239 terms

SYO-401 TEST

STUDY
PLAY

Terms in this set (...)

Which of the following protocols operates at the HIGHEST level of the OSI model?
SCP
Joe, the system administrator, has been asked to calculate the Annual Loss Expectancy (ALE) for a $5,000 server, which often crashes. In the past year, the server has crashed 10 times, requiring a system reboot to recover with only 10% loss of data or function. Which of the following is the ALE of this server?
$5,000
Which of the following should an administrator implement to research current attack methodologies?
Honeypot
Which of the following can be implemented in hardware or software to protect a web server from cross-site scripting attacks?
Web Application Firewall
Which of the following means of wireless authentication is easily vulnerable to spoofing?
MAC Filtering
The BEST methods for a web developer to prevent the website application code from being vulnerable to cross-site request forgery (XSRF) are to: (Select TWO).
Validate and filter input on the server side and client side.
Restrict and sanitize use of special characters in input and URLs.
Jane, a security administrator, needs to implement a secure wireless authentication method that uses a remote RADIUS server for authentication.
Which of the following is an authentication method Jane should use?
LEAP
Computer evidence at a crime scene is documented with a tag stating who had possession of the evidence at a given time.
Which of the following does this illustrate?
Chain of custody
A network administrator is configuring access control for the sales department which has high employee turnover. Which of the following is BEST suited when assigning user rights to individuals in the sales department?
Group based privileges
Which of the following is being tested when a company's payroll server is powered off for eight hours?
Continuity of operations plan
Which of the following preventative controls would be appropriate for responding to a directive to reduce the attack surface of a specific host?
Disabling unnecessary services
A security manager must remain aware of the security posture of each system. Which of the following supports this requirement?
Establishing baseline reporting
Deploying a wildcard certificate is one strategy to:
reduce the certificate management burden.
The security administrator needs to manage traffic on a layer 3 device to support FTP from a new remote site. Which of the following would need to be implemented?
Access control lists
Which of the following ports is used for SSH, by default?
22
A network administrator has been tasked with securing the WLAN. Which of the following cryptographic products would be used to provide the MOST secure environment for the WLAN?
WPA2 CCMP
A server with the IP address of 10.10.2.4 has been having intermittent connection issues. The logs show repeated connection attempts from the following IPs:
10.10.3.16
10.10.3.23
212.178.24.26
217.24.94.83
These attempts are overloading the server to the point that it cannot respond to traffic.
Which of the following attacks is occurring?
DDoS
Which of the following ciphers would be BEST used to encrypt streaming video?
RC4
A user attempting to log on to a workstation for the first time is prompted for the following information before being granted access: username, password, and a four-digit security pin that was mailed to him during account registration. This is an example of which of the following?
Single factor authentication
After analyzing and correlating activity from multiple sensors, the security administrator has determined that a group of very well organized individuals from an enemy country is responsible for various attempts to breach the company network, through the use of very sophisticated and targeted attacks. Which of the following is this an example of?
Advanced persistent threat
Which of the following is true about input validation in a client-server architecture, when data integrity is critical to the organization?
It should be performed on the server side.
A merchant acquirer has the need to store credit card numbers in a transactional database in a high performance environment. Which of the following BEST protects the credit card data?
Database field encryption
A bank has a fleet of aging payment terminals used by merchants for transactional processing. The terminals currently support single DES but require an upgrade in order to be compliant with security standards. Which of the following is likely to be the simplest upgrade to the aging terminals which will improve in-transit protection of transactional data?
3DES
Which of the following is BEST at blocking attacks and providing security at layer 7 of the OSI model?
WAF
Which of the following is BEST used to capture and analyze network traffic between hosts on the same network segment?
Protocol analyzer
A datacenter requires that staff be able to identify whether or not items have been removed from the facility. Which of the following controls will allow the organization to provide automated notification of item removal?
RFID
A malicious person gained access to a datacenter by ripping the proximity badge reader off the wall near the datacenter entrance. This caused the electronic locks on the datacenter door to release because the:
system was designed to fail open for life-safety.
The concept of rendering data passing between two points over an IP based network impervious to all but the most sophisticated advanced persistent threats is BEST categorized as which of the following?
Transport encryption
On Monday, all company employees report being unable to connect to the corporate wireless network, which uses 802.1x with PEAP. A technician verifies that no configuration changes were made to the wireless network and its supporting infrastructure, and that there are no outages. Which of the following is the MOST likely cause for this issue?
The Remote Authentication Dial-In User Service server certificate has expired.
Which of the following would BEST deter an attacker trying to brute force 4-digit PIN numbers to access an account at a bank teller machine?
