Fundamentals of Information Security [State Exam | Part 2 + 23 new questions]

Question 1 of 146

1

What are two methods to maintain certificate revocation status? (Choose two.)

Select one or more of the following:

subordinate CA
OCSP
DNS
LDAP
CRL

Explanation

Question 2 of 146

1

The following message was encrypted using a Caesar cipher with a key of 2:

fghgpf vjg ecuvng

What is the plaintext message?

Select one of the following:

invade the castle
defend the castle
defend the region
invade the region

Explanation

Question 3 of 146

1

What is the purpose of a digital certificate?

Select one of the following:

It ensures that the person who is gaining access to a network device is authorized.
It provides proof that data has a traditional signature attached.
It guarantees that a website has not been hacked.
It authenticates a website and establishes a secure connection to exchange confidential data

Explanation

Question 4 of 146

1

A company is developing a security policy for secure communication. In the exchange of critical messages between a headquarters office and a branch office, a hash value should only be recalculated with a predetermined code, thus ensuring the validity of data source. Which aspect of secure communications is addressed?

Select one of the following:

data integrity
non-repudiation
origin authentication
data confidentiality

Explanation

Question 5 of 146

1

In most host-based security suites, which function provides robust logging of security-related events and sends logs to a central location?

Select one of the following:

intrusion detection and prevention
anti-phishing
telemetry
safe browsing

Explanation

Question 6 of 146

1

On a Windows host, which tool can be used to create and maintain blacklists and whitelists?

Select one of the following:

Group Policy Editor
Local Users and Groups
Computer Management
Task Manager

Explanation

Question 7 of 146

1

Which statement describes agentless antivirus protection?

Select one of the following:

Host-based antivirus systems provide agentless antivirus protection.
The antivirus protection is provided by the router that is connected to a cloud service.
The antivirus protection is provided by the ISP.
Antivirus scans are performed on hosts from a centralized system.

Explanation

Question 8 of 146

1

The IT security personnel of an organization notice that the web server deployed in the DMZ is frequently targeted by threat actors. The decision is made to implement a patch management system to manage the server. Which risk management strategy method is being used to respond to the identified risk?

Select one of the following:

risk avoidance
risk retention
risk reduction
risk sharing

Explanation

Question 9 of 146

1

In addressing a risk that has low potential impact and relatively high cost of mitigation or reduction, which strategy will accept the risk and its consequences?

Select one of the following:

risk reduction
risk avoidance
risk retention
risk sharing

Explanation

Question 10 of 146

1

What is a host-based intrusion detection system (HIDS)?

Select one of the following:

It identifies potential attacks and sends alerts but does not stop the traffic.
It detects and stops potential direct attacks but does not scan for malware.
It is an agentless system that scans files on a host for potential malware.
It combines the functionalities of antimalware applications with firewall protection.

Explanation

Question 11 of 146

1

What type of antimalware program is able to detect viruses by recognizing various characteristics of a known malware file?

Select one of the following:

behavior-based
agent-based
signature-based
heuristic-based

Explanation

Question 12 of 146

1

Which device in a LAN infrastructure is susceptible to MAC address-table overflow and spoofing attacks?

Select one of the following:

firewall
workstation
server
switch

Explanation

Question 13 of 146

1

Which criterion in the Base Metric Group Exploitability metrics reflects the proximity of the threat actor to the vulnerable component?

Select one of the following:

user interaction
attack vector
attack complexity
privileges required

Explanation

Question 14 of 146

1

In addressing an identified risk, which strategy aims to stop performing the activities that create risk?

Select one of the following:

risk reduction
risk avoidance
risk retention
risk sharing

Explanation

Question 15 of 146

1

Which statement describes the term iptables?

Select one of the following:

It is a file used by a DHCP server to store current active IP addresses.
It is a DHCP application in Windows.
It is a DNS daemon in Linux.
It is a rule-based firewall application in Linux.

Explanation

Question 16 of 146

1

For network systems, which management system addresses the inventory and control of hardware and software configurations?

Select one of the following:

asset management
vulnerability management
risk management
configuration management

Explanation

Question 17 of 146

1

Which statement describes the anomaly-based intrusion detection approach?

Select one of the following:

It compares the signatures of incoming traffic to a known intrusion database.
It compares the antivirus definition file to a cloud based repository for latest updates.
It compares the operations of a host against a well-defined security policy.
It compares the behavior of a host to an established baseline to identify potential intrusions.

Explanation

Question 18 of 146

1

What is the first step taken in risk assessment?

Select one of the following:

Identify threats and vulnerabilities and the matching of threats with vulnerabilities.
Establish a baseline to indicate risk before security controls are implemented.
Compare to any ongoing risk assessment as a means of evaluating risk management effectiveness.
Perform audits to verify threats are eliminated.

Explanation

Question 19 of 146

1

Which statement describes the threat-vulnerability (T-V) pairing?

Select one of the following:

It is the identification of threats and vulnerabilities and the matching of threats with vulnerabilities.
It is the comparison between known malware and system risks.
It is the detection of malware against a central vulnerability research center.
It is the advisory notice from a vulnerability research center.

Explanation

Question 20 of 146

1

Which security procedure would be used on a Windows workstation to prevent access to a specific set of websites?

Select one of the following:

whitelisting
HIDS
blacklisting
baselining

Explanation

Question 21 of 146

1

Which statement describes the use of a Network Admission Control (NAC) solution?

