Copiar e Editar

Fundamentals of Information Security [State Exam | Part 2 + 23 new questions]

Descrição

Advanced Fundamentals of Information Security [Teachers: Abdulanova Altynay, Sagymbekova Azhar; STATE EXAM] ▼ (State Exam) Quiz sobre Fundamentals of Information Security [State Exam | Part 2 + 23 new questions], criado por Good Guy Beket em 26-03-2019.
Good Guy Beket
Quiz por Good Guy Beket, atualizado more than 1 year ago
Good Guy Beket
Criado por Good Guy Beket mais de 5 anos atrás
865
15
0

Resumo de Recurso

Questão 1

Questão
What are two methods to maintain certificate revocation status? (Choose two.)
Responda
  • subordinate CA
  • OCSP
  • DNS
  • LDAP
  • CRL

Questão 2

Questão
The following message was encrypted using a Caesar cipher with a key of 2: fghgpf vjg ecuvng What is the plaintext message?
Responda
  • invade the castle
  • defend the castle
  • defend the region
  • invade the region

Questão 3

Questão
What is the purpose of a digital certificate?
Responda
  • It ensures that the person who is gaining access to a network device is authorized.
  • It provides proof that data has a traditional signature attached.
  • It guarantees that a website has not been hacked.
  • It authenticates a website and establishes a secure connection to exchange confidential data

Questão 4

Questão
A company is developing a security policy for secure communication. In the exchange of critical messages between a headquarters office and a branch office, a hash value should only be recalculated with a predetermined code, thus ensuring the validity of data source. Which aspect of secure communications is addressed?
Responda
  • data integrity
  • non-repudiation
  • origin authentication
  • data confidentiality

Questão 5

Questão
In most host-based security suites, which function provides robust logging of security-related events and sends logs to a central location?
Responda
  • intrusion detection and prevention
  • anti-phishing
  • telemetry
  • safe browsing

Questão 6

Questão
On a Windows host, which tool can be used to create and maintain blacklists and whitelists?
Responda
  • Group Policy Editor
  • Local Users and Groups
  • Computer Management
  • Task Manager

Questão 7

Questão
Which statement describes agentless antivirus protection?
Responda
  • Host-based antivirus systems provide agentless antivirus protection.
  • The antivirus protection is provided by the router that is connected to a cloud service.
  • The antivirus protection is provided by the ISP.
  • Antivirus scans are performed on hosts from a centralized system.

Questão 8

Questão
The IT security personnel of an organization notice that the web server deployed in the DMZ is frequently targeted by threat actors. The decision is made to implement a patch management system to manage the server. Which risk management strategy method is being used to respond to the identified risk?
Responda
  • risk avoidance
  • risk retention
  • risk reduction
  • risk sharing

Questão 9

Questão
In addressing a risk that has low potential impact and relatively high cost of mitigation or reduction, which strategy will accept the risk and its consequences?
Responda
  • risk reduction
  • risk avoidance
  • risk retention
  • risk sharing

Questão 10

Questão
What is a host-based intrusion detection system (HIDS)?
Responda
  • It identifies potential attacks and sends alerts but does not stop the traffic.
  • It detects and stops potential direct attacks but does not scan for malware.
  • It is an agentless system that scans files on a host for potential malware.
  • It combines the functionalities of antimalware applications with firewall protection.

Questão 11

Questão
What type of antimalware program is able to detect viruses by recognizing various characteristics of a known malware file?
Responda
  • behavior-based
  • agent-based
  • signature-based
  • heuristic-based

Questão 12

Questão
Which device in a LAN infrastructure is susceptible to MAC address-table overflow and spoofing attacks?
Responda
  • firewall
  • workstation
  • server
  • switch

Questão 13

Questão
Which criterion in the Base Metric Group Exploitability metrics reflects the proximity of the threat actor to the vulnerable component?
Responda
  • user interaction
  • attack vector
  • attack complexity
  • privileges required

Questão 14

Questão
In addressing an identified risk, which strategy aims to stop performing the activities that create risk?
Responda
  • risk reduction
  • risk avoidance
  • risk retention
  • risk sharing

Questão 15

Questão
Which statement describes the term iptables?
Responda
  • It is a file used by a DHCP server to store current active IP addresses.
  • It is a DHCP application in Windows.
  • It is a DNS daemon in Linux.
  • It is a rule-based firewall application in Linux.

Questão 16

Questão
For network systems, which management system addresses the inventory and control of hardware and software configurations?
Responda
  • asset management
  • vulnerability management
  • risk management
  • configuration management

Questão 17

Questão
Which statement describes the anomaly-based intrusion detection approach?
Responda
  • It compares the signatures of incoming traffic to a known intrusion database.
  • It compares the antivirus definition file to a cloud based repository for latest updates.
  • It compares the operations of a host against a well-defined security policy.
  • It compares the behavior of a host to an established baseline to identify potential intrusions.

Questão 18

Questão
What is the first step taken in risk assessment?
Responda
  • Identify threats and vulnerabilities and the matching of threats with vulnerabilities.
  • Establish a baseline to indicate risk before security controls are implemented.
  • Compare to any ongoing risk assessment as a means of evaluating risk management effectiveness.
  • Perform audits to verify threats are eliminated.

