Security + 401

Front 1

3 types of access controls:

Back 1

type 1: what you have(lock and key, CaC)

type 2: what you know ( information, passwords)

type 3: what you are (biometrics)

Front 2

What is accountability?

Back 2

the idea that user should be accountable to the actions performed under his/her name.

Front 3

What is Kerberos?

Back 3

Client sends login information to KDC (Key Distribution Center), which verifies a clients credentials and sends request to TGS (ticket granting server), followed by a TGT (ticket granting ticket) to the client.

Front 4

What is an SYN flood?

Back 4

Sending TCP packets to deny availability

Front 5

What is an ICMP flood?

Back 5

Sending ICMP (usually ping) packets to deny availability.

Front 6

What is smurfing?

Back 6

A special ICMP flood attack that braodcasts ICMP requests.

Front 7

Buffer Overflow:

Back 7

Sending a malformed packet that overflows a memory address to deny availability and possibly gain privileges

Front 8

Backdoor:

Back 8

Gain access through a secret program (ex. trojan horse)

Front 9

Sniffing:

Back 9

Read information off the network

Front 10

Spoofing:

Back 10

Hiding or disguising an address to make it appear that the requests come from another source.

Front 11

Man n the middle

Back 11

Intercepting packets and changing the contents. (denies confidentiality and integrity.)

Front 12

Replay

Back 12

session key sniffed and then used.

Front 13

How does a virus propagate?

Back 13

through user action, usually by email.

Front 14

How does a worm propagate?

Back 14

self-propagating and uses exploits

Front 15

L2TP operates on the _____ layer.

Back 15

Data-Link

Front 16

IPSec operates on the ____ layer and has 2 protocols: ____ and ___.

Back 16

network layer, AH and ESP

Front 17

what are S/MIME, MOSS. PEM and PGP?

Back 17

email security programs.

Front 18

What is an applet?

Back 18

Programs that run in a browser such as Java and activeX.

Front 19

what is the difference between S-HTTP and SSL?

Back 19

S-HTTP is connectionless while SSL is connection oriented.

Front 20

What does disk spanning allow?

Back 20

Allows a file system to be spread over multiple physical drives.

Front 21

What is WTLS?

Back 21

WAP's built in security system and operates over TLS

Front 22

What is WEP?

Back 22

a weak security system for wireless LANs and operates on layers 1 and 2 (physical and data)

Front 23

What is cladding?

Back 23

the glass insulator in the fiber optic cable

Front 24

What is the key anagement protocol that uses EAP?

Back 24

802.1x

Front 25

Which type of cabling is said to be shielded against EMI?

Back 25

STP cabling

Front 26

Circuit level gateway:

Back 26

Maintains state information (connection based)

Front 27

Application level gateway:

Back 27

examines each packet coming in for content

Front 28

What is a proxy server?

Back 28

special application level gateway that ensures no direct connection between an untrusted and trusted network.

Front 29

What is an ACL?

Back 29

the list that defines the rules that a packet filtering firewall follows

Front 30

Screening router:

Back 30

a router between the trusted and untrusted

Front 31

Screened host gateway

Back 31

A bastion host that can examine traffic between trusted and untrusted

Front 32

Dual-homed gateway

Back 32

a bastion host and router between trusted and untrusted

Front 33

Screened subnet:

Back 33

A bastion host (DMZ zone) between two routers

Front 34

Whats the difference between and active IDS and a passive IDS?

Back 34

active finds and attempts to circumvent threats, a passive finds threats and alerts administrator

Front 35

How does a host based IDS operate?

Back 35

requires special software to be installed on each node

Front 36

Knowledge based IDS:

Back 36

works using signatures and known attacks

Front 37

Behavior based IDS:

Back 37

works by analyzing baseline v.s real time network traffic

Front 38

what is relaying?

Back 38

the behavior of SMTP servers that will send a message from any source (should be disabled)

Front 39

What do anonymous services do?

Back 39

allow access without authentication

Front 40

What is AES>

Back 40

a symmetric algorithm based on Rijndael Block Cipher

Front 41

What do block ciphers do?

Back 41

Encrypt clear text block by block while stream ciphers encrypt in real time

Front 42

Name some symmetrical algorithms

Back 42

DES, 3DES, AES and IDEA

Front 43

Name some asymmetric algorithms

Back 43

Diffie-Hellman, RSA and El Gamel

Front 44

What are the three types of backups?

Back 44

Full, Differential and Incremental

Front 45

What is a differential backup?

Back 45

Only the data that has changed since the last full backup was done is backed up

Front 46

What is an incremental backup?

Back 46

Only the data that has changed since the last incremental or full backup is backed up

Front 47

What is MTD?

Back 47

Maximum tolerable downtime- the greatest amount of time a system can withstand being un-operational

Front 48

DES:

Back 48

sym. 64 bit (56+8 parity) very weak 3DES

Front 49

3DES

Back 49

sym. 192 bit (168bit + 24 parity) Moderate AES

Front 50

AES

Back 50

sym. Variable (128, 192, 256) strong N/A

Front 51

El Gamel

Back 51

N/A very strong

Front 52

MD5 Hash

Back 52

Rivest MD5 block hash 512 bit block processing/128 it digest strong MD6

Front 53

SHA-1

Back 53

512 bit processing/160 bit digest very strong

Front 54

That is CCMP?