Select one of the following:

It provides network access to only authorized and compliant systems.
A Network Admission Control solution provides filtering of potentially malicious emails before they reach the endpoint.
It provides endpoint protection from viruses and malware.
It provides filtering and blacklisting of websites being accessed by end users.

Explanation

Question 22 of 146

1

Which type of antimalware software detects and mitigates malware by analyzing suspicious activities?

Select one of the following:

heuristics-based
packet-based
behavior-based
signature-based

Explanation

Question 23 of 146

1

Which regulatory compliance regulation sets requirements for all U.S. public company boards, management and public accounting firms regarding the way in which corporations control and disclose financial information?

Select one of the following:

Gramm-Leach-Bliley Act (GLBA)
Health Insurance Portability and Accountability Act (HIPAA)
Federal Information Security Management Act of 2002 (FISMA)
Sarbanes-Oxley Act of 2002 (SOX)

Explanation

Question 24 of 146

1

Which statement describes the term attack surface?

Select one of the following:

It is the total sum of vulnerabilities in a system that is accessible to an attacker.
It is the group of hosts that experiences the same attack.
It is the network interface where attacks originate.
It is the total number of attacks toward an organization within a day.

Explanation

Question 25 of 146

1

Which step in the Vulnerability Management Life Cycle determines a baseline risk profile to eliminate risks based on asset criticality, vulnerability threat, and asset classification?

Select one of the following:

assess
discover
verify
prioritize assets

Explanation

Question 26 of 146

1

When a network baseline is being established for an organization, which network profile element indicates the time between the establishment of a data flow and its termination?

Select one of the following:

session duration
critical asset address space
ports used
total throughput

Explanation

Question 27 of 146

1

Which two classes of metrics are included in the CVSS Base Metric Group? (Choose two.)

Select one or more of the following:

Modified Base
Confidentiality Requirement
Exploit Code Maturity
Exploitability
Impact metrics

Explanation

Question 28 of 146

1

In network security assessments, which type of test employs software to scan internal networks and Internet facing servers for various types of vulnerabilities?

Select one of the following:

risk analysis
penetration testing
vulnerability assessment
strength of network security testing

Explanation

Question 29 of 146

1

Which two criteria in the Base Metric Group Exploitability metrics are associated with the complexity of attacks? (Choose two)

Select one or more of the following:

scope
attack complexity
user interaction
attack vector
privileges required

Explanation

Question 30 of 146

1

Which statement describes the Cisco Threat Grid Glovebox?

Select one of the following:

It is a network-based IDS/IPS.
It is a firewall appliance.
It is a host-based intrusion detection system (HIDS) solution to fight against malware
It is a sandbox product for analyzing malware behaviors.

Explanation

Question 31 of 146

1

How does using HTTPS complicate network security monitoring?

Select one of the following:

HTTPS cannot protect visitors to a company-provided web site.
HTTPS can be used to infiltrate DNS queries.
Web browser traffic is directed to infected servers.
HTTPS adds complexity to captured packets.

Explanation

Question 32 of 146

1

Which protocol is used to send e-mail messages between two servers that are in different e-mail domains?

Select one of the following:

POP3
SMTP
HTTP
IMAP4

Explanation

Question 33 of 146

1

What are two ways that ICMP can be a security threat to a company? (Choose two.)

Select one or more of the following:

by collecting information about a network
by corrupting network IP data packets
by providing a conduit for DoS attacks
by corrupting data between email servers and email recipients
by the infiltration of web pages

Explanation

Question 34 of 146

1

Which function is provided by the Sguil application?

Select one of the following:

It makes Snort-generated alerts readable and searchable.
It detects potential network intrusions.
It reports conversations between hosts on the network.
It prevents malware from attacking a host.

Explanation

Question 35 of 146

1

Which two options are network security monitoring approaches that use advanced analytic techniques to analyze network telemetry data? (Choose two.)

Select one or more of the following:

NetFlow
Snorby
NBAD
NBA
IPFIX
Sguil

Explanation

Question 36 of 146

1

A system administrator has recommended to the CIO a move of some applications from a Windows server to a Linux server. The proposed server will use ext4 partitions and serve as a web server, file server, and print server. The CIO is considering the recommendation, but has some questions regarding security.
Which two methods does Linux use to log data in order to identify a security event? (Choose two.)

Select one or more of the following:

Apache access logs
Event Viewer
NetFlow
SPAN
syslog

Explanation

Question 37 of 146

1

A system administrator has recommended to the CIO a move of some applications from a Windows server to a Linux server. The proposed server will use ext4 partitions and serve as a web server, file server, and print server. The CIO is considering the recommendation, but has some questions regarding security.
What is a daemon?

Select one of the following:

a background process that runs without the need for user interaction
a record to keep track of important events
a type of security attack
an application that monitors and analyzes suspicious activity

Explanation

Question 38 of 146

1

A system administrator has recommended to the CIO a move of some applications from a Windows server to a Linux server. The proposed server will use ext4 partitions and serve as a web server, file server, and print server. The CIO is considering the recommendation, but has some questions regarding security.
Because the company uses discretionary access control (DAC) for user file management, what feature would need to be supported on the server?

Select one of the following:

access based on security clearance held
principle of least privilege
role-based access control
user-based data access control

Explanation

Question 39 of 146

1

A system administrator has recommended to the CIO a move of some applications from a Windows server to a Linux server. The proposed server will use ext4 partitions and serve as a web server, file server, and print server. The CIO is considering the recommendation, but has some questions regarding security.
What are two benefits of using an ext4 partition instead of ext3? (Choose two.)

