Security +

Question 1

-Social engineering/spoofing
-done by email, text etc, URL
-can spot by spelling, fonts, graphics

Vishing
Phishing
Impersonation
Spear fishing

Answer 1

Phishing

Question 2

Ñame 2 types of typosquatting

Answer 2

URL hijacking- https://professor messier.com instead of messer

Prepending- https://pprofessor messer.com

Guy squatting with a gun held up to someone to change a URL

Question 3

“Hi we’re calling from Visa about an auto payment and need your credentials” is an example of what?”

Pretexting
Phishing
Impersonation
Spear phishing

Answer 3

Pretexting, lying to get info

Wolf of Wall Street him teaching script scene

Question 4

Redirect a legit website to a bogus site, poisoned dns server or client vulnerabilities

Answer 4

Pharming

Question 5

Phishing is harvesting large groups of people

Answer 5

False, pharming
Phishing collects access credentials

Question 6

Anti malware is great for detecting pharming

Answer 6

False, everything appears legit to the user

Question 7

Type of phishing: Caller ID spoofing, fake security or bank updates, done over phone

Answer 7

Vishing

Fish on phone with fingers in v shape

Question 8

Type of phishing done by text, spoofing and forwards links to ask for personal information

Answer 8

Smishing

“Yeah we smushed”

Question 9

Gather information on a victim, digital footprint. Understands security posture and focuses on key systems

Answer 9

Reconnaissance

A renaissance knight with a scroll asking people questions

Question 10

An attacker builds this through social media, where you work, your bank, family/friends

Answer 10

Pretext

Question 11

Targeted phishing with inside information that includes whaling

Answer 11

Spear phishing

Question 12

Never click a link in an email, type it out to see if it is legit

Answer 12

True

Question 13

Attacker pretending to be someone, using details from reconnaissance, May pretend to be higher rank, May try to throw technical details or act like a buddy

Answer 13

Impersonation

When Donny Burger gives you a fake name you go with it!

Question 14

Seen with vishing
Victims don’t realize it is happening (hacking the human) Getting info from victim

Pretexting
Impersonation
Spoofing
Eliciting information

Answer 14

Eliciting information

An e ice cream cone that each time you press to lick, a new fact about you is presented

Question 15

Identity being used by someone not you. Includes: credit card, bank, lone and govt benefits fraud

Impersonation
Social engineering
Identity fraud
Pharming

Answer 15

Identity fraud

Question 16

Important information thrown out with the trash that can be gathered for an attack and is typically done at the end of the month

Answer 16

Dumpster diving

Question 17

Control I put by being aware of your surroundings, use privacy filters, keeping monitors away from windows and hallways are ways to prevent this

Answer 17

Shoulder surfing

Question 18

Blacks a screen unless you are sitting directly in front of a monitor

Answer 18

Privacy filter

Question 19

A threat that doesn’t actually exist, often through email and is attempting to get money but not through an electric means. Not a virus but can waste almost as much time

Computer hoax
Spoofing
Pharming
Dumpster diving

Answer 19

Computer Hoax

Stephen a bamboozled, run a muck

Question 20

Consider source, cross reference, spam filters and if it sounds too good to be true are ways to what?

De-hoaxing
Eliciting information
Adware
Rdns

Answer 20

De-hoaxing

Detective Hoch

Question 21

Determines which website the victim group to uses by infecting third party sites with site vulnerability/email attachments to infect all visitors who go to that site and gain access to your network

Answer 21

Watering hole attack

Ex. Infecting a site you know people visit so every time they visit then malicious JavaScript files are downloaded to your computer

Question 22

Defense in depth, firewalls and IPS, antivirus/anti malware signature updates are best methods to prevent what kind of attack?

Spraying
Watering hole
Man in the middle
Crypto malware

Answer 22

Watering hole attack

Question 23

Unsolicited messages by emails, forums etc by phishing attempts

Answer 23

Spam
Over IM is SPIM

Question 24

Used to identify spam,only receives email from trustee sender and SMTP blocks anything that doesn’t follow RFC standards

Allowed list
Recipient filtering
ACL
rDNS

Answer 24

Allowed list

Question 25

Used to identify spam, block email where the sender’s domain doesn’t match the ip address

Answer 25

rDNS, reverse DNS

Question 26

Tarpitting blocks all email not addressed to a valid recipient email address Used to identify spam,

Answer 26

False, intentionally slow down the server conversation Recipient filtering will block all email not addressed to a valid recipient email address

Question 27

An unsolicited email is stopped here and can be either onsite or cloud based

Answer 27

Mail gateway

Question 28

Swaying public opinion on political and social issues, enabled through social media to amplify, used to divide and includes advertising Hacking the human Cyber warfare Hybrid warfare Hacking public opinion

Answer 28

Hacking public opinion Ex. Creating fake users to post about things until real users voice sane opinion and goes viral

Question 29

Attack an entity with tech, influencing foreign elections, fake news Hacking public opinion Hybrid warfare Social engineering Cyber warfare

Answer 29

Cyber warfare

Question 30

Militaries trying to influence people with the internet in order to have elected officials benefit them Cyber warfare Hybrid warfare Social engineering Hacking the human

Answer 30

Hybrid warfare

Question 31

Tailgating

Answer 31

Using an authorized person to gain unauthorized access to a building.

Question 32

Prevent this with policy for visitors, one scan per person, and man traps

Answer 32

Tailgating

Question 33

Attacker sends a fake invoice to who pays the bills for a company

Answer 33

Invoice scam

Question 34

Attacker collecting login password through your computer on web browsers, windows cred manager Theharvester Password file Credential harvesting Collisions

Answer 34

Credential harvesting

Question 35

Name 4 social engineering principles

Answer 35

Authority Intimidation Consensus Scarcity Urgency Familiarity Trust

Question 36

Social engineering principle that convinces based on what’s normally expected, “your co worker Jill did this last week for me” is familiarity/liking

Answer 36

False, Consensus/social proof

Question 37

Social engineering principle, someone you know, we have common friends is Familiarity/liking

Answer 37

True

Question 38

Social engineering May involve multiple organizations, may be in person or electronic

Answer 38

True

Question 39

Malicious software, gathers your information through keystrokes, can turn computer into a zombie, trick you through advertising and can download virus/worms to encrypt your data

Answer 39

Malware

Question 40

Name 4 types of malware

Answer 40

Virus Crypto malware Ransomware Worms Trojan horse Rootkit Keylogger Adware/spyware Botnet

Question 41

A worm takes advantage of a vulnerability, then installs malicious software that includes a remote access back door and later installs a bot is how you get what harmful thing to your computer?

Answer 41

Malware process

Question 42

Don’t click email links or web page pop ups Keep OS up to date Check applications publisher Prevents what? Malware Persistent XSS attack Non Persistent XSS attack Botnets

Answer 42

Malware

Question 43

Malware that can reproduce itself through file systems or the network after you execute a program, can be invisible and spread from just running a program

Answer 43

Virus

Question 44

This needs its signature file updated

Answer 44

Anti-virus

Question 45

Program virus is OS and browser based

Answer 45

False, script virus Program virus is part of the application

Question 46

Common virus in Microsoft office is boot sector virus

Answer 46

False, macro virus Boot sector is in your storage

Question 47

What kind of virus infection process is this: 1. User clicks on malicious website link 2. Website exploits flash/Java/windows vulnerability 3. Launches power shell, downloads payload in RAM 4. Runs PS scripts, executables in memory, exfiltrates data, damage files 5. Adds an auto start to registry Server side forgery request Session hijacking Fileless virus Watering hole attack

Answer 47

Fileless virus

Question 48

Malware that self replicated, you don’t have to do anything, self propagates and spreads quickly

Answer 48

Worms

Question 49

Firewalls and IDS/IPS can get rid of worms

Answer 49

False, they can mitigate/prevent but can’t do much once the work is inside

Question 50

This virus avoids anti virus detection by not downloading to a file, it operates in memory but is never installed in a file or application

Answer 50

Fileless virus

Question 51

Attackers locking you out of your laptop and will let you back in if you pay

Answer 51

Ransomware

Question 52

Malware encrypts your data files and you must pay attacker to get decryption key, untraceable payment system

Answer 52

Crypto malware

Question 53

Have an offline backup Keep os/applications up to date by patching vulnerabilities and additional security Keep anti malware and antivirus signature up to date Prevent what attack? Ransomware Crypto malware Rootkit Botnets

Answer 53

Ransomware

Question 54

Trojan horse

Answer 54

Software pretending to be something else to take over your computer

Question 55

PUP (potentially Unwanted program)

Answer 55

This is identified by antivirus which shows potentially undesirable software and often installed with other software. Overly aggressive tool bar, back up utility that displays ads, browser search engine hijacker

Question 56

Placed on computer through malware to avoid going through rigorous process. Other malware can get through this also. Some software even comes with this

Answer 56

Back door

Question 57

Ultimate back door for administrative control of a device. Malware installs the server/service/host and connects with client software. Control a device with key logging, screen record, copy files, more malware embedded

Answer 57

RAT (Remote Access Control)

Question 58

Don’t run unknown software Keep anti virus signature up to date Always have a back up Prevents against what? Watering hole attack Session hijacking RAT and Trojan Crypto ware

Answer 58

RAT and Trojan

Question 59

Modifies core system files, can’t see in task manager/os/antivirus, takes over control of administrator functions

Answer 59

Rootkit

Question 60

This rootkit malware is famous for cleaning out bank accounts combined with

Answer 60

Rootkit types, Zeus/zbot Necurs (kernel level driver) to not be able to delete zbot and have total control

Question 61

Anti malware scans, use a remover specifically for this, secure boot for security in bios finds and removes what? RAM Rootkit Storage RAT

Answer 61

Rootkit

Question 62

Computer is full of pop ups that cause performance issues. Can be installed accidentally but you need to be carful of software that claims it removes this Pup Crypto malware Adware Machine learning

Answer 62

Adware

Question 63

Malware that monitors you and your surfing habits. Can capture keystrokes or trick you into installing fake security software Adware Key logger Malware Spyware

Answer 63

Spyware

Question 64

Money for What you see, your computer time and bandwidth, and your bank account are reasons for these attacks

Answer 64

Adware and spyware

Question 65

Maintain anti virus signature Always know what you are installing Having a backup Run scans (malware bytes) Protect against what? Fileless virus adware/spyware Rootkit Watering hole attack

Answer 65

Adware/spyware

Question 66

A system admin has determined that a spoofed email originated in another country. Which of the following most likely provided this information? Netflow Syslog Metadata IPPFIX SFlow

Answer 66

Metadata - data that describes other data sources

Question 67

HSM, DLP, jump server, Collector •access protected network from external connection •backup and manage certificates for all company web servers •gather stats for long term network monitoring •block network traffic with private info

Answer 67

•Jump server- access protected network from external connection •HSM- backup and manage certificates for all company web servers •Collector- gather stats for long term network monitoring •DLP-block network traffic with private info

Question 68

Which describes best the time required to fix an issue during an outage? RTO MTTR EULA MTBF RPO

Answer 68

MTTR

Question 69

Which would best transfer data to a siem? IPSec Syslog HTTPS Ssh SFTP

Answer 69

Syslog

Question 70

Which of the following is best way to direct individuals through a specific area? Motion detection CCTV Bollard Protected distribution Industrial camouflage

Answer 70

Bollard- prevent access

Question 71

Which would provide management of both mobile and non mobile devices? MDM MAM SNMP UEM HSM

Answer 71

UEM Unified endpoint management Evolution of MDM

Question 72

Server admin at bank notices a decrease in number of visitors to its website. Research shows users being directed to a different ip address than the banks server. What attack is this? Disassociation DDOS Buffer Overflow DNS poisoning

Answer 72

Dns poisoning

Question 73

Group of Infected computers that relay spam, proxy network traffic and computing tasks. Botnets can be rented is what kind of attack?

Answer 73

DDOS

Question 74

Prevent initial infection with os/application patches, Update anti malware signature, identify infection with on demand scans/network monitoring Are ways to stop what? Man in the middle Botnets XSS attack SQL injection

Answer 74

Botnets

Question 75

Block at firewall, identify at workstation with a host based firewall of host based IPS to prevent what?

Answer 75

Command and control (C&C)

Question 76

Waits for a predefined event. Time/date or a used event will trigger this. Difficult to identify and disappear after it is done

Answer 76

Logic bomb

Question 77

Have Formal change control to identify when a procedure is not followed, use electronic monitoring with alert for changes and HID’s, constant auditing with an admin authorizing and circumventing existing systems prevents what attack? Adware RAT Fileless Virus Logic bomb

Answer 77

Preventing a logic bomb Difficult to recognize and each is unique with no predefined signatures.

Question 78

If you store a password here anyone with access to the password file or database has every credential

Answer 78

Plain text Book covering up because it’s naked

Question 79

Represent Data as a fixed length string of text with different inputs for different passwords, impossible to recover original message from digest, common way to store passwords

Answer 79

Hashing a password

Question 80

Different across operating systems and applications, different hash algorithms Rainbow dictionary Brute force hashing Password file Salting

Answer 80

Password file

Question 81

Attack an account with 3 or more common passwords and if it doesn’t work then move on to the next account in order to not be locked out is what attack?

Answer 81

Spraying attack

Question 82

Obtain a list of users and hashes then calculate password has and compare to a stored hash. Large computational resource requirement is what attack? Pass the hash Brute force the hash Rainbow table Replay attack

Answer 82

Brute force the hash

Question 83

Rainbow tables

Answer 83

Pre built set of hashes

Question 84

Random data added to a password when hashing. Each user gets their own and rainbow tables won’t work against this. Each user gets a different random hash

Answer 84

Salting

Question 85

Has additional electronics inside and your OS identified it as Human Interface Device like a keyboard/mouse and once connected it downloads and installs malicious software is a malicious flash drive

Answer 85

False, malicious USB Malicious flash drive acts like a HID and loads malware in documents/pdf’s, infect computer after a reboot or act as an Ethernet adapter to act as a wireless gateway or redirect internet traffic

Question 86

Stealing credit card information during a normal transaction by copying credit card or with a small camera is

Answer 86

skimming

Question 87

Card cloning

Answer 87

Get card details from skimmer, create a duplicate with same magnetic strip (chip can’t clone) Cloned gift cards are common

Question 88

Computers identify patterns in data, face recognition for analyzing, use it to stop spam, recommend products Evasion attack RDNS API attack Machine learning

Answer 88

Machine learning

Question 89

Attackers send modified training data that causes AI to behave incorrectly Poisoning training data Machine learning Evasión attack Rdns

Answer 89

Poisoning training data

Question 90

AI is only as good as the training, AI can be fooled, can release real world confidential information Evasión attacks Machine learning Cryptographic attack Adware

Answer 90

Evasión attacks

Question 91

cross check and verify training data, retrain with new/better data, train AI with possible poisoning to secure what? Learning algorithms AI Hacking the human Hybrid warfare

Answer 91

Learning algorithms

Question 92

contains many moving parts and attackers can infect different parts without supervision. One exploit can affect this Supply chain Cryptographic attacks Botnets DDOS

Answer 92

Supply chain

Question 93

Can you trust server/router/firewall/software, use small supplier base for tighter control of vendor, strict controls over policies and procedures, security implemented in overall designs is security for what? Logic bomb Supply chain Cryptographic attack Evasión attack

Answer 93

Supply chain

Question 94

Cloud based security puts security burden on the client with data center security and infrastructure costs

Answer 94

False, on premise security Cloud based is centralized and costs less with no dedicated hardware or data center but a 3rd party handles everything

Question 95

Customize your security posture with full control in house, on-site local IT security team, this team maintains uptime and availability with system checks, security changes for this takes time is what type of security?

Answer 95

On premise security

Question 96

Data in a secure environment but 3rd party May have access to it, manage large scale security with auto signature and security updates, limited downtime with fault tolerance, scalable security options

Answer 96

Security in the cloud

Question 97

Many shortcomings for this attack and the main issue attackers go after is the implementation. Attacker looking for the key is what?

Answer 97

Cryptographic attacks

Question 98

Same hash value for 2 different plaintext’s. Find a collision through brute force. Attacker generates multiple versions of plaintext to match hashes Persistent XSS attack Birthday attack Brute force hashing Botnets

Answer 98

Birthday attack Protect yourself with large hash output Kelbys plain “happy birthday” text to me

Question 99

Collisions

Answer 99

Hash digests are supposed to be unique, different input data should never create same hash

Question 100

Force a system to downgrade their security is what attack

Answer 100

Downgrade attack

Question 101

Gain higher level access to a system through a bug or exploiting vulnerability, need to get these holes closed up quickly, Eliciting information Privilege escalation Worm Rootkit

Answer 101

Privilege escalation Horizontal privilege escalation- user a can use user b resources

Question 102

Patch quickly, update antivirus/block known vulnerabilities, data execution prevention with only data in executable areas, address space layout randomize to prevent a buffer overrun at known memory address mitigates what? LDAP injection Collisions Code injection Privilege escalation

Answer 102

Privilege escalation

Question 103

Browser security flaws with information from one site shared to another, common web application develop errors and takes advantage of the trust a user has for a site, malware that uses JavaScript Server side request forgery XSS attack Watering hole attack DLL injection

Answer 103

Cross site scripting/XSS Bad person puts bad code into a website and when you visit it bad things happen to your computer. Like a diary for friends that someone writes mean things in

Question 104

Website allows scripts to run in user input like a search box, attacker emails link that takes advantage of vulnerability and runs a script that sends credentials to attacker,script embedded in url in victim’s browser, attacker uses credentials to steal victim’s information

Answer 104

Non persistent (reflected) XSS attack A sneaky person tricks a website to having something on the web page it shouldn’t when people visit. Like a mirror that shows cute animals but a fairy instead changes it to show toys

Question 105

Attacker posts a message to social network with malicious payload, everyone/all viewers gets payload, social networking this can spread quickly with everyone having it posted to page and can propagate further Botnets Non Persistent XSS attack Persistent XSS attack Session hijacking

Answer 105

Persistent (stored) XSS attack A notebook with a message that appears nice but when you open it is mean.

Question 106

Be careful with untrusted links, disable JS or control with an extension, keep browser applications updated to avoid vulnerabilities, validate input and don’t allow users to add their own scripts to an input field protects against what? Watering hole attack Server side forgery request XSS Birthday attack

Answer 106

Protecting against XSS Xz wow

Question 107

Adding your own information into a data stream, enabled from bad programming with the application should be able to handle input and output, user for many different data types

Answer 107

Code injection

Question 108

SQL injection

Answer 108

Most common relational database management system language, modifies these requests and application should not allow this

Question 109

XML injection

Answer 109

Set of rules for data transfer and storage, modifies these requests that a good application will validate SAN/NAS (acronyms for storage) Agreeing to XXX site rules

Question 110

Created by telephone companies and now used by everyone,modify these requests to manipulate application results

Answer 110

LDAP injection

Question 111

Windows library containing code and data and many applications can use this library, have an application run a program and run as part of the target process

Answer 111

DLL injection Dill pickle on the window, wieners on the glass Sneaky friend adds special tools to a programs room without program knowing and can change how the program works

Question 112

Overwriting of memory, spills into other memory areas, attackers look for openings so developers need to blind check, not simple and it takes time to avoid crashing/do what you want, should be repeatable so a system is compromised to gain access to a system or make an application do what they want Buffer overflows XML injection Memory leak Fileless virus

Answer 112

Buffer overflow A glass with too much milk spills, computer has place to store information but if too much a sneaky person can grab it outside of the cup when it spills

Question 113

Useful information sent over network, access to raw data through network tap/arp poisoning/malware on victim computer, replay data to appear as someone else, not on path attack or need work station is what type of attack?

Answer 113

Replay attack

Question 114

Avoid this with a salt to use a session ID with the password hash to create a unique authentication hash each time Server side forgery Cross site scripting Passing the hash Replay attack

Answer 114

Replay attack

Question 115

What is this a process for? 1. Client authenticate with username and hashed password 2. During authentication the attacker captures username and password hash 3. Attacker sends his own authentication request using the captured credentials

Answer 115

Pass the hash

Question 116

Information gathering through wire shark, exploits with cross scripting, modify headers and cookies with cookie managers is what? Cookies and session ID’s Cross site request Header manipulation Pass the hash

Answer 116

Header manipulation

Question 117

Encrypt end to end so they can’t see session ID, additional load on web server (https) force https, encrypt end to somewhere to avoid capture over local wireless network, still in clear and use personal vpn to prevent what attack? Server side request forgery Cross site scripting Session hijacking Replay attack

Answer 117

Prevent session hijacking

Question 118

Information stored on computer by browser and used for tracking personalization, only a risk if someone gets access to them, privacy risk, maintain multiple sessions

Answer 118

Browser cookies and session ID’s

Question 119

Process for what? 1. Victim authenticates to server 2. Server provides session ID to client 3. Attacker intercepts session ID and uses it to access the server with the victim’s credentials

Answer 119

Session hijacking

Question 120

Common and legit, html directs these from your browser, most unauthenticated requests

Answer 120

Cross site requests

Question 121

Website pages consist of code on each side of the Client and server

Answer 121

True

Question 122

server side performs requests from the client-html, PHP, transfer money from one account to another, post video on YouTube

Answer 122

True Client side renders page on screen, html/JavaScript

Question 123

One click attack/session riding takes advantage of trust web app has for user like browser and made with your co sent, significant web applications develop oversight with anti forgery or cryptographic tokens

Answer 123

Cross site forgery

Question 124

What is this the process for? 1. Attacker creates funds transfer request 2. Request is sent as a hyperlink to a user who may already be logged into the bank website 3. Visitor clicks link and unknowingly sends transfer request to bank website 4. Bank validates transfer and sends funds to attacker

Answer 124

Cross site request forgery

Question 125

Attacker finds vulnerable web application by sending requests to web server and it performs on behalf of attacker

Answer 125

Server side request forgery SSRF

Question 126

This is caused by bad programming, never trust user input, server should validate input and responses, rare but can be critical vulnerabilities Session hijacking Header manipulation Cross site scripture forgery Server side request forgery

Answer 126

Server side request forgery Waiting, not trusting your server with food

Question 127

What is this the process for 1. Attacker sends request that controls a web application 2. Web server sends request to another service such as cloud file storage 3. Cloud storage sends response to web server 4. Web server forwards response to attacker

Answer 127

Server side request forgery

Question 128

Antivirus is good at identifying known attacks by checking signature and blocking, although there are still ways to infect and hide is what term?

Answer 128

Malware hide and go seek

Question 129

Interaction between hardware and OS that trusted but security issues FaaS Azure Driver Hypervisor

Answer 129

Driver

Question 130

Shimming

Answer 130

Filling in space between 2 objects, windows has its own and is backwards compatible, malware authors write their own

Question 131

Refactoring

Answer 131

Metamorphic malware where it is a different program each time it’s downloaded, adds NOP instructions/loops pointless strings, can intelligent redesign itself by changing app flow Difficult to match with signature based detection

Question 132

Difficult to do but Combines on path attack with downgrade attack, sits in middle and modify victim and web server messages, victim sees nothing but browser is not encrypted

Answer 132

SSL stripping/HTTP downgrade Strips S from HTTPS

Question 133

Programming conundrum, time of check to time of use attack (TOCTOU) something happening between check and use

Answer 133

Race condition 2 trains trying to get to station at once. A computer having the same function happens at the same time and causing issues

Question 134

Unused memory not properly released, slowly grows in size, eventually uses all memory, system crashes

Answer 134

Memory leak

Question 135

Programming technique that references a portion of memory, application crash/debug/DoS

Answer 135

NULL pointer dereference

Question 136

Integer overflow

Answer 136

Large number into smaller sized space, shouldn’t be able to manipulate memory this way

Question 137

users shouldn’t be able to browse windows folder, won’t stop user from browsing past web sever root and takes advantage of badly written code, Read files from web server that are outside of website file directory

Answer 137

Directory traversal

Question 138

Messages should be just informational enough, network information/memory dump/stack traces/database dumps Improper error handling Improper header handling Birthday attack SSL stripping/HTTP downgrade

Answer 138

Improper error handling

Question 139

All input should be considered malicious, allowing invalid input can be devastating is what kind of handling?