Back 54

counter mode with cipher block chaining messaging authentication code protocol.

a wrapper that uses 128 bit AES encryption

Front 55

An achievement providing worldwide internet security was the signing of certificates associated with which protocol?

Back 55

SSL

Front 56

A chief Information Security officer (CISO) wants to implement two-factor authentication within the company. What will fulfill his requirements?

Back 56

USB token and PIN

Front 57

What can a security administrator implement on mobile devices that will help prevent unwanted people from viewing the data if the device is left unattended?

Back 57

screen lock

Front 58

What would a security manager implement in order to ID a problem between two systems that are not communication properly?

Back 58

Protocol analyzer

Front 59

What can result in significant administrative overhead from incorrect reporting?

Back 59

false positives

Front 60

A security admin wants to perform routine tests in the network during working hours when certain apps are being accessed. What will allow the S.A. to test the lack of security controls for those applications with the least impact to the system?

Back 60

vulnerability scan

Front 61

What risk concept requires an organization to determine the number of failures per year?

Back 61

ALE

Front 62

A system security analyst using an enterprise monitoring tool notices an unknown internal host exfiltrating files to several foreign IP addresses. What would be an appropriate mitigation technique?

Back 62

rogue machine detection

Front 63

what are three primary security control types that can be implemented?

Back 63

operational, technical, and management

Front 64

The helpdesk reports increased call from clients reporting spiked in malware infections on their systems. What phases of incident response is MOST appropriate as a first response?

Back 64

Identification

Front 65

What are the steps to incident response?

Back 65

Identification, Containment, Validation, Eradication, Recovery, Follow-up.

Front 66

Which protocol operates at the highest level of the OSI model?

Back 66

SCP

Front 67

Joe, the S.A has been asked to calculate the annual loss expectancy (ALE) for a $5000 dollar server, which often crashes. In the past year, the server crashed 10 times, requiring a system reboot to recover with only 10% loss of data or function. What is the ALE of this server?

Back 67

$5000

Front 68

What should an administrator implement to research current attack methodologies?

Back 68

Honeypot

Front 69

What can be implemented in hardware or software to protect a web server from cross-site scripting attacks?

Back 69

Web application firewall

Front 70

Which means of wireless authentication is easily vulnerable to spoofing?

Back 70

MAC filtering

Front 71

The BEST methods for a web developer to prevent the website application code from being vunerable to cross=site request (XSRF) are to ____ and ____.

Back 71

validate and filter input on the server side and the client side; restrict and sanitize use of special characters in input and URLs

Front 72

Jane, a security administrator, needs to implement a secure wireless authentication method uses a remoter RADIUS server for authentication. Which method should Jane use?

Back 72

LEAP

Front 73

Computer evidence at a crime scene is documented with a tag stating who had possession of the evidence at a given time. What does this illustrate?

Back 73

chain of custody

Front 74

A net admin is configuring access control foe the sale department which has high employee turnover. What is BEST suited when assigning user rights to individuals in the sales department?

Back 74

group based privileges

Front 75

What is being tested when a company's payroll server is powered off for eight hours?

Back 75

continuity of operations plan

Front 76

A security analyst is reviewing an IRC channel and notices that a malicious exploit has been created for a frequently used application. She notifies the software vendor and asks them for remediation steps, but is alarmed to find that no patches are available to mitigate this vulnerability. What is the best description of this exploit?

Back 76

Zero-day exploit

Front 77

A security admin has concerns about new types of media which allow for the mass distribution of personal comments to a select group of people. To mitigate the risks involved with this media, employees should receive training on what?

Back 77

social networking

Front 78

A net admin is responsible for securing applications against external attacks. Every month, the underlying operating system is updated. There is no process in lace for the other software updates. What could MOST effectively mitigate these risks?

Back 78

Application patch management

Front 79

A network engineer is designing a secure tunneled VPN. Which protocol would be the MOST secure?

Back 79

IPSec

Front 80

Which implementation steps would be appropriate for a public wireless hot spot?

Back 80

open system authentication

Front 81

An integral step in deploying a WPA=2 enterprise wireless network

Back 81

install a digital certificate on the authentication server

Front 82

Which control would allow a company to reduce the exposure of sensitive systems from unmanaged devices on internal networks>

Back 82

802.1x

Front 83

What preventative control would be appropriate for responding to a directive to reduce the attack surface of a specific host?

Back 83

disabling unnecessary services

Front 84

A security manager must remain aware of the security posture of each system. What would support that requirement?

Back 84

Establishing baseline reporting

Front 85

deploying a wildcard certificate is one strategy to do what?

Back 85

reduce the certificate management burden

Front 86

Th security admin needs to manage traffic on a layer 3 device to support FTP from a new remote site. What would need to be implemented?

Back 86

access control lists

Front 87

Which port is used for SSH by default

Back 87

22

Front 88

A network admin has been tasked with securing the WLAN. Which cryptographic product would be used to provide the MOST secure environment for the WLAN?

