Security+ Sy201

Front 1

QUESTION NO: 1
All of the following provide confidentiality protection as part of the underlying protocol EXCEPT:
A. SSL.
B. SSH.
C. L2TP.
D. IPSeC.

Back 1

Answer: C

Front 2

QUESTION NO: 2
Which of the following allows an attacker to manipulate files by using the least significant bit(s) to
secretly embed data?
A. Steganography
B. Worm
C. Trojan horse
D. Virus

Back 2

Answer: A

Front 3

QUESTION NO: 3
Which of the following type of attacks would allow an attacker to capture HTTP requests and send
back a spoofed page?
A. Teardrop
B. TCP/IP hijacking
C. Phishing
D. Replay

Back 3

Answer: B

Front 4

QUESTION NO: 4
How should a company test the integrity of its backup data?
A. By conducting another backup
B. By using software to recover deleted files
C. By restoring part of the backup
D. By reviewing the written procedures

Back 4

Answer: C

Front 5

QUESTION NO: 5
Which of following can BEST be used to determine the topology of a network and discover
unknown devices?
A. Vulnerability scanner
B. NIPS
C. Protocol analyzer
D. Network mapper

Back 5

Answer: D

Front 6

QUESTION NO: 6
When should a technician perform penetration testing?
A. When the technician suspects that weak passwords exist on the network
B. When the technician is trying to guess passwords on a network
C. When the technician has permission from the owner of the network
D. When the technician is war driving and trying to gain access

Back 6

Answer: C

Front 7

QUESTION NO: 7
An administrator has implemented a new SMTP service on a server. A public IP address
translates to the internal SMTP server. The administrator notices many sessions to the server, and
gets notification that the servers public IP address is now reported in a spam real-time block
list.Which of the following is wrong with the server?
A. SMTP open relaying is enableD.
B. It does not have a spam filter.
C. The amount of sessions needs to be limiteD.
D. The public IP address is incorrect.

Back 7

Answer: A

Front 8

QUESTION NO: 8
Which of the following is MOST efficient for encrypting large amounts of data?
A. Hashing algorithms
B. Symmetric key algorithms
C. Asymmetric key algorithms
D. ECC algorithms

Back 8

Answer: B

Front 9

QUESTION NO: 9
Which of the following is a reason why a company should disable the SSID broadcast of the
wireless
access points?
A. Rogue access points
B. War driving
C. Weak encryption
D. Session hijacking

Back 9

Answer: B

Front 10

QUESTION NO: 10
Which of the following BEST describes ARP?
A. Discovering the IP address of a device from the MAC address
B. Discovering the IP address of a device from the DNS name
C. Discovering the MAC address of a device from the IP address
D. Discovering the DNS name of a device from the IP address

Back 10

Answer: C

Front 11

QUESTION NO: 11
Which of the following would be BEST to use to apply corporate security settings to a device?
A. A security patch
B. A security hotfix
C. An OS service pack
D. A security template

Back 11

Answer: D

Front 12

5,000b

Back 12

Answer: B

Front 13

QUESTION NO: 13
Which of the following is the main objective of steganography?
A. Message digest
B. Encrypt information
C. Hide information
D. Data integrity

Back 13

Answer: C

Front 14

QUESTION NO: 14
Which of the following would allow for secure key exchange over an unsecured network without a
pre-shared key?
A. 3DES
B. AES
C. DH-ECC
D. MD5

Back 14

Answer: C

Front 15

QUESTION NO: 15
Which of the following improves security in a wireless system?
A. IP spoofing
B. MAC filtering
C. SSID spoofing
D. Closed network

Back 15

Answer: B

Front 16

QUESTION NO: 16
A user wants to implement secure LDAP on the network. Which of the following port numbers
secure LDAP use by default?
A. 53
B. 389
C. 443
D. 636

Back 16

Answer: D

Front 17

QUESTION NO: 17
On which of the following is a security technician MOST likely to find usernames?
A. DNS logs
B. Application logs
C. Firewall logs
D. DHCP logs

Back 17

Answer: B

Front 18

QUESTION NO: 18
How many keys are utilized with asymmetric cryptography?
A. One
B. Two
C. Five
D. Seven

Back 18

Answer: B

Front 19

QUESTION NO: 19
During a risk assessment it is discovered that only one system administrator is assigned several
tasks
critical to continuity of operations. It is recommended to cross train other system administrators to
perform
these tasks and mitigate which of the following risks?
A. DDoS
B. Privilege escalation
C. Disclosure of PII
D. Single point of failure

Back 19

Answer: D

Front 20

QUESTION NO: 20
Which of the following network filtering devices will rely on signature updates to be effective?
A. Proxy server
B. Firewall
C. NIDS
D. Honeynet

Back 20

Answer: C

Front 21

QUESTION NO: 21
Which of the following is a single server that is setup in the DMZ or outer perimeter in order to
distract
attackers?
A. Honeynet
B. DMZ
C. Honeypot
D. VLAN

Back 21

Answer: C

Front 22

QUESTION NO: 22
Which of the following encryption algorithms is decrypted in the LEAST amount of time?
A. RSA
B. AES
C. 3DES
D. L2TP

Back 22

Answer: B

Front 23

QUESTION NO: 23
An administrator is trying to secure a network from threats originating outside the network. Which
of the following devices provides protection for the DMZ from attacks launched from the Internet?
A. Antivirus
B. Content filter
C. Firewall
D. Proxy server

Back 23

Answer: C

Front 24

QUESTION NO: 24
Which of the following is a way to manage operating system updates?
A. Service pack management
B. Patch application
C. Hotfix management
D. Change management

Back 24

Answer: D

Front 25

QUESTION NO: 25
Which of the following is a list of discrete entries that are known to be benign?
A. Whitelist
B. Signature
C. Blacklist
D. ACL

Back 25

Answer: A

Front 26

QUESTION NO: 26
Which of the following increases the collision resistance of a hash?
A. Salt
B. Increase the input length
C. Rainbow Table
D. Larger key space

Back 26

Answer: A

Front 27

QUESTION NO: 27
A programmer has decided to alter the server variable in the coding of an authentication function
for a proprietary sales application. Before implementing the new routine on the production
application server, which of the following processes should be followed?
A. Change management
B. Secure disposal
C. Password complexity
D. Chain of custody

Back 27

Answer: A

Front 28

QUESTION NO: 28
When deploying 50 new workstations on the network, which of following should be completed
FIRST?
A. Install a word processor.
B. Run the latest spywarE.
C. Apply the baseline configuration.
D. Run OS updates.

Back 28

Answer: C

Front 29

QUESTION NO: 29
Which of the following should be implemented to have all workstations and servers isolated in their
own
broadcast domains?
A. VLANs
B. NAT
C. Access lists
D. Intranet

Back 29

Answer: A

Front 30

QUESTION NO: 30
End users are complaining about receiving a lot of email from online vendors and
pharmacies.Which of
the following is this an example of?
A. Trojan
B. Spam
C. Phishing
D. DNS poisoning

Back 30

Answer: B

Front 31

QUESTION NO: 31
Which of the following BEST describes a private key in regards to asymmetric encryption?
A. The key owner has exclusive access to the private key.
B. Everyone has access to the private key on the CA.
C. Only the CA has access to the private key.
D. The key owner and a recipient of an encrypted email have exclusive access to the private key.
WBerlin
Sans

Back 31

Answer: A

Front 32

QUESTION NO: 32
Which of the following logs might reveal the IP address and MAC address of a rogue device within
the local network?
A. Security logs
B. DHCP logs
C. DNS logs
D. Antivirus logs

Back 32

Answer: B

Front 33

QUESTION NO: 33
Which of the following is commonly used in a distributed denial of service (DDOS) attack?
A. Phishing
B. Adware
C. Botnet
D. Trojan

Back 33

Answer: C

Front 34

QUESTION NO: 34
Which of the following practices is MOST relevant to protecting against operating system security
flaws?
A. Network intrusion detection
B. Patch management
C. Firewall configuration
D. Antivirus selection

Back 34

Answer: B

Front 35

QUESTION NO: 35
Which of the following is a best practice for coding applications in a secure manner?
A. Input validation
B. Object oriented coding
C. Rapid Application Development (RAD)
D. Cross-site scripting

Back 35

Answer: A

Front 36

QUESTION NO: 36
Which of the following technologies can be used as a means to isolate a host OS from some types
of security threats?
A. Intrusion detection
B. Virtualization
C. Kiting
D. Cloning

Back 36

Answer: B

Front 37

QUESTION NO: 37
Which of the following network tools would provide the information on what an attacker is doing to
compromise a system?
A. Proxy server
B. Honeypot
C. Internet content filters
D. Firewall

Back 37

Answer: B

Front 38

QUESTION NO: 38
Assigning proper security permissions to files and folders is the primary method of mitigating
which of the following?
A. Hijacking
B. Policy subversion
C. Trojan
D. DoS

Back 38

Answer: C

Front 39

QUESTION NO: 39
Which of the following logical access controls would be MOST appropriate to use when creating
an account for a temporary worker?
A. ACL
B. Account expiration
C. Time of day restrictions
D. Logical tokens

Back 39

Answer: B

Front 40

QUESTION NO: 40
Which of the following may be an indication of a possible system compromise?
A. A port monitor utility shows that there are many connections to port 80 on the Internet facing
web server.
B. A performance monitor indicates a recent and ongoing drop in speed, disk space or memory
utilization
from the baselinE.
C. A protocol analyzer records a high number of UDP packets to a streaming media server on the
Internet.
D. The certificate for one of the web servers has expired and transactions on that server begins to
drop
rapidly.

Back 40

Answer: B

Front 41

QUESTION NO: 41
An administrator suspects that files are being copied to a remote location during off hours. The file
server does not have logging enableD. Which of the following logs would be the BEST place to
look for information?
A. Intrusion detection logs
B. Firewall logs
C. Antivirus logs
D. DNS logs

Back 41

Answer: B

Front 42

QUESTION NO: 42
Which of the following access control methods gives the owner control over providing
permissions?
A. Role-Based Access Control (RBAC)
B. Rule-Based Access control (RBAC)
C. Mandatory Access Control (MAC)
D. Discretionary Access Control (DAC)

Back 42

Answer: D

Front 43

QUESTION NO: 43
Which of the following access control methods grants permissions based on the users position in
the company?
A. Mandatory Access Control (MAC)
B. Rule-Based Access control (RBAC)
C. Discretionary Access Control (DAC)
D. Role-Based Access Control (RBAC)

Back 43

Answer: D

Front 44

QUESTION NO: 44
Which of the following access control methods includes switching work assignments at preset
intervals?
A. Job rotation
B. Mandatory vacations
C. Least privilege
D. Separation of duties

Back 44

Answer: A

Front 45

QUESTION NO: 45
Which of the following authentication methods would MOST likely prevent an attacker from being
able to successfully deploy a replay attack?
A. TACACS
B. RAS
C. RADIUS
D. Kerberos

Back 45

Answer: D

Front 46

QUESTION NO: 46
Which of the following would an attacker use to footprint a system?
A. RADIUS
B. Password cracker
C. Port scanner
D. Man-in-the-middle attack

Back 46

Answer: C

Front 47

QUESTION NO: 47
Which of the following ensures a user cannot deny having sent a message?
A. Availability
B. Integrity
C. Non-repudiation
D. Confidentiality

Back 47

Answer: C

Front 48

QUESTION NO: 48
Which of the following allows an attacker to embed a rootkit into a picture?
A. Trojan horse
B. Worm
C. Steganography
D. Virus

Back 48

Answer: C

Front 49

QUESTION NO: 49
Which of the following is a publication of inactivated user certificates?
A. Certificate revocation list
B. Certificate suspension
C. Recovery agent
D. Certificate authority

Back 49

Answer: A

Front 50

QUESTION NO: 50
Which of the following is a method of encrypting email?
A. S/MIME
B. SMTP
C. L2TP
D. VPN

Back 50

Answer: A

Front 51

QUESTION NO: 51
Which of the following risks would be reduced by implementing screen filters?
A. Replay attacks
B. Phishing
C. Man-in-the-middle attacks
D. Shoulder surfing

Back 51

Answer: D

Front 52

QUESTION NO: 52
Which of the following allows an attacker to hide the presence of malicious code by altering the
systems process and registry entries?
A. Logic bomb
B. Worm
C. Trojan
D. Rootkit

Back 52

Answer: D

Front 53

QUESTION NO: 53
Which of the following will propagate itself without any user interaction?
A. Worm
B. Rootkit
C. Trojan
D. Virus

Back 53

Answer: A

Front 54

QUESTION NO: 54
An administrator wants to setup their network with only one public IP address. Which of the
following would allow for this?
A. DMZ
B. VLAN
C. NIDS
D. NAT

Back 54

Answer: D

Front 55

QUESTION NO: 55
An administrator wants to proactively collect information on attackers and their attempted methods
of gaining access to the internal network. Which of the following would allow the administrator to
do this?
A. NIPS
B. Honeypot
C. DMZ
D. NIDS

Back 55

Answer: B

Front 56

QUESTION NO: 56
Which of the following allows a technician to correct a specific issue with a solution that has not
been fully tested?
A. Patch
B. Hotfix
C. Security roll-up
D. Service pack

Back 56

Answer: B

Front 57

QUESTION NO: 57
A technician wants to regulate and deny traffic to websites that contain information on
hacking.Which of the following would be the BEST solution to deploy?
A. Internet content filter
B. Proxy
C. Protocol analyzer
D. NIDS

Back 57

Answer: A

Front 58

QUESTION NO: 58
Which of the following is the LEAST intrusive way of checking the environment for known software
flaws?
A. Protocol analyzer
B. Vulnerability scanner
C. Port scanner
D. Penetration test

Back 58

Answer: B

Front 59

QUESTION NO: 59
If a certificate has been compromised, which of the following should be done?
A. Run the recovery agent.
B. Put the certificate on the CRL.
C. Put the certificate in key escrow.
D. Suspend the certificate for further investigation.

Back 59

Answer: B

Front 60

QUESTION NO: 60
Which of the following requires an update to the baseline after installing new software on a
machine?
A. Signature-based NIPS
B. Signature-based NIDS
C. Honeypot
D. Behavior-based HIDS

Back 60

Answer: D

Front 61

QUESTION NO: 61
Which of the following would be the MOST secure choice to implement for authenticating remote
connections?
A. LDAP
B. 8021x
C. RAS
D. RADIUS

Back 61

Answer: D

Front 62

QUESTION NO: 62
Which of the following is the BEST way to reduce the number of accounts a user must maintain?
A. Kerberos
B. CHAP
C. SSO
D. MD5

Back 62

Answer: C

Front 63

QUESTION NO: 63
Which of the following can be used as a means for dual-factor authentication?
A. RAS and username/password
B. RADIUS and L2TP
C. LDAP and WPA
D. Iris scan and proximity card

Back 63

Answer: D

Front 64

QUESTION NO: 64
After implementing file auditing, which of the following logs would show unauthorized usage
attempts?
A. Performance
B. System
C. Security
D. Application

Back 64

Answer: C

Front 65

QUESTION NO: 65
Which of the following type of attacks requires an attacker to sniff the network?
A. Man-in-the-Middle
B. DDoS attack
C. MAC flooding
D. DNS poisoning

Back 65

Answer: A

Front 66

QUESTION NO: 66
If a user attempts to go to a website and notices the URL has changed, which of the following
attacks is
MOST likely the cause?
A. DLL injection
B. DDoS attack
C. DNS poisoning
D. ARP poisoning

Back 66

Answer: C

Front 67

QUESTION NO: 67
Which of the following attacks can be caused by a user being unaware of their physical
surroundings?
A. ARP poisoning
B. Phishing
C. Shoulder surfing
D. Man-in-the-middle

Back 67

Answer: C

Front 68

QUESTION NO: 68
Which of the following actions should be performed upon discovering an unauthorized wireless
access point attached to a network?
A. Unplug the Ethernet cable from the wireless access point.
B. Enable MAC filtering on the wireless access point.
C. Change the SSID on the wireless access point.
D. Run a ping against the wireless access point.

Back 68

Answer: A

Front 69

QUESTION NO: 69
Which of the following redundancy solutions contains hardware systems similar to the affected
organization, but does not provide live data?
A. Hot site
B. Uninterruptible Power Supply (UPS)
C. Warm site
D. Cold site

Back 69

Answer: C

Front 70

QUESTION NO: 70
During the implementation of LDAP, which of the following will typically be changed within the
organizations software programs?
A. IP addresses
B. Authentication credentials
C. Non-repudiation policy
D. Network protocol

Back 70

Answer: B

Front 71

QUESTION NO: 71
Which of the following would be MOST useful to determine why packets from a computer outside
the network are being dropped on the way to a computer inside the network?
A. HIDS log
B. Security log
C. Firewall log
D. System log

Back 71

Answer: C

Front 72

QUESTION NO: 72
Which of the following security policies is BEST to use when trying to mitigate the risks involved
with allowing a user to access company email via their cell phone?
A. The cell phone should require a password after a set period of inactivity.
B. The cell phone should only be used for company related emails.
C. The cell phone data should be encrypted according to NIST standards.
D. The cell phone should have data connection abilities disableD.

Back 72

Answer: A

Front 73

QUESTION NO: 73
An administrator has been asked to encrypt credit card datA. Which of the following algorithms
would be the MOST secure with the least CPU utilization?
A. 3DES
B. AES
C. SHA-1
D. MD5

Back 73

Answer: B

Front 74

QUESTION NO: 74
Which of the following algorithms is the LEAST secure?
A. NTLM
B. MD5
C. LANMAN
D. SHA-1

Back 74

Answer: C

Front 75

QUESTION NO: 75
Which of the following algorithms is MOST closely associated with the signing of email messages?
A. MD5
B. TKIP
C. PGP
D. SHA-1

Back 75

Answer: C

Front 76

QUESTION NO: 76
An executive uses PKI to encrypt sensitive emails sent to an assistant. In addition to encrypting
the body of the email, the executive wishes to encrypt the signature so that the assistant can verify
that the email actually came from the executive. Which of the following asymmetric keys should
the executive use to encrypt the signature?
A. Public
B. Private
C. Shared
D. Hash

Back 76

Answer: B

Front 77

QUESTION NO: 77
A technician needs to detect staff members that are connecting to an unauthorized website. Which
of the following could be used?
A. Protocol analyzer
B. Bluesnarfing
C. Host routing table
D. HIDS

Back 77

Answer: A

Front 78

QUESTION NO: 78
An administrator suspects that multiple PCs are infected with a zombie. Which of the following
tools
could be used to confirm this?
A. Antivirus
B. Recovery agent
C. Spyware
D. Port scan

Back 78

Answer: A

Front 79

QUESTION NO: 79
Which of the following is an example of security personnel that administer access control
functions, but
do not administer audit functions?
A. Access enforcement
B. Separation of duties
C. Least privilege
D. Account management

Back 79

Answer: B

Front 80

QUESTION NO: 80
A malware incident has just been detected within a company. Which of the following should be the
administrators FIRST response?
A. Removal
B. Containment
C. Recovery
D. Monitor

Back 80

Answer: B

Front 81

QUESTION NO: 81
Taking into account personal safety, which of the following types of fire suppression substances
would BEST prevent damage to electronic equipment?
A. Foam
B. CO2
C. Halon
D. Water

Back 81

Answer: B

Front 82

QUESTION NO: 82
Which of the following describes the process of securely removing information from media (E. g.
hard drive) for future use?
A. Reformatting
B. Destruction
C. Sanitization
D. Deleting

Back 82

Answer: C

Front 83

QUESTION NO: 83
Which of the following principles should be applied when assigning permissions?
A. Most privilege
B. Least privilege
C. Rule based
D. Role based

Back 83

Answer: B

Front 84

QUESTION NO: 84
Which of the following type of strategies can be applied to allow a user to enter their username
and password once in order to authenticate to multiple systems and applications?
A. Two-factor authentication
B. Single sign-on
C. Smart card
D. Biometrics

Back 84

Answer: B

Front 85

QUESTION NO: 85
User A is a member of the payroll security group. Each member of the group should have
read/write permissions to a sharE. User A was trying to update a file but when the user tried to
access the file the user was denieD. Which of the following would explain why User A could not
access the file?
A. Privilege escalation
B. Rights are not set correctly
C. Least privilege
D. Read only access

Back 85

Answer: B

Front 86

QUESTION NO: 86
Which of the following threats is the MOST difficult to detect and hides itself from the operating
system?
A. Rootkit
B. Adware
C. Spyware
D. Spam

Back 86

Answer: A

Front 87

QUESTION NO: 87
Which of the following methods is used to perform denial of service (DoS) attacks?
A. Privilege escalation
B. Botnet
C. Adware
D. Spyware

Back 87

Answer: B

Front 88

QUESTION NO: 88
Which of the following is an attack that is triggered by a specific event or by a date?
A. Logic bomb
B. Spam
C. Rootkit
D. Privilege escalation

Back 88

Answer: A

Front 89

QUESTION NO: 89
Which of the following can an attacker use to gather information on a system without having a user
ID or password?
A. NAT
B. DNS poisoning
C. Null session
D. Spoofing

Back 89

Answer: C

Front 90

QUESTION NO: 90
Which of the following is a way to logically separate a network through a switch?
A. Spanning port
B. Subnetting
C. VLAN
D. NAT

Back 90

Answer: C

Front 91

QUESTION NO: 91
Which of the following is a security threat when a new network device is configured for first-time
installation?
A. Attacker privilege escalation
B. Installation of a back door
C. Denial of Service (DoS)
D. Use of default passwords

Back 91

Answer: D

Front 92

QUESTION NO: 92
Which of the following is an exploit against a device where only the hardware model and
manufacturer
are known?
A. Replay attack
B. Denial of service (DoS)
C. Privilege escalation
D. Default passwords

Back 92

Answer: D

Front 93

QUESTION NO: 93
A technician is implementing a new wireless network for an organization. The technician should be
concerned with all of the following wireless vulnerabilities EXCEPT:
A. rogue access points.
B. 80211 modE.
C. weak encryption.
D. SSID broadcasts.

Back 93

Answer: B

Front 94

QUESTION NO: 94
Which of the following tools will allow the technician to find all open ports on the network?
A. Performance monitor
B. Protocol analyzer
C. Router ACL
D. Network scanner

Back 94

Answer: D

Front 95

QUESTION NO: 95
An organization is installing new servers into their infrastructurE. A technician is responsible for
making sure that all new servers meet security requirements for uptimE. In which of the following
is the availability requirements identified?
A. Service level agreement
B. Performance baseline
C. Device manufacturer documentation
D. Security template

Back 95

Answer: A

Front 96

QUESTION NO: 96
After issuance a technician becomes aware that some keys were issued to individuals who are not
authorized to use them. Which of the following should the technician use to correct this problem?
A. Recovery agent
B. Certificate revocation list
C. Key escrow
D. Public key recovery

Back 96

Answer: B

Front 97

QUESTION NO: 97
Password crackers are generally used by malicious attackers to:
A. verify system access.
B. facilitate penetration testing.
C. gain system access.
D. sniff network passwords.

Back 97

Answer: C

Front 98

QUESTION NO: 98
Which of the following properly describes penetration testing?
A. Penetration tests are generally used to scan the network and identify open ports.
B. Penetration tests are generally used to map the network and grab banners.
C. Penetration tests are generally used to exploit a weakness without permission and show how
an attacker might compromise a system.
D. Penetration tests are generally used to demonstrate a weakness in a system and then provide
documentation on the weakness.

Back 98

Answer: D

Front 99

QUESTION NO: 99
Which of the following should a technician review when a user is moved from one department to
another?
A. User access and rights
B. Data storage and retention policies
C. Users group policy
D. Acceptable usage policy

Back 99

Answer: A

Front 100

QUESTION NO: 100
Which of the following is a reason to implement security logging on a DNS server?
A. To monitor unauthorized zone transfers
B. To measure the DNS server performance
C. To perform penetration testing on the DNS server
D. To control unauthorized DNS DoS

Back 100

Answer: A

Front 101

QUESTION NO: 101
A technician is rebuilding the infrastructure for an organization. The technician has been tasked
with making sure that the virtualization technology is implemented securely. Which of the following
is a concern when implementing virtualization technology?
A. The technician should verify that the virtual servers are dual homed so that traffic is securely
separateD.
B. The technician should verify that the virtual servers and the host have the latest service packs
and
patches applieD.
C. The technician should subnet the network so each virtual server is on a different network
segment.
D. The technician should perform penetration testing on all the virtual servers to monitor
performancE.

