Quiz
401
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (118)
1A distributed denial of service attack can BEST be described as:
- Ainvalid characters being entered into a field in a database application
- Busers attempting to input random or invalid data into fields within a web browser application
- Cmultiple computers attacking a single target in an organized attempt to deplete its resources
- Dmultiple attackers attempting to gain elevated privileges on a target system
2Joe analyzed the following log and determined the security team should implement which of the following as a mitigation method against further attempts?
Host 192.168.1.123 [00: 00: 01]Successful Login: 015 192.168.1.123 : local [00: 00: 03]Unsuccessful Login: 022 214.34.56.006 : RDP 192.168.1.124 [00: 00: 04]UnSuccessful Login: 010 214.34.56.006 : RDP 192.168.1.124 [00: 00: 07]UnSuccessful Login: 007 214.34.56.006 : RDP 192.168.1.124 [00: 00: 08]UnSuccessful Login: 003 214.34.56.006 : RDP 192.168.1.124- AReporting
- BIDS
- CMonitor system logs
- DHardening
3A computer supply company is located in a building with three wireless networks. The system security team implemented a quarterly security scan and saw the following. SSID State Channel Level Computer AreUs1 connected 1 70dbm Computer AreUs2 connected 5 80dbm Computer AreUs3 connected 3 75dbm Computer AreUs4 connected 6 95dbm
Which of the following is this an example of?- ARogue access point
- BNear field communication
- CJamming
- DPacket sniffing
4A systems administrator has implemented PKI on a classified government network. In the event that a disconnect occurs from the primary CA, which of the following should be accessible locally from every site to ensure users with bad certificates cannot gain access to the network?
- AA CRL
- BMake the RA available
- CA verification authority
- DA redundant CA
5While configuring a new access layer switch, the administrator, Joe, was advised that he needed to make sure that only devices authorized to access the network would be permitted to login and utilize resources. Which of the following should the administrator implement to ensure this happens?
- ALog Analysis
- BVLAN Management
- CNetwork separation
- D802.1x
6A vulnerability assessment indicates that a router can be accessed from default port 80 and default port 22. Which of the following should be executed on the router to prevent access via these ports? (Select TWO)
- AFTP service should be disabled
- BHTTPS service should be disabled
- CSSH service should be disabled
- DHTTP service should disabled
- ETelnet service should be disabled
7Results from a vulnerability analysis indicate that all enabled virtual terminals on a router can be accessed using the same password. The company's network device security policy mandates that at least one virtual terminal have a different password than the other virtual terminals. Which of the following sets of commands would meet this requirement?
- Aline vty 0 6 P@s5W0Rd password line vty 7 Qwer++!Y password
- Bline console 0 password password line vty 0 4 password P@s5W0Rd
- Cline vty 0 3 password Qwer++!Y line vty 4 password P@s5W0Rd
- Dline vty 0 3 password Qwer++!Y line console 0 password P@s5W0Rd
8Joe, an employee, was escorted from the company premises due to suspicion of revealing trade secrets to a competitor. Joe had already been working for two hours before leaving the premises. A security technician was asked to prepare a report of files that had changed since last night's integrity scan. Which of the following could the technician use to prepare the report? (Select TWO)
- A PGP
- BMD5
- CECC
- DAES
- EBlowfish
- FHMAC
- A PGP
9Ann has read and write access to an employee database, while Joe has only read access. Ann is leaving for a conference. Which of the following types of authorization could be utilized to trigger write access for Joe when Ann is absent?
- A Mandatory access control
- BRole-based access control
- CDiscretionary access control
- DRule-based access control
10Human Resources suspects an employee is accessing the employee salary database. The administrator is asked to find out who it is. In order to complete this task, which of the following is a security control that should be in place?
- AShared accounts should be prohibited
- B Account lockout should be enabled
- CPrivileges should be assigned to groups rather than individuals
- DTime of day restrictions should be in use
11An administrator finds that non-production servers are being frequently compromised, production servers are rebooting at unplanned times and kernel versions are several releases behind the version with all current security fixes. Which of the following should the administrator implement?
