Term
|
Definition
| Confidentiality, Integrity, Availability |
|
|
Term
| What is symetric encryption? |
|
Definition
| "They use the same secret" |
|
|
Term
|
Definition
| That certain information should only be known to certain people |
|
|
Term
| What is asymetric encryption? |
|
Definition
| "They use different secrets" |
|
|
Term
|
Definition
| That you can prove that someone did something |
|
|
Term
|
Definition
| A weakness that could be triggered accidentally or exploited intentionally to cause a security breach? |
|
|
Term
|
Definition
| Means that data is stored and transferred as intended and that any modification is authorized |
|
|
Term
|
Definition
| this means that information is accessible to those authorized to view or modify it |
|
|
Term
| What are the steps to establishing a security policy? |
|
Definition
| Starts at the top with the CEO, then goes to the CIO, down to the managers, technical staff, non-technical staff and down to all the staff |
|
|
Term
| What is a security control or countermeasure? |
|
Definition
| Something designed to make a particular asset or information system secure |
|
|
Term
|
Definition
| the likelihood and impact (or consequence) of a threat actor exercising a vulnerability. |
|
|
Term
|
Definition
| A system or procedure put in place to mitigate risk. |
|
|
Term
|
Definition
| A newbie or n00b. Does not understand what they are doing. |
|
|
Term
|
Definition
| Document that identifies security conrols as belonging in one of 18 families, such as Access Control (AC), Audit and Accountability (AA), Incident Response (IR), or Risk Assessment (RA), which describe the basic functions of the controls |
|
|
Term
| What is a black hat hacker |
|
Definition
|
|
Term
| What is a white hat hacker? |
|
Definition
|
|
Term
|
Definition
| Creating an account or ID that identifies the user or process on the computer system |
|
|
Term
|
Definition
| Proving that a subject is who or what it claims to be when it attempts to access the resource |
|
|
Term
|
Definition
| Proving that a subject is who or what it claims to be when it attempts to access the resource |
|
|
Term
|
Definition
| Determining what rights subjects should have on each resource and enforcing those rights |
|
|
Term
|
Definition
| Tracking authorized and unauthorized usage of a resource |
|
|
Term
| What server is more important? |
|
Definition
|
|
Term
| What must an identifier be? |
|
Definition
|
|
Term
|
Definition
| (pretending to be someone else) is one of the badic social engineering techniques. |
|
|
Term
| What is shoulder surfing? |
|
Definition
| refers to stealin a password or PIN by watching the user type it. |
|
|
Term
| What are the formal access control models? |
|
Definition
Discretionary Access Control (DAC)
Role-based Access Control (RBAC)
Mandatory Access Control (MAC) |
|
|
Term
| What are some characteristics of discretionary access control (DAC) |
|
Definition
ACLs
Ownership
Flexible
Decentralized |
|
|
Term
| What are the characteristics of role-based access control (RBAC) |
|
Definition
ACLs
Non-discretionary
Centralized (adminstrative control)
Can only have one role
Groups are assigned to roles
Permissions are assigned to groups |
|
|
Term
|
Definition
| Leaving your CAC/staying loged in in the computer during lunch. |
|
|
Term
| What are characteristics of Mandatory Access Control (MAC)? |
|
Definition
Labels and clearance
Inflexible
"Need to know" |
|
|
Term
| What are characteristics of rule-based access control? |
|
Definition
| System-enforced rules rather than system users |
|
|
Term
| What is Tailgating or piggybacking? |
|
Definition
| is a means of entering a secure area without authorization by following close behind the person that has been allowed to open the door or checkpoint. |
|
|
Term
|
Definition
The most restrictive priviledge
|
|
|
Term
|
Definition
| is a combination of social engineering and spoofing (disguising one computer resource as another). |
|
|
Term
|
Definition
| If something goes wrong - continue to work |
|
|
Term
|
Definition
| If something goes wrong - nothing will work |
|
|
Term
| What should you turn off prior to remove malware? |
|
Definition
|
|
Term
| What is single sign-on (SSO)? |
|
Definition
| A user only has to authenticate to a system once to gain access to all the resources to which the user has been granted rights |
|
|
Term
|
Definition
| Recording when any whome a resource was accessed |
|
|
Term
| What is the difference between a broadcast domain and a collision detection domain? |
|
Definition
| Broadcast domains are used with switches and collision detection domain is used with hubs |
|
|
Term
|
Definition
| refers to a phishing scam where the attacker has some information that makes the target more likely to be fooled by the attack. |
|
|
Term
| What are the different man in the middle (MTM or MiTM) attacks? |
|
Definition
| Sniff, replay, alter, inject, spoof, and hijack |
|
|
Term
| What are the layers of the OSI Model? |
|
Definition