Select one or more of the following:

compatibility with CDFS
compatibility with NTFS
decreased load time
improved performance
an increase in the number of supported devices
increase in the size of supported files

Explanation

Question 40 of 146

1

How can IMAP be a security threat to a company?

Select one of the following:

It can be used to encode stolen data and send to a threat actor.
An email can be used to bring malware to a host.
Encrypted data is decrypted.
Someone inadvertently clicks on a hidden iFrame.

Explanation

Question 41 of 146

1

A system administrator runs a file scan utility on a Windows PC and notices a file lsass.exe in the Program Files directory. What should the administrator do?

Select one of the following:

Open the Task Manager, right-click on the lsass process and choose End Task.
Uninstall the lsass application because it is a legacy application and no longer required by Windows.
Move it to Program Files (x86) because it is a 32bit application.
Delete the file because it is probably malware.

Explanation

Question 42 of 146

1

How does a web proxy device provide data loss prevention (DLP) for an enterprise?

Select one of the following:

by checking the reputation of external web servers
by functioning as a firewall
by inspecting incoming traffic for potential exploits
by scanning and logging outgoing traffic

Explanation

Question 43 of 146

1

A system analyst is reviewing syslog messages and notices that the PRI value of a message is 26. What is the severity value of the message?

Select one of the following:

1
2
3
6

Explanation

Question 44 of 146

1

Which statement describes session data in security logs?

Select one of the following:

It is a record of a conversation between network hosts.
It can be used to describe or predict network behavior.
It reports detailed network activities between network hosts.
It shows the result of network sessions.

Explanation

Question 45 of 146

1

In a Cisco AVC system, in which module is NetFlow deployed?

Select one of the following:

Management and Reporting
Metrics Collection
Control
Application Recognition

Explanation

Question 46 of 146

1

What port number would be used if a threat actor was using NTP to direct DDoS attacks?

Select one of the following:

443
25
69
123

Explanation

Question 47 of 146

1

Which information can be provided by the Cisco NetFlow utility?

Select one of the following:

IDS and IPS capabilities
security and user account restrictions
peak usage times and traffic routing
source and destination UDP port mapping

Explanation

Question 48 of 146

1

What is Tor?

Select one of the following:

a type of Instant Messaging (IM) software used on the darknet
a way to share processors between network devices across the Internet
a rule created in order to match a signature of a known exploit
a software platform and network of P2P hosts that function as Internet routers

Explanation

Question 49 of 146

1

Which statement describes statistical data in network security monitoring processes?

Select one of the following:

It shows the results of network activities between network hosts.
It contains conversations between network hosts.
It is created through an analysis of other forms of network data.
It lists each alert message along with statistical information.

Explanation

Question 50 of 146

1

Refer to the exhibit. A network administrator is reviewing an Apache access log message. What is the status of the access request by the client?

Select one of the following:

The request was unsuccessful because of server errors.
The request was fulfilled successfully.
The request was redirected to another web server.
The request was unsuccessful because of client errors.

Explanation

Question 51 of 146

1

How might corporate IT professionals deal with DNS-based cyber threats?

Select one of the following:

Monitor DNS proxy server logs and look for unusual DNS queries.
Use IPS/IDS devices to scan internal corporate traffic.
Limit the number of simultaneously opened browsers or browser tabs.
Limit the number of DNS queries permitted within the organization.

Explanation

Question 52 of 146

1

Refer to the exhibit. A junior network engineer is handed a print-out of the network information shown. Which protocol or service originated the information shown in the graphic?

Select one of the following:

NetFlow
TACACS+
RADIUS
Syslog

Explanation

Question 53 of 146

1

Which technology is used in Cisco Next-Generation IPS devices to consolidate multiple security layers into a single platform?

Select one of the following:

FirePOWER
WinGate
Apache Traffic Server
Squid

Explanation

Question 54 of 146

1

Refer to the exhibit. How is the traffic from the client web browser being altered when connected to the destination website of www.cisco.com?

Select one of the following:

Traffic is sent in plain-text by the user machine and is encrypted by the TOR node in France and decrypted by the TOR node in Germany.
Traffic is encrypted by the user machine and sent directly to the cisco.com server to be decrypted.
Traffic is encrypted by the user machine, and the TOR network only routes the traffic through France, Canada, Germany, and delivers it to cisco.com.
Traffic is encrypted by the user machine, and the TOR network encrypts next-hop information on a hop-by-hop basis.

Explanation

Question 55 of 146

1

Which Windows log contains information about installations of software, including Windows updates?

Select one of the following:

setup logs
application logs
system logs
security logs

Explanation

Question 56 of 146

1

Which Windows log records events related to login attempts and operations related to file or object access?

Select one of the following:

setup logs
security logs
application logs
system logs

Explanation

Question 57 of 146

1

What does it indicate if the timestamp in the HEADER section of a syslog message is preceded by a period or asterisk symbol?

Select one of the following:

The timestamp represents the round trip duration value.
The syslog message indicates the time an email is received.
There is a problem associated with NTP.
The syslog message should be treated with high priority.

Explanation

Question 58 of 146

1

Which two application layer protocols manage the exchange of messages between a client with a web browser and a remote web server? (Choose two.)

Select one or more of the following:

HTTPS
DHCP
HTML
DNS
HTTP

Explanation

Question 59 of 146

1

Which protocol is a name resolution protocol often used by malware to communicate with command-and-control (CnC) servers?

Select one of the following:

IMAP
HTTPS
DNS
ICMP

Explanation

Question 60 of 146

1

How is the hash value of files useful in network security investigations?

