Security + 401

Front 1

3 types of access controls:

Back 1

type 1: what you have(lock and key, CaC)

type 2: what you know ( information, passwords)

type 3: what you are (biometrics)

Front 2

What is accountability?

Back 2

the idea that user should be accountable to the actions performed under his/her name.

Front 3

What is Kerberos?

Back 3

Client sends login information to KDC (Key Distribution Center), which verifies a clients credentials and sends request to TGS (ticket granting server), followed by a TGT (ticket granting ticket) to the client.

Front 4

What is an SYN flood?

Back 4

Sending TCP packets to deny availability

Front 5

What is an ICMP flood?

Back 5

Sending ICMP (usually ping) packets to deny availability.

Front 6

What is smurfing?

Back 6

A special ICMP flood attack that braodcasts ICMP requests.

Front 7

Buffer Overflow:

Back 7

Sending a malformed packet that overflows a memory address to deny availability and possibly gain privileges

Front 8

Backdoor:

Back 8

Gain access through a secret program (ex. trojan horse)

Front 9

Sniffing:

Back 9

Read information off the network

Front 10

Spoofing:

Back 10

Hiding or disguising an address to make it appear that the requests come from another source.

Front 11

Man n the middle

Back 11

Intercepting packets and changing the contents. (denies confidentiality and integrity.)

Front 12

Replay

Back 12

session key sniffed and then used.

Front 13

Birthday attack:

Back 13

probability based

Front 14

How does a virus propagate?

Back 14

through user action, usually by email.

Front 15

How does a worm propagate?

Back 15

self-propagating and uses exploits

Front 16

L2TP operates on the _____ layer.

Back 16

Data-Link

Front 17

IPSec operates on the ____ layer and has 2 protocols: ____ and ___.

Back 17

network layer, AH and ESP

Front 18

what are S/MIME, MOSS. PEM and PGP?

Back 18

email security programs.

Front 19

What is an applet?

Back 19

Programs that run in a browser such as Java and activeX.

Front 20

what is the difference between S-HTTP and SSL?

Back 20

S-HTTP is connectionless while SSL is connection oriented.

Front 21

What does disk spanning allow?

Back 21

Allows a file system to be spread over multiple physical drives.

Front 22

What is WTLS?

Back 22

WAP's built in security system and operates over TLS

Front 23

What is WEP?

Back 23

a weak security system for wireless LANs and operates on layers 1 and 2 (physical and data)

Front 24

What is cladding?

Back 24

the glass insulator in the fiber optic cable

Front 25

What is the key anagement protocol that uses EAP?

Back 25

802.1x

Front 26

Which type of cabling is said to be shielded against EMI?

Back 26

STP cabling

Front 27

Circuit level gateway:

Back 27

Maintains state information (connection based)

Front 28

Application level gateway:

Back 28

examines each packet coming in for content

Front 29

What is a proxy server?

Back 29

special application level gateway that ensures no direct connection between an untrusted and trusted network.

Front 30

What is an ACL?

Back 30

the list that defines the rules that a packet filtering firewall follows

Front 31

Screening router:

Back 31

a router between the trusted and untrusted

Front 32

Screened host gateway

Back 32

A bastion host that can examine traffic between trusted and untrusted

Front 33

Dual-homed gateway

Back 33

a bastion host and router between trusted and untrusted

Front 34

Screened subnet:

Back 34

A bastion host (DMZ zone) between two routers

Front 35

Whats the difference between and active IDS and a passive IDS?

Back 35

active finds and attempts to circumvent threats, a passive finds threats and alerts administrator

Front 36

How does a host based IDS operate?

Back 36

requires special software to be installed on each node

Front 37

Knowledge based IDS:

Back 37

works using signatures and known attacks

Front 38

Behavior based IDS:

Back 38

works by analyzing baseline v.s real time network traffic

Front 39

what is relaying?

Back 39

the behavior of SMTP servers that will send a message from any source (should be disabled)

Front 40

What do anonymous services do?