Back 101

Answer: B

Front 102

QUESTION NO: 102
A technician is reviewing the logical access control method an organization uses. One of the
senior managers requests that the technician prevent staff members from logging on during nonworking
days.
Which of the following should the technician implement to meet managements request?
A. Enforce Kerberos
B. Deploy smart cards
C. Time of day restrictions
D. Access control lists

Back 102

Answer: C

Front 103

QUESTION NO: 103
How would a technician implement a security patch in an enterprise environment?
A. Download the patch from the vendors secure website and install it on the most vulnerable
workstation.
B. Download the patch from the vendors secure website, test the patch and install it on all
workstations.
C. Download the patch from the vendors secure website and install it as needeD.
D. Download the patch from the Internet, test the patch and install it on all of the production
servers.WBerlin
Sans

Back 103

Answer: B

Front 104

QUESTION NO: 104
Which of the following is considered the weakest encryption?
A. AES
B. DES
C. SHA
D. RSA

Back 104

Answer: B

Front 105

QUESTION NO: 105
Which of the following encryption schemes is the public key infrastructure based on?
A. Quantum
B. Elliptical curve
C. Asymmetric
D. Symmetric

Back 105

Answer: C

Front 106

QUESTION NO: 106
Which of the following BEST describes the term war driving?
A. Driving from point to point with a laptop and an antenna to find unsecured wireless access
points.
B. Driving from point to point with a wireless scanner to read other users emails through the
access point.
C. Driving from point to point with a wireless network card and hacking into unsecured wireless
access
points.
D. Driving from point to point with a wireless scanner to use unsecured access points.

Back 106

Answer: A

Front 107

QUESTION NO: 107
Which of the following statements BEST describes the implicit deny concept?
A. Blocks everything and only allows privileges based on job description
B. Blocks everything and only allows explicitly granted permissions
C. Blocks everything and only allows the minimal required privileges
D. Blocks everything and allows the maximum level of permissions

Back 107

Answer: B

Front 108

QUESTION NO: 108
When is the BEST time to update antivirus definitions?
A. At least once a week as part of system maintenance
B. As the definitions become available from the vendor
C. When a new virus is discovered on the system
D. When an attack occurs on the network

Back 108

Answer: B

Front 109

QUESTION NO: 109
Why would a technician use a password cracker?
A. To look for weak passwords on the network
B. To changea users passwords when they leave the company
C. To enforce password complexity requirements
D. To change users passwords if they have forgotten them

Back 109

Answer: A

Front 110

QUESTION NO: 110
Users on a network report that they are receiving unsolicited emails from an email address that
does not change. Which of the following steps should be taken to stop this from occurring?
A. Configure a rule in eachusers router and restart the router.
B. Configure rules on the users host and restart the host.
C. Install an anti-spam filter on the domain mail servers and filter the email address.
D. Install an ACL on the firewall to block traffic from the sender and filter the IP address.

Back 110

Answer: C

Front 111

QUESTION NO: 111
Which of the following is a true statement with regards to a NIDS?
A. A NIDS monitors and analyzes network traffic for possible intrusions.
B. A NIDS is installed on the proxy server.
C. A NIDS prevents certain types of traffic from entering a network.
D. A NIDS is normally installed on the email server.

Back 111

Answer: A

Front 112

QUESTION NO: 112
A technician suspects that a piece of malware is consuming too many CPU cycles and slowing
down a system. Which of the following will help determine the amount of CPU cycles that are
being consumed?
A. Install HIDS to determine the CPU usage.
B. Run performance monitor to evaluate the CPU usage.
C. Install malware scanning software.
D. Use a protocol analyzer to find the cause of the traffic.

Back 112

Answer: B

Front 113

QUESTION NO: 113
Which of the following are characteristics of a hash function? (Select TWO).
A. One-way
B. Encrypts a connection
C. Ensures data can be easily decrypted
D. Fixed length output
E. Requires a key

Back 113

Answer: A,D

Front 114

QUESTION NO: 114
Which of the following is the MOST secure alternative for administrative access to a router?
A. SSH
B. Telnet
C. rlogin
D. HTTP

Back 114

Answer: A

Front 115

QUESTION NO: 115
Which of the following might an attacker resort to in order to recover discarded company
documents?
A. Phishing
B. Insider theft
C. Dumpster diving
D. Shoulder surfing

Back 115

Answer: C

Front 116

QUESTION NO: 116
Which of the following creates a security buffer zone between two rooms?
A. Mantrap
B. DMZ
C. Turnstile
D. Anti-pass back

Back 116

Answer: A

Front 117

QUESTION NO: 117
Which of the following tools would be used to review network traffic for clear text passwords?
A. Port scanner
B. Protocol analyzer
C. Firewall
D. Password cracker

Back 117

Answer: B

Front 118

QUESTION NO: 118
Kerberos uses which of the following trusted entities to issue tickets?
A. Ticket Granting System
B. Certificate Authority
C. Internet Key Exchange
D. Key Distribution Center

Back 118

Answer: D

Front 119

QUESTION NO: 119
Which of the following specifies a set of consistent requirements for a workstation or server?
A. Vulnerability assessment
B. Imaging software
C. Patch management
D. Configuration baseline

Back 119

Answer: D

Front 120

QUESTION NO: 120
A companys website allows customers to search for a product and display the current price and
quantity available of each product from the production databasE. Which of the following would
invalidate an SQL injection attack launched from the lookup field at the web server level?
A. Security template
B. Buffer overflow protection
C. NIPS
D. Input validation

Back 120

Answer: D

Front 121

QUESTION NO: 121
Which of the following virtual machine components monitors and manages the various virtual
instances?
A. VMOS
B. VCPU
C. Hypervisor
D. Virtual supervisor

Back 121

Answer: C

Front 122

QUESTION NO: 122
A smurf attack is an example of which of the following threats?
A. ARP Poisoning
B. DoS
C. TCP/IP Hijacking
D. Man-in-the-middle

Back 122

Answer: B

Front 123

QUESTION NO: 123
Which of the following is the BEST tool for allowing users to go to approved business-related
websites only?
A. Internet content filter
B. Firewall
C. ACL
D. Caching server

Back 123

Answer: A

Front 124

QUESTION NO: 124
Which of the following is a security trait of a virtual machine?
A. Provides additional resources for testing
B. Provides real-time access to all system processes
C. Provides a read-only area for executing code
D. Provides a restricted environment for executing code

Back 124

Answer: D

Front 125

QUESTION NO: 125
An unauthorized user intercepted a users password and used this information to obtain the
companys administrator password. The unauthorized user can use the administrators password to
access sensitive information pertaining to client datA. Which of the following is this an example of?
A. Session hijacking
B. Least privilege
C. Privilege escalation
D. Network address translation

Back 125

Answer: C

Front 126

QUESTION NO: 126
Users are utilizing thumb drives to connect to USB ports on company workstations. A technician is
concerned that sensitive files can be copied to the USB drives.Which of the following mitigation
techniques would address this concern? (Select TWO).
A. Disable the USB root hub within the OS.
B. Install anti-virus software on the USB drives.
C. Disable USB within the workstations BIOS.
D. Apply the concept of least privilege to USB devices.
E. Run spyware detection against all workstations.

Back 126

Answer: A,C

Front 127

QUESTION NO: 127
An administrator has developed an OS install that will implement the tightest security controls
possible.
In order to quickly replicate these controls on all systems, which of the following should be
established?
A. Take screen shots of the configuration options.
B. Create an image from the OS install.
C. Create a boot disk for the operating system.
D. Implement OS hardening procedures.

Back 127

Answer: B

Front 128

QUESTION NO: 128
After registering an email address on a website, a user starts receiving messages from unknown
sources. The email account is new, and therefore the user is concerneD. This type of message
traffic is referred to as:
A. instant message traffiC.
B. SPIM.
C. S/MIME.
D. spam.

Back 128

Answer: D

Front 129

QUESTION NO: 129
A technician is testing the security of a new database application with a website front-end. The
technician notices that when certain characters are input into the application it will crash the
server. Which of the following does the technician need to do?
A. Utilize SSL on the website
B. Implement an ACL
C. Lock-down the database
D. Input validation

Back 129

Answer: D

Front 130

QUESTION NO: 130
An administrator in a small office environment has implemented an IDS on the network perimeter
to detect malicious traffic patterns. The administrator still has a concern about traffic inside the
network originating between client workstations. Which of the following could be implemented?
A. HIDS
B. A VLAN
C. A network router
D. An access list

Back 130

Answer: A

Front 131

QUESTION NO: 131
A user is redirected to a different website when the user requests the DNS record
www.xyz.comptiA. com. Which of the following is this an example of?
A. DNS poisoning
B. DoS
C. DNS caching
D. Smurf attack

Back 131

Answer: A

Front 132

QUESTION NO: 132
A company wants to host public servers on a new network. These servers will include a website
and
mail server.Which of the following should be implemented on the network to isolate these public
hosts from
the rest of the network?
A. IPv6
B. IPSec
C. DMZ
D. VLAN

Back 132

Answer: C

Front 133

QUESTION NO: 133
A user has decided that they do not want an internal LAN segment to use public IP addresses.
The user wants to translate them as private IP addresses to a pool of public IP addresses to
identify them on the Internet. Which of the following does the user want to implement?
A. IPSec
B. NAT
C. SSH
D. SFTP

Back 133

Answer: B

Front 134

QUESTION NO: 134
An administrator has been studying stateful packet inspection and wants to implement this security
technique on the network. Which of the following devices could the administrator use to BEST
utilize stateful packet inspection?
A. Hub
B. IDS
C. Switch
D. Firewall

Back 134

Answer: D

Front 135

QUESTION NO: 135
Which of the following is the primary purpose of a honeypot?
A. Translate addresses at the perimeter
B. To provide a decoy target on the network
C. Provide cryptography for the network
D. Work as a network proxy

Back 135

Answer: B

Front 136

QUESTION NO: 136
An administrator wants to ensure that that no equipment is damaged when there is a fire or false
alarm in the server room. Which of the following type of fire suppression systems should be used?
A. Carbon Dioxide
B. Hydrogen Peroxide
C. Wet pipe sprinkler
D. Deluge sprinkler

Back 136

Answer: A

Front 137

QUESTION NO: 137
Which of the following is a CRL composed of?
A. Public Key Infrastructure (PKI)
B. Expired or revoked certificates
C. Certificate authorities
D. Expired user accounts

Back 137

Answer: B

Front 138

QUESTION NO: 138
Which of the following is the primary purpose of a CA?
A. LANMAN validation
B. Encrypt data
C. Kerberos authentication
D. Issue private/public keys

Back 138

Answer: D

Front 139

QUESTION NO: 139
An administrator wants to replace telnet with a more secure protocol to manage a network device.
Which of the following should be implemented on the network?
A. SMTP
B. SNMP
C. SFTP
D. SSH

Back 139

Answer: D

Front 140

QUESTION NO: 140
A user is attempting to receive digitally signed and encrypted email messages from a remote
office.
Which of the following protocols does the system need to support?
A. SMTP
B. S/MIME
C. ISAKMP
D. IPSec

Back 140

Answer: B

Front 141

QUESTION NO: 141
An administrator does not want anyone to VPN from inside the network to a remote office or
network.
Which of the following protocols should be blocked outbound on the network?
A. TPM
B. OVAL
C. SNMP
D. ISAKMP

Back 141

Answer: D

Front 142

QUESTION NO: 142
An administrator is implementing a public website and they want all client connections to the
server to be encrypted via their web browser. Which of the following should be implemented?
A. SSL
B. SHA-1
C. Blowfish
D. 3DES

Back 142

Answer: A

Front 143

QUESTION NO: 143
Which of the following is MOST likely provided by asymmetric key cryptography?
A. Performance
B. A pre-shared key
C. Kiting
D. Confidentiality

Back 143

Answer: D

Front 144

QUESTION NO: 144
All of the following are symmetric key algorithms EXCEPT:
A. ECC.
B. Rijndael.
C. 3DES.
D. RC4

Back 144

Answer: A

Front 145

QUESTION NO: 145
Which of the following is true about ECC algorithms?
A. It is the algorithm used in PGP.
B. It is implemented in portable devices.
C. It is a private key algorithm.
D. It is CPU intensivE.

Back 145

Answer: B

Front 146

QUESTION NO: 146
Which of the following is a way to encrypt session keys using SSL?
A. Session keys are sent unencrypteD.
B. Session keys are encrypted using an asymmetric algorithm.
C. Session keys are sent in clear text because they are private keys.
D. Session keys are encrypted using a symmetric algorithm.

Back 146

Answer: B

Front 147

QUESTION NO: 147
Which of the following can reduce the risk associated with password guessing attacks? (Select
TWO).
A. Implement single sign-on.
B. Implement shared passwords.
C. Implement account-lockout thresholds.
D. Implement shadow passwords.
E. Implement stronger password complexity policies.

Back 147

Answer: C,E

Front 148

QUESTION NO: 148
Which of the following is a common practice in forensic investigation?
A. Performing a Gutman sanitization of the drive
B. Performing a binary copy of the systems storage media
C. Performing a file level copy of the systems storage media
D. Performing a sanitization of the drive

Back 148

Answer: B

Front 149

QUESTION NO: 149
Which of the following is done to ensure appropriate personnel have access to systems and
networks?
(Select TWO).
A. Conduct periodic penetration testing assessments.
B. Conduct periodic personnel employment verifications.
C. Conduct rights review of users and groups.
D. Conduct virus scan.
E. Conduct vulnerability assessments.

Back 149

Answer: B,C

Front 150

QUESTION NO: 150
Antivirus software products detect malware by comparing the characteristics of known instances
against which of the following type of file sets?
A. Signature
B. Text
C. NIDS signature
D. Dynamic Library

Back 150

Answer: A

Front 151

QUESTION NO: 151
Which of the following type of fire suppression tools would cause the MOST damage to electrical
equipment?
A. Water
B. Carbon Dioxide
C. Halon
D. Foam

Back 151

Answer: A

Front 152

QUESTION NO: 152
Which of the following is the BEST process of removing PII data from a disk drive before reuse?
A. Destruction
B. Sanitization
C. Reformatting
D. Degaussing

Back 152

Answer: B

Front 153

QUESTION NO: 153
When assigning permissions, which of the following concepts should be applied to enable a
person to perform their job task?
A. Rule based
B. Discretionary access control (DAC)
C. Least privilege
D. Role based

Back 153

Answer: C

Front 154

QUESTION NO: 154
While conducting a review of the system logs, a user had attempted to log onto the network over
250 times. Which of the following type of attacks is MOST likely occurring?
A. Brute force
B. Phishing
C. Spamming
D. DNS spoofing

Back 154

Answer: A

Front 155

QUESTION NO: 155
Users do not want to enter credentials to each server or application to conduct their normal work.
Which of the following type of strategies will resolve this issue?
A. Smart card
B. Two-factor authentication
C. Biometrics
D. SSO

Back 155

Answer: D

Front 156

QUESTION NO: 156
A user was trying to update an open file but when they tried to access the file they were denied.
Which of the following would explain why the user could not access the file?
A. Audit only access
B. Execute only access
C. Rights are not set correctly
D. Write only access

Back 156

Answer: C

Front 157

QUESTION NO: 157
Accessing a system or application using permissions from another users account is a form of
which of the following?
A. Phishing
B. Domain kiting
C. ARP spoofing
D. Privilege escalation

Back 157

Answer: D

Front 158

QUESTION NO: 158
Which of the following is an important reason for password protecting the BIOS?
A. To maintain password complexity requirements
B. To prevent system start-up without knowing the password
C. To keep a user from changing the boot order of the system
D. To keep a virus from overwriting the BIOS

Back 158

Answer: C

Front 159

QUESTION NO: 159
Which of the following is a software bundle containing multiple security fixes?
A. Patch management
B. A hotfix
C. Service pack
D. A patch

Back 159

Answer: C

Front 160

ervicexx, where xx is the last two numbers of the users cell phone number. The users
are not required to change this password. Which of the following is this an example of?
A. Default accounts
B. Known plain text
C. Back door
D. Weak passwords

Back 160

Answer: D

Front 161

QUESTION NO: 161
Which of the following is an installable package that includes several patches from the same
vendor for various applications?
A. Hotfix
B. Patch template
C. Service pack
D. Patch rollup

Back 161

Answer: C

Front 162

QUESTION NO: 162
Which of the following is a best practice to prevent users from being vulnerable to social
engineering?
A. Have a solid acceptable use policy in place with a click through banner.
B. Provide thorough and frequent user awareness training.
C. Haveuser sign both the acceptable use policy and security based HR policy.
D. Provide a service level agreement that addresses social engineering issues.

Back 162

Answer: B

Front 163

QUESTION NO: 163
The RAS logs on a server show 100 errors in a two minute time period from an attempt to access
an account. The error log shows unknown username or passworD. Which of the following is this
an example of?
A. The local firewall is blocking GRE packets.
B. An unauthorized attempt to access the server.
C. The end users ISPis having issues with packet loss.
D. One of the users forgot their password and kept trying to login.

Back 163

Answer: B

Front 164

QUESTION NO: 164
An administrator notices that former temporary employees accounts are still active on a domain.
Which of the following can be implemented to increase security and prevent this from happening?
A. Run a last logon script to look for inactive accounts.
B. Implement an account expiration date for temporary employees.
C. Implement a password expiration policy.
D. Implement time of day restrictions for all temporary employees.

Back 164

Answer: B

Front 165

QUESTION NO: 165
Which of the following is the primary security risk with coaxial cable?
A. Diffusion of the core light source
B. Data emanation from the core
C. Crosstalk between the wire pairs
D. Refraction of the signal

Back 165

Answer: B

Front 166

QUESTION NO: 166
Which of the following is a collection of patches?
A. A security template
B. A service pack
C. A security hotfix
D. A security baseline

Back 166

Answer: B

Front 167

QUESTION NO: 167
Which of the following would allow an administrator to find weak passwords on the network?
A. A network mapper
B. A hash function
C. A password generator
D. A rainbow table

Back 167

Answer: D

Front 168

QUESTION NO: 168
Which of the following is the BEST place where the disaster recovery plan should be kept?
A. Printed out and kept in the desk of the CIO
B. At multiple offsite locations
C. Multiple copies printed out and kept in the server room
D. On the network file server

Back 168

Answer: B

Front 169

QUESTION NO: 169
Which of the following is established immediately upon evidence seizure?
A. Start the incident respond plan
B. Damage and loss control
C. Chain of custody
D. Forensic analysis

Back 169

Answer: C

Front 170

QUESTION NO: 170
Which of the following is a required privilege that an administrator must have in order to restore a
public/private key set on a certificate authority (CA)?
A. Recovery agent
B. Registration authority
C. Domain administrator
D. Group administrator

Back 170

Answer: A

Front 171

QUESTION NO: 171
Which of the following algorithms have the smallest key space?
A. IDEA
B. SHA-1
C. AES
D. DES

Back 171

Answer: D

Front 172

QUESTION NO: 172
Which of the following is the MOST recent addition to cryptography?
A. AES
B. DES
C. 3DES
D. PGP

Back 172

Answer: A

Front 173

QUESTION NO: 173
Which of the following requires a common pre-shared key before communication can begin?
A. Public key infrastructure
B. Symmetric key cryptography
C. Secure hashing algorithm
D. Asymmetric key cryptography

Back 173

Answer: B

Front 174

QUESTION NO: 174
Which of the following provides the MOST comprehensive redundancy for an entire site with the
least downtime?
A. A warm site
B. A cold site
C. Amobile site
D. A hot site

Back 174

Answer: D

Front 175

QUESTION NO: 175
Which of the following allows devices attached to the same switch to have separate broadcast
domains?
A. NAT
B. DMZ
C. NAC
D. VLAN

Back 175

Answer: D

Front 176

QUESTION NO: 176
Which of the following allows for notification when a hacking attempt is discovered?
A. NAT
B. NIDS
C. Netflow
D. Protocol analyzer

Back 176

Answer: B

Front 177

QUESTION NO: 177
When dealing with a 10BASE5 network, which of the following is the MOST likely security risk?
A. An incorrect VLAN
B. SSID broadcasting
C. A repeater
D. A vampire tap

Back 177

Answer: D

Front 178

QUESTION NO: 178
Which of the following allows a technician to scan for missing patches on a device without actually
attempting to exploit the security problem?
A. A vulnerability scanner
B. Security baselines
C. A port scanner
D. Group policy

Back 178

Answer: A

Front 179

QUESTION NO: 179
Which of the following allows for proof that a certain person sent a particular email?
A. Steganography
B. Integrity
C. Trusted Platform Module
D. Non-repudiation

Back 179

Answer: D

Front 180

QUESTION NO: 180
Which of the following uses a key ring?
A. AES
B. DES
C. PGP
D. RSA

Back 180

Answer: C

Front 181

QUESTION NO: 181
Which of the following allows for the highest level of security at time of login?
A. Single sign-on
B. Two-factor authentication
C. One-factor authentication
D. NTLMv2

Back 181

Answer: B

Front 182

QUESTION NO: 182
Sending a patch through a testing and approval process is an example of which of the following?
A. Disaster planning
B. Change management
C. Acceptable use policies
D. User education and awareness training

Back 182

Answer: B

Front 183

QUESTION NO: 183
Sending continuous TCP requests to a device and ignoring the return information until the device
ceases to accept new connections is an example of which of the following?
A. TCP/IP hijacking
B. DNS poisoning
C. Kiting
D. DoS

Back 183

Answer: D

Front 184

QUESTION NO: 184
Which of the following would use a group of bots to stop a web server from accepting new
requests?
A. DoS
B. DDoS
C. MAC
D. ARP

Back 184

Answer: B

Front 185

QUESTION NO: 185
Which of the following is the MOST likely to generate static electricity?
A. Low humidity and high temperature
B. High humidity and low temperature
C. Low humidity and low temperature
D. High humidity and high temperature

Back 185

Answer: A

Front 186

QUESTION NO: 186
Using an asymmetric key cryptography system, where can a technician generate the key pairs?
A. A certificate authority
B. IETF
C. A key escrow service
D. A recovery agent

Back 186

Answer: A

Front 187

QUESTION NO: 187
Which of the following media is the LEAST likely to be successfully tapped into?
A. Unshielded twisted pair cable
B. Coaxial cable
C. Fiber optic cable
D. Shielded twisted pair cable

Back 187

Answer: C

Front 188

QUESTION NO: 188
Which of the following allows a person to find public wireless access points?
A. Weak encryption
B. 8021x
C. SSID broadcast
D. Data emanation

Back 188

Answer: C

Front 189

QUESTION NO: 189
Which of the following allows a file to have different security permissions for users that have the
same roles or user groups?
A. Mandatory Access Control (MAC)
B. Role-Based Access Control (RBAC)
C. Discretionary Access Control (DAC)
D. Rule-Based Access Control (RBAC)

Back 189

Answer: C

Front 190

QUESTION NO: 190
A DMZ has a fake network that a hacker is attacking. Which of the following is this an example of?
A. Firewall
B. Man-in-the-middle
C. Proxy server
D. Honeypot

Back 190

Answer: D

Front 191

QUESTION NO: 191
A company decides that the purchasing agent and the accounts receivable agent should
exchange positions in order to allow for more oversight of past transactions. Which of the following
is this an example
of?
A. Least privilege
B. Implicit deny
C. Separation of duties
D. Job rotation

Back 191

Answer: D

Front 192

QUESTION NO: 192
A user complains that the color laser printer continuously gives an access denied message while
attempting to print a text document. The administrator logs onto the PC and prints successfully.
Which of the following should the administrator check FIRST?
A. That the printer has the correct size of paper in each of the trays
B. That the toner should be changed in the printer
C. That the user has sufficient rights to print to the printer
D. That the user is attempting to print to the correct printer tray

Back 192

Answer: C

Front 193

QUESTION NO: 193
Which of the following uses a sandbox to manage a programs ability to access system resources?
A. Java
B. ActiveX
C. JavaScript
D. Cold Fusion

Back 193

Answer: A

Front 194

QUESTION NO: 194
Which of the following allows a technician to view the security permissions of a file?
A. The access control list
B. The security baseline
C. The data emanation
D. The local security template

Back 194

Answer: A

Front 195

QUESTION NO: 195
A user is denied access to a filE. The user had access to the file yesterday. Which of the following
is the FIRST action for the technician to take?
A. Deny the users request and forward to the human resources department.
B. Reboot the system.
C. Verify that theusers permissions are correct.
D. Grant access to the filE.

