Network Security CI120 (A & B)

Ace your homework & exams now with Quizwiz!

A differential backup

Rick performs a backup that captures the changes since the last full backup. What type of backup has he performed?

Audit

The board of directors of Kate's company recently hired an independent firm to review the state of the organization's security controls and certify those results to the board. What term best describes this engagement?

Cryptanalysis

The evaluation of a cryptosystem to test its security.

Preparation

The following figure shows the Security+ incident response cycle. What item is missing? (Hint: First step)

XOR

The function most commonly seen in cryptography. A "bitwise eXclusive OR"

Key Escrow

The process of giving keys to a third party so they can decrypt and read sensitive information if the need arises.

Code signing

Tom is a software developer who creates code for sale to the public. He would like to assure his users that the code they receive actually came from him. What technique can he use to best provide this assurance?

AUP

Tonya discovers that an employee is running a side business from his office, using company technology resources. What policy would most likely contain information relevant to this situation?

Transit gateway

Ursula would like to link the networks in her on-premises datacenter with cloud VPCs in a secure manner. What technology would help her best achieve this goal?

A browser plug-in

Wayne is concerned that an on-path attack has been used against computers he is responsible for. What artifact is he most likely to find associated with this attack?

Session cookie

Wendy is a penetration tester who wishes to engage in a session hijacking attack. What information is crucial for Wendy to obtain if her attack will be successful?

Privacy

What is the most frequent concern that leads to GPS tagging being disabled by some companies via an MDM tool?

XML

What language is STIX based on?

GDPR

What law creates privacy obligations for those who handle the personal information of European Union residents?

TLS

What protocol is used to securely wrap many otherwise insecure protocols?

EV

What type of digital certificate provides the greatest level of assurance that the certificate owner is who they claim to be?

Vishing

When you combine phishing with Voice over IP, it is known as:

Hybrid cloud

Which cloud computing deployment model requires the use of a unifying technology platform to tie together components from different providers?

Controls used to fulfill one PCI DSS requirement may be used to compensate for the absence of a control needed to meet another requirement.

Which one of the following statements is not true about compensating controls under PCI DSS?

Management

Which team member acts as a primary conduit to senior management on an IR team?

To prevent EMI

Why are Faraday cages deployed?

WTLS (Wireless Transport Layer Security)

Wireless Access Points use this protocol to attempt to ensure confidentiality of data.

Incident response policies

__________________ __________________ __________________ are commonly defined as part of building an IR capability.

Signature-based detection

__________________ uses a hash or other signature generation method to identify files or components of the malware that have been previously observed.

BPDU

____________________ guard protects STP by preventing ports that should not send BPDU messages from sending them.

Sanitizing drives or media

_____________________ involves wiping the data or destroying the media.

Data loss prevention tools

_____________________ protect organizational data from both theft and inadvertent exposure.

DHCP

_______________________ snooping focuses on preventing rogue DHCP servers from handing out IP addresses to clients in a managed network.

Business Partnership Agreement

A legal agreement between organizations establishing the terms, conditions, and expectations of the relationship between them

Memorandum of Understanding

A legal document used to describe a bilateral agreement between parties.

Hackers

Actors who deliberately access computer systems and networks without authorization.

Static code analysis

Adam is conducting software testing by reviewing the source code of the application. What type of code testing is Adam conducting?

TAXII

Cindy wants to send threat information via a standardized protocol specifically designed to exchange cyber threat information. What should she choose?

Subnet Mask

Tells you what portion of a 32-bit IP address is being used as the Network ID and what portion is being used as the Host ID

checksum

The hash value for a drive or image can also be used as a __________________ to ensure that it has not changed.

Entropy

The measure of randomness in a system.

Biometrics

The measurement of unique biological properties such as fingerprints or irises.

Workstation

The name for a typical computer a user uses on a network.

An RTOS

The organization that Lynn works for wants to deploy an embedded system that needs to process data as it comes in to the device without processing delays or other interruptions. What type of solution does Lynn's company need to deploy?

Three-Way Handshake

The packet exchange sequence that initiates a TCP connection. SYN, SYN-ACK, ACK.

Economy of Mechanism

The principle in security where protection mechanisms should be kept as simple and small as possible.

Least Privilege

The principle that states that a subject has only the necessary rights and privileges to perform its task with no additional permissions.

Dumpster Diving

The process of going through a target's trash searching for information that can be used in an attack or to gain knowledge about a system or network.

TEMPEST

The program to control electronic emanations from electrical equipment.

Registration Authority (RA)

The trusted authority for certifying individuals' identities and creating an electronic document indicating that individuals are who they say they are.

PHI

Tina works for a hospital system and manages the system's patient records. What category of personal information best describes the information that is likely to be found in those records?

Whitelist blacklist block list

____________ and ____________ or ____________ are all terms used to describe allowing you to build a list of software, applications, and other system components that are allowed to exist or blocked from a system.

AUP

____________ provides network and system users with clear direction on permissible uses of information resources.

Least privilege

____________ says that individuals should be granted only the minimum set of permissions necessary to carry out their job functions.

Preparation

____________. In this phase, you build the tools, processes, and procedures to respond to an incident.

Asset management

_____________ ___________ describe how the organization will follow for accepting new assets (such as computers and mobile devices) into inventory, tracking those assets over their lifetime, and properly disposing of them at the end of their useful life.