Back 88

WPA2 CCMP

Front 89

A server with an IP address of 10.10.2.4 has been having intermittent connection issues. The logs show repeated connection attempts from the following IPs: 10.10.3.16, 10.10.3.23, 212.178.24.26, and 217.24.94.83.

These attempts are overloading the server to the point that it cannot respond to traffic. Which attack is occurring?

Back 89

DDoS

Front 90

Which cipher would be best used to encrypt streaming video?

Back 90

RC4

Front 91

A user attempting to log on to a workstation for the first time is prompted for the following info before being granted access: username, password, and 4 digit pin that was mailed to him during account registration. This is an example of what?

Back 91

single factor authentication

Front 92

After analyzing and correlating activity from multiple sensors, the security admin has determined that a group of very well organized individuals from an enemy country is responsible for various attempts to breach the compay network, through the use of a very sophisticated and targeted attacks. This is an example of____.

Back 92

advanced persistent threat

Front 93

true/false:

In a client-server architecture, when data integrity is critical to the organization, input validation should be performed on the server side.

Back 93

true

Front 94

A merchant acquirer has the need to store credit card numbers in a transitional database in a high performance environment. What best protects the credit card data?

Back 94

database field encryption

Front 95

A bank has a fleet of aging payment terminals used by merchants for transactional processing. The terminals currently support single DES but require an upgrade in order to be compliant with security standards. What is likely to be the simplest upgrade to the aging terminals which will improve in-transit protection of the transactional data?

Back 95

3DES

Front 96

What is the BEST at blocking and providing security at layer 7 of the OSI model?

Back 96

WAF

Front 97

What is BEST used to capture and alayze network traffic between hosts on the same network segment?

Back 97

protocol analyzer

Front 98

After a number of highly publicized and embarrassing customer data leaks as a result os social engineering attacks by the phone, the chief information officer (CIO) has decided the user training will reduce the risk of another data leak. What would be the MOST effective in reducing data leaks in this situation?

Back 98

Information Security Awareness

Front 99

What function provides an output which cannot be reversed and converts data into a string of characters?

Back 99

hashing

Front 100

What encrypts data a singlel bit at a time?

Back 100

stream cipher

Front 101

what is used to verify data integrity?

Back 101

SHA

Front 102

by default, TCP port 22 is used by ____.

Back 102

SCP, SSH and SFTP

Front 103

Access mechanisms to data on encrypted USB hard drives must be implemented correctly otherwise what may occur?

Back 103

the security controls on the USB drive can be bypassed.

Front 104

Maintenance workers find an active network switch hidden above a dropped ceiling tile in the CEOs office with various connected cables from the office. What type of attack is occuring?

Back 104

packet sniffing

Front 105

A security admin is segregating all web facing server traffic from the internal network restricting it to a single interface on a firewall. What BEST describes this new network?

Back 105

DMZ

Front 106

What was based on a previous X 500 specification and allows either unencrypted authentication or encrypted authentication through the use of TLS?

Back 106

LDAP

Front 107

The quality assurance team is testing a new third party developed application. The quality team does not have any experience with the application. What is the team performing?

Back 107

black box testing

Front 108

___ has a storage root key.

Back 108

TPM

Front 109

A data center requires that staff be able to ID whether or not items have been removed from the facility. Which controls will allow the organization to provide automated notification of item removal?

Back 109

RFID

Front 110

A malicious person gained access to a datacenter by ripping the proximity badge reader off the wall near the datacenter entrance. This caused the electronic locks on the datacenter door to release because the ___.

Back 110

system was designed to fail open for life-safety.

Front 111

The concept of rendering data passing between two points over an IP based network impervious to all but the most sophisticated advanced persistent threats is BEST categorized as ___.

Back 111

transport encryption

Front 112

On Monday, all company employees report eing unable to connect to the corporate wireless network, which uses 802.1x with PEAP. A technician verifies that no configuration changes were made to the wireless network and its supporting infrastructure, and that there are no outages. What is MOST likely the cause of this?

Back 112

The remote authentication dial-in user service server certificate has expired.

Front 113

What would BEST deter an attacker trying to brute force 4 digit PIN numbers to access an account at a bank tell machine?

Back 113

account lockout settings

Front 114

In kerberos, the ticketing granting ticket s used for what?

Back 114

authentication

Front 115

What network design element allows for many internal devices to share on public IP address?

Back 115

PAT

Front 116

What component of an all in one security appliance would MOST likely be configured in order to restrict access to peer to peer file sharing websites?

Back 116

URL filter

Front 117

When considering a vendor specific vulnerability in critical industrial control systems, what technique supports availability?

Back 117

incorporating diversity into redundant design

Front 118

During the information gatherig stage of a deploying role-based access control model, what information is MOST likely required?

Back 118

Matrix of job titles with required access privileges.

Front 119

The CTO has been informed of a potential fraud committed by a database admin performing several other job functions within the company. What is the BEST method to prevent such activities in the future?

Back 119

separation of duties

Front 120

Ann would like to forward some personal identifiable information to her HR department by email, but she is worried about the confidentiality of the information. What will accomplish this task securely?

Back 120

encryption.

Front 121

A company is trying to limit the risk associated with the use of unapproved USB devices to copy documents. Which would be the BEST technology control to use in this scenario?