Select one of the following:

It helps identify malware signatures
It is used to decode files
It verifies confidentiality of files
It is used as a key for encryption

Explanation

Question 61 of 146

1

Which tool is a Security Onion integrated host-based intrusion detection system?

Select one of the following:

OSSEC
Sguil
ELSA
Snort

Explanation

Question 62 of 146

1

Which type of evidence supports an assertion based on previously obtained evidence?

Select one of the following:

Direct evidence
Corroborating evidence
Best evidence
Indirect evidence

Explanation

Question 63 of 146

1

Which tool is developed by Cisco and provides an interactive dashboard that allows investigation of the threat landscape?

Select one of the following:

Wireshark
Talos
Sguil
Snort

Explanation

Question 64 of 146

1

Which term is used to describe the process of converting log entries into a common format?

Select one of the following:

Standardization
Normalization
Classification
Systemization

Explanation

Question 65 of 146

1

According to NIST, which step in the digital forensics process involves extracting relevant information from data?

Select one of the following:

Collection
Examination
Analysis
Reporting

Explanation

Question 66 of 146

1

A law office uses a Linux host as the firewall device for the network. The IT administrator is adding a rule to the firewall iptables to block internal hosts from connecting to a remote device that has the IP address 209.165.202.133. Which command should the administrator use?

Select one of the following:

IPTABLES –I FORWARD –P TCP –D 209.165.202.133 –DPORT 7777 –J DROP
IPTABLES –I INPUT –P TCP –D 209.165.202.133 –DPORT 7777 –J DROP
IPTABLES –I PASS –P TCP –D 209.165.202.133 –DPORT 7777 –J DROP
IPTABLES –I OUTPUT –P TCP –D 209.165.202.133 –DPORT 7777 –J DROP

Explanation

Question 67 of 146

1

What procedure should be avoided in a digital forensics investigation?

Select one of the following:

Secure physical access to the computer under investigation
Reboot the affected system upon arrival
Make a copy of the hard drive
Recover deleted files

Explanation

Question 68 of 146

1

Which statement describes a feature of timestamps in Linux?

Select one of the following:

Human readable timestamps measure the number of seconds that have passed since January 1, 1970.
All devices generate human readable and unix epoch timestamps
It is easier to work with Unix epoch timestamps for addition and subtraction operations
Unix epoch timestamps are easier for humans to interpret

Explanation

Question 69 of 146

1

Which tool is included with Security Onion that is used by Snort to automatically download new rules?

Select one of the following:

Sguil
Wireshark
PulledPork
ELSA

Explanation

Question 70 of 146

1

Which tool would an analyst use to start a workflow investigation?

Select one of the following:

Sguil
Bro
Snort
ELSA

Explanation

Question 71 of 146

1

What is indicated by a Snort signature ID that is below 3464?

Select one of the following:

The SID was created by Sourcefire and distributed under a GPL agreement
This is a custom signature developed by the organization to address locally observed rules
The SID was created by members of emerging threats
The SID was created by the Snort community and is maintained in community rules

Explanation

Question 72 of 146

1

How does an application program interact with the operating system?

Select one of the following:

Accessing BIOS or UEFI
Making API calls
Sending files
Using processes

Explanation

Question 73 of 146

1

A threat actor has successfully breached the network firewall without being detected by the IDS system. What condition describes the lack of alert?

Select one of the following:

TRUE NEGATIVE
TRUE POSITIVE
FALSE POSITIVE
FALSE NEGATIVE

Explanation

Question 74 of 146

1

Use the following scenario to answer the questions. a company has just had a cybersecurity incident. The threat actor or actors appeared to have a goal of network disruption and appeared to use a common security hack tool that overwhelmed a particular server with a large amount of traffic, which rendered the server inoperable.
How would a certified cybersecurity analyst classify this type of threat actor?

Select one of the following:

Amateur
Hacktivist
State-sponsored
Terrorist

Explanation

Question 75 of 146

1

Use the following scenario to answer the questions. a company has just had a cybersecurity incident. The threat actor or actors appeared to have a goal of network disruption and appeared to use a common security hack tool that overwhelmed a particular server with a large amount of traffic, which rendered the server inoperable.
The security team at this company has removed the compromised server and preserved it with the security hack still embedded. What type of evidence is this?

Select one of the following:

Best
Classified
Corroborating
Indirect

Explanation

Question 76 of 146

1

Use the following scenario to answer the questions. a company has just had a cybersecurity incident. The threat actor or actors appeared to have a goal of network disruption and appeared to use a common security hack tool that overwhelmed a particular server with a large amount of traffic, which rendered the server inoperable.
Which type of attack was achieved?

Select one of the following:

Access
DoS
DDoS
Social engineering

Explanation

Question 77 of 146

1

Use the following scenario to answer the questions. a company has just had a cybersecurity incident. the threat actor or actors appeared to have a goal of network disruption and appeared to use a common security hack tool that overwhelmed a particular server with a large amount of traffic, which rendered the server inoperable.
What would be the threat attribution in this case?

Select one of the following:

Evaluating the server alert data
Obtaining the most volatile evidence
Determining who is responsible for the attack
Reporting the incident to the proper authorities

Explanation

Question 78 of 146

1

Use the following scenario to answer the questions. a company has just had a cybersecurity incident. the threat actor or actors appeared to have a goal of network disruption and appeared to use a common security hack tool that overwhelmed a particular server with a large amount of traffic, which rendered the server inoperable.
What are three common tools used to carry out this type of attack? (Choose three.)