Questão 19

Questão
Which statement describes the threat-vulnerability (T-V) pairing?
Responda
  • It is the identification of threats and vulnerabilities and the matching of threats with vulnerabilities.
  • It is the comparison between known malware and system risks.
  • It is the detection of malware against a central vulnerability research center.
  • It is the advisory notice from a vulnerability research center.

Questão 20

Questão
Which security procedure would be used on a Windows workstation to prevent access to a specific set of websites?
Responda
  • whitelisting
  • HIDS
  • blacklisting
  • baselining

Questão 21

Questão
Which statement describes the use of a Network Admission Control (NAC) solution?
Responda
  • It provides network access to only authorized and compliant systems.
  • A Network Admission Control solution provides filtering of potentially malicious emails before they reach the endpoint.
  • It provides endpoint protection from viruses and malware.
  • It provides filtering and blacklisting of websites being accessed by end users.

Questão 22

Questão
Which type of antimalware software detects and mitigates malware by analyzing suspicious activities?
Responda
  • heuristics-based
  • packet-based
  • behavior-based
  • signature-based

Questão 23

Questão
Which regulatory compliance regulation sets requirements for all U.S. public company boards, management and public accounting firms regarding the way in which corporations control and disclose financial information?
Responda
  • Gramm-Leach-Bliley Act (GLBA)
  • Health Insurance Portability and Accountability Act (HIPAA)
  • Federal Information Security Management Act of 2002 (FISMA)
  • Sarbanes-Oxley Act of 2002 (SOX)

Questão 24

Questão
Which statement describes the term attack surface?
Responda
  • It is the total sum of vulnerabilities in a system that is accessible to an attacker.
  • It is the group of hosts that experiences the same attack.
  • It is the network interface where attacks originate.
  • It is the total number of attacks toward an organization within a day.

Questão 25

Questão
Which step in the Vulnerability Management Life Cycle determines a baseline risk profile to eliminate risks based on asset criticality, vulnerability threat, and asset classification?
Responda
  • assess
  • discover
  • verify
  • prioritize assets

Questão 26

Questão
When a network baseline is being established for an organization, which network profile element indicates the time between the establishment of a data flow and its termination?
Responda
  • session duration
  • critical asset address space
  • ports used
  • total throughput

Questão 27

Questão
Which two classes of metrics are included in the CVSS Base Metric Group? (Choose two.)
Responda
  • Modified Base
  • Confidentiality Requirement
  • Exploit Code Maturity
  • Exploitability
  • Impact metrics

Questão 28

Questão
In network security assessments, which type of test employs software to scan internal networks and Internet facing servers for various types of vulnerabilities?
Responda
  • risk analysis
  • penetration testing
  • vulnerability assessment
  • strength of network security testing

Questão 29

Questão
Which two criteria in the Base Metric Group Exploitability metrics are associated with the complexity of attacks? (Choose two)
Responda
  • scope
  • attack complexity
  • user interaction
  • attack vector
  • privileges required

Questão 30

Questão
Which statement describes the Cisco Threat Grid Glovebox?
Responda
  • It is a network-based IDS/IPS.
  • It is a firewall appliance.
  • It is a host-based intrusion detection system (HIDS) solution to fight against malware
  • It is a sandbox product for analyzing malware behaviors.

Questão 31

Questão
How does using HTTPS complicate network security monitoring?
Responda
  • HTTPS cannot protect visitors to a company-provided web site.
  • HTTPS can be used to infiltrate DNS queries.
  • Web browser traffic is directed to infected servers.
  • HTTPS adds complexity to captured packets.

Questão 32

Questão
Which protocol is used to send e-mail messages between two servers that are in different e-mail domains?
Responda
  • POP3
  • SMTP
  • HTTP
  • IMAP4

Questão 33

Questão
What are two ways that ICMP can be a security threat to a company? (Choose two.)
Responda
  • by collecting information about a network
  • by corrupting network IP data packets
  • by providing a conduit for DoS attacks
  • by corrupting data between email servers and email recipients
  • by the infiltration of web pages

Questão 34

Questão
Which function is provided by the Sguil application?
Responda
  • It makes Snort-generated alerts readable and searchable.
  • It detects potential network intrusions.
  • It reports conversations between hosts on the network.
  • It prevents malware from attacking a host.

Questão 35

Questão
Which two options are network security monitoring approaches that use advanced analytic techniques to analyze network telemetry data? (Choose two.)
Responda
  • NetFlow
  • Snorby
  • NBAD
  • NBA
  • IPFIX
  • Sguil

Questão 36

Questão
A system administrator has recommended to the CIO a move of some applications from a Windows server to a Linux server. The proposed server will use ext4 partitions and serve as a web server, file server, and print server. The CIO is considering the recommendation, but has some questions regarding security. Which two methods does Linux use to log data in order to identify a security event? (Choose two.)
Responda
  • Apache access logs
  • Event Viewer
  • NetFlow
  • SPAN
  • syslog

Questão 37

Questão
A system administrator has recommended to the CIO a move of some applications from a Windows server to a Linux server. The proposed server will use ext4 partitions and serve as a web server, file server, and print server. The CIO is considering the recommendation, but has some questions regarding security. What is a daemon?
Responda
  • a background process that runs without the need for user interaction
  • a record to keep track of important events
  • a type of security attack
  • an application that monitors and analyzes suspicious activity