Account lockout settings
An administrator discovers that many users have used their same passwords for years even though the network requires that the passwords be changed every six weeks. Which of the following, when used together, would BEST prevent users from reusing their existing password? (Select TWO).
Password History
Minimum password age
A recent audit has discovered that at the time of password expiration clients are able to recycle the previous credentials for authentication. Which of the following controls should be used together to prevent this from occurring? (Select TWO).
Password age
Password history
A system administrator is configuring UNIX accounts to authenticate against an external server. The configuration file asks for the following information DC=ServerName and DC=COM. Which of the following authentication services is being used?
LDAP
In Kerberos, the Ticket Granting Ticket (TGT) is used for which of the following?
Authentication
Which of the following network design elements allows for many internal devices to share one public IP address?
PAT
Which of the following components of an all-in-one security appliance would MOST likely be configured in order to restrict access to peer-to-peer file sharing websites?
URL filter
When considering a vendor-specific vulnerability in critical industrial control systems which of the following techniques supports availability?
Incorporating diversity into redundant design
During the information gathering stage of a deploying role-based access control model, which of the following information is MOST likely required?
Matrix of job titles with required access privileges
The Chief Technical Officer (CTO) has been informed of a potential fraud committed by a database administrator performing several other job functions within the company. Which of the following is the BEST method to prevent such activities in the future?
Separation of duties
Ann would like to forward some Personal Identifiable Information to her HR department by email, but she is worried about the confidentiality of the information. Which of the following will accomplish this task securely?
Encryption
A company is trying to limit the risk associated with the use of unapproved USB devices to copy documents. Which of the following would be the BEST technology control to use in this scenario?
DLP
A recently installed application update caused a vital application to crash during the middle of the workday. The application remained down until a previous version could be reinstalled on the server, and this resulted in a significant loss of data and revenue.
Which of the following could BEST prevent this issue from occurring again?
Application patch management
A security administrator wishes to increase the security of the wireless network. Which of the following BEST addresses this concern?
Change the encryption from TKIP-based to CCMP-based.
The system administrator has deployed updated security controls for the network to limit risk of attack. The security manager is concerned that controls continue to function as intended to maintain appropriate security posture.
Which of the following risk mitigation strategies is MOST important to the security manager?
Routine audits
A company is about to release a very large patch to its customers. An administrator is required to test patch installations several times prior to distributing them to customer PCs.
Which of the following should the administrator use to test the patching process quickly and often?
Create a virtualized sandbox and utilize snapshots
An auditing team has found that passwords do not meet best business practices. Which of the following will MOST increase the security of the passwords? (Select TWO).
Password Complexity
Password Length
A vulnerability scan is reporting that patches are missing on a server. After a review, it is determined that the application requiring the patch does not exist on the operating system.
Which of the following describes this cause?
False positive
Company A submitted a bid on a contract to do work for Company B via email. Company B was insistent that the bid did not come from Company A. Which of the following would have assured that the bid was submitted by Company A?
Digital Signatures
Ann, a sales manager, successfully connected her company-issued smartphone to the wireless network in her office without supplying a username/password combination. Upon disconnecting from the wireless network, she attempted to connect her personal tablet computer to the same wireless network and could not connect.
Which of the following is MOST likely the reason?
The company wireless is using a MAC filter.
A network technician is on the phone with the system administration team. Power to the server room was lost and servers need to be restarted. The DNS services must be the first to be restarted. Several machines are powered off. Assuming each server only provides one service, which of the following should be powered on FIRST to establish DNS services?
Bind server
A security administrator is reviewing the company's continuity plan. The plan specifies an RTO of six hours and RPO of two days. Which of the following is the plan describing?
Systems should be restored within six hours with a minimum of two days worth of data
The incident response team has received the following email message.
From: monitor@ext-company.com
To: security@company.com
Subject: Copyright infringement
A copyright infringement alert was triggered by IP address 13.10.66.5 at 09: 50: 01 GMT.
After reviewing the following web logs for IP 13.10.66.5, the team is unable to correlate and identify the incident.
09: 45: 33 13.10.66.5 http: //remote.site.com/login.asp?user=john
09: 50: 22 13.10.66.5 http: //remote.site.com/logout.asp?user=anne
10: 50: 01 13.10.66.5 http: //remote.site.com/access.asp?file=movie.mov
11: 02: 45 13.10.65.5 http: //remote.site.com/download.asp?movie.mov=ok
Which of the following is the MOST likely reason why the incident response team is unable to identify and correlate the incident?
Incident time offsets were not accounted for.
A server dedicated to the storage and processing of sensitive information was compromised with a rootkit and sensitive data was exfiltrated. Which of the following incident response procedures is best suited to restore the server?