Back 40

allow access without authentication

Front 41

What is AES>

Back 41

a symmetric algorithm based on Rijndael Block Cipher

Front 42

What do block ciphers do?

Back 42

Encrypt clear text block by block while stream ciphers encrypt in real time

Front 43

Name some symmetrical algorithms

Back 43

DES, 3DES, AES and IDEA

Front 44

Name some asymmetric algorithms

Back 44

Diffie-Hellman, RSA and El Gamel

Front 45

What are the three types of backups?

Back 45

Full, Differential and Incremental

Front 46

What is a differential backup?

Back 46

Only the data that has changed since the last full backup was done is backed up

Front 47

What is an incremental backup?

Back 47

Only the data that has changed since the last incremental or full backup is backed up

Front 48

What is MTD?

Back 48

Maximum tolerable downtime- the greatest amount of time a system can withstand being un-operational

Front 49

DES:

Back 49

sym. 64 bit (56+8 parity) very weak 3DES

Front 50

3DES

Back 50

sym. 192 bit (168bit + 24 parity) Moderate AES

Front 51

AES

Back 51

sym. Variable (128, 192, 256) strong N/A

Front 52

RCS

Back 52

sym. (up to 2048) Very strong N/A

Front 53

Diffie-Hellman

Back 53

Asym. 512 strong

Front 54

El Gamel

Back 54

N/A very strong

Front 55

MD5 Hash

Back 55

Rivest MD5 block hash 512 bit block processing/128 it digest strong MD6

Front 56

SHA-1

Back 56

512 bit processing/160 bit digest very strong

Front 57

HMAC

Back 57

Variable, very strong

Front 58

That is CCMP?

Back 58

counter mode with cipher block chaining messaging authentication code protocol.

a wrapper that uses 128 bit AES encryption

Front 59

An achievement providing worldwide internet security was the signing of certificates associated with which protocol?

Back 59

SSL

Front 60

A chief Information Security officer (CISO) wants to implement two-factor authentication within the company. What will fulfill his requirements?

Back 60

USB token and PIN

Front 61

What can a security administrator implement on mobile devices that will help prevent unwanted people from viewing the data if the device is left unattended?

Back 61

screen lock

Front 62

What would a security manager implement in order to ID a problem between two systems that are not communication properly?

Back 62

Protocol analyzer

Front 63

What can result in significant administrative overhead from incorrect reporting?

Back 63

false positives

Front 64

A security admin wants to perform routine tests in the network during working hours when certain apps are being accessed. What will allow the S.A. to test the lack of security controls for those applications with the least impact to the system?

Back 64

vulnerability scan

Front 65

What risk concept requires an organization to determine the number of failures per year?

Back 65

ALE

Front 66

A system security analyst using an enterprise monitoring tool notices an unknown internal host exfiltrating files to several foreign IP addresses. What would be an appropriate mitigation technique?

Back 66

rogue machine detection

Front 67

what are three primary security control types that can be implemented?

Back 67

operational, technical, and management

Front 68

The helpdesk reports increased call from clients reporting spiked in malware infections on their systems. What phases of incident response is MOST appropriate as a first response?

Back 68

Identification

Front 69

What are the steps to incident response?

Back 69

Identification, Containment, Validation, Eradication, Recovery, Follow-up.

Front 70

Which protocol operates at the highest level of the OSI model?

Back 70

SCP

Front 71

Joe, the S.A has been asked to calculate the annual loss expectancy (ALE) for a $5000 dollar server, which often crashes. In the past year, the server crashed 10 times, requiring a system reboot to recover with only 10% loss of data or function. What is the ALE of this server?

Back 71

$5000

Front 72

What should an administrator implement to research current attack methodologies?

Back 72

Honeypot

Front 73

What can be implemented in hardware or software to protect a web server from cross-site scripting attacks?

Back 73

Web application firewall

Front 74

Which means of wireless authentication is easily vulnerable to spoofing?