- ASnapshots
- BSandboxing
- CPatch management
- DIntrusion detection system
12An auditor's report discovered several accounts with no activity for over 60 days. The accounts were later identified as contractors' accounts who would be returning in three months and would need to resume the activities. Which of the following would mitigate and secure the auditors finding?
- ADisable unnecessary contractor accounts and inform the auditor of the update
- BReset contractor accounts and inform the auditor of the update
- CInform the auditor that the accounts belong to the contractors
- DDelete contractor accounts and inform the auditor of the update
13Ann, the security administrator, wishes to implement multifactor security. Which of the following should be implemented in order to compliment password usage and smart cards?
- AHard tokens
- BFingerprint readers
- CSwipe badge readers
- DPassphrases
14Customers' credit card information was stolen from a popular video streaming company. A security consultant determined that the information was stolen, while in transit, from the gaming consoles of a particular vendor. Which of the following methods should the company consider to secure this data in the future?
- AApplication firewalls
- BManual updates
- CFirmware version control
- DEncrypted TCP wrappers
15A new intern was assigned to the system engineering department, which consists of the system architect and system software developer's teams. These two teams have separate privileges. The intern requires privileges to view the system architectural drawings and comment on some software development projects. Which of the following methods should the system administrator implement?
- AGroup based privileges
- BGeneric account prohibition
- CUser access review
- DCredential management
16One of the system administrators at a company is assigned to maintain a secure computer lab. The administrator has rights to configure machines, install software, and perform user account maintenance. However, the administrator cannot add new computers to the domain, because that requires authorization from the Information Assurance Officer. This is an example of which of the following?
- AMandatory access
- BRule-based access control
- CLeast privilege
- DJob rotation
17A small business needs to incorporate fault tolerance into their infrastructure to increase data availability. Which of the following options would be the BEST solution at a minimal cost?
- AClustering
- BMirrored server
- CRAID
- DTape backup
18A new application needs to be deployed on a virtual server. The virtual server hosts a SQL server that is used by several employees. Which of the following is the BEST approach for implementation of the new application on the virtual server?
- ATake a snapshot of the virtual server after installing the new application and store the snapshot in a secure location
- BGenerate a baseline report detailing all installed applications on the virtualized server after installing the new application
- CTake a snapshot of the virtual server before installing the new application and store the snapshot in a secure location
- DCreate an exact copy of the virtual server and store the copy on an external hard drive after installing the new application
19Ann wants to send a file to Joe using PKI. Which of the following should Ann use in order to sign the file?
- AJoe's public key
- BJoe's private key
- CAnn's public key
- DAnn's private key
20Which of the following protocols is used to validate whether trust is in place and accurate by returning responses of either "good", "unknown", or "revoked"?
- ACRL
- BPKI
- COCSP
- DRA
21During a recent investigation, an auditor discovered that an engineer's compromised workstation was being used to connect to SCADA systems while the engineer was not logged in. The engineer is responsible for administering the SCADA systems and cannot be blocked from connecting to them. The SCADA systems cannot be modified without vendor approval which requires months of testing. Which of the following is MOST likely to protect the SCADA systems from misuse?
- AUpdate anti-virus definitions on SCADA systems
- BAudit accounts on the SCADA systems
- CInstall a firewall on the SCADA network
- DDeploy NIPS at the edge of the SCADA network
22A security administrator must implement a network authentication solution which will ensure encryption of user credentials when users enter their username and password to authenticate to the network. Which of the following should the administrator implement?
- AWPA2 over EAP-TTLS
- BWPA-PSK
- CWPA2 with WPS
- DWEP over EAP-PEAP
23Several employees have been printing files that include personally identifiable information of customers. Auditors have raised concerns about the destruction of these hard copies after they are created, and management has decided the best way to address this concern is by preventing these files from being printed. Which of the following would be the BEST control to implement?
- A File encryption
- B Printer hardening
- CClean desk policies
- DData loss prevention
24The company's sales team plans to work late to provide the Chief Executive Officer (CEO) with a special report of sales before the quarter ends. After working for several hours, the team finds they cannot save or print the reports. Which of the following controls is preventing them from completing their work?