Wipe the storage, reinstall the OS from original media and restore the data from the last known
good backup.
Which of the following describes a type of malware which is difficult to reverse engineer in a virtual lab?
Armored virus
Using a heuristic system to detect an anomaly in a computer's baseline, a system administrator was able to detect an attack even though the company signature based IDS and antivirus did not detect it. Further analysis revealed that the attacker had downloaded an executable file onto the company PC from the USB port, and executed it to trigger a privilege escalation flaw.
Which of the following attacks has MOST likely occurred?
Zero-day
After copying a sensitive document from his desktop to a flash drive, Joe, a user, realizes that the document is no longer encrypted. Which of the following can a security technician implement to ensure that documents stored on Joe's desktop remain encrypted when moved to external media or other network based storage?
File level encryption
A security administrator must implement a system to allow clients to securely negotiate encryption keys with the company's server over a public unencrypted communication channel. Which of the following implements the required secure key negotiation? (Select TWO).
ECDHE
Diffie-Hellman
Acme Corp has selectively outsourced proprietary business processes to ABC Services. Due to some technical issues, ABC services wants to send some of Acme Corp's debug data to a third party vendor for problem resolution. Which of the following MUST be considered prior to sending data to a third party?
This may violate data ownership and non-disclosure agreements
An organization has introduced token-based authentication to system administrators due to risk of password compromise. The tokens have a set of numbers that automatically change every 30 seconds. Which of the following type of authentication mechanism is this?
TOTP
An administrator wants to establish a WiFi network using a high gain directional antenna with a narrow radiation pattern to connect two buildings separated by a very long distance. Which of the following antennas would be BEST for this situation?
Yagi
An attacker used an undocumented and unknown application exploit to gain access to a file server. Which of the following BEST describes this type of attack?
Zero-day
Which of the following is an XML based open standard used in the exchange of authentication and authorization information between different parties?
SAML
Which of the following ports and protocol types must be opened on a host with a host- based firewall to allow incoming SFTP connections?
22/TCP
A user, Ann, is reporting to the company IT support group that her workstation screen is blank other than a window with a message requesting payment or else her hard drive will be formatted. Which of the following types of malware is on Ann's workstation?
Ransomware
Which of the following controls can be implemented together to prevent data loss in the event of theft of a mobile device storing sensitive information? (Select TWO).
Full device encryption
Screen locks
A way to assure data at-rest is secure even in the event of loss or theft is to usE.
full device encryption.
A security audit identifies a number of large email messages being sent by a specific user from their company email account to another address external to the company. These messages were sent prior to a company data breach, which prompted the security audit. The user was one of a few people who had access to the leaked data. Review of the suspect's emails show they consist mostly of pictures of the user at various locations during a recent vacation. No suspicious activities from other users who have access to the data were discovered.
Which of the following is occurring?
The user is using steganography.
A security analyst is reviewing firewall logs while investigating a compromised web server.
The following ports appear in the log.
22, 25, 445, 1433, 3128, 3389, 6667
Which of the following protocols was used to access the server remotely?
RDP
An organization does not want the wireless network name to be easily discovered. Which of the following software features should be configured on the access points?
SSID broadcast
A computer is suspected of being compromised by malware. The security analyst examines the computer and finds that a service called Telnet is running and connecting to an external website over port 443. This Telnet service was found by comparing the system's services to the list of standard services on the company's system image. This review process depends on:
baselining.
A software developer wants to prevent stored passwords from being easily decrypted. When the password is stored by the application, additional text is added to each password before the password is hashed. This technique is known as:
salting.
In which of the following steps of incident response does a team analyze the incident and determine steps to prevent a future occurrence?
Lessons learned
A security technician has been asked to recommend an authentication mechanism that will allow users to authenticate using a password that will only be valid for a predefined time interval. Which of the following should the security technician recommend?
TOTP
A security administrator must implement a wireless encryption system to secure mobile devices' communication. Some users have mobile devices which only support 56-bit encryption. Which of the following wireless encryption methods should be implemented?
RC4
After a security incident involving a physical asset, which of the following should be done at the beginning?
Record every person who was in possession of assets, continuing post-incident.
Which of the following is the GREATEST security risk of two or more companies working together under a Memorandum of Understanding?
MOUs are generally loose agreements and therefore may not have strict guidelines in place to protect sensitive data between the two entities.
Joe, a user, reports to the system administrator that he is receiving an error stating his certificate has been revoked. Which of the following is the name of the database repository for these certificates?
CRL
A software company has completed a security assessment. The assessment states that the company should implement fencing and lighting around the property. Additionally, the assessment states that production releases of their software should be digitally signed. Given the recommendations, the company was deficient in which of the following core security areas? (Select TWO).