Back 121

DLP

Front 122

A company is trying to implement physical deterrent controls to improve the overall security posture of their data center. What would help them BEST meets their goal?

Back 122

Hardware locks

Front 123

A company's employees were victims of a spear phishing campaign impersonating the CEO. The company would nwow like to implement a solution the overall security posture by assuring their that email originated from the CEO. Which of the following controls could they implement to BEST meet this goal?D

Back 123

Digital signatures

Front 124

A security technician is attempting to improve the overall security posture of an internal mail server. Which of the following actions would BEST accomplish this goal?

Back 124

Disabling unnecessary services

Front 125

A bank has recently deployed mobile tablets to all loan officers for use at customer sites. Which would BEST prevent the discolsure of customer data in the event that a tablet is lost or stolen?

Back 125

Remote wiping

Front 126

Which of the following is the primary security concern when deploying a mobile device on a network?

Back 126

Data security

Front 127

Which of the following technical controls is BEST used to define which applications a user can install and run on a company issued mobile device?

Back 127

Whitelisting

Front 128

After a company has standardized to a single operating system, not all servers are immune to a well-known OS vulnerability. Which solution would mitigate this issue?

Back 128

Patch management system

Front 129

A security administrator discovers an image file that has several plain text documents hidden in the file. Which of the following security goals is met by comouflaging data inside of other files?

Back 129

confidentiality

Front 130

A company determines a need for additional protection from rogue devices plugging into physical ports around the building. What provides the highest degree of protection from unauthorized wired network access?

Back 130

802.1x

Front 131

A company is preparing to decomission an offline, non-networked root certificate server. Before sending the server's drives to be destroyed by a contrated company, the Chief Security Officer wants to be certain that the data will not be accessed. If implimented, what would best reassure the CSO?

Back 131

Full disk encryption and disk wiping prcedures

Front 132

During the analysis of a PCAP file, a security noticed several communications with a remoter server on port 53. What protocol type is observed in this traffic?

Back 132

DNS

Front 133

A compromised workstation utilized in a DDoS attack has been created. However, the system administrator stated that the system as left unattended for several hours before the image was created. In the event of a court case, what is likely to be an issue with this incident?

Back 133

chain of custody

Front 134

During which phase of the incident response process should a security administrator define and the implement general defense general defence against malware?

Back 134

preparation

Front 135

Due to hardware limitation, a technician must impelment a wirelss encryption algorithm that used the RC4 protocol. Whcih wireless encryption solution should the technician implement to ensure the strongest level of security?

Back 135

WPA-TKIP

Front 136

Joe, a user wants to send an encrypted email to Ann. Which of the following will Ann need to use to verofy that the email came from Joe and decrypt it?

Back 136

Anns private key and Joes public key.

Front 137

A technician wants to implement a udual factor authentication system that will enable the organization to authorize access to sensitive systems on a need to know basis. What should be implemented during the authorization stage?

Back 137

Biometrics

Front 138

A security researcher wants to reverse engineer an executable file to determine if it is malicious. The file was found on an underused server and appears to contain a zero-day exploit. What can the researcher do to determine in the file is malicious in nature?

Back 138

OS baseline comparison

Front 139

A recnet spike in virus detections has been attributed to end-users visiting www.company.com . The business has an established relationship with an organization using the URL of www.company.com but not with the site that hhas been causing the infections. What would BEST describe this type of attack?

Back 139

Typo squatting

Front 140

A company has proprietary mission critical devices connected to their network which are configured remotely by both employees and approved customers. The administrator wants to monitor device security without changing their baseline configuration. Whcih od the following should be implemented to secure the devices without risking availability?

Back 140

IDS

Front 141

An administrator has a network subnet dedicated to a group of users. Due to concerns regarding data and network secuirty. the administrator desires to proviede network access for this group only. Which of the following would BEST address this desire?

Back 141

Configure the switch to allow only traffic from computers based upon their physical address.

Front 142

A security concern regarding users bringing personally-owned devices that they connect to the corporate network?

Back 142

Lack of controls in place to ensure that the devices have the latest system patches and signature files.

Front 143

Due to issues with building keys being duplicated and distributed, a security administrator wishes to change to a different security control regarding a restricted area, The goal is to provide access based upon facial recognition. What will address this requirement?

Back 143

Place a guard at the entrance to approve access.

Front 144

A security administrator has concerns regarding employees saving data on company provided mobile devices. What would BEST address the administrators concerns?

Back 144

Configure the devices so that removable media use is disabled.

Front 145

Identifying residual risk is MOST important to which of the following concepts?

Back 145

Risk acceptance

Front 146

The information security technician wants to ensure security controls are depliyed and functioning as intended to be able to maintain an appropriate security posture. What security technique is MOST appropriate to do this?

Back 146

continuous security monitoring

Front 147

A small company can only afford to buy an all-in-one wireless router/switch. The company has 3 wireless BYOD users and 2 web servers without wireless access. Which of the following should the company configure to protect the servers from the user devices?

Back 147

Create a server VLAN, and create an ACL to access the server

Front 148

Users an authenticate to a company's web applications using their credentials from a popular social media site. Which of the following poses the greatest risk with this integration?