Answer 139

Improper input handling

Question 140

Attackers look for vulnerabilities by exposing sensitive data/DoS/intercepted communication/privileged access

Answer 140

API attacks

Question 141

Special DoS only require a device and lie bandwidth, zip bomb Resource exhaustion Evasión attack Logic bomb DLL injection

Answer 141

Resource exhaustion

Question 142

Bluejacking is access to a blue tooth device and data, if you know file or picture or video you can download without authentication

Answer 142

False, Bluesnarfing Bluejacking is sending of unsolicited messages to another device

Question 143

802.11w

Answer 143

Protects against disassociation/de authentication attacks

Question 144

Prevent wireless communications with decrease the signal to noise ratio at receiving device, can be intentional or caused by microwave or lights Reactive jamming Code injection Replay attack Radio frequency jamming

Answer 144

Radio frequency jamming

Question 145

Constant random bits or frames sent at random times, needs to be close to do this, Nfc RFID Wireless jamming Jitter

Answer 145

Wireless jamming

Question 146

Only sending signals when the attacker sees someone is trying to communicate on the network DLL injection DDOS jamming Reactive jamming Computer hoax

Answer 146

Reactive jamming

Question 147

Fox hunting

Answer 147

Finding source of jamming signal

Question 148

Access badges/inventory/pet id that uses radio energy for bidirectional communication

Answer 148

RFID (radio frequency identification)

Question 149

Data capture through replay attack, spoof the reader, DOS signal jamming, decrypt communication is what attack? RFID attack Nfc attack Reactive jamming Radio frequency jamming

Answer 149

RFID attack Running the 800 in track (tracking and 800 is a lot)

Question 150

2 way wireless communication, used for payment systems and helps with blue tooth pairing, an access token/security card with short range encryption is what?

Answer 150

, NFC (near field communication)

Question 151

Remote capture, frequency jamming/DoS, replay/on path attack, loss of device are security concerns for what? NFC RFID DDOS rDns

Answer 151

Nfc

Question 152

Arbitrary, pseudo number used once that can’t be reasonably guessed for login process and helps to avoid a replay attack

Answer 152

Cryptographic nonce

Question 153

Type of nonce that randomizes encryption scheme, used in encryption ciphers, WEP and some SSL implementations Nonce Hash Salt Initialization vectors

Answer 153

Initialization Vectors

Question 154

Malware/Trojan does all the proxy work and the malware in your browser waits for you to login to your bank and other sites and steal your money/information is what kind of attack? Spyware On path browser attack RAT Logic bomb

Answer 154

On path browser attack

Question 155

Attacker sending traffic with different source MAC addresses to force out legit MAC addresses on the table. This makes the switch a hub that will repeat information to all devices connected to it

Answer 155

MAC flooding

Question 156

Acces to domain registration(determines dns names/ip addresses) to control traffic flows is what attack?

Answer 156

domain hijacking

Question 157

Internet tracking your security posture, if bad can cause email rejections and errors that appear when someone tries to go to the website that tell them the website is not safe to access Domain hijacking Domain reputation Domain registration SQL injection

Answer 157

Domain reputation

Question 158

Makes an application break or work harder, can be identified by anti virus, over use a cloud resource like cpu is what attack?

Answer 158

Application DoS

Question 159

Hardware and software for industrial equipment, electric grid goes, offline, plant shuts down etc RFID Operational tech DoS NFC DDOS

Answer 159

Operational tech DoS

Question 160

Shell Script is the Command line for windows system admins, extends command line functions, attacked through system admin/active domain admin/file share access

Answer 160

False, Windows powershell She’ll script is unix/Linux

Question 161

General purpose scripting language, popular, used for cloud orchestration for application instances, attacks happen in infrastructure of routers, servers, switches

Answer 161

Python

Question 162

Macros

Answer 162

Automatic functions with application or os, can create security vulnerabilities, all they need is the user to open the file

Question 163

Automatic processes within windows application, powerful programming language, run arbitrary code in document with CVE-2010-0815/MS10-031

Answer 163

Visual Basic for applications (VBA)

Question 164

Entity responsible for an event that has an impact on the safety of another entity

Answer 164

Threat actor or malicious actor

Question 165

An attacker in the network and undetected, constant attacks is an example of this

Answer 165

Advanced persistent threat 71 days in US

Question 166

Script kiddies

Answer 166

Runs premade scripts without Knowledge of what’s really happening

Question 167

When people at work use apps or software they’re not supposed to use Script kiddies Birthday attack Shadow IT Code injection

Answer 167

Shadow IT

Question 168

Method a computer hacker tries to get into a computer system or network, a lot of work goes into finding these vulnerabilities

Answer 168

Attack vector

Question 169

What type of attack vector do we lock data centers for, they try to modify OS, attack keylogger for passwords, transfer files or DoS?

Answer 169

Direct access

Question 170

This attack vector modifies access point config, rogue/evil twin Direct access Removable media Email Wireless

Answer 170

Wireless

Question 171

Biggest attack vector, phishing, social engineering Cloud Email Removable Wireless

Answer 171

Email

Question 172

This attack vector tampers with infrastructure or manufacturing process with malware Cloud Supply chain Social media Removable

Answer 172

Supply chain

Question 173

Which attack vector is publicly facing applications and services with security misconfiguration, brute force/orchestration/DoS attacks?

Answer 173

Cloud media Social media is fake friends, user profiling for information on you

Question 174

What attack vector gets around fire wall, has malicious software on usb flash, Data exfiltration and allows usb to act as keyboards?

Answer 174

Removable media

Question 175

Open source intelligence makes decisions to best prevent hackers and attackers

Answer 175

False, threat intelligence OSINT is publicly available through discussion groups/internet

Question 176

Threat intelligence services, compiled threat information, constant threat monitoring

Answer 176

Closed/proprietary intelligence Who’s line is it prop scene with Wayne Brady triple threat

Question 177

Public/private sharing center

Answer 177

Includes the CTA where members upload threat intelligence with scores on how severe, sharing of cyber threat information

Question 178

Intelligence industry standard for sharing threat data that includes STIX and TAXI

Answer 178

AIS, Automated indicator sharing

Question 179

describes cyber threat info, includes motivations/response information CIST NIST STIX TAXII

Answer 179

STIX TAXII securely shares STIX data

Question 180

Event that shows an intrusion, unusual amount of activity/file hash values change/uncommon login patterns

Answer 180

IOC

Question 181

Analyze large amounts of data to find suspicious patterns, identifies dns queries/location/traffic pattern behavior, early warning system, machine learning Dark web intelligence AIS Predictive analysis Threat map

Answer 181

Predictive analysis

Question 182

identifies attacks and trends and file/code repository shows what the hackers are building, see what code accidentally releases Threat map Sharing center AIS Code reuse

Answer 182

Threat map

Question 183

They know the product better than anyone and know the problems/vulnerabilities Threat research Vendor websites Local industry groups Vulnerability feeds

Answer 183

Vendor websites

Question 184

Vulnerability feeds, conferences, academic journals request for comments , local industry groups, threat feeds and social media are great for threat research

Answer 184

True

Question 185

These proactively look for threats by searching data and networks, look for what adversaries are doing

Answer 185

TTP (tactics, technique, and procedures)

Question 186

No Security, anyone can access, change or take anything from. Computer or a file or folder. Increasingly common with cloud storage Open permissions Zero day attack Unsecured root accounts Default settings

Answer 186

Open permissions

Question 187

When the Most powerful key for your computer system that allows you to control and make big changes is not locked. Can be by a MIs configuration Weak encryption Unsecured root account Open port Default settings

Answer 187

Unsecured root accounts

Question 188

Most common encryption issue AES 3DES SSL TLS

Answer 188

TLS

Question 189

Takes advantage of default configurations/IoT devices, cameras, routers, garage door openers etc Unsecured root account Weak encryption Mirái Botnet Insecure protocol

Answer 189

Mirai botnet

Question 190

Hardware and software from a 3rd party can contain malware

Answer 190

True

Question 191

For outsourced code development make sure the development systems should be isolated, test encryption and check for back doors

Answer 191

True

Question 192

Intelligence fusion

Answer 192

Overwhelming amount of data/types, split into security operation/security intelligence/threat response teams, fuse data together with diverse datasets

Question 193

Logs/sensors/intrusion detection/internet events, focus on predictive and user behavior analytics Threat hunting Intelligence fusion Fusing the data Cybersecurity maneuvers

Answer 193

Fusing the data

Question 194

Moving firewalls and is, firewall rule/block ip address, delete malicious software, automated maneuvers Fusing data Cybersecurity maneuvers Intelligence fusion Threat hunting

Answer 194

Cybersecurity maneuvers

Question 195

Threat hunting

Answer 195

Find attacker before they find you, intelligence data is reactive

Question 196

Minimally invasive, port scans, identify systems and devices, detects insider threats is what?

Answer 196

Vulnerability scanning

Question 197

gathers information and doesn’t try to exploit a vulnerability is what type of scan?

Answer 197

Non intrusive intrusive scan isTrying out a vulnerability to see if it works

Question 198

is not having password what kind of scan?

Answer 198

Non credentialed A credentialed scan is when a normal user emulates an insider attack Having a key to a house and non is looking at house from outside. Credentialed is more effective because you can see inside house

Question 199

Application scans are desktop/mobile scans

Answer 199

web application scans are for software on a web server

Question 200

This scans misconfigured firewalls, open ports, vulnerable devices Systems scan Application scan Web application scan Network scan

Answer 200

Network scan

Question 201

A vulnerability that is identified but doesn’t actually exist is a false negative

Answer 201

False, false positive False negative is a vulnerability exists but you didn’t detect it

Question 202

Includes data inputs for authentication attempts/vpn/firewall session logs/denied outbound traffic/network utilization and packet captures of network packets/critical alert/capturing everything is data for what?

Answer 202

Siem data

Question 203

detects insider threats/identify target attacks/catches what DLP and Siem systems might miss

Answer 203

user and entity behavior analytics (UEB) Sentiment analysis is public discourse correlated to real world behavior/hate you they hack you/social media as barometer

Question 204

Soar Security, orchestration, automation and response

Answer 204

Automate routine/tedious/time intensive activities

Question 205

Rules of engagement

Answer 205

Defines purpose, scope and penetration test parameters. Includes: IP address ranges, emergency contacts, handling sensitive information, in/out of scope devices

Question 206

Try to break into system, can cause DoS/data loss, buffer overflows/gain privilege escalation, password brute force, social engineering, injections Risk Soar Threat actor Exploiting vulnerabilities

Answer 206

Exploiting vulnerabilities

Question 207

Getting into network is difficult but inside of network is relatively unprotected Lateral movement Rules of engagement Pentest aftermath Threat actor

Answer 207

Lateral movement

Question 208

Initial exploitation, lateral movements, persistence (setting up a way to get back in with a back door, pivot is the process for what?

Answer 208

Pentesting

Question 209

Getting access to one system that allows you to get access to others Initialization vector Pivot Persistence Lateral movement

Answer 209

Pivot Friends ross

Question 210

Leave network in original state, remove binaries or temp files, remove back doors, delete user accounts created is what? Sandbox Pentest aftermath Quarantine Order of volatility

Answer 210

pentest aftermath

Question 211

Cat

Answer 211

On a Linux server, combine the contents of both files to a single document would be what command?

Question 212

Which provides a framework for better understanding techniques which may be used by a potential attacker? Mitre att&ck Cyber kill chain Osi Ieee Diamond model

Answer 212

Mitre att&ck

Question 213

Which is categorized as an operational security control? Security policy Firewall Hot site Warning sign Security guard

Answer 213

Security guard

Question 214

A network admin has identified a device sending a large amount of traffic to an external ip address. The computer is powered on, but the user is on vacation. Which is most like reason for this traffic? Botnet Logic bomb MAC spoofing Skimming

Answer 214

Botnet

Question 215

A package delivery receipt includes signature of receiving party. Which describes signature on receipt? Something you are Something you have Something you can do Something you are Something you know

Answer 215

Something you can do

Question 216

A user digitally signs all email messages sent to external recipients. Which of the following would be used to provide this functionality? SaaS IPSec Ldaps S/mime SRTP

Answer 216

S/mime

Question 217

Security engineer runs monthly vulnerability scan. Scan doesn’t list any vulnerabilities for windows servers, but a significant vulnerability was announced last week and no servers are patched yet. Which best describes? Exploit Credentialed Zero day attack False negative

Answer 217

False negative

Question 218

is monitoring packets on network through ping scans, port scans, os scans and looks at nmap. People are able to see reconnaissance

Answer 218

Active footprinting passive footprinting is utilizing open sources such as social media, Reddit, and corporate websites to learn information

Question 219

Red team is offensive attacking, blue team is defensive protecting security, purple team is red and blue collaborating and white team manages the interactions between red and blue teams

Answer 219

True

Question 220

These should be performed often, check against well documented baselines and if failed would require immediate correction

Answer 220

Integrity measurement check

Question 221

Standardized naming/numbering for cables and devices in your environment so everyone knows where equipment is located in data center/rack.

Answer 221

Standard naming conventions Ex for devices asset tag names/numbers, networks have port labeling, user account names

Question 222

Ip schema

Answer 222

Knowing what ip addresses are used at what locations. Ranges, subnets, hosts per subnet, reserved addresses

Question 223

Data is on a storage drive, network and in a CPU. It is protected by encryption and has different permissions for users

Answer 223

True

Question 224

Data that resides in a country is subject to the laws of that country Data masking Data in use Data at rest Data sovereignty

Answer 224

Data sovereignty

Question 225

Data masking

Answer 225

Hide some of original data with obfuscation, protects PII. Last 4 digits on a receipt for credit card but the rest not shown

Question 226

Original information is plain text, encrypted form is ciphertext

Answer 226

True data encryption

Question 227

changing one character of the input and many characters change of the output

Answer 227

diffusion, Confusion is the encrypted data is drastically different than the plain text

Question 228

Data at wha, encrypts entire data, applies permissions with ACL’s and authorized users and is on a storage device

Answer 228

Data at rest

Question 229

Data in use is data over network without much protection, includes network based protection, need to provide transport encryption like TLS or IPSec

Answer 229

False, data in transit Data in use is actively processing in memory. Data is always decrypted and attackers take straight from RAM

Question 230

Replace sensitive data with a non sensitive place holder. Storing a ssn number as a different number. Common with credit card

Answer 230

Tokenization

Question 231

IRM information rights management

Answer 231

Limits the scope of what someone can do with a document

Question 232

Examines everything going into and out of a device

Answer 232

Endpoint dlp

Question 233

Located between users and the internet , block custom defined data strings, prevent file transfers to cloud storage, block virus/malware

Answer 233

Cloud based dlp

Question 234

Data in Motion is on your network and data at rest is on your server

Answer 234

True

Question 235

Views information within encrypted data to see if anything malicious is in it. Has to be specially configured and done with your device trusting browser Tls inspection IPSec Dlp endpoint DLL injection

Answer 235

Tls inspection

Question 236

TLS encryption works if Browser checks a web servers certificate was signed by a trusted CA

Answer 236

True

Question 237

It's a special list of things that a computer or a program can do. Instead of going into the computer and telling it exactly what to do, you can use this just like you use the menu at a restaurant, to ask the computer to do specific tasks. This tells the computer how to do those tasks, and it gives you back the results, just like a waiter brings you the food you ordered from the menu.

Answer 237

API

Question 238

Authentication to legitimate users, authorization for users to have limited roles, and uses a WAF for security CPU Vulnerabilities Syslog API

Answer 238

API

Question 239

Multiple honey pots is called what?

Answer 239

honey net

Question 240

Bait for honeynet is called honeyfiles

Answer 240

True

Question 241

Trying to get machine to think malware is actually something good through machine learning so it won’t be able to identify it

Answer 241

Fake telemetry

Question 242

Dns that gives out incorrect ip addresses, attacker can redirect to malicious site, can also redirect malicious domains to being ip addresses which is good, can integrate with firewalls

Answer 242

Dns sinkhole

Question 243

You only handle development is software as a service

Answer 243

False, PaaS

Question 244

Broad description of cloud models, services delivered over the internet, IT function changed into service

Answer 244

Xaas anything as a service

Question 245

Handle aspects of tech for clients, can be cloud service provider, provides network connect management/disaster recovery/growth management, can focus on IT security

Answer 245

MSP managed service provider

Question 246

Latency with cloud too far away, limited bandwidth, difficult to protect data and requires internet connectivity are issues for which type of computing? Cloud Edge Fog Network

Answer 246

Cloud, massive data storage and instant computing power

Question 247

30 billion IoT devices, processes data locally/on the device, storage, no latency or network requirements, does not need cloud to process data is fog computing

Answer 247

False, Edge computing Fog is cloud + IoT to extend cloud

Question 248

What type of computing has no latency because data is local, no bandwidth requirements, minimizes security concerns, and provides long term analysis Cloud Fog Edge Network

Answer 248

Fog

Question 249

Applications run on a remote server, VDI/DaaS instead of physical devices, only local devices are KB/mouse/screen

Answer 249

Thin client, minimal OS on client but needs big network connectivity

Question 250

Runs many different OS on the same hardware, each app has its own OS

Answer 250

Virtualization

Question 251

Isolated process in a sandbox, apps can’t interact with each other, uses host kernel and secure separation between applications

Answer 251

Container

Question 252

One big application that does everything, contains all decision making process/code challenges

Answer 252

Monolithic

Question 253

API

Answer 253

is the glue for micro services, built in containment, outage containment and scalable

Question 254

Serverless architecture where apps split into individual functions, ran in a stateless computer container, managed by third party and May only run for 1 event

Answer 254

Function as a Service

Question 255

Transit gateway, pool of resources created in a public cloud, many are created, cloud router, on different subjects and connected through vpn Azure FaaS SIAM VPC

Answer 255

Virtual private cloud

Question 256

Azure

Answer 256

specifies which resources can be provisioned and amazon specifies resources/permitted actions-list users, allow api access from ip address range

Question 257

Service integration and management

Answer 257

Many different service providers (multi sourcing) integrates diverse providers

Question 258

Directly programmable, agile to make changes dynamically, centrally managed with open standards, no human intervention

Answer 258

Software defined networking, control and data plane

Question 259

Needs to see data to secure it, devices include: NGF/WAF/Siem, encapsulates data with VXLAN/TLS, monitor application traffic with real time traffic flow, can control traffic flow via api is what?

Answer 259

Software Defined Visibility

Question 260

I’m virtualization you have built too many servers/networks and firewalls, can’t tell which VM’s are for which apps

Answer 260

VM Sprawl

Question 261

VM escape protection

Answer 261

Breaking out of VM and interact with host operating system or hardware, huge exploit because control virtual network

Question 262

A sandbox is an isolated testing environment

Answer 262

True

Question 263

Dismantling and removing an application instance is de provisioning and provisioning is deploying an app (web server, database server etc)

Answer 263

True

Question 264

elasticity

Answer 264

increases or decreases available resources as the workload changes Scalability increases workload in a given infrastructure

Question 265

SQL databases with client sending detailed requests for data, limit client interactions is what? Stored procedures Memory management Code reuse Dead code

Answer 265

Stored procedures

Question 266

Cryptographic nonce is Taking perfectly readable code and turning it into nonsense. True or False

Answer 266

False, obfuscation

Question 267

Code reuse is when the results aren’t used anywhere else in the application

Answer 267

False, dead code Code reuse is using old code to build new applications, watch for security risks

Question 268

Helps protect against malicious users, attackers may not use your interface is what type of validation point? Input Server side Client side Version control

Answer 268

Server side, checks occur on server

Question 269

What Validation point has end user app make validation decisions, filter legit input from users, provide additional speed Input Server side Client side Version control

Answer 269

Client side, use both server and client but server is more important

Question 270

Extend functionality of a programming language

Answer 270

Third party libraries

Question 271

A windows 10 exploit affects all windows 10 users unless the computers are running different software/applications with uniques binaries. What is the name of this preventive measure

Answer 271

Software diversity

Question 272

Constantly written code that is merged into the central repository many times a day, need to document security baselines Continuous delivery Continuous deployment Continuous Integration Continuous scripting

Answer 272

CI

Question 273

Which Continuous is more automation, auto deploy to production, no manual checks

Answer 273

continuous deployment Continuous delivery automated testing and release processes, click button and deploy application

Question 274

All usernames and passwords of a organizations database, authentication requests reference this, Kerberos or ldap Attestation SMS Federation Directory services

Answer 274

Directory services

Question 275

Provide network access to others, partners/suppliers/customers etc, must establish trust

Answer 275

Federation

Question 276

Attestation

Answer 276

Prove that hardware is yours , remote has operational report to verification server

Question 277

This is authentication to a specialized app on mobile device

Answer 277

Push notification Login factor sent to phone with predefined phone number is SMS and

Question 278

True or false, Authentication apps are pseudo random token generators, physical or software token generators

Answer 278

True

Question 279

Secret key and time of day, key configured ahead of time with time stamp

Answer 279

Time based one time password algorithm

Question 280

HOTP one time password

Answer 280

Once a session with one login attempt, includes: HMAC algorithm (keyed hash) token based (hash different each time) hardware/software tokens

Question 281

You can authenticate with both phone calls giving you a code and smart cards and a static code such as a pin or a password/phrase

Answer 281

True

Question 282

False rejection rate is the likelihood that an unauthorized user will be accepted, not sensitive enough

Answer 282

False, false acceptance rate False rejection rate is likelihood that an authorized user will be rejected, too sensitive

Question 283

Defines overall accuracy of a biometric system, rate at which FAR and FRR are equal, adjust sensitivity to equalize both values is what?