| Physical, Presentation, Session, Transport, Network, Data Link, and Physical |
|
|
Term
|
Definition
| a spear phishing attack directed specifically against upper levels of management in the organization (CEOs and other "big breasts") |
|
|
Term
| What is promiscuous mode? |
|
Definition
| Used to listen to all traffic |
|
|
Term
|
Definition
| is another means of redirecting users from a legitimate website to a malicious one. |
|
|
Term
|
Definition
|
|
Term
| What is ethernet broadcast? |
|
Definition
| Everyone on that network will hear the broadcast |
|
|
Term
| What is a watering hole attack? |
|
Definition
| is another type of directed social engineering attack. It relies on the probability that a particular group of targets may use an insecure third-party website. |
|
|
Term
|
Definition
Protocol analyzer
Analyzes network traffic |
|
|
Term
|
Definition
|
|
Term
|
Definition
| is a catch-all term to describe malicious software threats and social engineering tools designed to vandalize or compromise computer systems. |
|
|
Term
| Within the OSI model where can a hub be used? |
|
Definition
|
|
Term
| Within the OSI model where can a switch be used? |
|
Definition
|
|
Term
| Where in the OSI model can firewalls be used? |
|
Definition
Layers 3, 4, 5, and 7
Networ, Transport, Session, and Application layer |
|
|
Term
| Where in the OSI model are MAC addresses used? |
|
Definition
|
|
Term
| Where in the OSI model are IPs used? |
|
Definition
|
|
Term
|
Definition
| programs designed to replicate and spread amongst computers, usually by "infecting" executable applications or program code. |
|
|
Term
| Where in the OSI model are ports used? |
|
Definition
|
|
Term
|
Definition
| Address Resolution Protocol |
|
|
Term
|
Definition
| Broadcasting unsolicited ARP reply packets |
|
|
Term
| How can ARP Poisoning be mitigated? |
|
Definition
|
|
Term
| What are the different types of virus? |
|
Definition
-Boot Sector Virus
- Program viruses
- Script viruses
- Macro Viruses
- Multipartite viruses |
|
|
Term
|
Definition
|
|
Term
|
Definition
| Worms are memory-resient viruses that replicate over network resources. |
|
|
Term
|
Definition
| Captures and resends packets after acquiring them |
|
|
Term
| What is a root kit (#1 and #2)? |
|
Definition
#1 Do common stuff to gain admin status.
#2 Malware that is able to hide in the operating system. |
|
|
Term
|
Definition
| Listening to network traffic |
|
|
Term
|
Definition
|
|
Term
|
Definition
|
|
Term
|
Definition
| Pretending to be someone or something you're not |
|
|
Term
|
Definition
| Pretending to be someone or something you're not |
|
|
Term
|
Definition
| is a type of malware that tries to extort money from the victum. |
|
|
Term
| Describe the virus mechanism: Stealth |
|
Definition
| the virus intercepts commands from anti-virus software and passes the software a clean version of the file; alternatively the virus may "jump" from file-to-file ahead of the virus scanner. |
|
|
Term
| Describe the virus mechanism: modification (two) |
|
Definition
| anti-virus software mostly works by identifying known virus patterns (signatures). A polymorphic virus attempts to defeat this approach by changing itself (for example, by encrypting the virus code). A metamorphic virus completely re-compiles itself to infect new files. |
|
|
Term
|
Definition
| Occurs after a session has occurred |
|
|
Term
| Which protocol provides error detection and correction? |
|
Definition
TCP provides error detection & correction
UDP is fire and forget |
|
|
Term
| Describe the virus mechanism: armor |
|
Definition
| the virus code is protected, making it difficult for anti-virus software to analyze it. One technique is to obfuscate the virus code by putting unnecessary or misleading routines in it to make it hard to analyze and identify the virus' true structure and purpose. |
|
|
Term
| Describe the virus mechanism: retrovirus |
|
Definition
| the virus seeks to disable the anti-virus software |
|
|
Term
| Describe the virus mechanism: slow and sparse |
|
Definition
| infectors - these attempt to stay "under the radar" by replicating slowly. |
|
|
Term
| What is a black box attack? |
|
Definition
| the hacker knows nothing. External threat. |
|
|
Term
|
Definition
| The attacker changes the source and/or destination address recorded in the IP packet |
|
|
Term
| What is a white box test? |
|
Definition
| the hacker is given as much info as an employee |
|
|
Term
|
Definition
| Gathering information about the network |
|
|
Term
|
Definition
| The hacker is given inbetween some infomation. |
|
|
Term
| What is "no holds barred" testing? |
|
Definition
| the consultant will try to use any means to penetrate as far into the network and information systems as possible. |
|
|
Term
|
Definition
| What ports a client is using |
|
|
Term
| What are well-known ports? |
|
Definition
You'll know what server to talk to
Ports 0 to 1024
1 |
|
|
Term
|
Definition
| A way to keep track of vulnerabilities. |
|
|
Term