Embedded systems

_______________ are computer systems that are built into other devices.

Sandbox

_______________ describes an isolated environment where potentially dangerous or problematic software can be run.

Autopsy

__________________ is an open source forensic suite with broad capabilities.

Hardware Security Module (HSM)

A physical device that safeguards cryptographic keys.

Shoulder Surfing

A procedure in which attackers position themselves in such a way as to be able to observe an authorized user entering the correct access code.

A heatmap

Amanda wants to create a view of her buildings that shows Wi-Fi signal strength and coverage. What is this type of view called?

Degaussing

Amanda wants to securely destroy data held on DVDs. Which of the following options is not a suitable solution for this?

SSID

An Access Point uses this to advertise its existence to potential wireless clients.

Evil twin

An ________________ is a malicious fake access point that is set up to appear to be a legitimate, trusted network.

Steganography

Brian discovers that a user suspected of stealing sensitive information is posting many image files to a message board. What technique might the individual be using to hide sensitive information in those images?

Performing user input validation

Charles is worried about users conducting SQL injection attacks. Which of the following solutions will best address his concerns?

Interview the individual.

Charles needs to know about actions an individual performed on a PC. What is the best starting point to help him identify those actions?

tail

Charles wants to monitor changes to a log file via a command line in real time. Which of the following command-line Linux tools will let him see the last lines of a log file as they change?

Out-of-band management

Fred wants to ensure that the administrative interfaces for the switches and routers are protected so that they cannot be accessed by attackers. Which of the following solutions should he recommend as part of his organization's network design?

Supply chain

Greg believes that an attacker may have installed malicious firmware in a network device before it was provided to his organization by the supplier. What type of threat vector best describes this attack?

Geographic dispersal

Gurvinder identifies a third-party datacenter provider over 90 miles away to run his redundant datacenter operations. Why has he placed the datacenter that far away?

Backups

Gurvinder wants to follow the order of volatility to guide his forensic data acquisition. Which of the following is the least volatile?

COPE

Gurvinder wants to select a mobile device deployment method that provides employees with devices that they can use as though they're personally owned to maximize flexibility and ease of use. Which deployment model should he select?

Command and Control

In the Cyber Kill Chain, this stage access allows two-way communication and continued control of the remote system. __________________

Reconnaissance

In the Cyber Kill Chain, this stage identifies targets. __________________

Risk acceptance

In the end, Grace found that the insurance policy was too expensive and opted not to purchase it. She is taking no additional action. What risk management strategy is being used in this situation?

SaaS

In what cloud security model does the cloud service provider bear the most responsibility for implementing security controls?

When the machine is off

Jim configures a Windows machine with the built-in BitLocker full disk encryption tool. When is the machine least vulnerable to having data stolen from it?

Text messages and multimedia messages

Madhuri disables SMS, MMS, and RCS on phones in her organization. What has she prevented from being sent?

Active/active

Madhuri is designing a load-balancing configuration for her company and wants to keep a single node from being overloaded. What type of design will meet this need?

Standard Operating Procedures

Mandatory step-by-step instructions set by the organization so that in the performance of their duties employees will meet the stated security objectives of the firm.

Email

Of the threat vectors listed here, which one is most commonly exploited by attackers who are at a distant location?

Bootdisk

Removable media from a computer which can be booted.

Third-party control

Ryan is selecting a new security control to meet his organization's objectives. He would like to use it in their multicloud environment and would like to minimize the administrative work required from his fellow technologists. What approach would best meet his needs?

A microcontroller, and on physical security

The company that Hui works for has built a device based on an Arduino and wants to standardize its deployment across the entire organization. What type of device has Hui's organization deployed, and where should Hui place her focus on securing it?

MAC Address

The hardware address that uniquely identifies each device on a network.

Network Address Translation (NAT)

The protocol that allows the use of private, internal IP addresses for internal traffic and public IP addresses for external traffic.

Topology

The shape or arrangement of a network, such as bus or star.

IEEE 802.11

The standard for wireless local area networks.

Mobile Device Management (MDM)

The type of application used to control security across multiple mobile devices in an enterprise.

Storage segmentation

Theresa has implemented a technology that keeps data for personal use separate from data for her company on mobile devices used by members of her staff. What is this concept called?

$25,000

What is the annualized loss expectancy (ALE)?

Stream cipher

What type of cipher operates on one character of text at a time?

Two-person control

Which of the following controls helps prevent insider threats?

Create specific technology requirements for an organization.

Which one of the following is not a common use of the NIST Cybersecurity Framework?

Preventing injection attacks

Which one of the following is not an advantage of database normalization?

Proposed revision to the security policy

Which one of the following items is not normally included in a request for an exception to security policy?

Reduced the probability

You notice a high number of SQL injection attacks against a web application run by your organization, so you install a web application firewall to block many of these attacks before they reach the server. How have you altered the severity of this risk?

Data ownership policy

_____ clearly states the ownership of information created or used by the organization.

Password policy

_____ sets forth requirements for password length, complexity, reuse, and similar issues.

MSA

_______ provides an umbrella contract for the work that a vendor does with an organization over an extended period of time.

SCADA

_________ is a type of system architecture that combines data acquisition and control devices, computers, communications capabilities, and an interface to control and monitor an entire architecture.

