Test Questions
place the port numbers in the correct order with their associated protocols -SCP: -POP3: -SNMP: -Telnet:
22 110 161 23
ARP Poisoning / Spoofing
Address Resolution Protocol Poisoning, used with Man-in-the-Middle Attacks at workstations
Which of the following cryptographic algorithms is classified as symmetric?
Advanced Encryption Standard (AES)
What tool is used to collect wireless packet data?
Aircrack-ng
You are trying to select the best device to install to proactively stop outside attackers from reaching your internal network. Which of the following devices would be the BEST for you to select?
An intrusion prevention system (IPS)
Infrastructure as a Service (IaaS)
Blank hardware to use for whatever
Dion Training has contracted a software development firm to create a bulk file upload utility for its website. During a requirements planning meeting, the developers asked what type of encryption is required for the project. After some discussion, Jason decides that the file upload tool should use a cipher capable of encrypting 8 bits of data at a time before transmitting the files from the web developer's workstation to the webserver. What of the following should be selected to meet this security requirement?
Block Cipher
You are attending a cybersecurity conference and just watched a security researcher demonstrating the exploitation of a web interface on a SCADA/ICS component. This caused the device to malfunction and be destroyed. You recognize that the same component is used throughout your company's manufacturing plants. Which of the following mitigation strategies would provide you with the most immediate protection against this emergent threat?
Block the web interface if it isn't needed for the system to function
DNS Poisoning
Changing IP Addresses on DNS Servers sending users to the wrong destination
Which of the following elements is LEAST likely to be included in an organization's data retention policy?
Classification of information
What sanitization technique uses only logical techniques to remove data, such as overwriting a hard drive with a random series of ones and zeroes?
Clear
You are conducting an incident response and have traced the attack source to some compromised user credentials. After performing log analysis, you discover that the attack was successfully authenticated from an unauthorized foreign country. Your management is now asking for you to implement a solution to help mitigate this type of attack from occurring again. Which of the following should you implement?
Context-based authentication
XSRF / CSRF (Sea Surf)
Cross-site Request Forgery
Which of the following describes the overall accuracy of a biometric authentication system?
Crossover Error Rate (CER)
Which of the following cryptographic algorithms is classified as asymmetric?
DSA (Digital Signature Algorithm)
When your credit card data is written to the customer invoicing system at Dion Training, the first 12 digits are replaced with an x before storing the data. Which of the following privacy methods is being used?
Data masking
Your organization has recently suffered a data breach due to a server being exploited. As a part of the remediation efforts, the company wants to ensure that the default administrator password on each of the 1250 workstations on the network is changed. What is the easiest way to perform this password change requirement?
Deploy a new group policy
Sarah is working at a startup that is focused on making secure banking apps for smartphones. Her company needs to select an asymmetric encryption algorithm to encrypt the data being used by the app. Due to the need for high security of the banking data, the company needs to ensure that whatever encryption they use is considered strong, but also need to minimize the processing power required since it will be running on a mobile device with lower computing power. Which algorithm should Sarah choose to provide the same level of high encryption strength with a lower overall key length?
Elliptic curve cryptography (ECC)
What is used as a measure of biometric performance to rate the system's ability to correctly authenticate an authorized user by measuring the rate that an unauthorized user is mistakenly permitted access?
False acceptance rate (FAR)
Which law requires government agencies and other organizations that operate systems on behalf of government agencies to comply with security standards?
Federal Information Security Management Act (FISMA)
Vulnerability scans must be conducted continuously to meet regulatory compliance requirements for the storage of PHI. During the last vulnerability scan, a cybersecurity analyst received a report of 2,592 possible vulnerabilities and was asked by the Chief Information Security Officer (CISO) for a plan to remediate all the known issues. Which of the following should the analyst do next?
Filter the scan results to include only those items listed as critical in the asset inventory and remediate those vulnerabilities first
You have been hired as a cybersecurity analyst for a privately-owned bank. Which of the following regulations would have the greatest impact on your bank's cybersecurity program?
GLBA (Gramm-Leach-Bliley Act)
Which of the following security controls provides Windows system administrators with an efficient way to deploy system configuration settings across many devices?
GPO (Group Policy Object)
IoT
Internet of Things, Light bulbs, Cameras, Smartphones, eta.
Replay Attacks / Pass the Hash
It's replaying data a user sent earlier to gain access, salting prevents this.
You are the first forensic analyst to arrive on the scene of a data breach. You have been asked to begin evidence collection on the server while waiting for the rest of your team to arrive. Which of the following evidence should you capture first?
L3 Cashe
Which of the following is NOT considered part of the Internet of Things?
Laptop
Nicole's organization does not have the budget or staff to conduct 24/7 security monitoring of their network. To supplement her team, she contracts with a managed SOC service. Which of the following services or providers would be best suited for this role?
MSSP (managed security service provider)
Salting
Makes passwords different every time on a network.