| What are registered ports? |
|
Definition
|
|
Term
| What are ephemeral ports? |
|
Definition
Ports 49,151 to 65,535
Ports that clients use
64 |
|
|
Term
|
Definition
File transfer protocol - data
TCP |
|
|
Term
| What port # is File Transfer Protocol - Control? |
|
Definition
|
|
Term
|
Definition
| Can act as a decoy. Low interaction and High interaction. |
|
|
Term
| What port # is secure shell? |
|
Definition
|
|
Term
|
Definition
|
|
Term
|
Definition
|
|
Term
| What protocol # does simple mail transfer protocol use? |
|
Definition
|
|
Term
|
Definition
|
|
Term
| What port # does HTTP use? |
|
Definition
|
|
Term
| What port # does Kerberos authentical protocol use? |
|
Definition
|
|
Term
|
Definition
Post Office Protocol version 3
POP 3
TCP |
|
|
Term
| What port # does Internet Mail Access Protocol? |
|
Definition
|
|
Term
|
Definition
Simple Network Management Protocol
TCP/UDP |
|
|
Term
| What port # does SNMP trap use? |
|
Definition
|
|
Term
|
Definition
|
|
Term
|
Definition
| Probing a server to try to elicit any sort of response that will identify the server application and version number, or any other interesting detail about the way the server is configured. |
|
|
Term
| What is a Denial of Service attack? |
|
Definition
| Causes a service at a given host to fail or to become available to legitimate users |
|
|
Term
|
Definition
|
|
Term
|
Definition
|
|
Term
|
Definition
|
|
Term
|
Definition
| The attacker spoofs the victim's IP address and uses it to broadcast UDM packets aimed at obsolete diagnostics ports (echo, chargen, or discard) |
|
|
Term
|
Definition
| The client spoof's the victim's IP address and pings the broadcast address of a third-party network (one of many hosts; referred to as the "amplifying network"). Each host directs its echo responses to the victim server. |
|
|
Term
| What is plaintext or cleartext? |
|
Definition
|
|
Term
|
Definition
|
|
Term
|
Definition
| This is the process (or algorithm) used to encrypt and decrypt a message |
|
|
Term
|
Definition
| This is the art of breaking or "cracking" cryptographic systems |
|
|
Term
| What is a substitution cipher? |
|
Definition
| A substitution cipher involves replacing units (a letter or block of letters) in the plaintext with a different ciphertext |
|
|
Term
| What is a transposition cipher? |
|
Definition
| The units in a transposition cipher stay the same in plaintext and ciphertext but their order is changed, according to some mechanism |
|
|
Term
| What are characteristic of keys? |
|
Definition
Cannot keep the cipher itself secret
Ensures ciphertext remains protected even when the operation of the cipher is known
Key size determines how difficult it is for the computer to guess (brute force) of the key |
|
|
Term
| What is frequency analysis? |
|
Definition
| Depends on the fact that some letters and groups of letters appear more frequently in natural language than others |
|
|
Term
|
Definition
| The range of key values available to use with an algorithm |
|
|
Term
| What is initialization vector (IV)? |
|
Definition
Random block used with keys to make the ciphertext more complex and stronger agreed upon by two parties to prevent another from discovering
|
|
|
Term
|
Definition
| An encryption key that consists of exactly the same number of characters as the plaintext and must be generated by a truly random algorithm |
|
|
Term
| What are characteristics of the on time pad? |
|
Definition
Message and key are the same size
Impossible to crack (if the key is sufficiently random) |
|
|
Term
|
Definition
One-way (ciphertext cannot be decrypted)
Same size
Changes randomly
Susceptible to collisions |
|
|
Term
|
Definition
|
|
Term
|
Definition
|
|
Term
| What term explains "the key and message are combined in a way designed to be resistant to "extension" attacks against other means of generating MACs |
|
Definition
|
|
Term
| What is symmetric encryption? |
|
Definition
| A single secret key is used both to encrypt and decrypt data |
|
|
Term
| What are some symmetric encryption standards? |
|
Definition
Data Encryption Standard (DES / 3DES)
Advanced Encryption Standard (AES)
RSA Security (Rivest Ciphers) RC4 (stream cipher) (aka Arcfour)
International Data Encryption Algorithm (IDEA)
Blowfish / Twofish (Bruce Schneier) |
|
|
Term
| What are some characteristics of DES? |
|
Definition
Uses a block size of 64
Key size of 56 bits
It goes through 16 rounds |
|
|
Term
|
Definition
| The plaintext is divided into equal-size blocks (usually 64- 128-bit) |
|
|
Term
| What is asymmetric encryption? |
|
Definition
| A secret key is used to decrypt data. A mathematically related public key is used to encrypt data |
|
|
Term
| What are some asymmetric encryption characteristics? |
|
Definition
One key encrypts or decrypts but not both
One key cannot be derived from the other
Private key must be kept secret
Public key is easy to distribute (anyone can have it)
Message size limits so not suitable for large amounts of data |
|
|
Term