Back 148

Password breaches to the social media site affect the company application as well

Front 149

A security team has established a security awareness program. Which of the following would best prove the success of the program?

Back 149

metrics

Front 150

A company needs to receive data that contains personally identifiable information. The company requires both the transmission and data at rest to be encrypted. Which of the following achieves this goal?

Back 150

SSH, and PGP/GPG

Front 151

An organization does not have adequate resources to administer its large infrastructure. A security administrator wishes to combine the security controls of some of the network devices in the organization. Which of the following methods would BEST accomplish this goal?

Back 151

Unified threat management

Front 152

Which of the following would allow the organization to divide a class C IP address range into several ranges?

Back 152

Subnetting

Front 153

The security administrator is currently unaware of an incident that occurred a week ago. Which of the following will ensure the administrator is notified in a timely manner in the future?

Back 153

routine auditing

Front 154

An access point has been configures for AES encryption but a client is unable to connect to it. Which of the following should be configures on the client to fix this issue?

Back 154

CCMP

Front 155

The system administrator is tasked with changing the admin password across all 2000 computers in the organization. Which of the following should the system administrator implement to accomplish this task?

Back 155

A group policy

Front 156

A network administrator wants to block both DNS requests and zone transfers coming from outside IP addresses. The company uses a firewall which implements an implicit allow and is currently configures with the following ACL applied to its external interface:

PERMIT TCP ANY ANY 80

PERMIT TCP ANY ANY 443

Which of the following rules would accomplish this task?

Back 156

Change the firewall default settings so that is implements an implicit deny and add the following ACL at the bottom of the current ACL: DENY IP ANY ANY 53

Front 157

Which of the following attacks would cause all mobile devices to lose their association with corporate access points while the attack is underway?

Back 157

Wireless jamming

Front 158

An administrator wants to ensure that the reclaimed space of a hard drive has been sanitized while the computer is in use. Which can be implemented?

Back 158

Cluster tip wiping

Front 159

A company is looking to improve their security posture by addressing risks uncovered by a recent penetration test. Which of the following risks is MOST likely to affect the business on a day-to-day basis?

Back 159

Lack of anitvirus software

Front 160

Ann, an employee, is cleaning out her desk and disposes of paperwork containing confidential risk of loss from which of the following attacks?

Back 160

dumpster diving

Front 161

A recently installed application update caused a vital application to crash during the middle of the workday. The application remained down until a previous version could be reinstalled on the server, and this resulted in a significant loss of data and revenue. Which of the following could best prevent this issue from occurring again?

Back 161

application patch management

Front 162

A security admin wished to increase the security of the wireless network. Which of the following BEST addresses this concern?

Back 162

Change the encryption from TKIP based to CCMP based

Front 163

The system admin has deployed updated security controls for the network to limit risk of attack. The security manager is concerned that controls continue to function as intended to maintain appropriate security posture. Which of the collowing risk mitigation strategies is MOST important to the security manager?

Back 163

Routine audits

Front 164

A company is about to release a very large patch to its customers. An administrator is required to test patch installations several times prior to distributing them to customer PCs. Which of the follwing should the admin use to test the patching process quickly and often?

Back 164

Create a virtualized sandbox and utilize snapshots

Front 165

An auditing team has found that passwords do not meet best business practices. Which of the following will MOST increase the security of the Passwords? (select two)

Back 165

Password Complexity, Password length

Front 166

A vulnerability scan is reporting that patches are missing on a server. After a review, it is determined tat the application requiring the patch does not exist on the operating system. Which of the following describes this cause?

Back 166

false positive

Front 167

Company A submitted a bid on a contract to do work for Company B via email. Company B was insistent that the bid did not come from Company A. Which of the following would have assured tat the bid submitted by Company A?

Back 167

Digital Signatures

Front 168

Ann, a sales manager, successfully connected her company-issued smartphone to the wireless network in her office without supplying a username/password combination. Upon disconnecting from the wireless network, she attempted to connect her personal tablet computer to the same network and could not connect. Which of the following is MOST likely the reason?

Back 168

The company wireless is using a MAC filter

Front 169

A network technician of on the phone with the system administration team, Power to the server room was lost and servers need to be restarted. The DNS services must be the first to be restarted. Several machines are powered off. Assuming each server only provides one service, which of the following should be powered on FIRST to established DNS services?

Back 169

bind server

Front 170

Which of the following is a hardware based encryption device?

EFS/Truecrypt/TPM/SLE

Back 170

TPM

Front 171

Certificates are used for: (select two)

client authentication/WEP encryption/Access control lists/Code signing/Password hashing

Back 171

Client authentication/Code signing

Front 172

a security admin wants to check user password complexity. Which of the following is the BEST tool to use?

Password history/password logging/password cracker/password hashing

Back 172

password cracker

Front 173

Which of the following can be used by a security administrator to successfully recover a user's forgotten password on the password protected file?

Back 173

cognitive password/password sniffing/brute force/social engineering

Front 174

Which of the following application security testing techniques is implemented when an automates system generates random input data?

fuzzing/XSRF/hardening/Input validation

Back 174

fuzzing

Front 175

Which of the following devices would most likely have a DMZ interface?