Select one or more of the following:

Ping sweep
TCP SYN flood
Buffer overflow
IP, MAC and DHCP Spoofing
Smurf attack
Man-in-the-middle

Explanation

Question 79 of 146

1

Refer to the exhibit. A network security specialist issues the command tcpdump to capture events. What is the function provided by the ampersand symbol used in the command?

Select one of the following:

It instructs the tcpdump to capture data that starts with the symbol.
It tells the Linux shell to execute the tcpdump process in the background.
It tells the Linux shell to display the captured data on the console.
It tells the Linux shell to execute the tcpdump process indefinitely.

Explanation

Question 80 of 146

1

Refer to the exhibit. A cybersecurity analyst is using Sguil to verify security alerts. How is the current view sorted?

Select one of the following:

By sensor number
By source IP
By frequency
By Date/Time

Explanation

Question 81 of 146

1

Which three procedures in Sguil are provided to security analysts to address alerts? (Choose three.)

Select one or more of the following:

Expire false positives
Pivot to other information sources and tools
Construct queries using query builder
Escalate an uncertain alert
Correlate similar alerts into a single line
Categorize true positives

Explanation

Question 82 of 146

1

Which two strings will be matched by the regular expression? (Choose two.)
Level[^12]

Select one or more of the following:

Level4
Level3
Level2
Level1
Level12

Explanation

Question 83 of 146

1

Which statement describes the status after the Security Onion VM is started?

Select one of the following:

Sguil becomes enabled via the sudo Sguil –e terminal command
Awk becomes enabled via the sudo awk terminal command
Pullpork is used by ELSA as an open source search engine
Snort is enabled by default

Explanation

Question 84 of 146

1

What are the three core functions provided by the Security Onion? (Choose three.)

Select one or more of the following:

Business continuity planning
Full packet capture
Alert analysis
Intrusion detection
Security device management
Threat containment

Explanation

Question 85 of 146

1

Refer to the exhibit. A network security analyst is using the Follow TCP Stream feature in Wireshark to rebuild the TCP transaction. However, the transaction data seems indecipherable. What is the explanation for this?

Select one of the following:

The transaction data is encoded with base64
The transaction data is a binary file
The data shown is line noise
The transaction data is corrupted

Explanation

Question 86 of 146

1

What is the tool that has alert records linked directly to the search functionality of the Enterprise Log Search and Archive (ELSA)?

Select one of the following:

Sguil
Wireshark
CapMe
Snort

Explanation

Question 87 of 146

1

Refer to the exhibit. A network security analyst is examining captured data using Wireshark. The captured frames indicate that a host is downloading malware from a server. Which source port is used by the host to request the download?

Select one of the following:

66
1514
6666
48598

Explanation

Question 88 of 146

1

Which two types of unreadable network traffic could be eliminated from data collected by NSM? (Choose two.)

Select one or more of the following:

Routing updates traffic
STP traffic
SSL traffic
IPSec traffic
Broadcast traffic

Explanation

Question 89 of 146

1

When dealing with security threats and using the Cyber Kill Chain model, which two approaches can an organization use to help block potential exploitations of a system? (Choose two.)

Select one or more of the following:

Collect email and web logs for forensic reconstruction.
Analyze the infrastructure path used for delivery.
Audit endpoints to forensically determine origin of exploit.
Conduct full malware analysis.
Conduct employee awareness training and email testing.

Explanation

Question 90 of 146

1

Which action should be included in a plan element that is part of a computer security incident response capability (CSIRC)?

Select one of the following:

Detail how incidents should be handled based on the mission and functions of an organization.
Develop metrics for measuring the incident response capability and its effectiveness.
Create an organizational structure and definition of roles, responsibilities, and levels of authority.
Prioritize severity ratings of security incidents.

Explanation

Question 91 of 146

1

What is the objective the threat actor in establishing a two-way communication channel between the target system and a CnC infrastructure?

Select one of the following:

to allow the threat actor to issue commands to the software that is installed on the target
to steal network bandwidth from the network where the target is located
to launch a buffer overflow attack
to send user data stored on the target to the threat actor

Explanation

Question 92 of 146

1

After containment, what is the first step of eradicating an attack?

Select one of the following:

Hold meetings on lessons learned.
Change all passwords.
Patch all vulnerabilities.
Identify all hosts that need remediation.

Explanation

Question 93 of 146

1

What is defined in the SOP of a computer security incident response capability (CSIRC)?

Select one of the following:

the procedures that are followed during an incident response
the metrics for measuring incident response capabilities
the roadmap for increasing incident response capabilities
the details on how an incident is handled

Explanation

Question 94 of 146

1

A school has a web server mainly used for parents to view school events, access student performance indicators, and communicate with teachers. The network administrator suspects a security-related event has occurred and is reviewing what steps should be taken.

The threat actor has already placed malware on the server causing its performance to slow. The network administrator has found and removed the malware as well as patched the security hole where the threat actor gained access. The network administrator can find no other security issue. What stage of the Cyber Kill Chain did the threat actor achieve?

Select one of the following:

actions on objectives
command and control
delivery
exploitation
installation

Explanation

Question 95 of 146

1

A school has a web server mainly used for parents to view school events, access student performance indicators, and communicate with teachers. The network administrator suspects a security-related event has occurred and is reviewing what steps should be taken.

If the web server runs Microsoft IIS, which Windows tool would the network administrator use to view the access logs?

