- An unskilled person who downloads automated attack software (i.e. open-source intelligence) and uses it to carry out attacks would be considered to be what type of threat actor?
script kiddie
2. An Advanced Persistent Threat is most commonly associated with what type of threat actor?
nation state actors
3. How is confidentiality ensured using the IPsec VPN protocol?
By using the Encapsulating Security Payload (ESP) protocol.
4. What encryption protocol is used for the WPA2 wireless standard?
Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP)
5. What are two items that are specifically part of the Secure DevOps methodology? (Choose two.)
continuous integration
security automation
6. How does a distributed denial of service attack differ from a regular denial of service attack?
DDoS attacks utilize many computers for making bogus requests, instead of just one.
7. What statement accurately defines what a race condition is and how it might affect a computer?
A race condition occurs when concurrent threads of execution access a shared resource simultaneously, producing unintended consequences.
8. An attacker is attempting to generate data that has the same hash as a captured hash of a password. What type of attack is this?
collision attack
9. Recently, a managed Cisco network switch in a publicly accessible closet experienced a crash, dropping all those that were connected to it. Based on logs recovered from a central logging system, you determine that the switch may have been flooded with spoofed MAC addresses, causing the memory available on the switch to be consumed. What feature could you implement to help prevent this from happening in the future?
port security
10. What Linux/UNIX-based command interface and protocol can be used for securely accessing a remote computer?
ssh
11. What statement properly describes the propagation or circulation techniques utilized by a worm-type malware?
A worm utilizes application or operating system vulnerabilities to spread through a network.
12. What type of fingerprint scanner requires that a user place their entire thumb or finger over a small oval window, which then takes an optical picture of the fingerprint?
static fingerprint scanner
13. What DNS vulnerability can be specifically addressed by utilizing Domain Name System Security Extensions (DNSSEC)?
DNS poisoning
14. What are two valid weaknesses of utilizing MAC filtering for controlling wireless network access?
MAC addresses are initially exchanged between wireless devices and the AP in unencrypted format.
Filtering by MAC address requires significant administrative overhead to maintain the list of allowed MACs.
15. The basic ROT13 cipher is an example of what kind of cipher algorithm?
substitution cipher
16. Of the two encryption modes supported by IPsec, what mode is more secure, and why?
Tunnel mode, because the header and data portion of the packet are encrypted.
17. Once a tester has penetrated a network and gained access, what is the tester’s next step?
Attempt to pivot or move around inside the network to other resources.
18. What statement regarding the use of load balancers on a network is NOT accurate?
Load balancers can only be used in an active-pass configuration.
19. In multifactor authentication, a password is considered to be what element of authentication?
Something you know.
20. The Advanced Encryption Standard (AES) symmetric cipher uses how many rounds of substitution and re-arranging when utilizing a 256-bit key size?
13 rounds
21. When performing a vulnerability scan, what is NOT one of the things the scan looks for?
The likelihood of zero-day malware attacks on the system
22. What statement describes the Privacy Enhancement Mail (PEM) X.509 format?
It is designed to provide confidentiality and integrity to emails utilizing DER encoding.
23. What does a component’s mean time between failures (MTBF) value determine?
It refers to the average amount of time until a component fails and cannot be repaired.
24. You are speaking to your CIO, and she has instructed you to ensure that the network is “five nines” in percentage of availability. What is the total yearly downtime that this allows?
5.26 minutes
25. Consider the following network: PC1->Switch1->Switch2->PC2. When Switch1 receives a frame from PC1 intended for PC2, but does not have an entry in the MAC table for PC2, what happens?
Switch1 broadcasts the frame out all connected ports. Switch2 will do the same if it too does not contain an entry for PC2, else the frame will be delivered to the port PC2 resides on.
26. What type of digital certificate is primarily used for Microsoft Exchange servers or unified communications?
Subject Alternative Name (SAN) certificate
27. You are an administrator for the site example.com, and would like to secure all the subdomains under example.com with a single SSL certificate. What type of certificate should you use?
wildcard certificate
28. What are two valid methods that could be used to prevent a replay attack? (Choose two.)
Timestamps can be utilized for all communication.
Both sides of communication could utilize random keys that are valid for limited periods of time.
29. What is not an item that a host based intrusion detection system (HIDS) is capable of monitoring?
An attempt to access remote network-shared files.