Answer 283

True, Crossover Error Rate

Question 284

Authorization is proving who you say you are with a password and other factors

Answer 284

False, authentication Authorization is the accesses you have based on your identification and authentication

Question 285

Internal monitoring and management, need internal expertise, external access must be granted and managed is what authentication? Cloud On premise Multi factor Biometric

Answer 285

On premise

Question 286

What authentication factor is completing a series of patterns? Something you do Something you know Something you have Something you are

Answer 286

Something you know

Question 287

Multiple links in network in case a link fails RAID Geographic dispersal Load balancing Multipath I/O

Answer 287

Multipath I/O Ex. multiple fibre channels with multiple switches in case of failure

Question 288

Raiders 0 is no fault tolerance

Answer 288

True

Question 289

NICs talk to each other broadcasts

Answer 289

False, Multicast

Question 290

Ups is a short term backup power supply and a generator is long term

Answer 290

True

Question 291

Hot swappable

Answer 291

Replace a faulty power supply without powering down

Question 292

Provide multiple power outlets (in a rack) Include monitoring and control by managing power capacity and enable or disable indv outlets

Answer 292

PDU

Question 293

duplicates data from one data center to another

Answer 293

Use SAN-SAN

Question 294

This includes redundancy by maintaining one VM and replicate all others (one big file) maintain copies anywhere

Answer 294

VM replication

Question 295

Cloud storage is faster than on premise

Answer 295

False, cloud is always slower than local

Question 296

All files changes since the last full back up Full Incremental Differential Non authoritative

Answer 296

Differential, Incremental is all files changed since last incremental backup

Question 297

Incremental is the fastest back up

Answer 297

True

Question 298

A copy is an exact duplicate of a systemat one point in time

Answer 298

True

Question 299

A disk is sequential storage, easy to ship and store, 100gb

Answer 299

False, magnetic tape Disk is faster and deduplicate/compress

Question 300

Run os from removable media, portable Non persistence Live boot media Diversity Order of restoration

Answer 300

Love boot media

Question 301

What should be restored first? Application Server Hardware Database

Answer 301

Database

Question 302

All cryptography is temporary

Answer 302

True, additional CA’s can provide additional protection

Question 303

Embedded systems

Answer 303

Hardware and software designed for a specific function like digital watch, medical imaging system etc

Question 304

Multiple components running on a single chip

Answer 304

System on a chip Small form factor

Question 305

Integrated circuit that can be configured after manufacturing. Common in infrastructure (firewall, routers)

Answer 305

FPGA

Question 306

Cellular networking that runs at 10Gbits per second

Answer 306

5G

Question 307

Uses to provide information to a cellular network provider from IoT devices, contains mobile details and embedded systems 5G Subscriber Identity Module Narrowband Zigbee

Answer 307

SIM

Question 308

Communicates analog signals over a slim range of frequencies, conserves frequency over long distance 5G Subscriber Identity Module Narrowband Zigbee

Answer 308

Narrowband, used with IoT devices and SCADA

Question 309

Single cable with a digital signal, bidirectional Baseband Subscriber Identity Module Narrowband Zigbee

Answer 309

Baseband 100base-to, 1000base-t, 10gbase-t

Question 310

IoT networking, IEEE 802.15.4 PAN, alt. To WiFi and Bluetooth(less power consumption)

Answer 310

Zigbee

Question 311

Embedded systems are not usually ran on a fully capable computer, they have limited features/communication (low cost)

Answer 311

True Raspberry pie etc

Question 312

What is a common constraint of embedded systems? Power CPU RAM Network

Answer 312

Power, cpu and network

Question 313

Embedded systems commonly use authentication for security

Answer 313

False, typically none

Question 314

Concealing an important facility in plain sight, blends into local environment

Answer 314

Industrial camouflage

Question 315

Chemical fire you would use what to stop?

Answer 315

DuPont FM-200 (halon)

Question 316

Site surveys, damage assessments you would use this Proximity reader Bollard Faraday cage Drone

Answer 316

Drone

Question 317

Blocks electromagnetic fields, microwave oven inside

Answer 317

Faraday cage

Question 318

Physically secure cabled network, protect cables/fiver and data, can’t cut the cables PDS Dual power PDU Hot swappable

Answer 318

PDS Protected distribution system

Question 319

Physical separation between networks, in shared environments; stock markets, SCADA, airplanes etc have these for protection

Answer 319

Air gap

Question 320

Remove magnetic field, destroys drive data and renders drive unusable

Answer 320

Degaussing

Question 321

Wiping data is is removing it from an existing data store

Answer 321

False, purge Wipe is unrecoverable removal of data in a storage device, to be able to reuse on another system

Question 322

What are added to encrypt a text?

Answer 322

Key Cypher is the algorithm used to encrypt

Question 323

Already built in and generates hashes from passwords Key stretching library Cryptographic key Homomorphic encryption Public/private sharing

Answer 323

Key stretching library

Question 324

Used to secure IoT devices with limited power/CPU,

Answer 324

LW Crypt

Question 325

Homomorphic encryption

Answer 325

Perform calculations while data is encrypted, directly on encrypted data, can only decrypt with price key

Question 326

Single key to encrypt/decrypt data, if it gets out you need another key, secret key algorithm, doesn’t scale well

Answer 326

Symmetric encryption

Question 327

Public key cryptography with 2 or more keys (public/private) need both to encrypt/decrypt. Both mathematically related

Answer 327

Asymmetric encryption

Question 328

Key generation

Answer 328

combines a large random (prime) number with a key generation program to create a private and public key

Question 329

Elliptic curve cryptography

Answer 329

Instead of numbers these use smaller keys than large prime numbers, smaller storage, perfect for phones

Question 330

These can be a digital signature; authentication, non repudiation and integrity

Answer 330

Hashes

Question 331

Verifies a downloadable file, compares downloaded file hash with the posted hash value Collision Practical hashing Salt Elliptical curve

Answer 331

Practical hashing

Question 332

Digital signature does what Proves message not changed (integrity) Verify signature (non repudiation) Sign with private key Verify with public key

Answer 332

All the above

Question 333

Don’t send the symmetric key over net, uses phone or in person is in band key exchange

Answer 333

False, out of band In band is on network with additional encryption, use asymmetric to deliver symmetric key

Question 334

Session keys are permanent

Answer 334

False, they are ephemeral (temporary) and need to be changed often

Question 335

You can decrypt a web servers data if you have the private key and capture traffics. SPOF. Use this to change the method of key exchange

Answer 335

Pfs, Uses elliptic curve or diffie helman for ephemeral key exchange

Question 336

Steganography

Answer 336

is security through obscurity

Question 337

Name 3 types of steganography

Answer 337

-embed messages in tcp packets -place in image -invisible watermarks -digital audio files -sequence of images

Question 338

0’s and 1’s and combos of them used to search large data bases Steganography Post quantum cryptography NTRU Quantum superposition

Answer 338

Quantum superposition

Question 339

Crypto system not vulnerable to quantum computing. Instead of using prime numbers it uses closest vector problem.

Answer 339

NTRU

Question 340

random stream Quibits (key) across quantum network, if both keys are identical then it wasn’t viewed during transmission, someone seeing it would modify data stream and keys not be the same

Answer 340

QKD

Question 341

Stream cyphers are mostly used with asymmetric encryption

Answer 341

False, symmetric

Question 342

Block cyphers

Answer 342

What are symmetric encryption that are often 64 or 128 bit and each bit is encrypted or decrypted separately

Question 343

Simplest encryption mode, each block encrypted with same key

Answer 343

ECB

Question 344

Each plaintext block is XORed with previous cipher text. First block is IV and adds randoms

Answer 344

CBC

Question 345

CTR

Answer 345

Acts as a stream cipher, encrypts successive values

Question 346

Galois/ Counter Mode

Answer 346

Encryption with authentication, part of block mode, efficient without latency, used in packet used data;IPSec, tls etc

Question 347

A block chain is a distributed ledger that keeps track of transactions, replicates to anyone

Answer 347

True

Question 348

Low Power devices/low latency need larger symmetric key sizes and use ECC for asymmetric encryption

Answer 348

False, use smaller key sizes High resiliency needs larger key sizes

Question 349

Match these to the below; integrity, authentication, non repudiation Validate content with hashes Password hashing digital signature

Answer 349

Integrity- Validate content with hashes Auth-Password hashing Non repudiated-digital signature

Question 350

Public key encryption and digital signing of mail content S/MIME SRTP NTPsec HMAC

Answer 350

S/MIME

Question 351

FTPS is SSH file over FTP

Answer 351

False, FTP over SSL SFTP is SSH file over FTP

Question 352

SASL

Answer 352

Provides authentication using many different methods is

Question 353

Users access of data and applications is what?

Answer 353

endpoint DLP is preventing data being lost

Question 354

Kernel

Answer 354

This has complete control of OS

Question 355

Specification for cryptographic functions used by apps within os, random number generator, versatile memory

Answer 355

TPM

Question 356

This verifies a boot loader with a signed trustee certificate or digital signature Hardware module Trusted Boot Boot integrity Secure boot

Answer 356

Secure boot

Question 357

Bootlisder verifies digital signature of os kernel, kernel verifies other components, then checks every driver if trusted Hardware module Trusted Platform Module Trusted Boot Secure boot

Answer 357

Trust boot

Question 358

Remote Attestation

Answer 358

Device provides operational report to a verification server

Question 359

Sending random input to an application; robustness testing, fault injecting, negative testing Fuzzing Secure cookies Salting Hashing

Answer 359

Fuzzing (dynamic analysis)

Question 360

These prevent XSS attacks, add to web server configuration, only allow local script sites Fuzzing Secure cookies Salting HTTP secure headers

Answer 360

HTTP secure headers

Question 361

Decisions in os, application hash, certificates, path and network zones are examples of what? Fuzzing Allow lists Salting HTTP secure headers

Answer 361

Allowed lists

Question 362

Help identify security flaws, can automate finding a hidden vulnerability in a source code

Answer 362

Static application security testing

Question 363

Registry

Answer 363

Primary configuration database for windows

Question 364

Encryption for this prevents access to application database files

Answer 364

Disk

Question 365

FDE, SED, Opal storage specification -Hardware based full disk encryption, no OS -encrypt everything on drive, bit locker

Answer 365

Full disk encryption- encrypt everything on drive, bit locker -Self encryption drive-Hardware based full disk encryption, no OS Opal Storage- 

Question 366

send to server with lowest use Weighted round Robin Round Robin Dynamic round round robin Active/active load balancing

Answer 366

Dynamic round Robin Round Robin, Each server is selected in turn Weighted round Robin prioritizes a server

Question 367

extranet

Answer 367

Private network for partners/ vendors, suppliers, needs additional authentication is what? Intranet is private network for internal use only, vpn access only

Question 368

North/south traffic is the ingress/egress to an outside device, internal web server inside data center communicating to an external web server

Answer 368

True, East to west is traffic flow in a data centers, 2 web servers inside same data center communicating to each other

Question 369

Encryption/decryption access device, used with client software built into os, many deployment options

Answer 369

Concentrator

Question 370

Language commonly in web browsers, includes api and web cryptography, create vpn tunnel without a separate vpn application

Answer 370

HTML5 vpn

Question 371

Everything sent from remote user is sent to vpn concentrator and the concentrator decides where the data goes Split Full Site to site L2TP

Answer 371

Full

Question 372

Always on, firewall acts as vpn concentrator between remote user and corporate resources L2TP Site to site Full Split

Answer 372

Site to site

Question 373

Connecting sites over a layer 3 network as if they were connected at layer 2, implemented with IPSec Site to site Full L2TP Split

Answer 373

L2TP

Question 374

IPsec

Answer 374

Security for layer 3, authentication and encryption for every packet, confidentiality and integrity

Question 375

Transport mode encrypts both the data and IP header

Answer 375

False, tunnel mode

Question 376

Use this if you only care about integrity of data, hash of packet and shared key, prevent replay attack ESP AH L2TP IPSec

Answer 376

AH, ESP encrypts and authenticates, more common to use, combined with AH for the integrity

Question 377

802.1D

Answer 377

Prevents switching loops

Question 378

BPDU guard ,

Answer 378

This bypasses listening and learning states, spanning tree control protocol, work stations don’t send these

Question 379

Ip tracking on layer 2 device, switch is a firewall for tus, switch watches these conversations, filters invalid information

Answer 379

DHCP snooping

Question 380

Descruces process of controlling traffic flows, many methods is

Answer 380

QoS

Question 381

No NAT, no ARP, IPSec built in for ipv4 security

Answer 381

False, ipv6 security

Question 382

Port redirection, software based and limited functionality

Answer 382

Port mirror

Question 383

These limit the number of broadcasts per second, can also control multicast and unicast traffic, managed by values Switches STP BPDU guard NGFW

Answer 383

Switches, managed

Question 384

Filter traffic by port number or application, encrypt traffic between vpn sites, layer 3 device, incorporating NAT WAF Network based firewall Stateless firewall NGFW

Answer 384

Network based

Question 385

Application layer, all data is in every packet, each packet analyzed State full firewall Network based firewall Stateless firewall NGFW

Answer 385

NGFW

Question 386

Applies rules to https, allows or denies based on input, used for payment cards, sQl injection WAF Network based firewall Stateless firewall NGFW

Answer 386

WAF

Question 387

Firewall ACL’s are from top to bottom

Answer 387

True, also includes implicit deny

Question 388

True or false, Opening source firewalls include application controls and high speed hardware

Answer 388

False, proprietary Open source is traditionally firewall function

Question 389

Appliance provide faster throughput for firewall then host based

Answer 389

True, Host based can view non encrypted data

Question 390

This access control is Connecting internal network to the internet, mostly with firewalls, access control is inside or outside and trying to reach resources/access can be through location or user groups etc

Answer 390

Edge

Question 391

integrated with Active Directory and makes health checks during login and log off is what?

Answer 391

Agentless nac dissolvable agents- Not Installing permanent software, performs posture assessment and terminates when done

Question 392

These are useful fit caching information, access control, url filtering and content scanning

Answer 392

Proxies

Question 393

Internal proxy commonly to protect and control user access to the internet Application proxy Forward proxy Reverse proxy Open proxy

Answer 393

Forward proxy

Question 394

Inbound traffic from Internet to your internal service Application proxy Forward proxy Reverse proxy Open proxy

Answer 394

Reverse proxy

Question 395

3rd party uncontrolled proxy, significant security concern, used to circumvent existing security controls Application proxy Forward proxy Reverse proxy Open proxy

Answer 395

Open proxy

Question 396

Connects an ips, redirects traffic by examining a copy of traffic. Does this through port mirror or network tap, does not block, just prevents In band response Passive monitoring In line monitoring Out of band response

Answer 396

Passive monitoring

Question 397

Out of band response

Answer 397

Malicious traffic is identified, limits traffic , iPs sends tcp reset frame to disable traffic flow and prevent anymore malicious traffic

Question 398

Ips sits physically in-line, all traffic goes through it first, prevents any malicious traffic from getting into netwok, drops bad traffic

Answer 398

In band response

Question 399

High end cryptographic hardware, secures storage, offloads cpu overhead from other devices, used in large environments with clusters and redundant power

Answer 399

Hardware Security module

Question 400

Access secure network zones, highly secured device, ssh/tunnel/vpn to this, security concern

Answer 400

Jump server

Question 401

This is Proprietary consoles (firewall, ips) siem consoles (Syslog servers) aimed include correlation engine to compare diverse sensor data

Answer 401

Collector

Question 402

WPA2-CCMP

Answer 402

Data confidentiality with aes, message integrity with cbc-mac

Question 403

WPA3 PSK has a brute force problem

Answer 403

False, WPA2 PSK

Question 404

WPA changes PSK to include mutual authentication, creates shared session key that isn’t shared over the network, no hashes/handshakes is now in WPA3 for SAE

Answer 404

True

Question 405

Diffie Hellman derive key exchange with authentication component, everyone uses different session key, even with PSK is SAE

Answer 405

True, dragon fly handshake

Question 406

This security mode authenticates users individually with an authentication server (radius) is WPA-PSK

Answer 406

False, WPA3 enterprise/802.1x

Question 407

Allows for easy set up of mobile device through pin configured on access point entered on phone/push button on access point Eap PEAP WPS EAP-FAST

Answer 407

WPS

Question 408

Authentication framework, many ways to authenticate based on RFC standard, integrates with 802.1x.

Answer 408

Eap

Question 409

PSK is used in conjunction with access to to a database, radius/ldap/TACACS

Answer 409

False, 802.1x (port based network access control)

Question 410

Authentication server and supplicant share a protected access credential (pac) (shared secret) needs radius server, authenticates over tls. *makes sure supplicant and authenticator can communicate in a tunnel Eap-fast PEAP Eap Captive portal

Answer 410

Eap-fast

Question 411

Encapsulates eap in a tls tunnel, user authenticates with MSCHAPv2, user can authenticate with GTC. Uses digital certificates for authentication Eap-fast PEAP Eap Captive portal

Answer 411

PEAP

Question 412

Requires digital certificate in AS and other devices. Uses mutual auth in order for a tls tunnel. Required PKI and legacy devices may not be able to use Eap-fast PEAP Eap Eap tls

Answer 412

Eap tls

Question 413

Radius federation is members of an organization can authentication to network of another organization, uses 802.1x (NAC)

Answer 413

True

Question 414

Supplicant- the client authenticator- device that provide access authentication server- validates client credential

Answer 414

True

Question 415

Eap-ttls

Answer 415

Supports other authentication protocols in a tls tunnel, needs one digital certificate on AS, used by all is what?

Question 416

For wireless packet analysis, you can’t hear everything on the network if you are transmitting data

Answer 416

True

Question 417

Configures, updates, and maintain all access points in an infrastructure Controller ESSID 802.1x Eap-tls

Answer 417

Controller

Question 418

Connections to buildings are point to multi point

Answer 418

False, point to point Multi point is full connectivity between nodes

Question 419

WiFi is WAN

Answer 419

Blue tooth is PAN- high speed communication over short distance WiFi is LAN

Question 420

DOS/frequency jamming, remote capture, stolen device, replay attack or man in the middle are common attacks against what? RFC NFC Bluetooth GPS

Answer 420

NFC

Question 421

Mobile device management

Answer 421

Manage company owned and user owned mobile devices

Question 422

Secure access to data, protect data from outsiders, file sharing and viewing, DLP for mobile devices

Answer 422

Mobile content management

Question 423

Context aware auth

Answer 423

Authentication that combines multiple contexts; ip address, gps, other devices, emerging tech, what devices you frequent etc

Question 424

Separate enterprise mobile apps and data, creates a virtual area for company data with limited sharing. Storage segments the data is what?

Answer 424

Containerization

Question 425

Shrinks PCI express, security; key generation, digital signatures, authentication, secure storage

Answer 425

MicroSD HSM

Question 426

Provision, update and remove apps, creates enterprise catalog, monitor application use, remote wipe MicroSD UEM MAM SEAndroid

Answer 426

Mobile application management

Question 427

Addresses broad scope of system security for Linux/kernel/user space/policy configuration MicroSD UEM MAM SEAndroid

Answer 427

SEAndroid

Question 428

Move from user assigned control to object labels and minimum user access

Answer 428

SEAndroid manages android deployments

Question 429

Applications can be used across different platforms by using this MicroSD UEM MAM SEAndroid

Answer 429

UEM

Question 430

Rooting (android)/jailbreaking (Apple)

Answer 430

Install custom firmware, uncontrolled access, side load apps. You don’t need access to os

Question 431

Company buys device, used as corporate and personal device, org has full control of device

Answer 431

Corporate owned personally enabled

Question 432

Apps/data separate from mobile device, centralized app development, data separate from device Corporate owned VDI/VMI COPE CYOD

Answer 432

Virtual desktop infrastructure

Question 433

Company owns device and is not for personal use use is CYOD

Answer 433

False, corporate owned CYOD is similar to COPE but you choose your device

Question 434

HA across zones are Availability zones, isolated locations with cloud region, independent power, build apps to be highly available, load balancers

Answer 434

True

Question 435

This allows different os and applications to communicate across platforms, validates security controls

Answer 435

Integration/auditing resource policies- Identity access management, map job functions to roles, provide access to cloud resources, centralize user accounts

Question 436

API keys, password, certificates, difficulty to manage, authorize access to this, manage access control policy, provide audit trail Secrets management Resource policies HA across zones Integration

Answer 436

Secret management

Question 437

Iam, bucket policies, globally blacking public access, don’t put data in cloud unless it needs to be there are examples of what? Resource policies Permissions Replication Cloud storage

Answer 437

Permission

Question 438

Data already encrypted when sent to the cloud and performed by the application is client side encryption

Answer 438

True, Server side encryption encrypts data in cloud and is encrypted when stored on a disk

Question 439

is micro service architecture that view’s special api queries and monitors incoming/outgoing data

Answer 439

API inspection and integration

Question 440

Manages computing resources such launchers/removesa vm or container, allocates resources Iaas Security groups Virtual private cloud endpoint Container security

Answer 440

Iaas

Question 441

Dynamic resource allocation

Answer 441

Provisioned resources when needed, scaled up or down, ongoing monitoring

Question 442

Instance awareness

Answer 442

Granular security controls, identifies specific data flows, files shares and defines set policies, denies certain uploads

Question 443

Allows private cloud subnets to communicate to other cloud services, does not need internet connectivity

Answer 443

Virtual private cloud endpoint

Question 444

Bugs, Insufficient security controls, Mia configurations are security issues for what? Virtualization Cloud computing Container Man I. The middle

Answer 444

Container

Question 445

Cloud access security broker

Answer 445

Keeps data secure in the clouds, organization has defined security policies, implemented as client software, determines authorization of apps, compliance, threat prevention

Question 446

This is one of the most common cloud security issues Wireless Applications Storage RAM

Answer 446

Applications misconfiguration

Question 447

Protects uses and devices regardless of activity/location, examines api applications, examines JSON strings and api requests

Answer 447

Next gen secure web gateway SWG

Question 448

Attributes

Answer 448

Identifier or property of an entity, name/email/department name etc., one or more can be used for identification

Question 449

-ssh-keygen

Answer 449

Create a public/private key pair

Question 450

Copy the public key to the ssh server -ssh-copy-id host@user -ssh-I’d user-copy@host -keygen-copy-id user@host -ssh-copy-id user@host

Answer 450

-ssh-copy-id user@host

Question 451

-ssh user@host

Answer 451

No password prompt

Question 452

Used exclusively by services running on a computer, no interactive, web/data base server, access defined for specific action is what kind of account?

Answer 452

Service accounts

Question 453

What adds location metadata to a document or file, location based access rules, time based access rules?

Answer 453

Geotagging geofencing is automatically allowing or restricting access when the user is in a specific location, don’t allow to run unless near office

Question 454

All passwords in one location, credentials encrypted with unique passwords is a password vault

Answer 454

True

Question 455

Use personal knowledge as an authentication factor

Answer 455

Knowledge based authentication

Question 456

Static kba questions are based on an identity verification service, street number etc

Answer 456

False, dynamic Static kba is pre configured shared secrets, used with password recovery (make and model of first car)

Question 457

TPM

Answer 457

as a cryptographic processor that will generate random numbers or key generators, persistent memory with unique keys burned in?