Integrity
Safety
A user was reissued a smart card after the previous smart card had expired. The user is able to log into the domain but is now unable to send digitally signed or encrypted email. Which of the following would the user need to perform?
Publish the new certificates to the global address list.
Users are encouraged to click on a link in an email to obtain exclusive access to the newest version of a popular Smartphone. This is an example of.
scarcity
Which of the following types of attacks involves interception of authentication traffic in an attempt to gain unauthorized access to a wireless network?
IV attack
Which of the following is a BEST practice when dealing with user accounts that will only need to be active for a limited time period?
When creating the account, set an expiration date on the account.
Which of the following types of authentication packages user credentials in a ticket?
Kerberos
Which of the following is required to allow multiple servers to exist on one physical server
Virtualization
Several employees submit the same phishing email to the administrator. The administrator finds that the links in the email are not being blocked by the company's security device. Which of the following might the administrator do in the short term to prevent the emails from being received?
Add the domain to a block list
A company has several conference rooms with wired network jacks that are used by both employees and guests. Employees need access to internal resources and guests only need access to the Internet. Which of the following combinations is BEST to meet the requirements?
802.1x and VLANs
LDAP and Kerberos are commonly used for which of the following?
To utilize single sign-on capabilities
An administrator needs to renew a certificate for a web server. Which of the following should be submitted to a CA?
CSR
An administrator needs to submit a new CSR to a CA. Which of the following is a valid FIRST step?
Generate a new private key based on RSA.
The security team would like to gather intelligence about the types of attacks being launched against the organization. Which of the following would provide them with the MOST information?
Implement a honeynet
After recovering from a data breach in which customer data was lost, the legal team meets with the Chief Security Officer (CSO) to discuss ways to better protect the privacy of customer data.
Which of the following controls support this goal?
Encryption and stronger access control
A security engineer, Joe, has been asked to create a secure connection between his mail server and the mail server of a business partner. Which of the following protocol would be MOST appropriate?
TLS
A new network administrator is setting up a new file server for the company. Which of the following would be the BEST way to manage folder security?
Create security groups for each folder and assign appropriate users to each group
A recent vulnerability scan found that Telnet is enabled on all network devices. Which of the following protocols should be used instead of Telnet?
SSH
A network engineer is setting up a network for a company. There is a BYOD policy for the employees so that they can connect their laptops and mobile devices.
Which of the following technologies should be employed to separate the administrative network from the network in which all of the employees' devices are connected?
VLAN
A network administrator is asked to send a large file containing PII to a business associate. Which of the following protocols is the BEST choice to use?
SFTP
When performing the daily review of the system vulnerability scans of the network Joe, the administrator, noticed several security related vulnerabilities with an assigned vulnerability identification number. Joe researches the assigned vulnerability identification number from the vendor website. Joe proceeds with applying the recommended solution for identified vulnerability.
Which of the following is the type of vulnerability described?
Signature based
A malicious individual is attempting to write too much data to an application's memory. Which of the following describes this type of attack?
Buffer overflow
Ann, a security administrator, wishes to replace their RADIUS authentication with a more secure protocol, which can utilize EAP. Which of the following would BEST fit her objective?
Diameter
Ann, a security administrator, has concerns regarding her company's wireless network. The network is open and available for visiting prospective clients in the conference room, but she notices that many more devices are connecting to the network than should be.
Which of the following would BEST alleviate Ann's concerns with minimum disturbance of current functionality for clients?
Lower the antenna's broadcasting power.
A distributed denial of service attack can BEST be described as:
multiple computers attacking a single target in an organized attempt to deplete its resources
Joe analyzed the following log and determined the security team should implement which of the following as a mitigation method against further attempts?
Host 192.168.1.123
[00: 00: 01]Successful Login: 015 192.168.1.123 : local
[00: 00: 03]Unsuccessful Login: 022 214.34.56.006 : RDP 192.168.1.124
[00: 00: 04]UnSuccessful Login: 010 214.34.56.006 : RDP 192.168.1.124
[00: 00: 07]UnSuccessful Login: 007 214.34.56.006 : RDP 192.168.1.124
[00: 00: 08]UnSuccessful Login: 003 214.34.56.006 : RDP 192.168.1.124
Hardening
A computer supply company is located in a building with three wireless networks. The system security team implemented a quarterly security scan and saw the following.
SSID State Channel Level
Computer AreUs1 connected 1 70dbm
Computer AreUs2 connected 5 80dbm
Computer AreUs3 connected 3 75dbm
Computer AreUs4 connected 6 95dbm
Which of the following is this an example of?