30. Once a system has been infected, what is the method of operation of a logic bomb malware program?
The logic bomb code lies dormant until a specific logical event triggers it, upon which data is deleted and/or the system is sabotaged.
31. On Windows, how does the Mandatory Integrity Control (MIC) MAC implementation ensure data integrity?
It controls access to securable objects through the use of security identifiers.
32. You are currently engaged in troubleshooting an active connection that is being cut off in mid-transmission each time an attempt is made to communicate. What type of program should you use to diagnose the problem with this transmission?
protocol analyzer
33. What block cipher mode of operation involves each ciphertext block being fed back into the encryption process to encrypt the next plaintext block?
Cipher Block Chaining (CBC)
34. What type of agreement serves as a contract between a vendor and a client that specifies what services will be provided, the responsibilities of each party, and any guarantees of service?
Service Level Agreement (SLA)
35. What are the two different types of one-time password that can be created? (Choose two.)
HMAC based one-time password (HOTP)
time-based one time password (TOTP)
36. By creating a starting point for comparison purposes in order to apply targets and goals to measure success, what are you doing?
Establishing a baseline.
37. If a wireless attacker sends a Request to Send (RTS) frame with a duration field containing a very high value, what happens on the wireless network?
All other wireless client devices on the network will be unable to transmit until their NAV value is 0.
38. In dealing with facial recognition technology, what term describes the rate at which imposters are recognized as legitimate users?
false acceptance rate (FAR)
39. A client PC on your company’s network is attempting to browse to a vendor’s web page on the Internet, but the computer goes to a malicious web page instead. What two utilities can you use to verify that the DNS records are correct for the web page? (Choose two.)
nslookup
dig
40. When discussing protections provided by cryptography, what does non-repudiation mean?
Individuals are prevented from fraudulently denying that they were involved in a transaction.
41. In the management of virtual machines, what are the risks associated with virtual machine sprawl?
In the management of virtual machines, what are the risks associated with virtual machine sprawl?
42. In what type of security policy might you define the required minimal security configuration for servers on the network?
server security policy
43. When considering the proper storage of private keys, what statement is not accurate?
Copies of keys should be made for safe keeping.
44. When you are configuring password policy settings in Group Policy, what is the recommended setting for password reuse?
24 new passwords must be used before a reused password.
45. What two cryptographic transport protocols should not be used or are considered obsolete? (Choose two.)
SSL v2.0
SSL v2.0
46. Elliot’s computer has a TPM chip, which was used to encrypt the contents of his hard drive. Due to a component failure on the motherboard, Elliot had to move the hard drive to a new computer, also with a TPM chip. What happens to the drive upon starting the computer?
The drive will be unavailable until the recovery password is entered.
47. What EAP protocol supported by WPA2-Enterprise securely tunnels any credential form for authentication using TLS?
EAP-FAST
48. What statement correctly defines what a rainbow table is in relation to password attacks?
A rainbow table is a compressed representation of cleartext passwords that are related and organized in a sequence.
49. What statement regarding the use of Software Defined Networking (SDN) is NOT accurate?
SDN controllers and switches are limited to Layer 2 and Layer 3 of the OSI model.
50. The Secure Boot security standard is used in conjunction with what type of booting process firmware?
Unified Extensible Firmware Interface (UEFI)
51. What type of a social engineering attack attempts to trick a user via email or web page into surrendering private information, such as login information to financial websites?
phishing attack
52. Your organization is planning to deploy wireless access points across their campus network, and you have been tasked with securing the installation. Currently, the design calls for a wireless network with many APs that are controlled by a single device, to allow centralized management. What type of APs will you be securing?
controller APs
53. What type of backup is considered to be an evidence-grade backup, because its accuracy meets evidence standards?
bit-stream backup
54. If a company that employs a SCADA system comes under attack, and the SCADA system itself is affected, what are the risks?
The control systems managed by SCADA could malfunction, possibly causing damage to equipment.
55. When dealing with the preservation of evidence, who should be responsible for processing the evidence?
Properly trained computer evidence specialists.
56. What type of security control implements security in a defined structure and location?
physical control
57. What is not one of the more common security issues that should be planned for?
inventory management
58. What feature of a mobile device management system could be used to restrict the use of an application containing confidential data to only a specific geographical area?
geofencing
59. When deploying sensors, collectors, and filters, where should they be placed in the network?
They should be placed where the stream of data is largest.