Question 458

Larg number of servers woukusing encryption would use an HSM, centralized storage

Answer 458

True

Question 459

Encrypted authentication protocol that utilizes a 3 way handshake is PAP

Answer 459

False, CHAP Pap is basic in the clear, weak and non encrypted

Question 460

After a link is established, server sends a challenge Client responds with a password hash calculated from the challenge and password Server compares received hash with stored hash 3 way handshake Trusted Platform process Password vault process Radius

Answer 460

3 way handshake

Question 461

Used commonly with point to point tunneling and has security issues with DES, easy to brute force IPsec MS-CHAP L2tp 802.1x

Answer 461

MS-CHAP, micro soft version of chap Use L2TP, IPsec, 802.1x or another secure authentication method

Question 462

Common AAA protocol, supported on a wide variety of platforms, centralize authentication for users, on any server

Answer 462

Radius

Question 463

Network authentication protocol that you do not need to reauthenticate with and is used with Microsoft

Answer 463

Kerberos

Question 464

Integrates with eap and prevents access to network until authentication succeeds 802.1x Radius Tacacs LDAP

Answer 464

802.1x Used in conjunction with either radius, Tacacs or ldap

Question 465

Routers/switches/firewalls, sever authentication, remote vpn, 802.1x would authenticate with Kerberos

Answer 465

False, radius

Question 466

Open standards for authentication and authorization, can authenticate from 3rd party, one standard does it all, issues with mobile apps Federation SAML O auth SASL

Answer 466

Security assertion markup language

Question 467

Authorization framework, determine resources a user will be able to access, created by Google and others, openid connect handles SSO, authorization but not auth,

Answer 467

O auth

Question 468

Users receive rights for authorization through what? ACL’s Windows groups Access control models Chmod a-w

Answer 468

access control models

Question 469

Os limits operation of object based on security clearance, every object gets a label, admin decides who gets security access DAC Mac Rbac ABAC

Answer 469

Mac

Question 470

Used in most os, spreadsheet/owner controls who has access, flexible but weak security

Answer 470

Discretionary access control

Question 471

Rbac

Answer 471

is used in windows that use groups for access control

Question 472

Users can have complex relationships to applications and data, many parameters DAC Mac Rbac ABAC

Answer 472

Attributes based access control Ex resource info, ip address, time of day, data relationship

Question 473

Generic term for following rules, access comes through system enforced rules, rule is associated with object

Answer 473

Rule based access control

Question 474

Stores files and access to them, done through acls/user rights/central files, handles encryption and decryption

Answer 474

File system security

Question 475

Difficult to apply old methods of authentication to new methods of working, constantly changing cloud, conditions, controls allow or block, can make complex access rules

Answer 475

Conditional access

Question 476

Managing super user access with admin and root, store privileged accounts in digital vault, centralized passwords/automation/manage each user access/tracking and Audit

Answer 476

Privileged access management

Question 477

Policies, procedures, hardware, software, people and digital certificates

Answer 477

PKI

Question 478

Public key certificate that binds with digital signature from CA RA PKI CA Digital certificates

Answer 478

Digital certification

Question 479

Key pair send the public key to the CA

Answer 479

Certificate signing request

Question 480

Built in browser is commercial certificate

Answer 480

True, Private certificates are in house with internal ca, for large organizations

Question 481

Everyone receives certificates from multiple CA’s

Answer 481

False, one

Question 482

Entity requesting certificate needs to be verified, approval or rejection, responsible for revocations RA PKI CA CSR

Answer 482

Registration authority

Question 483

CN

Answer 483

Common name FQDN for certificate

Question 484

Manages certification revocation list CRL PKI CA CSR

Answer 484

CA

Question 485

DV, EV, wildcard domain and SAN are what type of tickets? Web server ssl Web server user Code signing Root

Answer 485

Web server ssl

Question 486

Owner of certificate has some control over dns domain

Answer 486

Domain validation

Question 487

Additional checks have verified the certificate owners identity, show green name on address bar, ssl now outdated Ev DV San Wildcard

Answer 487

Extended validation certificate

Question 488

Ext to x.509 certificate, lists addition identification information, certificate support many different domains Ev DV San Wildcard

Answer 488

Subject alternative name

Question 489

Certificate are based on name of server, apply to all server names in a domain Ev DV San Wildcard

Answer 489

Wildcard

Question 490

Developers provide level of trust/apps signed by developers, users os examines developer signature bf validate software Code signing Web signing ssl Root Self signed

Answer 490

Code signing certificate

Question 491

Public key certificate that identifies root ca, issues other certificates Code signing Web signing ssl Root Self signed

Answer 491

Root certificate

Question 492

Internal certificate not signed by public ca, build your own ca Code signing Web signing ssl Root Self signed

Answer 492

Self signed certificate

Question 493

Putting a certificate on a device that you signed is what type of certificate?

Answer 493

machine and computer certification User certificates is an id card with additional authentication factor

Question 494

Cryptography in an email platform with public key cryptography, public key encrypts email/private key decrypts is what certificate?

Answer 494

email certificate

Question 495

X.509

Answer 495

Structure of certification is standardized, format of file can take many forms

Question 496

Format designed to transfer syntax for data structures, specifically coding format, binary, common with Java

Answer 496

Distinguished encoding rules

Question 497

Common format, base64 encoded der certificate, format from CA’s, on many platforms, ASCII X.509 DER PEM PKCS #12

Answer 497

Privacy enhanced mail N64 pikachu unreal in smash

Question 498

PKCS #12

Answer 498

Personal information exchange syntax standard, rfc standard, format for many x.509 certificates, used to transfer public/private key, PFX

Question 499

Windows x.509 ext, encoded as der or as ascii pem format, public key and private is transferred in .pfx format CER PKCS #12 PAM PKCS #7

Answer 499

Certificate

Question 500

Cryptographic message syntax standard, store I. ASCII (human readable format), no private keys, wide platforms supported CER DER PEM PKCS #7

Answer 500

PKCS #7

Question 501

Encrypts emails, received encrypted emails, digital signatures/private key digitally signs, non repudiated/integrity CER Email certificates PEM PKCS #7

Answer 501

Email certificate

Question 502

Offline CA’s are bad and cannot be trusted

Answer 502

True

Question 503

Provides scalability for these checks, CA responds to these client requests, doesn’t scale well, certificate holder verified status, in TLS handshake Pinning Certificate chaining Key escrow OCSP stapling

Answer 503

Online certificate status protocol stapling

Question 504

Proves you are communicating on trustworthy tls server, this has expected certificate or public key to an application, keys don’t match then it shuts down Pinning Certificate chaining Key escrow OCSP stapling

Answer 504

Pinning

Question 505

Cross certifying CA’s are for scalability with mesh

Answer 505

False, don’t scale well

Question 506

Someone else holds encryption keys

Answer 506

Key escrow

Question 507

List of all veers between server and root CA, starts with SSL cert and ends with root, anything in between us this

Answer 507

Certificate chaining

Question 508

Web of trust is a single CA issues certain to intermediate CA’s

Answer 508

False, hierarchical Web of trust is alt to traditional PKI

Question 509

Takes advantage of ICMP TTL exceeded error message, TTL is hops, TTL=1 first router, TTL=2 2nd router is what command?

Answer 509

Tracert (windows) or trace route

Question 510

This device filters icmp

Answer 510

Firewall

Question 511

This command learns about devices, port scan for device and open ports, can determine OS, service scans and has additional scripts/vulnerability scanning

Answer 511

Nmap

Question 512

Pathping

Answer 512

First phase runs a trace route to build map, 2nd phase measures round trip time and packet loss at each hop

Question 513

TCP/IP packet assembler/analyzer that is a ping that can send anything

Answer 513

Hping

Question 514

#hping3 - - desport 80 10.1.10.1 modifies IP/TCP/UDP/ICMP values and is easy to flood and DoS

Answer 514

True

Question 515

Show all active connections

Answer 515

Netstat -a

Question 516

Netstat -n

Answer 516

Do not resolve names

Question 517

Netcat

Answer 517

Read or write to the network, open port and send or receive traffic, listens on port number/transfer data/scans port, becomes backdoor

Question 518

Locate active devices, arp, ICMP requests, tcp ack, ICMP timestamp is what?

Answer 518

ip scanners

Question 519

Arp determined Mac address based on ip address

Answer 519

True

Question 520

ARP -a

Answer 520

View local arp table

Question 521

View devices routing table, find out which way the packers will go Give windows and Linux commands

Answer 521

Route Route print (windows) Netstat -r (Linux)

Question 522

Cur1

Answer 522

Client url, retrieve data using a url, web pages, ftp, grabs raw data from search

Question 523

Gathers osint, finds associated ip addresses, names from linked in, pho keys by email domain, dns brute force is what command?

Answer 523

theHarvester

Question 524

Combine many recon tools into a single framework, non and intrusive scanning options

Answer 524

Sn1per

Question 525

What Run port scans from different hosts, port scan proxy, ip is hidden scan source?

Answer 525

Scanless

Question 526

Dnseum

Answer 526

Enumerated dns information, view host from dns servers, find host names on Google

Question 527

Nessus

Answer 527

Industry leader in vulnerability scanning, checklist of issues/extensive reporting

Question 528

Cuckoo

Answer 528

Sandbox for malware, virtual environments, api calls and network traffic/memory analysis, traffic captures, screenshots

Question 529

View first part of a file

Answer 529

Head

Question 530

- head -n 5 syslog uses n to specify what?

Answer 530

Number of lines

Question 531

Tail

Answer 531

View last part of a file

Question 532

Cat

Answer 532

Link together in a series Concatenate

Question 533

- cat file1.txt file2.txt copies a file to a screen and - cat file1.txt file2.txt > both.txt copies a file to another file

Answer 533

True

Question 534

Change mode of a file system object, set for file owner (u) group (g) others (o) or all (a)

Answer 534

Chmod X= execute

Question 535

-chmod 744 first.txt is user to read write execute, group is read only and other is read only

Answer 535

True

Question 536

Type of change mode to All users, no writing to first text

Answer 536

Chmod a-w first.txt

Question 537

Owner of script.sh can execute the file Scanless Cur1 Chmod u+x Chmod a-w

Answer 537

Chmod u+x script.sh

Question 538

Add entries to system log, syslog is what?

Answer 538

Logger

Question 539

-logger “This information is added to syslog” is useful for including information in a local or remote syslog file, included as part of automation script and log an important event. True or false

Answer 539

True

Question 540

Command line for system administrators, .ps1 file extensions SSH Power shell Python OpenSSL

Answer 540

Windows power shell

Question 541

Toolkit and crypto library for this, create/manage x.509 certificates and requests and CRLs, supports many hashing protocols, encryption

Answer 541

OpenSSL

Question 542

Packet replay utilities that edit packet captures, check ip signatures/firewall rules, looks at traffic in Netflix and evaluates security performance devices is what?

Answer 542

tcpreplay

Question 543

captures packers from command line and displays packers on screen and write packers to a

Answer 543

tcpdump Wire shark is a graphical packet analyzer that gathers frames on network and can be built into the device with extensive decodes

Question 544

dd

Answer 544

Includes an ibm mainframe and data definition, bit by bit copy of a drive

Question 545

Create a disk image is - dd if=/dev/sda of=/tmp/sda-image.img Restore from an image is -dd if=/tmp/sda-image.img of=/dev/sda memdump

Answer 545

True

Question 546

Winhex

Answer 546

Universal hexadecimal editor for windows os that edits disks/files/ram, clones disks, hard drive cleaning is

Question 547

Ftk imager

Answer 547

Access data forensic drive imaging tool, widely supported, full disk encryption, import other image formats

Question 548

Perform digital forensics of hard drives, extract many different data types

Answer 548

Autopsy

Question 549

Metasploit

Answer 549

Attack known vulnerabilities is what?

Question 550

Ñame 2 nist sp800-61 security incidents handling guide incident life cycle stages

Answer 550

Preparation Detection analysis Containment, eradication, and recovery Post incident activity

Question 551

This monitoring detects configuration changes like system files

Answer 551

Host based

Question 552

Phased approach to fixing a system after an attack

Answer 552

Reconstitution

Question 553

Performing a full scale disaster drill before an event Walkthrough Exercise Tabletop exercise Simulation

Answer 553

Exercise

Question 554

Not having to physically go through a disaster drill Walkthrough Exercise Tabletop exercise Simulation

Answer 554

Table top exercise

Question 555

Include responses, test processes before an event and go through each step to identify faults Walkthrough Exercise Tabletop exercise Simulation

Answer 555

Walkthrough

Question 556

Testing an event like phishing email is which prevention exercise

Answer 556

Simulation

Question 557

Using paper when a computer goes down is an example of what plan?

Answer 557

Coop (continuity of operation planning)

Question 558

Determines actions of an attacker: identify point of intrusion, understand methods to move around, look at security techniques to block future attacks Diamond model of intrusion Incident response Mitre attack Siem

Answer 558

Mitre attack

Question 559

Apply scientific principles to intrusion analysis/measurements and looks simple but is complex, adversary deploys capability over some infrastructure against a victim

Answer 559

Diamond model of intrusion

Question 560

Diamond models co sits of what?

Answer 560

adversary, infrastructure, victim and capability

Question 561

Cyber kill chain, name 2

Answer 561

Reconnaissance- gather intel weaponization- build deliverables to include a backdoor delivery- deliver executable over email exploit- execute code on victims device installation- malware installed on os command and control- C2 channel created for remote access actions on objectives - attacker can remotely carry out objectives Is what?

Question 562

A vulnerability exists but you didn’t detect it is a false negative

Answer 562

True

Question 563

Switches, routers, ap’s, vpn concentrators and infrastructure devices are what kind of logs? Network System Applications Security

Answer 563

Network logs

Question 564

Os, security events, requires filtering, extensive Network System Applications Security

Answer 564

System

Question 565

Windows event viewer, Linux macOS parse log details on siem, specific to this log Network System Applications Security

Answer 565

Application

Question 566

Blocked and allowed traffic, exploit attempts, blockier categories, dns sinkhole, firewalls and critical protection information Network System Applications Security

Answer 566

Security

Question 567

Ip address, access errors, unauthorized attempts, server start up and shut down activity Network System Authentication Web

Answer 567

Web log files

Question 568

View lookup requests, ip address of the request, malware sites and queries to bad urls, block or modify bad requests Network DNS Authentication Web

Answer 568

Dms log files

Question 569

Know who logged in or who didn’t, account name, source ip, auth method, identify brute force and multiple failures, Network System Authentication Web

Answer 569

Authentication log files

Question 570

Store all contents of memory into diagnostic file, reste in windows task manager, some apps have their own of this log file

Answer 570

Dump log files

Question 571

View inbound and outbound call info, audit trail, includes sip information VoIP and call manager System Dump DNS

Answer 571

VoIP logs

Question 572

Rsyslog is a popular Syslog daemon with additional filtering/storage and NXlog is a collection from many diverse log types

Answer 572

False, syslog-ng, Rsyslog is a rocket fast system for log processing

Question 573

Linux log, stored in binary, optimized for storage and provides method for querying system journal with search and filter

Answer 573

Jountslalctl

Question 574

Bandwidth monitoring is percentage of use over time

Answer 574

True, snmp, Netflix, SFlow, ipfix

Question 575

Describes other data sources like mobile/web/files etc Jountslalctl Metadata Rsyslog NXlog

Answer 575

Metadata

Question 576

This gathers traffic flow by a probe watching network and summary records sent to collector

Answer 576

Netflow

Question 577

Templates used to describe data, newer Netflow is what?

Answer 577

ipfix Sflow is sample of actual network traffic, embedded in routers/switches

Question 578

Protocol analyzer

Answer 578

This solves complex application issues, gathers network packet, and views detailed traffic information

Question 579

End user device like a pc is an endpoint

Answer 579

True

Question 580

Decisions made into os, only allow apps with unique identifiers, allow digitally signed apps from publishers, only run apps in folders or network zone are Kernel Macro CRL Approval lists

Answer 580

approval lists

Question 581

Enable it disable phone and tablet functionality, regardless of physical location

Answer 581

Mobile device manager

Question 582

Block transfer of pii or sensitive information

Answer 582

DLP

Question 583

Content filtering

Answer 583

Limit access to untrusted websites, block know malicious sites, blocklists share suspicious site urls

Question 584

Admin isolate compromised device with malicious software from everything else/network is containments

Answer 584

False, isolation Containment is running app in sandbox, limit interaction with os and multi device security

Question 585

Sepárate network, prevent unauthorized movement and limit scope of breach is segmentation

Answer 585

True

Question 586

Includes run books of linear checklist steps to perform and playbooks with conditional steps to follow with a data breach, integrates 3rd party tools and data sources

Answer 586

Security orchestration automation and response

Question 587

Collect and protect information relating to an intrusion, RFC 3227 guideline for evidence collection

Answer 587

Digital forensics

Question 588

Legal technique to preserve relevant information, hold notifications, electronically stored information, ongoing preservation

Answer 588

Legal hold

Question 589

Not all data can be used in a court of law, legal authorization, laboratories, technical qualifications

Answer 589

Admissibility

Question 590

Control evidence by maintaining integrity, use hashes and everyone contacts evidence/labels everything, Digital forensics Legal hold Admissibility Chain of custody

Answer 590

Chain of custody

Question 591

Fat time is stored in gmt

Answer 591

False, ntfs Fat is stored in local time

Question 592

Below is least volatile to most CPU registers, cpu cache Router table, arp cache, kernel, memory Temporary file systems Disk Remote logging/monitoring data Physical config, network topology Archival media

Answer 592

False, most to least

Question 593

How long data sticks around

Answer 593

volatility

Question 594

Changes constantly and is difficult to capture, memory dump

Answer 594

RAM

Question 595

Swap/pagefile

Answer 595

Used by different os system, place to store ram when memory is deleted, more space on storage drive, portions of application, similar to ram dump

Question 596

Snapshot

Answer 596

Associated with virtual machines, original image is full back up, each of these is incremental from the last

Question 597

Artifacts

Answer 597

Digital items left behind, every contact leaves a trace, log info/flash memory etc

Question 598

CPU cache is long term instruction storage

Answer 598

False, short term

Question 599

A legal agreement to have the option to perform a security audit at any time

Answer 599

Right to audit clause

Question 600

Data in different of these may be bound by different rules, data stored in cloud may not be located in same country, data center can determine its treatment Forensic cloud Right to audit clause Regulatory/jurisdiction Data breach notification law

Answer 600

Regulatory/jurisdiction

Question 601

Protects against accidental changes during transmission, relatively simple integrity check, not designed to replace hash Checksum Provenance Preservation E-discovery

Answer 601

Checksum

Question 602

Documentation of authenticity, chain of custody for data handling, blockchain tech Checksum Provenance Preservation E-discovery

Answer 602

Provenance

Question 603

Handling evidence, manage collection process, live collection Checksum Provenance Preservation E-discovery

Answer 603

Preservation

Question 604

Gathers data required by legal process Checksum Provenance Preservation E-discovery

Answer 604

E-discovery

Question 605

Focus on key threat activity for a domain, prevent hostile intelligence operations is

Answer 605

strategic intelligence/counter intelligence

Question 606

Technical controls are controls that are implemented by people, security guards/awareness programs

Answer 606

False, Operational Technical is systems like firewalls or antivirus

Question 607

This type of Control addresses security design, security policies, SOP’s Technical On premise security Managerial Peap

Answer 607

Managerial

Question 608

Physical contrincante access, door lock, security guard, firewall Preventive Detective Corrective Deterrent

Answer 608

Preventive

Question 609

May not prevent access, identifies and records any intrusion attempt, motion detector, ips/ids Preventive Detective Corrective Deterrent

Answer 609

Detective

Question 610

Designed to mitigate damage, ips can block attacker, backups mitigate ransomware, or storm Preventive Detective Corrective Deterrent

Answer 610

Corrective

Question 611

May not directly prevent access, discourage intrusion attempts, warning sign, login banner Preventive Detective Corrective Deterrent

Answer 611

Deterrent

Question 612

Doesn’t prevent attack, restore using other means, restore from backup, hot site, backup power system Preventive Physical Corrective Compensating

Answer 612

Compensating

Question 613

Fences, locks, mantraps, real world security Preventive Physical Corrective Compensating

Answer 613

Physical

Question 614

Compliance

Answer 614

Meeting standards of laws, policies, and regulations, across many aspects of business, penalties and scope

Question 615

Ray regulation for data protection, control export of personal data, individual has control of their personal data, details privacy rights for user

Answer 615

General Data Protection Regulation

Question 616

Payment card industry, data security standard for protecting credit cards GDPR PCI DSS Security framework Compliance

Answer 616

PCI DSS

Question 617

What is this? Build and maintain secure network systems Protect cardholder data Maintain vulnerability management program Implement strong access control measure regular monitor networks Maintain information security policy

Answer 617

PCI DSS

Question 618

6 steps for NIST RMF

Answer 618

Categorize- define environment Select- pick appropriate controls Implement- define proper implementation Asses- determine if controls are working Authorize- make a decision to authorize a system Monitor- check for ongoing compliance

Question 619

Practical and actionable tasks for it professionals for cyber defense is what?

Answer 619

center for internet security

Question 620

Cis is the alignment of standards, guidelines, and practices to framework core

Answer 620

False, framework profile inside Nist CSF

Question 621

Ido/iec 27001

Answer 621

Standard for an information security management system 27 ISO

Question 622

Ido/iec 27002

Answer 622

Code of practice for information security controls

Question 623

Ido/iec 27701

Answer 623

Privacy information management

Question 624

ISO 31000

Answer 624

International standards for risk management practices

Question 625

Type 1 audit tests controls in place at a particular point in time

Answer 625

True Type 2 tests controls over a period of at least 6 consecutive months

Question 626

Cloud controls Matrix

Answer 626

Cloud specific security controls, controls are mapped to Standards, best practices and regulations

Question 627

Enterprise architecture

Answer 627

Methodology and tools, asses internal it groups and cloud providers, determine security capabilities, build road map

Question 628

This hardens what, banner information, directory browsing for info leakage , run permissions from non privileged account, configure ssl, monitor log files

Answer 628

Web server

Question 629

This gardens what, updates/patches, user account with password complexity, limit network access, anti virus/malware Web server Os Application Network infrastructure

Answer 629

Os

Question 630

This hardens what, runtime/programming language b/w web server and database, disable unnecessary services, security patches, limit rights and access from other devices Web server Os Application Network infrastructure

Answer 630

Application

Question 631

This hardens what, switches/routers, embedded os with purpose built in device, don’t use default configuration, manufacturer security updates etc

Answer 631

Network infrastructure

Question 632

What use is allowed for assets of the company is what?

Answer 632

acceptable use policy

Question 633

Job rotation so no one has total control, mandatory vacations, separation of duties, clean desk policy are examples of least privilege

Answer 633

False, business policies

Question 634

NDA, prevents use of confidential information, social media analysis AUP Personnel security procedures Business policies User training

Answer 634

Personnel security procedures

Question 635

Gamification, capture the flag/hacking, phishing simulation, computer based training are examples of what? AUP Personnel security procedures Business policies User training

Answer 635

User training

Question 636

An adverse action is someone failing a background check

Answer 636

True

Question 637

Mínimum terms for services provided, used between customers and service providers

Answer 637

Service level agreement

Question 638

Don’t make decisions based on incorrect data, used with quality management systems like 6 sigma, calculate measurements uncertainty BPA MOU MSA EOSL

Answer 638

Measurement system analysis

Question 639

Manufacturer stop selling product, no more support for product BPA MOU MSA EOSL

Answer 639

End of life or end of service life

Question 640

Rules, processes. And accountability associated with an Organization’s data Data governance Data steward Data classification Data retention

Answer 640

Data governance

Question 641

Manages governance process, data accuracy/privacy/security, associate’s sensitivity labels to the data, ensure compliance with applicable laws

Answer 641

Data steward

Question 642

Identify data types and compliance Data governance Data steward Data classification Data retention

Answer 642

Data classification

Question 643

Keep files that change frequently for version control/files change often, recover from virus infection, often legal requirements with different storages Data governance Data steward Data classification Data retention

Answer 643

Data retention

Question 644

Passwords must be embedded in the application, everything needs to be on the client side, not the server side

Answer 644

False, server side not client side

Question 645

Personnel accounts have no privileged access to os

Answer 645

True

Question 646

Web server rights and permissions will be the same as the data base server

Answer 646

False, different

Question 647

An account that has Elevated access to one or more systems, complete access to drivers, not used for normal administration, highly secured is what?