| What is Diffie-Hellman (D-H)? |
|
Definition
| A key agreement protocol, published in 1975 by Whitfield Diffie and Martin Hellman |
|
|
Term
| What is Perfect Forward Secrecy? |
|
Definition
| Where an ephemeral key is generated for each session |
|
|
Term
| What is an ephemeral key? |
|
Definition
| A key generated for different sessions |
|
|
Term
| What are characteristics of digital signatures? |
|
Definition
Proves it came from a certain user
Integrity
Authentication
Non-repudiation |
|
|
Term
| What are characteristics of RSA Security? |
|
Definition
Very widely used (SSL/TLS)
Basis of many digital certificates and signature schemes
Maximum message size: Keysize = 11KB
Used for authentication, integrity, non-repudiation, and confidentiality |
|
|
Term
| What is a digital envelope? |
|
Definition
Used to seal large amounts of data
encrypted using the receivers public key |
|
|
Term
| What are characteristics of Elliptic Curve Cryptography (ECC)? |
|
Definition
Another means of generating "trapdoor" functions (easy to calculate, difficult to reverse)
Can use smaller keys to obtain same security |
|
|
Term
| What is transport encryption? |
|
Definition
| Encrypting data as it is sent of a network |
|
|
Term
| What are some characteristics of mathematicaly attacks? |
|
Definition
Weaknesses in the cipher
Weaknesses in the keyspace
Weaknesses in the implementation (software) |
|
|
Term
| What are characteristics of man-in-the-middle and replay attacks? |
|
Definition
Inadequate authentication
Inadequate session control/timestamping |
|
|
Term
| What are methods for digitally signing an e-mail? |
|
Definition
Hash
Encrypt the hash with the sender's private key
Receiver receives the message
Hash
Decrypt's the hash sent by the sender with the sender's public key |
|
|
Term
| What is Public Key Infrastructure (PKI)? |
|
Definition
Aims to prove that the owners of public keys are who they say they are.
Certificate authority
Trusted third party |
|
|
Term
| What protocol(s) can kerberos use? |
|
Definition
|
|
Term
| What is a birthday attack? |
|
Definition
Attach a fake signature to a message
find two plaintexts that produce the same ciphertext
Birthday paradox is group such that two in group share same (any birthday) (the paradox is the that the group doesn't have to be very big)
Happens by chance due to a hash collision |
|
|
Term
| What is a weak key attack? |
|
Definition
| If the password is weak, an attacker may be able to gues or crack the password to derive the key. Also, the plain fact is that even a strong password is not a particularly good seed for a large key |
|
|
Term
|
Definition
| To make the key generated from a user password stronger by - basically - mucking about with it lots of times |
|
|
Term
|
Definition
It uses a small key
The initialization vector is negotiated in the open |
|
|
Term
| What is perfect forward secrecy? |
|
Definition
| Perfect forward secrecy allows me to keep confidentiality even if my RSA key is compromised |
|
|
Term
| What are ways to mitigate Man in the Middle Attacks? |
|
Definition
Time stamps
Sequence numbers
Encryption |
|
|
Term
| What are the different models of PKI? |
|
Definition
Stand alone
Hierarchy
Mesh |
|
|
Term
| What type of certificate model is PGP? |
|
Definition
|
|
Term
| What is a certificate practice statement? |
|
Definition
| How the certificate authority works |
|
|
Term
| What is the certificate policy statement? |
|
Definition
Associated with one certificate and the role that should be used
What the owner of the certificate is allowed to do |
|
|
Term
| What are the two ways you can check the revocation of certificate? |
|
Definition
|
|
Term
|
Definition
|
|
Term
|
Definition
|
|
Term
|
Definition
|
|
Term
|
Definition
|
|
Term
| If you only want UDP authentication services what authentication and authorization protocols should be used? |
|
Definition
|
|
Term
|
Definition
| You can authenticate by using a third party account i.e., Facebook (idP) to play a game (SP) |
|
|
Term
|
Definition
| Is a protocol used to query and update an X.500 directory or any type of directory that can present itself as an X.500 |
|
|
Term
| What port # does LDAP operate on? |
|
Definition
|
|
Term
| What is smaller than a domain? |
|
Definition
|
|
Term
| What is larger than a domain? |
|
Definition
|
|
Term
| There are two rules to understand with group policies? |
|
Definition
1.) the domain rules preempt/over rule the local rules
2.) If there is conflict, the more specific rule wins |
|
|
Term
|
Definition
| control what a user can/can't do |
|
|
Term
| The GPO is broken up into two parts. What are the two parts? |
|
Definition
|
|
Term
|
Definition
| Connects two networks at layer two |
|
|
Term
|
Definition
Virtual Storage Area Network
Breaks up a SAN, similar to VLAN to LAN
|
|
|
Term
|
Definition
|
|
Term
| What are characteristics of a basic firewall? |
|
Definition
Restricts traffic allowed on the network
Used to implement security zones
Configured with access control rules |