Legacy systems

_______________ pose a unique type of risk to organizations.

Qualitative risk assessments

_______________ substitute subjective judgments and categories for strict numerical analysis, allowing the assessment of risks that are difficult to quantify.

Quantitative risk assessments

_______________ use numeric data in the analysis, resulting in assessments that allow the very straightforward prioritization of risks.

Network segmentation

________________ divides a network up into logical or physical groupings that are frequently based on trust boundaries, functional requirements, or other reasons that help an organization apply controls or assist with functionality.

Full disk encryption

________________ encrypts the disk and requires that the bootloader or a hardware device provide a decryption key and software or hardware to decrypt the drive for use.

EAP-TLS

________________ implements certificate-based authentication as well as mutual authentication of the device and network.

Port security

________________ is a capability that allows you to limit the number of MAC addresses that can be used on a single port

RFID

________________ is a relatively short-range (from less than a foot of some passive tags to about 100 meters for active tags) wireless technology that uses a tag and a receiver to exchange information.

Walk-throughs

__________________ take a team through an incident step by step.

Files will remain but file indexes will not.

Alex has been handed a flash media device that was quick-formatted and has been asked to recover the data. What data will remain on the drive?

Residual risk

Brian recently conducted a risk mitigation exercise and has determined the level of risk that remains after implementing a series of controls. What term best describes this risk?

Autopsy

Henry wants to use an open source forensic suite. Which of the following tools should he select?

27701

What ISO standard provides guidance on privacy controls?

0.05

What is the annualized rate of occurrence (ARO)?

Initialization Vector

A random number used in combination with a secret key as a means to encrypt data. Part of the RC4 cipher that has a weak implementation in WEP.

CCTV

A system where the camera and monitor are directly linked.

Single Sign-On (SSO)

An authentication process where the user can enter their user ID and password once and then be able to move from application to application without having to supply further authentication.

Backdoor

An avenue that can be used to access a system while circumventing normal security mechanisms.

PBX (Private Branch Exchange)

An extension of the telephone service into a firm's telecommunications network.

Script Kiddie

An individual who does not have the technical expertise to develop scripts or discover new vulnerabilities in software but who has just enough understanding of computer systems to be able to download and run scripts that others have developed.

Resource policy

Brian would like to limit the ability of users inside his organization to provision expensive cloud server instances without permission. What type of control would best help him achieve this goal?

Elicitation

Charles wants to find out about security procedures inside his target company, but he doesn't want the people he is talking to realize that he is gathering information about the organization. He engages staff members in casual conversation to get them to talk about the security procedures without noticing that they have done so. What term describes this process in social engineering efforts?

Use the VM host to create a snapshot.

Charles wants to obtain a forensic copy of a running virtual machine. What technique should he use to capture the image?

The Windows Security log

Chris has turned on logon auditing for a Windows system. Which log will show them?

Integrity

Chris is responding to a security incident that compromised one of his organization's web servers. He believes that the attackers defaced one or more pages on the website. What cybersecurity objective did this attack violate? Confidentiality Nonrepudiation Integrity Availability

UEFI/Measured boot

Chris wants systems that connect to his network to report their boot processes to a server where they can be validated before being permitted to join the network. What technology should he use to do this on the workstations?

None of the above (which are: Use signed BGP by adopting certificates for each BGP peer/ Turn on BGP route protection/ Choose a TLS-enabled version of BGP)

Chuck wants to provide route security for his organization, and he wants to secure the BGP traffic that his routers rely on for route information. What should Chuck do?

Implement and use a data classification scheme.

Frank's organization is preparing to deploy a data loss prevention (DLP) system. What key process should they undertake before they deploy it?

Network-based

Greg is implementing a data loss prevention system. He would like to ensure that it protects against transmissions of sensitive information by guests on his wireless network. What DLP technology would best meet this goal?

WinHex

Greg wants to use a tool that can directly edit disks for forensic purposes. What commercial tool could he select from this list?

journalctl

Jim wants to view log entries that describe actions taken by applications on a CentOS Linux system. Which of the following tools can he use on the system to view those logs?

John the Ripper

Joanna recovers a password file with passwords stored as MD5 hashes. What tool can she use to crack the passwords?

In the photo's metadata

Madhuri wants to check a PNG-formatted photo for GPS coordinates. Where can she find that information if it exists in the photo?

Motion detection

Madhuri wants to implement a camera system but is concerned about the amount of storage space that the video recordings will require. What technology can help with this?

Bluesnarfing

Octavia discovers that the contact list from her phone has been acquired via a wireless attack. Which of the following is the most likely culprit?

Remote wipe and FDE

Susan wants to ensure that the threat of a lost phone creating a data breach is minimized. What two technologies should she implement to do this?

100%

What is the exposure factor (EF)?

Man-in-the-middle

What type of attack places an attacker in the position to eavesdrop on communications between a user and a web server?

DOM-based XSS

What type of cross-site scripting attack would not be visible to a security professional inspecting the HTML source code in a browser?

A nation-state

What type of malicious actor is most likely to use hybrid warfare?

An access control vestibule

What type of physical security control is shown here? (A closed room with Door 1 which leads to Door 2, which leads to a secure area (or room).)

A warm site

What type of recovery site has some or most systems in place but does not have the data needed to take over operations?