Questão 38

Questão
A system administrator has recommended to the CIO a move of some applications from a Windows server to a Linux server. The proposed server will use ext4 partitions and serve as a web server, file server, and print server. The CIO is considering the recommendation, but has some questions regarding security. Because the company uses discretionary access control (DAC) for user file management, what feature would need to be supported on the server?
Responda
  • access based on security clearance held
  • principle of least privilege
  • role-based access control
  • user-based data access control

Questão 39

Questão
A system administrator has recommended to the CIO a move of some applications from a Windows server to a Linux server. The proposed server will use ext4 partitions and serve as a web server, file server, and print server. The CIO is considering the recommendation, but has some questions regarding security. What are two benefits of using an ext4 partition instead of ext3? (Choose two.)
Responda
  • compatibility with CDFS
  • compatibility with NTFS
  • decreased load time
  • improved performance
  • an increase in the number of supported devices
  • increase in the size of supported files

Questão 40

Questão
How can IMAP be a security threat to a company?
Responda
  • It can be used to encode stolen data and send to a threat actor.
  • An email can be used to bring malware to a host.
  • Encrypted data is decrypted.
  • Someone inadvertently clicks on a hidden iFrame.

Questão 41

Questão
A system administrator runs a file scan utility on a Windows PC and notices a file lsass.exe in the Program Files directory. What should the administrator do?
Responda
  • Open the Task Manager, right-click on the lsass process and choose End Task.
  • Uninstall the lsass application because it is a legacy application and no longer required by Windows.
  • Move it to Program Files (x86) because it is a 32bit application.
  • Delete the file because it is probably malware.

Questão 42

Questão
How does a web proxy device provide data loss prevention (DLP) for an enterprise?
Responda
  • by checking the reputation of external web servers
  • by functioning as a firewall
  • by inspecting incoming traffic for potential exploits
  • by scanning and logging outgoing traffic

Questão 43

Questão
A system analyst is reviewing syslog messages and notices that the PRI value of a message is 26. What is the severity value of the message?
Responda
  • 1
  • 2
  • 3
  • 6

Questão 44

Questão
Which statement describes session data in security logs?
Responda
  • It is a record of a conversation between network hosts.
  • It can be used to describe or predict network behavior.
  • It reports detailed network activities between network hosts.
  • It shows the result of network sessions.

Questão 45

Questão
In a Cisco AVC system, in which module is NetFlow deployed?
Responda
  • Management and Reporting
  • Metrics Collection
  • Control
  • Application Recognition

Questão 46

Questão
What port number would be used if a threat actor was using NTP to direct DDoS attacks?
Responda
  • 443
  • 25
  • 69
  • 123

Questão 47

Questão
Which information can be provided by the Cisco NetFlow utility?
Responda
  • IDS and IPS capabilities
  • security and user account restrictions
  • peak usage times and traffic routing
  • source and destination UDP port mapping

Questão 48

Questão
What is Tor?
Responda
  • a type of Instant Messaging (IM) software used on the darknet
  • a way to share processors between network devices across the Internet
  • a rule created in order to match a signature of a known exploit
  • a software platform and network of P2P hosts that function as Internet routers

Questão 49

Questão
Which statement describes statistical data in network security monitoring processes?
Responda
  • It shows the results of network activities between network hosts.
  • It contains conversations between network hosts.
  • It is created through an analysis of other forms of network data.
  • It lists each alert message along with statistical information.

Questão 50

Questão
Refer to the exhibit. A network administrator is reviewing an Apache access log message. What is the status of the access request by the client?
Image:
Screenshot 4 (binary/octet-stream)
Responda
  • The request was unsuccessful because of server errors.
  • The request was fulfilled successfully.
  • The request was redirected to another web server.
  • The request was unsuccessful because of client errors.

Questão 51

Questão
How might corporate IT professionals deal with DNS-based cyber threats?
Responda
  • Monitor DNS proxy server logs and look for unusual DNS queries.
  • Use IPS/IDS devices to scan internal corporate traffic.
  • Limit the number of simultaneously opened browsers or browser tabs.
  • Limit the number of DNS queries permitted within the organization.

Questão 52

Questão
Refer to the exhibit. A junior network engineer is handed a print-out of the network information shown. Which protocol or service originated the information shown in the graphic?
Responda
  • NetFlow
  • TACACS+
  • RADIUS
  • Syslog

Questão 53

Questão
Which technology is used in Cisco Next-Generation IPS devices to consolidate multiple security layers into a single platform?
Responda
  • FirePOWER
  • WinGate
  • Apache Traffic Server
  • Squid

Questão 54

Questão
Refer to the exhibit. How is the traffic from the client web browser being altered when connected to the destination website of www.cisco.com?
Image:
Screenshot 5 (binary/octet-stream)
Responda
  • Traffic is sent in plain-text by the user machine and is encrypted by the TOR node in France and decrypted by the TOR node in Germany.
  • Traffic is encrypted by the user machine and sent directly to the cisco.com server to be decrypted.
  • Traffic is encrypted by the user machine, and the TOR network only routes the traffic through France, Canada, Germany, and delivers it to cisco.com.
  • Traffic is encrypted by the user machine, and the TOR network encrypts next-hop information on a hop-by-hop basis.

