Sec+ CH.1 Pre-Assessment

1. Your organization is planning to expand the data center to support more

systems. Management wants the plan to focus on resiliency and uptime.

Which of the following methods would best support these goals? (Select

TWO.)

• UPS

• Cold Site

• NIC Teaming

• Off-Site Backups

Answer explanation

A and C are correct. An uninterruptible power supply (UPS) and network

interface card (NIC) teaming support resiliency and uptime goals. The UPS

ensures the system stays up if power is lost. NIC teaming automatically

recovers if one of the NICs or NIC inputs fail. Resiliency methods help

systems heal themselves and recover from faults automatically. A cold site

cannot take over automatically and is not quick. Off-site backups would

need to be retrieved and applied by a person, so they aren’t automatic. See

Chapter 1.

You are tasked with improving the overall security of several servers in

your data center. Which of the following are preventive controls that will

assist with this goal? (Choose TWO.)

• Disabling unnecessary services

• Adding cable locks

• Monitoring logs on SIEM systems

• Implementing a backup plan

• Closing unneeded ports

Answer explanation

A and E are correct. Disabling unnecessary services and closing

unneeded ports are steps you can take to harden a server. They are

preventive controls because they help prevent an incident. Cable locks are a

type of physical control and are typically used on laptops, not on servers.

Monitoring logs on security information and event management (SIEM)

systems is a detective control. A backup plan is a corrective control. See

Chapter 1.

Your organization houses a server room, and management wants to

increase the server room security. You are tasked with identifying some

deterrent controls that can be implemented to protect it. Which of the

following choices would BEST meet this objective?

• Hardware locks

• Data encryption

• A vulnerability assessment

• Backups

Answer explanation

A is correct. Hardware locks are deterrent controls because they would

deter someone from entering or accessing the servers in bays if bay door

locks are used. They are also examples of physical controls. None of the

other answers increase the security of the server room. Data encryption is a

technical control designed to protect data on the servers. A vulnerability

assessment is a managerial control designed to discover vulnerabilities.

Backups are corrective controls designed to reverse the impact of data loss

or corruption. See Chapter 1.

You suspect that a Linux computer is establishing connections with a

remote server on the Internet without any user interaction. You want to

verify this by viewing a summary of protocol statistics on a Linux system.

Which of the following commands would you use?

• dig

• nslookup

• ifconfig

• netstat

Answer explanation

D is correct. The netstat -s command will display a summary of protocol

statistics on a Linux system. You can use the dig (short for domain

information groper) command on Linux systems to query Domain Name

System (DNS) servers and verify if you can resolve names to IP addresses.

The nslookup (short for name server lookup) command can also be used to

query DNS servers. The ifconfig command is used to display information

and configure network interfaces on Linux systems. See Chapter 1.

You are using a Linux computer to monitor network traffic. After

connecting your computer to the mirror port of a switch, you started logging

software on the computer. However, you discover that the only traffic being

collected is traffic to or from the Linux computer. You want to collect all

traffic going through the switch. Which of the following actions should you

take?

• Run the command ifconfig eth0 promisc.

• Run the command ipconfig eth0 promisc.

• Connect the computer to a router.

• Reconfigure the switch.

Answer explanation

A is correct. You should run the command ifconfig eth0 promisc to

enable promiscuous mode on eth0, the network interface card (NIC).

Promiscuous mode allows a NIC to process all traffic it receives, instead of

only traffic addressed to it. The ipconfig command is used on Windows

systems and doesn’t support this feature. The scenario indicates she wants

to collect traffic going through the switch, so connecting to a router isn’t

necessary. Port mirroring on a switch sends a copy of all traffic received by

the switch to the mirror port. The scenario indicates this is configured, so

the switch doesn’t need to be reconfigured. See Chapter 1.

You suspect that attackers have been performing a password spraying

attack against a Linux server. Which of the following would be the BEST

method of confirming your suspicions?

• Use the cat command to view the auth.log file.

• Implement an account lockout policy.

• Salt passwords to prevent the success of the spraying attack.

• Use the logger command to view unsuccessful logins.

Answer explanation

A is correct. The cat command (short for concatenate) displays the entire

contents of a file and the auth.log file shows all unsuccessful (and

successful) logins, and this is the only choice of the available answers that

confirms past activity. An account lockout policy locks an account after too

many incorrect passwords within a certain time frame, but a spraying attack

uses a time lapse between each password attempt to bypass an account

lockout policy. Salting passwords is often used to prevent rainbow table-

based attacks, but salts aren’t effective against spraying attacks. The logger

command is used to add log entries into the syslog file but doesn’t examine

log entries. See Chapter 1.

Your network includes dozens of servers. Administrators in your

organization are having problems aggregating and correlating the logs from

these servers. Which of the following provides the BEST solution for these

problems?

• SIEM

• Syslog

• NetFlow

• sFlow

Answer explanation

A is correct. A security information and event management (SIEM)

system collects, aggregates, and correlates logs from multiple sources.

Syslog is a protocol that specifies log entry formats that many SIEMs use. It

is also the name of a log on Linux systems. NetFlow is a network protocol

(developed by Cisco) used to collect and monitor network traffic. The

sFlow (short for sampled flow) protocol is used to collect a sampling of

network traffic for monitoring. See Chapter 1.