Rogue access point
A systems administrator has implemented PKI on a classified government network. In the event that a disconnect occurs from the primary CA, which of the following should be accessible locally from every site to ensure users with bad certificates cannot gain access to the network?
A CRL
While configuring a new access layer switch, the administrator, Joe, was advised that he needed to make sure that only devices authorized to access the network would be permitted to login and utilize resources. Which of the following should the administrator implement to ensure this happens?
802.1x
A vulnerability assessment indicates that a router can be accessed from default port 80 and default port 22. Which of the following should be executed on the router to prevent access via these ports? (Select TWO).
SSH service should be disabled
HTTP service should disabled
Results from a vulnerability analysis indicate that all enabled virtual terminals on a router can be accessed using the same password. The company's network device security policy mandates that at least one virtual terminal have a different password than the other virtual terminals. Which of the following sets of commands would meet this requirement?
line vty 0 3 password Qwer++!Y line vty 4 password P@s5W0Rd
Joe, an employee, was escorted from the company premises due to suspicion of revealing trade secrets to a competitor. Joe had already been working for two hours before leaving the premises. A security technician was asked to prepare a report of files that had changed since last night's integrity scan. Which of the following could the technician use to prepare the report? (Select TWO).
MDS
HMAC
Ann has read and write access to an employee database, while Joe has only read access. Ann is leaving for a conference. Which of the following types of authorization could be utilized to trigger write access for Joe when Ann is absent?
Rule-based access control
Human Resources suspects an employee is accessing the employee salary database. The administrator is asked to find out who it is. In order to complete this task, which of the following is a security control that should be in place?
Shared accounts should be prohibited.
An administrator finds that non-production servers are being frequently compromised, production servers are rebooting at unplanned times and kernel versions are several releases behind the version with all current security fixes. Which of the following should the administrator implement?
Patch management
An auditor's report discovered several accounts with no activity for over 60 days. The accounts were later identified as contractors' accounts who would be returning in three months and would need to resume the activities. Which of the following would mitigate and secure the auditors finding?
Disable unnecessary contractor accounts and inform the auditor of the update.
Ann, the security administrator, wishes to implement multifactor security. Which of the following should be implemented in order to compliment password usage and smart cards?
Fingerprint readers
Customers' credit card information was stolen from a popular video streaming company. A security consultant determined that the information was stolen, while in transit, from the gaming consoles of a particular vendor. Which of the following methods should the company consider to secure this data in the future?
Encrypted TCP wrappers
A new intern was assigned to the system engineering department, which consists of the system architect and system software developer's teams. These two teams have separate privileges. The intern requires privileges to view the system architectural drawings and comment on some software development projects. Which of the following methods should the system administrator implement?
Group based privileges
One of the system administrators at a company is assigned to maintain a secure computer lab. The administrator has rights to configure machines, install software, and perform user account maintenance. However, the administrator cannot add new computers to the domain, because that requires authorization from the Information Assurance Officer. This is an example of which of the following?
Least privilege
A small business needs to incorporate fault tolerance into their infrastructure to increase data availability. Which of the following options would be the BEST solution at a minimal cost?
RAID
A new application needs to be deployed on a virtual server. The virtual server hosts a SQL server that is used by several employees.
Which of the following is the BEST approach for implementation of the new application on the virtual server?
Take a snapshot of the virtual server before installing the new application and store the snapshot in
a secure location
Ann wants to send a file to Joe using PKI. Which of the following should Ann use in order to sign the file?
Ann's private key
Which of the following protocols is used to validate whether trust is in place and accurate by returning responses of either "good", "unknown", or "revoked"?
OCSP
During a recent investigation, an auditor discovered that an engineer's compromised workstation was being used to connect to SCADA systems while the engineer was not logged in. The engineer is responsible for administering the SCADA systems and cannot be blocked from connecting to them. The SCADA systems cannot be modified without vendor approval which requires months of testing.
Which of the following is MOST likely to protect the SCADA systems from misuse?
Deploy NIPS at the edge of the SCADA network
A security administrator must implement a network authentication solution which will ensure encryption of user credentials when users enter their username and password to authenticate to the network.
Which of the following should the administrator implement?
WEP over EAP-PEAP
Several employees have been printing files that include personally identifiable information of customers. Auditors have raised concerns about the destruction of these hard copies after they are created, and management has decided the best way to address this concern is by preventing these files from being printed.
Which of the following would be the BEST control to implement?
Data loss prevention
The company's sales team plans to work late to provide the Chief Executive Officer (CEO) with a special report of sales before the quarter ends. After working for several hours, the team finds they cannot save or print the reports.
Which of the following controls is preventing them from completing their work?
Time of Day access control
A security engineer is asked by the company's development team to recommend the most secure method for password storage.