Questão 55

Questão
Which Windows log contains information about installations of software, including Windows updates?
Responda
  • setup logs
  • application logs
  • system logs
  • security logs

Questão 56

Questão
Which Windows log records events related to login attempts and operations related to file or object access?
Responda
  • setup logs
  • security logs
  • application logs
  • system logs

Questão 57

Questão
What does it indicate if the timestamp in the HEADER section of a syslog message is preceded by a period or asterisk symbol?
Responda
  • The timestamp represents the round trip duration value.
  • The syslog message indicates the time an email is received.
  • There is a problem associated with NTP.
  • The syslog message should be treated with high priority.

Questão 58

Questão
Which two application layer protocols manage the exchange of messages between a client with a web browser and a remote web server? (Choose two.)
Responda
  • HTTPS
  • DHCP
  • HTML
  • DNS
  • HTTP

Questão 59

Questão
Which protocol is a name resolution protocol often used by malware to communicate with command-and-control (CnC) servers?
Responda
  • IMAP
  • HTTPS
  • DNS
  • ICMP

Questão 60

Questão
How is the hash value of files useful in network security investigations?
Responda
  • It helps identify malware signatures
  • It is used to decode files
  • It verifies confidentiality of files
  • It is used as a key for encryption

Questão 61

Questão
Which tool is a Security Onion integrated host-based intrusion detection system?
Responda
  • OSSEC
  • Sguil
  • ELSA
  • Snort

Questão 62

Questão
Which type of evidence supports an assertion based on previously obtained evidence?
Responda
  • Direct evidence
  • Corroborating evidence
  • Best evidence
  • Indirect evidence

Questão 63

Questão
Which tool is developed by Cisco and provides an interactive dashboard that allows investigation of the threat landscape?
Responda
  • Wireshark
  • Talos
  • Sguil
  • Snort

Questão 64

Questão
Which term is used to describe the process of converting log entries into a common format?
Responda
  • Standardization
  • Normalization
  • Classification
  • Systemization

Questão 65

Questão
According to NIST, which step in the digital forensics process involves extracting relevant information from data?
Responda
  • Collection
  • Examination
  • Analysis
  • Reporting

Questão 66

Questão
A law office uses a Linux host as the firewall device for the network. The IT administrator is adding a rule to the firewall iptables to block internal hosts from connecting to a remote device that has the IP address 209.165.202.133. Which command should the administrator use?
Responda
  • IPTABLES –I FORWARD –P TCP –D 209.165.202.133 –DPORT 7777 –J DROP
  • IPTABLES –I INPUT –P TCP –D 209.165.202.133 –DPORT 7777 –J DROP
  • IPTABLES –I PASS –P TCP –D 209.165.202.133 –DPORT 7777 –J DROP
  • IPTABLES –I OUTPUT –P TCP –D 209.165.202.133 –DPORT 7777 –J DROP

Questão 67

Questão
What procedure should be avoided in a digital forensics investigation?
Responda
  • Secure physical access to the computer under investigation
  • Reboot the affected system upon arrival
  • Make a copy of the hard drive
  • Recover deleted files

Questão 68

Questão
Which statement describes a feature of timestamps in Linux?
Responda
  • Human readable timestamps measure the number of seconds that have passed since January 1, 1970.
  • All devices generate human readable and unix epoch timestamps
  • It is easier to work with Unix epoch timestamps for addition and subtraction operations
  • Unix epoch timestamps are easier for humans to interpret

Questão 69

Questão
Which tool is included with Security Onion that is used by Snort to automatically download new rules?
Responda
  • Sguil
  • Wireshark
  • PulledPork
  • ELSA

Questão 70

Questão
Which tool would an analyst use to start a workflow investigation?
Responda
  • Sguil
  • Bro
  • Snort
  • ELSA

Questão 71

Questão
What is indicated by a Snort signature ID that is below 3464?
Responda
  • The SID was created by Sourcefire and distributed under a GPL agreement
  • This is a custom signature developed by the organization to address locally observed rules
  • The SID was created by members of emerging threats
  • The SID was created by the Snort community and is maintained in community rules

Questão 72

Questão
How does an application program interact with the operating system?
Responda
  • Accessing BIOS or UEFI
  • Making API calls
  • Sending files
  • Using processes

Questão 73

Questão
A threat actor has successfully breached the network firewall without being detected by the IDS system. What condition describes the lack of alert?
Responda
  • TRUE NEGATIVE
  • TRUE POSITIVE
  • FALSE POSITIVE
  • FALSE NEGATIVE

Questão 74

Questão
Use the following scenario to answer the questions. a company has just had a cybersecurity incident. The threat actor or actors appeared to have a goal of network disruption and appeared to use a common security hack tool that overwhelmed a particular server with a large amount of traffic, which rendered the server inoperable. How would a certified cybersecurity analyst classify this type of threat actor?
Responda
  • Amateur
  • Hacktivist
  • State-sponsored
  • Terrorist

Questão 75

Questão
Use the following scenario to answer the questions. a company has just had a cybersecurity incident. The threat actor or actors appeared to have a goal of network disruption and appeared to use a common security hack tool that overwhelmed a particular server with a large amount of traffic, which rendered the server inoperable. The security team at this company has removed the compromised server and preserved it with the security hack still embedded. What type of evidence is this?
Responda
  • Best
  • Classified
  • Corroborating
  • Indirect