Authority

When a caller was recently directed to Amanda, who is a junior IT employee at her company, the caller informed her that they were the head of IT for her organization and that she needed to immediately disable the organization's firewall due to an ongoing issue with their e-commerce website. After Amanda made the change, she discovered that the caller was not the head of IT, and that it was actually a penetration tester hired by her company. Which social engineering principle best matches this type of attack?

Volatility

Which of the following is a memory forensics toolkit that includes memdump?

Form factor

Which of the following is not a common constraint of an embedded system?

Using a cloud provider's web interface to provision resources

Which one of the following is not an example of infrastructure as code?

Contain

Which one of the following is not one of the five core security functions defined by the NIST Cybersecurity Framework?

Anonymous

Which one of the following is the best example of a hacktivist group?

Nonrepudiation

Which one of the following objectives is not one of the three main objectives that information security professionals must achieve to protect their organizations against cybersecurity threats?

Data retention policy

Which one of the following policies would typically answer questions about when an organization should destroy records?

Guideline

Which one of the following security policy framework components does not contain mandatory guidance for individuals in the organization?

Agile

Which one of the following software development models focuses on the early and continuous delivery of software?

Threat map

Which one of the following threat research tools is used to visually display information about the location of threat actors?

CRM

Which one of the following would not commonly be available as an IaaS service offering?

Requirement to use AES-256 encryption

Which one of the following would not normally be found in an organization's information security policy?

Procedures

_________ are detailed, step-by-step processes that individuals and organizations must follow in specific circumstances.

SLA

__________ are written contracts that specify the conditions of service that will be provided by the vendor and the remedies available to the customer if the vendor fails to meet the SLA.

Continuous monitoring policy

__________ describes the organization's approach to monitoring and informs employees that their activity is subject to monitoring in the workplace.

Asset management

__________ describes the process an organization will follow for accepting new assets (such as computers and mobile devices) into inventory, tracking those assets over their lifetime, and properly disposing of them at the end of their useful life.

MOU

__________ is an informal mechanism that allows the parties to document their relationship to avoid future misunderstandings.

Standards

__________ provide mandatory requirements describing how an organization will carry out its information security policies.

Guidelines

___________ provide best practices and recommendations related to a given concept, technology, or task.

Data stewards

_______________ are individuals who carry out the intent of the data controller and are delegated responsibility from the controller.

External risks

_______________ are those risks that originate from a source outside the organization.

Multi-party risks

_______________ are those that impact more than one organization.

Vulnerabilities

_______________ are weaknesses in our systems or controls that could be exploited by a threat.

Risk avoidance

_______________ is a risk management strategy where we change our business practices to completely eliminate the potential that a risk will materialize.

Risk acceptance

_______________ is the final risk management strategy and it boils down to deliberately choosing to take no other risk management strategy and to simply continue operations as normal in the face of the risk

Risk mitigation

_______________ is the process of applying security controls to reduce the probability and/or magnitude of a risk.

Risk management

_______________ is the process of systematically addressing the risks facing an organization.

Risks

_______________ occur at the intersection of a vulnerability and a threat that might exploit that vulnerability.

Risk identification process

_______________ requires identifying the threats and vulnerabilities that exist in your operating environment.

Tailgating

A simple tactic of following closely behind a person who has just used their access card or PIN to gain physical access to a room or building.

A supply chain attack

Alex discovers that the network routers that his organization has recently ordered are running a modified firmware version that does not match the hash provided by the manufacturer when he compares them. What type of attack should Alex categorize this attack as?

A disaster recovery plan

Gwen is building her organization's documentation and processes and wants to create the plan for what the organization would do if her datacenter burned down. What type of plan would typically cover that type of scenario?

Masking

Gwen is exploring a customer transaction reporting system and discovers the table shown here. What type of data minimization has most likely been used on this table?

SaaS

Helen designed a new payroll system that she offers to her customers. She hosts the payroll system in AWS and her customers access it through the web. What tier of cloud computing best describes Helen's service?

Data processor

Helen's organization maintains medical records on behalf of its customers, who are individual physicians. What term best describes the role of Helen's organization?

An unencrypted HTTP connection

What does an SSL stripping attack look for to perform an on-path attack?

Bluetooth

________________ is a short-range wireless standard limited to typically 5-30 meters.

Shoulder surfing

Alan reads Susan's password from across the room as she logs in. What type of technique has he used?

Homomorphic encryption

Alan's team needs to perform computations on sensitive personal information but does not need access to the underlying data. What technology can the team use to perform these calculations without accessing the data?

A microSD HSM

Alyssa wants to use her Android phone to store and manage cryptographic certificates. What type of solution could she choose to do this using secure hardware?

A CAN bus

Amanda is assessing a vehicle's internal network. What type of bus is she most likely to discover connecting its internal sensors and controllers?

Vulnerability scans

Henry wants to check to see if services were installed by an attacker. What commonly gathered organizational data can he use to see if a new service appeared on systems?

A host intrusion detection system

Olivia wants to install a host-based security package that can detect attacks against the system coming from the network, but she does not want to take the risk of blocking the attacks since she fears that she might inadvertently block legitimate traffic. What type of tool could she install that will meet this requirement?

Peer-to-Peer Trust Model

One CA is not subordinate to another CA, and there is no established trust anchor between the CAs involved.