Which of the following provide the BEST protection against brute forcing stored passwords? (Select TWO).
PBKDF2
Bcrypt
After entering the following information into a SOHO wireless router, a mobile device's user reports being unable to connect to the network:
PERMIT 0A: D1: FA. B1: 03: 37
DENY 01: 33: 7F: AB: 10: AB
Which of the following is preventing the device from connecting?
Hardware address filtering is blocking the device.
The call center supervisor has reported that many employees have been playing preinstalled games on company computers and this is reducing productivity.
Which of the following would be MOST effective for preventing this behavior?
Application whitelisting
When creating a public / private key pair, for which of the following ciphers would a user need to specify the key strength?
RSA
A company has decided to move large data sets to a cloud provider in order to limit the costs of new infrastructure. Some of the data is sensitive and the Chief Information Officer wants to make sure both parties have a clear understanding of the controls needed to protect the data.
Which of the following types of interoperability agreement is this?
ISA
Which of the following solutions provides the most flexibility when testing new security controls prior to implementation?
Virtualization
Which of the following authentication services requires the use of a ticket-granting ticket (TGT) server in order to complete the authentication process?
Kerberos
Drag and drop the correct protocol to its default port.
A forensic analyst is asked to respond to an ongoing network attack on a server. Place the items in the list below in the correct order in which the forensic analyst should preserve them.
Matching
Hotspot Question
Select the appropriate attack from each drop down list to label the corresponding illustrated attack
Instructions: Attacks may only be used once, and will disappear from drop down list if selected. When you have completed the simulation, please select the Done button to submit.
Matching
A Security administrator wants to implement strong security on the company smart phones and terminal servers located in the data center. Drag and Drop the applicable controls to each asset type.
Instructions: Controls can be used multiple times and not all placeholders needs to be filled. When you have completed the simulation, Please select Done to submit.
fill in the blanks
Which of the following is a hardware based encryption device?
TPM
Which of the following BEST describes a protective countermeasure for SQL injection?
Validating user input in web applications
Types of Security
Which of the following MOST interferes with network-based detection techniques?
SS
A certificate authority takes which of the following actions in PKI?
...
Use of a smart card to authenticate remote servers remains MOST susceptible to which of the following attacks?
Malicious code on the local system
Separation of duties is often implemented between developers and administrators in order to separate which of the following?
Changes to program code and the ability to deploy to production
A security administrator needs to update the OS on all the switches in the company. Which of the following MUST be done before any actual switch configuration is performed?
The request needs to be approved through the change management process.
Jane, an individual, has recently been calling various financial offices pretending to be another person to gain financial information. Which of the following attacks is being described?
Vishing
A user in the company is in charge of various financial roles but needs to prepare for an upcoming audit. They use the same account to access each financial system. Which of the following security controls will MOST likely be implemented within the company?
Separation of duties
A CRL is comprised oF.
Public keys.
Sara, a user, downloads a keygen to install pirated software. After running the keygen, system performance is extremely slow and numerous antivirus alerts are displayed. Which of the following BEST describes this type of malware?
Trojan
Which of the following may significantly reduce data loss if multiple drives fail at the same time?
RAID
Which of the following should be considered to mitigate data theft when using CAT5 wiring?
EMI shielding
To help prevent unauthorized access to PCs, a security administrator implements screen savers that lock the PC after five minutes of inactivity. Which of the following controls is being described in this situation?
Technical
Pete, a network administrator, is capturing packets on the network and notices that a large amount of the traffic on the LAN is SIP and RTP protocols. Which of the following should he do to segment that traffic from the other traffic?
Create a voice VLAN.
Which of the following IP addresses would be hosts on the same subnet given the subnet mask 255.255.255.224?
10.4.4.165
10.4.4.189
Which of the following algorithms has well documented collisions? (Select TWO).
MDS
SHA
Which of the following is BEST used as a secure replacement for TELNET?
SSH
An email client says a digital signature is invalid and the sender cannot be verified. The recipient is concerned with which of the following concepts?
Integrity
Which of the following is an effective way to ensure the BEST temperature for all equipment within a datacenter?
Hot or cool aisle containment
Which of the following transportation encryption protocols should be used to ensure maximum security between a web browser and a web server?
TLS
Developers currently have access to update production servers without going through an approval process. Which of the following strategies would BEST mitigate this risk?
Change management
Which of the following is a difference between TFTP and FTP?
TFTP utilizes UDP and FTP uses TCP.
Matt, an administrator, notices a flood fragmented packet and retransmits from an email server. After disabling the TCP offload setting on the NIC, Matt sees normal traffic with packets flowing in sequence again. Which of the following utilities was he MOST likely using to view this issue?