Questão 76

Questão
Use the following scenario to answer the questions. a company has just had a cybersecurity incident. The threat actor or actors appeared to have a goal of network disruption and appeared to use a common security hack tool that overwhelmed a particular server with a large amount of traffic, which rendered the server inoperable. Which type of attack was achieved?
Responda
  • Access
  • DoS
  • DDoS
  • Social engineering

Questão 77

Questão
Use the following scenario to answer the questions. a company has just had a cybersecurity incident. the threat actor or actors appeared to have a goal of network disruption and appeared to use a common security hack tool that overwhelmed a particular server with a large amount of traffic, which rendered the server inoperable. What would be the threat attribution in this case?
Responda
  • Evaluating the server alert data
  • Obtaining the most volatile evidence
  • Determining who is responsible for the attack
  • Reporting the incident to the proper authorities

Questão 78

Questão
Use the following scenario to answer the questions. a company has just had a cybersecurity incident. the threat actor or actors appeared to have a goal of network disruption and appeared to use a common security hack tool that overwhelmed a particular server with a large amount of traffic, which rendered the server inoperable. What are three common tools used to carry out this type of attack? (Choose three.)
Responda
  • Ping sweep
  • TCP SYN flood
  • Buffer overflow
  • IP, MAC and DHCP Spoofing
  • Smurf attack
  • Man-in-the-middle

Questão 79

Questão
Refer to the exhibit. A network security specialist issues the command tcpdump to capture events. What is the function provided by the ampersand symbol used in the command?
Image:
Screenshot 6 (binary/octet-stream)
Responda
  • It instructs the tcpdump to capture data that starts with the symbol.
  • It tells the Linux shell to execute the tcpdump process in the background.
  • It tells the Linux shell to display the captured data on the console.
  • It tells the Linux shell to execute the tcpdump process indefinitely.

Questão 80

Questão
Refer to the exhibit. A cybersecurity analyst is using Sguil to verify security alerts. How is the current view sorted?
Image:
Screenshot 7 (binary/octet-stream)
Responda
  • By sensor number
  • By source IP
  • By frequency
  • By Date/Time

Questão 81

Questão
Which three procedures in Sguil are provided to security analysts to address alerts? (Choose three.)
Responda
  • Expire false positives
  • Pivot to other information sources and tools
  • Construct queries using query builder
  • Escalate an uncertain alert
  • Correlate similar alerts into a single line
  • Categorize true positives

Questão 82

Questão
Which two strings will be matched by the regular expression? (Choose two.) Level[^12]
Responda
  • Level4
  • Level3
  • Level2
  • Level1
  • Level12

Questão 83

Questão
Which statement describes the status after the Security Onion VM is started?
Responda
  • Sguil becomes enabled via the sudo Sguil –e terminal command
  • Awk becomes enabled via the sudo awk terminal command
  • Pullpork is used by ELSA as an open source search engine
  • Snort is enabled by default

Questão 84

Questão
What are the three core functions provided by the Security Onion? (Choose three.)
Responda
  • Business continuity planning
  • Full packet capture
  • Alert analysis
  • Intrusion detection
  • Security device management
  • Threat containment

Questão 85

Questão
Refer to the exhibit. A network security analyst is using the Follow TCP Stream feature in Wireshark to rebuild the TCP transaction. However, the transaction data seems indecipherable. What is the explanation for this?
Responda
  • The transaction data is encoded with base64
  • The transaction data is a binary file
  • The data shown is line noise
  • The transaction data is corrupted

Questão 86

Questão
What is the tool that has alert records linked directly to the search functionality of the Enterprise Log Search and Archive (ELSA)?
Responda
  • Sguil
  • Wireshark
  • CapMe
  • Snort

Questão 87

Questão
Refer to the exhibit. A network security analyst is examining captured data using Wireshark. The captured frames indicate that a host is downloading malware from a server. Which source port is used by the host to request the download?
Image:
Screenshot 8 (binary/octet-stream)
Responda
  • 66
  • 1514
  • 6666
  • 48598

Questão 88

Questão
Which two types of unreadable network traffic could be eliminated from data collected by NSM? (Choose two.)
Responda
  • Routing updates traffic
  • STP traffic
  • SSL traffic
  • IPSec traffic
  • Broadcast traffic

Questão 89

Questão
When dealing with security threats and using the Cyber Kill Chain model, which two approaches can an organization use to help block potential exploitations of a system? (Choose two.)
Responda
  • Collect email and web logs for forensic reconstruction.
  • Analyze the infrastructure path used for delivery.
  • Audit endpoints to forensically determine origin of exploit.
  • Conduct full malware analysis.
  • Conduct employee awareness training and email testing.

Questão 90

Questão
Which action should be included in a plan element that is part of a computer security incident response capability (CSIRC)?
Responda
  • Detail how incidents should be handled based on the mission and functions of an organization.
  • Develop metrics for measuring the incident response capability and its effectiveness.
  • Create an organizational structure and definition of roles, responsibilities, and levels of authority.
  • Prioritize severity ratings of security incidents.

