Sybex Practice Test 01

Front

What is the most likely cause of a sudden drop to zero in network flow on a particular segment? Options: A denial-of-service attack, A link failure, High bandwidth consumption, Beaconing

Back

A link failure

Answer explanation

The sudden drop to zero is most likely to be an example of link failure. A denial-of-service

attack could result in this type of drop but is less likely for most organizations. High bandwidth

consumption and beaconing both show different traffic patterns than shown in this example.

Front

Which one of the following should be Saanvi's highest priority for patching during the recovery process after a security incident? Windows systems, Systems involved in the incident, Linux systems, Web servers

Back

Systems involved in the incident

Answer explanation

During an incident recovery effort, patching priority should be placed on systems that

were directly involved in the incident. This is one component of remediating known issues

that were actively exploited.

Front

Susan’s organization suffered from a major breach attributed to an advanced persistent threat (APT) using exploits of zero-day vulnerabilities. Which of the following is the least appropriate solution for Susan to recommend to help prevent future attacks of this type? Heuristic attack detection methods, Signature-based attack detection methods, Segmentation, Leverage threat intelligence

Back

Signature-based attack detection methods

Answer explanation

Signature-based attack detection methods rely on knowing what an attack or malware looks like. Zero-day attacks are unlikely to have an existing signature, making them a poor choice to prevent them. Heuristic (behavior) detection methods can indicate compromises despite the lack of signatures for the specific exploit. Building a well-designed and segmented network can limit the impact of compromises or even prevent them. Leveraging threat intelligence

to understand new attacks and countermeasures is an important part of defense against zero-day attacks.

Front

During his investigation of a Windows system, Eric discovered that files were deleted and he wants to determine whether a specific file previously existed on the computer. Which of the following is the least likely to be a potential location to discover evidence supporting that theory? Windows registry, Master File Table, INDX files, Event logs

Back

Event logs

Answer explanation

The Windows registry, Master File Tables, and INDX files all contain information about files, often including removed or deleted files. Event logs are far less likely to contain information about a specific file location.

Front

As part of her SOC analyst duties, Emily is tasked with monitoring intrusion detection systems that cover her employer’s corporate headquarters network. During her shift, Emily’s IDS alarms report that a network scan has occurred from a system with IP address 10.0.11.19 on the organization’s WPA3 Enterprise wireless network aimed at systems in the finance division. What data source should she check first?

Back

Wireless authentication logs

Answer explanation

Since Emily’s organization uses WPA3 Enterprise, users must authenticate to use the wireless network. Associating the scan with an authenticated user will help incident responders identify the device that conducted the scan.

Front

Casey’s incident response process leads her to a production server that must stay online for her company’s business to remain operational. What method should she use to capture the data she needs?

Back

Live image to an external drive.

Answer explanation

Normally, forensic images are collected from systems that are offline to ensure that a complete copy is made. In cases like this where keeping the system online is more important than the completeness of the forensic image, a live image to an external drive using a portable

forensic tool such as FTK Imager Lite, dd, or similar is the correct choice.

Front

What does the Nmap response “filtered” mean in port scan results?

Back

Nmap cannot tell whether the port is open or closed.

Answer explanation

When Nmap returns a response of “filtered,” it indicates that Nmap cannot tell whether

the port is open or closed. Filtered results are often the result of a firewall or other network

device, but a response of filtered does not indicate that a firewall or IPS was detected.

When Nmap returns a “closed” result, it means that there is no application listening at

that moment.

Front

During her review of incident logs, Deepa discovers the initial entry via SSH on a front-facing bastion host (A) at 8:02 a.m. If the network that Deepa is responsible for is designed as shown here, what is the most likely diagnosis if the second intrusion shows up on host B at 7:15 a.m.?

Back

Neither host B nor host A are synchronized to NTP properly.

Answer explanation

The likeliest issue is a problem with the Network Time Protocol (NTP) synchronization for both of the hosts, because of an improperly set time zone or another time issue. The ruleset only allows traffic initiated by host A, making it impossible for host B to be the source of a compromise of A. The other options are possible, but the most likely issue is an NTP problem.

Front

Matt recently ran a vulnerability scan of his organization’s network and received the results shown here. He would like to remediate the server with the highest number of the most serious vulnerabilities first. Which one of the following servers should be on his highest priority list? Options: Server A, Server B, Server C, Server D

Back

Server D

Answer explanation

The most serious vulnerabilities shown in this report are medium-severity vulnerabilities.

Server D has the highest number (8) of vulnerabilities at that severity level.

Front

What likelihood of occurrence should Saanvi assign to breaches of the web application using the NIST 800-30 risk assessment framework?

Back

High

Answer explanation

When an event of the type that is being analyzed has occurred within the recent past

(often defined as a year), assessments that review that event will normally classify the

likelihood of occurrence as high since it has already occurred.