Protocol analyzer
Which of the following is characterized by an attacker attempting to map out an organization's staff hierarchy in order to send targeted emails?
Whaling
Which of the following would a security administrator implement in order to discover comprehensive security threats on a network?
Vulnerability scan
Which of the following is an example of a false positive?
Anti-virus identifies a benign application as malware.
Data execution prevention is a feature in most operating systems intended to protect against which type of attack?
Buffer overflow
Use of group accounts should be minimized to ensure which of the following?
Individual accountability
Privilege creep among long-term employees can be mitigated by which of the following procedures?
User permission reviews
In which of the following scenarios is PKI LEAST hardened?
A malicious CA certificate is loaded on all the clients.
Configuring the mode, encryption methods, and security associations are part of which of the following?
IPSec
Which of the following assessments would Pete, the security administrator, use to actively test that an application's security controls are in place?
Penetration test
A security administrator has just finished creating a hot site for the company. This implementation relates to which of the following concepts?
Availability
In the initial stages of an incident response, Matt, the security administrator, was provided the hard drives in question from the incident manager. Which of the following incident response procedures would he need to perform in order to begin the analysis? (Select TWO).
Take hashes
Capture the system image
Which of the following is used to certify intermediate authorities in a large PKI deployment?
Root CA
Which of the following components MUST be trusted by all parties in PKI?
CA
Which of the following should Matt, a security administrator, include when encrypting smartphones? (Select TWO).
Internal memory
Removable memory cards
Which of the following is the below pseudo-code an example of?
IF VARIABLE (CONTAINS NUMBERS = TRUE) THEN EXIT
Input validation
A system administrator is using a packet sniffer to troubleshoot remote authentication. The administrator detects a device trying to communicate to TCP port 49. Which of the following authentication methods is MOST likely being attempted?
TACACS+
Which of the following can use RC4 for encryption? (Select TWO).
SSL
WEP
Which of the following defines a business goal for system restoration and acceptable data loss?
RPO
If Organization A trusts Organization B and Organization B trusts Organization C, then Organization A trusts Organization C. Which of the following PKI concepts is this describing?
Transitive trust
Which of the following concepts is BEST described as developing a new chain of command in the event of a contingency?
Succession planning
Which of the following allows a company to maintain access to encrypted resources when employee turnover is high?
Recovery agent
Which of the following devices will help prevent a laptop from being removed from a certain location?
Cable locks
Which of the following is the MOST secure protocol to transfer files?
FTPS
Suspicious traffic without a specific signature was detected. Under further investigation, it was determined that these were false indicators. Which of the following security devices needs to be configured to disable future false alarms?
Anomaly based IDS
A company storing data on a secure server wants to ensure it is legally able to dismiss and prosecute staff who intentionally access the server via Telnet and illegally tamper with customer data. Which of the following administrative controls should be implemented to BEST achieve this?
Warning banners
Which of the following protocols is used to authenticate the client and server's digital certificate?
TLS
Which of the following can be used to mitigate risk if a mobile device is lost?
Strong passwords
Which of the following security concepts would Sara, the security administrator, use to mitigate the risk of data loss?
Clean desk policy
Which of the following is an example of multifactor authentication?
Credit card and PIN
After Matt, a user, enters his username and password at the login screen of a web enabled portal, the following appears on his screen:
`Please only use letters and numbers on these fields'
Which of the following is this an example of?
Proper input validation
Which of the following should the security administrator implement to limit web traffic based on country of origin? (Select THREE).
Proxies
Firewall
URL filtering
Several bins are located throughout a building for secure disposal of sensitive information.
Which of the following does this prevent?
Dumpster diving
Matt, a developer, recently attended a workshop on a new application. The developer installs the new application on a production system to test the functionality. Which of the following is MOST likely affected?
Initial baseline configuration
Sara, a company's security officer, often receives reports of unauthorized personnel having access codes to the cipher locks of secure areas in the building. Sara should immediately implement which of the following?
Security awareness training
Mike, a network administrator, has been asked to passively monitor network traffic to the company's sales websites. Which of the following would be BEST suited for this task?
NIPS
Mike, a security professional, is tasked with actively verifying the strength of the security controls on a company's live modem pool. Which of the following activities is MOST appropriate?
War dialing
Users at a company report that a popular news website keeps taking them to a web page with derogatory content. This is an example of which of the following?
DNS poisoning
An encrypted message is sent using PKI from Sara, a client, to a customer. Sara claims she never sent the message. Which of the following aspects of PKI BEST ensures the identity of the sender?
Non-repudiation
Jane, a security administrator, has observed repeated attempts to break into a server. Which of the following is designed to stop an intrusion on a specific server?