- ADiscretionary access control
- BRole-based access control
- CTime of Day access control
- DMandatory access control
25A security engineer is asked by the company's development team to recommend the most secure method for password storage. Which of the following provide the BEST protection against brute forcing stored passwords? (Select TWO).
- APBKDF2
- BMD5
- CSHA2
- DBcrypt
- EAES
- FCHAP
26After entering the following information into a SOHO wireless router, a mobile device's user reports being unable to connect to the network:
PERMIT 0A: D1: FA. B1: 03: 37
DENY 01: 33: 7F: AB: 10: AB
Which of the following is preventing the device from connecting?- A WPA2-PSK requires a supplicant on the mobile device
- BHardware address filtering is blocking the device
- CTCP/IP Port filtering has been implemented on the SOHO router
- DIP address filtering has disabled the device from connecting
27The call center supervisor has reported that many employees have been playing preinstalled games on company computers and this is reducing productivity. Which of the following would be MOST effective for preventing this behavior?
- AAcceptable use policies
- BHost-based firewalls
- CContent inspection
- DApplication whitelisting
28When creating a public / private key pair, for which of the following ciphers would a user need to specify the key strength?
- ASHA
- BAES
- CDES
- DRSA
29A company has decided to move large data sets to a cloud provider in order to limit the costs of new infrastructure. Some of the data is sensitive and the Chief Information Officer wants to make sure both parties have a clear understanding of the controls needed to protect the data. Which of the following types of interoperability agreement is this?
- AISA
- BMOU
- CSLA
- DBPA
30Which of the following solutions provides the most flexibility when testing new security controls prior to implementation?
- ATrusted OS
- BHost software baselining
- COS hardening
- DVirtualization
31Which of the following authentication services requires the use of a ticket-granting ticket (TGT) server in order to complete the authentication process?
- ATACACS+
- BSecure LDAP
- CRADIUS
- DKerberos
32Which of the following is a hardware based encryption device?
- AEFS
- BTrueCrypt
- CTPM
- DSLE
33Which of the following BEST describes a protective countermeasure for SQL injection?
- AEliminating cross-site scripting vulnerabilities
- BInstalling an IDS to monitor network traffic
- CValidating user input in web applications
- DPlacing a firewall between the Internet and database servers
34Which of the following MOST interferes with network-based detection techniques?
- AMime-encoding
- BSSL
- CFTP
- DAnonymous email accounts
35A certificate authority takes which of the following actions in PKI?
- ASigns and verifies all infrastructure messages
- BIssues and signs all private keys
- CPublishes key escrow lists to CRLs
- DIssues and signs all root certificates
36Use of a smart card to authenticate remote servers remains MOST susceptible to which of the following attacks?
- AMalicious code on the local system
- BShoulder surfing
- CBrute force certificate cracking
- DDistributed dictionary attacks
37Separation of duties is often implemented between developers and administrators in order to separate which of the following?
- AMore experienced employees from less experienced employees
- BChanges to program code and the ability to deploy to production
- CUpper level management users from standard development employees
- DThe network access layer from the application access layer
38A security administrator needs to update the OS on all the switches in the company. Which of the following MUST be done before any actual switch configuration is performed?
- AThe request needs to be sent to the incident management team
- BThe request needs to be approved through the incident management process
- CThe request needs to be approved through the change management process
- DThe request needs to be sent to the change management team
39Jane, an individual, has recently been calling various financial offices pretending to be another person to gain financial information. Which of the following attacks is being described?
- APhishing
- BTailgating
- CPharming
- DVishing
40A user in the company is in charge of various financial roles but needs to prepare for an upcoming audit. They use the same account to access each financial system. Which of the following security controls will MOST likely be implemented within the company?