MTD
Maximum Tolerable Downtime
MTBF
Mean Time Between Failures
MTTF
Mean Time to Failure
Which operating system feature is designed to detect malware that is loaded early in the system startup process or before the operating system can load itself?
Measured boot
Which of the following tools is useful for capturing Windows memory data for forensic analysis?
Memdump
What tool can be used to scan a network to perform vulnerability checks and compliance auditing?
Nessus
Dion Training utilizes a wired network throughout the building to provide network connectivity. Jason is concerned that a visitor might plug their laptop into a CAT 5e wall jack in the lobby and access the corporate network. What technology should be utilized to prevent users from gaining access to network resources if they can plug their laptops into the network?
Network Access Control (NAC)
Something you know
PIN
Which cloud computing concept is BEST described as focusing on replacing the hardware and software required when creating and testing new applications and programs from a customer's environment with cloud-based resources?
PaaS (Platform as a Service)
Your company is setting up a system to accept credit cards in their retail and online locations. Which of the following compliance types should you be MOST concerned with dealing with credit cards?
Payment Card Industry Data Security Standard (PCI DSS)
Your firewall is blocking outbound email traffic that is attempting to be sent. Which port should you verify is set to ALLOW in the firewall to ensure your emails are being sent?
Port 25
You suspect that your server has been the victim of a web-based attack. Which of the following ports would most likely be seen in the logs to indicate the attack's target?
Port 443 (HTTPS)
Which type of media sanitization would you classify degaussing as?
Purging
Which of the following cryptographic algorithms is classified as stream cipher?
RC4, or Rivest Cipher 4
Which of the following cryptographic algorithms is classified as symmetric?
RC4, or Rivest Cipher 4
Which of the following cryptographic algorithms is classified as asymmetric?
RSA (Rivest-Shamir-Adleman)
Frank and John have started a secret club together. They want to ensure that when they send messages to each other, they are truly unbreakable. What encryption key would provide the STRONGEST and MOST secure encryption?
Randomized one-time use pad
RPO
Recovery Point Objective
RTO
Recovery Time Objective
Which party in a federation provides services to members of the federation?
Relying parties (RPs)
RAT
Remote Access Trojan
Pharming
Reroutes requests for legitimate websites to false websites
What term describes the amount of risk an organization is willing to accept?
Risk appetite
Which of the following hashing algorithms results in a 160-bit fixed output?
SHA-1
Which of the following hashing algorithms results in a 256-bit fixed output?
SHA-2
During her login session, Sally is asked by the system for a code sent to her via text (SMS) message. Which of the following concerns should she raise to her organization's AAA services manager?
SMS messages may be accessible to attackers via VoIP or other systems
Which of the following does a User Agent request a resource from when conducting a SAML transaction?
SP (service provider)
Which cloud computing concept is BEST described as focusing on the replacement of applications and programs on a customer's workstation with cloud-based resources?
SaaS (Software as a Service)
Cloud Access Security Broker (CASB)
Security for cloud servers and on-premise
Which of the following protocols is commonly used to collect information about CPU utilization and memory usage from network devices?
Simple Network Management Protocol (SNMP)
You are troubleshooting a network connectivity issue and need to determine the packet's flow path from your system to the remote server. Which of the following tools would best help you identify the path between the two systems?
TRACERT (trace route)
Bluebugging
Taking over mobile/smartphone
Bluesnarfing
Theft of info from mobile/smartphone
Which of the following features is supported by Kerberos but not by RADIUS and Diameter?
Tickets used to identify authenticated users. Kerberos is all about 'tickets.'
Which of the following methods is used to replace all or part of a data field with a randomly generated number used to reference the original value stored in another vault or database?
Tokenization
Which of the following cryptographic algorithms is classified as symmetric?
Twofish
Your organization has recently been the target of a spearphishing campaign. You have identified the website associated with the link in the spearphishing emails and want to block it. Which of the following techniques would be the MOST effective in this situation?
URL filter
Rogue Access Point (Rogue AP)
Unauthorized device on a network
Evil Twin
Unauthorized device pretending to be a known device
BlueJacking
Unauthorized texts sent to/from a mobile/smartphone
Session Hijacking
Using a similarly spelled Address
You have been investigating how a malicious actor could exfiltrate confidential data from a web server to a remote host. After an in-depth forensic review, you determine that a rootkit's installation had modified the web server's BIOS. After removing the rootkit and reflash the BIOS to a known good image, what should you do to prevent the malicious actor from affecting the BIOS again?
Utilize secure boot
Which of the following is not normally part of an endpoint security suite?
VPN
Riaan's company runs critical web applications. During a vulnerability scan, Riaan found a serious SQL injection vulnerability in one of their web applications. The system cannot be taken offline to remediate the vulnerability. Which of the following compensating controls should Riaan recommend using until the system can be remediated?
WAF (web application firewall)
You are trying to find a rogue device on your wired network. Which of the following options would NOT help find the device?