Firewall/Switch/load balancer/proxy

Back 175

Firewall

Front 176

Employee badges are encoded with a private encrytpion key and specific personal information/ The encoding is then used to provide access to the netwrok. Which of the following describes this access control type?

Smartcard/token/discretionary access control/mandatory access control

Back 176

smartcard

Front 177

Which of the following MUST be updated immediately when an employee is terminate to prevent unauthorized access?

registration/CA/CRL/Recovery agent

Back 177

CRL

Front 178

A security administrator needs to determine which system a particular user is trying to login to at various times of the day. Which of the following log types would the administrator check?

firewall/application/IDS/security

Back 178

security

Front 179

Drag and drop the correct protocol to its default:

FTP/Telnet/SMTP/SNMP/SCP/TFTP

161/22/21/69/25/23

Back 179

FTP=21

TELNET=23

SMTP=25

SNMP=161

SCP=22

TFTP=69

Front 180

A forensic analyst is asked to respond to an ongoing network attack on a server. Place the items in the list below in the correct order in which the forensic analyst should preserve them:

RAM.CPU cache/swap/hard drive

Back 180

CPU cache/RAM/swap/Hard drive

Front 181

For each of the given items, select the appropriate authentication category from the dropdown choices.

retina scan/smart card/hardware token/password/PIN number/Firngerprint scan

Back 181

Retina scan=all given authentication categories

smart card=something you have

hardware token=something you are

password=something you know

pin number=something you know

fingerprint scan=all given authentication categories

Front 182

Select the appropriate attack from each drop down list to label the corresponding illustrated attack:

1. attacker gains conf. company info

2. attacker posts links to fake AV software

3. attacker collecting credit card details

4. attacker mass-emails

5. attacker redirects name resolution

Back 182

1. spear pushing

2. hoax

3. vishing

4. phishing

5. pharming

Front 183

For each given item, select the apprompriate authentication category from the drop down choices:

Fingerprint scan/hardware token/smartcard/password/PIN number/retina scan

Back 183

fingerprint scan=biometric autherntication

Hardware token=one time password

smart card=multi-factor

password=PAP authentication

PIN number=PAP authentication

Retina scan=biometric authentication

Front 184

A security admin wants to implement strong security on the company smart phones and terminal servers located in the data center. Drag and drop the applicable controls to each type.

(controls can be used multiple times)

scerren locks/strong password/device encyption/remote wipe/GPS tracking/pop up blocker/ cable locks/antivirus/host based firewall/proximity reader/sniffer/mantor ap

Back 184

smart phone: scerren locks/srtong password/device encryption/remote wipe/gps tracking/pop-up blocker

data center terminal server: cable locks /antivirus/host based firewall/sniffer/mantor app

Front 185

determine the types of attacks below by selecting an option from the dropdown list:

1. email sent to multiple users to a link

2. phone calls made to CEO of organization

3. Phone call made to individual stating there was an IT issue

4. social media site and instant message pops up

5. a friend/collegue asks you questions of a personal nature

Back 185

1. phishing

2. whaling

3. vishing

4. spim

5. social engineering

Front 186

drag the items on the left to show the different types of security for the shown devices. Not all fields need to be filled. Not all items need to be used.

mobile device security/server in data center security

Back 186

mobile device security=GPS tracking/remote wipe/device encryption/strong passwords

server in data center security=FM-200/biometrics/proximity badges/mantrap

Front 187

Back 187

Front 188

Which of the follwoing would be used when a higher level of security is desired for encryption storage?

tactas+/L2TP/LDAP/TPM

Back 188

TPM

Front 189

In regards to secure coding practices, why is input validation important?

it mitigates buffer overflow attacks

it makes the code more readable

it provides an application config baseline

it meet gray box testing standards

Back 189

it mitigates buffer overflow attacks

Front 190

All of the following are valid cryptographic hash functions EXCEPT

RIPEMD/RC4/SHA-512/MD4

Back 190

RC4

Front 191

Which of the following devices is BEST suited for servers that need to store private keys?

Hardware security module

hardened network firewall

solid state disk drive

hardened host firewall

Back 191

hardware security module

Front 192

Which of the following is the BEST approach to perform risk mitigation of user access control rights?

conduct surveys and rank the results

Implement periodic vunerability scanning

disable user accounts

Back 192

perform routine user permission reviews

Front 193

A network stream nees to be encrypted. Sara, the network admin has selected a cipher which will encrypt 8 bits at a time before sending the data across the network. Which of the following has sara selected?

block cihper/stream cipher/CRC/hashing algorithm

Back 193

block cipher

Front 194

Pete, the sysad is reviewing his disaster recovery plans. He wishes to limit the downtime in the event of a disaster, but does not have the budget approval to implement or maintain an offsite location. Which of the following is his BEST option?

use hardware/move the servers/retain data/move the data back-ups...

Back 194

Use hardware already at an offsite location and configure it to be quickly utilized

Front 195

Pete, the system admin has blocked users from accessing social media web sites. In addition to protection company information from being accidentally leaked, which additional security benefit does this provide?

no competition.../protection against malware introduced by banner ads/increased number.../elimination...

Back 195

protection against malware introduced by banner ads

Front 196

Which of the following can be implemented with multiple bit strength?