- AAccount lockout policy
- BAccount password enforcement
- CPassword complexity enabled
- DSeparation of duties
41A CRL is comprised of
- AMalicious IP addresses
- BTrusted CA's
- CUntrusted private keys
- DPublic keys
42Sara, a user, downloads a keygen to install pirated software. After running the keygen, system performance is extremely slow and numerous antivirus alerts are displayed. Which of the following BEST describes this type of malware?
- ALogic bomb
- BWorm
- CTrojan
- DAdware
43Which of the following may significantly reduce data loss if multiple drives fail at the same time?
- AVirtualization
- BRAID
- CLoad balancing
- DServer clustering
44Which of the following should be considered to mitigate data theft when using CAT5 wiring?
- ACCTV
- BEnvironmental monitoring
- CMultimode fiber
- DEMI shielding
45To help prevent unauthorized access to PCs, a security administrator implements screen savers that lock the PC after five minutes of inactivity. Which of the following controls is being described in this situation?
- AManagement
- BAdministrative
- CTechnical
- DOperational
46Pete, a network administrator, is capturing packets on the network and notices that a large amount of the traffic on the LAN is SIP and RTP protocols. Which of the following should he do to segment that traffic from the other traffic?
- AConnect the WAP to a different switch.
- BCreate a voice VLAN.
- CCreate a DMZ.
- DSet the switch ports to 802.1q mode.
47Which of the following IP addresses would be hosts on the same subnet given the subnet mask 255.255.255.224? (Select TWO).
- A10.4.4.125
- B10.4.4.158
- C10.4.4.165
- D10.4.4.189
- E10.4.4.199
48Which of the following algorithms has well documented collisions? (Select TWO).
- AAES
- BMD5
- CSHA
- DSHA-256
- ERSA
49Which of the following is BEST used as a secure replacement for TELNET?
- AHTTPS
- BHMAC
- CGPG
- DSSH
50An email client says a digital signature is invalid and the sender cannot be verified. The recipient is concerned with which of the following concepts?
- AIntegrity
- BAvailability
- CConfidentiality
- DRemediation
51Which of the following is an effective way to ensure the BEST temperature for all equipment within a datacenter?
- AFire suppression
- BRaised floor implementation
- CEMI shielding
- DHot or cool aisle containment
52Which of the following transportation encryption protocols should be used to ensure maximum security between a web browser and a web server?
- ASSLv2
- BSSHv1
- CRSA
- DTLS
53Developers currently have access to update production servers without going through an approval process. Which of the following strategies would BEST mitigate this risk?
- AIncident management
- BClean desk policy
- C Routine audits
- DChange management
54Which of the following is a difference between TFTP and FTP?
- ATFTP is slower than FTP
- BTFTP is more secure than FTP
- CTFTP utilizes TCP and FTP uses UDP
- DTFTP utilizes UDP and FTP uses TCP
55Matt, an administrator, notices a flood fragmented packet and retransmits from an email server. After disabling the TCP offload setting on the NIC, Matt sees normal traffic with packets flowing in sequence again. Which of the following utilities was he MOST likely using to view this issue?
- ASpam filter
- BProtocol analyzer
- CWeb application firewall
- DLoad balancer
56Which of the following is characterized by an attacker attempting to map out an organization's staff hierarchy in order to send targeted emails?
- AWhaling
- BImpersonation
- CPrivilege escalation
- DSpear phishing
57Which of the following would a security administrator implement in order to discover comprehensive security threats on a network?
- ADesign reviews
- BBaseline reporting
- CVulnerability scan
- DCode review
58Which of the following is an example of a false positive?
- AAnti-virus identifies a benign application as malware
- BA biometric iris scanner rejects an authorized user wearing a new contact lens
- CA user account is locked out after the user mistypes the password too many times
- DThe IDS does not identify a buffer overflow
59Data execution prevention is a feature in most operating systems intended to protect against which type of attack?
- ACross-site scripting
- BBuffer overflow
- CHeader manipulation
- DSQL injection
60Use of group accounts should be minimized to ensure which of the following?
- APassword security
- BRegular auditing
- CBaseline management
- DIndividual accountability
61Privilege creep among long-term employees can be mitigated by which of the following procedures?
