across the network. Which of the following has Jason chosen?
Block cipher
What should you publish a compromised certificate to?
CRL
You are in charge of PKI certificates. What should you implement so that stolen certificates cannot be used?
CRL
What two items are included in a digital certificate? (Select the two best answers.)
Certificate authority's digital signature The user's public key
A hash algorithm has the capability to avoid the same output from two guessed inputs. What is this known as?
Collision resistance
Which of the following methods will best verify that a download from the Internet has not been modified since the manufacturer released it?
Compare the final MD5 hash with the original.
Which of the following deals with the standard load for a server?
Configuration baseline
Which of the following techniques enables an already secure organization to assess security vulnerabilities in real time?
Continuous monitoring
Which of the following is the best practice to implement when securing logs files?
Copy the logs to a remote log server.
Which of the following is the weakest encryption type?
DES
Rick has a local computer that uses software to generate and store key pairs. What type of PKI implementation is this?
Decentralized
What kind of security control do computer security audits fall under?
Detective
Which of the following is not a symmetric key algorithm?
ECC
You are tasked with selecting an asymmetric encryption method that allows for the same level of encryption strength, but with a lesser key length than is typically necessary. Which encryption method fulfills your requirement?
ECC
Which of the following tape backup methods enables daily backups, weekly full backups, and monthly full backups?
Grandfather-father-son
Which of the following protocols uses port 443?
HTTPS
Which of the following uses an asymmetric key to open a session, and then establishes a symmetric key for the remainder of the session?
HTTPS
Which of the following will provide an integrity check?
Hash
Which of the following can facilitate a full recovery within minutes?
Hot site
Which of the following is usually used with L2TP?
IPsec
Of the following backup types, which describes the backup of files that have changed since the last full or incremental backup?
Incremental
One of the developers in your organization installs a new application in a test system to test its functionality before implementing into production. Which of the following is most likely affected?
Initial baseline configuration
Which of the following concepts does the Diffie-Hellman algorithm rely on?
Key exchange
Which of the following protocols creates an unencrypted tunnel?
L2TP
Critical equipment should always be able to get power. What is the correct order of devices that your critical equipment should draw power from?
Line conditioner, UPS battery, generator
Which of the following provides for the best application availability and can be easily expanded as an organization's demand grows?
Load balancing
Which of the following describes key escrow?
Maintains a secured copy of the user's private key for the purpose of recovering the key if it is lost
Which layer of the OSI model does IPsec operate at?
Network
Which of the following combines the keystream with the plaintext message using the bitwise XOR operator to produce the ciphertext?
One-time pad
Which of the following are certificate-based authentication mapping schemes? (Select the two best answers.)
One-to-one mapping Many-to-one mapping
The IT director wants you to use a cryptographic algorithm that cannot be decoded by being reversed. Which of the following would be the best option?
One-way function
Which of the following does not apply to an X.509 certificate?
Owners symmetric key
Which of the following protocols is not used to create a VPN tunnel and not used to encrypt VPN tunnels?
PPP
Which of the following would not be considered part of a disaster recovery plan?
Patch management software
What tool can alert you if a server's processor trips a certain threshold?
Performance Monitor
You have established a baseline for your server. Which of the following is the best tool to use to monitor any changes to that baseline?
Performance Monitor
Jason is a security administrator for a company of 4000 users. He wants to store 6 months of security logs to a logging server for analysis. The reports are required by upper management due to legal obligations but are not time-critical. When planning for the requirements of the logging server, which of the following should not be implemented?
Performance baseline and audit trails
As you review your firewall log, you see the following information. What type of attack is this? S=207.50.135.54:53 - D=10.1.1.80:0 S=207.50.135.54:53 - D=10.1.1.80:1 S=207.50.135.54:53 - D=10.1.1.80:2 S=207.50.135.54:53 - D=10.1.1.80:3 S=207.50.135.54:53 - D=10.1.1.80:4 S=207.50.135.54:53 - D=10.1.1.80:5
Port scanning
In a public key infrastructure setup, which of the following should be used to encrypt the signature of an e-mail?
Private key
Your boss wants you to set up an authentication scheme in which employees will use smart cards to log in to the company network. What kind of key should be used to accomplish this?
Private key
Which of the following can determine which flags are set in a TCP/IP handshake?
Protocol analyzer
Which tool can be instrumental in capturing FTP GET requests?
Protocol analyzer
You suspect a broadcast storm on the LAN. Which tool is required to diagnose which network adapter is causing the storm?
Protocol analyzer
When a user's web browser communicates with a CA, what PKI element does the CA require from the browser?
Public key
You have been asked to set up authentication through PKI, and encryption of a database using a different cryptographic process to decrease latency. What encryption types should you use?