HIPS
Matt, the IT Manager, wants to create a new network available to virtual servers on the same hypervisor, and does not want this network to be routable to the firewall. How could this BEST be accomplished?
Create a virtual switch.
A security administrator implements access controls based on the security classification of the data and need-to-know information. Which of the following BEST describes this level of access control?
Mandatory Access Controls
A security administrator has configured FTP in passive mode. Which of the following ports should the security administrator allow on the firewall by default?
21
Which of the following could cause a browser to display the message below?
"The security certificate presented by this website was issued for a different website's address."
A. The website certificate was issued by a different CA than what the browser recognizes in its trusted CAs.
HTTPS://127.0.01 was used instead of HTTPS://localhost.
A company that purchased an HVAC system for the datacenter is MOST concerned with which of the following?
Availability
Which of the following pseudocodes can be used to handle program exceptions?
If program module crashes, then restart program module.
Which of the following technologies uses multiple devices to share work?
Load balancing
Which of the following protocols uses an asymmetric key to open a session and then establishes a symmetric key for the remainder of the session?
HTTPS
Which of the following describes how Sara, an attacker, can send unwanted advertisements to a mobile device?
Bluejacking
Pete, an employee, is terminated from the company and the legal department needs documents from his encrypted hard drive. Which of the following should be used to accomplish this task? (Select TWO).
Recovery agent
Key escrow
Which of the following mitigation strategies is established to reduce risk when performing updates to business critical systems?
Change management
Which of the following can Pete, a security administrator, use to distribute the processing effort when generating hashes for a password cracking program?
Clustering
Which of the following should Jane, a security administrator, perform before a hard drive is analyzed with forensics tools?
Capture system image
Jane, an administrator, needs to make sure the wireless network is not accessible from the parking area of their office. Which of the following would BEST help Jane when deploying a new access point?
Placement of antenna
Which of the following allows Pete, a security technician, to provide the MOST secure wireless implementation
Implement WPA
Which of the following is a management control?
Written security policy
Which of the following security strategies allows a company to limit damage to internal systems and provides loss control?
Containment strategies
In order for Sara, a client, to logon to her desktop computer, she must provide her username, password, and a four digit PIN. Which of the following authentication methods is Sara using?
Single factor
Using proximity card readers instead of the traditional key punch doors would help to mitigate
Shoulder surfing
Which of the following application attacks is used to gain access to SEH?
Buffer overflow
Which of the following is an authentication service that uses UDP as a transport medium?
RADIUS
Which of the following can be used on a smartphone to BEST protect against sensitive data loss if the device is stolen? (Select TWO).
Remote wipe
Device encryption
Jane, a security analyst, is reviewing logs from hosts across the Internet which her company uses to gather data on new malware. Which of the following is being implemented by Jane's company?
Honeynet
Which of the following should Pete, a security manager, implement to reduce the risk of employees working in collusion to embezzle funds from their company?
Mandatory Vacations
Which of the following will allow Pete, a security analyst, to trigger a security alert because of a tracking cookie?
Anti-spyware software
Which of the following protocols allows for secure transfer of files? (Select TWO).
SFTP
SCP
Which of the following passwords is the LEAST complex?
Mytr@in!!
During a penetration test from the Internet, Jane, the system administrator, was able to establish a connection to an internal router, but not successfully log in to it. Which ports and protocols are MOST likely to be open on the firewall? (Select FOUR).
22
23
SSH
Telnet
Which of the following is an application security coding problem?
Error and exception handling
An IT security technician needs to establish host based security for company workstations. Which of the following will BEST meet this requirement?
Implement OS hardening by applying GPOs.
Which of the following is the MOST specific plan for various problems that can arise within a system?
IT Contingency Plan
Which of the following BEST describes the weakness in WEP encryption?
The WEP key is stored with a very small pool of random numbers to make the cipher text.
As the random numbers are often reused it becomes easy to derive the remaining WEP key.
Sara, the Chief Security Officer (CSO), has had four security breaches during the past two years. Each breach has cost the company $3,000. A third party vendor has offered to repair the security hole in the system for $25,000. The breached system is scheduled to be replaced in five years. Which of the following should Sara do to address the risk?
Transfer the risk saving $5,000.
Which of the following is an authentication and accounting service that uses TCP for connecting to routers and switches?
TACACS+
Which of the following can BEST help prevent cross-site scripting attacks and buffer overflows on a production system?
Input validation
Pete, an IT Administrator, needs to secure his server room. Which of the following mitigation methods would provide the MOST physical protection?
Mantrap
Which of the following should be connected to the fire alarm system in order to help prevent the spread of a fire in a server room without data loss to assist in an FM-200 deployment?
HVAC