Back 195

Answer: C

Front 196

QUESTION NO: 196
A user is convinced that someone is attempting to use their user account at night. Which of the
following should an administrator check FIRST in order to prove or disprove this claim?
A. The IDS logs
B. The security application logs
C. The local security logs
D. The firewall logs

Back 196

Answer: C

Front 197

QUESTION NO: 197
A user reports that a web based application is not working after a browser upgradE. Before the
upgrade, a login box would appear on the screen and disappear after login. The login box does
not appear after the upgradE. Which of the following BEST describes what to check FIRST?
A. That the software based firewall application trusts this site
B. That the pop-up blocker application trusts this site
C. That the antivirus application trusts this site
D. That the anti-spam application trusts this site

Back 197

Answer: B

Front 198

QUESTION NO: 198
An intrusion has been detected on a companys network from the Internet. Which of the following
should be checked FIRST?
A. The firewall logs
B. The DNS logs
C. The access logs
D. The performance logs

Back 198

Answer: A

Front 199

QUESTION NO: 199
A user needs to verify that a patch file downloaded from a third party has not been modified since
the time that the original manufacturer released the patch. Which of the following is the BEST way
to verify that the file has not been modified?
A. Compare the final MD5 hash with the original.
B. Download the patch file over an AES encrypted VPN connection.
C. Compare the final LANMAN hash with the original.
D. Download the patch file through a SSL connection.

Back 199

Answer: A

Front 200

QUESTION NO: 200
A technician suspects that one of the network cards on the internal LAN is causing a broadcast
storm.
Which of the following would BEST diagnose which NIC is causing this problem?
A. The NIDS log file
B. A protocol analyzer
C. The local security log file
D. The local firewall log file

Back 200

Answer: B

Front 201

QUESTION NO: 201
A user does not understand why the domain password policy is so stringent. Which of the
following BEST demonstrates the security basis for the password policy?
A. Explain how easy it is for a hacker to crack weak passwords.
B. Show the user a domain overview, including a list of weak passwords.
C. Refer the user to a strong password demonstrator.
D. Ask the user to review the corporate policies and procedures manual.

Back 201

Answer: A

Front 202

QUESTION NO: 202
A company needs to have multiple servers running low CPU utilization applications. Which of the
following is the MOST cost efficient method for accomplishing this?
A. Install multiple high end servers, sharing a clustered network operating system.
B. Install a single low end server, running multiple virtual servers.
C. Install a single high end server, running multiple virtual servers.
D. Install multiple low end servers, each running a network operating system.

Back 202

Answer: C

Front 203

QUESTION NO: 203
A programmer creates an application to accept data from a websitE. A user places more
information than the program expects in the input field resulting in the back end database placing
the extra information into the databasE. Which of the following is this an example of?
A. Java input error
B. Cross-site scripting
C. Buffer overflow
D. SQL injection

Back 203

Answer: D

Front 204

QUESTION NO: 204
Which of the following security threats is MOST commonly associated with a targeted distributed
denial of service (DDoS)?
A. Viruses
B. Worms
C. Botnets
D. Trojans

Back 204

Answer: C

Front 205

QUESTION NO: 205
A developer added code to a financial system designed to transfer money to a foreign bank
account on
a specific time and datE. The code would activate only if human resources processed the
developers termination papers. The developer implemented which of the following security
threats?
A. Logic bomb
B. Rootkit
C. Botnet
D. Privilege escalation

Back 205

Answer: A

Front 206

QUESTION NO: 206
A CEO is concerned about staff browsing inappropriate material on the Internet via HTTPS. It has
been suggested that the company purchase a product which could decrypt the SSL session, scan
the content and then repackage the SSL session without staff knowing.Which of the following type
of attacks is similar to this product?
A. Replay
B. Spoofing
C. TCP/IP hijacking
D. Man-in-the-middle

Back 206

Answer: D

Front 207

QUESTION NO: 207
After a system risk assessment was performed it was found that the cost to mitigate the risk was
higher than the expected loss if the risk was actualizeD. In this instance, which of the following is
the BEST course of action?
A. Accept the risk
B. Mitigate the risk
C. Reject the risk
D. Run a new risk assessment

Back 207

Answer: A

Front 208

7,290b

Back 208

Answer: D

Front 209

QUESTION NO: 209
A technician is deciding between implementing a HIDS on the database server or implementing a
NIDS. Which of the following are reasons why a NIDS may be better to implement? (Select TWO).
A. Many HIDS require frequent patches and updates.
B. Many HIDS are not able to detect network attacks.
C. Many HIDS have a negative impact on system performancE.
D. Many HIDS only offer a low level of detection granularity.
E. Many HIDS are not good at detecting attacks on database servers.

Back 209

Answer: B,C

Front 210

QUESTION NO: 210
Which of the following scenarios is MOST likely to benefit from using a personal software firewall
on a laptop?
A. Remote access user connecting via SSL VPN
B. Office laptop connected to the enterprise LAN
C. Remote access user connecting via corporate dial-in server
D. Office laptop connected to a homeusers network

Back 210

Answer: D

Front 211

QUESTION NO: 211
Virtualized applications, such as virtualized browsers, are capable of protecting the underlying
operating system from which of the following?
A. Malware installation from suspects Internet sites
B. Man-in-the-middle attacks
C. Phishing and spam attacks
D. DDoS attacks against the underlying OS

Back 211

Answer: A

Front 212

QUESTION NO: 212
A flat or simple role-based access control (RBAC) embodies which of the following principles?
A. Users assigned to roles, permissions are assigned to groups, controls applied to groups and
permissions acquired by controls
B. Users assigned permissions, roles assigned to groups and users acquire additional permissions
by being a member of a group
C. Roles applied to groups, users assigned to groups and users acquire permissions by being a
member of the group
D. Users assigned to roles, permissions are assigned to roles and users acquire permissions by
being a member of the role

Back 212

Answer: D

Front 213

QUESTION NO: 213
A number of unauthorized staff has been entering the data center by piggybacking authorized
staff. The CIO has mandated that this behavior stops. Which of the following is the BEST
technology to install at the data center to prevent piggybacking?
A. Mantrap
B. Security badges
C. Hardware locks
D. Token access

Back 213

Answer: A

Front 214

QUESTION NO: 214
Which of the following is a security threat that hides its processes and files from being easily
detected?
A. Trojan
B. Adware
C. Worm
D. Rootkit

Back 214

Answer: D

Front 215

QUESTION NO: 215
Security templates are used for which of the following purposes? (Select TWO).
A. To ensure that email is encrypted by users of PGP
B. To ensure that PKI will work properly within the companys trust model
C. To ensure that performance is standardized across all servers
D. To ensure that all servers start from a common security configuration
E. To ensure that servers are in compliance with the corporate security policy

Back 215

Answer: D,E

Front 216

QUESTION NO: 216
Frequent signature updates are required by which of the following security applications? (Select
TWO).
A. Antivirus
B. PGP
C. Firewall
D. PKI
E. IDS

Back 216

Answer: A,E

Front 217

QUESTION NO: 217
When choosing an antivirus product, which of the following are the MOST important security
considerations? (Select TWO).
A. The frequency of signature updates
B. The ability to scan encrypted files
C. The availability of application programming interface
D. The number of emails that can be scanned
E. The number of viruses the software can detect

Back 217

Answer: A,E

Front 218

QUESTION NO: 218
Three generally accepted activities of patch management are: determining which patches are
needed, applying the patches and which of the following?
A. Updating the firewall configuration to include the patches
B. Running a NIDS report to list the remaining vulnerabilities
C. Auditing for the successful application of the patches
D. Backing up the patch file executables to a network share

Back 218

Answer: C

Front 219

QUESTION NO: 219
In which of the following situations would it be appropriate to install a hotfix?
A. A patch in a service pack fixes the issue, but too many extra patches are includeD.
B. A patch is not available and workarounds do not correct the problem.
C. A patch is available, but has not yet been tested in a production environment.
D. A patch is too large to be distributed via a remote deployment tool.

Back 219

Answer: B

Front 220

QUESTION NO: 220
Social engineering, password cracking and vulnerability exploitation are examples of which of the
following?
A. Vulnerability assessment
B. Fingerprinting
C. Penetration testing
D. Fuzzing

Back 220

Answer: C

Front 221

QUESTION NO: 221
If an administrator does not have a NIDS examining network traffic, which of the following could be
used to identify an active attack?
A. Protocol analyzer
B. Penetration testing tool
C. Network mapper
D. Vulnerability scanner

Back 221

Answer: A

Front 222

QUESTION NO: 222
Configuration baselines should be taken at which of the following stages in the deployment of a
new system?
A. Before initial configuration
B. Before loading the OS
C. After a user logs in
D. After initial configuration

Back 222

Answer: D

Front 223

QUESTION NO: 223
Which of the following practices should be implemented to harden workstations and servers?
A. Log on only as the administrator.
B. Install only needed softwarE.
C. Check the logs regularly.
D. Report all security incidents.

Back 223

Answer: B

Front 224

QUESTION NO: 224
Which of the following is a mechanism that prevents electromagnetic emanations from being
captured?
A. Install a repeater
B. Uninterruptible power supply (UPS)
C. Faraday cage
D. Disable SSID broadcast

Back 224

Answer: C

Front 225

QUESTION NO: 225
Which of the following describes the difference between a secure cipher and a secure hash?
A. A hash produces a variable output for any input size, a cipher does not.
B. A cipher produces the same size output for any input size, a hash does not.
C. A cipher can be reversed, a hash cannot.
D. A hash can be reversed, a cipher cannot.

Back 225

Answer: C

Front 226

QUESTION NO: 226
Which of the following physical threats is prevented with mantraps?
A. Piggybacking
B. Social engineering
C. Dumpster diving
D. Shoulder surfing

Back 226

Answer: A

Front 227

QUESTION NO: 227
Which of the following BEST describes the differences between SHA-1 and MD5?
A. MD5 produces variable length message digests.
B. SHA-1 produces few collisions than MD5
C. MD5 produces few collisions than SHA-1
D. SHA-1 produces fixed length message digests.

Back 227

Answer: B

Front 228

QUESTION NO: 228
Which of the following BEST applies in the secure disposal of computers?
A. Computers must be configured for automated patch management.
B. Computer media must be sanitizeD.
C. Default passwords must be changed oncE.
D. Computers must be tested against known TCP/IP vulnerabilities.

Back 228

Answer: B

Front 229

QUESTION NO: 229
Which of the following BEST describes the differences between RADIUS and TACACS?
A. TACACS separates authentication, authorization and auditing capabilities.
B. TACACS is a remote access authentication servicE.
C. RADIUS is a remote access authentication servicE.
D. RADIUS separates authentication, authorization and auditing capabilities.

Back 229

Answer: A

Front 230

QUESTION NO: 230
Which of the following BEST describes the differences between RADIUS and TACACS?
A. RADIUS encrypts client-server negotiation dialog.
B. RADIUS is a remote access authentication servicE.
C. TACACS encrypts client-server negotiation dialog.
D. TACACS is a remote access authentication servicE.

Back 230

Answer: C

Front 231

QUESTION NO: 231
Which of the following authentication mechanisms performs better in a secure environment?
A. RADIUS because it is a remote access authentication servicE.
B. TACACS because it encrypts client-server negotiation dialogs.
C. RADIUS because it encrypts client-server passwords.
D. TACACS because it is a remote access authentication servicE.

Back 231

Answer: B

Front 232

QUESTION NO: 232
To evaluate the security compliance of a group of servers against best practices, which of the
following BEST applies?
A. Get a patch management report.
B. Conduct a penetration test.
C. Run a vulnerability assessment tool.
D. Install a protocol analyzer.

Back 232

Answer: C

Front 233

QUESTION NO: 233
Which of the following is a problem MOST often associated with UTP cable?
A. Fuzzing
B. Vampire tap
C. Crosstalk
D. Refraction

Back 233

Answer: C

Front 234

QUESTION NO: 234
An administrator notices on the monthly firewall log that many of the internal PCs are sending
packets on a routine basis to a single external PC. Which of the following BEST describes what is
occurring?
A. The remote PC has a spam slave application running and the local PCs have a spam master
application running.
B. The remote PC has a zombie master application running and the local PCs have a zombie
slave application running.
C. The remote PC has a spam master application running and the local PCs have a spam slave
application running.
D. The remote PC has a zombie slave application running and the local PCs have a zombie
master application running.

Back 234

Answer: B

Front 235

QUESTION NO: 235
An administrator notices that a PC is sending an unusual amount of email at odd times of the day.
Which of the following should the administrator check for FIRST?
A. A S/MIME buffer overflow
B. A POP3 protocol exception
C. DNS poisoning
D. A SMTP open relay

Back 235

Answer: D

Front 236

QUESTION NO: 236
Which of the following would a password cracker help an administrator to find?
A. Weak passwords
B. Expired passwords
C. Locked passwords
D. Backdoor passwords

Back 236

Answer: A

Front 237

QUESTION NO: 237
Which of the following is setup within a router?
A. ARP
B. DMZ
C. OVAL
D. DDoS

Back 237

Answer: B

Front 238

QUESTION NO: 238
Which of the following would BEST allow for fast, highly secure encryption of a USB flash drive?
A. SHA-1
B. MD5
C. 3DES
D. AES256

Back 238

Answer: D

Front 239

QUESTION NO: 239
When is the correct time to discuss the appropriate use of electronic devices with a new
employee?
A. At time of hire
B. At time of first correspondence
C. At time of departure
D. At time of first system login

Back 239

Answer: A

Front 240

QUESTION NO: 240
Which of the following could BEST assist in the recovery of a crashed hard drive?
A. Forensics software
B. Drive optimization
C. Drive sanitization
D. Damage and loss control

Back 240

Answer: A

Front 241

QUESTION NO: 241
Which of the following facilitates the creation of an unencrypted tunnel between two devices?
A. AES
B. HTTPS
C. L2TP
D. PPTP

Back 241

Answer: C

Front 242

QUESTION NO: 242
Which of the following allows for a secure connection to be made through a web browser?
A. L2TP
B. SSH
C. SSL
D. HTTP

Back 242

Answer: C

Front 243

QUESTION NO: 243
Which of the following is the BEST order in which crucial equipment should draw power?
A. Uninterruptible Power Supply (UPS) battery, UPS line conditioner, backup generator
B. Backup generator, UPS line conditioner, UPS battery
C. Backup generator, UPS battery, UPS line conditioner
D. UPS line conditioner, UPS battery, and backup generator

Back 243

Answer: D

Front 244

QUESTION NO: 244
Which of the following would require a pre-sharing of information before a home user could attach
to a neighbors wireless adapter?
A. Anonymous connections enabled
B. SSID broadcasting disabled
C. SSID broadcasting enabled
D. Encryption disabled

Back 244

Answer: B

Front 245

QUESTION NO: 245
Which of the following would BEST allow an administrator to quickly find a rogue server on the
network?
A. Review security access logs
B. A network mapper
C. A protocol analyzer
D. Review DNS logs

Back 245

Answer: B

Front 246

QUESTION NO: 246
Which of the following would BEST allow an administrator to quickly find a PC with a blank
database administrator password?
A. Protocol analyzer
B. Vulnerability scanner
C. Rainbow tables
D. Security access logs

Back 246

Answer: B

Front 247

QUESTION NO: 247
An administrator is backing up all server data nightly to a local NAS devicE. Which of the following
additional steps should the administrator take for protection from disaster in the case the primary
site is permanently lost?
A. Backup all data at a preset interval to tape and store those tapes at a sister site across the
street.
B. Backup all data at a preset interval to tape and store those tapes at a sister site in another city.
C. Backup all data at a preset interval to removable disk and store the disk in a safety deposit box
at theadministrators homE.
D. Backup all data at a preset interval to removable disk and store the disk in a fireproof safe in
the buildings basement.

Back 247

Answer: B

Front 248

QUESTION NO: 248
Which of the following is the MOST intrusive on a network?
A. Penetration testing
B. Protocol analyzers
C. Port scanners
D. Vulnerability testing

Back 248

Answer: A

Front 249

QUESTION NO: 249
A single sign-on requires which of the following?
A. Multifactor authentication
B. One-factor authentication
C. A trust model between workstations
D. A unified trust model

Back 249

Answer: D

Front 250

QUESTION NO: 250
All of the following are where backup tapes should be kept EXCEPT:
A. near a fiber optic cable entrance.
B. near a shared LCD screen.
C. near a power linE.
D. near a high end server.

Back 250

Answer: C

Front 251

QUESTION NO: 251
All of the following require periodic updates to stay accurate EXCEPT:
A. signature based HIDS.
B. pop-up blocker applications.
C. antivirus applications.
D. rootkit detection applications.

Back 251

Answer: B

Front 252

QUESTION NO: 252
Which of the following is the quickest method to create a secure test server for a programmer?
A. Install a network operating system on new equipment.
B. Create a virtual server on existing equipment.
C. Install a network operating system on existing equipment.
D. Create a virtual server on new equipment.

Back 252

Answer: B

Front 253

QUESTION NO: 253
Which of the following is a collection of fixes for an application or operating system that has been
tested by the vendor?
A. A security template
B. A service pack
C. A patch
D. A hotfix

Back 253

Answer: B

Front 254

QUESTION NO: 254
Which of the following usually applies specifically to a web browser?
A. Antivirus
B. Pop-up blocker
C. Anti-spyware
D. Personal software firewall

Back 254

Answer: B

Front 255

QUESTION NO: 255
Pre-shared keys apply to which of the following?
A. CA
B. PGP
C. TPM
D. Digital signature

Back 255

Answer: B

Front 256

QUESTION NO: 256
Which of the following is a risk associated with a virtual server?
A. If the physical server crashes, all of the local virtual servers go offline immediately.
B. If the physical server crashes, all of the physical servers nearby go offline immediately.
C. If a virtual server crashes, all of the virtual servers go offline immediately.
D. If a virtual server crashes, all of the physical servers go offline immediately.

Back 256

Answer: A

Front 257

QUESTION NO: 257
Which of the following exploits is only triggered by a specific date or time key?
A. Trojan
B. Worm
C. Botnet
D. Logic bomb

Back 257

Answer: D

Front 258

QUESTION NO: 258
Threats to a network could include: (Select TWO)
A. penetration testing.
B. network audits.
C. disgruntled employees.
D. dial-up access.
E. disabled user accounts.

Back 258

Answer: C,D

Front 259

QUESTION NO: 259
An antivirus server keeps flagging an approved application that the marketing department has
installed on their local computers as a threat. This is an example of:
A. false negative.
B. false positivE.
C. true negativE.
D. true positivE.

Back 259

Answer: B

Front 260

QUESTION NO: 260
A vendor releases an application update to a recent service pack that addresses problems being
experienced by some end users. This update would be considered a:
A. hotfix.
B. patch.
C. service pack rollup.
D. service pack.

Back 260

Answer: A

Front 261

QUESTION NO: 261
A technician is working on an end users desktop which has been having performance issues. The
technician notices there seems to be a lot of activity on the NIC. A good tool to quickly check the
current network connections of the desktop would be:
A. netops.
B. lanman.
C. netstat.
D. ipconfig /all.

Back 261

Answer: C

Front 262

QUESTION NO: 262
A company has an issue with field users logging into VPN to connect to the mail server, and
leaving their computers connected while in public places. The administrator needs to prevent both
unauthorized access to the company email and data, and limit the impact on the VPN server.
Which of the following BEST achieves this goal?
A. Set VPN to disconnect after five minutes of inactivity.
B. Use registry settings to lock computers after five minutes of inactivity, and limit VPN
connections to two hours.
C. Use group policy to lock computers after five minutes of inactivity, and limit VPN connections to
one hour.
D. Provide web mail access to all users.

Back 262

Answer: C

Front 263

QUESTION NO: 263
The service provided by message authentication code (MAC) hash is:
A. fault tolerancE.
B. key recovery.
C. data recovery.
D. integrity.

Back 263

Answer: D

Front 264

QUESTION NO: 264
An administrator is running a network monitoring application that looks for behaviors on the
network outside the standard baseline that has been establisheD. This is typical of a(n):
A. signature-based tool.
B. protocol analyzer.
C. honeynet.
D. anomaly-based tool.

Back 264

Answer: D

Front 265

QUESTION NO: 265
Some examples of hardening techniques include all of the following EXCEPT:
A. applying security templates.
B. running weekly spyware applications.
C. network-based patch management.
D. disabling all non-required services.

Back 265

Answer: B

Front 266

QUESTION NO: 266
An administrator wants to block users from accessing a few inappropriate websites as soon as
possiblE. The existing firewall allows blocking by IP address. To achieve this goal the
administrator will need to:
A. upgrade to a DNS based filter to achieve the desired result.
B. use the company AUP to achieve the desired result.
C. upgrade to a URL based filter to achieve the desired result.
D. upgrade to a text based filter to achieve the desired result.

Back 266

Answer: C

Front 267

QUESTION NO: 267
A CRL contains a list of which of the following type of keys?
A. Both public and private keys
B. Steganographic keys
C. Private keys
D. Public keys

Back 267

Answer: A

Front 268

QUESTION NO: 268
A user logs into their network with a smart carD. Which of the following keys is used?
A. Cipher key
B. Shared key
C. Public key
D. Privatekey

Back 268

Answer: D

Front 269

QUESTION NO: 269
An administrator wants to ensure that when an employee leaves the company permanently, that
the company will have access to their private keys. Which of the following will accomplish this?
A. Store the keys in escrow.
B. Immediately delete the account.
C. Store them in a CRL.
D. Obtain the employees hardware token.

Back 269

Answer: A

Front 270

QUESTION NO: 270
When a server and workstation communicate via SSL, which of the following keys are being used?
(Select TWO).
A. Public key
B. Cipher key
C. Session key
D. Recovery key
E. Keylogger

Back 270

Answer: A,C

Front 271

QUESTION NO: 271
A user is going to dispose of some old hard drives. Which of the following should the user do to
the
drives before disposing of them?
A. Reformat the hard drives oncE.
B. Use a certified wipe program to erase datA.
C. Install antivirus on the drives.
D. Run anti-spyware on the drives.

Back 271

Answer: B

Front 272

QUESTION NO: 272
A user wants to implement very tight security controls for technicians that seek to enter the users
datacenter. Which of the following solutions offers the BEST security controls?
A. Combination locks and key locks
B. Smartcard and proximity readers
C. Magnetic lock and pin
D. Biometric reader and smartcard

Back 272

Answer: D

Front 273

QUESTION NO: 273
Which of the following concepts, requires users and system processes to be assigned minimum
levels of permission to carry out the assigned task?
A. User authentication
B. Need-to-know
C. Least privilege
D. Job role

Back 273

Answer: C

Front 274

QUESTION NO: 274
When using discretionary access control (DAC), who determines access and what privileges they
have?
A. User
B. System
C. Help desk
D. Owner

Back 274

Answer: D

Front 275

QUESTION NO: 275
Which of the following is a security benefit of mandatory vacations?
A. Least privilege
B. Separation of duties
C. Reducing stress
D. Detecting fraud

Back 275

Answer: D

Front 276

QUESTION NO: 276
The data custodian in an organization is responsible for:
A. recoverability of the datA.
B. classification of the datA.
C. completeness of the datA.
D. accuracy of the datA.

Back 276

Answer: A

Front 277

QUESTION NO: 277
Which of the following organizational documentation describes how tasks or job functions should
be conducted?
A. Standards
B. Guideline
C. Policy
D. Procedures

Back 277

Answer: D

Front 278

QUESTION NO: 278
Which of the following organizational documentation provides high level objectives that change
infrequently?
A. Standards
B. Policy
C. Procedures
D. Guideline

Back 278

Answer: B

Front 279

QUESTION NO: 279
Which of the following sites can be online the QUICKEST and does not require data restoration
from backup media to ensure the production data is as current as possible?
A. Mobile site
B. Hot site
C. Warm site
D. Mirrored site

Back 279

Answer: D

Front 280

QUESTION NO: 280
Which of the following are MOST likely to be analyzed by Internet filter appliances/servers?
(Select
THREE).
A. Certificates
B. Keys
C. TLSs
D. URLs
E. Content
F. CRLs

Back 280

Answer: A,D,E

Front 281

QUESTION NO: 281
The primary function of risk management in an organization is to reduce risk to a level:
A. where the ARO equals the SLE.
B. the organization will mitigatE.
C. where the ALE is lower than the SLE.
D. the organization will accept.