AES/DES/SHA-1/MD5/MD4

Back 196

AES

Front 197

Pete, the security engineer would like to prevent wireless attacks on his network. Pete has implemented a security control to limit the connecting MAC addresses to a single port. Which of the following wireless attacks would this address?

interference/man in the middle/ARP/Rogue access point

Back 197

rogue access point

Front 198

Pete's corporation has outsourced help desk services to a large provider. Management has published a procedure that requires all users, when receiving support, to call a special number. Users then need to enter the code provided to help them by the help desk tech prior to allowing the technician to work on their PC. Which of the following does this procedure prevent?

Collucion/impersontation/pharming/transitive access

Back 198

impersonation

Front 199

The infosec team does a presentation on social media and advises the participants not to provide too much personal information on social media websites. This advice would BEST protect people from which of the following?

rainbow table attacks/brute force attacks/birthday attacks/cognitive passwords attacks

Back 199

cognitive passwords attacks

Front 200

Pete, a developer writes an application. Jane, the security analyst knows some things about the overall application but does not have all the details. Jane needs to review the software before it is released to production. Which of the following reviews should Jane conduct?

Gray box testing/black box testing/business impact analysis/white box testing

Back 200

gray box testing

Front 201

Which of the following is the LEAST volatile when performing incident response procedures?

Registers/RAID cache/RAM/Hard drive

Back 201

hard drive

Front 202

Sara, an application developer, implemented error and exception handling alongside input validation. Which of the following does this help prevent?

buffer overflow/pop up blockers/cross site scripting/fuzzing

Back 202

buffer overflow

Front 203

Which of the following encompasses application patch management?

configuration management/policy management/crosssite management/fuzzing

Back 203

configuration management

Front 204

Which of the following presents the STRONGEST access control?

MAC/TACTACS/DAC/RBAC

Back 204

MAC

Front 205

Configuring the mode, encryption methods, and security associations are part of which of the following?

IPSec/full disk encryption/802.1x/PKI

Back 205

IPSec

Front 206

Which of the following assessments would Pete, the security administrator, use to actively test that an application's security controls are in place?

code review/penetration test/protocol analyzer/vunerability scan

Back 206

penetration test

Front 207

A security admin has just finished creating a hot site for the company. This implementation relates to which of the following?

confidentiality/availability/succession planning/integrity

Back 207

availability

Front 208

In the initial stages of an incident response, Matt, the security admin, was provided he hard drives in QUESTION NO: from the incident manager. Which of the following incident response procedures would he need to perform in order to begin analysis?

take hashes/begin chain of custody paperwork/take screen shots/capture the system image/decompile suspicious files

Back 208

take hashes/capture the system image

Front 209

Which of the following is used to certify intermediate authorities in a large PKI deployment?

Root CA/Recovery agent/root user/key escrow

Back 209

Root CA

Front 210

Which of the following components MUST be trusted by all parties in PKI?

Key escrow/CA/Private key/recovery key

Back 210

CA

Front 211

Which of the following should Matt, a security admin, include when encrypting smartphones?

steganography images/internal memory/master boot records/removable memory cards, public keys

Back 211

internal memory, removable memory cards

Front 212

Which of the following is the below psuedo-code an ecample of? IF VARIABLE |(CONTAINS NUMBERS = TRUE) THEN EXIT

buffer overflow prevention/input validation/CSRF prevention/cross-site scripting prevention

Back 212

input validation

Front 213

A system admin is using a packet sniffer to troubleshoot remote authentication. The administrator detects a device trying to communicate to TCP port 49. Which of the following authentication methods is most likely being attempted?

RADIUS/TACACS+/Kerberos/LDAP

Back 213

TACACS+

Front 214

Which of the following can ise RC4 for encryption?

CHAP/SSL/WEP/AES/3DES

Back 214

SSL/WEP

Front 215

Which of the following defines a business goal for system restoration and acceptable data loss?

MTTR/MTBF/RPO/Warm site

Back 215

RPO

Front 216

Which of the following allows a company to maintain access to encrypted resources when employee turnover is high?

Recovery agent/Certificate authority/trust model/key escrow

Back 216

recovery agent

Front 217

Which of the following devices will help prevent a laptop from being removed from a certain location?

Back 217

cable locks

Front 218

Which of the following is the most secure protocol to transfer files?

FTP/SFTP/SSH/TELNET

Back 218

SFTP (FTPS)

Front 219

Which of the following protocols is used to authenticate the client and server's digital certificate?

PEAP/DNS/TLS/ICMP

Back 219

TLS

Front 220

Which of the following can be used to mitigate risk is a mobile device is lost?

Cable lock/transport encryption/voice encryption/strong passwords

Back 220

strong passwords

Front 221

Which of the following security concepts would sara, the security admin, use to mitigate the risk of data loss?

Record time offset/clean desk policy/cloud computing/routine log review

Back 221

clean desk policy

Front 222

Mike, a security professional, is tasked with actively verifying the strength of the security controls on a company's live modem pool. Which of the following activities is MOST appropriate?

War dialing/War chalking/war driving/bluesnarfing

Back 222

war dialing

Front 223

Users at a company report that a popular news website keeps taking them to a web page with derogatory content. This is an example of which of the following?