Questão 91

Questão
What is the objective the threat actor in establishing a two-way communication channel between the target system and a CnC infrastructure?
Responda
  • to allow the threat actor to issue commands to the software that is installed on the target
  • to steal network bandwidth from the network where the target is located
  • to launch a buffer overflow attack
  • to send user data stored on the target to the threat actor

Questão 92

Questão
After containment, what is the first step of eradicating an attack?
Responda
  • Hold meetings on lessons learned.
  • Change all passwords.
  • Patch all vulnerabilities.
  • Identify all hosts that need remediation.

Questão 93

Questão
What is defined in the SOP of a computer security incident response capability (CSIRC)?
Responda
  • the procedures that are followed during an incident response
  • the metrics for measuring incident response capabilities
  • the roadmap for increasing incident response capabilities
  • the details on how an incident is handled

Questão 94

Questão
A school has a web server mainly used for parents to view school events, access student performance indicators, and communicate with teachers. The network administrator suspects a security-related event has occurred and is reviewing what steps should be taken. The threat actor has already placed malware on the server causing its performance to slow. The network administrator has found and removed the malware as well as patched the security hole where the threat actor gained access. The network administrator can find no other security issue. What stage of the Cyber Kill Chain did the threat actor achieve?
Responda
  • actions on objectives
  • command and control
  • delivery
  • exploitation
  • installation

Questão 95

Questão
A school has a web server mainly used for parents to view school events, access student performance indicators, and communicate with teachers. The network administrator suspects a security-related event has occurred and is reviewing what steps should be taken. If the web server runs Microsoft IIS, which Windows tool would the network administrator use to view the access logs?
Responda
  • Event Viewer
  • net command
  • PowerShell
  • Task Manager

Questão 96

Questão
A school has a web server mainly used for parents to view school events, access student performance indicators, and communicate with teachers. The network administrator suspects a security-related event has occurred and is reviewing what steps should be taken. Reports of network slowness lead the network administrator to review server alerts. The administrator confirms that an alert was an actual security incident. Which type of security alert classification would this be?
Responda
  • false negative
  • false positive
  • true negative
  • true positive

Questão 97

Questão
A school has a web server mainly used for parents to view school events, access student performance indicators, and communicate with teachers. The network administrator suspects a security-related event has occurred and is reviewing what steps should be taken. The network administrator believes that the threat actor used a commonly available tool to slow the server down. The administrator concludes that based on the source IP address identified in the alert, the threat actor was probably one of the students. What type of hacker would the student be classified as?
Responda
  • black hat
  • gray hat
  • red hat
  • white hat

Questão 98

Questão
What is the goal of an attack in the installation phase of the Cyber Kill Chain?
Responda
  • Create a back door in the target system to allow for future access.
  • Establish command and control (CnC) with the target system.
  • Use the information from the reconnaissance phase to develop a weapon against the target.
  • Break the vulnerability and gain control of the target.

Questão 99

Questão
Which meta-feature element in the Diamond Model describes information gained by the adversary?
Responda
  • resources
  • methodology
  • direction
  • results

Questão 100

Questão
What is a benefit of using the VERIS community database?
Responda
  • It can be used to discover how other organizations dealt with a particular type of security incident.
  • Companies who pay to contribute and access the database are protected from security threats.
  • It can be used to discover the name of known threat actors.
  • The database can be easily compressed.

Questão 101

Questão
When a security attack has occurred, which two approaches should security professionals take to mitigate a compromised system during the Actions on Objectives step as defined by the Cyber Kill Chain model? (Choose two.)
Responda
  • Build detections for the behavior of known malware.
  • Train web developers for securing code.
  • Detect data exfiltration, lateral movement, and unauthorized credential usage.
  • Perform forensic analysis of endpoints for rapid triage.
  • Collect malware files and metadata for future analysis.

Questão 102

Questão
A threat actor has identified the potential vulnerability of the web server of an organization and is building an attack. What will the threat actor possibly do to build an attack weapon?
Responda
  • Obtain an automated tool in order to deliver the malware payload through the vulnerability.
  • Install a webshell on the web server for persistent access.
  • Create a point of persistence by adding services.
  • Collect credentials of the web server developers and administrators.

Questão 103

Questão
Which action is taken in the postincident phase of the NIST incident response life cycle?
Responda
  • Document the handling of the incident.
  • identify and validate incidents.
  • Conduct CSIRT response training.
  • Implement procedures to contain threats.

Questão 104

Questão
Which top-level element of the VERIS schema would allow a company to log who the actors were, what actions affected the asset, which assets were affected, and how the asset was affected?
Responda
  • incident description
  • incident tracking
  • discovery and response
  • victim demographics

Questão 105

Questão
What is the role of vendor teams as they relate to CSIRT?
Responda
  • Coordinate incident handling across multiple CSIRTs.
  • Handle customer reports concerning security vulnerabilities.
  • Use data from many sources to determine incident activity trends.
  • Provide incident handling to other organizations as a fee-based service.

Questão 106

Questão
According to information outlined by the Cyber Kill Chain, which two approaches can help identify reconnaissance threats? (Choose two.)
Responda
  • Analyze web log alerts and historical search data.
  • Audit endpoints to forensically determine origin of exploit.
  • Build playbooks for detecting browser behavior.
  • Conduct full malware analysis.
  • Understand targeted servers, people, and data available to attack.

