-Security+ Sy-401: Application, Data & Host Security

Front 1

What is the best way to remove a boot sector virus

Back 1

Start the computer from a bootable antivirus disk. This bypasses the infected boot sector on the hard drive.

Front 2

What is a companion virus?

Back 2

One that disguises itself as a more legitimate program with the same name, but using a different extension, for example, using a .com instead of .exe extension.

Front 3

What is a file infector virus, and what precaution should be taken?

Back 3

They infect executable files. Do not connect them to the network, as they can replicate to other systems and network files.

Front 4

What is an additional risk of macro viruses?

Back 4

They can infect document templates, replicating the virus with each new document created with that template.

Front 5

What kind of virus changes itself with each new replication to avoid detection?

Back 5

Polymorphic viruses

Front 6

What is metamorphic malware

Back 6

Can actually change the virus code (payload), not simply the appearance of the file.

Front 7

What is the optimum fix for a rootkit?

Back 7

They are difficult to remove via software and the best fix is to wipe and reinstall the OS.

Front 8

What is used to ensure a minimum acceptable level of security is being complied with?

Back 8

Security baselines

Front 9

removing unessesary services from a system is part of ______

Back 9

OS hardening

Front 10

Linux filesystems should be of what type for optimum security purposes?

Back 10

ext3 or later

Front 11

what can an admisistrator do to defend against unauthorized user downloaded software or malware communicating out to the internet?

Back 11

block the ports that some of thes eapplications use at the main firewall.

Front 12

What is the recomended policy for web browser security settings?

Back 12

Start with a strong security mode and then add exceptions as needed. Do NOT start with a weak security mode intending to strenghten.

Front 13

What an be done to allow cookies to funtion but still enhance seurity?

Back 13

Block third party cookies which are usually coming from third pary sites

Front 14

What monitors an individual system for suspicious activity?

Back 14

A Host based Intrusion Detection System (HIDS) they are typically used in critical server systems.

Front 15

What kind of intrusion detection system monitors and sends alerts?

Back 15

Passive. To take steps to shut down access requires an active detection system.

Front 16

What are several benefits of virtualizaton?

Back 16

Elasticity, the ability to divide up resources upon demand.
Snapshots can allow an administrator to roll back the system configuration.
Sandboxing, which separates and insulates the underlying machine layer from the software.

Front 17

What encryption method is typically used for on the fly file system encryption/decryption?

Back 17

AES 128 or 256 bit.

Front 18

What can protect a network from trojan horse activity trying to utilize back door access?

Back 18

A host based firewall can block incoming connections and monitor outbound activity.

Front 19

What should be done after installing antivirus software?

Back 19

Update the virus definition files. These are frequently updated and the files that ship with the software could already be out of date.

Front 20

What makes javascript a security issue?

Back 20

Executable content embedded in web pages and the issues of the browsers that implement them.

Front 21

What is a security flaw of active X controls?

Back 21

ActiveX components are downloaded and run with the same pemissions as the logged in user.

Front 22

What provides some measure of security when running activeX controls?

Back 22

A valid activeX control will have a signed and verifiable certifcate. do not use the lowest level of browser security,as this will allow all activeX controls to be run with no user alerts given.

Front 23

What is done to protect against header manipulation?

Back 23

Most web applications will process server side headers only which areusually safe and cannot be manipulated, but not client side headers, due to security concerns

Front 24

What are some security flaws of FTP?

Back 24

All data and credentials are sent in clear text and FTP servers often have an anonymous login account installed by default. SFTP should be used instead, and the anonymous account should bedisabled.

Front 25

What is cache poisoning?

Back 25

False DNS records are planted with spoofed IP adresses, resulting in users being directed to a hackers website instead.

Front 26

What is a risk in DNS zone transfers?

Back 26

An unauthorized zone transfer could result in a hacker gaining access to DNS records including adresses of critical servers and other equipment. Zone tranfers should be restricted to trusted DNS servers under your control.

Front 27

What is the main vulnerbility of DHCP?

Back 27

Lack of any authentication mechanism to allow or disallow clients connecting.

Front 28

What is a DOS attack that can be done against DHCP?

Back 28

using up all the available adresses in a DHCP servers address pool which will prevent any other clients from connecting.

Front 29

What kind of attack inputs commands into the input fields of a database application?

Back 29

SQL injection. These commands are then run against the database, providing escalated priviledges. Authenitication and access permissions should be configured.

Front 30

What is an attack that can be done against a directory service?

Back 30

LDAP injection inserts code into a user request. Input should be validated by the application.

Front 31

What should be done to prevent an SMTP server from forwarding spam or malware containing mail?

Back 31

It should be set to only forward authenticated emails from within it's own domain.

Front 32

What is escaping?

Back 32

A secure coding technique that recongizes command characters and and converts them to simple data before they are processed.

Front 33

What is a risk of transitive access?

Back 33

That mutual trust relationships will pass through more than one software component, and provide access to a third party. This is pass through transitive access and should not be allowed when creating applications.

Front 34

What are the advantages and disadvantages of server side validation?

Back 34

Advantages are it is more compatible with a variety of clients and it is considered more secure, as it does not show it's code to the client. Disadvantage is that is is much slower to validate input than if the validation is done at the client.

Front 35

what is the concept of usind security and content control to keep private data from leaving an organization?

Back 35

DLP Data Loss Prevention

Front 36

What is NOT included in Whole Disk Encryption?

Back 36

Boot volume or MBR (Master Boot Record)

Front 37

NESSUS

Back 37

A vulnerability scanner