Back 281

Answer: D

Front 282

QUESTION NO: 282
Which of the following BEST describes risk analysis?
A. Monitoring and acceptance
B. Evaluation and assessment
C. Assessment and eradication
D. Mitigation and repudiation

Back 282

Answer: B

Front 283

QUESTION NO: 283
A financial institution performed a risk assessment on the DLT backup system used to store
customer
account details. The main risk highlighted was the long-term retention of electronically stored datA.
Which
of the following is the MOST likely reason for the risk being raised?
A. Compatibility of media and application systems
B. Application systems and technical staff
C. Compatibility and retention of data on the media
D. Retention of data on the media

Back 283

Answer: A

Front 284

QUESTION NO: 284
Which of the following hashing techniques is commonly disabled to make password cracking more
difficult?
A. NTLM
B. AES
C. OVAL
D. Kerberos

Back 284

Answer: A

Front 285

QUESTION NO: 285
An organization has recently implemented a work from home program. Employees need to
connect
securely from home to the corporate network. Which of the following encryption technologies
might BEST
accomplish this?
A. PPTP
B. IPSec
C. L2TP
D. PPPoE

Back 285

Answer: B

Front 286

QUESTION NO: 286
The use of a physical token, PIN and a password during authentication is an example of which of
the
following?
A. Two-factor authentication
B. Kerberos authentication
C. EAP authentication
D. Three-factor authentication

Back 286

Answer: A

Front 287

QUESTION NO: 287
Port 3535 is typically blocked for outbound traffic on a companys LAN. An end-user has recently
purchased a legitimate business program that needs to make outbound calls using this port.
Which of the
following steps should a technician take to allow this? (Select TWO).
A. Open the port on the companys proxy server.
B. Open the port on the companys firewall.
C. Change theusers subnet mask.
D. Open the port on the users personal software firewall.
E. Open the port on the VLAN.

Back 287

Answer: B,D

Front 288

QUESTION NO: 288
Which of the following describes software that is often written solely for a specific customers
application?
A. Rootkit
B. Hotfix
C. Service pack
D. Patch

Back 288

Answer: B

Front 289

QUESTION NO: 289
A security manager believes that too many services are running on a mission critical database
server.
Which of the following tools might a security analyst use to determine services that are running on
the
server, without logging into the machine?
A. OVAL
B. Port scanner
C. Protocol analyzer
D. NIDS

Back 289

Answer: B

Front 290

QUESTION NO: 290
A manufacturing corporation has decided to send a highly sensitive message to one of their
suppliers.
The message is concealed inside a JPEG image of a beach resort. Which of the following is this
an
example of?
A. Cryptography
B. Digital signature
C. Hashing
D. Steganography

Back 290

Answer: D

Front 291

QUESTION NO: 291
Which of the following encryption methods is often used along with L2TP?
A. S/MIME
B. SSH
C. 3DES
D. IPSec

Back 291

Answer: D

Front 292

QUESTION NO: 292
An administrator is assigned to monitor servers in a data center. A web server connected to the
Internet suddenly experiences a large spike in CPU activity. Which of the following is the MOST
likely cause?
A. Spyware
B. Trojan
C. Privilege escalation
D. DoS

Back 292

Answer: D

Front 293

QUESTION NO: 293
Which of the following methods will help to identify when unauthorized access has occurred?
A. Implement two-factor authentication.
B. Implement previous logon notification.
C. Implement session termination mechanism.
D. Implement session lock mechanism.

Back 293

Answer: B

Front 294

QUESTION NO: 294
Ensuring administrators have both a regular user account and a privileged user account is an
example
of applying which security principle?
A. Need-to-know
B. Mandatory Access Control (MAC)
C. Least privilege
D. Discretionary Access Control (DAC)

Back 294

Answer: C

Front 295

QUESTION NO: 295
All of the following are steps in the incident response process EXCEPT:
A. eradication.
B. repudiation.
C. recovery.
D. containment.

Back 295

Answer: B

Front 296

QUESTION NO: 296
Which of the following is an example of two-factor authentication for an information system?
A. ATM card and PIN
B. Username and password
C. Retina and fingerprint scanner
D. Photo ID and PIN

Back 296

Answer: A

Front 297

QUESTION NO: 297
Which of the following describes a spanned switch port in the context of IDS traffic analysis?
A. An association of a set of destination ports with a single source port
B. An association of a set of source ports with a single destination port
C. An association of a set of source ports with multiple destination ports and an IDS sensor
D. An association of a set of destination ports with an IDS sensor

Back 297

Answer: B

Front 298

QUESTION NO: 298
A technician is performing an assessment on a router and discovers packet filtering is employeD.
Which of the following describes a security concern with stateless packet filtering?
A. Packet payload is not checkeD.
B. State connections are retained by the router.
C. Router performance is reduceD.
D. Loose routing cannot determine the exact path a packet must follow.

Back 298

Answer: A

Front 299

QUESTION NO: 299
Which of the following describes the process of comparing cryptographic hash functions of system
executables, configuration files, and log files?
A. File integrity auditing
B. Host based intrusion detection
C. Network based intrusion detection
D. Stateful packet filtering

Back 299

Answer: A

Front 300

QUESTION NO: 300
Which of the following is a cryptographic representation of non-repudiation?
A. Digital signature
B. Internet key exchange
C. Certificate authority
D. Symmetric key

Back 300

Answer: A

Front 301

QUESTION NO: 301
Which of the following reduces the effectiveness of telephone social engineering?
A. Automatic callback
B. Monitoring outbound calls
C. Awareness training
D. Use of VoIP

Back 301

Answer: C

Front 302

QUESTION NO: 302
Which of the following will execute malicious code at a pre-specified time?
A. Logic Bomb
B. DoS
C. Worm
D. Rootkit

Back 302

Answer: A

Front 303

QUESTION NO: 303
All of the following are weaknesses of WEP EXCEPT:
A. lack of integrity checking.
B. initialization vector.
C. replay attacks.
D. lack of strong keys.

Back 303

Answer: A

Front 304

QUESTION NO: 304
Which of the following is LEAST likely to help reduce single points of failure?
A. Mandatory vacations
B. Cross training
C. Clustered servers
D. Disaster recovery exercises

Back 304

Answer: A

Front 305

QUESTION NO: 305
Which of the following reduces the attack surface of an operating system?
A. Patch management
B. Installing antivirus
C. Installing HIDS
D. Disabling unused services

Back 305

Answer: D

Front 306

QUESTION NO: 306
Which of the following is LEAST effective when hardening an operating system?
A. Configuration baselines
B. Limiting administrative privileges
C. Installing HIDS
D. Install a software firewall

Back 306

Answer: C

Front 307

QUESTION NO: 307
Which of the following provides the MOST control when deploying patches?
A. Hotfix
B. Remote desktop
C. Patch management
D. Service packs

Back 307

Answer: C

Front 308

QUESTION NO: 308
If a technician wants to know when a computer application is accessing the network, which of the
following logs should be reviewed?
A. Antivirus log
B. RADIUS log
C. Performance log
D. Host firewall log

Back 308

Answer: D

Front 309

QUESTION NO: 309
All of the following are components of IPSec EXCEPT:
A. encapsulating security payloaD.
B. Internet key exchangE.
C. temporal key interchange protocol.
D. authentication header (AH).

Back 309

Answer: C

Front 310

QUESTION NO: 310
IPSec connection parameters are stored in which of the following?
A. Security association database
B. Security payload index
C. Security parameter index
D. Certificate authority

Back 310

Answer: A

Front 311

QUESTION NO: 311
Which of the following will provide a 128-bit hash?
A. MD5
B. AES128
C. ROT13
D. SHA-1

Back 311

Answer: A

Front 312

QUESTION NO: 312
Which of the following describes a hash algorithms ability to avoid the same output from two
guessed inputs?
A. Collision avoidance
B. Collision resistance
C. Collision strength
D. Collision metric

Back 312

Answer: B

Front 313

QUESTION NO: 313
Which of the following should be included in a forensic toolkit?
A. Compressed air
B. Tape recorder
C. Fingerprint cards
D. Digital camera

Back 313

Answer: D

Front 314

QUESTION NO: 314
Which of the following BEST describes the form used while transferring evidence?
A. Booking slip
B. Affidavit
C. Chain of custody
D. Evidence log

Back 314

Answer: C

Front 315

QUESTION NO: 315
Which of the following is the primary incident response function of a first responder?
A. To evaluate the scene and repair the problem
B. To secure the scene and preserve evidence
C. To evaluate the scene and determine the cause
D. To gather evidence and write reports

Back 315

Answer: B

Front 316

QUESTION NO: 316
Which of the following is the GREATEST problem with low humidity in a server room?
A. Static electricity
B. Power surge
C. Electromagnetic interference
D. Brown out

Back 316

Answer: A

Front 317

QUESTION NO: 317
Which of the following protocols is used to ensure secure transmissions on port 443?
A. HTTPS
B. Telnet
C. SFTP
D. SHTTP

Back 317

Answer: A

Front 318

QUESTION NO: 318
When should a technician perform disaster recovery testing?
A. Immediately following lessons learned sessions
B. Once a month, during peak business hours
C. After the network is stable and online
D. In accordance with the disaster recovery plan

Back 318

Answer: D

Front 319

QUESTION NO: 319
Which of the following is the BEST backup method to restore the entire operating system and all
related software?
A. Weekly
B. Incremental
C. Disk Image
D. Differential

Back 319

Answer: C

Front 320

QUESTION NO: 320
How many keys are utilized in symmetric cryptography?
A. One
B. Two
C. Three
D. Four

Back 320

Answer: A

Front 321

QUESTION NO: 321
Which of the following terms is BEST associated with public key infrastructure (PKI)?
A. MD5 hashing
B. Symmetric key
C. Symmetric algorithm
D. Digital signatures

Back 321

Answer: D

Front 322

QUESTION NO: 322
Which of the following is the LAST step to granting access to specific domain resources?
A. Validate the user
B. Authorize the user
C. Verify the user
D. Authenticate the user

Back 322

Answer: B

Front 323

QUESTION NO: 323
After an attacker has successfully gained remote access to a server with minimal privileges, which
of the following is their next step?
A. Elevate system privileges.
B. Monitor network traffiC.
C. Capture private keys.
D. Begin key recovery.

Back 323

Answer: A

Front 324

QUESTION NO: 324
Which of the following should the technician recommend as a way to logically separate various
internal
networks from each other?
A. NIDS
B. VLAN
C. NAT
D. HIDS

Back 324

Answer: B

Front 325

QUESTION NO: 325
An organization has requested the ability to monitor all network traffic as it traverses their network.
Which of the following should a technician implement?
A. Content filter
B. Protocol analyzer
C. Honeypot
D. HIDS

Back 325

Answer: B

Front 326

QUESTION NO: 326
A large amount of viruses have been found on numerous domain workstations. Which of the
following should the technician implement?
A. Decentralized antivirus
B. Host based intrusion detection
C. Centralized antivirus
D. Spyware detection

Back 326

Answer: C

Front 327

QUESTION NO: 327
Which of the following is the MOST difficult security concern to detect when contractors enter a
secured facility?
A. Rogue access points being installed
B. Copying sensitive information with cellular phones
C. Removing mass storage iSCSI drives
D. Removing network attached storage

Back 327

Answer: B

Front 328

QUESTION NO: 328
When are port scanners generally used on systems?
A. At the middle of a vulnerability assessment
B. At the beginning of a vulnerability assessment
C. When there is a need to documentvulnerabilities
D. At the end of a penetration test assessment

Back 328

Answer: B

Front 329

QUESTION NO: 329
The staff must be cross-trained in different functional areas so that fraud can be detecteD. Which
of the following is this an example of?
A. Separation of duties
B. Implicit deny
C. Least privilege
D. Job rotation

Back 329

Answer: D

Front 330

QUESTION NO: 330
Human Resources has requested that staff members be moved to different parts of the country
into new positions. Which of the following is this an example of?
A. Implicit deny
B. Separation of duties
C. Least privilege
D. Job rotation

Back 330

Answer: D

Front 331

QUESTION NO: 331
An administrator is worried about an attacker using a compromised user account to gain
administrator
access to a system. Which of the following is this an example of?
A. Man-in-the-middle attack
B. Protocol analysis
C. Privilege escalation
D. Cross-site scripting

Back 331

Answer: C

Front 332

QUESTION NO: 332
Which of the following is used to deny authorized users access to services?
A. Botnets
B. Adware
C. Spyware
D. Trojans

Back 332

Answer: A

Front 333

QUESTION NO: 333
An administrator recommends implementing whitelisting, blacklisting, closing-open relays, and
strong authentication techniques to a server administrator. Which of the following threats are being
addressed?
A. Adware
B. Spyware
C. Spam
D. Viruses

Back 333

Answer: C

Front 334

QUESTION NO: 334
An administrator is asked to improve the physical security of a data center located inside the office
building. The data center already maintains a physical access log and has a video surveillance
system.
Which of the following additional controls could be implemented?
A. Defense-in-depth
B. Logical token
C. ACL
D. Mantrap

Back 334

Answer: D

Front 335

QUESTION NO: 335
In regards to physical security, which of the following BEST describes an access control system
which
implements a non-trusted but secure zone immediately outside of the secure zone?
A. Smart card
B. Defense-in-depth
C. Mantrap
D. DMZ

Back 335

Answer: C

Front 336

QUESTION NO: 336
A technician notices delays in mail delivery on the mail server. Which of the following tools could
be
used to determine the cause of the service degradation?
A. Port scanner
B. Performance monitor
C. ipconfig /all
D. TFTP

Back 336

Answer: B

Front 337

QUESTION NO: 337
Penetration testing should only be used once which of the following items is in place?
A. Acceptable use policy
B. Data retention and disclosure policy
C. Service level agreement
D. Written permission

Back 337

Answer: D

Front 338

QUESTION NO: 338
An administrator recommends that management establish a trusted third party central repository to
maintain all employees private keys. Which of the following BEST describes the administrators
recommendation?
A. Registration
B. Certificate authority
C. Recovery agent
D. Key escrow

Back 338

Answer: D

Front 339

QUESTION NO: 339
To combat transaction fraud, a bank has implemented a requirement that all bank customers enter
a different, unique code to confirm every transaction. Which of the following is the MOST effective
method to accomplish this?
A. ATM PIN code
B. Elliptic curve
C. One-time password
D. Digital certificate

Back 339

Answer: C

Front 340

QUESTION NO: 340
All of the following should be identified within the penetration testing scope of work EXCEPT:
A. a complete list of all network vulnerabilities.
B. IP addresses of machines from which penetration testing will be executeD.
C. a list of acceptable testing techniques and tools to be utilizeD.
D. handling of information collected by the penetration testing team.

Back 340

Answer: A

Front 341

QUESTION NO: 341
Which of the following is the MOST efficient way that an administrator can restrict network access
to
certain ports enterprise wide?
A. HIDS
B. Personal software firewall
C. NIDS
D. ACL

Back 341

Answer: D

Front 342

QUESTION NO: 342
An administrator is responsible for a server which has been attacked repeatedly in the past. The
only recourse has been to reload the server from scratch. Which of the following techniques could
be used to decrease the recovery time following an incident?
A. Implement the server as a honeypot.
B. Implement the server as a virtual server instance.
C. Load balance between two identical servers.
D. Install the server on a separate VLAN segment.

Back 342

Answer: B

Front 343

QUESTION NO: 343
Validating the users claimed identity is called which of the following?
A. Authentication
B. Identification
C. Verification
D. Validation

Back 343

Answer: A

Front 344

QUESTION NO: 344
Which of the following is planted on an infected system and deployed at a predetermined time?
A. Logic bomb
B. Trojan horse
C. Worm
D. Rootkit

Back 344

Answer: A

Front 345

QUESTION NO: 345
Which of the following allows a user to float a domain registration for a maximum of five days?
A. DNS poisoning
B. Domain hijacking
C. Spoofing
D. Kiting

Back 345

Answer: D

Front 346

QUESTION NO: 346
According to company policy an administrator must logically keep the Human Resources
department
separated from the Accounting department.Which of the following would be the simplest way to
accomplish
this?
A. NIDS
B. DMZ
C. NAT
D. VLAN

Back 346

Answer: D

Front 347

QUESTION NO: 347
Which of the following is an attack which is launched from multiple zombie machines in attempt to
bring down a service?
A. DoS
B. Man-in-the-middle
C. DDoS
D. TCP/IP hijacking

Back 347

Answer: C

Front 348

QUESTION NO: 348
Which of the following will MOST likely allow an attacker to make a switch function like a hub?
A. MAC flooding
B. ARP poisoning
C. DNS poisoning
D. DNS spoofing

Back 348

Answer: A

Front 349

QUESTION NO: 349
Which of the following is commonly programmed into an application for ease of administration?
A. Back door
B. Worm
C. Zombie
D. Trojan

Back 349

Answer: A

Front 350

QUESTION NO: 350
Which of the following is a technique used by hackers to identify unsecured wireless network
locations to other hackers?
A. Bluesnarfing
B. War dialing
C. War chalking
D. War driving

Back 350

Answer: C

Front 351

QUESTION NO: 351
Which of the following authentication models uses a KDC?
A. CHAP
B. PKI
C. PGP
D. Kerberos

Back 351

Answer: D

Front 352

QUESTION NO: 352
Which of the following disaster recovery components is a location that is completely empty, but
allows the infrastructure to be built if the live site goes down?
A. Mirrored site
B. Cold site
C. Warm site
D. Hot site

Back 352

Answer: B

Front 353

QUESTION NO: 353
Which of the following should be done if an organization intends to prosecute an attacker once an
attack has been completed?
A. Update antivirus definitions.
B. Disconnect the entire network from the Internet.
C. Apply proper forensic techniques.
D. Restore missing files on the affected system.

Back 353

Answer: C

Front 354

QUESTION NO: 354
Which of the following documents specifies the uptime guarantee of a web server?
A. Due process
B. Due diligence
C. Scope of work
D. Service level agreement

Back 354

Answer: D

Front 355

QUESTION NO: 355
Which of the following authentication models uses a time stamp to prevent the risks associated
with a
replay attack?
A. Two-factor authentication
B. RADIUS
C. LDAP
D. Kerberos

Back 355

Answer: D

Front 356

QUESTION NO: 356
Which of the following protocols can be implemented as an alternative to the overhead of a VPN?
A. L2TP
B. PPTP
C. SSH
D. SSL

Back 356

Answer: D

Front 357

QUESTION NO: 357
Which of the following will set an account to lockout for 30 minutes after the maximum number
attempts have failed?
A. Key distribution center
B. Account lockout duration
C. Account lockout threshold
D. Password complexity requirements

Back 357

Answer: B

Front 358

QUESTION NO: 358
Which of the following logs would reveal activities related to an ACL?
A. Mobile device
B. Transaction
C. Firewall
D. Performance

Back 358

Answer: C

Front 359

QUESTION NO: 359
Which of the following encryption algorithms has the largest overhead?
A. AES256
B. 3DES
C. AES
D. RSA

Back 359

Answer: B

Front 360

QUESTION NO: 360
Which of the following hashing algorithms is the MOST secure?
A. LANMAN
B. SHA-1
C. MD5
D. CHAP

Back 360

Answer: C

Front 361

QUESTION NO: 361
Which of the following would allow a technician to compile a visual view of an infrastructure?
A. Security log
B. Network mapper
C. Port scanner
D. Protocol analyzer

Back 361

Answer: B

Front 362

QUESTION NO: 362
Which of the following creates separate logical networks?
A. NAT
B. DMZ
C. NAC
D. Subnetting

Back 362

Answer: D

Front 363

QUESTION NO: 363
Which of the following is an area of the network infrastructure that allows a technician to place
public facing systems into it without compromising the entire infrastructure?
A. VPN
B. NAT
C. VLAN
D. DMZ

Back 363

Answer: D

Front 364

QUESTION NO: 364
Which of the following attacks commonly result in a buffer overflow?
A. ARP Poisoning
B. DNS Poisoning
C. Replay
D. DoS

Back 364

Answer: D

Front 365

QUESTION NO: 365
Which of the following type of attacks is TCP/IP hijacking?
A. Birthday
B. ARP poisoning
C. MAC flooding
D. Man-in-the-middle

Back 365

Answer: D

Front 366

QUESTION NO: 366
Which of the following ports does SNMP run on?
A. 25
B. 110
C. 161
D. 443

Back 366

Answer: C

Front 367

QUESTION NO: 367
Which of the following is a collection of servers that is setup to attract hackers?
A. DMZ
B. Honeypot
C. Honeynet
D. VLAN

Back 367

Answer: C

Front 368

QUESTION NO: 368
Which of the following could be used to determine which flags are set in a TCP/IP handshake?
A. FIN/RST
B. SYN/ACK
C. Protocol analyzer
D. Network mapper

Back 368

Answer: C

Front 369

QUESTION NO: 369
Which of the following would be the BEST choice to ensure only ports 25, 80 and 443 were open
from outside of the network?
A. Firewall
B. DMZ
C. VLAN
D. Proxy

Back 369

Answer: A

Front 370

QUESTION NO: 370
Which of the following media is LEAST susceptible to a tap being placed on the line?
A. Fiber
B. UTP
C. STP
D. Coaxial

Back 370

Answer: A

Front 371

QUESTION NO: 371
Which of the following is responsible for establishing trust models?
A. The firewall
B. The information security officer
C. The certificate authority
D. The key escrow agent

Back 371

Answer: C

Front 372

QUESTION NO: 372
Which of the following allows attackers to gain control over the web camera of a system?
A. ActiveX component
B. SQL injection
C. Cross-site scripting
D. XML

Back 372

Answer: A

Front 373

QUESTION NO: 373
Which of the following type of attacks sends out numerous MAC resolution requests to create a
buffer overflow attack?
A. Smurf
B. ARP poisoning
C. DDoS
D. DNS poisoning

Back 373

Answer: B

Front 374

QUESTION NO: 374
Which of the following would a former employee MOST likely plant on a server that is not
traceable?
A. Worm
B. Logic bomb
C. Trojan
D. Virus

Back 374

Answer: B

Front 375

QUESTION NO: 375
Which of the following would be MOST effective in stopping phishing attempts?
A. Antivirus
B. User training
C. NIDS
D. HIDS

Back 375

Answer: B

Front 376

QUESTION NO: 376
Which of the following consists of markings outside a building that indicate the connection speed
of a nearby unsecured wireless network?
A. War driving
B. War chalking
C. Blue jacking
D. Bluesnarfing

Back 376

Answer: B

Front 377

QUESTION NO: 377
Which of the following would be of MOST interest to someone that is dumpster diving?
A. User education manual
B. Business card of computer contractor
C. List of expired usernames
D. Receipts from the supply store

Back 377

Answer: B

Front 378

QUESTION NO: 378
Which of the following could involve moving physical locations every two years to help mitigate
security risks?
A. Implicit deny
B. Least privilege
C. Job rotation
D. Separation of duties

Back 378

Answer: C

Front 379

QUESTION NO: 379
Which of the following could be used to capture website GET requests?
A. Port scanner
B. Protocol analyzer
C. Network mapper
D. Vulnerability scanner

Back 379

Answer: B

Front 380

QUESTION NO: 380
Which of the following does the process of least privilege fall under?
A. Integrity
B. Non-repudiation
C. Confidentiality
D. Availability

Back 380

Answer: C

Front 381

QUESTION NO: 381
Which of the following hashing algorithms is the LEAST secure?
A. SHA-1
B. LANMAN
C. NTLM
D. MD5

Back 381

Answer: B

Front 382

QUESTION NO: 382
Which of the following is the MOST secure transmission algorithm?
A. 3DES
B. TKIP
C. AES256
D. AES

Back 382

Answer: B

Front 383

QUESTION NO: 383
Which of the following protocols is used for encryption between email servers?
A. TLS
B. PPTP
C. L2TP
D. S/MIME

Back 383

Answer: A

Front 384

QUESTION NO: 384
Which of the following scenarios would a penetration test BEST be used for?
A. When providing a proof of concept demonstration for a vulnerability
B. While in the reconnaissance phase
C. When performing network mapping
D. When conducting performance monitoring

Back 384

Answer: A

Front 385

QUESTION NO: 385
Which of the following would be the easiest to use in detection of a DDoS attack?
A. Performance monitor
B. Application log
C. System log
D. Protocol analyzer

Back 385

Answer: A

Front 386

QUESTION NO: 386
Which of the following implements the strongest hashing algorithm?
A. NTLMv2
B. NTLM
C. VLAN
D. LANMAN

Back 386

Answer: A

Front 387

QUESTION NO: 387
Which of the following is BEST used to determine whether network utilization is abnormal?
A. Security log
B. Performance baseline
C. Application log
D. Systems monitor

Back 387

Answer: B

Front 388

QUESTION NO: 388
Which of the following is the BEST solution to implement to reduce unsolicited email?
A. Pop-up blocker
B. Anti-spam
C. Antivirus
D. Personal software firewall

Back 388

Answer: B

Front 389

QUESTION NO: 389
Identification is a critical component of the authentication process because it is:
A. used to confirm the privileges of a user.
B. when the user is verifieD.
C. when the user is authorizeD.
D. used to prevent authorized access.

