Jeopardy

Front 1

Describe the importance of enacting and maintaining a clean desk policy

Back 1

Avoid passwords and sensitive data from being unsecured

Front 2

Matt, a security technician, is using TFTP. Which port number is used for TFTP?

Back 2

69

Front 3

What system implements a secure key distribution system that relies on hardcopy keys intended for individual sessions?

Back 3

One-time pad

Front 4

What, when used in conjunction with software-based encryption, enhances platform authentication by storing unique RSH Keys and provides crypto processing?

Back 4

TPM

Front 5

For what reason would Pete, a security administrator, implement Kerberos over local system authentication?

Back 5

Authentication to multiple devices

Front 6

What would Pete, a security technician, most likely use to secure the creation of cryptographic keys?

Back 6

Trusted Platform Module

Front 7

What is most likely to reduce the threat of a zero day vulnerability?

Back 7

Disabling unnecessary services

Front 8

What has the capability to perform onboard cryptographic functions?

Back 8

Smart card

Front 9

Matt, a security administrator, discovers that server1 and server2 have been compromised, and then he observers unauthorized ongoing connections from server1 to server2. On server1 there is a executable named tcpdump and several files that appear to be network dump files. Finally, there are unauthorized transactions in the database on server2. What has most likely occurred?

Back 9

A replay attack has been used against server2

Front 10

What is most relevant for Jane, a security administrator, to use when investigating a SQL injection attack?

Back 10

Stored procedures

Front 11

Pete, a system administrator, was recently laid off for compromising various accounting systems within the company. A few month later, the finance department reported their applications were not working correctly. Upon further investigation, it was determined that unauthorized accounting software was installed onto a financial system and several application exploits existed within that system. That is an example of what?

Back 11

Trojan horse

Front 12

Monitoring data streams for malicious code and behavior is a process known as

Back 12

Content inspection

Front 13

Reviewing an access control list on a firewall reveals a drop all statement at the end of the rules. What form of access control does this describe?

Back 13

Implicit deny

Front 14

An administrator is taking an image of a server and converting it to a virtual instance. What best describes the information security requirements of a virtualized server?

Back 14

Virtual servers have the same information security requirements as physical servers

Front 15

Webmail is classified under which of the following cloud-based technologies?

Back 15

Software as a service (SAAS)

Front 16

A security engineer is troubleshooting a server in the DMZ, which cannot be reached from the internet or the internal network. All other servers on the DMZ are able to communicate with this server. What is most likely the cause?

Back 16

The server is missing the default gateway

Front 17

What can cause a user, connected to a NAC-enabled network, to not be promoted for credentials?

Back 17

The users PC is missing the authentication agent

Front 18

What would be implemented to allow access to services while segmenting access to the internal network?

Back 18

DMZ

Front 19

A security administrator needs to separate two departments. What would the administrator implement to perform this?

Back 19

VLAN

Front 20

What security control is lost when using cloud computing?

Back 20

Physical control of the data

Front 21

Which of protocol should be blocked at the network perimeter to prevent host enumeration by sweep devices?

Back 21

ICMP

Front 22

What uses TCP Port 22 by default?

Back 22

SSH, SCP, and SFTP

Front 23

What allows a security administrator to set device traps?

Back 23

SNMP

Front 24

A security administrator needs to implement a site-to-site VPN tunnel between the main office and a remote branch. What protocol should be used for the tunnel?

Back 24

IPSEC

Front 25

What protocol would be the most secure method to transfer files from a host machine?

Back 25

SFTP

Front 26

What port number should be used for SCP by default?

Back 26

22

Front 27

What is the most secure method of utilizing FTP?

Back 27

FTPS

Front 28

What protocol can be implemented to monitor network devices?

Back 28

SNMP

Front 29

What protocol would an administrator most likely use to monitor the parameters of network devices?

Back 29

SNMP

Front 30

A remote office is reporting they are unable to access any of the network resources from the main office. The security administrator realized the error and corrects it. The administrator then tries to ping the router at the remote office and receives no reply; However, the technician is able to telnet to that router. What is most likely the cause of the security administrator being unable to ping the router?

Back 30

The remote router has ICMP Blocked

Front 31

A network administrator is implementing a network addressing scheme that uses a long string of both numbers and alphanumeric characters to create addressign options and avoid duplicates. What describes a protocol built for this purpose?

Back 31

IPv6

Front 32

Where would a forensic analyst look to find a hooked process?

Back 32

BIOS

Front 33

What file transfer protocol is an extension of SSH?

Back 33

SFTP

Front 34

What secure protocol is most commonly used to remotely administer UNIX/LINUX systems?

Back 34

SSH

Front 35

The security administrator notices a number of TCP connections from the development department to the test network segregation. Large volumes of data are being transmitted between the two networks only on port 22. What is most likely occurring?

Back 35

The development team is transferring data to test systems using SFTP and SCP

Front 36

An administrator who wishes to block all database ports at the firewall should include which port in the block list?

Back 36

1433

Front 37

If a security administrator wants to telnet into a router to make configuration changes, which port would need to be open by default?

Back 37

23

Front 38

Which port would a security administrator block if the administrator wanted to stop users from accessing outside SMTP services?