Answer 647

an admin/root account

Question 648

Change control steps. Name 2

Answer 648

Analyze risk associated with change Create a plan Get end user approval Present proposal to change control board Backout plan if change doesn’t work Document changes

Question 649

Theft of ideas/inventions/creative expressions is intellectual property theft

Answer 649

True

Question 650

Every project has a plan with risk, document risk with each step and apply solutions, monitor results Risk register Risk control assessment Risk matrix Inherent risk

Answer 650

Risk register

Question 651

Risk matrix

Answer 651

View results of risk assessment, risk based on color, likelihood of an event with potential impact,

Question 652

Impact + likelihood, risk exists in absence of controls

Answer 652

Inherent risk

Question 653

Inherent risk +control effectiveness, risk after controls are considered, models based on on including additional controls Risk register Risk matrix Inherent risk Residual risk

Answer 653

Residual risk

Question 654

Risk determined, cybersecurity requirements, formal audit, security based on requirements, exist controls are good or not

Answer 654

Risk control assessment

Question 655

Co Stanton changing backfield, overwhelming amount of information, knowledge is key Risk awareness Risk matrix Inherent risk Risk control assessment

Answer 655

Risk awareness

Question 656

Likelihood, annual rate of occurrence, single loss expectancy, annual loss expected are types of what? Risk awareness Risk matrix Quantitative risk Risk control assessment

Answer 656

Quantitative risk

Question 657

Impact

Answer 657

Life, property, safety, finance, reputation is what?

Question 658

What recovery plans should consider in unique environments? Name 2

Answer 658

Application Personnel Equipment Work environment

Question 659

Récords are sorted and stored Distribution Use Maintenance Disposition

Answer 659

Distribution

Question 660

Use

Answer 660

Make business decisions

Question 661

Maintenance

Answer 661

Ongoing data retrieval and data transfers is what?

Question 662

Disposition

Answer 662

Archiving or disposal of data is called what?

Question 663

Notices

Answer 663

Terms of service and conditions, awareness

Question 664

Data classification that is property of an org, including trade secrets and unique data to org

Answer 664

Proprietary

Question 665

Hashing and masking are examples of what?

Answer 665

Anonymous zation

Question 666

manages the purposes and means by which personal data is processed

Answer 666

Data controller

Question 667

is responsible for data accuracy, privacy and security

Answer 667

Data custodian or steward

Question 668

Data that is property of an organization

Answer 668

Proprietary

Question 669

Security admin needs to search a storage drive to get email messages and browser histories. Which?

Answer 669

Autopsy

Question 670

Using an automated teller machine with a pin and debit card Something you know Something you have Something you are Something you do

Answer 670

Something you have/know

Question 671

Airport check in process requires photo identification Something you know Something you have Something you are Something you do

Answer 671

Something you are

Question 672

Door to data center requires a id card and handprint Something you know Something you have Something you are Something you

Answer 672

Something you are/have

Question 673

Main door to a building uses 2 separate keys on a key ring Something you know Something you have Something you are Something you

Answer 673

Something you have

Question 674

A users browser will only send session keys over an encrypted connection Code signing Input validation Static cookie analysis Secure cookies Fuzzing

Answer 674

Secure cookies

Question 675

A security admin is gathering data from a compromised host. Which should be gathered first? Any previous backups Memory dump Drive image Default router configuration /tmp directory contents

Answer 675

Memory dump

Question 676

A company loses $1,000 each time a tablet is stolen RPO SLE MTBF RTO ALE

Answer 676

SLE, Singletary loss expectancy Losing a device

Question 677

A team in the security department is responsible for scanning and exploiting vulnerabilities on the company network Blue White Purple Green Red

Answer 677

Red

Question 678

A Linux admin is downloading an updated version of her Linux distribution. The download site shows a link to the ISO and SHA256 hash value. Which describes the use of the hash value? Verified the file was not corrupted during file transfer Provides a key for decrypting the ISO download Authenticates the site as an official ISO distribution site Confirms that the file does not contain any malware

Answer 678

Verified the file was not corrupted during file transfer

Question 679

Attackers ability to reconnect to a compromised host is what part of kill chain process? Persistence Weaponization Reconnaissance Pivoting

Answer 679

Persistence

Question 680

Banner grabbing

Answer 680

Probing a server to elicit a response to identify the server application and version number or how server is configured

Question 681

Arp is an easily configurable backdoor

Answer 681

False, Netstat

Question 682

X.509 links the identity of a user to a public key, while PGP links the identity to a private key

Answer 682

False

Question 683

Verification is a stage in a key’s life cycle

Answer 683

False

Question 684

Guaranteeing the identity of e commerce sites and the other websites that gather and store confidential information is the purported of what? CA Server certificates RA Root CA

Answer 684

Server certificate

Question 685

All certificates use PEM which converts information into binary

Answer 685

False, DER (distinguished encoding rules)

Question 686

PGP is under what kind of model? GPG Web of trust Hierarchical Chain of trust

Answer 686

Web of trust

Question 687

Tokens can be allowed to continue without expiring in HTOP

Answer 687

True

Question 688

Key stretching

Answer 688

Putting initial key through thousands of rounds of hashing

Question 689

Provide google credentials and can simultaneously log into Twitter because they have a trusted network between the 2 is federated

Answer 689

True

Question 690

Access control model that is not rule based Rbac Mac ABAC Dac

Answer 690

Dac

Question 691

Access model that is strict and inflexible, contains labels similar to security clearances

Answer 691

Mac

Question 692

Access model that is complex for defining rules that allow or deny access Rbac Dac ABAC Mac

Answer 692

ABAC

Question 693

X.500

Answer 693

Principle directory standard

Question 694

Way of binding an ldap(SMTP, or IMAP) directory server with client and server agreeing upon mutually supported security mechanism Open auth Sasl Ldaps Saml

Answer 694

Sasl (simple authentication and security layer) Allows client and server applications to authenticate each other

Question 695

Saml tokens are written in what?

Answer 695

X.500

Question 696

Active Directory is a database stored on one or more servers called this

Answer 696

Domain controllers

Question 697

Su

Answer 697

Linux command that allows you to gain access while logged into your normal user account

Question 698

This is executed in the hosts memory and cpu but not installed to a local disk Hotp Totp Persistent agent Dissolvable agent

Answer 698

Dissolvable agent

Question 699

duplicates data for FT (mirroring) Raid 1 Raid 0 Raid 5 Multiple raids

Answer 699

Raid 1

Question 700

requires additional disk for redundancy Raid 5 Raid 1 Raid 3 Raid 0

Answer 700

RAID 5

Question 701

Sneaky friend adds special tools to a programs room without program knowing and can change how the program works

Answer 701

DLL Injection

Question 702

What weakness is exploited in a MD5 hash?

Answer 702

Collision

Question 703

What is a problem with symmetric encryption? Difficult to maintain secure distribution and storage of key Public key can’t be use to decrypt private key Private key can’t decrypt public key A lot of computing overhead

Answer 703

Difficult to maintain secure distribution and storage of key

Question 704

Asymmetric key is faster than symmetric

Answer 704

False

Question 705

CTR and GCM allow block ciphers to behave like stream ciphers

Answer 705

True

Question 706

GCM

Answer 706

Type of ctr mode and combines cipher text with messages authentication code GMAC similar to HMAC

Question 707

Functions like a stream cipher, each block is combined with a nonce (non repeating) counter value

Answer 707

CTR

Question 708

CBC applies same key to each plaintext block

Answer 708

False, ECB CBC improves ciphertext integrity with IV to first plaintext block to ensure the key produces a unique ciphertext from plaintext

Question 709

This means a key should not be derivable from the ciphertext Diffusion Obstruction Confusion Masking

Answer 709

Confusión

Question 710

Diffusion

Answer 710

If one bit of the plaintext is changed, many bits in cipher text should change is what?

Question 711

What ensures identical plaintext’s produce different ciphertext a?

Answer 711

Iv, salt, nonce

Question 712

Digital envelopes

Answer 712

Used both symmetric and asymmetric encryption

Question 713

Used crypto algorithms to generate unique value from file contents. If file changed so does this

Answer 713

Checksum

Question 714

A stream cipher is padded to the correct size if there is not enough data in the plain text

Answer 714

False, block cipher

Question 715

the state when data is present in volatile memory, like RAM or CPU register is what type of data?

Answer 715

Data in use

Question 716

Having am the same public key as someone but a different private key is what encryption?

Answer 716

Asymmetric

Question 717

Crypto hash algorithm produces a fixed length string from a variable length string Collision Checksum Passed hash Message digest

Answer 717

Message digest

Question 718

a special box that helps keep your toys organized and safe. you play with your toys (which are like apps or programs), the box makes sure your toys are being used safely. It checks who is playing with them, makes sure they're being used in the right way, and keeps an eye out for any problems or things that shouldn't happen. Is what? API CASB SWG XSS

Answer 718

CASB Just like your toy box helps keep your toys safe and organized, a CASB helps keep computer programs and apps safe when they are used on the internet or in the cloud.

Question 719

gatekeeper/super hero for the computer that keeps you safe when you go online to play games/watch videos. So, when you want to go on the internet (like going to a playground), the superhero gatekeeper stands at the entrance. It checks everything you want to do on the internet to make sure it's safe and good for you. It helps stop any bad stuff from getting to your computer, like mean bugs or things that might make your computer sick.

Answer 719

SWG (next gen secure web gateway) Just like a superhero protects a city, the SWG helps protect your computer when you're playing and exploring things on the internet.

Question 720

X.509 links identity to a private key

Answer 720

False, public PGP for private

Question 721

Purpose for which a certificate was issued

Answer 721

Standard extensions

Question 722

RA informs user whether a certificate is valid, revoked or suspended

Answer 722

False, they are only for registration process

Question 723

These are like extra labels you add to a treasure map (CA) to give more details on the information it’s protecting is extensions

Answer 723

Extensions

Question 724

Like an ID cards helps people know who you are/can trust you. This helps computers and programs trust each other with these types of certificates (ID’s)

Answer 724

X.509

Question 725

a special robot is very good at noticing and understanding what's going on in the moment. It's like when you're playing a game, and you quickly notice if someone joins in or if the game rules change. Is what?

Answer 725

Instance awareness – that's being instance aware, just like the smart toy robot that knows what's happening around it.

Question 726

helps computers and devices connect to and access things stored in the cloud (like data or applications) without having to physically be where those things are located. It creates a magical connection that allows you to reach and use cloud stuff from wherever you are, just like the magic door on your backpack brings your toys to you! API VPC Netflow Sfix

Answer 726

Virtual private cloud endpoints

Question 727

System or technology’s ability to stay up and running for a long time without interruption

Answer 727

Highly available

Question 728

Gaining administrative access to system files and settings that are usually restricted in order to modify os, install custom software etc for greater control and customization of device

Answer 728

Rooting/jailbreaking

Question 729

Su

Answer 729

Linux command that allows you to gain root access while logged into your normal user account

Question 730

Removing all data from mobile device, always have a backup is what?

Answer 730

Remote wipe

Question 731

Instead of authenticating with just a password, this authentication adds additional information like location, device info, time of access, behavior pattern and network information to be able to sign in EV Rbac PAM Context aware authentication

Answer 731

Context aware authentication

Question 732

Bad person puts bad code into a website and when you visit it bad things happen to your computer. Like a diary for friends that someone writes mean things

Answer 732

Cross site scripting/xss attack

Question 733

Used in wireless networks and PPP connections. It is a framework for standards on different methods of authentication L2tp EAP SASL Ipsec

Answer 733

EAP

Question 734

Your computer wants to connect to a Wi-Fi network or another computer, it does a secret handshake with the network or the other computer. This helps in making this handshake more secure by creating a safe tunnel for the handshake to happen. It's like having a secret passage where only the right computers can go through is eap-fast

Answer 734

True

Question 735

is like a digital backpack where you can keep secret keys, certificates, and other important stuff for your computer. It helps keep everything safe and organized so only the right people can use them is PKCS #12

Answer 735

True

Question 736

is like a digital envelope for messages. It helps keep information secure when it's sent from one place to another on the internet. It's like putting your message in a special, locked box so only the person you want to open it can read it. SWG PKCS #7 Mail gateway API

Answer 736

PKCS #7

Question 737

These attacks bypass maximum failed login restrictions

Answer 737

Rainbow table

Question 738

An attacker compromises a public CA and issues unauthorized X.509 certificates for Company.com. In the future, Company.com wants to mitigate the impact of similar incidents. Which of the following would assist Company.com with its goal? Cert. with EV Cert. pinning Cert. chaining Cert. stapling

Answer 738

Certificate pinning

Question 739

What is the term used to describe the process of validating a digital certificate by verifying a chain of trust through a series of certificates?

Answer 739

Certificate chaining

Question 740

What is the term for the practice where a web server provides a digital certificate directly to a client, rather than the client retrieving it from a certificate authority during the TLS/SSL handshake? A) certificate pinning B) Certificate Chaining C) Certificate Stapling D) eap-fast

Answer 740

Certificate stapling

Question 741

What security practice involves associating a specific digital certificate with a particular server or service, allowing client applications to verify the server's authenticity by checking if the presented certificate matches the pre-configured one? A) Certificate EV B) Certificate stapling C) Certificate Pinning D) OSCP stapling

Answer 741

Certificate pinning

Question 742

What type of digital certificate provides additional verification steps beyond basic domain ownership, often including thorough validation of the requesting entity's legal identity and business details? A) DV certificate B) CSR C) RA D) Certificate EV

Answer 742

Certificate with Extended Validation

Question 743

A security analyst is reviewing an assessment report that includes software versions, running services, supported encryption algorithms, and permission settings. Which of the following produced the report? Nmap Vulnerability scanner IP Scanner TLS Inspection

Answer 743

Vulnerability scanner

Question 744

Port,/network/vulnerability scanning, banner grabbing, fingerprinting, social engineering and packet sniffing are examples of what?

Answer 744

Active reconnaissance

Question 745

A systems administrator found a suspicious file in the root of the file system. The file contains URLs, usernames, passwords, and text from other documents being edited on the system. Which of the following types of malware would generate such a file?

Answer 745

Keylogger

Question 746

A security administrator wants to implement a company-wide policy to empower data owners to manage and enforce access control rules on various resources. Which of the following should be implemented? Rbac Mac ABAC Dac

Answer 746

Dac

Question 747

Which encryption program is commonly used for securing emails and files by providing a method for end-to-end encryption and digital signatures?

Answer 747

PGP

Question 748

Which of these would best describe the use of a nonce? -Information is hidden inside of an image -Information encrypted with a public key is decrypted with a private key -Prevents replay attacks during authentication -The sender of an email can be verified

Answer 748

-Prevents replay attacks during authentication

Question 749

A system administrator is implementing a fingerprint scanner to provide access to the data center. Which of these metrics would be the most important to minimize so that unauthorized persons are prevented from accessing the data center? You Answered TOTP HOTP FAR FRR

Answer 749

False Acceptance Rate

Question 750

Which set of security standards is designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment?

Answer 750

PCI DSS

Question 751

What is the term for activities undertaken to prevent, detect, and respond to intelligence activities conducted by adversaries or competitors against an organization or government?

Answer 751

CI

Question 752

Focus on key threat activity for a domain

Answer 752

Strategic intelligence

Question 753

Swap/pagefile

Answer 753

In computer systems, what is the term used for a reserved space on the hard drive that is used as virtual memory when the physical RAM is fully utilized?

Question 754

What term is commonly used to refer to a set of documented procedures and steps that system administrators or operators follow to perform routine operational tasks and address common issues in an IT environment? A) CI B) playbook C) Runbook D) continuous deployment

Answer 754

Runbook

Question 755

Playbook

Answer 755

What term is commonly used to describe a documented set of strategies, actions, and procedures that are planned and organized in advance for a specific purpose, often used in cybersecurity incident response?

Question 756

Which framework provides a knowledge base of tactics and techniques used by adversaries in the cybersecurity domain, offering a comprehensive resource for understanding, preventing, and mitigating cyber threats?

Answer 756

Mitre attack

Question 757

Which framework provides a set of guidelines and best practices for improving the cybersecurity posture of an organization, with a focus on risk management and a lifecycle approach to managing information security? A) ISO/IEC 27001 B) PCI DSS C) NIST Framework D) COBIT

Answer 757

Nist framework

Question 758

Which model is commonly used in cybersecurity to analyze and understand cyber threats by considering four key elements: adversaries, infrastructure, capabilities, and victim organizations?

Answer 758

Diamond Model of Intrusion Analysis

Question 759

STIX/TAXI Model

Answer 759

commonly used in cybersecurity to standardize the exchange of threat intelligence information, providing a structured language and transport mechanism for sharing information about cyber threats

Question 760

Which document from the National Institute of Standards and Technology (NIST) provides guidance on how organizations can effectively respond to and recover from computer security incidents?

Answer 760

B) NIST SP800-61

Question 761

Which forensic imaging tool is commonly used for creating forensic images of digital devices, allowing investigators to capture and analyze data from storage media in a forensically sound manner?

Answer 761

Ftk imager

Question 762

Which forensic tool is often used for computer forensics and data recovery, providing features such as disk editing, data interpretation, and file recovery in a hexadecimal and ASCII visualization?

Answer 762

Winhex

Question 763

Dd

Answer 763

Which command-line tool is commonly used in Unix-like operating systems for copying and converting data, often used in forensic imaging to create bit-for-bit copies of disks or partitions?

Question 764

Which open-source software toolkit is commonly used for implementing the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, providing encryption, decryption, and other cryptographic functions for secure communication over a computer network?

Answer 764

Open ssl

Question 765

Chmod

Answer 765

In Unix-like operating systems, what command is used to change the permissions of a file or directory?

Question 766

Which command-line tool is commonly used for network testing and packet crafting, allowing users to send custom ICMP, UDP, or TCP packets to a target host for network analysis and troubleshooting?

Answer 766

HPing

Question 767

Which version of the tools is an extended and improved version, offering additional features for network testing and packet crafting, including support for various protocols and sophisticated packet manipulation capabilities?

Answer 767

Hping3

Question 768

organizational structure of a Public Key Infrastructure (PKI) where multiple levels or tiers of Certificate Authorities (CAs) are arranged with each level providing a different level of trust and validation?

Answer 768

C) Hierarchical PKI

Question 769

Which PKI (Public Key Infrastructure) model relies on the concept of users personally verifying the identities of others and vouching for the authenticity of their public keys, creating a decentralized and trust-based network? A) Hierarchical PKI B) 2 way trust PKI C) Web of Trust PKI D) Federated PKI

Answer 769

C) Web of Trust PKI

Question 770

What is the primary purpose of a Public Key Infrastructure (PKI) in computer security? A) To manage passwords B) To encrypt files C) To establish secure communication and verify the identities of users or entities D) To monitor network traffic

Answer 770

C) To establish secure communication and verify the identities of users or entities

Question 771

In a network security context, what is the primary function of a jump server or jump host? A) To host website content B) To facilitate secure communication between two networks C) To jump between different Wi-Fi networks D) To manage email communication

Answer 771

B) To facilitate secure communication between two networks

Question 772

What does passive monitoring refer to in the context of network security? A) intercepting and modifying data traffic B) Monitoring network traffic without interacting with data C) Initiating automated security scans on network devices D) Blocking incoming traffic from specific IP addresses

Answer 772

B) Monitoring network traffic without actively interacting or altering the data

Question 773

What is the primary benefit of using OCSP Stapling in the context of web security? A) Faster web page loading times B) Improved server authentication C) Enhanced data encryption D) More efficient DNS resolution

Answer 773

A) Faster web page loading times

Question 774

In cryptography, what does the term "key escrow" refer to? A) Storing cryptographic keys in a secure physical vault B) Backing up cryptographic keys to a secure cloud storage C) Providing a trusted third party with a copy of the encryption keys D) Changing cryptographic keys periodically for added security

Answer 774

C) Providing a trusted third party with a copy of the encryption keys

Question 775

In the realm of cryptography, what term describes a set of rules used for encoding and representing data structures in a binary format, often utilized in the encoding of digital certificates? A) PKCS #12 B) CER C) PEM D) DER

Answer 775

Distinguished Encoding Rules

Question 776

You're working with a secure email system that uses a format for encoding certificates and keys. What term best describes this encoding method, often used for cryptographic purposes in emails and various applications?

Answer 776

Privacy-Enhanced Mail

Question 777

You're tasked with securely storing a user's private key, public key, and potentially additional certificates in a single file format. What standard would you choose for this purpose?

Answer 777

D) PKCS #12

Question 778

You need to share a digital certificate that only contains the public key and is intended for use in a specific application. What file format would be most suitable for this scenario? A) DER B) PEM C) CER D) PFX

Answer 778

CER

Question 779

You're involved in a project where multiple digital signatures and certificates need to be bundled together for secure transmission. Which file format would you choose to achieve this, ensuring integrity and authenticity of the signatures? A) PKCS #7 B) PKCS #12 C) PEM D) CER

Answer 779

A) PKCS #7

Question 780

You're setting up security measures for a website where the main concern is ensuring a secure connection and encrypted data transfer. What type of SSL/TLS certificate would be most appropriate for this scenario, considering cost-effectiveness and quick issuance? A) EV (Extended Validation) Certificate B) DV (Domain Validation) Certificate C) SAN (Subjective Alternative Name) D) Wildcard Certificate

Answer 780

DV

Question 781

You're launching an e-commerce website and want to establish a high level of trust with your customers. What type of SSL/TLS certificate would you choose to display a green address bar in web browsers, providing a visual indicator of enhanced security and identity verification? A) DV B) EV C) SAN D) wildcard

Answer 781

EV

Question 782

You're managing a server that hosts multiple websites with different domain names. To secure all these domains with a single SSL/TLS certificate, ensuring compatibility and ease of management, which certificate type would you choose? A) DV (Domain Validation) Certificate B) EV (Extended Validation) Certificate C) Wildcard Certificate D) Subject Alternative Name (SAN) Certificate

Answer 782

SAN

Question 783

You're responsible for securing various subdomains of a website, and you want to simplify certificate management while ensuring all subdomains are protected. What type of SSL/TLS certificate would you choose for this scenario? A) DV (Domain Validation) Certificate B) EV (Extended Validation) Certificate C) SAN (Subject Alternative Name) Certificate D) Wildcard Certificate

Answer 783

Wildcard

Question 784

You're tasked with implementing a robust security strategy for a company that involves generating, distributing, storing, and retiring cryptographic keys. What phase of the key management lifecycle would you focus on when ensuring that keys are securely created and made available for use across various applications and services? A) Key Generation B) Key Distribution C) Key Storage D) Key Retirement

Answer 784

KG

Question 785

You're the IT administrator for a large e-commerce website, and your company needs to secure online transactions. Considering the need for widespread trust and compatibility with major web browsers, which type of certificate authority would you choose to issue SSL/TLS certificates for your website? A) Private Certificate Authority B) Self-Signed Certificate Authority C) Commercial Certificate Authority D) Public Certificate Authority

Answer 785

CCA

Question 786

In a large organization with a complex network infrastructure, you want to streamline the process of validating and verifying users before issuing digital certificates. Which entity would you designate to handle the user identity validation process and act as an intermediary between users and the certificate authority? A) Certificate Authority B) Registration Authority C) Certificate Revocation Authority D) Certificate Repository

Answer 786

RA

Question 787

You're responsible for securing access to critical systems within your organization. You want to implement a solution that provides just-in-time privileged access, session recording, and periodic credential rotation for administrators. Which security approach would you choose to achieve these goals? A) Role-Based Access Control (RBAC) B) Multi-Factor Authentication (MFA) C) Privileged Access Management (PAM) D) Identity and Access Management (IAM)

Answer 787

PAM

Question 788

You're responsible for designing a Single Sign-On (SSO) solution for your organization, where users need seamless access to multiple applications. Additionally, you want to ensure secure authentication without the need for storing passwords on each application. What standard would you consider for achieving this SSO functionality? A) OAuth B) LDAP C) SAML (Security Assertion Markup Language) D) Kerberos

Answer 788

SAML

Question 789

You're developing a mobile application that needs to access a user's social media data without requiring them to share their login credentials. Additionally, you want to ensure that the user has control over the data shared. What authorization framework would you implement for secure and delegated access to the user's social media account? A) SAML (Security Assertion Markup Language) B) JWT (JSON Web Token) C) OAuth (Open Authorization) D) Kerberos

Answer 789

OAuth

Question 790

You're tasked with enhancing the security of a company's laptops to protect sensitive data and prevent unauthorized access. What hardware-based security solution would you recommend to store cryptographic keys, secure the boot process, and enable features like full disk encryption on these laptops? A) USB Token B) HSM (Hardware Security Module) C) TPM (Trusted Platform Module) D) Smart Card

Answer 790

TPM

Question 791

Your organization has adopted a cloud-first strategy, and employees use various cloud services for collaboration. However, you want to ensure visibility, control, and data security across these cloud applications. What solution would you implement to enforce security policies, monitor user activities, and protect sensitive data in the cloud?