Evil twin/DNS poisoning/Vishing/Session hijacking

Back 223

DNS poisoning

Front 224

An encrypted message is sent using PKI from Sara, a client, to a customer. Sara claims she never sent the message. Which of the following aspects of PKI BEST ensures the Identity of the sender?

CRL/non-repudiation/trust models/recovery agents

Back 224

non-repudiation

Front 225

Jane, a security admin has observed repeated attempts to break into a server. Which of the following is designed to stop an intrusion on a specific server?

HIPS/NIDS/HIDS/NIPS

Back 225

HIPS

Front 226

Matt, the IT manager wants to create a new network available to virtual servers on the same hypervisor, and does not want this network to be routable to the firewall. How could this best be accomplished?

Create a VLAN/remove the network from the routing table/create a virtual switch/commission a stand-alone switch

Back 226

create a virtual switch

Front 227

A security admin implements access controls base on the security classification of the data and need-to-know info. Which of the following BEST describes this level of access control?

Implicit deny/role-base access control/mandatory access controls/least privilege

Back 227

mandatory access controls

Front 228

A company that purchased an HVAC system for the datacenter is MOST concerned with which of the following?

availability/integrity/confidentiality/fire suppression

Back 228

availability

Front 229

Which of the following pseudocodes can be used to handle program exceptions?

If a program detects another instance of itself, then kill program instance

if user enters invalid input, then restart program

if program module crashes, then restart program module

if user's input exeeds buffer length, then truncate the input

Back 229

if program module crashes, the restart program module

Front 230

Which of the following technologies uses multiple devices to share work?

switching/load balancing/RAID/VPN concentrator

Back 230

Load Balancing

Front 231

Which od the following protocols uses an asymmetric key to open a session then establishes a symmetric key for the remainder of the sessions?

SFTP/HTTPS/TFTP/TLS

Back 231

HTTPS

Front 232

Which of the following describes how sara, an attacker, can send unwanted advertisements to a mobile device?

man in the middle

bluejacking

bluesnarfing

packet sniffing

Back 232

bluejacking

Front 233

Pete, an employee, is terminated from the company and the legal dept needs documents from his encrypted HDD. Which of the following should be used to accomplish this task?

Private hash/recovery agent/public key/key escrow/CRL

Back 233

recovery agent, key escrow

Front 234

Which of the following mitigation strategies is established to reduce risk when performing updates to business critical systems?

incident management/server clustering/change management/forensic analysis

Back 234

change management

Front 235

which of the following can pete, a security admin, use to distribute the processing effort when generating hashes for a password cracking program?

RAID/clustering/redundancy/virtualization

Back 235

clustering

Front 236

Which of the following should Jane, a security admin perform before a HDD is analyzed with forensics tools?

Identify user habits/disconnect system from network/capture system image/interview witnesses

Back 236

capture systems image

Front 237

Jane, an admin needs to make sure the wireless network is not accessible from the parking area of their office. Which of the following would BEST help Jane when deploying a new access point?

Placement of antenna/disabling the SSID/implementing WPA2/Enableing the MAC filtering

Back 237

Placement of the antenna

Front 238

Which of the following allows Pete, a security technicain to provide the MOST secure wireless implementation?

Implement WPA/disable SSID/adjust antenna placement/implement WEP

Back 238

Implement WPA

Front 239

Which of the following is a management control?

logon banners/written security policy/SYN attack prevention/access controls list (ACL)

Back 239

written security policy

Front 240

Which of the following security strategies allows a company to limit damage to internal systems and provide loss control?

Restoration and recovery strategies/ deterrent strategies/containment strategies/detection strategies

Back 240

containment strategies

Front 241

In order for sata, a client, to logon to her desktop computer, she must provide her username, password, and a four digit PIN. Which of the the following authentication methods is sara using?

three factor/single factor/two factor/four factor

Back 241

single factor

Front 242

Using proximity card readers instead of the traditional key punch doors would help to mitigate

impersonation/tailgaitng/dumpster diving/shoulder surfing

Back 242

shoulder surfing

Front 243

Which of the following application attacks is used gain access to SEH?

Cookie stealing/buffer overflow/directory traversal/XML injection

Back 243

Buffer overflow

Front 244

Which of the following is an authentication service that uses UDP as a transport medium?

TACACS+/LDAP/Kerberos/RADIUS

Back 244

RADIUS

Front 245

Which of the following can be used on a smartphone to BEST protect against sensitive data loss if the device is stolen?

Tethering/screen lock/remote wipe/email password/GPS tracking/device encryption

Back 245

Remote wipe/device encryption

Front 246

Which odf the following should Pete, a security manager, implement to reduce the risk of employees working in collusion to embezzle funds from their company?

Privacy policy/least privilege/acceptable use/mandatory vacations

Back 246

mandatory vacations

Front 247

which of the following will allow pete, a security analyst to trigger a security alert because of a tracking cookie?

network based firewall/anti spam software/host based firewall/anti spyware software

Back 247

anti spyware software

Front 248

Which f the collowing protocols are used to secure transfer of files?

ICMP/SNMP/SFTP/SCP/TFTP

Back 248

SFTP, SCP