60. What is a valid disadvantage of the use of a software firewall versus using a hardware firewall?
A malware infection on the machine could compromise the software firewall processes.
61. Providing the minimum amount of privileges necessary to perform a job or function is known as what security principle?
least privilege
62. Although change management involves all types of changes to information systems, what two major types of changes regarding security need to be properly documented? (Choose two.)
The classification status of files or documents, such as a file being changed to confidential or top secret.
Any change in system architecture, such as new servers, routers, or other equipment.
63. In a white box penetration test of a network, how much information is known to the tester, if any?
The tester will have in-depth knowledge of the network and systems tested.
64. How does the use of the perfect forward secrecy key exchange method differ from other key exchange methods?
Perfect forward secrecy involves the use of public key systems that generate random public keys that differ for each session.
65. What statement is accurate in regards to adjusting frequency spectrum settings?
Channel width determines how much spectrum is available to transfer data.
66. What is NOT an advantage of using job rotation in a complex business environment?
It reduces job training costs by ensuring everyone knows how to do everyone else’s job.
67. Identification of any single points of failure should be a key component in what important business tool?
Business Impact Analysis (BIA)
68. What type of redundant site provides office space, but equipment necessary for continuing operations must be provided by the customer?
cold site
69. When using OAuth, how are a user’s username and password received by a third party server.
The username and password are replaced by a an authentication token, which is then used to gain access to the third party server.
70. A Bluetooth piconet is an example of what type of network topology?
ad hoc topology
71. You are involved in the creation of your company’s employee offboarding policy. What statement reflects a good policy measure?
Offboarded employee accounts are immediately disabled.
72. The Google Android OS Smart Lock feature is an example of what kind of authentication?
context-aware authentication
73. What can be used to help ensure against employee perpetrated fraud against an employer?
A mandatory vacation policy.
74. What type of information security policy is often considered to be the most important policy?
acceptable use policy
75. You have been placed in charge of a large number of corporate firewalls and NIPs. Due to the volume of traffic, you would like to recommend the procurement of a product capable of real-time monitoring and management of security information with analysis and reporting of security events. What type of product is this?
A Security and Information Event Management product.
76. What two statements describe methods that can be employed by armored viruses in order to avoid detection? (Choose two.)
Armored viruses may mutate or change their code on the fly to avoid detection.
Armored viruses can use encrypted code pieces to assemble itself with the help of an infected program.
77. What type of malware specializes in avoiding detection by accessing lower layers of the operating system or by using undocumented functions to make alterations?
rootkit
78. When might an industry-specific security framework or architecture be required for a company?
The company’s industry is regulated.
79. What is the most secure form of IEEE 802.1x authentication?
certificate based
80. What statement best describes how an HMAC-based one-time password (HOTP) works?
HOTPs are event-driven and change when specific events occur, such as when a user enters a personal identification number.
81. What type of cryptography provides security comparable to asymmetric encryption with significantly reduced computational power and with smaller key sizes?
elliptic curve cryptography
82. Due to the sensitivity of the computer equipment your company has in its core network, you would like to shield these devices from electromagnetic pulses. What can you do to accomplish this?
You can use a metallic enclosure known as a Faraday cage.
83. What is NOT a component in the “AAA” framework used to control access to computer resources?
Affiliation
84. Per your company’s data destruction policy, you have been tasked with the destruction of data on a magnetic hard drive. The policy employed by your company specifies that you must destroy the drive by reducing or eliminating the magnetic fields present in the drive. What method should you use?
You should perform a degaussing procedure on the drive.
85. In mandatory access control, what are the two key elements used to grant permissions? (Choose two.)
levels
labels
86. You have been tasked with responding to a security incident involving the compromise of a manager’s documents. You and your team have determined that the attacker involved copied files via a Bluetooth connection with the manager’s unprotected cell phone. What kind of attack was this?
bluesnarfing attack
87. When performing an audit, what is the process that looks at the applications that the user is provided, how frequently they are used, and how they are being used known as?
usage auditing and review
88. What federation system technology uses federation standards to provide SSO and exchanging attributes?
Shibboleth
89. When using application-based firewalls, what is NOT capable of being used to identify an application being used?
IP addresses
90. An attack in which the attacker substitutes the return address in a program with a pointer to malicious code is an example of what kind of attack?
buffer overflow attack
Other Links:
See other websites for quiz:
Check on QUIZLET