Back 389

Answer: B

Front 390

QUESTION NO: 390
Identity proofing occurs during which phase of identification and authentication?
A. Testing
B. Verification
C. Authentication
D. Identification

Back 390

Answer: D

Front 391

QUESTION NO: 391
Which of the following BEST describes the practice of dumpster diving?
A. Sorting through the garbage of an organization to obtain information used for configuration
management.
B. Sorting through the garbage of an organization to obtain information used for a subsequent
attack.
C. Sorting through the trash of an organization to obtain information found on their intranet.
D. Sorting through the trash of an organization to recover an old user ID badge previously used for
an
attack.

Back 391

Answer: B

Front 392

QUESTION NO: 392
Implementation of proper environmental controls should be considered by administrators when
recommending facility security controls because of which of the following?
A. Proper environmental controls provide redundancy to the facility.
B. Proper environmental controls helpensure availability of IT systems.
C. Proper environmental controls make authentication simpler.
D. Proper environmental controls provide integrity to IT systems.

Back 392

Answer: B

Front 393

QUESTION NO: 393
An administrator is asked to recommend the most secure transmission mediA. Which of the
following should be recommended?
A. Unshielded twisted pair cable
B. Fiber optic cable
C. Ethernet CAT5 cable
D. Coaxial cable

Back 393

Answer: B

Front 394

QUESTION NO: 394
An administrator is selecting a device to secure an internal network segment from traffic external
to the segment. Which of the following devices could be selected to provide security to the network
segment?
A. NIPS
B. HIDS
C. Internet content filter
D. DMZ

Back 394

Answer: A

Front 395

QUESTION NO: 395
Which of the following devices should be deployed to protect a network against attacks launched
from a business to business intranet? (Select TWO).
A. NIPS
B. Content filter
C. HIPS
D. Firewall
E. NIDS

Back 395

Answer: A,D

Front 396

QUESTION NO: 396
To prevent the use of previously issued PKI credentials which have expired or otherwise become
invalid, administrators should always design programs to check which of the following?
A. PKI
B. CRL
C. Escrow
D. CA

Back 396

Answer: B

Front 397

QUESTION NO: 397
To prevent the use of stolen PKI certificates on web servers, which of the following should an
administrator ensure is available to their web servers?
A. Registration
B. CA
C. CRL
D. Key escrow

Back 397

Answer: C

Front 398

QUESTION NO: 398
Which of the following describes an implementation of PKI where a copy of a users private key is
stored to provide third party access and to facilitate recovery operations?
A. Registration
B. Recovery agent
C. Key escrow
D. Asymmetric

Back 398

Answer: C

Front 399

QUESTION NO: 399
A security administrator has been asked to deploy a biometric authentication system in a
corporation.
Which of the following devices is the MOST reliable and has the lowest cross over error rate?
A. Iris scanner
B. Handprint scanner
C. Retina scanner
D. Fingerprint scanner

Back 399

Answer: C

Front 400

QUESTION NO: 400
To increase the security of the network authentication process, an administrator decides to
implement three-factor authentication. Which of the following authentication combinations is a
three-factor system?
A. A PKI enabled smart card, strong password and 12-digit PIN
B. A retina scanner, PKI enabled smart card and a six-digit PIN
C. A fingerprint scanner, PKI enabled smart card and badge proximity reader
D. An Iris scanner, a user generated pass phrase and a palm reader

Back 400

Answer: B

Front 401

QUESTION NO: 401
To facilitate compliance with the Internet use portion of the corporate acceptable use policy, an
administrator implements a series of proxy servers and firewalls. The administrator further
recommends installation of software based firewalls on each host on the network. Which of the
following would have provided an alternative simpler solution?
A. Internet content filter
B. Hardware IDS
C. Software HIPS
D. DMZ

Back 401

Answer: A

Front 402

QUESTION NO: 402
The marketing department wants to distribute pens with embedded USB drives to clients. In the
past this client has been victimized by social engineering attacks which led to a loss of sensitive
datA. The security administrator advises the marketing department not to distribute the USB pens
due to which of the following?
A. The risks associated with the large capacity of USB drives and their concealable nature
B. The security costs associated with securing the USB drives over time
C. The cost associated with distributing a large volume of the USB pens
D. The security risks associated with combining USB drives and cell phones on a network

Back 402

Answer: A

Front 403

QUESTION NO: 403
USB drives create a potential security risk due to which of the following?
A. Operating system incompatibility
B. Large storage capacity
C. Widespread use
D. Potential for software introduction

Back 403

Answer: D

Front 404

QUESTION NO: 404
As a best practice, risk assessments should be based upon which of the following?
A. A qualitative measurement of risk and impact
B. A survey of annual loss, potential threats and asset value
C. A quantitative measurement of risk, impact and asset value
D. An absolute measurement of threats

Back 404

Answer: C

Front 405

QUESTION NO: 405
Which of the following is a cryptographic hash function?
A. RSA
B. SHA
C. RC4
D. ECC

Back 405

Answer: B

Front 406

QUESTION NO: 406
From a security standpoint, which of the following is the BEST reason to implement performance
monitoring applications on network systems?
A. To detect network intrusions from external attackers
B. To detect integrity degradations to network attached storage
C. To detect host intrusions from external networks
D. To detect availability degradations caused by attackers

Back 406

Answer: D

Front 407

QUESTION NO: 407
All of the following are methods used to conduct risk assessments EXCEPT:
A. penetration tests.
B. security audits.
C. vulnerability scans.
D. disaster exercises.

Back 407

Answer: D

Front 408

QUESTION NO: 408
After conducting a risk assessment, the main focus of an administrator should be which of the
following?
A. To report the results of the assessment to the users
B. To ensure all threats are mitigated
C. To ensure all vulnerabilities are eliminated
D. To ensure risk mitigation activities are implemented

Back 408

Answer: D

Front 409

QUESTION NO: 409
Which of the following is a BEST practice when implementing a new system?
A. Disable unneeded services.
B. Use group policies.
C. Implement open source alternatives.
D. Use default installations.

Back 409

Answer: A

Front 410

QUESTION NO: 410
When installing and securing a new system for a home user which of the following are best
practices?
(Select THREE).
A. Use a strong firewall.
B. Block inbound access to port 80
C. Apply all system patches.
D. Use input validation.
E. Install remote control softwarE.
F. Apply all service packs.

Back 410

Answer: A,C,F

Front 411

QUESTION NO: 411
Which of the following describes a logic bomb?
A. A piece of malicious code that can spread on its own
B. A piece of malicious code that is concealed from all detection
C. A piece of malicious code that executes based on an event or date
D. A piece of malicious code that exploits a race condition

Back 411

Answer: C

Front 412

QUESTION NO: 412
Which of the following is a prerequisite for privilege escalation to occur?
A. The attacker has to create their own zero day attack for privilege escalation.
B. The attacker must already have physical access to the system.
C. The attacker must use a rootkit in conjunction with privilege escalation.
D. The attacker must have already gained entry into the system.

Back 412

Answer: D

Front 413

QUESTION NO: 413
Which of the following is an example of an attack that executes once a year on a certain date?
A. Virus
B. Worm
C. Logic bomb
D. Rootkit

Back 413

Answer: C

Front 414

QUESTION NO: 414
Which of the following is the GREATEST threat to highly secure environments?
A. Network attached storage
B. BIOS configuration
C. RSA256
D. USB devices

Back 414

Answer: D

Front 415

QUESTION NO: 415
Management has asked a technician to prevent data theft through the use of portable drives.
Which of the following should the technician implement?
A. Install a CCTV system.
B. Use security templates.
C. Implement a biometric system.
D. Disable USB drives.

Back 415

Answer: D

Front 416

QUESTION NO: 416
A technician has been informed that many of the workstations on the network are flooding servers.
Which of the following is the MOST likely cause of this?
A. Worm
B. Logic bomb
C. Virus
D. Spam

Back 416

Answer: A

Front 417

QUESTION NO: 417
Which of the following BEST describes a way to prevent buffer overflows?
A. Apply all security patches to workstations.
B. Apply security templates enterprise widE.
C. Apply group policy management techniques.
D. Monitor P2P program usage through content filters.

Back 417

Answer: A

Front 418

QUESTION NO: 418
Which of the following is a security reason to implement virtualization throughout the network
infrastructure?
A. To analyze the various network traffic with protocol analyzers
B. To centralize the patch management of network servers
C. To isolate the various network services and roles
D. To implement additional network services at a lower cost

Back 418

Answer: C

Front 419

QUESTION NO: 419
Which of the following is a reason to use a Faraday cage?
A. To allow wireless usage
B. To minimize weak encryption
C. To mitigate data emanation
D. To find rogue access points

Back 419

Answer: C

Front 420

QUESTION NO: 420
Weak encryption is a common problem with which of the following wireless protocols?
A. WPA2-Enterprise
B. WEP
C. WPA2-Personal
D. WPA

Back 420

Answer: B

Front 421

QUESTION NO: 421
Which of the following describes a tool used by organizations to verify whether or not a staff
member has been involved in malicious activity?
A. Mandatory vacations
B. Implicit deny
C. Implicit allow
D. Time of day restrictions

Back 421

Answer: A

Front 422

QUESTION NO: 422
Which of the following is a cross-training technique where organizations minimize collusion
amongst staff?
A. Least privilege
B. Job rotation
C. Cross-site scripting
D. Separation of duties

Back 422

Answer: B

Front 423

QUESTION NO: 423
Which of the following will allow a technician to restrict a users access to the GUI?
A. Access control lists
B. Group policy implementation
C. Use of logical tokens
D. Password policy enforcement

Back 423

Answer: B

Front 424

QUESTION NO: 424
Which of the following is the MOST common logical access control method?
A. Access control lists
B. Usernames and password
C. Multifactor authentication
D. Security ID badges

Back 424

Answer: B

Front 425

QUESTION NO: 425
Which of the following verifies control for granting access in a PKI environment?
A. System administrator
B. Certificate authority
C. Recovery agent
D. Certificate revocation list

Back 425

Answer: B

Front 426

QUESTION NO: 426
Which of the following explains the difference between a public key and a private key?
A. The public key is only used by the client while the private key is available to all. Both keys are
mathematically relateD.
B. The private key only decrypts the data while the public key only encrypts the datA. Both keys
are mathematically relateD.
C. The private key is commonly used in symmetric key decryption while the public key is used in
asymmetric key decryption.
D. The private key is only used by the client and kept secret while the public key is available to
all.WBerlinSans

Back 426

Answer: D

Front 427

QUESTION NO: 427
Which of the following is a countermeasure when power must be delivered to critical systems no
matter what?
A. Backup generator
B. Redundant power supplies
C. Uninterruptible power supplies (UPSs)
D. Warm site

Back 427

Answer: A

Front 428

QUESTION NO: 428
Which of the following is the MOST important step to conduct during a risk assessment of
computing systems?
A. The identification of USB drives
B. The identification of missing patches
C. The identification of mantraps
D. The identification of disgruntled staff members

Back 428

Answer: B

Front 429

QUESTION NO: 429
Which of the following tools will allow a technician to detect security-related TCP connection
anomalies?
A. Logical token
B. Performance monitor
C. Public key infrastructure
D. Trusted platform module

Back 429

Answer: B

Front 430

QUESTION NO: 430
Which of the following monitoring methodologies will allow a technician to determine when there is
a security related problem that results in an abnormal condition?
A. Signature-based
B. NIDS
C. Anomaly-based
D. NIPS

Back 430

Answer: C

Front 431

QUESTION NO: 431
Which of the following systems is BEST to use when monitoring application activity and
modification?
A. RADIUS
B. OVAL
C. HIDS
D. NIDS

Back 431

Answer: C

Front 432

QUESTION NO: 432
Which of the following is the MOST important thing to consider when implementing an IDS
solution?
A. The cost of the device
B. Distinguishing between false negatives
C. Distinguishing between false positives
D. The personnel to interpret results

Back 432

Answer: D

Front 433

QUESTION NO: 433
Which of the following is the FIRST step in the implementation of an IDS?
A. Decide on the typE.
B. Decide on the model.
C. Purchase the equipment.
D. Document the existing network.

Back 433

Answer: D

Front 434

QUESTION NO: 434
Which of the following encryption algorithms is used for encryption and decryption of data?
A. MD5
B. SHA-1
C. NTLM
D. RC5

Back 434

Answer: D

Front 435

QUESTION NO: 435
Which of the following are the authentication header modes?
A. Encrypt and Route
B. Transport and Tunnel
C. Tunnel and Encrypt
D. Transport and Encrypt

Back 435

Answer: B

Front 436

QUESTION NO: 436
Which of the following would a technician use to check data integrity?
A. Digital signature algorithm
B. Encapsulating security protocol
C. Rivest cipher 4
D. Message authentication code

Back 436

Answer: D

Front 437

QUESTION NO: 437
Which of the following are the functions of asymmetric keys?
A. Decrypt,decipher, encode and encrypt
B. Sign,validate, encrypt and verify
C. Decrypt,validate, encode and verify
D. Encrypt, sign, decrypt and verify

Back 437

Answer: D

Front 438

QUESTION NO: 438
Which of the following is the purpose of the AH?
A. Provides non-repudiation
B. Provides integrity
C. Provides authorization
D. Provides confidentiality

Back 438

Answer: B

Front 439

QUESTION NO: 439
Which of the following describes the insertion of additional bytes of data into a packet?
A. Header injection
B. TCP hijacking
C. Encapsulating
D. Padding

Back 439

Answer: D

Front 440

QUESTION NO: 440
Which of the following is true regarding authentication headers (AH)?
A. The authentication information is a keyed hash based on all of the bytes in the packet.
B. The authentication information hash will increase by one if the bytes remain the same on
transfer.
C. The authentication information hash will remain the same if the bytes change on transfer.
D. The authentication information may be the same on different packets if the integrity remains in
placE.

Back 440

Answer: A

Front 441

QUESTION NO: 441
Which of the following will allow wireless access to network resources based on certain ports?
A. 80211n
B. 80211g
C. 8021x
D. 80211a

Back 441

Answer: C

Front 442

QUESTION NO: 442
The method of controlling how and when users can connect in from home is called which of the
following?
A. Remote access policy
B. Terminal access control
C. Virtual Private Networking (VPN)
D. Remote authentication

Back 442

Answer: A

Front 443

QUESTION NO: 443
Which of the following is the main limitation with biometric devices?
A. The false rejection rate
B. They are expensive and complex
C. They can be easily fooled or bypassed
D. The error human factor

Back 443

Answer: B

Front 444

QUESTION NO: 444
Who is ultimately responsible for the amount of residual risk?
A. The senior management
B. The security technician
C. The organizations security officer
D. The DRP coordinator

Back 444

Answer: A

Front 445

QUESTION NO: 445
Which of the following typically use IRC for command and control activities?
A. Trojan
B. Logic bombs
C. Worms
D. Botnets

Back 445

Answer: D

Front 446

QUESTION NO: 446
When designing a firewall policy, which of the following should be the default action?
A. Least privilege
B. Implicit allow
C. DMZ
D. Implicit deny

Back 446

Answer: D

Front 447

QUESTION NO: 447
If hashing two different files creates the same result, which of the following just occurred?
A. A duplication
B. A collision
C. A pseudo-random event
D. Amirror

Back 447

Answer: B

Front 448

QUESTION NO: 448
Which of the following type of protection is hashing used to provide?
A. Integrity
B. Cryptographic randomness
C. Collision
D. Confidentiality

Back 448

Answer: A

Front 449

QUESTION NO: 449
All of the following are part of the disaster recovery plan EXCEPT:
A. obtaining management buy-in.
B. identifying all assets.
C. system backups.
D. patch management softwarE.

Back 449

Answer: D

Front 450

QUESTION NO: 450
Which of the following is MOST likely to make a disaster recovery exercise valuable?
A. Revising the disaster recovery plan during the exercise
B. Conducting intricate, large-scale mock exercises
C. Learning from the mistakes of the exercise
D. Management participation

Back 450

Answer: C

Front 451

QUESTION NO: 451
Which of the following allows directory permissions to filter down through the sub-directory
hierarchy?
A. Impedance
B. Inheritance
C. Mirroring
D. Replication

Back 451

Answer: B

Front 452

QUESTION NO: 452
Which of the following access control models BEST follows the concept of separation of duties?
A. Discretionary Access Control (DAC)
B. Mandatory Access Control (MAC)
C. Rule-base access control (RBAC)
D. Role-based access control (RBAC)

Back 452

Answer: D

Front 453

QUESTION NO: 453
Which of the following would MOST likely prevent a PC application from accessing the network?
A. Virtualization
B. Host-based firewall
C. Antivirus
D. HIDS

Back 453

Answer: B

Front 454

QUESTION NO: 454
A technician is investigating intermittent switch degradation. The issue only seems to occur when
the buildings roof air conditioning system runs. Which of the following would reduce the
connectivity issues?
A. Adding a heat deflector
B. Redundant HVAC systems
C. Shielding
D. Add a wireless network

Back 454

Answer: C

Front 455

QUESTION NO: 455
A technician tracks the integrity of certain files on the server. Which of the following algorithms
provide this ability?
A. SHA-1
B. 3DES
C. XOR
D. AES

Back 455

Answer: A

Front 456

QUESTION NO: 456
Which of the following describes the standard load for all systems?
A. Configuration baseline
B. Group policy
C. Patch management
D. Security template

Back 456

Answer: A

Front 457

QUESTION NO: 457
When testing a newly released patch, a technician should do all of the following EXCEPT:
A. verify the integrity of the patch.
B. deploy immediately using Patch Management.
C. verify the patch is relevant to the system.
D. test it in a non-production environment.

Back 457

Answer: B

Front 458

QUESTION NO: 458
A botnet zombie is using HTTP traffic to encapsulate IRC traffiC. Which of the following would
detect this encapsulated traffic?
A. Vulnerability scanner
B. Proxy server
C. Anomaly-based IDS
D. Rootkit

Back 458

Answer: C

Front 459

QUESTION NO: 459
Documentation review, log review, rule-set review, system configuration review, network sniffing,
and
file integrity checking are examples of:
A. active security testing techniques.
B. invasive security testing techniques.
C. black box testing techniques.
D. passive security testing techniques.

Back 459

Answer: D

Front 460

QUESTION NO: 460
To determine whether a system is properly documented and to gain insight into the systems
security aspects that are only available through documentation is the purpose of:
A. hybrid security testing techniques.
B. active security testing techniques.
C. passive security testing techniques.
D. invasive security testing techniques.

Back 460

Answer: C

Front 461

QUESTION NO: 461
Which of the following BEST describes external security testing?
A. Conducted from outside the perimeter switch but inside the firewall
B. Conducted from outside the building that hosts the organizations servers
C. Conducted from outside the organizations security perimeter
D. Conducted from outside the perimeter switch but inside the border router

Back 461

Answer: C

Front 462

QUESTION NO: 462
Port scanners can identify all of the following EXCEPT:
A. applications.
B. operating systems.
C. vulnerabilities.
D. active hosts.

Back 462

Answer: C

Front 463

QUESTION NO: 463
All of the following are limitations of a vulnerability scanner EXCEPT:
A. it only uncovers vulnerabilities for active systems.
B. it generates a high false-positive error ratE.
C. it relies on a repository of signatures.
D. it generates less network traffic than port scanning.

Back 463

Answer: D

Front 464

QUESTION NO: 464
Which of the following can BEST aid in preventing a phishing attack?
A. Implementing two-factor authentication
B. Enabling complex password policies
C. Conducting user awareness training
D. Requiring the use of stronger encryption

Back 464

Answer: C

Front 465

QUESTION NO: 465
A travel reservation company conducts the majority of its transactions through a public facing
website.
Any downtime to this website results in substantial financial damage for the company. One web
server is connected to several distributed database servers. Which of the following describes this
scenario?
A. Warm site
B. Proxy server
C. RAID
D. Single point of failure

Back 465

Answer: D

Front 466

QUESTION NO: 466
Which of the following is MOST commonly used to secure a web browsing session?
A. SHTTP
B. SSH
C. HTTPS
D. S/MIME

Back 466

Answer: C

Front 467

QUESTION NO: 467
One of the reasons that DNS attacks are so universal is DNS services are required for a computer
to
access:
A. WLANs.
B. the Internet.
C. LANs.
D. WANs.

Back 467

Answer: B

Front 468

QUESTION NO: 468
One of the security benefits to using virtualization technology is:
A. if an instance is compromised the damage can be compartmentalizeD.
B. applying a patch to the server automatically patches all instances.
C. if one instance is compromised no other instances can be compromiseD.
D. virtual instances are not affected by conventional port scanning techniques.

Back 468

Answer: A

Front 469

QUESTION NO: 469
A virtual server implementation attack that affects the:
A. OS kernel will affect all virtual instances.
B. disk partition will affect all virtual instances.
C. system registry will affect all virtual instances.
D. RAM will affect all virtual instances.

Back 469

Answer: D

Front 470

QUESTION NO: 470
An administrator wants to set up a new web server with a static NAT. Which of the following is the
BEST reason for implementing NAT?
A. Publishes the organizations internal network addressing scheme
B. Publishes the organizations external network addressing scheme
C. Hides the organizations internal network addressing scheme
D. Hides the organizations external network addressing scheme

Back 470

Answer: C

Front 471

QUESTION NO: 471
Which of the following is the BEST reason for an administrator to use port address translation
(PAT) instead of NAT on a new corporate mail gateway?
A. PAT provides the mail gateway with protection on port 24
B. PAT allows external users to access the mail gateway on random ports.
C. PAT provides the mail gateway with protection on port 25
D. PAT allows external users to access the mail gateway on pre-selected ports.

Back 471

Answer: D

Front 472

QUESTION NO: 472
Which of the following describes a static NAT?
A. A static NAT uses a one to many mapping.
B. A static NAT uses a many to one mapping.
C. A static NAT uses a many to many mapping.
D. A static NAT uses a one to one mapping.