Back 74

MAC filtering

Front 75

The BEST methods for a web developer to prevent the website application code from being vunerable to cross=site request (XSRF) are to ____ and ____.

Back 75

validate and filter input on the server side and the client side; restrict and sanitize use of special characters in input and URLs

Front 76

Jane, a security administrator, needs to implement a secure wireless authentication method uses a remoter RADIUS server for authentication. Which method should Jane use?

Back 76

LEAP

Front 77

Computer evidence at a crime scene is documented with a tag stating who had possession of the evidence at a given time. What does this illustrate?

Back 77

chain of custody

Front 78

A net admin is configuring access control foe the sale department which has high employee turnover. What is BEST suited when assigning user rights to individuals in the sales department?

Back 78

group based privileges

Front 79

What is being tested when a company's payroll server is powered off for eight hours?

Back 79

continuity of operations plan

Front 80

A security analyst is reviewing an IRC channel and notices that a malicious exploit has been created for a frequently used application. She notifies the software vendor and asks them for remediation steps, but is alarmed to find that no patches are available to mitigate this vulnerability. What is the best description of this exploit?

Back 80

Zero-day exploit

Front 81

A security admin has concerns about new types of media which allow for the mass distribution of personal comments to a select group of people. To mitigate the risks involved with this media, employees should receive training on what?

Back 81

social networking

Front 82

A net admin is responsible for securing applications against external attacks. Every month, the underlying operating system is updated. There is no process in lace for the other software updates. What could MOST effectively mitigate these risks?

Back 82

Application patch management

Front 83

A network engineer is designing a secure tunneled VPN. Which protocol would be the MOST secure?

Back 83

IPSec

Front 84

Which implementation steps would be appropriate for a public wireless hot spot?

Back 84

open system authentication

Front 85

An integral step in deploying a WPA=2 enterprise wireless network

Back 85

install a digital certificate on the authentication server

Front 86

Which control would allow a company to reduce the exposure of sensitive systems from unmanaged devices on internal networks>

Back 86

802.1x

Front 87

What preventative control would be appropriate for responding to a directive to reduce the attack surface of a specific host?

Back 87

disabling unnecessary services

Front 88

A security manager must remain aware of the security posture of each system. What would support that requirement?

Back 88

Establishing baseline reporting

Front 89

deploying a wildcard certificate is one strategy to do what?

Back 89

reduce the certificate management burden

Front 90

Th security admin needs to manage traffic on a layer 3 device to support FTP from a new remote site. What would need to be implemented?

Back 90

access control lists

Front 91

Which port is used for SSH by default

Back 91

22

Front 92

A network admin has been tasked with securing the WLAN. Which cryptographic product would be used to provide the MOST secure environment for the WLAN?

Back 92

WPA2 CCMP

Front 93

A server with an IP address of 10.10.2.4 has been having intermittent connection issues. The logs show repeated connection attempts from the following IPs: 10.10.3.16, 10.10.3.23, 212.178.24.26, and 217.24.94.83.

These attempts are overloading the server to the point that it cannot respond to traffic. Which attack is occurring?

Back 93

DDoS

Front 94

Which cipher would be best used to encrypt streaming video?

Back 94

RC4

Front 95

A user attempting to log on to a workstation for the first time is prompted for the following info before being granted access: username, password, and 4 digit pin that was mailed to him during account registration. This is an example of what?

Back 95

single factor authentication

Front 96

After analyzing and correlating activity from multiple sensors, the security admin has determined that a group of very well organized individuals from an enemy country is responsible for various attempts to breach the compay network, through the use of a very sophisticated and targeted attacks. This is an example of____.

Back 96

advanced persistent threat

Front 97

true/false:

In a client-server architecture, when data integrity is critical to the organization, input validation should be performed on the server side.

Back 97

true

Front 98

A merchant acquirer has the need to store credit card numbers in a transitional database in a high performance environment. What best protects the credit card data?