Answer 791

CASB

Question 792

Your organization is focused on providing a secure and productive web experience for employees. You need a solution that goes beyond traditional web filtering, offering advanced threat protection, real-time content analysis, and user behavior monitoring. Which security solution would you choose to address these requirements for secure web access? A) IPSEC B) CASB C) Next-Gen Secure Web Gateway (SWG) D) API

Answer 792

SWG

Question 793

Your organization is hosting critical applications on a cloud platform and wants to establish private and direct connectivity to specific AWS services without using public IPs. You also aim to enhance security by avoiding exposure to the public internet. What AWS feature would you leverage to achieve this secure and private communication? A) SWG B) faas C) Azure D) Virtual Private Cloud Endpoint

Answer 793

VPC

Question 794

In the context of Android security, what is the primary role of SEAndroid, and how does it enhance the security posture of the Android operating system? A) SEAndroid is a kernel-level security module that enforces Mandatory Access Controls (MAC) to restrict app permissions. B) SEAndroid provides secure boot functionality, ensuring the integrity of the Android system during the boot process. C) SEAndroid is a runtime encryption technology that protects sensitive data within Android applications. D) SEAndroid is a secure enclave within the Android framework that handles cryptographic operations for secure communication.

Answer 794

A) SEAndroid is a kernel-level security module that enforces Mandatory Access Controls (MAC) to restrict app permissions.

Question 795

Your organization encourages employees to use mobile devices for work-related tasks, and you want to ensure secure access to corporate applications and data. However, you also want to maintain separation between work and personal data on employees' devices. Which mobile security approach would you implement to achieve this balance of security and user privacy? A) Mobile Device Management (MDM) B) Mobile Application Management (MAM) C) Mobile Threat Defense (MTD) D) Containerization

Answer 795

MAM

Question 796

Your organization is implementing a wireless network, and you prioritize a secure and efficient authentication method for users connecting to the Wi-Fi. Considering the need for a quick and secure EAP method, especially in environments where certificate-based authentication might be challenging, which EAP method would you choose for this wireless network? A) EAP-TLS (Extensible Authentication Protocol-Transport Layer Security) B) EAP-FAST (Extensible Authentication Protocol-Flexible Authentication via Secure Tunneling) C) EAP-TTLS (Extensible Authentication Protocol-Tunneled Transport Layer Security) D) PEAP (Protected Extensible Authentication Protocol)

Answer 796

Eap-fast

Question 797

Your organization is implementing secure Wi-Fi access for employees, and you want a method that provides strong authentication while ensuring ease of deployment. Considering the need for a widely supported and secure EAP method that doesn't require client-side certificates, which EAP method would you choose for this wireless network? A) EAP-TLS (Extensible Authentication Protocol-Transport Layer Security) B) EAP-FAST (Extensible Authentication Protocol-Flexible Authentication via Secure Tunneling) C) PEAP (Protected Extensible Authentication Protocol) D) EAP-TTLS (Extensible Authentication Protocol-Tunneled Transport Layer Security)

Answer 797

PEAP

Question 798

In a corporate environment with a diverse range of devices and operating systems, you need to implement a secure Wi-Fi authentication method that supports a variety of client devices. Additionally, you want to provide a method that allows for the use of username and password without requiring client-side certificates. Which EAP method would you choose for this wireless network? A) EAP-TLS (Extensible Authentication Protocol-Transport Layer Security) B) EAP-FAST (Extensible Authentication Protocol-Flexible Authentication via Secure Tunneling) C) PEAP (Protected Extensible Authentication Protocol) D) EAP-TTLS (Extensible Authentication Protocol-Tunneled Transport Layer Security)

Answer 798

Eap-ttls

Question 799

You're tasked with implementing a secure Wi-Fi network for a residential community, where users have varying levels of technical expertise. You want a password-based authentication method that offers strong security and is resistant to certain types of attacks. What authentication method would you choose to ensure both security and user-friendliness in this scenario? A) eAP-FAST (Wired Equivalent Privacy) B) PEAP (Wi-Fi Protected Access - Pre-Shared Key) C) EAP-TLS (Extensible Authentication Protocol-Transport Layer Security) D) SAE (Simultaneous Authentication of Equals)

Answer 799

SAE

Question 800

A copy of traffic is sent to an IDS/IPS Passive monitoring In-line monitoring Out of band response In band response

Answer 800

Passive monitoring, port mirror network tap

Question 801

In a network security setup, you want to deploy a monitoring solution that allows real-time analysis of traffic passing through the network, enabling immediate threat detection and response. What type of monitoring would you choose to inspect and analyze network traffic as it flows through the security appliance, ensuring minimal latency in detecting and preventing potential threats? A) Passive Monitoring B) Inline Monitoring C) Out-of-Band Monitoring D) in band monitoring

Answer 801

In-line monitoring

Question 802

In an organization where employees need secure access to various web applications, you want to implement a solution that provides additional security layers, including content filtering, authentication, and protection against application-layer attacks. What type of security solution would you deploy to act as an intermediary between users and web applications, offering advanced security features while ensuring seamless access to authorized applications? A) Firewall B) VPN (Virtual Private Network) C) IDS/IPS (Intrusion Detection System/Intrusion Prevention System) D) Application Proxy

Answer 802

Application proxy

Question 803

the core component of an operating system that manages resources and facilitates communication between software and hardware?

Answer 803

Kernel

Question 804

In a secure communication setup, which encryption method allows computations to be performed on encrypted data without decrypting it?

Answer 804

c) Homomorphic encryption

Question 805

Software-Defined Visibility

Answer 805

provides a centralized and programmable view of network traffic, allowing for enhanced monitoring and analysis

Question 806

SSRF

Answer 806

In a cybersecurity scenario, an attacker tricks a server into making unintended requests to internal resources. What vulnerability is being exploited?

Question 807

In the realm of authentication protocols, which mechanism provides a framework for client-server communication, allowing authentication without exposing the user's password? a) SSL/TLS b) OAuth c) SASL (Simple Authentication and Security Layer) d) Kerberos

Answer 807

SASL

Question 808

What is edge access managed primarily through?

Answer 808

Firewall rules

Question 809

Evaluate operational status of a system or network Dissolvable agent Persistent agent Posture assessment Health check

Answer 809

Health check Game operation

Question 810

Evaluate security or compliance with security policies if a system or device Dissolvable agent Persistent agent Posture assessment Health check

Answer 810

Posture assessment

Question 811

In an enterprise environment with a diverse range of devices and operating systems, you want to ensure continuous monitoring and enforcement of security policies, even when devices are off the corporate network. Additionally, you aim to facilitate remote troubleshooting and push security updates seamlessly. What security solution would you implement to achieve ongoing endpoint visibility and control?

Answer 811

Persistent agent

Question 812

In a guest network environment where temporary and limited access is granted to devices, you want to ensure that security policies are applied without requiring the installation of permanent software on guest devices. Additionally, you aim to provide a seamless and non-intrusive experience for guests. What approach would you choose for enforcing security policies in this scenario? A) non Persistent Agent B) Intrusion Prevention System (IPS) C) Dissolvable Agent D) Network Segmentation

Answer 812

Dissolvable agent

Question 813

In a Bring Your Own Device (BYOD) environment where users connect a variety of personal devices to the corporate network, you want to enforce security policies without requiring the installation of agents on every device. Additionally, you aim to streamline the onboarding process for new devices. What NAC approach would you choose for achieving this goal? A) Persistent Agent B) Dissolvable Agent C) Network Segmentation D) Agentless NAC

Answer 813

Agentless nac

Question 814

A network administrator has implemented a group of servers that are configured as a unit and work together to provide network services as a means of fault tolerance. In the event of a node failure, the data on one node is made available to another node seamlessly. What is this called?

Answer 814

Clustering

Question 815

While browsing a website, you come across a form that allows users to submit comments. A friend shares a link to a different website, and when you click it, you notice that it automatically submits a comment on the original site without your knowledge. What security vulnerability is demonstrated in this scenario? a) Cross-Site Scripting (XSS) b) Cross-Site Request Forgery (CSRF) c) SQL Injection d) Session Hijacking

Answer 815

CSRF

Question 816

You're sending a sensitive file to your colleague, and you want to ensure that the file's integrity is maintained during transit. Which cryptographic technique would you employ to generate a fixed-size string (hash) unique to the file's content, allowing your colleague to verify its integrity upon receipt?

Answer 816

Message digest

Question 817

You discover that an attacker has gained unauthorized access to your network and obtained hashed password values. Instead of cracking the actual passwords, the attacker tries to use the obtained hashes to authenticate to various services. What type of attack is the intruder attempting?

Answer 817

Pass the hash

Question 818

You're working on automating tasks within a Microsoft Office application, such as Excel or Word. Which programming language is specifically designed for this purpose, allowing you to write macros and automate repetitive actions within the Office suite?

Answer 818

VBA

Question 819

NGFW’s are network based firewalls

Answer 819

True Ips, content filtering, control traffic flow based on apps like YouTube etc

Question 820

Your company's website is experiencing an increase in malicious traffic and attempted SQL injection attacks. To enhance security, you decide to implement a protective barrier that filters and monitors HTTP traffic between your web application and the internet. What security measure are you likely to deploy?

Answer 820

WAF

Question 821

Validates DNS responses

Answer 821

DNSSEC Original authentication, data integrity with Public Key Crypt, signed by trustee 3rd party

Question 822

A sneaky person tricks a website to having something on the web page it shouldn’t when people visit. Like a mirror that shows cute animals but a fairy instead changes it to show toys

Answer 822

Non persistent XSS attack

Question 823

IOS devices take less time to update than android

Answer 823

True

Question 824

Ally has an application on her phone for a particular store she often visits. The app has a feature that turns on as soon as she walks into the store, showing her information on her past purchases, weekly sales, product suggestions, and more. The feature relies upon GPS positioning, creating a sort of virtual boundary based on real-world geography. What is this technique called? Geofencing GPS tagging Ips services Geolocation

Answer 824

Geofencing

Question 825

Your company has a workforce that operates remotely from various locations. Employees need secure access to internal resources such as file servers and company applications. Considering the importance of providing secure remote access without the need for specialized client software and the need for broad device compatibility, which VPN technology would you implement for this scenario? A) IPsec VPN B) MPLS VPN C) SSL VPN D) PPTP VPN

Answer 825

SSL VPN

Question 826

In a modern workplace where employees use a mix of devices, including laptops, tablets, and smartphones, you're tasked with implementing a VPN solution that provides secure access to internal resources. Your goal is to ensure accessibility from any device without requiring specific client installations. What VPN technology would be most suitable for achieving this device-agnostic and user-friendly secure access? A) IPsec VPN B) MPLS VPN C) SSL VPN D) HTML5 VPN

Answer 826

HTML5 VPN

Question 827

During a security assessment, an attacker manipulates user input in a web application, causing the system to misinterpret data and potentially leading to unauthorized access. What is the specific term for this security threat?

Answer 827

XML injection

Question 828

Monitor the server load and distribute to the server with lowest use is weighted round Robin

Answer 828

False, dynamic round Robin Weighted prioritizes the server use

Question 829

In a large-scale cloud environment, your organization is managing multiple virtual machines to support critical applications. To enhance performance and optimize resource allocation, you want to ensure that certain VMs consistently share the same physical host. What cybersecurity concept would you leverage to achieve this specific placement and minimize potential security risks?

Answer 829

Affinity rules

Question 830

Primary configuration database for windows, hierarchical, shows a before and after changes

Answer 830

Registry

Question 831

In a corporate environment where sensitive data is stored on laptops and mobile devices, you want to implement a security measure that ensures the confidentiality of data, especially in the event of device loss or theft. What solution would you deploy to encrypt the entire contents of the storage drive, protecting the data from unauthorized access even if the physical device falls into the wrong hands? A) Antivirus Software B) Network Firewall C) Full Disk Encryption (FDE) D) Intrusion Detection System (IDS)

Answer 831

FDE

Question 832

In an organization where data security is a top priority, you're responsible for managing a fleet of laptops and storage devices. Given the need to protect sensitive information at rest, what technology would you choose to ensure that the data stored on these devices is automatically and transparently encrypted, without relying on additional software or user intervention? A) homomorphic encryption B) FDE C) SED D) File-Level Encryption

Answer 832

SDE, Self-Encrypting Drives

Question 833

In an enterprise setting with a focus on securing stored data on client devices, you want to deploy a solution that provides hardware-based encryption and seamless integration with existing management systems. Your goal is to enhance data security and maintain centralized control over encryption policies. What technology would you implement for encrypting data on storage devices, ensuring compatibility with enterprise management tools? A) BitLocker B) Opal Storage C) VeraCrypt D) FileVault

Answer 833

Opal storage

Question 834

In the development lifecycle of a critical software application, the security team wants to identify potential vulnerabilities by subjecting the application to a variety of unexpected and invalid inputs. The goal is to discover and address any weaknesses in the application's input handling. What technique would the security team most likely employ for this purpose? A) Penetration Testing B) Static Code Analysis C) Threat Modeling D) Fuzzing

Answer 834

Fuzzing

Question 835

In the development lifecycle of a critical software application, the security team wants to identify potential vulnerabilities by subjecting the application to a variety of unexpected and invalid inputs. The goal is to discover and address any weaknesses in the application's input handling. What technique would the security team most likely employ for this purpose? A) Penetration Testing B) Static Code Analysis C) Threat Modeling D) Fuzzing

Answer 835

Static code analysis

Question 836

In a corporate environment where data security and system integrity are paramount, you want to implement a solution that ensures the secure boot process of devices and protects cryptographic keys used for disk encryption. Additionally, you aim to enhance the overall security posture of the organization's computing infrastructure. What hardware-based security measure would you deploy to achieve these goals? A) Hardware Security Module (HSM) B) Secure Boot C) Intrusion Detection System (IDS) D) Trusted Platform Module (TPM)

Answer 836

TPM

Question 837

HSM focuses on cryptographic operations and key management/is a standalone device. TPM focuses on secure platform with secure boot and is integrated on multiple devices

Answer 837

True

Question 838

In an organization where data integrity and system security are paramount, you're tasked with implementing measures to prevent the execution of unauthorized or tampered code during the startup process. Additionally, you want to ensure that only trusted firmware and operating system components are loaded. What technology or process would you implement to achieve a secure and trustworthy boot sequence in this scenario? A) Digital Signatures B) Virtual Private Network (VPN) C) Trusted Platform Module (TPM) D) Secure Boot

Answer 838

Secure boot

Question 839

In a high-security environment where protecting against advanced persistent threats and unauthorized system modifications is critical, you need a mechanism that verifies the integrity of the entire boot process, including the BIOS/UEFI firmware and the operating system. What security feature would you deploy to ensure that the system only boots from a known and trusted state, helping to prevent compromise from the early stages of system startup? A) boot integrity B) Measured boot C) Secure Boot D) Trusted Boot

Answer 839

Trusted Boot

Question 840

In a highly regulated industry where compliance with stringent security standards is mandatory, you need to implement a solution that not only verifies the integrity of the system during boot but also generates a secure record or log of the boot process. This record will be crucial for audit trails and compliance reporting. What technology would you deploy to ensure a comprehensive and verifiable measurement of the entire boot sequence? A) Secure Boot B) Intrusion Prevention System (IPS) C) Measured Boot D) Endpoint Detection and Response (EDR)

Answer 840

Measured boot

Question 841

In a large enterprise where protecting against advanced threats and rapidly responding to potential security incidents are top priorities, you want a solution that provides real-time visibility into endpoint activities, enables threat detection, and allows for swift response actions. What security technology would you deploy to enhance your organization's ability to detect and respond to security incidents at the endpoint level? A) Firewall B) Antivirus Software C) Virtual Private Network (VPN) D) Endpoint Detection and Response (EDR)

Answer 841

EDR

Question 842

Endpoint detection and response primarily looks at signatures for detecting threats

Answer 842

False, it does but also looks at other types like behavioral and machine learning

Question 843

n a scenario where an organization relies on cryptographic hash functions for data integrity verification, an attacker aims to find a collision—a situation where two different inputs produce the same hash value. The attacker is specifically looking for a point where the collision probability becomes surprisingly high. What type of attack is the adversary attempting in this situation, and why is it called that? A) Brute Force Attack B) Birthday Attack C) Man-in-the-Middle Attack D) Denial-of-Service Attack

Answer 843

Birthday attack

Question 844

In a network security environment where an Intrusion Detection System (IDS) is in place to analyze network traffic for malicious patterns, an attacker is attempting to manipulate or obfuscate the network packets to avoid detection. The goal is to deliver a payload or execute malicious actions while bypassing the detection mechanisms. What type of attack is the adversary engaging in, and what is the primary objective of this technique? A) Spoofing Attack B) Evasion Attack C) Phishing Attack D) Denial-of-Service (DoS) Attack

Answer 844

Evasion attacks

Question 845

In a web application where users can input comments and interact with dynamic content, an attacker identifies a vulnerability that allows injecting malicious scripts into the comments section. The scripts execute within the browsers of other users who view the comments. What type of attack is the adversary exploiting, and what is the potential impact of this attack on the affected users? A) Cross-Site Request Forgery (CSRF) B) SQL Injection Attack C) Cross-Site Scripting (XSS) D) Man-in-the-Middle (MitM) Attack

Answer 845

XSS

Question 846

In an online forum where users can share links and discuss various topics, an attacker crafts a malicious link containing a script. The attacker then tricks a user into clicking on the link. When the user clicks the link, the script executes in the context of the user's browser. What type of Cross-Site Scripting attack is demonstrated in this scenario, and why is it considered "non-persistent"? A) Stored XSS Attack B) DOM-Based XSS Attack C) Non-Persistent (Reflected) XSS Attack D) Self-XSS Attack

Answer 846

Non persistent XSS attack

Question 847

In a non-persistent XSS attack, the malicious script is delivered to the victim as part of a crafted URL or input, and it is not stored permanently on the target server. The script is reflected back to the user without being saved on the server, making it non-persistent. The attack relies on tricking users into clicking on specially crafted links or interacting with manipulated input fields.

Answer 847

True

Question 848

In a persistent (stored) XSS attack, the malicious script is permanently stored on the target server, often within a database or another storage mechanism. The script is then served to users whenever they view the affected content, making it more dangerous as it can impact multiple users over an extended period. In this scenario, the injected script in the comment section can affect anyone who views that specific blog post

Answer 848

True

Question 849

In a popular online blogging platform where users can create and share posts, an attacker discovers a vulnerability that allows them to inject a malicious script directly into the comment section of a blog post. The injected script becomes part of the permanently stored content. What type of Cross-Site Scripting attack is the adversary exploiting in this scenario, and how does the persistent nature of the attack affect potential victims? A) Non-Persistent (Reflected) XSS Attack B) DOM-Based XSS Attack C) Persistent (Stored) XSS Attack D) Self-XSS Attack

Answer 849

Persistent XSS attack

Question 850

In a Windows-based environment with a client-server application, an attacker gains access to a user's computer and identifies a vulnerability in a legitimate application that loads dynamic link libraries. The attacker exploits this vulnerability to inject a malicious this into the memory space of the target process. What type of attack is the adversary conducting? A) SQL Injection Attack B) Cross-Site Scripting (XSS) Attack C) DLL Injection Attack D) Man-in-the-Middle (MitM) Attack

Answer 850

DLL injection

Question 851

In a DLL injection attack, an attacker injects a malicious DLL into the address space of a running process. This technique is often used to execute arbitrary code within the context of a trusted application, potentially leading to unauthorized access, data theft, or further exploitation of the compromised system. In this scenario, the injected DLL could manipulate the behavior of the legitimate application, allowing the attacker to control or monitor the affected process.

