Security+_Domain_3

A company wants to build a new website to sell products online. The website will host a storefront application that will allow visitors to add products to a shopping cart and pay for the products using a credit card. Which of the following protocols would be the MOST secure to implement?

• SSL

• FTP

• SNMP

• TLS

After a recent security breach a security analyst reports that several administrative usernames and passwords are being sent via cleartext across the network to access network devices over port 23. Which of the following should be implemented so all credentials sent over the network are encrypted when remotely accessing and configuring network devices?

• SSH

• SNMPv3

• SFTP

• Telnet

• FTP

A network administrator would like to configure a site-to-site VPN utilizing iPSec. The administrator wants the tunnel to be established with data integrity encryption, authentication and anti-replay functions. Which of the following should the administrator use when configuring the VPN?

• AH

• EDR

• ESP

• DNSSEC

Answer explanation

Two of the primary subprotocols of IPSec are Authentication Header (AH) and Encapsulating Security Payload (ESP).

AH provides authentication of the sender’s data; ESP provides encryption of the transferred data as well as limited authentication

A security analyst is evaluating solutions to deploy an additional layer of protection for a web application. The goal is to allow only encrypted communications without relying on network devices. Which of the following can be implemented?

• DNSSEC implementation

• SRTP

• S/MIME

• HTTP security header

Answer explanation

Security headers are directives used by web applications to configure security defenses in web browsers. Based on these directives, browsers can make it harder to exploit client-side vulnerabilities such as Cross-Site Scripting or Clickjacking

A Chief Information Security Officer wants to ensure the organization is validating and checking the Integrity of zone transfers. Which of the following solutions should be implemented?

• LDAPS

• NGFW

• DNSSEC

• DLP

A company is implementing a DLP solution on the file server. The file server has Pll. financial information, and health information stored on it Depending on what type of data that is hosted on the file server, the company wants different DLP rules assigned to the data. Which of the following should the company do to help accomplish this goal?

• Mask the data

• Classify the data  

• Assign an application owner

• Perform a risk analysis

A security engineer is concerned about using an agent on devices that relies completely on defined known-bad signatures. The security engineer wants to implement a tool with multiple components including the ability to track, analyze, and monitor devices without reliance on definitions alone. Which of the following solutions BEST fits this use case?

• DLP

• NGFW

• EDR

• HIPS

A company recently experienced an inside attack using a corporate machine that resulted in data compromise. Analysis indicated an unauthorized change to the software circumvented technological protection measures, The analyst was tasked with determining the best method to ensure the integrity of the systems remains intact and local and remote boot attestation can take place. Which of the following would provide the BEST solution?

• HIPS

• FIM

• TPM

• DLP

Answer explanation

the analyst wants to check the integrity of the system, and boot attestation can take place. TPM chips have mechanisms to prevent system tampering and boot attestation can be done with TPM based hardware to verify the state of the firmware, bootloader, etc.

FIM (File Integrity Monitoring) - Technology that monitors and detects file changes that could be indicative of a cyberattack. FIM specifically involves examining files to see if and when they change, how they change, who changed them, and what can be done to restore those files if those modifications are unauthorized

A software company adopted the following processes before releasing software to production;

• Peer review 

• Static code scanning 

• Signing

A considerable number of vulnerabilities are still being detected when code is executed on production Which of the following security tools can improve vulnerability detection on this environment?

• File integrity monitoring for the source code

• Dynamic code analysis tool

• Encrypted code repository

• Endpoint detection and response solution

Answer explanation

the code is executed, fuzzing applied in order to detect flaws

An organization has activated an incident response plan due to a malware outbreak on its network The organization has brought in a forensics team that has identified an internet-facing Windows server as the likely point of initial compromise The malware family that was detected is known to be distributed by manually logging on to servers and running the malicious code Which of the following actions would be BEST to prevent reinfection from the initial infection vector?

• Prevent connections over TFTP from the internal network

• Create a firewall rule that blocks port 22 from the internet to the server

• Disable file sharing over port 445 to the server

• Block port 3389 inbound from untrusted networks

Answer explanation

the best solution to prevent manually logging into a system would be to block RDP. SSH is for Linux. RDP is for Windows