Back 98

database field encryption

Front 99

A bank has a fleet of aging payment terminals used by merchants for transactional processing. The terminals currently support single DES but require an upgrade in order to be compliant with security standards. What is likely to be the simplest upgrade to the aging terminals which will improve in-transit protection of the transactional data?

Back 99

3DES

Front 100

What is the BEST at blocking and providing security at layer 7 of the OSI model?

Back 100

WAF

Front 101

What is BEST used to capture and alayze network traffic between hosts on the same network segment?

Back 101

protocol analyzer

Front 102

After a number of highly publicized and embarrassing customer data leaks as a result os social engineering attacks by the phone, the chief information officer (CIO) has decided the user training will reduce the risk of another data leak. What would be the MOST effective in reducing data leaks in this situation?

Back 102

Information Security Awareness

Front 103

What function provides an output which cannot be reversed and converts data into a string of characters?

Back 103

hashing

Front 104

What encrypts data a singlel bit at a time?

Back 104

stream cipher

Front 105

what is used to verify data integrity?

Back 105

SHA

Front 106

by default, TCP port 22 is used by ____.

Back 106

SCP, SSH and SFTP

Front 107

Access mechanisms to data on encrypted USB hard drives must be implemented correctly otherwise what may occur?

Back 107

the security controls on the USB drive can be bypassed.

Front 108

Maintenance workers find an active network switch hidden above a dropped ceiling tile in the CEOs office with various connected cables from the office. What type of attack is occuring?

Back 108

packet sniffing

Front 109

A security admin is segregating all web facing server traffic from the internal network restricting it to a single interface on a firewall. What BEST describes this new network?

Back 109

DMZ

Front 110

What was based on a previous X 500 specification and allows either unencrypted authentication or encrypted authentication through the use of TLS?

Back 110

LDAP

Front 111

The quality assurance team is testing a new third party developed application. The quality team does not have any experience with the application. What is the team performing?

Back 111

black box testing

Front 112

___ has a storage root key.

Back 112

TPM

Front 113

A data center requires that staff be able to ID whether or not items have been removed from the facility. Which controls will allow the organization to provide automated notification of item removal?

Back 113

RFID

Front 114

A malicious person gained access to a datacenter by ripping the proximity badge reader off the wall near the datacenter entrance. This caused the electronic locks on the datacenter door to release because the ___.

Back 114

system was designed to fail open for life-safety.

Front 115

The concept of rendering data passing between two points over an IP based network impervious to all but the most sophisticated advanced persistent threats is BEST categorized as ___.

Back 115

transport encryption

Front 116

On Monday, all company employees report eing unable to connect to the corporate wireless network, which uses 802.1x with PEAP. A technician verifies that no configuration changes were made to the wireless network and its supporting infrastructure, and that there are no outages. What is MOST likely the cause of this?

Back 116

The remote authentication dial-in user service server certificate has expired.

Front 117

What would BEST deter an attacker trying to brute force 4 digit PIN numbers to access an account at a bank tell machine?

Back 117

account lockout settings

Front 118

In kerberos, the ticketing granting ticket s used for what?

Back 118

authentication

Front 119

What network design element allows for many internal devices to share on public IP address?

Back 119

PAT

Front 120

What component of an all in one security appliance would MOST likely be configured in order to restrict access to peer to peer file sharing websites?

Back 120

URL filter

Front 121

When considering a vendor specific vulnerability in critical industrial control systems, what technique supports availability?

Back 121

incorporating diversity into redundant design

Front 122

During the information gatherig stage of a deploying role-based access control model, what information is MOST likely required?

Back 122

Matrix of job titles with required access privileges.

Front 123

The CTO has been informed of a potential fraud committed by a database admin performing several other job functions within the company. What is the BEST method to prevent such activities in the future?

Back 123

separation of duties

Front 124

Ann would like to forward some personal identifiable information to her HR department by email, but she is worried about the confidentiality of the information. What will accomplish this task securely?

Back 124

encryption.

Front 125

A company is trying to limit the risk associated with the use of unapproved USB devices to copy documents. Which would be the BEST technology control to use in this scenario?