Back 472

Answer: D

Front 473

QUESTION NO: 473
Which of the following if disabled will MOST likely reduce, but not eliminate the risk of VLAN
jumping?
A. LAN manager
B. ARP caching
C. DTP on all ports
D. TACACS

Back 473

Answer: C

Front 474

QUESTION NO: 474
An administrator is concerned that PCs on the internal network may be acting as zombies
participating in external DDoS attacks. Which of the following could BEST be used to confirm the
administrators suspicions?
A. HIDS logs
B. Proxy logs
C. AV server logs
D. Firewall logs

Back 474

Answer: D

Front 475

QUESTION NO: 475
Restricting access to files based on the identity of the user or group is an example of which of the
following?
A. CRL
B. PKI
C. MAC
D. DAC

Back 475

Answer: D

Front 476

QUESTION NO: 476
Restricting access to files based on the identity of the user or group and security classification of
the information is an example of which of the following?
A. RBAC
B. DAC
C. NTFS
D. MAC

Back 476

Answer: D

Front 477

QUESTION NO: 477
A new Internet content filtering device installed in a large financial institution allows IT
administrators to log in and manage the device, but not the content filtering policy. Only the IT
security operation staff can modify policies on the Internet filtering devicE. Which of the following is
this an example of?
A. Role-Based Access Control (RBAC)
B. Mandatory Access Control (MAC)
C. Lightweight Directory Access Protocol (LDAP)
D. Discretionary Access Control (DAC)

Back 477

Answer: A

Front 478

QUESTION NO: 478
Which of the following would BEST describe a disaster recovery plan (DRP)?
A. Addresses the recovery of an organizations business documentation
B. Addresses the recovery of an organizations email
C. Addresses the recovery of an organizations backup site
D. Addresses the recovery of an organizations IT infrastructure

Back 478

Answer: D

Front 479

QUESTION NO: 479
Which of the following is the primary objective of a business continuity plan (BCP)?
A. Addresses the recovery of an organizations business operations
B. Addresses the recovery of an organizations business payroll system
C. Addresses the recovery of an organizations business facilities
D. Addresses the recovery of an organizations backup site

Back 479

Answer: A

Front 480

QUESTION NO: 480
A software manufacturer discovered a design flaw in a new application. Rather than recall the
software, management decided to continue manufacturing the product with the flaw. Which of the
following risk management strategies was adopted by management?
A. Risk mitigation
B. Risk avoidance
C. Risk acceptance
D. Risk transfer

Back 480

Answer: C

Front 481

QUESTION NO: 481
Which of the following BEST describes an application or string of code that cannot automatically
spread from one system to another but is designed to spread from file to file?
A. Adware
B. Worm
C. Botnet
D. Virus

Back 481

Answer: D

Front 482

QUESTION NO: 482
Which of the following is considered an independent program that can copy itself from one system
to another and its main purpose is to damage data or affect system performance?
A. Virus
B. Worm
C. Spam
D. Spyware

Back 482

Answer: B

Front 483

QUESTION NO: 483
All of the following are considered malware EXCEPT:
A. spam.
B. Trojan.
C. virus.
D. logical bombs.

Back 483

Answer: A

Front 484

QUESTION NO: 484
Which of the following NIDS configurations is solely based on specific network traffic?
A. Host-based
B. Behavior-based
C. Anomaly-based
D. Signature-based

Back 484

Answer: D

Front 485

QUESTION NO: 485
Which of the following only looks at header information of network traffic?
A. Internet content filter
B. Packet filter
C. Application firewall
D. Hybrid firewall

Back 485

Answer: B

Front 486

QUESTION NO: 486
Which of the following access control methods could the administrator implement because of
constant hiring of new personnel?
A. Rule-based
B. Role-based
C. Discretionary
D. Decentralized

Back 486

Answer: B

Front 487

QUESTION NO: 487
When using a single sign-on method, which of the following could adversely impact the entire
network?
A. Workstation
B. Biometrics
C. Web server
D. Authentication server

Back 487

Answer: D

Front 488

QUESTION NO: 488
RADIUS uses all of the following authentication protocols EXCEPT:
A. PAP.
B. CHAP.
C. EAP.
D. L2TP.

Back 488

Answer: D

Front 489

QUESTION NO: 489
A HIDS is installed to monitor which of following?
A. CPU performance
B. NIC performance
C. System files
D. Temporary Internet files

Back 489

Answer: C

Front 490

QUESTION NO: 490
Which of the following intrusion detection systems uses statistical analysis to detect intrusions?
A. Signature
B. Honeynet
C. Anomaly
D. Knowledge

Back 490

Answer: C

Front 491

QUESTION NO: 491
Which of the following intrusion detection systems uses well defined models of how an attack
occurs?
A. Protocol
B. Behavior
C. Signature
D. Anomaly

Back 491

Answer: C

Front 492

QUESTION NO: 492
Which of the following is a system that will automate the deployment of updates to workstations
and servers?
A. Service pack
B. Remote access
C. Patch management
D. Installer package

Back 492

Answer: C

Front 493

QUESTION NO: 493
A user is concerned with the security of their laptops BIOS. The user does not want anyone to be
able to access control functions except themselves. Which of the following will make the BIOS
more secure?
A. Password
B. Encrypt the hard drive
C. Create an access-list
D. Flash the BIOS

Back 493

Answer: A

Front 494

QUESTION NO: 494
Which of the following is a method to apply system security settings to all workstations at once?
A. Policy analyzer
B. Patch management
C. Configuration baseline
D. A security template

Back 494

Answer: D

Front 495

QUESTION NO: 495
Which of the following would be a method of securing the web browser settings on all network
workstations?
A. Internet content filter
B. Group policy
C. Control panel
D. P2P software

Back 495

Answer: B

Front 496

QUESTION NO: 496
Which of the following is a limitation of a HIDS?
A. It does not capture MAC addresses.
B. Someone must manually review the logs.
C. It requires an open port on the firewall.
D. They are difficult to install.

Back 496

Answer: B

Front 497

QUESTION NO: 497
A technician has implemented a new network attached storage solution for a client. The technician
has created many shares on the storagE. Which of the following is the MOST secure way to
assign permissions?
A. Separation of duties
B. Full control
C. Authentication
D. Least privilege

Back 497

Answer: D

Front 498

QUESTION NO: 498
Which of the following is an example of a trust model?
A. SSL/TLS
B. Internet key exchange
C. Recovery agent
D. Managing the CA relationships

Back 498

Answer: D

Front 499

QUESTION NO: 499
Which of the following is the common mail format for digitally signed and encrypted messages?
A. SMTP
B. SSL
C. MIME
D. S/MIME

Back 499

Answer: D

Front 500

QUESTION NO: 500
Which of the following is the common way of implementing cryptography on network devices for
encapsulating traffic between the device and the host managing them?
A. S/MIME
B. SNMP
C. SSH
D. SMTP

Back 500

Answer: C

Front 501

QUESTION NO: 501
Which of the following describes penetration testing?
A. Simulating an actual attack on a network
B. Hacking into a network for malicious reasons
C. Detecting active intrusions
D. Establishing a security baseline

Back 501

Answer: A

Front 502

QUESTION NO: 502
When an IDS is configured to match a specific traffic pattern, then which of the following is this
referring to?
A. Signature-based
B. Anomaly-based
C. Heuristic-based
D. Behavior-based

Back 502

Answer: A

Front 503

QUESTION NO: 503
An application that gets downloaded onto a system by appearing to be a useful tool for cleaning
out duplicate contacts in a users emails would be considered:
A. spyware.
B. spam.
C. a worm.
D. a Trojan.

Back 503

Answer: D

Front 504

QUESTION NO: 504
Installing an application on every desktop in a companys network that watches for possible
intrusions would be an example of:
A. a HIDS.
B. a personal software firewall.
C. hardening.
D. a NIDS.

Back 504

Answer: A

Front 505

QUESTION NO: 505
An administrator suspects an issue retrieving files on the network and accesses the file servers
performance monitor to check the results against:
A. the performance baselinE.
B. yesterdays performancE.
C. the system monitor.
D. themanufacturers websitE.

Back 505

Answer: A

Front 506

QUESTION NO: 506
An administrator runs a tool checking SMTP, DNS, POP3, and ICMP packets on the network. This
is an example of which of the following?
A. A port scanner
B. A protocol analyzer
C. A vulnerability scan
D. A penetration test

Back 506

Answer: B

Front 507

QUESTION NO: 507
A company runs a backup after each shift and the main concern is how quickly the backups are
completed between shifts. Recovery time should be kept to a minimum. The administrator decides
that backing up all the data that has changed during the last shift is the best way to go. This would
be considered a:
A. differential backup.
B. incremental backup.
C. shadow copy.
D. full backup.

Back 507

Answer: A

Front 508

QUESTION NO: 508
Users should be able to access their email and several secure applications from any workstation
on the network. Additionally, the administrator has implemented an authentication system
requiring the use of a username, password, and a company issued smart card. Which of the
following is this an example of?
A. Three factor authentication
B. SSO
C. ACL
D. Least privilege

Back 508

Answer: B

Front 509

QUESTION NO: 509
Both the client and the server authenticate before exchanging datA. This is an example of:
A. biometrics.
B. multifactor authentication.
C. mutual authentication.
D. SSO.

Back 509

Answer: C

Front 510

QUESTION NO: 510
Which of the following could be used to institute a tunneling protocol for security?
A. IPX/SPX
B. EAP
C. IPSec
D. FTP

Back 510

Answer: C

Front 511

QUESTION NO: 511
Which of the following is an encryption program used to secure email and voice over the Internet?
A. PGP
B. S/MIME
C. ECC
D. Blowfish

Back 511

Answer: A

Front 512

QUESTION NO: 512
Which of the following is used for securing communication between a client and a server?
A. NTLM
B. SHA-1
C. MD5
D. SMTP

Back 512

Answer: A

Front 513

QUESTION NO: 513
Which of the following processes are used to monitor and protect the DNS server?
A. Ping the DNS server every minute to verify connectivity.
B. Use personal firewalls to block port 53
C. Check DNS records regularly.
D. Set PTR records to purge daily.

Back 513

Answer: C

Front 514

QUESTION NO: 514
Which of the following is the MOST effective method for stopping a phishing attempt?
A. Up-to-date antivirus definitions
B. Paper shredders
C. User education
D. SPAM filters

Back 514

Answer: C

Front 515

QUESTION NO: 515
A corporation has a contractual obligation to provide a certain amount of system uptime to a client.
Which of the following is this contract an example of?
A. PII
B. SLA
C. Due diligence
D. Redundancy

Back 515

Answer: B

Front 516

QUESTION NO: 516
Which of the following would allow for a network to remain operational after a T1 failure?
A. Uninterruptible Power Supply (UPS)
B. Redundant ISP
C. Redundant servers
D. RAID 5 drive array

Back 516

Answer: B

Front 517

QUESTION NO: 517
Which of the following asymmetric encryption algorithms was utilized FIRST?
A. AES
B. Serpent
C. Whirlpool
D. DES

Back 517

Answer: D

Front 518

QUESTION NO: 518
A ticket granting server is an important concept in which of the following authentication models?
A. PAP
B. RADIUS
C. Kerberos
D. CHAP

Back 518

Answer: C

Front 519

QUESTION NO: 519
Which of the following is an example of two-factor authentication?
A. User ID and password
B. Smart card and PIN
C. Fingerprint reader and iris scanner
D. Smart card and ID badge

Back 519

Answer: B

Front 520

QUESTION NO: 520
Which of the following could physically damage a device if a long term failure occurred?
A. OVAL
B. HVAC
C. Battery backup system
D. Shielding

Back 520

Answer: B

Front 521

QUESTION NO: 521
Which of the following is the easiest way to disable a 10Base2 network?
A. Introduce crosstalk.
B. Install a zombiE.
C. Remove a terminator.
D. Remove a vampire tap.

Back 521

Answer: C

Front 522

QUESTION NO: 522
Which of the following is the BEST method for securing the data on a coaxial network?
A. Weld all terminators to the cable ends.
B. Run all cables through a conduit.
C. Make sure all terminators are groundeD.
D. Run all new cables parallel to existing alternating current (AC) cabling.

Back 522

Answer: B

Front 523

QUESTION NO: 523
Which of the following is the weakest password?
A. Indu5tr1als
B. F%r3Walke3r
C. C0mpt!a2**8
D. P^s5W0rd

Back 523

Answer: A

Front 524

QUESTION NO: 524
Which of the following is the GREATEST security risk regarding removable storage?
A. Integrity of data
B. Not enough space available
C. Availability of data
D. Confidentiality of data

Back 524

Answer: D

Front 525

QUESTION NO: 525
Which of the following mimics a legitimate program in order to steal sensitive data?
A. Botnet
B. Worm
C. Spam
D. Trojan

Back 525

Answer: D

Front 526

QUESTION NO: 526
Which of the following allows for a user to have only the minimum level of access required for their
job duties?
A. Least privilege
B. Privilege escalation
C. Job rotation
D. Implicit deny

Back 526

Answer: A

Front 527

QUESTION NO: 527
A manager needs to control employee overtimE. Which of the following would BEST allow for the
manager to control when the employees are on the network?
A. Access control list
B. User account expiration
C. Time of day restriction
D. Domain password policy

Back 527

Answer: C

Front 528

QUESTION NO: 528
Which of the following BEST describes hashing?
A. Encrypting the data payload and computing a unique mathematic identifier in order to detect
change during transport.
B. Computing a unique mathematic identifier in order to prevent change during transport.
C. Encrypting the data payload and computing a unique mathematic identifier in order to prevent
change during transport.
D. Computing a unique mathematic identifier in order to detect change during transport.

Back 528

Answer: D

Front 529

QUESTION NO: 529
Which of the following is MOST likely to crash a workstation?
A. Vulnerability assessment
B. Protocol analyzer
C. Penetration test
D. Network mapper

Back 529

Answer: C

Front 530

QUESTION NO: 530
Which of the following is the critical piece of an encrypted communication that must be kept
secret?
A. The key exchange algorithm
B. The initial salt value
C. The encryption algorithm
D. The final CRC of the key packet

Back 530

Answer: B

Front 531

QUESTION NO: 531
A PC is rejecting push updates from the server; all other PCs on the network are accepting the
updates successfully. Which of the following should the administrator check FIRST?
A. Pop-up blocker
B. Local firewall
C. Password expiration
D. Anti-spyware

Back 531

Answer: B

Front 532

QUESTION NO: 532
Which of the following describes an encrypted connection across public communication lines?
A. TACACS
B. VPN
C. EAP
D. CHAP

Back 532

Answer: B

Front 533

QUESTION NO: 533
After a period of high employee turnover, which of the following should be implemented?
A. A review of NTLM hashes on the domain servers
B. A review of group policies
C. A review of user access and rights
D. A review of storage and retention policies

Back 533

Answer: C

Front 534

QUESTION NO: 534
All PCs in a network share a single administrator ID and passworD. When the administrator
attempts to
remotely control a users PC the attempt fails.Which of the following should the administrator check
FIRST?
A. The antivirus settings on the local PC
B. The antivirus settings on the remote PC
C. The HIPS on the remote PC
D. The HIPS on the local PC

Back 534

Answer: C

Front 535

QUESTION NO: 535
All of the following are considered key exchange protocols EXCEPT:
A. Diffie-Hellman.
B. KEA.
C. RSA.
D. SAFER.

Back 535

Answer: D

Front 536

QUESTION NO: 536
Which of the following keys is generally applied FIRST to a message digest to provide nonrepudiation
using asymmetric cryptography?
A. Privatekey of the receiver
B. Privatekey of the sender
C. Public key of the sender
D. Public key of the receiver

Back 536

Answer: B

Front 537

QUESTION NO: 537
Which of the following describes a weakness of the hash functions?
A. Collision
B. Birthday attack
C. Collusion
D. Man-in-the-middle

Back 537

Answer: A

Front 538

QUESTION NO: 538
All of the following are organizational policies that reduce the impact of fraud EXCEPT:
A. separation of duties.
B. password complexity rules.
C. job rotation.
D. escorting procedures.

Back 538

Answer: B

Front 539

QUESTION NO: 539
A technician is conducting a forensics analysis on a computer system. Which of the following
should be done FIRST?
A. Look for hidden files.
B. Analyze temporary files.
C. Get a binary copy of the system.
D. Search for Trojans.

Back 539

Answer: C

Front 540

QUESTION NO: 540
A technician noticed a remote attack taking place on a system. Which of the following should be
done FIRST?
A. Contain the attack.
B. Respond to the attacker.
C. Disconnect the system from the network.
D. Follow the incident management procedure in placE.

Back 540

Answer: D

Front 541

QUESTION NO: 541
Which of the following IDS generally follows a learning process?
A. Anomaly-based IDS
B. Signature-based IDS
C. Event-based IDS
D. Rule-based IDS

Back 541

Answer: A

Front 542

QUESTION NO: 542
Which of the following algorithms is faster when encrypting data?
A. Symmetric key algorithms
B. Public key algorithms
C. Whole disk encryption algorithms
D. Asymmetric key algorithms

Back 542

Answer: A

Front 543

QUESTION NO: 543
Which of the following is a reason why DNS logs should be archived?
A. For complying with payment card industry (PCI) requirements
B. For complying with PII requirements
C. For use in disaster recovery of the DNS server
D. For use in an investigation in the future

Back 543

Answer: D

Front 544

QUESTION NO: 544
Which of the following is a best practice for securing log files?
A. Copy or save the logs to a remote log server.
B. Log all failed and successful login attempts.
C. Deny administrators all access to log files to prevent write failures.
D. Change security settings to avoid corruption.

Back 544

Answer: A

Front 545

QUESTION NO: 545
Which of the following logs shows when the workstation was last shutdown?
A. DHCP
B. Security
C. Access
D. System

Back 545

Answer: D

Front 546

QUESTION NO: 546
Which of the following is a best practice auditing procedure?
A. Mitigate vulnerabilities
B. Review user access and rights
C. Set strong password requirements
D. Draft an email retention policy

Back 546

Answer: B

Front 547

QUESTION NO: 547
Which of the following tools is commonly used to detect security anomalies on a host?
A. A file system integrity checker
B. A TACACS+ implementation
C. A remote protocol analyzer
D. A network mapper

Back 547

Answer: A

Front 548

QUESTION NO: 548
Snort, TCPDump and Wireshark are commonly used for which of the following?
A. Port scanning
B. Host monitoring
C. DDOS attacks
D. Network sniffing

Back 548

Answer: D

Front 549

QUESTION NO: 549
Which of the following would typically require the use of a network protocol analyzer?
A. Determining who logged on to a machine last night atmidnight
B. Determining how many users are logged onto the domain controller
C. Determining why authentication between two machines failed
D. Determining what the speed is on the external interface of a firewall

Back 549

Answer: C

Front 550

QUESTION NO: 550
Which of the following security related anomalies are MOST likely to be detected by a protocol
analyzer?
A. Many malformed or fragmented packets
B. Decryption of encrypted network traffic
C. Disabled network interface on a server
D. Passive sniffing of local network traffic

Back 550

Answer: A

Front 551

QUESTION NO: 551
Users and computers are generally grouped into domains for security purposes.Which of the
following is a common attribute used to determine which domain a user or computer belongs to?
A. MAC address
B. Location
C. Password
D. OS

Back 551

Answer: B

Front 552

QUESTION NO: 552
Malware that uses virtualization techniques can be difficult to detect because of which of the
following?
A. A portion of the malware may have been removed by the IDS.
B. The malware may be using a Trojan to infect the system.
C. The malware may be implementing a proxy server for command and control.
D. The malware may be running at a more privileged level than the antivirus softwarE.

Back 552

Answer: D

Front 553

QUESTION NO: 553
Which of the following is a reason why virtualization techniques are often used to implement a
honeynet?
A. To reduce the number of physical devices needed
B. To hide the encryption being used in the honeynet
C. To slow the intruders network connection speed
D. To reduce the number of connections allowed

Back 553

Answer: A

Front 554

QUESTION NO: 554
Which of the following is an industry standard for remote logging?
A. ipfilter
B. RDP
C. rlogin
D. syslog

Back 554

Answer: D

Front 555

QUESTION NO: 555
Audit trails are used for which of the following?
A. Availability
B. Accountability
C. Authorization
D. Continuity

Back 555

Answer: B

Front 556

QUESTION NO: 556
Which of the following can be used to centrally manage security settings?
A. Cross-site scripting
B. Group policy
C. Service pack
D. NIDS

Back 556

Answer: B

Front 557

QUESTION NO: 557
Which of the following is a best practice disaster recovery strategy?
A. Use a reciprocal agreement.
B. Spend at least 5% of the IT budget.
C. Hire an independent consultant.
D. Test the recovery plan.

Back 557

Answer: D

Front 558

QUESTION NO: 558
Which of the following activities is MOST closely associated with DLL injection?
A. Penetration testing
B. Network mapping
C. Vulnerability assessment
D. SQL servers

Back 558

Answer: A

Front 559

QUESTION NO: 559
Which of the following is true about penetration testing or vulnerability assessments?
A. Vulnerability assessment verifies incidence response
B. Penetration testing removes malware if found during a scan
C. Vulnerability assessment exploits a weakness in a system
D. Penetration testing exploitsa vulnerability

Back 559

Answer: D

Front 560

QUESTION NO: 560
Which of the following is a security risk of not password protecting the BIOS?
A. The system may be changed to boot from alternative mediA.
B. The antivirus software will not run because it needs a BIOS passworD.
C. A virus may corrupt the SCSI settings and the system will not boot.
D. The authentication system may be subverteD.

Back 560

Answer: A

Front 561

QUESTION NO: 561
Executing proper logging procedures would be the proper course of action in which of the
following scenarios? (Select TWO).
A. Need to prevent access to a file or folder
B. Need to know which files have been accessed
C. Need to know who is logging on to the system
D. Need to prevent users from logging on to the system
E. Need to capture monitor network traffic in real time

Back 561

Answer: B,C

Front 562

QUESTION NO: 562
Executing proper logging procedures would facilitate which of the following requirements?
A. Ignore suspicious queries to the DNS server.
B. Investigate suspicious queries to the DNS server.
C. Block suspicious queries to the DNS server.
D. Monitor suspicious queries to the DNS server in real timE.

Back 562

Answer: B

Front 563

QUESTION NO: 563
Which of the following is a concern when setting logging to a debug level?
A. The log may fill up with extraneous information.
B. The device or application will only operate in test modE.
C. Some important events will not get loggeD.
D. The events may not contain enough details.

Back 563

Answer: A

Front 564

QUESTION NO: 564
Which of the following should be considered when executing proper logging procedures? (Select
TWO).
A. The information that is needed to reconstruct events
B. The number of disasters that may occur in one year
C. The password requirements for user accounts
D. The virtual memory allocated on the log server
E. The amount of disk space required

Back 564

Answer: A,E

Front 565

QUESTION NO: 565
Which of the following malicious activities might leave traces in a DNS log file?
A. Hijacking
B. Poisoning
C. Caching
D. Phishing

Back 565

Answer: B

Front 566

QUESTION NO: 566
Which of the following NAC scanning types is the LEAST intrusive to the client?
A. Open ID
B. Agent based
C. Agentless
D. ActiveX

Back 566

Answer: C

Front 567

QUESTION NO: 567
Common settings configured on an Internet content filtering device are database update settings,
log settings and which of the following?
A. False positive threshold
B. Content rules
C. Anomaly settings
D. Performance settings

Back 567

Answer: B

Front 568

QUESTION NO: 568
Which of the following activities commonly involves feedback from departmental managers or
human resources?
A. Clearing cookies from the browser
B. Resetting an employee password
C. User access and rights review
D. Setting system performance baseline

Back 568

Answer: C

Front 569

QUESTION NO: 569
While auditing a list of active user accounts, which of the following may be revealed?
A. Accounts with weak passwords
B. Passwords with dictionary words
C. Passwordsthat are blank
D. Accounts that need to be removed

Back 569

Answer: D

Front 570

QUESTION NO: 570
Which of the following is the BEST option for securing an email infrastructure?
A. Set up an email proxy on the Internet and an email server in the internal network.
B. Set up an email proxy on the Internet and an email server in the DMZ.
C. Set up the email server in a DMZ.
D. Set up an email proxy in the DMZ and the email server in the internal network.

Back 570

Answer: D

Front 571

QUESTION NO: 571
Which of the following provides the BEST mechanism for non-repudiation?
A. Encryption
B. Message digests
C. Digital signatures
D. Message authentication codes

Back 571

Answer: C

Front 572

QUESTION NO: 572
Which of the following is the BEST logical access control method for controlling system access on
teams working in shifts?
A. Separation of duties
B. Job rotation
C. Time of day restrictions
D. Least privilege

Back 572

Answer: C

Front 573

QUESTION NO: 573
Which of the following key types does Kerberos use?
A. Ticket Grating Service
B. Symmetric keys
C. Asymmetric keys
D. Key Distribution Center

Back 573

Answer: C

Front 574

QUESTION NO: 574
Which of the following are recommended security measures when implementing system logging
procedures? (Select TWO).
A. Perform a binary copy of the system.
B. Apply retention policies on the log files.
C. Collect system temporary files.
D. Perform hashing of the log files.
E. Perform CRC checks.

Back 574

Answer: B,D

Front 575

QUESTION NO: 575
Which of the following should be considered when implementing logging controls on multiple
systems?
(Select TWO).
A. VLAN segment of the systems
B. Systems clock synchronization
C. Systems capacity and performance
D. External network traffic
E. Network security zone of the systems

Back 575

Answer: B,C

Front 576

QUESTION NO: 576
Which of the following BEST describes actions pertaining to user account reviews? (Select TWO).
A. User account reports are periodically extracted from systems and employment verification is
performeD.
B. User accounts and their privileges are periodically extracted from systems and reports are kept
for auditing purposes.
C. User accounts and their privileges are periodically extracted from systems and are reviewed for
the appropriate level of authorization.
D. User accounts reports are periodically extracted from systems and end users are informed.
E. User accounts reports are periodically extracted from systems and user access dates are
verified

Back 576

Answer: A,C

Front 577

QUESTION NO: 577
All of the following are attributes of an x.509 certificate EXCEPT:
A. the symmetric key of the owner.
B. the public key of the owner.
C. the version of the certificatE.
D. the issuer.