- AUser permission reviews
- BMandatory vacations
- CSeparation of duties
- DJob function rotation
62In which of the following scenarios is PKI LEAST hardened?
- AThe CRL is posted to a publicly accessible location
- BThe recorded time offsets are developed with symmetric keys
- CA malicious CA certificate is loaded on all the clients
- DAll public keys are accessed by an unauthorized user
63Configuring the mode, encryption methods, and security associations are part of which of the following?
- AIPSec
- BFull disk encryption
- C802.1x
- DPKI
64Which of the following assessments would Pete, the security administrator, use to actively test that an application's security controls are in place?
- ACode review
- BPenetration test
- CProtocol analyzer
- DVulnerability scan
65A security administrator has just finished creating a hot site for the company. This implementation relates to which of the following concepts?
- AConfidentiality
- BAvailability
- CSuccession planning
- DIntegrity
66In the initial stages of an incident response, Matt, the security administrator, was provided the hard drives in question from the incident manager. Which of the following incident response procedures would he need to perform in order to begin the analysis? (Select TWO).
- ATake hashes
- BBegin the chain of custody paperwork
- CTake screen shots
- DCapture the system image
- EDecompile suspicious files
67Which of the following is used to certify intermediate authorities in a large PKI deployment?
- ARoot CA
- BRecovery agent
- CRoot user
- DKey escrow
68Which of the following components MUST be trusted by all parties in PKI?
- AKey escrow
- BCA
- CPrivate key
- DRecovery key
69Which of the following should Matt, a security administrator, include when encrypting smartphones? (Select TWO).
- ASteganography images
- BInternal memory
- CMaster boot records
- DRemovable memory cards
- EPublic keys
70Which of the following is the below pseudo-code an example of?
IF VARIABLE (CONTAINS NUMBERS = TRUE) THEN EXIT- ABuffer overflow prevention
- BInput validation
- CCSRF prevention
- DCross-site scripting prevention
71A system administrator is using a packet sniffer to troubleshoot remote authentication. The administrator detects a device trying to communicate to TCP port 49. Which of the following authentication methods is MOST likely being attempted?
- ARADIUS
- BTACACS+
- CKerberos
- DLDAP
72Which of the following can use RC4 for encryption? (Select TWO).
- ACHAP
- BSSL
- CWEP
- DAES
- E3DES
73Which of the following defines a business goal for system restoration and acceptable data loss?
- AMTTR
- BMTBF
- CRPO
- DWarn site
74If Organization A trusts Organization B and Organization B trusts Organization C, then Organization A trusts Organization C. Which of the following PKI concepts is this describing?
- ATransitive trust
- BPublic key trust
- CCertificate authority trust
- DDomain level trust
75Which of the following concepts is BEST described as developing a new chain of command in the event of a contingency?
- ABusiness continuity planning
- BContinuity of operations
- CBusiness impact analysis
- DSuccession planning
76Which of the following allows a company to maintain access to encrypted resources when employee turnover is high?
- ARecovery agent
- BCertificate authority
- CTrust model
- DKey escrow
77Which of the following devices will help prevent a laptop from being removed from a certain location?
- ADevice encryption
- BCable locks
- CGPS tracking
- DRemote data wipes
78Which of the following is the MOST secure protocol to transfer files?
- AFTP
- BFTPS
- CSSH
- DTELNET
79Suspicious traffic without a specific signature was detected. Under further investigation, it was determined that these were false indicators. Which of the following security devices needs to be configured to disable future false alarms?
- ASignature based IPS
- BSignature based IDS
- CApplication based IPS
- D Anomaly based IDS
80A company storing data on a secure server wants to ensure it is legally able to dismiss and prosecute staff who intentionally access the server via Telnet and illegally tamper with customer data. Which of the following administrative controls should be implemented to BEST achieve this?
- ACommand shell restrictions
- BRestricted interface
- CWarning banners
- DSession output pipe to /dev/null
81Which of the following protocols is used to authenticate the client and server's digital certificate?