|
|
Term
|
Definition
Hardware or software
Stateful or stateless
It works at layers 3/4 (network firewall), 7 (application firewall or content filter firewall), |
|
|
Term
|
Definition
| A list of rules, each of which defines a specific type of data packet and the appropriate action to take when a packeet matches the rule |
|
|
Term
| What is a non-transparent server? |
|
Definition
| A non-transparent server means that the client must be configured with the server address to use it |
|
|
Term
| What is a transparent proxy server? |
|
Definition
| Intercepts client traffic without the client having to be reconfigured |
|
|
Term
| What is pre-fetching or caching? |
|
Definition
| Some proxy servers also pre-fetch pages that are referenced in pages that have been requested. When the client computer then requests that page, the proxy server already has a local copy. |
|
|
Term
| What are web security gateways? |
|
Definition
| Primary functions are to prevent viruses or Trojans infecting computers from the internet, block spam, and restrict web use to authorized sites |
|
|
Term
| What is a reverse proxy server? |
|
Definition
| Provides for protocol-specific inbound traffic |
|
|
Term
|
Definition
|
|
Term
| What are characteristics of host-based firewalls? |
|
Definition
Protects single host (personal firewall)
Windows firewall
Can perform packet filtering and control which processes can use the network interface
Vulnerable to tampering
|
|
|
Term
| What are characteristics of web application firewalls? |
|
Definition
Able to inspect code in HTTP packets
Matches suspicious code to vulnerability database
Can be implemented as software on host or as appliance
|
|
|
Term
| What are characteristics of web security gateways? |
|
Definition
Many applications use HTTP
Keyword / URI based filtering
Time-of-day / total usage restrictions
Combined firewall / malware scanner /intrusion detection in all-in-one appliance or proxy
Unified Threat Management
|
|
|
Term
| What are the mail access protocols? |
|
Definition
|
|
Term
| What protocol is used to send mail? |
|
Definition
|
|
Term
| What are the types of logs? |
|
Definition
Event
Audit
Security
Access |
|
|
Term
|
Definition
|
|
Term
| Encapsulation Security Payload (ESP) does what? |
|
Definition
Encryption
Integrity
Authentication (Non repudiation)
Compression |
|
|
Term
|
Definition
|
|
Term
| What two ports do I use to remotely log in? |
|
Definition
|
|
Term
| What is DNS Poisoning or DNS Cache Pollution? |
|
Definition
| A redirection attack, but instead of trying to subvert the name service used by the client, it aims to corrupt the records held by the DNS server itself |
|
|
Term
|
Definition
|
|
Term
| What are some DNS vulnerabilities? |
|
Definition
Footprinting
DoS
Poisoning |
|
|
Term
|
Definition
| Backing out of installing a patch |
|
|
Term
| What are the different network zones? |
|
Definition
Extranet
Intranet
Internet
DMZ |
|
|
Term
| How can two switches talk to each other? |
|
Definition
|
|
Term
|
Definition
MAC Filtering
A white list of acceptable MACs |
|
|
Term
|
Definition
| Connecting two networks over layer 2 |
|
|
Term
| What is the purpose of NAT? |
|
Definition
|
|
Term
|
Definition
|
|
Term
|
Definition
|
|
Term
| An application firewall or content filter reads |
|
Definition
|
|
Term
|
Definition
|
|
Term
|
Definition
|
|
Term
|
Definition
|
|
Term
|
Definition
|
|
Term
| What does WPA Enterprise require? |
|
Definition
|
|
Term
| What is the difference between WPA and WPA2 |
|
Definition
Different encryption
WPA2 uses CCMP and AES
WPA uses RC-4, TKIP, and AAA server (enterprise only) |
|
|
Term
|
Definition
|
|
Term
| What are you looking for in a site survey for wireless? |
|
Definition
| coverage and unauthorized access points |
|
|
Term
| What are some protocols to use to setup VPN? |
|
Definition
PPP
SSL
TLS
IPSec
SSH
L2TP |
|
|
Term
| What are the two way to securely access a remote computer? |
|
Definition
SSH - port 22
RDP - port 3389 |
|
|
Term
|
Definition
|
|
Term
|
Definition
|
|
Term
| What are the two main versions of IPSec? |
|
Definition
ESP - Protocol 50
AH - Protocol 51 |
|
|
Term
| What are the four things ESP does? |
|
Definition
Encrypts
Authenticates
Integrity
Compression |
|
|
Term
| What two things does AH do? |
|
Definition
|
|
Term
| What is Internet Key Exchange? |
|
Definition
| It creates a security association |
|
|
Term
| Internet Security Association and Key Management Protocol (ISAKMP) is a type of what? |
|
Definition
| Type of IKE or Internet Key Exchange |
|
|
Term
| Two types of DNS attacks? |
|
Definition
DNS Cache Poisoning
Attacking the zone transfers |
|
|
Term
| SANs can make a network more secure by? |
|
Definition
|
|
Term
| You use zoning to accomplish? |
|
Definition
|
|
Term
| SANs can help with security by |
|
Definition
|
|
Term
|
Definition
|
|
Term
An achievement in providing worldwide Internet security was the signing of certificates associated
with which of the following protocols?