Back 577

Answer: A

Front 578

QUESTION NO: 578
A user complains that pop-up windows continuously appear on their screen with a message
stating that they have a virus and offering to see a program that will remove it. The technician is
skeptical because the antivirus definitions on the machine are up-to-datE. Which of the following
BEST describes what the user is seeing?
A. SQL injection
B. Spyware
C. Adware
D. SMTP open relay

Back 578

Answer: C

Front 579

QUESTION NO: 579
The GREATEST security concern in regards to data leakage with USB devices is:
A. speeD.
B. physical sizE.
C. OS compatibility.
D. storage capacity.

Back 579

Answer: B

Front 580

QUESTION NO: 580
Which of the following is the main difference between a substitution cipher and a transposition
cipher when used to encode messages?
A. One rearranges and replaces blocks while the other rearranges only.
B. One replaces blocks with other blocks while the other rearranges only.
C. One replaces blocks while the other rearranges and replaces only.
D. One is a symmetric block cipher and the other is asymmetriC.

Back 580

Answer: B

Front 581

QUESTION NO: 581
All of the following can be found in the document retention policy EXCEPT:
A. type of storage mediA.
B. password complexity rules.
C. physical access controls.
D. retention periods.

Back 581

Answer: B

Front 582

QUESTION NO: 582
Which of the following reduces effectiveness when deploying and managing NIPS?
A. Encrypting all network traffic
B. Continued tuning
C. Network placement
D. Reviewing the logs

Back 582

Answer: A

Front 583

QUESTION NO: 583
Which of the following authentication methods prevents a replay attack from occurring?
A. L2TP
B. CHAP
C. Kerberos
D. RADIUS

Back 583

Answer: C

Front 584

QUESTION NO: 584
To prevent disk integrity errors due to small line-power fluctuations, a system administrator should
install which of the following?
A. Voltage regulator
B. Line conditioner
C. Battery backup
D. Redundant power supplies

Back 584

Answer: B

Front 585

QUESTION NO: 585
Which of the following is the BEST way to mass deploy security configurations to numerous
workstations?
A. Security hotfix
B. Configuration baseline
C. Patch management
D. Security templates

Back 585

Answer: D

Front 586

QUESTION NO: 586
Virtual machines are MOST often used by security researchers for which of the following
purposes?
A. To provide a secure virtual environment to conduct online deployments
B. To provide a virtual collaboration environment to discuss security research
C. To provide an environment where new network applications can be tested
D. To provide an environment where malware can be executed with minimal risk to equipment and
software

Back 586

Answer: D

Front 587

QUESTION NO: 587
Which of the following is a password cracker?
A. CORE Impact
B. Cain & Abel
C. WireShark
D. NMAP

Back 587

Answer: B

Front 588

QUESTION NO: 588
Which of the following characteristics of RAID increases availability?
A. Striping without parity
B. Mirroring
C. Kiting
D. Low cost

Back 588

Answer: B

Front 589

QUESTION NO: 589
A document shredder will BEST prevent which of the following?
A. Dumpster diving
B. Phishing
C. Shoulder surfing
D. Viruses

Back 589

Answer: A

Front 590

QUESTION NO: 590
Which of the following would BEST prevent the spread of a hoax?
A. Chain of custody
B. User education
C. Up-to-date antivirus definitions
D. Up-to-date anti-spyware definitions

Back 590

Answer: B

Front 591

QUESTION NO: 591
Which of the following is a term referring to the situation when a programmer leaves an
unauthorized entry point into a program or system?
A. Back door
B. Default account
C. Poisoning
D. Privilege escalation

Back 591

Answer: A

Front 592

QUESTION NO: 592
Which of the following refers to a system that is unable to accept new TCP connections due to a
SYN flood attack?
A. Airsnort
B. Smurf
C. Teardrop
D. DoS

Back 592

Answer: D

Front 593

QUESTION NO: 593
Which of the following would refer to a key fob with a periodically changing number that is used as
part of the authentication process?
A. Installation key
B. Biometric device
C. Hardware lock
D. Physical token

Back 593

Answer: D

Front 594

QUESTION NO: 594
Which of the following is the MOST common method of one-factor authentication?
A. Smart card and a PIN
B. Physical token and a password
C. Fingerprint reader
D. User ID and password

Back 594

Answer: D

Front 595

QUESTION NO: 595
An attorney demands to know exactly who had possession of a piece of evidence at a certain time
after seizurE. Which of the following documents would provide this?
A. Due diligence
B. Chain of custody
C. Due process
D. Change management

Back 595

Answer: B

Front 596

QUESTION NO: 596
Which of the following prevents damage to evidence during forensic analysis?
A. Write-only drive connectors
B. Drive sanitization tools
C. Read-only drive connectors
D. Drive recovery tools

Back 596

Answer: C

Front 597

QUESTION NO: 597
Which of the following is a drawback of using PAP authentication?
A. PAP only authenticates between same vendor servers.
B. PAP requires that both workstations mutually authenticatE.
C. PAP changes its initialization vector with each packet.
D. PAP sends all passwords across the network as clear text.

Back 597

Answer: D

Front 598

QUESTION NO: 598
Which of the following BEST describes using a third party to store the public and private keys?
A. Public key infrastructure
B. Recovery agent
C. Key escrow
D. Registration authority

Back 598

Answer: C

Front 599

QUESTION NO: 599
Which of the following requires the server to periodically request authentication from the client?
A. EAP
B. CHAP
C. WPA2
D. RAS

Back 599

Answer: B

Front 600

QUESTION NO: 600
A biometric fingerprint scanner is an example of which of the following?
A. Two-factor authentication
B. SSO
C. Three-factor authentication
D. Single-factor authentication

Back 600

Answer: D

Front 601

QUESTION NO: 601
A user ID, PIN, and a palm scan are all required to authenticate a system. Which of the following
is this an example of?
A. SSO
B. Two-factor authentication
C. Single-factor authentication
D. Three-factor authentication

Back 601

Answer: B

Front 602

QUESTION NO: 602
Which of the following would be disabled to prevent SPIM?
A. P2P
B. ActiveX controls
C. Instant messaging
D. Internet mail

Back 602

Answer: C

Front 603

QUESTION NO: 603
A user sees an MD5 hash number beside a file that they wish to downloaD. Which of the following
BEST describes a hash?
A. A hash is a unique number that is generated based upon the TCP/IP transmission header and
should be verified before downloaD.
B. A hash is a unique number that is generated based upon the files contents and used as the
SSL key during downloaD.
C. A hash is a unique number that is generated after the file has been encrypted and used as the
SSL key during downloaD.
D. A hash is a unique number that is generated based upon the files contents and should be
verified after downloaD.

Back 603

Answer: D

Front 604

QUESTION NO: 604
According to a good disaster recovery plan, which of the following must happen during a power
outage before an uninterruptible power supply (UPS) drains its battery?
A. The PKI CA is relocateD.
B. The backup generator activates.
C. The single point of failure is remedieD.
D. Full electrical service is restoreD.

Back 604

Answer: B

Front 605

QUESTION NO: 605
Which of the following would give a technician the MOST information regarding an external attack
on the network?
A. Internet content filter
B. Proxy server
C. NIDS
D. Firewall

Back 605

Answer: C

Front 606

QUESTION NO: 606
Which of the following would BEST prevent night shift workers from logging in with IDs and
passwords stolen from the day shift workers?
A. Account expiration
B. Time of day restriction
C. Account lockout
D. Domain password policy

Back 606

Answer: B

Front 607

QUESTION NO: 607
Which of the following would BEST ensure that users have complex passwords?
A. ACL
B. Domain password policy
C. Logical tokens
D. Time of day restrictions

Back 607

Answer: B

Front 608

QUESTION NO: 608
A technician finds that a malicious user has introduced an unidentified virus to a single file on the
network. Which of the following would BEST allow for the user to be identified?
A. Access logs
B. Performance log
C. Firewall logs
D. Antivirus logs

Back 608

Answer: A

Front 609

QUESTION NO: 609
Which of the following would BEST allow an administrator to find the IP address of an external
attacker?
A. Antivirus logs
B. DNS logs
C. Firewall logs
D. Performance logs

Back 609

Answer: C

Front 610

QUESTION NO: 610
After performing a vulnerability analysis and applying a security patch, which of the following nonintrusive
actions should an administrator take to verify that the vulnerability was truly removed?
A. Apply a security patch from the vendor.
B. Perform a penetration test.
C. Repeat the vulnerability scan.
D. Update the antivirus definition filE.

Back 610

Answer: C

Front 611

QUESTION NO: 611
Which of the following could be used by a technician needing to send data while ensuring that any
data tampering is easily detectible?
A. NTLM
B. LANMAN
C. SHA-1
D. AES

Back 611

Answer: C

Front 612

QUESTION NO: 612
Which of the following BEST allows for a high level of encryption?
A. AES with ECC
B. DES with SHA-1
C. PGP with SHA-1
D. 3DES with MD5

Back 612

Answer: A

Front 613

QUESTION NO: 613
Which of the following is the primary security risk associated with removable storage?
A. Availability
B. Confidentiality
C. Injection
D. Integrity

Back 613

Answer: B

Front 614

QUESTION NO: 614
After reading about the vulnerability issues with open SMTP relays, a technician runs an
application to see if port 25 is open. This would be considered a:
A. network mapper.
B. protocol analyzer.
C. vulnerabilityscan.
D. port scan.

Back 614

Answer: D

Front 615

QUESTION NO: 615
A companys accounting application requires users to be administrators for the software to function
correctly. Because of the security implications of this, a network administrator builds a user profile
which allows the user to still use the application but no longer requires them to have administrator
permissions.
Which of the following is this an example of?
A. Configuration baseline
B. Group policy
C. Security template
D. Privilege escalation

Back 615

Answer: C

Front 616

QUESTION NO: 616
Which of the following backup techniques resets the archive bit and allows for the fastest
recovery?
A. Full backup
B. Shadow copies
C. Differential backup
D. Incremental backup

Back 616

Answer: A

Front 617

QUESTION NO: 617
The company policy for availability requires full backups on Sunday and incremental backups each
week night at 10 p.m. The file server crashes on Wednesday afternoon; how many tapes will the
technician need to restore the data on the file server for Thursday morning?
A. One
B. Two
C. Three
D. Four

Back 617

Answer: C

Front 618

QUESTION NO: 618
A company is addressing backup and recovery issues. The company is looking for a compromise
between speed of backup and speed of recovery. Which of the following is the BEST
recommendation?
A. Full backups every day
B. Daily differential backups
C. Full backups weekly with differential backups daily
D. Weekly differential with incremental backups daily

Back 618

Answer: C

Front 619

QUESTION NO: 619
Which of the following would define document destruction requirements?
A. ACL
B. User access and rights review policies
C. Group policy
D. Storage and retention policies

Back 619

Answer: D

Front 620

QUESTION NO: 620
Part of a standard policy for hardening workstations and servers should include applying the
company security template and:
A. installing the NIDS.
B. closing unnecessary network ports.
C. applying all updates, patches and hotfixes immediately.
D. disabling SSID broadcast.

Back 620

Answer: B

Front 621

QUESTION NO: 621
Setting a baseline is required in which of the following? (Select TWO).
A. Anomaly-based monitoring
B. NIDS
C. Signature-based monitoring
D. NIPS
E. Behavior-based monitoring

Back 621

Answer: A,E

Front 622

QUESTION NO: 622
Which of the following hidden programs gathers information with or without the users knowledge
with the primary purpose of advertising?
A. Worm
B. Trojan
C. Spyware
D. Virus

Back 622

Answer: C

Front 623

QUESTION NO: 623
Which of the following provides best practice with a wireless network?
A. WPA
B. WPA with RADIUS
C. 3DES with RADIUS
D. WEP 128-bit

Back 623

Answer: B

Front 624

QUESTION NO: 624
Which of the following sites has the means (E. g. equipment, software, and communications) to
facilitate a full recovery within minutes?
A. Warm site
B. Hot site
C. Reciprocal site
D. Cold site

Back 624

Answer: B

Front 625

QUESTION NO: 625
When conducting an environmental security assessment, which of the following items should be
included in the assessment? (Select THREE).
A. HVAC
B. Card access system
C. Off-site data storage
D. Logical access
E. Utilities
F. Fire detection

Back 625

Answer: A,E,F

Front 626

QUESTION NO: 626
Which of the following security steps must a user complete before access is given to the network?
A. Authentication and password
B. Identification and authentication
C. Identification and authorization
D. Authentication and authorization

Back 626

Answer: B

Front 627

QUESTION NO: 627
When placing a NIDS onto the network, the NIC has to be placed in which of the following modes
to monitor all network traffic?
A. Promiscuous
B. Full-duplex
C. Auto
D. Half-duplex

Back 627

Answer: A

Front 628

QUESTION NO: 628
An administrator wants to obtain a view of the type of attacks that are being targeted against the
network perimeter. The recommended placement of a NIDS would be:
A. inside the proxy.
B. inside the DMZ.
C. outside the proxy.
D. outside the firewall.
E. inside the firewall.

Back 628

Answer: D

Front 629

QUESTION NO: 629
Once a system has been compromised, often the attacker will upload various tools that can be
used at a later date. The attacker could use which of the following to hide these tools?
A. Logic bomb
B. Rootkit
C. Virus
D. Trojan

Back 629

Answer: B

Front 630

QUESTION NO: 630
Which of the following is the perfect encryption scheme and is considered unbreakable when
properly used?
A. Running key cipher
B. Concealment cipher
C. One-time pad
D. Steganography

Back 630

Answer: C

Front 631

QUESTION NO: 631
When using a digital signature, the message digest is encrypted with which of the following keys?
A. Receivers private key
B. Receivers public key
C. Senders public key
D. Senders private key

Back 631

Answer: D

Front 632

QUESTION NO: 632
Which of the following is the MOST basic form of IDS?
A. Signature
B. Behavioral
C. Statistical
D. Anomaly

Back 632

Answer: A

Front 633

QUESTION NO: 633
Which of the following BEST applies to steganography?
A. Algorithms are not used to encrypt datA.
B. Algorithms are used to encrypt datA.
C. Keys are used to encrypt datA.
D. Keys are concealed in the datA.

Back 633

Answer: A

Front 634

QUESTION NO: 634
Which of the following can steganography be used for?
A. Watermark graphics for copyright.
B. Decrypt data in graphics.
C. Encrypt a message in WAV files.
D. Encrypt data in graphics.

Back 634

Answer: A

Front 635

QUESTION NO: 635
Steganography could be used by attackers to:
A. encrypt and conceal messages in microdots.
B. decrypt data stored in unused disk spacE.
C. encrypt and decrypt messages in graphics.
D. hide and conceal messages in WAV files.

Back 635

Answer: D

Front 636

QUESTION NO: 636
Which of the following BEST describes how steganography can be accomplished in graphic files?
A. Replacing the most significant byte of each bit
B. Replacing the least significant byte of each bit
C. Replacing the most significant bit of each byte
D. Replacing the least significant bit of each byte

Back 636

Answer: D

Front 637

QUESTION NO: 637
An application developer is looking for an encryption algorithm which is fast and hard to break if a
large key size is used. Which of the following BEST meets these requirements?
A. Transposition
B. Substitution
C. Symmetric
D. Asymmetric

Back 637

Answer: C

Front 638

QUESTION NO: 638
Which of the following if used incorrectly would be susceptible to frequency analysis?
A. Asymmetric algorithms
B. Transposition ciphers
C. Symmetric algorithms
D. Stream ciphers

Back 638

Answer: B

Front 639

QUESTION NO: 639
An administrator in an organization with 33,000 users would like to store six months of Internet
proxy logs on a dedicated logging server for analysis and content reporting. The reports are not
time critical, but are required by upper management for legal obligations. All of the following apply
when determining the requirements for the logging server EXCEPT:
A. log details and level of verbose logging.
B. time stamping and integrity of the logs.
C. performance baseline and audit trails.
D. log storage and backup requirements.

Back 639

Answer: C

Front 640

QUESTION NO: 640
Which of the following BEST describes when a hashing algorithm generates the same hash for
two different messages?
A. A hashing chain occurreD.
B. A deviation occurreD.
C. A collision occurreD.
D. A one-way hash occurreD.

Back 640

Answer: C

Front 641

QUESTION NO: 641
Which of the following is BEST known for self-replication in networks?
A. Spyware
B. Worm
C. Spam
D. Adware

Back 641

Answer: B

Front 642

QUESTION NO: 642
Which of the following security threats affects PCs and can have its software updated remotely by
a command and control center?
A. Zombie
B. Worm
C. Virus
D. Adware

Back 642

Answer: A

Front 643

QUESTION NO: 643
Multiple web servers are fed from a load balancer. Which of the following is this an example of?
A. RAID
B. Backup generator
C. Hot site
D. Redundant servers

Back 643

Answer: D

Front 644

QUESTION NO: 644
An outside auditor has been contracted to determine if weak passwords are being used on the
network.
To do this, the auditor is running a password cracker against the master password filE. Which of
the following is this an example of?
A. Vulnerability assessment
B. Fingerprinting
C. Malware scan
D. Baselining

Back 644

Answer: A

Front 645

QUESTION NO: 645
Password crackers:
A. are sometimes able to crack both passwords and physical tokens.
B. cannot exploit weaknesses in encryption algorithms.
C. cannot be run remotely.
D. are sometimes able to crack both Windows and UNIX passwords.

Back 645

Answer: D

Front 646

QUESTION NO: 646
Logic bombs differ from worms in that:
A. logic bombs cannot be sent through email.
B. logic bombs cannot spread from computer to computer.
C. logic bombs always contain a Trojan component.
D. logic bombs always have a date or time component.

Back 646

Answer: D

Front 647

QUESTION NO: 647
A firewall differs from a NIDS in which of the following ways?
A. A firewall attempts to detect patterns and a NIDS operates on a rule list.
B. A firewall operates on a rule list and a NIDS attempts to detect patterns.
C. A firewall prevents inside attacks and a NIDS prevents outside attacks.
D. A firewall prevents outside attacks and a NIDS prevents inside attacks.

Back 647

Answer: B

Front 648

QUESTION NO: 648
A vulnerability has recently been identified for a servers OS. Which of the following describes the
BEST course of action?
A. Shutdown all affected servers until management can be notifieD.
B. Visit a search engine and search for a possible patch.
C. Wait for an automatic update to be pushed out to the server from the manufacturer.
D. Visit the operating systemmanufacturers website for a possible patch.

Back 648

Answer: D

Front 649

QUESTION NO: 649
Personal software firewalls can be updated automatically using:
A. group policy.
B. cookies.
C. cross-site scripting.
D. corporate hardware firewalls.

Back 649

Answer: A

Front 650

QUESTION NO: 650
An accountant has logged onto the companys external banking websitE. An administrator using a
TCP/IP monitoring tool discovers that the accountant was actually using a spoofed banking
websitE. Which of the following could have caused this attack? (Select TWO).
A. Altered hosts file
B. Network mapper
C. Packet sniffing
D. DNS poisoning
E. Bluesnarfing

Back 650

Answer: A,D

Front 651

QUESTION NO: 651
Which of the following tools would be BEST for monitoring changes to the approved system
baseline?
A. Enterprise resource planning software
B. Enterprise performance monitoring software
C. Enterprise antivirus software
D. Enterprise key management software

Back 651

Answer: B

Front 652

QUESTION NO: 652
All of the following security applications can proactively detect workstation anomalies EXCEPT:
A. antivirus softwarE.
B. NIDS.
C. personal software firewall.
D. HIPS.

Back 652

Answer: B

Front 653

QUESTION NO: 653
A periodic security audit of group policy can:
A. show that data is being correctly backed up.
B. show that PII data is being properly protecteD.
C. show that virus definitions are up to date on all workstations.
D. show that unnecessary services are blocked on workstations.

Back 653

Answer: D

Front 654

QUESTION NO: 654
Which of the following is the primary purpose of an audit trail?
A. To detect when a user changes security permissions
B. To prevent a user from changing security permissions
C. To prevent a user from changing security settings
D. To detect the encryption algorithm used for files

Back 654

Answer: A

Front 655

QUESTION NO: 655
Which of the following describes a characteristic of the session key in an SSL connection?
A. It is symmetriC.
B. It is a hash valuE.
C. It is asymmetriC.
D. It is an elliptical curvE.

Back 655

Answer: A

Front 656

QUESTION NO: 656
Which of the following describes the cryptographic algorithm employed by TLS to establish a
session key?
A. RSA
B. Diffie-Hellman
C. Blowfish
D. IKE

Back 656

Answer: B

Front 657

QUESTION NO: 657
Which of the following describes how TLS protects against man-in-the-middle attacks?
A. The client compares the actual DNS name of the server to the DNS name on the certificatE.
B. The client relies on the MD5 value sent by the server.
C. The client compares the server certificate with the certificate listed on the CRL.
D. The client relies on the MAC value sent by the server.

Back 657

Answer: A

Front 658

QUESTION NO: 658
Which of the following is the primary purpose of removing audit logs from a server?
A. To protect against the log file being changed
B. To demonstrate least privilege to management
C. To reduce network latency
D. To improve the server performance

Back 658

Answer: A

Front 659

QUESTION NO: 659
Which of the following describes a common problem encountered when conducting audit log
reviews?
A. The timestamp for the servers are not synchronizeD.
B. The servers are not synchronized with the clients.
C. The audit logs cannot be imported into a spreadsheet.
D. The audit logs are pulled from servers on different days.

Back 659

Answer: A

Front 660

QUESTION NO: 660
A technician is conducting a web server audit and discovers that SSLv2 is implementeD. The
technician wants to recommend that the organization consider using TLS. Which of the following
reasons could the technician use to support the recommendation?
A. SSLv2 reduces server performancE.
B. SSLv2 is susceptible to network sniffing.
C. SSLv2 only uses message authentication code values.
D. SSLv2 is susceptible to man-in-the-middle attacks.

Back 660

Answer: D

Front 661

QUESTION NO: 661
A technician is conducting a password audit using a password cracking tool. Which of the
following describes a BEST business practice when conducting a password audit?
A. Use password masking.
B. Use hybrid modE.
C. Reveal the passworD.
D. Single out the accounts to crack.

Back 661

Answer: A

Front 662

QUESTION NO: 662
Which of the following is a security risk when using peer-to-peer software?
A. Cookies
B. Multiple streams
C. Data leakage
D. Licensing

Back 662

Answer: C

Front 663

QUESTION NO: 663
Which of the following overwrites the return address within a program to execute malicious code?
A. Buffer overflow
B. Rootkit
C. Logic bomb
D. Privilege escalation

Back 663

Answer: A

Front 664

QUESTION NO: 664
Heaps and stacks are susceptible to which of the following?
A. Cross-site scripting
B. Rootkits
C. Buffer overflows
D. SQL injection

Back 664

Answer: C

Front 665

QUESTION NO: 665
All of the following are inline devices EXCEPT:
A. NIPS.
B. firewalls.
C. HIDS.
D. routers.

Back 665

Answer: C

Front 666

QUESTION NO: 666
Which of the following would a technician use to validate whether specific network traffic is indeed
an attack?
A. NIDS
B. Firewall
C. Honeypot
D. Protocol analyzer

Back 666

Answer: D

Front 667

QUESTION NO: 667
Which of the following creates an emulated or virtual environment to detect and monitor malicious
activity?
A. Firewall
B. Honeypot
C. NIDS
D. NAC

Back 667

Answer: B

Front 668

QUESTION NO: 668
A technician wants better insight into the websites that employees are visiting.Which of the
following is BEST suited to accomplish this?
A. Proxy server
B. DHCP server
C. DNS server
D. Firewall

Back 668

Answer: A

Front 669

QUESTION NO: 669
Bluetooth discover mode is similar to which of the following?
A. SSID broadcast
B. Data emanation
C. RF analysis
D. Fuzzing

Back 669

Answer: A

Front 670

QUESTION NO: 670
All of the following are Bluetooth threats EXCEPT:
A. bluesnarfing.
B. discovery modE.
C. blue jacking.
D. a smurf attack.