War walking (walking around a build while locating wireless networks and devices)
You have been asked to scan your company's website using the OWASP ZAP tool. When you perform the scan, you received the following warning: "The AUTOCOMPLETE output is not disabled in HTML FORM/INPUT containing password type input. Passwords may be stored in browsers and retrieved." You begin to investigate further by reviewing a portion of the HTML code from the website that is listed below: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- <form action="authenticate.php"> Enter your username: <BR> <input type="text" name="user" value="" autofocus><BR> Enter your Password: <BR> <input type="password" name="pass" value="" maxlength="32"><BR><input type="submit" value="submit"> </form>-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Based on your analysis, which of the following actions should you take?
You tell the developer to review their code and implement a bug/code fix
Every new employee at Dion Training must sign a document to show they understand the proper rules for using the company's computers. This document states that the new employee has read the policy that dictates what can and cannot be done from the corporate workstations. Which of the following documents BEST describes this policy?
acceptable use policy (AUP)
Sofware as a Service (SaaS)
access thru web like Gmail, Office 365
Platform as a Service (PaaS)
barrow a cloud server to make apps
Alexa is an analyst for a large bank that has offices in multiple states. She wants to create an alert to detect if an employee from one bank office logs into a workstation located at an office in another state. What type of detection and analysis is Alexa configuring?
behavior-based detection
A hacker successfully modified the sale price of items purchased through your company's web site. During the investigation that followed, the security analyst has verified the web server, and the Oracle database was not compromised directly. The analyst also found no attacks that could have caused this during their log verification of the Intrusion Detection System (IDS). What is the most likely method that the attacker used to change the items' sale price?
changing hidden form values
During your annual cybersecurity awareness training in your company, the instructor states that employees should be careful about what information they post on social media. According to the instructor, if you post too much personal information on social media, such as your name, birthday, hometown, and other personal details, it is much easier for an attacker to conduct which type of attack to break your passwords?
cognitive password attack
A financial services company wants to donate some old hard drives from their servers to a local charity. The hard drives used in the servers are self-encrypting drives. Still, they are concerned about the possibility of residual data being left on the drives. Which of the following secure disposal methods would you recommend the company use?
cryptographic erase (CE)
A cybersecurity analyst is reviewing the logs of a proxy server and saw the following URL, http://test.diontraining.com/../../../../etc/shadow. What type of attack has likely occurred?
directory traversal manipulates variables or URLs that reference files with "dot-dot-slash (../)
A supplier needs to connect several laptops to an organization's network as part of their service agreement. These laptops will be operated and maintained by the supplier. Victor, a cybersecurity analyst for the organization, is concerned that these laptops could contain some vulnerabilities that could weaken the network's security posture. What can Victor do to mitigate the risk to other devices on the network without having direct administrative access to the supplier's laptops?
implement a jump box system
During a penetration test, you find a hash value related to malware associated with an APT. What best describes what you have found?
indicator of compromise
Dion Training has added a salt and cryptographic hash to their passwords to increase the security before storing them. To further increase security, they run this process many times before storing the passwords. What is this technique called?
key stretching
MTTR
mean time to repair / replace
What popular open-source port scanning tool is commonly used for host discovery and service identification?
nmap
What type of malware changes its binary pattern in its code on specific dates or times to avoid detection by antimalware software?
polymorphic virus
An attacker uses the nslookup interactive mode to locate information on a Domain Name Service (DNS). What command should they type to request the appropriate records for only name servers?
set type=ns
You are performing a web application security test, notice that the site is dynamic, and must be using a back-end database. You decide you want to determine if the site is susceptible to a SQL injection. What is the first character that you should attempt to use in breaking a valid SQL request?
single quote
Something you have
smart card, token
Which of the following is the most important feature to consider when designing a system on a chip?
space and power savings
Aymen is creating a procedure for the remediation of vulnerabilities discovered within his organization. He wants to ensure that any vendor patches are tested before deploying them into the production environment. What type of environment should his organization establish?
staging
You are conducting a routine vulnerability scan of a server when you find a vulnerability. You locate a patch for the vulnerability on the software vendor's website. What should you do next?
summit a Request fir Change using the change management process
Which of the following must be combined with a threat to create risk?
vulnerability
A new security appliance was installed on a network as part of a managed service deployment. The vendor controls the appliance, and the IT team cannot log in or configure it. The IT team is concerned about the appliance receiving the necessary updates. Which of the following mitigations should be performed to minimize the concern for the appliance and updates?
vulnerability scanning
Your company just launched a new invoicing website for use by your five largest vendors. You are the cybersecurity analyst and have been receiving numerous phone calls that the webpage is timing out, and the website overall is performing slowly. You have noticed that the website received three million requests in just 24 hours, and the service has now become unavailable for use. What do you recommend should be implemented to restore and maintain the availability of the new invoicing system?
whitelisting
Re-imaging
wiping a pc
What should be done NEXT if the final set of security controls does not eliminate all of the risks in a given system?
you should accept the risk if the residual risk is low enough