A. TCP/IP
B. SSL
C. SCP
D. SSH
|
|
Definition
|
|
Term
A Chief Information Security Officer (CISO) wants to implement two-factor authentication within
the company. Which of the following would fulfill the CISO’s requirements?
A. Username and password
B. Retina scan and fingerprint scan
C. USB token and PIN
D. Proximity badge and token
|
|
Definition
|
|
Term
Which of the following can a security administrator implement on mobile devices that will help
prevent unwanted people from viewing the data if the device is left unattended?
A. Screen lock
B. Voice encryption
C. GPS tracking
D. Device encryption
|
|
Definition
|
|
Term
Which of the following would a security administrator implement in order to identify a problem
between two systems that are not communicating properly?
A. Protocol analyzer
B. Baseline report
C. Risk assessment
D. Vulnerability scan
|
|
Definition
|
|
Term
Which of the following can result in significant administrative overhead from incorrect reporting?
A. Job rotation
B. Acceptable usage policies
C. False positives
D. Mandatory vacations
|
|
Definition
|
|
Term
A security administrator wants to perform routine tests on the network during working hours when
certain applications are being accessed by the most people. Which of the following would allow
the security administrator to test the lack of security controls for those applications with the least
impact to the system?
A. Penetration test
B. Vulnerability scan
C. Load testing
D. Port scanner
|
|
Definition
|
|
Term
Which of the following risk concepts requires an organization to determine the number of failures
per year?
A. SLE
B. ALE
C. MTBF
D. Quantitative analysis
|
|
Definition
|
|
Term
Three of the primary security control types that can be implemented are.
A. supervisory, subordinate, and peer.
B. personal, procedural, and legal.
C. operational, technical, and management.
D. mandatory, discretionary, and permanent.
|
|
Definition
C. operational, technical, and management.
|
|
|
Term
The helpdesk reports increased calls from clients reporting spikes in malware infections on their
systems. Which of the following phases of incident response is MOST appropriate as a FIRST
response?
A. Recovery
B. Follow-up
C. Validation
D. Identification
E. Eradication
F. Containment
|
|
Definition
|
|
Term
Which of the following protocols operates at the HIGHEST level of the OSI model?
A. ICMP
B. IPSec
C. SCP
D. TCP
|
|
Definition
|
|
Term
Joe, the system administrator, has been asked to calculate the Annual Loss Expectancy (ALE) for
a $5,000 server, which often crashes. In the past year, the server has crashed 10 times, requiring
a system reboot to recover with only 10% loss of data or function. Which of the following is the
ALE of this server?
A. $500
B. $5,000
C. $25,000
D. $50,000
|
|
Definition
|
|
Term
Which of the following should an administrator implement to research current attack
methodologies?
A. Design reviews
B. Honeypot
C. Vulnerability scanner
D. Code reviews
|
|
Definition
|
|
Term
Which of the following can be implemented in hardware or software to protect a web server from
cross-site scripting attacks?
A. Intrusion Detection System
B. Flood Guard Protection
C. Web Application Firewall
D. URL Content Filter
|
|
Definition
C. Web Application Firewall
|
|
|
Term
Which of the following means of wireless authentication is easily vulnerable to spoofing?
A. MAC Filtering
B. WPA - LEAP
C. WPA - PEAP
D. Enabled SSID
|
|
Definition
|
|
Term
The BEST methods for a web developer to prevent the website application code from being
vulnerable to cross-site request forgery (XSRF) are to: (Select TWO).
