CIS41A Quiz 2 Review

Which of the following statements is NOT true?

• Cloud computing customers provision resources through the service provider's sales team.

• Cloud resources are accessible over the network.

• Cloud computing offers ubiquitous, convenient access.

• Cloud computing customers store data on hardware that is shared with other customers.

Anthony purchases virtual machines from Microsoft Azure and uses them exclusively for his organization. What model of cloud computing did Anthony purchase?

• Private cloud

• Public cloud

• Hybrid cloud

• Community cloud

Answer explanation

limiting access to virtual machines to the organization is not relevant, because the determining factor for the cloud model is whether the underlying infrastructure is shared, not whether virtualized resources are shared.

Which one of the following options is a characteristic of DevOps approaches to technology?

• Requiring clear hand-offs between development and production

• Eliminating the need for developers to understand business requirements

• Isolating operations teams from development teams

• Increasing the frequency of application releases

What type of credential is commonly used to restrict access to an API?

• Biometrics

• Passwords

• Encryption keys

• API keys

Betty gained access to a client's AWS account during a penetration test. She would like to determine what level of access she has to the account. Which one of the following tools would best meet her need?

• Prowler

• Pacu

• CloudSuite

• Inspector

Answer explanation

Pacu is an AWS-specific exploitation framework. It is particularly well suited to identifying the permissions available to an account during a penetration test. ScoutSuite, Inspector, and Prowler are all assessment tools that would not directly provide the information that Gina seeks.

Carlos builds a malware signature using a hash of the binary that he found on an infected system. What problem will he encounter with modern malware when he tries to match hashes with other infected systems?

• The attackers may have encrypted the binary file.

• The hashes may match too many malware packages.

• The malware may be polymorphic.

• The hash value may be too long.

Answer explanation

Polymorphic techniques change malware each time it infects a system, making simple hashing unable to be used to check if the malware matches. More advanced techniques include behavior monitoring–based techniques as well as other more in-depth analytical techniques that identify components of the malware package.

Frankie wants to ensure that only preapproved software runs on the company's workstations. What solution will best fit this need?

• Antimalware

• Whitelisting

• Blacklisting

• Virtual Desktop Infrastructure (VDI)

Answer explanation

Whitelisting technologies can be used to only allow programs that have been preapproved to run on systems that use it. Blacklisting prevents specific programs from running. An antivirus uses a number of techniques to identify malicious software and might even include blacklisting and whitelisting capabilities, but we cannot assume that is the case. VDI provides virtualized desktops and can be useful for controlling systems but does not specifically provide this capability.

Josephine is concerned that increasing network traffic from the datacenter and this issue may be caused by a compromise that the security tools have not detected. What SIEM analysis can she use to evaluate the sent datacenter traffic over a period of time?

• Trend analysis

• Automated reporting engine

• Logs aggregation

• Border Gateway Protocol (BGP) graphing

Answer explanation

Trend analysis using historical data will show what the network traffic's behavior has been. Josephine may notice an increase since a new storage server with cloud replication was put in, or she may notice that a DMZ host has steadily been increasing its outbound traffic. Automated reporting might send an alarm if it has appropriate thresholds set, and log aggregation is the foundation of how a SIEM gathers information, but neither will individually give Josephine the view she needs. BGP is a routing protocol, and graphing it won't give Josephine the right information either.

What type of authentication uses IP addresses, geographic location, and time of day to validate the user?

• Token-based authentication

• Environment-based authentication

• Behavior-based authentication

• Context-based authentication

Answer explanation

Context-based authentication allows authentication decisions to be made based on information about the user, the system they are using, or other data like their geographic location, behavior, or even the time of day. Token-based authentication uses a security token to generate a onetime password or value.

Jack was originally hired into the helpdesk at his current employer but has since then moved into finance. During a rights audit, it is discovered that he still has the ability to change passwords for other staff members. What is this issue called?

• Privilege creep

• Permission misalignment

• Rights management

• Least privilege

Answer explanation

Privilege creep occurs as staff members change roles but their rights and permissions are not updated to match their new responsibilities. This violates the concept of least privilege. Rights mismanagement and permission misalignment are both terms made up for this question.