Security +

Front 1

Which of the following is BEST utilized to identify common misconfigurations throughout the enterprise?

Back 1

vulnerability scanning

Front 2

Which of the following tests a number of security controls in the least invasive manner?

Back 2

vulnerability scan

Front 3

A software development company has hired a programmer to develop a plug-in module to an existing proprietary application. After completing the module, the developer needs to test the entire application to ensure that the module did not introduce new vulnerabilities. Which of the following is the developer performing when testing the application?

Back 3

gray box testing

Front 4

Which of the following would be used to identify the security posture of a network without actually exploiting any weaknesses?

Back 4

vulnerability scan

Front 5

A security administrator is aware that a portion of the company’s Internet-facing network tends to be non-secure due to poorly configured and patched systems. The business owner has accepted the risk of those systems being compromised, but the administrator wants to determine the degree to which those systems can be used to gain access to the company intranet. Which of the following should the administrator perform?

Back 5

penetration test

Front 6

A quality assurance analyst is reviewing a new software product for security, and has complete access to the code and data structures used by the developers. This is an example of which of the following types of testing?

Back 6

white box

Front 7

Matt, the Chief Information Security Officer (CISO), tells the network administrator that a security company has been hired to perform a penetration test against his network. The security company asks Matt which type of testing would be most beneficial for him. Which of the following BEST describes what the security company might do during a black box test?

Back 7

The security company is provided with no information about the corporate network or physical locations.

Front 8

The security consultant is assigned to test a client’s new software for security, after logs show targeted attacks from the Internet. To determine the weaknesses, the consultant has no access to the application program interfaces, code, or data structures. This is an example of which of the following types of testing?

Back 8

black box

Front 9

Which of the following should an administrator implement to research current attack methodologies?

Back 9

honeypot

Front 10

A process in which the functionality of an application is tested without any knowledge of the internal mechanisms of the application is known as:

Back 10

black box testing

Front 11

Sara, the Chief Information Officer (CIO), has requested an audit take place to determine what services and operating systems are running on the corporate network. Which of the following should be used to complete this task?

Back 11

port scan and fingerprinting

Front 12

After analyzing and correlating activity from multiple sensors, the security administrator has determined that a group of very well organized individuals from an enemy country is responsible for various attempts to breach the company network, through the use of very sophisticated and targeted attacks. Which of the following is this an example of?

Back 12

advanced persisten threat

Front 13

Which of the following preventative controls would be appropriate for responding to a directive to reduce the attack surface of a specific host?

Back 13

disabling unnecessary services

Front 14

Which of the following tools would allow Ann, the security administrator, to be able to BEST quantify all traffic on her network?

Back 14

protocol analyzer

Front 15

Which of the following BEST represents the goal of a vulnerability assessment?

Back 15

to determine the systems security posture