Questão 107

Questão
To ensure that the chain of custody is maintained, what three items should be logged about evidence that is collected and analyzed after a security incident has occurred? (Choose three.)
Responda
  • measures used to prevent an incident
  • time and date the evidence was collected
  • extent of the damage to resources and assets
  • vulnerabilities that were exploited in an attack
  • serial numbers and hostnames of devices used as evidence
  • location of all evidence

Questão 108

Questão
Which schema or model was created to anonymously share quality information about security events to the security community?
Responda
  • VERIS
  • Diamond
  • CSIRT
  • Cyber Kill Chain

Questão 109

Questão
What is the purpose of the policy element in a computer security incident response capability of an organization, as recommended by NIST?
Responda
  • It provides a roadmap for maturing the incident response capability.
  • It provides metrics for measuring the incident response capability and effectiveness.
  • It defines how the incident response teams will communicate with the rest of the organization and with other organizations.
  • It details how incidents should be handled based on the organizational mission and functions.

Questão 110

Questão
What information is gathered by the CSIRT when determining the scope of a security incident?
Responda
  • the processes used to preserve evidence
  • the strategies and procedures used for incident containment
  • the networks, systems, and applications affected by an incident
  • the amount of time and resources needed to handle an incident

Questão 111

Questão
What is the main purpose of exploitations by a threat actor through the weapon delivered to a target during the Cyber Kill Chain exploitation phase?
Responda
  • Launch a DoS attack
  • Send a message back to CnC controlled by the threat actor
  • Break the vulnerability and gain control of the target
  • Establish a back door into the system

Questão 112

Questão
Which term is used in the Diamond Model of intrusion to describe a tool that a threat actor uses toward a target system?
Responda
  • infrastructure
  • capability
  • weaponization
  • adversary

Questão 113

Questão
What is the role of a Computer Emergency Response Team?
Responda
  • Receive, review, and respond to security incidents in an organization.
  • Provide national standards as a fee-based service.
  • Coordinate security incident handling across multiple CSIRTs.
  • Provide security awareness, best practices, and security vulnerability information to a specific population.

Questão 114

Questão
A threat actor collects information from web servers of an organization and searches for employee contact information. The information collected is further used to search personal information on the Internet. To which attack phase do these activities belong according to the Cyber Kill Chain model?
Responda
  • Actions on objectives
  • Exploitation
  • Reconnaissance
  • Weaponization

Questão 115

Questão
In which phase of the NIST incident response life cycle is evidence gathered that can assist subsequent investigations by authorities?
Responda
  • Preparation
  • Containment, Eradication and Recovery
  • Postincident activities
  • Detection and analysis

Questão 116

Questão
The company will be using both Linux- and Windows- based hosts. Which two solutions would be used in a distributed firewall network design? (Choose two).
Responda
  • Iptable
  • SIEM
  • Snort
  • Windows Table

Questão 117

Questão
The IT company is recommending the use of PKI applications. In which two instances might the entrepreneur make use of PKIs? (Choose two.)
Responda
  • 802 is authentication
  • HTTPS web-service
  • FTP transfers
  • Local NTP server
  • File and directory permission

Questão 118

Questão
The entrepreneur is concerned about company employees having uninterrupted access to important resources and data. Which of the CIA triad components would address the concern?
Responda
  • Authentication
  • Confidentiality
  • Integrity
  • Availability

Questão 119

Questão
Use the following scenario to answer the questions. An entrepreneur is starting a small business and is considering the server services needed for the startup company. The company handling the IT service is presenting options to the company. The company will be using both Linux- and Windows-based hosts. Which two solutions would be used in a distributed firewall network design? (Choose two.)
Responda
  • Iptable
  • Windows Firewall
  • Snort
  • SIEM
  • Wireshark

Questão 120

Questão
What is the Stream Ciphers?
Responda
  • Stream ciphers operate on each bit (instead of block)
  • Random answer (do not click, dumbass)

Questão 121

Questão
Grey Hat Hackers are..
Responda
  • Commit crimes and do unethical things but not for personal gain or to cause damage.
  • May compromise network and then disclose the problem so the organization can fix the problem.
  • Random answer1
  • Random answer2

Questão 122

Questão
“Vulnerability Broker” Threat Actors ...
Responda
  • Discover exploits and report them to vendors, sometimes for prizes or rewards.
  • Random answer 1 (click here to get free $500!)