Select one of the following:

Event Viewer
net command
PowerShell
Task Manager

Explanation

Question 96 of 146

1

A school has a web server mainly used for parents to view school events, access student performance indicators, and communicate with teachers. The network administrator suspects a security-related event has occurred and is reviewing what steps should be taken.

Reports of network slowness lead the network administrator to review server alerts. The administrator confirms that an alert was an actual security incident. Which type of security alert classification would this be?

Select one of the following:

false negative
false positive
true negative
true positive

Explanation

Question 97 of 146

1

A school has a web server mainly used for parents to view school events, access student performance indicators, and communicate with teachers. The network administrator suspects a security-related event has occurred and is reviewing what steps should be taken.

The network administrator believes that the threat actor used a commonly available tool to slow the server down. The administrator concludes that based on the source IP address identified in the alert, the threat actor was probably one of the students. What type of hacker would the student be classified as?

Select one of the following:

black hat
gray hat
red hat
white hat

Explanation

Question 98 of 146

1

What is the goal of an attack in the installation phase of the Cyber Kill Chain?

Select one of the following:

Create a back door in the target system to allow for future access.
Establish command and control (CnC) with the target system.
Use the information from the reconnaissance phase to develop a weapon against the target.
Break the vulnerability and gain control of the target.

Explanation

Question 99 of 146

1

Which meta-feature element in the Diamond Model describes information gained by the adversary?

Select one of the following:

resources
methodology
direction
results

Explanation

Question 100 of 146

1

What is a benefit of using the VERIS community database?

Select one of the following:

It can be used to discover how other organizations dealt with a particular type of security incident.
Companies who pay to contribute and access the database are protected from security threats.
It can be used to discover the name of known threat actors.
The database can be easily compressed.

Explanation

Question 101 of 146

1

When a security attack has occurred, which two approaches should security professionals take to mitigate a compromised system during the Actions on Objectives step as defined by the Cyber Kill Chain model? (Choose two.)

Select one or more of the following:

Build detections for the behavior of known malware.
Train web developers for securing code.
Detect data exfiltration, lateral movement, and unauthorized credential usage.
Perform forensic analysis of endpoints for rapid triage.
Collect malware files and metadata for future analysis.

Explanation

Question 102 of 146

1

A threat actor has identified the potential vulnerability of the web server of an organization and is building an attack. What will the threat actor possibly do to build an attack weapon?

Select one of the following:

Obtain an automated tool in order to deliver the malware payload through the vulnerability.
Install a webshell on the web server for persistent access.
Create a point of persistence by adding services.
Collect credentials of the web server developers and administrators.

Explanation

Question 103 of 146

1

Which action is taken in the postincident phase of the NIST incident response life cycle?

Select one of the following:

Document the handling of the incident.
identify and validate incidents.
Conduct CSIRT response training.
Implement procedures to contain threats.

Explanation

Question 104 of 146

1

Which top-level element of the VERIS schema would allow a company to log who the actors were, what actions affected the asset, which assets were affected, and how the asset was affected?

Select one of the following:

incident description
incident tracking
discovery and response
victim demographics

Explanation

Question 105 of 146

1

What is the role of vendor teams as they relate to CSIRT?

Select one of the following:

Coordinate incident handling across multiple CSIRTs.
Handle customer reports concerning security vulnerabilities.
Use data from many sources to determine incident activity trends.
Provide incident handling to other organizations as a fee-based service.

Explanation

Question 106 of 146

1

According to information outlined by the Cyber Kill Chain, which two approaches can help identify reconnaissance threats? (Choose two.)

Select one or more of the following:

Analyze web log alerts and historical search data.
Audit endpoints to forensically determine origin of exploit.
Build playbooks for detecting browser behavior.
Conduct full malware analysis.
Understand targeted servers, people, and data available to attack.

Explanation

Question 107 of 146

1

To ensure that the chain of custody is maintained, what three items should be logged about evidence that is collected and analyzed after a security incident has occurred? (Choose three.)

Select one or more of the following:

measures used to prevent an incident
time and date the evidence was collected
extent of the damage to resources and assets
vulnerabilities that were exploited in an attack
serial numbers and hostnames of devices used as evidence
location of all evidence

Explanation

Question 108 of 146

1

Which schema or model was created to anonymously share quality information about security events to the security community?

Select one of the following:

VERIS
Diamond
CSIRT
Cyber Kill Chain

Explanation

Question 109 of 146

1

What is the purpose of the policy element in a computer security incident response capability of an organization, as recommended by NIST?

Select one of the following:

It provides a roadmap for maturing the incident response capability.
It provides metrics for measuring the incident response capability and effectiveness.
It defines how the incident response teams will communicate with the rest of the organization and with other organizations.
It details how incidents should be handled based on the organizational mission and functions.

Explanation

Question 110 of 146

1

What information is gathered by the CSIRT when determining the scope of a security incident?

Select one of the following:

the processes used to preserve evidence
the strategies and procedures used for incident containment
the networks, systems, and applications affected by an incident
the amount of time and resources needed to handle an incident

Explanation

Question 111 of 146

1

What is the main purpose of exploitations by a threat actor through the weapon delivered to a target during the Cyber Kill Chain exploitation phase?

Select one of the following:

Launch a DoS attack
Send a message back to CnC controlled by the threat actor
Break the vulnerability and gain control of the target
Establish a back door into the system

Explanation

Question 112 of 146

1

Which term is used in the Diamond Model of intrusion to describe a tool that a threat actor uses toward a target system?