2

Referring to the scenario in question 9, if Acme Widgets switched to an asymmetric encryption algorithm, how many keys would be required to add the 11th employee?

Transitive Trust

Refers to the condition where trust is extended to another domain that is already trusted.

Gray-hat hacking

Renee is a cybersecurity hobbyist. She receives an email about a new web-based grading system being used by her son's school and she visits the site. She notices that the URL for the site looks like this: https://www.myschool.edu/grades.php&studentID=1023425 (Links to an external site.) She realizes that 1023425 is her son's student ID number and she then attempts to access the following similar URLs: https://www.myschool.edu/grades.php&studentID=1023423 (Links to an external site.) https://www.myschool.edu/grades.php&studentID=1023424 (Links to an external site.) https://www.myschool.edu/grades.php&studentID=1023426 (Links to an external site.) https://www.myschool.edu/grades.php&studentID=1023427 (Links to an external site.) When she does so, she accesses the records of other students. She closes the records and immediately informs the school principal of the vulnerability. What term best describes Renee's work?

Hub

Repeats all data traffic across all connected ports.

Cross-Certification Certificate

Used when independent CAs establish peer-to-peer trust relationships.

Account Disablement

Used whenever an employee leaves a firm. All associated accounts should be disabled to prevent further access.

SSH, port 22

Valerie wants to replace the telnet access that she found still in use in her organization. Which protocol should she use to replace it, and what port will it run on?

IoC

Vince recently received the hash values of malicious software that several other firms in his industry found installed on their systems after a compromise. What term best describes this information?

API keys

Wendy is scanning cloud-based repositories for sensitive information. Which one of the following should concern her most, if discovered in a public repository?

Face recognition and fingerprint recognition

What are the two most commonly deployed biometric authentication solutions for mobile devices?

PCI DSS

What compliance obligation applies to merchants and service providers who work with credit card information?

HIPAA

What compliance regulation most directly affects the operations of a healthcare provider?

Hypervisor

What component of a virtualization platform is primarily responsible for preventing VM escape attacks?

Tokenization

What data minimization technique replaces personal identifiers with unique identifiers that may be cross-referenced with a lookup table?

Chain of custody

What is the document that tracks the custody or control of a piece of evidence called?

SFlow samples only network traffic, meaning that some detail will be lost.

What is the primary concern with SFlow in a large, busy network?

$500,000

What is the single loss expectancy (SLE)?

Center for Internet Security

What organization is known for creating independent security benchmarks covering hardware and software platforms from many different vendors?

ISACs

What organizations did the U.S. government help create to help share knowledge between organizations in specific verticals?

Identification

What phase in the incident response process leverages indicators of compromise and log analysis as part of a review of events?

PowerShell

What scripting environment is native to Windows systems?

USB-OTG

What standard allows USB devices like cameras, keyboards and flash drives to be plugged into mobile devices and used as they normally would be?

Distributing them in parking lots as though they were dropped

What technique is most commonly associated with the use of malicious flash drives by penetration testers?

Data encryption

What technology uses mathematical algorithms to render information unreadable to those lacking the required key?

Control objectives

What term best describes an organization's desired security state?

Data in motion

What term best describes data that is being sent between two systems over a network connection?

Data controller

What term is given to an individual or organization who determines the reasons for processing personal information?

EDR

What term is used to describe tools focused on detecting and responding to suspicious activities occurring on endpoints like desktops, laptops, and mobile devices?

SOAR

What tool is specifically designed to support incident responders by allowing unified, automated responses across an organization?

Code of conduct

What type of security policy often serves as a backstop for issues not addressed in other policies?

False Rejection

When a biometric system (like fingerprints) fails to let you into a system when it should.

Use of weak encryption

Which of the following is not a typical security concern with MFPs?

Documentation and reporting

Which of the following is not one of the four phases in COOP?

Detail

Which of the following measures is not commonly used to assess threat intelligence?

IPv6's NAT implementation is insecure.

Which of the following statements about the security implications of IPv6 is not true?

Nation-state actors

Which of the following threat actors typically has the greatest access to resources?

Top Secret

Which one of the following U.S. government classification levels requires the highest degree of security control?

Frequent flyer number

Which one of the following data elements is not commonly associated with identity theft?

Tokenization

Which one of the following data protection techniques is reversible when conducted properly?

Port scans

Which one of the following information sources would not be considered an OSINT source?

Separation of duties

__________ requires the participation of two people to perform a single sensitive action.

Port mirror

_______________ sends a copy of all the traffic sent to one switch port to another switch port for monitoring.

802.11b

________________ Wi-Fi standard operates on the 11 Mbit/s and 2.4GHz frequency.

Load balancers

________________ are used to distribute traffic to multiple systems, provide redundancy, and allow for ease of upgrades and patching.

DMZs Demilitarized zones

________________ or ________________ are network zones that contain systems that are exposed to less trusted areas.

Information security policy

_________________ contains a series of documents designed to describe the organization's cybersecurity framework.

Patch management

_________________ ensures that systems and software are up to date helps ensure endpoint security by removing known vulnerabilities.