- APEAP
- BDNS
- CTLS
- DICMP
82Which of the following can be used to mitigate risk if a mobile device is lost?
- ACable lock
- BTransport encryption
- CVoice encryption
- DStrong passwords
83Which of the following security concepts would Sara, the security administrator, use to mitigate the risk of data loss?
- ARecord time offset
- BClean desk policy
- CCloud computing
- DRoutine log review
84Which of the following is an example of multifactor authentication?
- ACredit card and PIN
- BUsername and password
- CPassword and PIN
- DFingerprint and retina scan
85After Matt, a user, enters his username and password at the login screen of a web enabled portal, the following appears on his screen:
`Please only use letters and numbers on these fields'
Which of the following is this an example of?- AProper error handling
- BProper input validation
- CImproper input validation
- DImproper error handling
86Which of the following should the security administrator implement to limit web traffic based on country of origin? (Select THREE)
- ASpam filter
- BLoad balancer
- CAntivirus
- DProxies
- EFirewall
- FNIDS
- GURL filtering
87Several bins are located throughout a building for secure disposal of sensitive information. Which of the following does this prevent?
- ADumpster diving
- BWar driving
- CTailgating
- DWar chalking
88Matt, a developer, recently attended a workshop on a new application. The developer installs the new application on a production system to test the functionality. Which of the following is MOST likely affected?
- AApplication design
- BApplication security
- CInitial baseline configuration
- DManagement of interfaces
89Sara, a company's security officer, often receives reports of unauthorized personnel having access codes to the cipher locks of secure areas in the building. Sara should immediately implement which of the following?
- AAcceptable Use Policy
- BPhysical security controls
- CTechnical controls
- DSecurity awareness training
90Mike, a network administrator, has been asked to passively monitor network traffic to the company's sales websites. Which of the following would be BEST suited for this task?
- AHIDS
- BFirewall
- CNIPS
- DSpam filter
91Mike, a security professional, is tasked with actively verifying the strength of the security controls on a company's live modem pool. Which of the following activities is MOST appropriate?
- AWar dialing
- BWar chalking
- CWar driving
- DBluesnarfing
92Users at a company report that a popular news website keeps taking them to a web page with derogatory content. This is an example of which of the following?
- AEvil twin
- BDNS poisoning
- CVishing
- DSession hijacking
93An encrypted message is sent using PKI from Sara, a client, to a customer. Sara claims she never sent the message. Which of the following aspects of PKI BEST ensures the identity of the sender?
- ACRL
- BNon-repudiation
- CTrust models
- DRecovery agents
94Jane, a security administrator, has observed repeated attempts to break into a server. Which of the following is designed to stop an intrusion on a specific server?
- AHIPS
- BNIDS
- CHIDS
- DNIPS
95Matt, the IT Manager, wants to create a new network available to virtual servers on the same hypervisor, and does not want this network to be routable to the firewall. How could this BEST be accomplished?
- ACreate a VLAN without a default gateway
- BRemove the network from the routing table
- CCreate a virtual switch
- DCommission a stand-alone switch
96A security administrator implements access controls based on the security classification of the data and need-to-know information. Which of the following BEST describes this level of access control?
- AImplicit deny
- BRole-based Access Control
- CMandatory Access Controls
- DLeast privilege
97A security administrator has configured FTP in passive mode. Which of the following ports should the security administrator allow on the firewall by default?
- A20
- B21
- C22
- D23
98Which of the following could cause a browser to display the message below?
"The security certificate presented by this website was issued for a different website's address."- AThe website certificate was issued by a different CA than what the browser recognizes in its trusted CAs
- BThe website is using a wildcard certificate issued for the company's domain
- CHTTPS://127.0.01 was used instead of HTTPS://localhost
- DThe website is using an expired self signed certificate
99A company that purchased an HVAC system for the datacenter is MOST concerned with which of the following?
- AAvailability
- BIntegrity
- CConfidentiality
- DFire suppression
100Which of the following pseudocodes can be used to handle program exceptions?