Select one of the following:

infrastructure
capability
weaponization
adversary

Explanation

Question 113 of 146

1

What is the role of a Computer Emergency Response Team?

Select one of the following:

Receive, review, and respond to security incidents in an organization.
Provide national standards as a fee-based service.
Coordinate security incident handling across multiple CSIRTs.
Provide security awareness, best practices, and security vulnerability information to a specific population.

Explanation

Question 114 of 146

1

A threat actor collects information from web servers of an organization and searches for employee contact information. The information collected is further used to search personal information on the Internet. To which attack phase do these activities belong according to the Cyber Kill Chain model?

Select one of the following:

Actions on objectives
Exploitation
Reconnaissance
Weaponization

Explanation

Question 115 of 146

1

In which phase of the NIST incident response life cycle is evidence gathered that can assist subsequent investigations by authorities?

Select one of the following:

Preparation
Containment, Eradication and Recovery
Postincident activities
Detection and analysis

Explanation

Question 116 of 146

1

The company will be using both Linux- and Windows- based hosts. Which two solutions would be used in a distributed firewall network design? (Choose two).

Select one or more of the following:

Iptable
SIEM
Snort
Windows Table

Explanation

Question 117 of 146

1

The IT company is recommending the use of PKI applications. In which two instances might the entrepreneur make use of PKIs? (Choose two.)

Select one or more of the following:

802 is authentication
HTTPS web-service
FTP transfers
Local NTP server
File and directory permission

Explanation

Question 118 of 146

1

The entrepreneur is concerned about company employees having uninterrupted access to important resources and data. Which of the CIA triad components would address the concern?

Select one of the following:

Authentication
Confidentiality
Integrity
Availability

Explanation

Question 119 of 146

1

Use the following scenario to answer the questions. An entrepreneur is starting a small business and is considering the server services needed for the startup company. The company handling the IT service is presenting options to the company. The company will be using both Linux- and Windows-based hosts. Which two solutions would be used in a distributed firewall network design? (Choose two.)

Select one or more of the following:

Iptable
Windows Firewall
Snort
SIEM
Wireshark

Explanation

Question 120 of 146

1

What is the Stream Ciphers?

Select one of the following:

Stream ciphers operate on each bit (instead of block)
Random answer (do not click, dumbass)

Explanation

Question 121 of 146

1

Grey Hat Hackers are..

Select one or more of the following:

Commit crimes and do unethical things but not for personal gain or to cause damage.
May compromise network and then disclose the problem so the organization can fix the problem.
Random answer1
Random answer2

Explanation

Question 122 of 146

1

“Vulnerability Broker” Threat Actors ...

Select one of the following:

Discover exploits and report them to vendors, sometimes for prizes or rewards.
Random answer 1 (click here to get free $500!)

Explanation

Question 123 of 146

1

Definition of the attack " Sniffer "…

Select one of the following:

an application or device that can read, monitor, and capture network data exchanges and read network packets
Random answer 1 (do not click)

Explanation

Question 124 of 146

1

Which type of security threat can be described as software that attaches itself to another program to execute a specific unwanted function?

Select one of the following:

virus
worm
proxy Trojan horse
Denial of Service Trojan horse

Explanation

Question 125 of 146

1

What is the significant characteristic of worm malware?

Hint:
Virus requires a host program to run, worms can run by themselves. Automatically replicates itself and spreads across the network from system to system

Select one of the following:

A worm can execute independently of the host system.
A worm must be triggered by an event on the host system.
Worm malware disguises itself as legitimate software.
Once installed on a host system, a worm does not replicate itself

Explanation

Question 126 of 146

1

What is the purpose of a reconnaissance attack on a computer network?

Select one of the following:

Also known as information gathering, reconnaissance attacks perform unauthorized discovery and mapping of systems, services, or vulnerabilities.
Random answer 1

Explanation

Question 127 of 146

1

Type of access attack that attempts to manipulate individuals into performing actions or divulging confidential information needed to access a network.

Select one of the following:

Social engineering attacks
Random answer 1

Explanation

Question 128 of 146

1

What kind of DDOS term are malware designed to infect a host and communicate with a handler system and can also log keystrokes, gather passwords, capture and analyze packets, and more?

Select one of the following:

Bots
Random answer 1

Explanation

Question 129 of 146

1

What term DDoS attack refers to a group of zombies infected using self-propagating malware (i.e., bots) and are controlled by handlers?

Select one of the following:

Botnet
Random answer 1 (do not click)

Explanation

Question 130 of 146

1

What term DDoS attack refers to a master command-and-control server controlling groups of zombies?

Select one of the following:

Handlers
Bots
Botnet
Botmaster

Explanation

Question 131 of 146

1

What term DDoS attack refers to a group of compromised hosts (i.e. agents) that run malicious code referred to as robots (i.e. bots) ?

Select one of the following:

Zombies
Handlers
Botmaster
Scrum master

Explanation

Question 132 of 146

1

What term DDoS attack refers to the malware designed to infect a host and communicate with a handler system. It can also log keystrokes, gather passwords, capture and analyze packets, and more...

Select one of the following:

Bots
Zombies
Handlers
Handlermaster

Explanation

Question 133 of 146

1

What term DDoS attack refers to a group of zombies infected using self-propogating malware (i.e. bots) and are controlled by handlers.

Select one of the following:

Botnet
Handlers
Handlermaster
Scrum master

Explanation

Question 134 of 146

1

What DDOS attack term refers to the threat actor in control of the botnet handlers?