A. permit redirection to Internet-facing web URLs.
B. ensure all HTML tags are enclosed in angle brackets, e.g., ”<” and “>”.
C. validate and filter input on the server side and client side.
D. use a web proxy to pass website requests between the user and the application.
E. restrict and sanitize use of special characters in input and URLs.
|
|
Definition
C. validate and filter input on the server side and client side.
E. restrict and sanitize use of special characters in input and URLs.
|
|
|
Term
Jane, a security administrator, needs to implement a secure wireless authentication method that
uses a remote RADIUS server for authentication.
Which of the following is an authentication method Jane should use?
A. WPA2-PSK
B. WEP-PSK
C. CCMP
D. LEAP
|
|
Definition
|
|
Term
A network administrator is configuring access control for the sales department which has high
employee turnover. Which of the following is BEST suited when assigning user rights to individuals
in the sales department?
A. Time of day restrictions
B. Group based privileges
C. User assigned privileges
D. Domain admin restrictions
|
|
Definition
B. Group based privileges
|
|
|
Term
Which of the following is being tested when a company’s payroll server is powered off for eight
hours?
A. Succession plan
B. Business impact document
C. Continuity of operations plan
D. Risk assessment plan
|
|
Definition
C. Continuity of operations plan
|
|
|
Term
A security analyst, Ann, is reviewing an IRC channel and notices that a malicious exploit has been
created for a frequently used application. She notifies the software vendor and asks them for
remediation steps, but is alarmed to find that no patches are available to mitigate this vulnerability.
Which of the following BEST describes this exploit?
A. Malicious insider threat
B. Zero-day
C. Client-side attack
D. Malicious add-on
|
|
Definition
|
|
Term
A security administrator has concerns about new types of media which allow for the mass
distribution of personal comments to a select group of people. To mitigate the risks involved with
this media, employees should receive training on which of the following?
A. Peer to Peer
B. Mobile devices
C. Social networking
D. Personally owned devices
|
|
Definition
|
|
Term
A network administrator is responsible for securing applications against external attacks. Every
month, the underlying operating system is updated. There is no process in place for other software
updates.
Which of the following processes could MOST effectively mitigate these risks?
A. Application hardening
B. Application change management
C. Application patch management
D. Application firewall review
|
|
Definition
C. Application patch management
|
|
|
Term
A software developer is responsible for writing the code on an accounting application. Another
software developer is responsible for developing code on a system in human resources. Once a
year they have to switch roles for several weeks.
Which of the following practices is being implemented?
A. Mandatory vacations
B. Job rotation
C. Least privilege
D. Separation of duties
|
|
Definition
|
|
Term
A network engineer is designing a secure tunneled VPN. Which of the following protocols would
be the MOST secure?
A. IPsec
B. SFTP
C. BGP
D. PPTP
|
|
Definition
|
|
Term
Which of the following implementation steps would be appropriate for a public wireless hot-spot?
A. Reduce power level
B. Disable SSID broadcast
C. Open system authentication
D. MAC filter
|
|
Definition
C. Open system authentication
|
|
|
Term
Which of the following is a step in deploying a WPA2-Enterprise wireless network?
A. Install a token on the authentication server
B. Install a DHCP server on the authentication server
C. Install an encryption key on the authentication server
D. Install a digital certificate on the authentication server
|
|
Definition
D. Install a digital certificate on the authentication server
|
|
|
Term
Which of the following controls would allow a company to reduce the exposure of sensitive
systems from unmanaged devices on internal networks?
A. 802.1x
B. Data encryption
C. Password strength
D. BGP
|
|
Definition
|
|
Term
Which of the following preventative controls would be appropriate for responding to a directive to
reduce the attack surface of a specific host?
A. Installing anti-malware
B. Implementing an IDS
C. Taking a baseline configuration
D. Disabling unnecessary services
|
|
Definition
D. Disabling unnecessary services
|
|
|
Term
A security manager must remain aware of the security posture of each system. Which of the
following supports this requirement?
A. Training staff on security policies
B. Establishing baseline reporting
C. Installing anti-malware software
D. Disabling unnecessary accounts/services
|
|
Definition
B. Establishing baseline reporting
|
|
|
Term
Deploying a wildcard certificate is one strategy to:
A. secure the certificate’s private key.
B. increase the certificate’s encryption key length.
C. extend the renewal date of the certificate.
D. reduce the certificate management burden.
|
|
Definition
D. reduce the certificate management burden.
|
|
|
Term
The security administrator needs to manage traffic on a layer 3 device to support FTP from a new
remote site. Which of the following would need to be implemented?