Loop prevention

_________________ focuses on detecting loops and then disabling ports to prevent the loops from causing issues.

Right-to-audit clauses

__________________ __________________ , which are part of the contract between the cloud service and an organization.

Communication plans

__________________ __________________ are critical to incident response processes.

FTK imager

__________________ __________________ is a free tool for creating forensic images.

Disaster recovery

__________________ __________________ plans define the processes and procedures that an organization will take when a disaster occurs.

Business continuity

__________________ __________________ plans focus on keeping an organizational functional when misfortune or incidents occur.

Hardening

__________________ a system or application involves changing settings on the system to increase its overall level of security and reduce its vulnerability to attack.

Containers

__________________ have grown significantly in use and create new challenges for forensic examiners.

IoT

__________________ is a broad term that describes network-connected devices that are used for automation, sensors, security, and similar tasks.

Configuration management

__________________ tools are one of the most powerful options security professionals and system administrators have to ensure that the multitude of systems in their organizations have the right security settings and to help keep them safe.

Broadcast storm prevention storm control

________________________, sometimes called __________________, prevents broadcast packets from being amplified as they traverse a network.

Nonrepudiation

A term used to describe the condition where a user cannot deny that an event has occurred.

5 GHz Band

802.11a uses frequencies in this band.

WEP

802.11i updates the flawed security deployed in this protocol.

shell

A _________ is a command-line user interface to an operating system.

VPN

A ____________________ is a way to create a virtual network link across a public network that allows the endpoints to act as though they are on the same network.

A load balancer

A dedicated network device that can direct requests to different servers based on a variety of factors.

Router

A device that routes packets based on IP addresses

Geo-Tagging

A feature that can disclose a user's position when sharing photos.

User Habits

A foundational security tool in engaging the workforce to improve the overall security posture of an organization.

Network

A group of two or more computers linked together to share data.

10

Acme Widgets has 10 employees and they all need the ability to communicate with one another using a symmetric encryption system. The system should allow any two employees to securely communicate without other employees eavesdropping. If an 11th employee is added to the organization, how many new keys must be added to the system?

Time of Day Restriction

An access control method that would allow you to control access to records only when someone is scheduled to work.

Protocol

An agreed-upon method of exchanging information between systems.

Kerberos

An authentication model designed around the concept of using tickets for accessing objects.

Pharming

Alaina discovers that someone has set up a website that looks exactly like her organization's banking website. Which of the following terms best describes this sort of attack?

CCMP

Alaina has implemented WPA2 and uses enterprise authentication for access points in infrastructure mode. What encryption protocol is her network using?

Spam over Instant Messaging

Alaina suspects that her organization may be targeted by a SPIM attack. What technology is she concerned about?

Method of transport

Alaina wants to maintain chain of custody documentation and has created a form. Which of the following is not a common element on a chain of custody form?

Standard

Allan is developing a document that lists the acceptable mechanisms for securely obtaining remote administrative access to servers in his organization. What type of document is Allan writing?

A deny list tool

Alyssa wants to prevent a known Microsoft Word file from being downloaded and accessed on devices she is responsible for. What type of tool can she use to prevent this?

SAE

Daniel knows that WPA3 has added a method to ensure that brute-force attacks against weak preshared keys are less likely to succeed. What is this technology called?

Wireshark

Danielle wants to capture traffic from a network so that she can analyze a VoIP conversation. Which of the following tools will allow her to review the conversation most effectively?

Guideline

Joe is authoring a document that explains to system administrators one way in which they might comply with the organization's requirement to encrypt all laptops. What type of document is Joe writing?

Timing-based SQL injection

Joe is examining the logs for his web server and discovers that a user sent input to a web application that contained the string WAITFOR. What type of attack was the user likely attempting?

Directory traversal

Joe's adventures in web server log analysis are not yet complete. As he continues to review the logs, he finds the request http://www.mycompany.com/../../../etc/passwd What type of attack was most likely attempted?

Mandatory vacations

Colin would like to implement a security control in his accounting department that is specifically designed to detect cases of fraud that are able to occur despite the presence of other security controls. Which one of the following controls is best suited to meet Colin's need?

Robotic sentries

Kathleen wants to discourage potential attackers from entering the facility she is responsible for. Which of the following is not a common control used for this type of preventive defense?

Elasticity

Kevin would like to ensure that his software runs on a platform that is able to expand and contract as needs change. Which one of the following terms best describes his goal?

Compare the hashes of the source and target drive.

Maria has acquired a disk image from a hard drive using dd, and she wants to ensure that her process is forensically sound. What should her next step be after completing the copy?

Managerial

Matt is updating the organization's threat assessment process. What category of control is Matt implementing?

SOC 2 Type 1

Darren is working with an independent auditor to produce an audit report that he will share with his customers under NDA to demonstrate that he has appropriate security controls in place. The auditor will not be assessing the effectiveness of those controls. What type of audit report should Darren expect?

Role-Based Access Control (RBAC)

Designed around the type of tasks people perform.

Containerization

Fred's company issues devices in a BYOD model. That means that Fred wants to ensure that corporate data and applications are kept separate from personal applications on the devices. What technology is best suited to meet this need?

Capability

Megan's organization uses the Diamond Model of Intrusion Analysis as part of their incident response process. A user in Megan's organization has discovered a compromised system. What core feature would help her determine how the compromise occurred?

Wireshark

Melissa wants to capture network traffic for forensic purposes. What tool should she use to capture it?

eradication

The __________________ stage involves removing the artifacts associated with the incident.