- AIf program detects another instance of itself, then kill program instance
- BIf user enters invalid input, then restart program
- CIf program module crashes, then restart program module
- DIf user's input exceeds buffer length, then truncate the input
101Which of the following functions provides an output which cannot be reversed and converts data into a string of characters?
- AHashing
- BStream ciphers
- CSteganography
- DBlock ciphers
102Which of the following encrypts data a single bit at a time?
- AStream cipher
- BSteganography
- C3DES
- DHashing
103Which of the following is used to verify data integrity?
- ASHA
- B3DES
- CAES
- DRSA
104By default, which of the following uses TCP port 22? (Select THREE).
- AFTPS
- BSTELNET
- CTLS
- DSCP
- ESSL
- FHTTPS
- GSSH
- HSFTP
105Access mechanisms to data on encrypted USB hard drives must be implemented correctly otherwise.
- Auser accounts may be inadvertently locked out
- Bdata on the USB drive could be corrupted
- Cdata on the hard drive will be vulnerable to log analysis
- Dthe security controls on the USB drive can be bypassed
106Maintenance workers find an active network switch hidden above a dropped-ceiling tile in the CEO's office with various connected cables from the office. Which of the following describes the type of attack that was occurring?
- ASpear phishing
- BPacket sniffing
- CImpersonation
- DMAC flooding
107A security administrator is segregating all web-facing server traffic from the internal network and restricting it to a single interface on a firewall. Which of the following BEST describes this new network?
- AVLAN
- BSubnet
- CVPN
- DDMZ
108Which of the following was based on a previous X.500 specification and allows either unencrypted authentication or encrypted authentication through the use of TLS?
- A Kerberos
- BTACACS+
- CRADIUS
- DLDAP
109The Quality Assurance team is testing a new third party developed application. The Quality team does not have any experience with the application. Which of the following is the team performing?
- AGrey box testing
- BBlack box testing
- CPenetration testing
- DWhite box testing
110Which of the following has a storage root key?
- AHSM
- BEFS
- CTPM
- DTKIP
111A security analyst, Ann, is reviewing an IRC channel and notices that a malicious exploit has been created for a frequently used application. She notifies the software vendor and asks them for remediation steps, but is alarmed to find that no patches are available to mitigate this vulnerability. Which of the following BEST describes this exploit?
- AMalicious insider threat
- BZero-day
- CClient-side attack
- DMalicious add-on
112A security administrator has concerns about new types of media which allow for the mass distribution of personal comments to a select group of people. To mitigate the risks involved with this media, employees should receive training on which of the following?
- APeer to Peer
- BMobile devices
- CSocial networking
- DPersonally owned devices
113A network administrator is responsible for securing applications against external attacks. Every month, the underlying operating system is updated. There is no process in place for other software updates. Which of the following processes could MOST effectively mitigate these risks?
- AApplication hardening
- BApplication change management
- CApplication patch management
- DApplication firewall review
114A software developer is responsible for writing the code on an accounting application. Another software developer is responsible for developing code on a system in human resources. Once a year they have to switch roles for several weeks. Which of the following practices is being implemented?
- AMandatory vacations
- BJob rotation
- CLeast privilege
- DSeparation of duties
115A network engineer is designing a secure tunneled VPN. Which of the following protocols would be the MOST secure?
- AIPsec
- BSFTP
- CBGP
- DPPTP
116Which of the following implementation steps would be appropriate for a public wireless hot- spot?
- AReduce power level
- BDisable SSID broadcast
- COpen system authentication
- DMAC filter
117Which of the following is a step in deploying a WPA2-Enterprise wireless network?
- AInstall a token on the authentication server
- BInstall a DHCP server on the authentication server
- CInstall an encryption key on the authentication server
- DInstall a digital certificate on the authentication server
118Which of the following controls would allow a company to reduce the exposure of sensitive systems from unmanaged devices on internal networks?
- A 802.1x
- BData encryption
- CPassword strength
- DBGP
Information
- Description
- SEC PLUS
- Author
- maxwell3254
- Language
- English
- Views
- 250
- Tags
- Rating
- No ratings yet Rate this quiz