Back 670

Answer: D

Front 671

QUESTION NO: 671
Which of the following is the BEST approach when reducing firewall logs?
A. Review chronologically.
B. Discard known traffic first.
C. Search for encrypted protocol usagE.
D. Review each protocol one at a timE.

Back 671

Answer: B

Front 672

QUESTION NO: 672
In which of the following logs would notation of a quarantined file appear?
A. Antivirus
B. Firewall
C. Router
D. NAC

Back 672

Answer: A

Front 673

QUESTION NO: 673
Which of the following provides the MOST mathematically secure encryption for a file?
A. 3DES
B. One-time pad
C. AES256
D. Elliptic curve

Back 673

Answer: C

Front 674

QUESTION NO: 674
Which of the following encryption algorithms relies on the inability to factor large prime numbers?
A. Elliptic Curve
B. AES256
C. RSA
D. SHA-1

Back 674

Answer: C

Front 675

QUESTION NO: 675
All of the following provide a host active protection EXCEPT:
A. host-based firewall.
B. antivirus.
C. HIPS.
D. HIDS.

Back 675

Answer: D

Front 676

QUESTION NO: 676
Which of the following simplifies user and computer security administration?
A. Encrypted file system (EFS)
B. Printing policies
C. Data retention
D. Directory services

Back 676

Answer: D

Front 677

QUESTION NO: 677
Which of the following is MOST likely to cause pop-ups?
A. Botnets
B. Adware
C. Spam
D. Rootkit

Back 677

Answer: B

Front 678

QUESTION NO: 678
Which of the following is MOST likely to open a backdoor on a system?
A. Botnet
B. Trojan
C. Logic bomb
D. Worm

Back 678

Answer: B

Front 679

QUESTION NO: 679
If a company has a distributed IT staff, each being responsible for separate facilities, which of the
following would be the BEST way to structure a directory information tree?
A. By department
B. By location
C. By role
D. By name

Back 679

Answer: B

Front 680

QUESTION NO: 680
A technician wants to be able to add new users to a few key groups by default, which of the
following would allow this?
A. Auto-population
B. Template
C. Default ACL
D. Inheritance

Back 680

Answer: B

Front 681

QUESTION NO: 681
Which of the following is a reason to use digital signatures?
A. Access control list
B. Non-repudiation
C. Logical token
D. Hardware token

Back 681

Answer: B

Front 682

QUESTION NO: 682
All of the following are logical access control methods EXCEPT:
A. biometrics.
B. ACL.
C. software token.
D. group policy.

Back 682

Answer: A

Front 683

QUESTION NO: 683
Using the same initial computer image for all systems is similar to which of the following?
A. Group policy
B. Virtual machine
C. Configuration baseline
D. Patch management

Back 683

Answer: C

Front 684

QUESTION NO: 684
Which of the following has the LEAST amount of issues when inspecting encrypted traffic?
A. Antivirus
B. Firewall
C. NIDS
D. NIPS

Back 684

Answer: A

Front 685

QUESTION NO: 685
A technician has come across content on a server that is illegal. Which of the following should the
technician do?
A. Stop and immediately make a backup of the account and contact the owner of the data.
B. Stop and immediatelyfollow company approved incident response procedures.
C. Stop and immediately copy the system files and contact the ISP.
D. Stop and immediately perform a full system backup and contact the owner of the datA.

Back 685

Answer: B

Front 686

QUESTION NO: 686
Which of the following is a true statement in regards to incident response?
A. The first thing a technician should perform is a file system backup.
B. The first thing a technician should do is call in law enforcement.
C. If a technician finds illegal content, they should follow company incident response procedures.
D. If a technician finds illegal content, the first thing a technician should do is unplug the machine
and back it up.

Back 686

Answer: C

Front 687

QUESTION NO: 687
If a technician is unable to get to a website by its address but the technician can get there by the
IP address, which of the following is MOST likely the issue?
A. DHCP server
B. DNS server
C. Firewall
D. Proxy server

Back 687

Answer: B

Front 688

QUESTION NO: 688
Which of the following is placed in promiscuous mode, in line with the data flow, to allow a NIDS to
monitor the traffic?
A. Console
B. Sensor
C. Filter
D. Appliance

Back 688

Answer: B

Front 689

QUESTION NO: 689
In a NIDS, which of the following provides a user interface?
A. Filter
B. Screen
C. Console
D. Appliance

Back 689

Answer: C

Front 690

QUESTION NO: 690
An instance where an IDS identifies legitimate traffic as malicious activity is called which of the
following?
A. False positive
B. True negative
C. False negative
D. True positive

Back 690

Answer: A

Front 691

QUESTION NO: 691
An instance where a biometric system identifies legitimate users as being unauthorized is called
which of the following?
A. False positive
B. False negative
C. False rejection
D. False acceptance

Back 691

Answer: C

Front 692

QUESTION NO: 692
An instance where a biometric system identifies users that are authorized and allows them access
is called which of the following?
A. False negative
B. True negative
C. False positive
D. True positive

Back 692

Answer: D

Front 693

QUESTION NO: 693
An instance where an IDS identifies malicious activity as being legitimate activity is called which of
the following?
A. False acceptance
B. False positive
C. False negative
D. False rejection

Back 693

Answer: C

Front 694

QUESTION NO: 694
An instance where a biometric system identifies unauthorized users and allows them access is
called:
A. false rejection.
B. false negativE.
C. false acceptancE.
D. false positivE.

Back 694

Answer: C

Front 695

QUESTION NO: 695
When executing a disaster recovery plan the MOST important thing to consider is:
A. financial obligations to stockholders.
B. legal and financial responsibilities.
C. data backups and recovery tapes.
D. safety and welfare of personnel.

Back 695

Answer: D

Front 696

QUESTION NO: 696
When choosing a disaster recovery site, which of the following is the MOST important
consideration?
A. The amount of data that will be stored
B. The cost to rebuild the existing facility
C. The amount of emergency rescue personnel
D. The distance and size of the facility

Back 696

Answer: D

Front 697

QUESTION NO: 697
Who should be notified FIRST before testing the disaster recovery plan?
A. Senior management
B. The physical security department
C. All employees and key staff
D. Human resources

Back 697

Answer: A

Front 698

QUESTION NO: 698
Which of the following BEST describes the disaster recovery plan?
A. A detailed process of recovering information or IT systems after a catastrophic event
B. An emergency plan that will allow the company to recover financially
C. A plan that is put in place to recover the company assets in an emergency
D. A plan that is mandated by law to ensure liability issues are addressed in a catastrophic
eventWBerlin
Sans

Back 698

Answer: A

Front 699

QUESTION NO: 699
Which of the following is the MOST important consideration when developing a disaster recovery
plan?
A. Management buy-in
B. The cost of the project
C. The amount of personnel
D. The planning team

Back 699

Answer: A

Front 700

QUESTION NO: 700
In order to provide management with a prioritized list of time critical business processes, an
administrator would assist in conducting a:
A. risk management matrix.
B. business impact assessment.
C. continuity of operations plan.
D. disaster recovery plan.

Back 700

Answer: B

Front 701

QUESTION NO: 701
Which of the following BEST allows a technician to mitigate the chances of a successful attack
against the wireless network?
A. Implement an identification system and WPA2
B. Implement a biometric system and WEP.
C. Implement an authentication system and WPA.
D. Implement an authentication system and WEP.

Back 701

Answer: C

Front 702

QUESTION NO: 702
A technician is reviewing the system logs for a firewall and is told that there is an implicit deny
within the ACL. Which of the following is an example of an implicit deny?
A. An ACL is a way to secure traffic from one network to another.
B. An implicitdeny statement denies all traffic from one network to another.
C. Items which are not specifically given access are denied by default.
D. Each item is denied by default because of the implicit deny.

Back 702

Answer: C

Front 703

QUESTION NO: 703
Which of the following is the MOST likely reason that an attacker would use a DoS attack?
A. The attacker is attempting to distract the company from the real underlining attack.
B. The attacker wants to prevent authorized users from using a certain servicE.
C. The attacker is working with outside entities to test the companys coding practices.
D. The attacker is working with inside entities to test the companys firewall.

Back 703

Answer: B

Front 704

QUESTION NO: 704
Which of the following is a way to gather reconnaissance information from a printer resource?
A. HTTP
B. SMTP
C. RADIUS
D. SNMP

Back 704

Answer: D

Front 705

QUESTION NO: 705
A technician gets informed that there is a worm loose on the network.Which of the following should
the technician review to discover the internal source of the worm?
A. Maintenance logs
B. Antivirus logs
C. Performance logs
D. Access logs

Back 705

Answer: B

Front 706

QUESTION NO: 706
Which of the following BEST allows for the encryption of an entire hard drive?
A. Hashing function
B. Symmetric algorithm
C. Asymmetric algorithm
D. Public key infrastructure

Back 706

Answer: B

Front 707

QUESTION NO: 707
Which of the following would a Faraday cage prevent usage of?
A. Cell phone
B. USB key
C. Uninterruptible Power Supply (UPS)
D. Storage drive

Back 707

Answer: A

Front 708

QUESTION NO: 708
Which of the following will allow a technician to block certain HTTP traffic from company staff
members?
A. VLAN
B. Content filter
C. DMZ
D. NIDS

Back 708

Answer: B

Front 709

QUESTION NO: 709
Which of the following is a security threat to a workstation that requires interaction from a staff
member?
A. Worm
B. Logic bomb
C. Virus
D. Botnet

Back 709

Answer: C

Front 710

QUESTION NO: 710
Which of the following will prevent a person from booting into removal storage media if the correct
boot sequence is already set?
A. BIOS password settings
B. BIOS power on settings
C. USB key settings
D. BIOS boot options

Back 710

Answer: A

Front 711

QUESTION NO: 711
Which of the following ports need to be open to allow a user to login remotely onto a workstation?
A. 53
B. 636
C. 3389
D. 8080

Back 711

Answer: C

Front 712

QUESTION NO: 712
Which of the following, if intercepted, could allow an attacker to access a users email information?
A. Browser cookies
B. Cross-site scripting
C. Cell traffic
D. SMTP traffic

Back 712

Answer: A

Front 713

QUESTION NO: 713
Which of the following would allow a technician to minimize the risk associated with staff running
port scanners on the network?
A. Vulnerability scanners
B. Group policy
C. Network mappers
D. Password crackers

Back 713

Answer: B

Front 714

QUESTION NO: 714
Which of the following is the MOST effective application to implement to identify malicious traffic
on a server?
A. Personal software firewall
B. Enterprise software firewall
C. Antivirus software
D. HIDS software

Back 714

Answer: D

Front 715

QUESTION NO: 715
Which of the following is the MOST appropriate type of software to apply on a workstation that
needs to be protected from other locally accessible workstations?
A. Antivirus software
B. Personal software firewall
C. Pop-up blocker software
D. HIDS

Back 715

Answer: B

Front 716

QUESTION NO: 716
Which of the following is a way for a technician to identify security changes on a workstation?
A. Group policy management
B. Service pack application
C. Security templates
D. Configuration baseline

Back 716

Answer: D

Front 717

QUESTION NO: 717
Which of the following is a way to correct a single security issue on a workstation?
A. A patch
B. A service pack
C. Patch management
D. Configuration baseline

Back 717

Answer: A

Front 718

QUESTION NO: 718
Which of the following protects a home user from the Internet?
A. HIDS
B. Personal firewall
C. Anti-malware software
D. Antivirus application

Back 718

Answer: B

Front 719

QUESTION NO: 719
Computer equipment has been stolen from a companys officE. To prevent future thefts from
occurring and to safeguard the companys trade secrets which of the following should be
implemented?
A. Video surveillance and access logs
B. ID badges and passwords
C. Multifactor authentication
D. Hardware locks and door access systems

Back 719

Answer: D

Front 720

QUESTION NO: 720
Which of the following is the primary purpose for a physical access log in a data center?
A. Maintain a list of personnel who exit the facility.
B. Allow authorized personnel access to the data center.
C. Prevent unauthorized personnel access to the data center.
D. Maintain a list of personnel who enter the facility.

Back 720

Answer: D

Front 721

QUESTION NO: 721
Which of the following biometric authentication devices also carries significant privacy implications
due to personal health information that can be discovered during the authentication process?
A. Iris scanner
B. Fingerprint scanner
C. Retina scanner
D. Facial recognition

Back 721

Answer: C

Front 722

QUESTION NO: 722
An administrator has already implemented two-factor authentication and now wishes to install a
third authentication factor. If the existing authentication system uses strong passwords and PKI
tokens which of the following would provide a third factor?
A. Pass phrases
B. Elliptic curve
C. Fingerprint scanner
D. Six digit PINs

Back 722

Answer: C

Front 723

QUESTION NO: 723
A biometric authentication system consists of all of the following components EXCEPT:
A. reader.
B. credential storE.
C. hardware token.
D. supplicant.

Back 723

Answer: C

Front 724

QUESTION NO: 724
Which of the following is an example of remote authentication?
A. A user on a campus area network (CAN) connects to a server in another building and enters a
username and password pair.
B. A user in one building logs on to the network by entering a username and password into a host
in the same building.
C. A user on a metropolitan area network (MAN) accesses a host by entering a username and
password pair while not connected to the LAN.
D. A user in one city logs onto a network by connecting to a domain server in another city.

Back 724

Answer: D

Front 725

QUESTION NO: 725
Which of the following is a three-factor authentication system?
A. Username, password, token and iris scanner
B. Password, passphrase, PIN and iris scanner
C. PIN, palm recognition scanner and passphrase
D. Username, PIN and fingerprint reader

Back 725

Answer: A

Front 726

QUESTION NO: 726
Which of the following is an acceptable group in which to place end users?
A. Administrators
B. Backup operators
C. Domain users
D. Root

Back 726

Answer: C

Front 727

QUESTION NO: 727
According to industry best practices, administrators should institute a mandatory rotation of duties
policy due to which of the following?
A. Continuity of operations in the event of a spam outbreak
B. Continuity of operations in the event of a virus outbreak
C. Continuity of operations in the event of future growth of the network
D. Continuity of operations in the event of absence or accident

Back 727

Answer: D

Front 728

QUESTION NO: 728
According to industry best practices, administrators should institute a mandatory rotation of duties
policy due to which of the following?
A. To detect outside attackers
B. To detect malware
C. To detect viruses
D. To detect an inside threat

Back 728

Answer: D

Front 729

QUESTION NO: 729
Which of the following is considered the strongest encryption by use of mathematical evaluation
techniques?
A. ROT13
B. DES
C. AES
D. 3DES

Back 729

Answer: C

Front 730

QUESTION NO: 730
Which of the following should be implemented when protecting personally identifiable information
(PII) and sensitive information on IT equipment that can be easily stolen (E. g. USB drive,
laptops)?
A. Sensitive file encryption
B. Confidentiality
C. Whole disk encryption
D. Dual-sided certificates

Back 730

Answer: C

Front 731

QUESTION NO: 731
Which of the following is the BEST wireless security practice that could be implemented to prevent
unauthorized access?
A. WPA2 with a strong pass-phrase
B. Disabling of the SSID broadcast
C. WPA2 with TKIP
D. WPA with MAC filtering

Back 731

Answer: C

Front 732

QUESTION NO: 732
Which of the following can prevent malicious software applications from being introduced while
browsing the Internet?
A. Pop-up blockers
B. Anti-spyware scanners
C. Input validation
D. Strong authentication

Back 732

Answer: A

Front 733

QUESTION NO: 733
Which of the following are reasons to implement virtualization technology? (Select TWO).
A. To reduce recovery time in the event of application failure
B. To decrease false positives on the NIDS
C. To eliminate virtual redundancy
D. To decrease access to security resources
E. To provide a secure virtual environment for testing

Back 733

Answer: A,E

Front 734

QUESTION NO: 734
Network security administrators should implement which of the following to ensure system abuse
by administrators does not go undetected in the logs?
A. Acceptable use policy
B. Separation of duties
C. Implicit deny
D. Least privilege

Back 734

Answer: B

Front 735

QUESTION NO: 735
After completing a risk assessment and penetration test against a network, a security
administrator recommends the network owner take actions to prevent future security incidents.
Which of the following describes this type of action?
A. Risk acceptance
B. Risk avoidance
C. Risk mitigation
D. Risk transference

Back 735

Answer: C

Front 736

QUESTION NO: 736
Public key infrastructure uses which of the following combinations of cryptographic items?
A. One time keys, WEP and symmetric cryptography
B. Private keys, public keys and asymmetric cryptography
C. Private keys, public keys and ECC-based keys
D. Public keys, symmetric keys and ECC-based keys

Back 736

Answer: B

Front 737

QUESTION NO: 737
An administrator wants to implement a procedure to control inbound and outbound traffic on a
network segment. Which of the following would achieve this goal?
A. NIDS
B. HIDS
C. ACL
D. Proxy

Back 737

Answer: C

Front 738

QUESTION NO: 738
In PKI, the CA is responsible for which of the following?
A. Maintaining the CRL
B. Maintaining the cipher block chain
C. Maintaining all private keys
D. Maintaining the browsers PKI store

Back 738

Answer: A

Front 739

QUESTION NO: 739
In PKI, which of the following entities is responsible for publishing the CRL?
A. CA
B. ACL
C. Recovery agent
D. User

Back 739

Answer: A

Front 740

QUESTION NO: 740
Which of the following is a security risk associated with USB drives?
A. Easy to conceal and detect
B. Large storage capacity and high visibility
C. Small storage capacity and low visibility
D. Easy to conceal and large storage capacity

Back 740

Answer: D

Front 741

QUESTION NO: 741
Which of the following is a security risk associated with introducing cellular telephones with mobile
OS installed on a closed network?
A. New vector to introduce viruses and malware to the network
B. War-dialing DoS attacks against the network
C. War-driving DDoS attacks against the network
D. New vector to introduce VoIP to the network

Back 741

Answer: A

Front 742

QUESTION NO: 742
The availability of portable external storage such as USB hard drives has increased which of the
following threats to networks?
A. Introduction of material on to the network
B. Introduction of rogue wireless access points
C. Removal of sensitive and PII data
D. Increased loss business data

Back 742

Answer: C

Front 743

QUESTION NO: 743
An administrator finds a device attached between the USB port on a host and the attached USB
keyboarD. The administrator has also noticed large documents being transmitted from the host to
a host on an external network. The device is MOST likely which of the following?
A. External USB drive
B. In-line keystroke logger
C. In-line network analyzer
D. USB external hub

Back 743

Answer: B

Front 744

QUESTION NO: 744
A user is receiving an error which they have not seen before when opening an application. Which
of the following is MOST likely the cause of the problem?
A. A patch was pushed out.
B. A signature update was completed on the NIPS.
C. The NIDS baseline has been updateD.
D. The HIDS baseline has been updateD.

Back 744

Answer: A

Front 745

QUESTION NO: 745
Which of the following is used to encrypt email and create digital signatures?
A. LDAP
B. HTTPS
C. S/MIME
D. RSA

Back 745

Answer: C

Front 746

QUESTION NO: 746
Which of the following can be used to encrypt FTP or telnet credentials over the wire?
A. SSH
B. HTTPS
C. SHTTP
D. S/MIME

Back 746

Answer: A

Front 747

QUESTION NO: 747
Which of the following is a vulnerability assessment tool?
A. John the Ripper
B. Cain & Abel
C. AirSnort
D. Nessus

Back 747

Answer: D

Front 748

QUESTION NO: 748
Which of the following is a vulnerability scanner?
A. John the Ripper
B. Cain & Abel
C. Microsoft Baseline Security Analyzer
D. AirSnort

Back 748

Answer: C

Front 749

QUESTION NO: 749
Which of the following is a password cracking tool?
A. Nessus
B. AirSnort
C. John the Ripper
D. Wireshark

Back 749

Answer: C

Front 750

QUESTION NO: 750
Which of the following is a protocol analyzer?
A. John the Ripper
B. WireShark
C. Cain & Abel
D. Nessus

Back 750

Answer: B

Front 751

QUESTION NO: 751
Which of the following is a system setup to distract potential attackers?
A. VLAN
B. Firewall
C. Honeypot
D. DMZ

Back 751

Answer: C

Front 752

QUESTION NO: 752
Changing roles every couple of months as a security mitigation technique is an example of which
of the following?
A. Separation of duties
B. Mandatory vacations
C. Least privilege
D. Job rotation

Back 752

Answer: D

Front 753

QUESTION NO: 753
Which of the following should be checked if an email server is forwarding emails for another
domain?
A. DNS zone transfers
B. SMTP open relay
C. Cookies
D. ActiveX controls

Back 753

Answer: B

Front 754

QUESTION NO: 754
Which of the following will allow the running of a system integrity verifier on only a single host?
A. HIDS
B. NIDS
C. VLAN
D. NIPS

Back 754

Answer: A

Front 755

QUESTION NO: 755
Which of the following has the ability to find a rootkit?
A. Adware scanner
B. Malware scanner
C. Email scanner
D. Anti-spam scanner

Back 755

Answer: B

Front 756

QUESTION NO: 756
Which of the following will be prevented by setting a BIOS password?
A. Amachine becoming infected with a virus
B. Changing the system boot order
C. Replacing a video card on a machine
D. Amachine becoming infected with a botnet

Back 756

Answer: B

Front 757

QUESTION NO: 757
Which of the following is a security limitation of virtualization technology?
A. It increases false positives on the NIDS.
B. Patch management becomes more time consuming.
C. A compromise of one instance will immediately compromise all instances.
D. If an attack occurs, it could potentially disrupt multiple servers.

Back 757

Answer: D

Front 758

QUESTION NO: 758
Which of the following must be used to setup a DMZ?
A. Proxy
B. NIDS
C. Honeypot
D. Router

Back 758

Answer: D

Front 759

QUESTION NO: 759
Which of the following would be used to push out additional security hotfixes?
A. Patch management
B. Configuration baseline
C. Cookies
D. Local security policy

Back 759

Answer: A

Front 760

QUESTION NO: 760
Which of the following would be used to allow a server to shut itself down normally upon a loss of
power?
A. Backup generator
B. Redundant ISP
C. Redundant power supply
D. Uninterruptible Power Supply (UPS)

Back 760

Answer: D

Front 761

QUESTION NO: 761
Which of the following is the BEST security measure to use when implementing access control?
A. Password complexity requirements
B. Time of day restrictions
C. Changing default passwords
D. Disabling SSID broadcast

Back 761

Answer: A

Front 762

QUESTION NO: 762
Applying a service pack could affect the baseline of which of the following?
A. Honeynet
B. Heuristic-based NIDS
C. Signature-based NIDS
D. Signature-based NIPS

Back 762

Answer: B

Front 763

QUESTION NO: 763
Which of the following is the strongest encryption form that can be used in all countries?
A. WPA2
B. TKIP
C. WEP
D. WPA

Back 763

Answer: C

Front 764

QUESTION NO: 764
When would it be appropriate to use time of day restrictions on an account?
A. In order to ensure false positives are not received during baseline testing
B. To ensure the DMZ is not overloaded during server maintenance
C. To eliminate attack attempts of the network during peak hours
D. As an added security measure if employees work set schedules

Back 764

Answer: D

Front 765

QUESTION NO: 765
Which of the following could be used to restore a private key in the event of a CA server crashing?
A. Trust model verification
B. Key escrow
C. CRL
D. Recovery agent

Back 765

Answer: D

Front 766

QUESTION NO: 766
Which of the following is a possible security risk associated with USB devices?
A. Domain kiting
B. Cross-site scripting
C. Input validation
D. Bluesnarfing

Back 766

Answer: D

Front 767

QUESTION NO: 767
Which of the following is MOST effective in preventing adware?
A. Firewall
B. HIDS
C. Antivirus
D. Pop-up blocker

Back 767

Answer: D

Front 768

QUESTION NO: 768
Which of the following is the MOST important when implementing heuristic-based NIPS?
A. Perform comprehensive heuristic-based analysis on the system.
B. Enable automatic updates to the heuristic databasE.
C. Ensure the network is secure when baseline is establisheD.
D. The brand of NIPS that is being useD.

Back 768

Answer: C

Front 769

QUESTION NO: 769
Which of the following attacks enabling logging for DNS aids?
A. Virus infections
B. SQL injection
C. Local hosts file corruption
D. Botnet attacks

Back 769

Answer: D