Back 38

25

Front 39

Which of the following describes when forensic hashing should occur on a drive

Back 39

Before and afterthe imaging process and then hash the forensic image

Front 40

What assists in identifying if a system was properly handled during transport?

Back 40

Chain of custody

Front 41

What describes the purpose of chain of custody as applied to forensic image retention?

Back 41

To provide documentation as to who has handled the evidence

Front 42

What policy would force all users to organize their areas as well as help in reducing the risk of possible data theft?

Back 42

Clean desk policy

Front 43

What will educate employees about malicious attempts from an attacker to obtain bank account information?

Back 43

Phishing techniques

Front 44

What is a reason to perform user awareness and training?

Back 44

To minimize the organizational risk posed by users

Front 45

Used in conjunction, which of the following are PII?

Back 45

Birthday and full name

Front 46

On-going annual awareness security training should be coupled with

Back 46

Signing a user agreement

Front 47

Which of the following risks may result from improper use of social networking and P2P software?

Back 47

Information disclosure

Front 48

Main reason to require data labeling

Back 48

To ensure that staff understands what data they are handling and processing

Front 49

What should DRPs contain?

Back 49

Hierarchical list of critical systems

Front 50

Recovery point objects and recovery time objectives directly relate to which BCP concept?

Back 50

Business impact analysis

Front 51

A security firm has been engaged to assess a software application. A production-like test environment, login details, production documentation and source code have been provided. What type of testing is being described?

Back 51

White Box

Front 52

Which environmental control would best be used to regulate coding within a datacenter?

Back 52

Hot and cold aisles

Front 53

Which environmental variable reduces the potential for static discharges?

Back 53

Humidity

Front 54

What should be considered when trying to prevent somebody from capturing network traffic?

Back 54

EMI shielding

Front 55

With which of the following is RAID most concerned?

Back 55

Availability

Front 56

What reduces the likelihood of a single point of failure when a server fails?

Back 56

Clustering

Front 57

What is the best way to secure data for the purpose of retention?

Back 57

Off-site backup

Front 58

A security administrator is tasked with ensuring that all servers are highly available and that hard drive failure will not affect an individual server. Which configuration will allow for high availability?

Back 58

Hardware RAID 5
Software RAID 1

Front 59

A security administrator is in charge of a datacenter, a hot site and a cold site. Due to a recent disaster, the administrator needs to ensure that their cold site is ready to go in case of a disaster. What does the administrator need to ensure is in place for a cold site?

Back 59

Location that meets power and connectivity requirements

Front 60

A critical system in the datacenter is not connected to a UPS. The security administrator has coordinated an authorized service interruption to resolve this issue. This is and example of

Back 60

Fault tolerance

Front 61

In order to ensure high availability of all critical servers, backups of the main datacenter are done in the middle of the night and then the backup tapes are taken to an offsite location. What would ensure the minimal amount of downtime in the case of a disaster?

Back 61

Having the offsite location of tapes also be the hot site

Front 62

What concept ensures that the data is only viewable to authorized users?

Back 62

Confidentiality

Front 63

A security administrator working for a health insurance company needs to protect customer data by installing an HVAC system and a man trap in the datacenter. What is being addressed?

Back 63

Confidentiality and Availability

Front 64

A bulk update process fails and writes incorrect data throughout the database. What concept describes what has been compromised?

Back 64

Integrity

Front 65

What is an unauthorized wireless router that allows access to a secure network?

Back 65

Rouge access point

Front 66

A security administrator performs several war driving routes each month and recently has noticed a certain area with a large number of unauthorized devices. Which attack types is most likely occurring?

Back 66

Rouge access point

Front 67

Proper wireless antenna placement and radio power setting reduces the success of which of the following reconnaissance methods?

Back 67

War driving

Front 68

A rouge access point with the same SSID as the production wireless network is found. Which of the following best describes this attack?

Back 68

Evil twin

Front 69

A programmer allocates 16 bytes for a string variable, but does not adequately ensure that more than 16 bytes cannot be copied into the variable. This program may be vulnerable to what type of attack?

Back 69

Buffer overflow

Front 70

What must a programmer implement to prevent cross-site scripting?

Back 70

Validate input to remove hypertext

Front 71

What web application security weakness can be mitigated by preventing the use of html taos?

Back 71

Cross-site scripting

Front 72

During analysis of malicious code, a security analyst discovers java script being used to send random data to another service on the same system. This is most likely and example of what ?

Back 72

Buffer overflow

Front 73

Which attack is manifested as an embedded html image object or javascript image tag in an e-mail?

Back 73

Cross-site scripting

Front 74

A web application has been found to be vulnerable to a SQL injection attack. What best describes the required remediation action?

Back 74

Add input validation to forms

Front 75

An application log shows that the text "test; rm -r, /etc/passwd" was entered into an html form. What describes the type of attack that was attempted?

Back 75

Command injection

Front 76

What is most relevant to a buffer overflow attack?

Back 76

NOOP Instructions

Front 77

The detection of a NOOP SLED is an indication of what attack?

Back 77

Buffer overflow

Front 78

What device best allow a security administrator to identify malicious activity after it has occurred?

Back 78

IDS

Front 79

What should be enabled to ensure only certain wireless clients can access the networks?

Back 79

MAC filtering

Front 80

What best describes an intrusion prevention system?

Back 80

A system that stops an attack in progress