Back 125

DLP

Front 126

A company is trying to implement physical deterrent controls to improve the overall security posture of their data center. What would help them BEST meets their goal?

Back 126

Hardware locks

Front 127

A company's employees were victims of a spear phishing campaign impersonating the CEO. The company would nwow like to implement a solution the overall security posture by assuring their that email originated from the CEO. Which of the following controls could they implement to BEST meet this goal?D

Back 127

Digital signatures

Front 128

A security technician is attempting to improve the overall security posture of an internal mail server. Which of the following actions would BEST accomplish this goal?

Back 128

Disabling unnecessary services

Front 129

A bank has recently deployed mobile tablets to all loan officers for use at customer sites. Which would BEST prevent the discolsure of customer data in the event that a tablet is lost or stolen?

Back 129

Remote wiping

Front 130

Which of the following is the primary security concern when deploying a mobile device on a network?

Back 130

Data security

Front 131

Which of the following technical controls is BEST used to define which applications a user can install and run on a company issued mobile device?

Back 131

Whitelisting

Front 132

After a company has standardized to a single operating system, not all servers are immune to a well-known OS vulnerability. Which solution would mitigate this issue?

Back 132

Patch management system

Front 133

A security administrator discovers an image file that has several plain text documents hidden in the file. Which of the following security goals is met by comouflaging data inside of other files?

Back 133

confidentiality

Front 134

A company determines a need for additional protection from rogue devices plugging into physical ports around the building. What provides the highest degree of protection from unauthorized wired network access?

Back 134

802.1x

Front 135

A company is preparing to decomission an offline, non-networked root certificate server. Before sending the server's drives to be destroyed by a contrated company, the Chief Security Officer wants to be certain that the data will not be accessed. If implimented, what would best reassure the CSO?

Back 135

Full disk encryption and disk wiping prcedures

Front 136

During the analysis of a PCAP file, a security noticed several communications with a remoter server on port 53. What protocol type is observed in this traffic?

Back 136

DNS

Front 137

A compromised workstation utilized in a DDoS attack has been created. However, the system administrator stated that the system as left unattended for several hours before the image was created. In the event of a court case, what is likely to be an issue with this incident?

Back 137

chain of custody

Front 138

During which phase of the incident response process should a security administrator define and the implement general defense general defence against malware?

Back 138

preparation

Front 139

Due to hardware limitation, a technician must impelment a wirelss encryption algorithm that used the RC4 protocol. Whcih wireless encryption solution should the technician implement to ensure the strongest level of security?

Back 139

WPA-TKIP

Front 140

Joe, a user wants to send an encrypted email to Ann. Which of the following will Ann need to use to verofy that the email came from Joe and decrypt it?

Back 140

Anns private key and Joes public key.

Front 141

A technician wants to implement a udual factor authentication system that will enable the organization to authorize access to sensitive systems on a need to know basis. What should be implemented during the authorization stage?

Back 141

Biometrics

Front 142

A security researcher wants to reverse engineer an executable file to determine if it is malicious. The file was found on an underused server and appears to contain a zero-day exploit. What can the researcher do to determine in the file is malicious in nature?

Back 142

OS baseline comparison

Front 143

A recnet spike in virus detections has been attributed to end-users visiting www.company.com . The business has an established relationship with an organization using the URL of www.company.com but not with the site that hhas been causing the infections. What would BEST describe this type of attack?

Back 143

Typo squatting

Front 144

A company has proprietary mission critical devices connected to their network which are configured remotely by both employees and approved customers. The administrator wants to monitor device security without changing their baseline configuration. Whcih od the following should be implemented to secure the devices without risking availability?

Back 144

IDS

Front 145

An administrator has a network subnet dedicated to a group of users. Due to concerns regarding data and network secuirty. the administrator desires to proviede network access for this group only. Which of the following would BEST address this desire?

Back 145

Configure the switch to allow only traffic from computers based upon their physical address.