Answer 851

True

Question 852

In a scenario where an e-commerce website handles sensitive customer information and experiences frequent web application attacks, the security team is tasked with implementing a solution to protect against common web exploits. What security technology would be most effective in inspecting and filtering HTTP traffic, blocking malicious requests, and preventing attacks such as SQL injection and cross-site scripting (XSS) on the website? A) IPS B) IDS C) SWG D) (WAF

Answer 852

Web Application Firewall

Question 853

In a secure communication system, an organization is transmitting sensitive data over a network using a block cipher. To enhance the confidentiality of the transmitted information, the security team decides to implement a mode of operation that XORs each plaintext block with the previous ciphertext block before encryption. What cryptographic mode is being employed to achieve this chaining effect, and why is it chosen for this scenario? A) Electronic Codebook (ECB) B) Cipher Block Chaining (CBC) C) Counter (CTR) Mode D) Galois/Counter Mode (GCM)

Answer 853

CBC

Question 854

CBC mode, each plaintext block is XORed with the previous ciphertext block before encryption. This chaining effect adds an extra layer of security, making it more resistant to certain attacks, such as pattern recognition in identical plaintext blocks. CBC is a commonly used mode of operation for block ciphers in situations where chaining is beneficial

Answer 854

Trye

Question 855

In a corporate environment that extensively uses Microsoft Office applications, a team of employees needs to automate repetitive tasks in Excel, such as data manipulation and report generation. The goal is to enhance efficiency and accuracy in their workflows. Which programming language, often integrated into Microsoft Office applications, would be most suitable for creating custom macros and automating tasks in this scenario? A) Python B) SQL C) VBA D) Java

Answer 855

VBA

Question 856

In a company where secure access to sensitive systems and applications is crucial, the IT department is implementing a multi-factor authentication solution. The team wants to ensure that even if a password is compromised, an additional layer of time-sensitive authentication is in place. What technology would they likely incorporate into their authentication process to generate temporary codes that expire after a short duration, providing an additional layer of security? A) SMS-based One-Time Passwords (OTP) B) Biometric Authentication C) Time-based One-Time Password (TOTP) D) Hardware Token

Answer 856

TOTP

Question 857

In a highly secure online banking application, the development team is implementing a two-factor authentication mechanism to enhance account security. They want to ensure that each authentication code is unique and verifiable, with a focus on counter-based synchronization. What technology would they likely choose to generate one-time passwords that are based on a secret key and a counter, providing a strong and time-independent authentication method? A) Time-based One-Time Password (TOTP) B) Biometric Authentication C) HMAC-based One-Time Password (HOTP) D) SMS-based One-Time Passwords (OTP)

Answer 857

HOTP

Question 858

In a biometric authentication system deployed at a high-security facility, the management is concerned about the risk of unauthorized access. They want to evaluate the system's performance in terms of mistakenly accepting an impostor. What metric would the security team measure to assess the system's likelihood of incorrectly granting access to someone who is not the legitimate user? A) True Acceptance Rate (TAR) B) False Rejection Rate (FRR) C) False Acceptance Rate (FAR) D) Genuine Acceptance Rate (GAR

Answer 858

FAR

Question 859

In an access control system where employees use fingerprint biometrics to gain entry to a secure facility, the security team is concerned about instances where legitimate users are incorrectly denied access. What metric would the security team focus on to measure the frequency of rejecting valid users, and how would they refer to this metric? A) True Acceptance Rate (TAR) B) False Acceptance Rate (FAR) C) False Rejection Rate (FRR) D) Genuine Acceptance Rate (GAR)

Answer 859

FRR

Question 860

In a biometric identification system used for employee authentication in a corporate setting, the security team is evaluating the system's overall performance. They want to find the point where the rates of false acceptance and false rejection are equal. What specific metric would they use to determine this equal error rate, and why is it important for optimizing the system's accuracy? A) True Acceptance Rate (TAR) B) False Acceptance Rate (FAR) C) False Rejection Rate (FRR) D) Crossover Error Rate (CER)

Answer 860

CER

Question 861

Striping without parity. High performance, no fault tolerance. In a media production company where high-performance is critical for video editing workflows, the IT team is tasked with configuring storage for a new server. The primary requirement is to achieve maximum data transfer speeds and storage capacity. What RAID level would be most suitable for this scenario, considering that redundancy is not a priority, and the focus is on maximizing storage performance? A) RAID 1 B) RAID 5 C) RAID 0 D) RAID 10

Answer 861

RAID 0

Question 862

Mirroring. Duplicates data for fault tolerance, but requires twice the disk space. In a business environment where data redundancy and fault tolerance are of utmost importance, a company wants to ensure that critical files and applications are protected against disk failures. What RAID level would the IT team likely choose to provide mirroring of data, offering an exact copy of each disk in the array and the ability to continue operations even if one disk fails? A) RAID 0 B) RAID 1 C) RAID 5 D) RAID 10

Answer 862

RAID 1

Question 863

With Parity. Faul Tolerant, only requires an additional disk for redundancy. In a corporate server environment where both data redundancy and optimized storage capacity are crucial considerations, the IT team is tasked with configuring a storage solution. The goal is to provide fault tolerance and maintain data accessibility even in the event of a single drive failure. What RAID level would be most suitable for achieving these objectives while maximizing storage efficiency? A) RAID 1 B) RAID 0 C) RAID 5 D) RAID 10

Answer 863

RAID 5

Question 864

In an enterprise setting where both performance and fault tolerance are paramount, the IT team is planning the storage infrastructure for a mission-critical database server. The team wants to ensure a balance between high data transfer speeds and redundancy. What RAID configuration would be a suitable choice, allowing for striping and mirroring, and providing fault tolerance by creating a mirrored set of striped disks? A) RAID 0+1 B) RAID 1+0 C) RAID 5+1 D) RAID 10

Answer 864

RAID 1 + 0

Question 865

This raid type combines RAID methods to increase redundancy

Answer 865

Múltiple RAID types

Question 866

In a secure communication system where resource efficiency and strong encryption are key considerations, a company is implementing a new cryptographic algorithm for securing sensitive data during transmission. The goal is to achieve high-level security with smaller key sizes, reducing computational overhead. What cryptographic algorithm would be a suitable choice for this scenario, offering a higher level of security with shorter key lengths compared to traditional methods like RSA? A) RSA B) Diffie-Hellman C) Elliptic Curve Cryptography (ECC) D) AES

Answer 866

ECC

Question 867

In a real-time communication application where low latency and efficiency are critical, the development team is looking for a symmetric key encryption method that can encrypt and decrypt data on the fly. The application involves the continuous streaming of data, and the team wants a solution that allows for efficient processing without the need to buffer large blocks of data. What type of encryption algorithm would be most suitable for this scenario? A) Block Cipher B) Asymmetric Key Encryption C) Stream Cipher D) Elliptic Curve Cryptography (ECC)

Answer 867

Stream cipher

Question 868

In a secure file storage system where data is stored in fixed-size blocks, the development team is tasked with implementing a symmetric key encryption method to protect the confidentiality of each block. The goal is to ensure that each block of data is individually encrypted and decrypted. What type of encryption algorithm would be most suitable for this scenario, providing a systematic approach to secure each fixed-size block of data independently? A) Stream Cipher B) Asymmetric Key Encryption C) Block Cipher D) Elliptic Curve Cryptography (ECC)

Answer 868

Block cipher

Question 869

In a scenario where a company is encrypting large volumes of identical data blocks independently for storage, the development team is considering different encryption modes. They want a simple and straightforward approach where each block is encrypted individually without any dependencies on other blocks. What encryption mode would be most suitable for this scenario, offering ease of implementation and parallel processing for encrypting and decrypting each block independently? A) Cipher Block Chaining (CBC) B) Electronic Codebook (ECB) C) Counter (CTR) Mode D) Galois/Counter Mode (GCM)

Answer 869

ECB

Question 870

In a secure communication system where confidentiality is crucial, a company is transmitting sensitive data over a network. The development team wants to ensure that each block of data is dependent on the previous block during encryption, adding an extra layer of security. What cryptographic mode would be most suitable for this scenario, providing a chaining effect that helps prevent certain types of attacks, such as pattern recognition in identical plaintext blocks? A) Electronic Codebook (ECB) B) Cipher Block Chaining (CBC) C) Counter (CTR) Mode D) Galois/Counter Mode (GCM)

Answer 870

CBC

Question 871

In a software development project, a team is reviewing code for potential vulnerabilities. They come across a section where a pointer is accessed without being properly initialized, leading to a situation where it points to memory location zero. What type of software vulnerability is the team identifying, and why is it considered risky in terms of system stability and security? A) Buffer Overflow B) Cross-Site Scripting (XSS) C) Null Pointer Dereference D) SQL Injection

Answer 871

Null pointer dereference

Question 872

Null pointer dereference occurs when a program attempts to access or manipulate data through a pointer that has not been initialized (i.e., it points to a null or invalid memory location). This can lead to crashes, unexpected behavior, and potentially open avenues for attackers to exploit the application

Answer 872

True

Question 873

Adding different input and output to data for randomization. If 2 identical bits are put in then it’s a 0. If 2 different bits then it is a 1

Answer 873

XOR

Question 874

is when rate of false rejections and false acceptance are equal

Answer 874

Crossover error rate (CER)

Question 875

Best method to handle input validation?

Answer 875

Fuzzing

Question 876

encrypts your message bit by bit, with each bit's transformation depending on the previous ones and the secret key stream. It's like a magical dance that only you and your friend know, keeping your message safe from prying eyes! Block cipher GCM Stream cipher IV

Answer 876

a stream cipher

Question 877

is putting data into usually 128 bits in a block and encrypting each block with complex math equations unless you have the symmetric key

Answer 877

Block cipher

Question 878

Electronic Codebook (ECB) is a mode of operation for block ciphers where each block of plaintext is independently encrypted using the same key. The key remains constant for all the blocks. This simplicity in applying the same key to each block makes ECB straightforward, but it has certain vulnerabilities

Answer 878

True

Question 879

is a mode of operation for block ciphers. It turns a block cipher into a stream cipher, allowing the encryption of individual bits or bytes of plaintext independently. The basic idea is to use a counter value as an input to the block cipher, generating a stream of pseudorandom bits that can be XORed with the plaintext to produce the ciphertext. The counter is incremented for each block, ensuring uniqueness and avoiding the weaknesses associated with modes like Electronic Codebook (ECB

Answer 879

CTR

Question 880

Order of volatility from most

Answer 880

-CPU register/cache -Router table, arp cache, kernel stats, memory -temporary systems -disk -remote logging and monitoring data -physical configuration, network topology -archival media

Question 881

In essence, elasticity is about adapting in real-time to fluctuating demand, while scalability is about designing a system's capacity to handle growth over the long term

Answer 881

True

Question 882

Which below is a data steward not responsible for? Compliance Accuracy Privacy Security

Answer 882

It is responsible for all, Associates sensitivity labels to data

Question 883

Tests controls in place at a particular point in time

Answer 883

Type I audit Type II at least 6 consecutive months

Question 884

Admissibility

Answer 884

evidence or information may be considered if it meets the criteria set by legal rules and is allowed to be presented in court.

Question 885

It is a legal requirement that prevents the destruction, alteration, or deletion of potentially relevant information, ensuring its integrity and availability for legal proceedings

Answer 885

Legal hold

Question 886

What is the incident response lifecycle?

Answer 886

-Preparation -Detection and analysis -containment, eradication, and recovery -post incident activity

Question 887

protocol used in public key infrastructure to determine the revocation status of an SSL/TLS digital certificate. web server itself periodically contacts this server, obtains the status, and attaches that status to its own certificate

Answer 887

Online Certificate Stapling process

Question 888

Hashing a hashed password multiple times through

Answer 888

Key stretching

Question 889

Bios provides software security

Answer 889

True, Secure boot specifically

Question 890

A boot loader verifying a digital signature of the OS kernel is what Secure boot Trusted boot Boot integrity Measured boot

Answer 890

Trusted boot

Question 891

Calculates if changes happened on OS, stores hash, boot drivers and everything else loaded prior in the process, includes remote attestation for a report to verification server Boot integrity Secure boot Measured boot Trusted boot

Answer 891

Measured boot

Question 892

Took user by network admins to create connections between 2 machines

Answer 892

Netcat

Question 893

Access control that allows users to assign permissions

Answer 893

Dac

Question 894

What requires both server and client certificates?

Answer 894

Eap-tls

Question 895

Non transitive trust is if A trusts B, and B trusts C, then A would trust C also

Answer 895

False, transitive Non transitive would mean A only trusts B, even if B trusts C, A would not trust C

Question 896

CSR Cert signing request

Answer 896

When you provide a public key to the certificate authority (CA) to be signed

Question 897

Securely taking with customers on a scheduled conference call would use what protocol?

Answer 897

SRTP

Question 898

Securely synchronizes the time across all of your devices and port number

Answer 898

NTPsec 123

Question 899

Port 389

Answer 899

LDAP 636 is secure

Question 900

.security administrator, is concerned about the potential for data exfiltration using external storage drives. Which of the following would be the BEST way to prevent this method? A. Create an operating system security policy to prevent the use of removable media B. Monitor removable media usage in host-based firewall logs C. Only allow applications that do not use removable media D. Define a removable media block rule in the UTM

Answer 900

C. Only allow applications that do not use removable media

Question 901

IPS at your company has found a sharp increase in traffic from all-in-one printers. After researching, your security team has found a vulnerability associated with these devices that allows the device to be remotely controlled by a third-party. Which category would BEST describe these devices? IoT RTOS MFD SoC

Answer 901

Multifunction device

Question 902

A security incident has occurred on a file server. Which of the following data sources should be gathered to address file storage volatility? (Select TWO) Partition data Kernel statistics ROM data Temporary file systems Process table

Answer 902

Patroon data and temporary file systems are part of file storage subsystem

Question 903

A security team has been provided with a non-credentialed vulnerability scan report created by a third-party. Which of the following would they expect to see on this report? A summary of all files with invalid group assignments A list of all unpatched operating system files The version of web server software in use A list of local user accounts

Answer 903

The version of the web server software in use

Question 904

A security administrator is concerned about data exfiltration resulting from the use of malicious phone charging stations. Which of the following would be the BEST way to protect against this threat?

Answer 904

USB data blocker

Question 905

A file server has a full backup performed each Monday at 1 AM. Incremental backups are performed at 1 AM on Tuesday, Wednesday, Thursday, and Friday. The system administrator needs to perform a full recovery of the file server on Thursday afternoon. How many backup sets would be required to complete the recovery? 2 3 4 1

Answer 905

4 Each incremental backup will archive all of the files that have changed since the last full or incremental backup. To complete this full restore, the administrator will need the full backup from Monday and the incremental backups from Tuesday, Wednesday, and Thursday

Question 906

A security administrator needs to identify all references to a Javascript file in the HTML of a web page. Which of the following tools should be used to view the source of the web page and search through the file for a specific filename? (Select TWO) tail openssl scanless grep Nmap curl head

Answer 906

Grep, curl

Question 907

A user has assigned individual rights and permissions to a file on their network drive. The user adds three additional individuals to have read only access to the file. Which of the following would describe this access control model? DAC MAC ABAC RBAC

Answer 907

Dac

Question 908

A security administrator needs to identify all computers on the company network infected with a specific malware variant. Which of the following would be the BEST way to identify these systems?

Answer 908

DNS sinkhole A DNS (Domain Name System) sinkhole can be used to redirect and identify devices that may attempt to communicate with an external command and control (C2) server. The DNS sinkhole will resolve an internal IP address and can report on all devices that attempt to access the malicious domain

Question 909

Which part of the PC startup process verifies the digital signature of the OS kernel?

Answer 909

The Trusted Boot portion of the startup process verifies the operating system kernel signature and starts the ELAM (Early Launch Anti-Malware) process

Question 910

. A corporate security team would like to consolidate and protect the private keys across all of their web servers. Which of these would be the BEST way to securely store these keys? Use an HSM Implement full disk encryption on the web servers Use a TPM Upgrade the web servers to use a UEFI BIOS

Answer 910

HSM

Question 911

The security policies in a manufacturing company prohibit the transmission of customer information. However, a security administrator has received an alert that credit card numbers were transmitted as an email attachment. Which of the following was the MOST likely source of this alert message? IPS DLP SMTP PCI DSS

Answer 911

DLP

Question 912

Port numbers and their secure numbers for: RTP (SRTP) NTP (NTPsec) HTTP (HTTPS LDAP (LDAPS) DNS DHCP

Answer 912

RTP (SRTP) 5004 NTP (NTPsec) 123, HTTP (HTTPS) 80, 443 LDAP (LDAPS) 389, 636 DNS- 53 DHCP- 67/68

Question 913

Retrieves a web page and displays as html at the command line

Answer 913

Curl (client url)

Question 914

HPing

Answer 914

This modifies all IP TCP, UDP, and ICMP values

Question 915

What is a generic framework for adding auth to different protocols like LDAP, SMTP, IMAP?

Answer 915

SASL (simple auth security layer) SAML (Security Assertion Markup Language) is a security/authentication focused on web based single sign on and federated identity

Question 916

Adhering to a layered security approach, a controlled access facility employs security guards who verify the authorization of all personnel entering the facility. Which of the following terms BEST describes the security control being employed? Corrective Deterrent Compensating Administrative

Answer 916

Admin

Question 917

Mark is currently configuring a new e-commerce server. He’s concerned about security issues, so which of the following would be the best location to place his e-commerce server? DMZ Intranet Extranet Guest network

Answer 917

DMZ

Question 918

Which of these should be used for remote access authentication for users who have smart cards? EAP-TLS CHAP PEAP MS-CHAPv2

Answer 918

Eap-tls

Question 919

You’re wanting to integrate users’ accounts with other resources from the web. In order to do so, you need to allow authentication to be used across different domains and while doing so, you mustn’t expose your users’ passwords to these services. Of the listed principles, which would be the most effective to accomplish this goal? Kerberos SAML SASL OAuth

Answer 919

OAuth

Question 920

Why would a company want to utilize a wildcard certificate for their servers? To extend the renewal data of the certificate To secure the certificate's private key To reduce the certificate management burden To increase the certificate's encryption key length

Answer 920

To reduce the certificate management burden A wildcard certificate is a public key certificate which can be used with multiple subdomains of a domain. This saves money and reduces the management burden of managing multiple certificates, one for each subdomain. A single Wildcard certificate for *.diontraining.com, will secure all these domains (www.diontraining.com, mail.diontraining.com, ftp.diontraining.com, …). The other options provided are not solved by using a wildcard certificate

Question 921

Secure Enclave

Answer 921

All data on a mobile device is encrypted is what?

Question 922

Msp needs a secure method of connecting to the web servers of a remote client Proxy server Jump server IPS HSM

Answer 922

Jump server

Question 923

Ddos has caused a critical service to be unavailable for 90% of the business day. Asset value Single loss expectancy Risk appetite Exposure factor Key risk indicator

Answer 923

Exposure factor

Question 924

An attacker has circumvented a web-based application to send commands directly to a database. Which of the following would describe this attack type?

Answer 924

SQL injection

Question 925

Which of the following would be the MOST significant security concern when protecting against organized crime? -Require identification cards for all employees and guests -Prevent users from posting passwords near their workstations -Maintain reliable backup data -Use mantraps at all data center locations

Answer 925

Maintain reliable backup data

Question 926

A system administrator has added a new user to the network and has categorized this user to have “secret” level access. With this setting, the user will be able to access all files and folders with secret level access and lower. Which of the following describes this access control method? Rule-based Discretionary Mandatory Role-based

Answer 926

Mac

Question 927

To upgrade an internal application, the development team provides the operations team with a patch executable and instructions for backing up, patching, and reverting the patch if needed. The operations team schedules a date for the upgrade, informs the business divisions, and tests the upgrade process after completion. Which of the following describes this process? You Answered Continuity planning Usage auditing Agile Change management

Answer 927

Change management

Question 928

A security administrator has installed a network-based DLP solution to determine if file transfers contain PII. Which of the following describes the data during the file transfer? In-transit Highly available In-use At-rest

Answer 928

In transit

Question 929

A coworker is connecting to a secure website using HTTPS. The coworker informs you that before the website loads, their web browser displays an error that the site certificate is invalid and the site is not trusted. Which of the following is most likely the issue? -The web server is currently unavailable. -The web browser is requiring an update. -A web proxy is blocking the connection. -The server is using a self-signed certificate.

Answer 929

Server is using a self signed certificate

Question 930

IPsec is a VPN protocol, not a remote access and authentication protocol

Answer 930

True

Question 931

RFC 3227

Answer 931

Guidelines for evidence collection and archiving, digital forensic process

Question 932

Message digests work as support for what?

Answer 932

many hashing protocols A doctor with a hash brown as a nurse assisting him

Question 933

Key management life cycle 6 stages

Answer 933

Key generation Certificate generation Distribution Storage Revocation Expiration

Question 934

To create a key pair, send the private key to the CA to be signed

Answer 934

False, public key

Question 935

Company engineers regularly participate in a public Internet forum with other engineers throughout the industry. Which of the following tactics would an attacker MOST likely use in this scenario? Watering Hole Attack Hybrid Warfare Pharming Credential Harvesting

Answer 935

Watering hole attack

Question 936

Which of the following is unique to a stream cipher? It uses AES encryption It is used in HTTPS It encrypts 128 bytes at a time. It performs bit-level encryption

Answer 936

Bit level encryption

Question 937

A systems administrator is configuring a new network switch for TACACS+ management and authentication. Which of the following must be configured to provide authentication between the switch and the TACACS+ server CHAP Shared Secret SNMPv3 SSH

Answer 937

Shared secret

Question 938

Provenance

Answer 938

This is the original data and shows where the data has gone (chain of custody for data handling) block chain tech

Question 939

A security engineer is configuring a wireless network that must support mutual authentication of the wireless client and the authentication server before users provide credentials. The wireless network must also support authentication with usernames and passwords. Which of the following authentication protocols MUST the security engineer select? EAP EAP-FAST PEAP EAP-TLS

Answer 939

Peap

Question 940

Diamond model of intrusion analysis is what?

Answer 940

Adversary (develops) Capability (exploits) Victim (connects to) Infrastructure (uses)

Question 941

OAuth (Open Authorization) is an open standard for authorization that allows users to grant third-party applications limited access to their resources without sharing their credentials (like passwords) directly with the third-party application. It's commonly used for enabling secure access to APIs and web services, particularly in scenarios involving user authentication and authorization.

Answer 941

True

Question 942

Security assertion markup language

Answer 942

An open standard for authentication and authorization, can authenticate through a 3rd party, not good for mobile apps

Question 943

SWG stands for Secure Web Gateway. It is a security solution designed to protect users and devices within an organization from web-based threats and enforce security policies for internet traffic. SWGs act as intermediaries between users and the internet, monitoring and filtering web traffic to prevent access to malicious or unauthorized websites and content

Answer 943

True

Question 944

Key stretching library, Ext of Unix crypt library, generate hashes from passwords, blowfish cipher to perform multiple rounds of hashing

Answer 944

Bcrypt

Question 945

Change the method of key exchange, can’t decrypt with private server key/every session uses a different private key for the exchange, uses ECC or diffie is what?

Answer 945

Perfect forward secrecy

Question 946

Perfect forward secrecy

Answer 946

Use a different encryption key for each session is what?

Question 947

An authentication program performs a hash of all passwords is data in what?

Answer 947

Data in use

Question 948

Each time a spreadsheet is updated, all other cells with formulas auto update is what data?

Answer 948

Data in use

Question 949

The Vice President of Sales has asked the IT team to create daily backups of the sales data. The Vice President is an example of A. Data owner B. Data protection officer C. Data controller D. Data processor

Answer 949

Data owner

Question 950

A company has been informed of a hypervisor vulnerability that could allow users on one virtual machine to access resources on another virtual machine. Which of the following would BEST describe this vulnerability? A. Containerization B. VM sprawl C. SDN D. VM escape

Answer 950

VM escape A VM (Virtual Machine) escape is a vulnerability that allows communication between separate VMs

Question 951

Vala, a security analyst, has received an alert from her IPS regarding active exploit attempts from the Internet. Which of the following would provide detailed information about these exploit attempts? A. Netstat B. Nmap C. Nessus D. Wireshark

Answer 951

Wireshark

Question 952

Defines how much data loss would be acceptable during a recovery

Answer 952

RPO

Question 953

RTO Recovery time objectives

Answer 953

Defines minimum objectives required to get up and running to a particular service level

Question 954

A recent security audit has discovered email addresses and passwords located in a packet capture. Which of the following did the audit identify? A. Weak encryption B. Improper patch management C. Insecure protocols D. Open ports

Answer 954

Insecure protocols

Question 955

. An IPS report shows a series of exploit attempts were made against externally facing web servers. The system administrator of the web servers has identified a number of unusual log entries on each system. Which of the following would be the NEXT step in the incident response process? A. Check the IPS logs for any other potential attacks B. Create a plan for removing malware from the web servers C. Disable any breached user accounts D. Disconnect the web servers from the network

Answer 955

D. Disconnect the web servers from the network Disconnect the web servers from the network The unusual log entries on the web server indicate that the system may have been exploited. In that situation, the servers should be isolated to prevent access to or from those systems

Question 956

Raid 0 is striping with parity

Answer 956

False, RAID 5 Raid 0 is striping with no parity

Question 957

Minimization

Answer 957

Which of the following would limit the type of information a company can collect from their customers

Question 958

This command can be used to perform a reverse-lookup of the IPv4 address and determine the IP address block owner that may be responsible for this traffic.

Answer 958

dig (Domain Information Groper)

Question 959

. A hacker is planning an attack on a large corporation. Which of the following would provide the attacker with details about the company’s domain names and IP addresses? A. Information sharing center B. Vulnerability databases C. Automated indicator sharing D. Open-source intelligence

Answer 959

. Open-source intelligence describes reconnaissance gathering from publicly available sources. In this example, information about domain names and IP address would be easily retrieved from a query to a public DNS (Domain Name System) server.