Certificate Signing Request (CSR)

The actual request to a CA containing a public key and the requisite information needed to generate a certificate.

Certificate Authority (CA)

The actual service that issues certificates based on the data provided during the initial registration process.

Layered Defense

The architecture in which multiple methods of security defense are applied to prevent realization of threat-based risks.

Reverse Social Engineering

The attacker hopes to convince the target to initiate contact.

Use forensic memory acquisition techniques.

Michael wants to acquire the firmware from a running device for analysis. What method is most likely to succeed?

syslog-ng

Michael wants to log directly to a database while also using TCP and TLS to protect his log information and to ensure it is received. What tool should he use?

An allow list application

Michelle wants to prevent unauthorized applications from being installed on a system. What type of tool can she use to allow only permitted applications to be installed?

A bollard

Mike wants to stop vehicles from traveling toward the entrance of his building. What physical security control should he implement?

One system is set to an incorrect time zone.

Isaac is performing a forensic analysis on two systems that were compromised in the same event in the same facility. As he performs his analysis, he notices that the event appears to have happened almost exactly one hour earlier on one system than the other. What is the most likely issue he has encountered?

Routing

Moving packets from source to destination across multiple networks.

PEAP

Isabelle needs to select the EAP protocol that she will use with her wireless network. She wants to use a secure protocol that does not require client devices to have a certificate, but she does want to require mutual authentication. Which EAP protocol should she use?

A walk-through

As part of their yearly incident response preparations, Ben's organization goes through a sample incident step by step to validate what each person will do in the incident. What type of exercise is this?\

Purpose limitation

Asa believes that her organization is taking data collected from customers for technical support and using it for marketing without their permission. What principle is most likely being violated?

Basic Authentication

Authentication that is sent in plaintext with only Base64 encoding.

Access Tokens

Items carried by the user to allow them to be authenticated.

Disable ARP on all accessible ports

James is concerned about preventing broadcast storms on his network. Which of the following solutions is not a useful method of preventing broadcast storms on his network?

Point-to-point

Bart knows that there are two common connection methods between Wi-Fi devices. Which of the following best describes ad hoc mode?

tcpdump

Bart needs to assess whether a three-way TCP handshake is occurring between a Linux server and a Windows workstation. He believes that the workstation is sending a SYN but is not sure what is occurring next. If he wants to monitor the traffic, and he knows that the Linux system does not provide a GUI, what tool should he use to view that traffic?

Firewall

Basic packet filtering occurs here.

Dumpster diving

Ben searches through an organization's trash looking for sensitive documents, internal notes, and other useful information. What term describes this type of activity?

RAID 10

Ben wants to implement a RAID array that combines both read and write performance while retaining data integrity if a drive fails. Cost is not a concern compared to speed and resilience. What RAID type should he use?

LDAPS

Bonita has discovered that her organization is running a service on TCP port 636. What secure protocol is most likely in use?

Removed the vulnerability

Jen identified a missing patch on a Windows server that might allow an attacker to gain remote control of the system. After consulting with her manager, she applied the patch. From a risk management perspective, what has she done?

Structured Threat

Characterized by a greater amount of planning, a longer period of time to conduct the activity, more financial backing to accomplish it, and the possible corruption of, or collusion with, insiders

Information Warfare

Conducted against the information and information-processing equipment used by an adversary.

pathping

Connor believes that there is an issue between his organization's network and a remote web server, and he wants to verify this by checking each hop along the route. Which tool should he use if he is testing from a Windows 10 system?

Lighting

Continuous, standby, Trip, and emergency are all types of __________

A snapshot

Cynthia wants to clone a virtual machine. What should she do to capture a live machine, including the machine state?

dd

Cynthia wants to make an exact copy of a drive using a Linux command-line tool. What command should she use?

Key Management

Required for symmetric encryption.

A captive portal

Jerome wants to allow guests to use his organization's wireless network, but he does not want to provide a preshared key. What solution can he deploy to gather information such as email addresses or other contact information before allowing users to access his open network?

Bridge or Switch

Distributes traffic based on MAC addresses.

Improper error handling

During a web application test, Ben discovers that the application shows SQL code as part of an error provided to application users. What should he note in his report?

Use a degausser.

Elaine wants to securely erase the contents of a tape used for backups in her organization's tape library. What is the fastest secure erase method available to her that will allow the tape to be reused?

SRTP

Elle is implementing a VoIP telephony system and wants to use secure protocols. If she has already implemented SIPS, which other protocol is she most likely to use?

An air gap

Florian wants to ensure that systems on a protected network cannot be attacked via the organization's network. What design technique should he use to ensure this?

Whether the forensic information includes a timestamp

Frank is concerned about the admissibility of his forensic data. Which of the following is not an element he should be concerned about?

On disk

Gabby wants to capture the pagefile for a system. Where will she find the pagefile stored?

RAID 1

Gabby wants to implement a mirrored drive solution. What RAID level does this describe?

POPS, IMAPS, HTTPS

Gary wants to use secure protocols for email access for his end users. Which of the following groups of protocols should he implement to accomplish this task?