Select one of the following:

Botmaster
Zombies
Zombie master
Scrum master

Explanation

Question 135 of 146

1

Types of attacks targeting IP:

Select one or more of the following:

DOS
buffer overflow
Random answer 1 (do not click here)

Explanation

Question 136 of 146

1

The DoS attacks...

Select one or more of the following:

Originates from multiple, coordinated sources
Compromises many hosts
Random answer 1

Explanation

Question 137 of 146

1

ICMP attacks...

Select one or more of the following:

Can be used to identify hosts on a network, the structure of a network, and determine the operating systems at use on the network.
Can also be used as a vehicle for various types of DoS attacks.
ICMP can also be used for data exfiltration through ICMP traffic from inside the network.
To carry diagnostic messages and to report error conditions when routes, hosts, and ports are unavailable.
ICMP messages are generated by devices when a network error or outage occurs.
Random answer 1 (do not click here)

Explanation

Question 138 of 146

1

Two major sources of DoS attacks (choose two):

Select one or more of the following:

Maliciously Formatted Packets
Overwhelming Quantity of Traffic
Random answer 1 (don't click)

Explanation

Question 139 of 146

1

Which tool is used to provide a list of open ports on network devices?

Select one of the following:

Nmap
Sguil
ELSA
Security Onion

Explanation

Question 140 of 146

1

The security policy of an organization allows employees to connect to the office intranet from their homes. Which type of security policy is this?

Select one of the following:

remote access
Random answer 1

Explanation

Question 141 of 146

1

What is IPS?

Select one of the following:

Intrusion prevention system that stops trigger packets
Random answer

Explanation

Question 142 of 146

1

What is the ACL?

Select one of the following:

Is a series of commands that control whether a device forwards or drops packets based on information found in the packet header
Random answer

Explanation

Question 143 of 146

1

What is the The syslog logging service?

Select one or more of the following:

Serivce that allows networking devices to send their system messages across the network to syslog servers.
Service that provides three primary functions:

Gather logging information for monitoring and troubleshooting;
Select the type of logging information that is captured;
Specify the destination of captured syslog messages.
Random answer 1

Explanation

Question 144 of 146

1

________ is an usually part of a router firewall, which permits or denies traffic based on Layer 3 and Layer 4 information.

Select one of the following:

Packet filtering (Stateless) firewalls
Random answer

Explanation

Question 145 of 146

1

This type firewalls filters IP traffic between a pair of bridged interfaces

Select one of the following:

Transparent firewall
Random answer

Explanation

Question 146 of 146

1

What systems provide real time reporting and long-term analysis of security events?

Select one of the following:

Security Information Event Management (SIEM)
Random answer

	Created by Good Guy Beket over 5 years ago

Advanced Fundamentals of Information Security [Teachers: Abdulanova Altynay, Sagymbekova Azhar; STATE EXAM] ▼ (State Exam) Quiz on Fundamentals of Information Security [State Exam | Part 2 + 23 new questions], created by Good Guy Beket on 26/03/2019.

Fundamentals of Information Security [State Exam | Part 2 + 23 new questions]

Question 1 of 146

What are two methods to maintain certificate revocation status? (Choose two.)

Select one or more of the following:

Explanation

Question 2 of 146

The following message was encrypted using a Caesar cipher with a key of 2: fghgpf vjg ecuvng What is the plaintext message?

Select one of the following:

Explanation

Question 3 of 146

What is the purpose of a digital certificate?

Select one of the following:

Explanation

Question 4 of 146

Select one of the following:

Explanation

Question 5 of 146

In most host-based security suites, which function provides robust logging of security-related events and sends logs to a central location?

Select one of the following:

Explanation

Question 6 of 146

On a Windows host, which tool can be used to create and maintain blacklists and whitelists?

Select one of the following:

Explanation

Question 7 of 146

Which statement describes agentless antivirus protection?

Select one of the following:

Explanation

Question 8 of 146

Select one of the following:

Explanation

Question 9 of 146

In addressing a risk that has low potential impact and relatively high cost of mitigation or reduction, which strategy will accept the risk and its consequences?

Select one of the following:

Explanation

Question 10 of 146

What is a host-based intrusion detection system (HIDS)?

Select one of the following:

Explanation

Question 11 of 146

What type of antimalware program is able to detect viruses by recognizing various characteristics of a known malware file?

Select one of the following:

Explanation

Question 12 of 146

Which device in a LAN infrastructure is susceptible to MAC address-table overflow and spoofing attacks?

Select one of the following:

Explanation

Question 13 of 146

Which criterion in the Base Metric Group Exploitability metrics reflects the proximity of the threat actor to the vulnerable component?

Select one of the following:

Explanation

Question 14 of 146

In addressing an identified risk, which strategy aims to stop performing the activities that create risk?

Select one of the following:

Explanation

Question 15 of 146

Which statement describes the term iptables?

Select one of the following:

Explanation

Question 16 of 146

For network systems, which management system addresses the inventory and control of hardware and software configurations?

Select one of the following:

Explanation

Question 17 of 146

Which statement describes the anomaly-based intrusion detection approach?

Select one of the following:

Explanation

Question 18 of 146

What is the first step taken in risk assessment?

Select one of the following:

Explanation

Question 19 of 146

Which statement describes the threat-vulnerability (T-V) pairing?

Select one of the following:

Explanation

Question 20 of 146

Which security procedure would be used on a Windows workstation to prevent access to a specific set of websites?

Select one of the following:

Explanation

The following message was encrypted using a Caesar cipher with a key of 2:

fghgpf vjg ecuvng

What is the plaintext message?