A. Implicit deny
B. VLAN management
C. Port security
D. Access control lists
|
|
Definition
|
|
Term
Which of the following ports is used for SSH, by default?
A. 23
B. 32
C. 12
D. 22
|
|
Definition
|
|
Term
A network administrator has been tasked with securing the WLAN. Which of the following
cryptographic products would be used to provide the MOST secure environment for the WLAN?
A. WPA2 CCMP
B. WPA
C. WPA with MAC filtering
D. WPA2 TKIP
|
|
Definition
|
|
Term
A server with the IP address of 10.10.2.4 has been having intermittent connection issues. The logs
show repeated connection attempts from the following IPs:
10.10.3.16
10.10.3.23
212.178.24.26
217.24.94.83
These attempts are overloading the server to the point that it cannot respond to traffic. Which of
the following attacks is occurring?
A. XSS
B. DDoS
C. DoS
D. Xmas
|
|
Definition
|
|
Term
Which of the following ciphers would be BEST used to encrypt streaming video?
A. RSA
B. RC4
C. SHA1
D. 3DES
|
|
Definition
|
|
Term
A user attempting to log on to a workstation for the first time is prompted for the following
information before being granted access: username, password, and a four-digit security pin that
was mailed to him during account registration. This is an example of which of the following?
A. Dual-factor authentication
B. Multifactor authentication
C. Single factor authentication
D. Biometric authentication
|
|
Definition
C. Single factor authentication
|
|
|
Term
After analyzing and correlating activity from multiple sensors, the security administrator has
determined that a group of very well organized individuals from an enemy country is responsible
for various attempts to breach the company network, through the use of very sophisticated and
targeted attacks. Which of the following is this an example of?
A. Privilege escalation
B. Advanced persistent threat
C. Malicious insider threat
D. Spear phishing
|
|
Definition
B. Advanced persistent threat
|
|
|
Term
Which of the following is true about input validation in a client-server architecture, when data
integrity is critical to the organization?
A. It should be enforced on the client side only.
B. It must be protected by SSL encryption.
C. It must rely on the user’s knowledge of the application.
D. It should be performed on the server side.
|
|
Definition
D. It should be performed on the server side.
|
|
|
Term
A merchant acquirer has the need to store credit card numbers in a transactional database in a
high performance environment. Which of the following BEST protects the credit card data?
A. Database field encryption
B. File-level encryption
C. Data loss prevention system
D. Full disk encryption
|
|
Definition
A. Database field encryption
|
|
|
Term
A bank has a fleet of aging payment terminals used by merchants for transactional processing.
The terminals currently support single DES but require an upgrade in order to be compliant with
security standards. Which of the following is likely to be the simplest upgrade to the aging
terminals which will improve in-transit protection of transactional data?
A. AES
B. 3DES
C. RC4
D. WPA2
|
|
Definition
|
|
Term
Which of the following is BEST at blocking attacks and providing security at layer 7 of the OSI
model?
A. WAF
B. NIDS
C. Routers
D. Switches
|
|
Definition
|
|
Term
Which of the following is BEST used to capture and analyze network traffic between hosts on the
same network segment?
A. Protocol analyzer
B. Router
C. Firewall
D. HIPS
|
|
Definition
|
|
Term
After a number of highly publicized and embarrassing customer data leaks as a result of social
engineering attacks by phone, the Chief Information Officer (CIO) has decided user training will
reduce the risk of another data leak. Which of the following would be MOST effective in reducing
data leaks in this situation?
A. Information Security Awareness
B. Social Media and BYOD
C. Data Handling and Disposal
D. Acceptable Use of IT Systems
|
|
Definition
A. Information Security Awareness
|
|
|
Term
Which of the following functions provides an output which cannot be reversed and converts data
into a string of characters?
A. Hashing
B. Stream ciphers
C. Steganography
D. Block ciphers
|
|
Definition
|
|
Term
Which of the following encrypts data a single bit at a time?
A. Stream cipher
B. Steganography
C. 3DES
D. Hashing
|
|
Definition
|
|
Term
Which of the following is used to verify data integrity?
A. SHA
B. 3DES
C. AES
D. RSA
|
|
Definition
|
|
Term
By default, which of the following uses TCP port 22? (Select THREE).
A. FTPS
B. STELNET
C. TLS
D. SCP
E. SSL
F. HTTPS
G. SSH
H. SFTP
|
|
Definition
|
|
Term
Access mechanisms to data on encrypted USB hard drives must be implemented correctly
A. user accounts may be inadvertently locked out.
B. data on the USB drive could be corrupted.
C. data on the hard drive will be vulnerable to log analysis.
D. the security controls on the USB drive can be bypassed.
|
|
Definition
D. the security controls on the USB drive can be bypassed.
|
|
|