RTO

Gene recently conducted an assessment and determined that his organization can be without its main transaction database for a maximum of two hours before unacceptable damage occurs to the business. What metric has Gene identified?

dev. www.mydomain.com

Glenn recently obtained a wildcard certificate for *. mydomain.com . Which one of the following domains would not be covered by this certificate?

Risk transference

Grace's company decided to install the web application firewall and continue doing business. They are still worried about other risks to the information that were not addressed by the firewall and are considering purchasing an insurance policy to cover those risks. What strategy does this use?

All of the above. (It ensures that a vulnerability in a single company's product will not impact the entire infrastructure. If a single vendor goes out of business, the company does not need to replace its entire infrastructure. It means that a misconfiguration will not impact the company's entire infrastructure.)

How does technology diversity help ensure cybersecurity resilience?

All should have equal weight

Howard is assessing the legal risks to his organization based upon its handling of PII. The organization is based in the United States, handles the data of customers located in Europe, and stores information in Japanese datacenters. What law would be most important to Howard during his assessment?

David's private key

If David wishes to digitally sign the message that he is sending Mike, what key would he use to create the digital signature?

Default Deny

Implicit Deny is an operationalization of this principle.

ERM

In an _______________ program, organizations take a formal approach to risk analysis

CASB

Kira would like to implement a security control that can implement access restrictions across all of the SaaS solutions used by her organization. What control would best meet her needs?

White hat

Kolin is a penetration tester who works for a cybersecurity company. His firm was hired to conduct a penetration test against a health-care system, and Kolin is working to gain access to the systems belonging to a hospital in that system. What term best describes Kolin's work?

PSK

Laura wants to deploy a WPA2 secured wireless for her small business, but she doesn't have a RADIUS server set up. If she wants her Wi-Fi to be encrypted, what is her best option for wireless authentication?

A Raspberry Pi

Lucca is prototyping an embedded system and wants to use a device that can run a full Linux operating system so that he can install and use a firewall and other security software to protect a web service he will run on it. Which of the following solutions should he use?

21, 23, and 80

Naomi has discovered the following TCP ports open on a system she wants to harden. Which ports are used for unsecure services and thus should be disabled to allow their secure equivalents to continue to be used? 21 22 23 80 443

Right to forensic examination

Naomi is preparing to migrate her organization to a cloud service and wants to ensure that she has the appropriate contractual language in place. Which of the following is not a common item she should include?

Text message-based phishing

Naomi receives a report of smishing. What type of attack should she be looking for?

A load balancer

Naomi wants to deploy a tool that can allow her to scale horizontally while also allowing her to patch systems without interfering with traffic to her web servers. What type of technology should she deploy?

arp /a

Nick wants to display the ARP cache for a Windows system. What command should he run to display the cache?

Confidentiality

Nolan is writing an after action report on a security breach that took place in his organization. The attackers stole thousands of customer records from the organization's database. What cybersecurity principle was most impacted in this breach?

22

Port _____ is used for Secure Shell (SSH).

389

Port ________ is used for LDAP.

Parameterized queries

Precompiled SQL statements that only require variables to be input are an example of what type of application security control?

BIOS Passwords

Prevents an attacker from making a machine boot from its DVD drive.

$500,000

Questions 3-7 refer to the following scenario: Aziz is responsible for the administration of an e-commerce website that generates $100,000 per day in revenue for his firm. The website uses a database that contains sensitive information about the firm's customers. He expects that a compromise of that database would result in $500,000 of fines against his firm. Aziz is assessing the risk of a SQL injection attack against the database where the attacker would steal all of the customer personally identifiable information (PII) from the database. After consulting threat intelligence, he believes that there is a 5 percent chance of a successful attack in any given year. What is the asset value (AV)?

Risk mitigation

Questions 8-11 refer to the following scenario: Grace recently completed a risk assessment of her organization's exposure to data breaches and determined that there is a high level of risk related to the loss of sensitive personal information. She is considering a variety of approaches to managing this risk. Grace's first idea is to add a web application firewall to protect her organization against SQL injection attacks. What risk management strategy does this approach adopt?

None of the above (which are: SDHCP/ LDAPS/ ARPS)

Randy wants to prevent DHCP attacks on his network. What secure protocol should he implement to have the greatest impact?

Keyspace

Refers to every possible value for a cryptographic key.

The restoration order documentation

Sally is working to restore her organization's operations after a disaster took her datacenter offline. What critical document should she refer to as she restarts systems?

Exploitation

Selah is following the Cyber Kill Chain model and has completed the delivery phase. What step is next according to the Kill Chain?

Cloning

Skimming attacks are often associated with what next step by attackers?

Software-As-A-Service (SaaS)

Software-As-A-Service (SaaS) Offers software to end users from the cloud.

Retention policies

Susan has discovered that an incident took place on her network almost six months ago. As she prepares to identify useful data for the incident, which common policy is most likely to cause her difficulties during her investigation?

Policies

____________ are high-level statements of management intent.


Related study sets

Chapter 8: Distractions Inside and Outside the Vehicle

View Set

AP Psychology: UNIT 10 Test Review

View Set

Business Law - Chapter 5 (Exam #2)

View Set

Exam 1 computer concepts quiz 1 chapter 1

View Set

Review Chapter 5: The Relational Data Model

View Set

U.S. History and Constitution: Chapter 3

View Set

AWS Certified Solutions Architect 851 Q from dathuminh

View Set