Questão 123

Questão
Definition of the attack " Sniffer "…
Responda
  • an application or device that can read, monitor, and capture network data exchanges and read network packets
  • Random answer 1 (do not click)

Questão 124

Questão
Which type of security threat can be described as software that attaches itself to another program to execute a specific unwanted function?
Responda
  • virus
  • worm
  • proxy Trojan horse
  • Denial of Service Trojan horse

Questão 125

Questão
What is the significant characteristic of worm malware? Hint: Virus requires a host program to run, worms can run by themselves. Automatically replicates itself and spreads across the network from system to system
Responda
  • A worm can execute independently of the host system.
  • A worm must be triggered by an event on the host system.
  • Worm malware disguises itself as legitimate software.
  • Once installed on a host system, a worm does not replicate itself

Questão 126

Questão
What is the purpose of a reconnaissance attack on a computer network?
Responda
  • Also known as information gathering, reconnaissance attacks perform unauthorized discovery and mapping of systems, services, or vulnerabilities.
  • Random answer 1

Questão 127

Questão
Type of access attack that attempts to manipulate individuals into performing actions or divulging confidential information needed to access a network.
Responda
  • Social engineering attacks
  • Random answer 1

Questão 128

Questão
What kind of DDOS term are malware designed to infect a host and communicate with a handler system and can also log keystrokes, gather passwords, capture and analyze packets, and more?
Responda
  • Bots
  • Random answer 1

Questão 129

Questão
What term DDoS attack refers to a group of zombies infected using self-propagating malware (i.e., bots) and are controlled by handlers?
Responda
  • Botnet
  • Random answer 1 (do not click)

Questão 130

Questão
What term DDoS attack refers to a master command-and-control server controlling groups of zombies?
Responda
  • Handlers
  • Bots
  • Botnet
  • Botmaster

Questão 131

Questão
What term DDoS attack refers to a group of compromised hosts (i.e. agents) that run malicious code referred to as robots (i.e. bots) ?
Responda
  • Zombies
  • Handlers
  • Botmaster
  • Scrum master

Questão 132

Questão
What term DDoS attack refers to the malware designed to infect a host and communicate with a handler system. It can also log keystrokes, gather passwords, capture and analyze packets, and more...
Responda
  • Bots
  • Zombies
  • Handlers
  • Handlermaster

Questão 133

Questão
What term DDoS attack refers to a group of zombies infected using self-propogating malware (i.e. bots) and are controlled by handlers.
Responda
  • Botnet
  • Handlers
  • Handlermaster
  • Scrum master

Questão 134

Questão
What DDOS attack term refers to the threat actor in control of the botnet handlers?
Responda
  • Botmaster
  • Zombies
  • Zombie master
  • Scrum master

Questão 135

Questão
Types of attacks targeting IP:
Responda
  • DOS
  • buffer overflow
  • Random answer 1 (do not click here)

Questão 136

Questão
The DoS attacks...
Responda
  • Originates from multiple, coordinated sources
  • Compromises many hosts
  • Random answer 1

Questão 137

Questão
ICMP attacks...
Responda
  • Can be used to identify hosts on a network, the structure of a network, and determine the operating systems at use on the network. Can also be used as a vehicle for various types of DoS attacks. ICMP can also be used for data exfiltration through ICMP traffic from inside the network.
  • To carry diagnostic messages and to report error conditions when routes, hosts, and ports are unavailable. ICMP messages are generated by devices when a network error or outage occurs.
  • Random answer 1 (do not click here)

Questão 138

Questão
Two major sources of DoS attacks (choose two):
Responda
  • Maliciously Formatted Packets
  • Overwhelming Quantity of Traffic
  • Random answer 1 (don't click)

Questão 139

Questão
Which tool is used to provide a list of open ports on network devices?
Responda
  • Nmap
  • Sguil
  • ELSA
  • Security Onion

Questão 140

Questão
The security policy of an organization allows employees to connect to the office intranet from their homes. Which type of security policy is this?
Responda
  • remote access
  • Random answer 1

Questão 141

Questão
What is IPS?
Responda
  • Intrusion prevention system that stops trigger packets
  • Random answer

Questão 142

Questão
What is the ACL?
Responda
  • Is a series of commands that control whether a device forwards or drops packets based on information found in the packet header
  • Random answer

Questão 143

Questão
What is the The syslog logging service?
Responda
  • Serivce that allows networking devices to send their system messages across the network to syslog servers.
  • Service that provides three primary functions: Gather logging information for monitoring and troubleshooting; Select the type of logging information that is captured; Specify the destination of captured syslog messages.
  • Random answer 1

Questão 144

Questão
________ is an usually part of a router firewall, which permits or denies traffic based on Layer 3 and Layer 4 information.
Responda
  • Packet filtering (Stateless) firewalls
  • Random answer

Questão 145

Questão
This type firewalls filters IP traffic between a pair of bridged interfaces
Responda
  • Transparent firewall
  • Random answer

Questão 146

Questão
What systems provide real time reporting and long-term analysis of security events?
Responda
  • Security Information Event Management (SIEM)
  • Random answer

Quer criar seus próprios Quizzes gratuitos com a GoConqr? Saiba mais.

Semelhante

reading test 9 form
svetlana.gainano
Flashcards- Europa: Países e Capitais
Felipe Perreira
Estudo da Vegetação
Alessandra S.
Aprenda a fazer uma boa Redação para concursos Públicos em 5 passos
Alessandra S.
Literatura Brasileira
Alessandra S.
RESUMOS EXAME GEOGRAFIA A
beatriizcunha
SIMULADO DO SPAECE PORTUGUÊS 2º ANO 2014
gilmarjunior24
Geometria Plana Triângulo
Luiz Antonio Lopes
PROCESSO DISCIPLINAR
GoConqr suporte .
Química - Introdução
Carine Campos
PLANEJAMENTO DE LÍNGUA PORTUGUESA 2017 - 1ª ETAPA
Adriana Marcia Couto Poletti
Explore a Biblioteca