Public key encryption to authenticate users and private keys to encrypt the database
You have been tasked with increasing the level of server fault tolerance, but you have been given no budget to perform the task. Which of the following should you implement to ensure that servers' data can withstand hardware failure?
RAID
WEP improperly uses an encryption protocol and therefore is considered to be insecure. What encryption protocol does it use?
RC4
Which of the following is not a valid cryptographic hash function?
RC4
Which of the following encryption algorithms is used to encrypt and decrypt data?
RC5
Which of the following protocols are you observing in the packet capture below? 16:42:01 - SRC 192.168.1.5:3389 - DST 10.254.254.57:8080 - SYN/ACK
RDP
Which of the following encryption methods deals with two distinct, large prime numbers and the inability to factor those prime numbers?
RSA
You are tasked with ensuring that messages being sent and received between two systems are both encrypted and authenticated. Which of the following protocols accomplishes this?
RSA
Your company has a fiber-optic connection to the Internet. Which of the following can enable your network to remain operational even if the fiber-optic line fails?
Redundant ISP
Your company has six web servers. You are implementing load balancing. What is this an example of?
Redundant servers
What should you do to make sure that a compromised PKI key cannot be used again?
Revoke the key
Which of the following details one of the primary benefits of using S/MIME?
S/MIME enables users to send both encrypted and digitally signed e-mail messages.
In what way can you gather information from a remote printer?
SNMP
The IT director has asked you to install agents on several client computers and monitor them from a program at a server. What is this known as?
SNMP
You have been tasked with providing daily network usage reports of layer 3 devices without compromising any data during the information gathering process. Which of the following protocols should you select to provide for secure reporting in this scenario?
SNMPv3
Which of the following network protocols sends data between two computers while using a secure channel?
SSH
Which of the following log files should show attempts at unauthorized access?
Security
You are setting up auditing on a Windows computer. If set up properly, which log should have entries?
Security log
Which of the following should be done if an audit recording fails?
Send an alert to the administrator.
Which layer of the OSI model is where SSL provides encryption?
Session
Two computers are attempting to communicate with the SSL protocol. Which two types of keys will be used? (Select the two best answers.)
Session key Public key
Which of following is the most basic form of IDS?
Signature-based
Your manager wants you to implement a type of intrusion detection system (IDS) that can be matched to certain types of traffic patterns. What kind of IDS is this?
Signature-based IDS
Give two examples of hardware devices that can store keys. (Select the two best answers.)
Smart card USB flash drive
Which type of encryption technology is used with the BitLocker application?
Symmetric
Which of the following is used by PGP to encrypt the session key before it is sent?
Symmetric scheme
What is another term for secret key encryption?
Symmetrical
To find out when a computer was shut down, which log file would an administrator use?
System
Which of the following answers are not part of IPsec? (Select the two best answers.)
TKIP AES
What ensures that a CRL is authentic and has not been modified?
The CRL is digitally signed by the CA
Your boss wants you to properly log what happens on a database server. What are the most important concepts to think about while you do so? (Select the two best answers.)
The amount of disk space you will require The information that will be needed to reconstruct events later
Of the following, which two security measures should be implemented when logging a server? (Select the two best answers.)
The application of retention policies on log files Hashing of log files
Which of the following statements is correct about IPsec authentication headers?
The authentication information is a keyed hash based on all the bytes in the packet
Last week, one of the users in your organization encrypted a file with a private key. This week the user left the organization, and unfortunately the systems administrator deleted the user's account. What are the most probable outcomes of this situation? (Select the two best answers.)
The data is not recoverable The data can be decrypted using the recovery agent
What does steganography replace in graphic files?
The least significant bit of each byte
Michael has just completed monitoring and analyzing a web server. Which of the following indicates that the server might have been compromised?
The web server is showing a drop in CPU speed and hard disk speed.
Which of the following factors should you consider when evaluating assets to a company? (Select the two best answers.)
Their value to the company Their replacement cost
Which of the following might a public key be used to accomplish?
To decrypt the hash of a digital signature
Why would an attacker use steganography?
To hide information
What is the main reason to frequently view the logs of a DNS server?
To watch for unauthorized zone transfers
You are using the following backup scheme: A full backup is made every Friday night at 6 p.m., and differential backups are made every other night at 6 p.m. Your database server fails on a Thursday afternoon at 4 p.m. How many tapes will you need to restore the database server?
Two
To prevent electrical damage to a computer and its peripherals, the computer should be connected to what?
UPS
What device should be used to ensure that a server does not shut down when there is a power outage?
UPS
The fundamental difference between symmetric key systems and asymmetric key systems is that symmetric key systems do which of the following?
Use the same key on each end
