Security+_Domain_4

A security analyst is performing a packet capture on a series of SOAP HTTP requests for a security assessment. The analyst redirects the output to a file. After the capture is complete, the analyst needs to review the first transactions quickly and then search the entire series of requests for a particular string. Which of the following would be BEST to use to accomplish this task? (Choose two.)

• head

• tail

• curl

• dd

• grep

A systems administrator is troubleshooting a server's connection to an internal web server. The administrator needs to determine the correct ports to use. Which of the following tools BEST shows which ports on the web server are in a listening state?

• ipconfig

• ssh

• ping

• netstat

Answer explanation

Netstat

•used for troubleshooting and configuration,

•show network status and protocol statistics,

•displays active TCP connections, ports on which the computer is listening,

An organization is concerned that its hosted web servers are not running the most updated version of the software. Which of the following would work BEST to help identify potential vulnerabilities?

• hping3 -s comptia.org -p 80

• nc -l -v comptia.org -p 80

• nmap comptia.org -p 80 -sV

• nslookup -port=80 comtia.org

Answer explanation

nmap

•network mapping,

•vulnerability checking,

•port scanning,

A security analyst wants to fingerprint a web server. Which of the following tools will the security analyst MOST likely use to accomplish this task?

• nmap -pl-65535 192.168.0.10

• curl --head http://192.168.0.10

• dig 192.168.0.10

• ping 192.168.0.10

Answer explanation

curl

sending a request to get information from a server

During a security assessment, a security analyst finds a file with overly permissive permissions. Which of the following tools will allow the analyst to reduce the permissions for the existing users and groups and remove the set-user-ID bit from the file?

• ls

• chflags

• lsof

• chmod

• setuid

An IT security manager requests a report on company information that is publicly available. The manager's concern is that malicious actors will be able to access the data without engaging in active reconnaissance. Which of the following is the MOST efficient approach to perform the analysis?

• Provide a domain parameter to theHarvester tool.

• Check public DNS entries using dnsenum.

• Perform a Nessus vulnerability scan targeting a public company’s IP.

• Execute nmap using the options: scan all ports and sneaky mode.

Answer explanation

theHarvester

tool for gathering subdomain names, e-mail addresses, virtual hosts, open ports/ banners, and employee names

A security administrator suspects an employee has been emailing proprietary information to a competitor. Company policy requires the administrator to capture an exact copy of the employee's hard disk. Which of the following should the administrator use?

• chmod

• dnsenum

• dd

• logger

Which of the following should an organization consider implementing in the event executives need to speak to the media after a publicized data breach?

• Incident response plan

• Business continuity plan

• Communication plan

• Disaster recovery plan

Answer explanation

The plan that details how relevant stakeholders will be informed in event of an incident. (like a security breach)

During an incident response, an analyst applied rules to all inbound traffic on the border firewall and implemented ACLs on each critical server. Following an investigation, the company realizes it is still vulnerable because outbound traffic is not restricted, and the adversary is able to maintain a presence in the network.In which of the following stages of the Cyber Kill Chain is the adversary currently operating?

• Reconnaissance

• Command and control

• Actions on objective

• Exploitation

A security incident has been resolved. Which of the following BEST describes the importance of the final phase of the incident response plan?

• It examines and documents how well the team responded, discovers what caused the incident, and determines how the incident can be avoided in the future.

• It returns the affected systems back into production once systems have been fully patched, data restored, and vulnerabilities addressed.

• It identifies the incident and the scope of the breach, how it affects the production environment, and the ingress point.

• It contains the affected systems and disconnects them from the network, preventing further spread of the attack or breach.