Question 960

A security administrator would like to test a server to see if a specific vulnerability exists. Which of the following would be the BEST choice for this task?

Answer 960

Metasploit exploitation framework that can use known vulnerabilities to gain access to remote systems. Metasploit performs penetration tests and can verify the existence of a vulnerability

Question 961

Which of the following would be the BEST way to protect credit card account information when performing real-time purchase authorizations? A. Masking B. DLP C. Tokenization D. NGFW

Answer 961

Tokenization, technique that replaces user data with a non-sensitive placeholder, or token. Tokenization is commonly used on mobile devices to purchase using a credit card without transmitting the credit card number

Question 962

. A government transport service has installed access points that support WPA3. Which of the following technologies would provide enhanced security for PSK while using WPA3? A. 802.1X B. SAE C. WEP D. WPS

Answer 962

SAE

Question 963

.security administrator has identified the installation of a RAT on a database server and has quarantined the system. Which of the following should be followed to ensure that the integrity of the evidence is maintained? A. Perfect forward secrecy B. Non-repudiation C. Chain of custody D. Legal hold

Answer 963

Chain of custody

Question 964

o process the company payroll, a manager logs into a third-party browser-based application and enters the hours worked for each employee. The financial transfers and physical check mailings are all provided by the third-party company. The manager does not maintain any servers or virtual machines within his company. Which of the following would BEST describe this application model? A. PaaS B. Private C. SaaS D. IaaS

Answer 964

SaaS

Question 965

Which of the following BEST describes the modification of application source code that removes white space, shortens variable names, and rearranges the text into a compact format? A. Confusion B. Obfuscation C. Encryption D. Diffusion

Answer 965

Obfuscation

Question 966

Which of the following would be the MOST likely result of plaintext application communication? A. Buffer overflow B. Replay attack C. Resource exhaustion D. Directory traversal

Answer 966

Replay attack

Question 967

What can be used to monitor and alert if there are any changes to a file?

Answer 967

file integrity check (i.e., Tripwire, System File Checker, etc.)

Question 968

company disposed of seven-year-old printed customer account summaries that were no longer required for auditing purposes. A recent online search has now found that images of these documents are available as downloadable torrents. Which of the following would MOST likely have prevented this information breach? A. Pulping B. Degaussing C. NDA D. Fenced garbage disposal areas

Answer 968

Pulping

Question 969

Pulping places the papers into a large washing tank to remove the ink, and the paper is broken down into pulp and recycled. The information on the paper is not recoverable after pulping.

Answer 969

True

Question 970

application developer is creating a mobile device app that will include extensive encryption and decryption. Which of the following technologies would be the BEST choice for this app? A. AES B. Elliptic curve C. PFS D. PGP

Answer 970

Elliptic curve ECC (Elliptic Curve Cryptography) uses smaller keys than non-ECC encryption and has smaller storage and transmission requirements. These characteristics make it an efficient option for mobile devices

Question 971

The ARO (Annualized Rate of Occurrence) describes the number of instances that an event would occur in a year. For example, if the organization expect to lose seven laptops to theft in a year, the ARO for laptop theft is seven.

Answer 971

True

Question 972

Responsible for the organization’s data privacy – Sets policies, implements processes and procedures Data protection officer Data steward Data custodian Data controller

Answer 972

Data protection officer

Question 973

Defines payroll amounts and timeframes, processes payroll and stores employee information

Answer 973

Payroll controller and processor

Question 974

What is the information lifecycle?

Answer 974

Creation and receipt Distribution Use Maintenance Disposition

Question 975

Get up and running quickly, get back to a particular service level is MTTR

Answer 975

False, recovery time objective

Question 976

How much data loss is acceptable, bring the system back online, how far back data goes is what?

Answer 976

True, RPO

Question 977

Confusion

Answer 977

Concept with data encryption where the encrypted data is drastically different than the plain text

Question 978

In a zero trust architecture, which component acts as a gatekeeper between untrusted systems and trusted enterprise resources? Oscp Sender Policy framework End point detection and response Policy enforcement point

Answer 978

Policy enforcement point, A policy enforcement point allows, monitors, and terminates connections between the trusted and untrusted systems.

Question 979

Attacker emails a link that if clicked on will run a java script that sends credentials/session IDs/cookies to the attacker

Answer 979

Non persistent XSS attack When you buy something from a website and a attacker puts a js in so they can steal your information to be able to authenticate back to that website and buy stuff with your information

Question 980

When a website’s browser has a video from YouTube on it or has pictures loaded from insta, this is a what?

Answer 980

Cross site Most are unauthenticated

Question 981

What is for randomizing encryption schemes like ciphers, WEP and SSL?

Answer 981

IV salt is a type of nonce used with password randomization to make the password hash unpredictable

Question 982

Your organization requires support for specific authentication methods beyond username/password Eap-tls Eap-ttls Peap Eap-fast

Answer 982

Eap-ttls

Question 983

How a process can affect customer privacy is what?

Answer 983

Privacy impact assessment (PIA)

Question 984

Maintenance

Answer 984

Information life cycle stage that deals with retrieval of information and data transfers

Question 985

Information life cycle stage about how Information is processed, stored and sorted

Answer 985

Distribution

Question 986

RPO is how much time to recover to a certain point, not complete recovery

Answer 986

False, RTO (recovery time objective) RPO is minimum amount of data to get back online

Question 987

EU protection/privacy for data

Answer 987

GDPR

Question 988

Which best sends data to a specific remote port Netcat Route Grep Dig Tail

Answer 988

Netcat

Question 989

Ip sec, FTPs, NTPsec, ssh -Encrypt all data sent to terminal console -encrypt all voip phone call audio -gather performance metrics from switches and routers -Send files from workstation to a server -auto set time snd date on laptop -connect 2 sites using encrypted tynnel -securely authenticate users to a network resource

Answer 989

1. SSH 2. SRTP 3. SNMPv3 4. FTPS 5. NTPsec 6. IPsec 7. Ldaps

Question 990

Security admin wants to block users from visiting known malicious internet locations. Which provide this? Honeypot DNS sinkhole DLP Fake telemetry Embedded system

Answer 990

DNS sinkhole

Question 991

An application developer has embedded a certificate in a mobile app. Which best describes the app use of the certificate Self signed Stapling Pinning Hashing

Answer 991

Pinning

Question 992

Security assertion markup language (SAML)

Answer 992

Open standard to be able to gain authentication and authorization to a 3rd party’s resources Not for mobile apps

Question 993

Security admin needs to modify a portion of a systems boot sector. Which is the best for the task? Ftk imager Winhex Memdump Autopsy Dd

Answer 993

Winhex

Question 994

Which is the way to save energy in a data center? Air gap Hot and cold aisles East and west Ingress and egress

Answer 994

Hot and cold aisles

Question 995

Which of the following would be most likely to verify the entity requesting a certificate? OCSP Common name RA CRL

Answer 995

RA

Question 996

Ñame 3 business policies

Answer 996

Job rotation, mandatory vacation, separation of duties, dual control, clean desk policy

Question 997

Framework Core

Answer 997

This identifies, protects, detects, responds and recovers

Question 998

Security in cloud computing, not for profit organization

Answer 998

Cloud security alliance (CSA)

Question 999

Controls that are implemented by people is managerial controls

Answer 999

False, operational Managerial is security designs and and implementations, policies and SOP’s

Question 1000

Récord custodians are instructed to preserve data is what?

Answer 1000

Hold notification

Question 1001

But for bit copy and preserves all data, even if it as deleted

Answer 1001

Forensic clone (disc)

Question 1002

Ñame 2 types of data found in the RAM/memory dump

Answer 1002

Browsing history, clipboard information, encryption keys, command history

Question 1003

Ñame 2 artifact locations

Answer 1003

Log information Flash memory Prefetch cache files Recycle bins Browser bookmarks and logins

Question 1004

What is a difficulty with digital forensics in the cloud?

Answer 1004

Devices are not totally in your control There may be limited access Associate data with a specific user

Question 1005

What kind of attack is this, a virus alert appears in your browser from Microsoft with a phone number to call for support Vishing Hoax Spoofing On path

Answer 1005

Hoax

Question 1006

A computer room in a library that has a web server and a database server in it would use what 3 security controls? Locking cabinets Environmental sensors Biometric reader FDE Cable lock Smart card Video surveillance

Answer 1006

Locking cabinets Environmental sensors Video surveillance

Question 1007

A library employee is offsite using his laptop that contains PII. What 2 security controls should he use? Environmental sensors Video surveillance Biometric reader Locking cabinets Smart card FDE Cable lock

Answer 1007

FDE Biometric reader

Question 1008

An open area with laptop computers for a newspaper reading lab would use cable locks as security controls

Answer 1008

True

Question 1009

What secure network protocol would use to accept customer purchases from your primary website?

Answer 1009

HTTPS

Question 1010

Your login will not work unless you are connected to the VPN is something you can do

Answer 1010

False, somewhere you are

Question 1011

What 2 protocols use TLS to provide secure communication?

Answer 1011

HTTPS, FTPS

Question 1012

Daniel needs to know how often a firewall is expected to fail between repairs Mtbf RTO Mttr MTTF

Answer 1012

MTBF

Question 1013

What would provide a list of internal windows devices that have not installed the latest security patches and verification of encrypted data transfers?

Answer 1013

CASB

Question 1014

Name an an example of an approval list

Answer 1014

application hash- only allows apps with unique identifier Certificate- has to be digitally signed from publisher Path-only applications from specific folders Network zone- only from a specific zone

Question 1015

This typically has allowed lists built in Firewall Os Embedded system Concentrator

Answer 1015

OS

Question 1016

An online web conference is sent in real time to attendees is data in what? In use In transit At rest

Answer 1016

In transit

Question 1017

Authentication attempts to an AAA server is data what? In transit In use At rest

Answer 1017

In transit

Question 1018

An org is using the SSAE SOC 2 type II framework. Which is associated with this framework?

Answer 1018

System audit

Question 1019

A company is creating a security policy that will protect all corporate mobile devices Cope Cyod Mdm Mcm

Answer 1019

Mdm

Question 1020

The user adds 3 additional individuals to read only access to the file Mac ABAC Rbac Dac

Answer 1020

Dac

Question 1021

These need different tables for different hashing methods and aren’t useful if passwords are salted

Answer 1021

Rainbow tables

Question 1022

A security would like to verify systems can’t be accessed by former employees -Confirm that no authorized accounts have admin access -Validate lock out policy -Validate process/procedure for all outgoing employees -Create a report with all authentication for 24 hour period

Answer 1022

Validate process/procedure for all outgoing employees

Question 1023

This views data trends, alerts and correlations(view data in different ways)

Answer 1023

SIEM

Question 1024

NXlog

Answer 1024

Syslog daemon that collects many diverse logs

Question 1025

Memory is the 2nd most volatile

Answer 1025

True

Question 1026

Which risk management strategy would include purchase and installation of an NGFW? Transference Mitigation Acceptance Risk avoidance

Answer 1026

Mitigation

Question 1027

Mitre Attack

Answer 1027

-identify point of intrusion -understand method used to move around -identify potential security techniques to block future attacks

Question 1028

Which person in an org is responsible for managing access rights? Data processor Data owner Privacy officer Data custodian

Answer 1028

Data custodian

Question 1029

Vm in a screened subnet with guest login and no password would be the most likely reason? Server is a Honeypot Server is a Cloud storage Server is a VPN concentrator Server is a sandbox for 3party programming

Answer 1029

Server is a Honeypot

Question 1030

Company would like to securely deploy applications without overhead if installing a vm for each system. Containerization Iaas Segmentation Virtualization

Answer 1030

Containerization

Question 1031

How many drives does each below need? Raid 0 Raid 1 Raid 5

Answer 1031

2 2 3

Question 1032

Choose 3 security features for tablet and 3 for desktop with browser based front end with 2 authentication forms: Remote wipe, FDE, environmental factors, face recognition, locking cabinets, host based firewall, anti malware, smart card

Answer 1032

Tablet: remote wipe, FDE, face recognition Desktop: host based firewall, anti malware, smart card

Question 1033

Sales information is uploaded daily from a remote site using a satellite network is what type of data in?

Answer 1033

Data in Transit

Question 1034

Maintain uptime when power surges cause physical damage to one of the power supplies in a system Dual power supplies PDU PDS Hot swappable

Answer 1034

dual power supplies

Question 1035

This command would allow you to use a reverse lookup of an IPv4 address and see the IP address block owner

Answer 1035

Dig

Question 1036

Which would provide an attacker details about a company’s domain name and ip address? Information sharing center Vulnerability database AIS Open source intelligence

Answer 1036

Open source intelligence

Question 1037

Standard format and transfer mechanism for distributing security intelligence b/w different organizations Information sharing center AIS IOC Vulnerability database

Answer 1037

Automated indicator sharing

Question 1038

. To process the company payroll, a manager logs into a third-party browser-based application and enters the hours worked for each employee. The financial transfers and physical check mailings are all provided by the third-party company. The manager does not maintain any servers or virtual machines within his company. Which of the following would BEST describe this application model? A. PaaS B. Private C. SaaS D. IaaS

Answer 1038

SaaS

Question 1039

Modifies application source code and removes white spaces, shortens variable names and rearranges the text in compact form Confusion Obfuscation Encryption Diffusion

Answer 1039

Obfuscation

Question 1040

These logs may contain information about recent traffic flows to systems outside of corporate network

Answer 1040

Hips Host based firewall

Question 1041

An app developer is creating a mobile device app that will include extensive encryption and decryption is what?

Answer 1041

Elliptic curve, efficient for mobile devices

Question 1042

Tests Security devices by checking ips signatures and firewall rules, test ip flow/Netflow devices, evaluates performance of security devices

Answer 1042

Tcprelay

Question 1043

View’s application traffic, traffic patterns, identifies unknown traffic, verifies packet filtering and security controls

Answer 1043

Wire shark

Question 1044

Copy information in a system memory to the standard output stream

Answer 1044

Memdump

Question 1045

Certificate chaining starts with the SSL certificate and ends with the root certificate. What is a certificate in between the 2 called?

Answer 1045

Chain certificate or intermediate certificate

Question 1046

Common attack for this is the attacker making their system appear trusted with false ip addresses, caller id numbers and other ways to gain access to systems or information

Answer 1046

Spoofing

Question 1047

Encrypted data is drastically different than the plaintext is obfuscation

Answer 1047

False, confusion Obfuscation makes things unclear

Question 1048

CA verifies the entity requesting the certificate

Answer 1048

False, RA Certificate Authority deploys and managements certificates

Question 1049

Company is required to maintain 7 years of tax records. Which is best? A. Created automated script to remove tax info more than 7 years old B. Print and store all tax records in 7 year span C. Allie users to down tax records from account login D. Create separate daily backup archive for all applicable tax records

Answer 1049

D. Create separate daily backup archive for all applicable tax records

Question 1050

Security solution for end user devices to protect against malicious software and threats

Answer 1050

Endpoint detection response

Question 1051

It is common for vulnerability scans to show vulnerabilities that don’t actually exist and can be dismissed once the alert has been properly researched

Answer 1051

True, especially with non credentialed scans

Question 1052

Used with dedicated network exclusively to manage manufacturing equipment, power and water management systems

Answer 1052

Industrial control system ICS

Question 1053

Which is a common way to prevent exploitation of a root certificate? Certificate chaining CRL Certificate pinning Offline CA

Answer 1053

Offline CA, can’t hack if offline

Question 1054

Security admin thinks a user installed a rogue AP on corporate network. Which can confirm? Utm log WAF log Switch log DLP log

Answer 1054

Switch log

Question 1055

Incident response team is validating their disaster recovery plans without making changes to the infrastructure. Table top exercise Simulation Passive reconnaissance Exercise

Answer 1055

Table top exercise

Question 1056

Simulation often changes an existing system or infrastructure in order to properly test a simulated disaster

Answer 1056

True

Question 1057

Evaluates security of existing source code

Answer 1057

Static code analyzer

Question 1058

This would provide a specific filter that would prevent a web server from processing added data

Answer 1058

Input validation

Question 1059

Contract of long term temp employee is ending. Which is most important of off boarding process? -Perform on demand audit of user privileges -Archive decryption keys with user account -Document outstanding tasks -Obtain signed AUP

Answer 1059

Archive decryption keys with user account

Question 1060

System admin needs to provide os access to a web server executable. User Privileged Service Guest

Answer 1060

Service

Question 1061

Company maintains a scheduling app and a database in a virtualized cloud based environment. Which is best backup? Full Snapshot Differential Incremental

Answer 1061

Snapshot VM’s and virtual clouds specifically for this

Question 1062

In an environment with discretionary access control, which controls the rights and permissions associated with a file or directory? Admin Owner Group System

Answer 1062

Owner D.O. Chiedo

Question 1063

Determining if file transfers contain PII. Which describes data during a file transfer? In use In transit At rest Highly available

Answer 1063

In transit

Question 1064

System dev life cycle that focuses on creating content as quick as possible and refining the content until the final product is complete

Answer 1064

Agile

Question 1065

.. in a file path

Answer 1065

Parent directory Associated with directory traversal

Question 1066

Merges developed code, tests for issues, and auto moves the newly developed application to production without human intervention Continuous deployment Continuous of operations Continuous delivery Continuous integration

Answer 1066

Continuous deployment

Question 1067

Code constantly written and merged into central repository many times a day

Answer 1067

Continuous integration

Question 1068

An attacker sending a HTTP suspicious WebDAV (packet) is trying to do what?

Answer 1068

Trigger the IPs

Question 1069

Accesses a connection on a remote machine SSH Netcat Nmap LW thin client

Answer 1069

Netcat, also creates open connections and reads and writes information to the network

Question 1070

Most effective use of asymmetric encryption Real time video encryption Store passwords Protect data on mobile devices Securely derive a session key

Answer 1070

Securely derive a session key

Question 1071

It manager wants to prevent 3rd parties from gaining access to to info if a laptop is stolen. Which is best? Remote wipe FDE Biometrics Bios user password

Answer 1071

FDE

Question 1072

This firewall allows or denies based on expected input. Blocks unexpected input to exploit an application

Answer 1072

Web application firewall

Question 1073

-Physically disconnected the Ethernet cable on the database server -Disabled the unknown account • -Configured a firewall rule to prevent file transfers from the server Which incident response process? A. Eradication B. Containment C. Lessons learned D. Preparation

Answer 1073

B. Containment

Question 1074

Disconnecting compromised devices from the network, blocking malicious traffic is which of the incident response lifecycle? Detection analysis Containment Eradication Recovery

Answer 1074

Containment

Question 1075

Eradication is finding/eliminating the root cause of a security incident

Answer 1075

True

Question 1076

Which of the following is an authentication attribute? Something you have Somewhere you are Something you know Something you are

Answer 1076

Somewhere you are

Question 1077

What type of wireless network security limits access using physical hardware addresses? Geofencing WPS Geotagging Mac filtering

Answer 1077

Mac filtering

Question 1078

A system administrator has replaced a storage drive and restored a server from backup using a full backup and multiple additional tape sets. Which of the following would BEST describe this backup type? Differential Snapshot Full Incremental

Answer 1078

Incremental

Question 1079

A system administrator would like to identify all known vulnerabilities on a remote device. Which of the following would be the BEST choice for this task? Scanless Grep Nessus Dnseum

Answer 1079

Nessus

Question 1080

An attacker has circumvented a security control by modifying their MAC address. Which of the following would describe this attack type? Rogue AP Cloning Man in the middle Jamming

Answer 1080

Cloning

Question 1081

Which of these best describes authentication that is genuine with high confidence? Hashing Non repudiation Integrity AH

Answer 1081

Non repudiation

Question 1082

Which of the following would be the best way to prevent a worm entering the network through a USB flash drive Screened subnet NGFW DLP WAF

Answer 1082

DLP

Question 1083

Which of the following is commonly used to verify device drivers during Windows startup?

Answer 1083

ELAM

Question 1084

A company has determined that laptops valued at $50,000 have been stolen over the last calendar year. Which of the following would describe this value? ALE ARO SLE CER

Answer 1084

Annual loss expectancy

Question 1085

Infrastructure is handled by the provider in SaaS

Answer 1085

True, you use both the providers software and infrastructure IaaS you would only use the providers infrastructure but be in charge of your own software

Question 1086

Saas is like going to a restaurant and they make your meal for you PaaS is like going to an open kitchen where you have full access to cook your own meal

Answer 1086

True

Question 1087

Which control is security designs and and implementations, policies and SOP’s

Answer 1087

Managerial

Question 1088

This allows, monitors, and terminates connections between the trusted and untrusted systems.

Answer 1088

A policy enforcement

Question 1089

PII and PHI are classified/private information

Answer 1089

False, sensitive

Question 1090

Buying cybersecurity insurance is which risk management strategy?

Answer 1090

Transference Mitigation would be investing in security systems

Question 1091

is public discourse correlated to real world behavior/hate you they hack you/social media as barometer

Answer 1091

Sentiment analysis

Question 1092

SSL, intermediary and root certificate make up what?

Answer 1092

Certificate chain

Question 1093

Both sides agree to contents, includes a confidentiality statement, informal letter of intent, not signed contract

Answer 1093

Memorandum of understanding

Question 1094

BPA

Answer 1094

Business partnership agreement Going into business together, owner stake, financial contract, decision agreements, contingency preparation

Question 1095

Name 2 control objectives for PCI DSS

Answer 1095

-build and maintain a secure network and systems -protect cardholder data -maintain a vulnerability management program -implement strong access control measures -regularly monitor and test networks -maintain an information security policy

Question 1096

Records custodians are instructed to preserve data is what?

Answer 1096

Hold notification

Question 1097

In a legal hold, what has many different data sources and types/a unique workflow and retention requirements?

Answer 1097

Electronically stored information ESI

Question 1098

Record time offsets from the OS

Answer 1098

True, Windows registry

Question 1099

/var/log Event Viewer

Answer 1099

Log store for Linux Windows

Question 1100

In volatility ñame all in the 2nd and fifth most volatile

Answer 1100

2. Router table, kernel statistics, memory, process, ARP cache 5. Remote logging and monitoring data

Question 1101

What do you connect to a disk?

Answer 1101

Imaging device with write protection

Question 1102

What transfers pages of RAM to a storage device?

Answer 1102

Swap/pagefile Place to store ram when memory is depleted

Question 1103

Deleted files Hidden data Hardware or software corruption Storage device is physically damaged

Answer 1103

Data recovery process

Question 1104

The 2 parties can verify non repudiation through a use of what?

Answer 1104

Message authentication code MAC

Question 1105

CASB

Answer 1105

CASB you implement to -enforce security policies, -monitor user activities, -and protect sensitive data in the cloud?

Question 1106

Which logs are stored in binary format?

Answer 1106

System

Question 1107

Determines route a packet takes to a destination is what command?

Answer 1107

Traceroute Maps entire path

Question 1108

This command performs port, os and service scans and additional scripts

Answer 1108

Nmap

Question 1109

ARP on local subnet, ICMP requests, TCP ACK, and ICMP timestamp requests are techniques for what tool?

Answer 1109

Ip scanner

Question 1110

Uses cmdlets to extend command line functions

Answer 1110

Windows power shell

Question 1111

To create a key pair you send the private key to the CA to be signed

Answer 1111

False, public