IT Fundamentals - Security Threats and Authentication

What is the best countermeasure against social engineering?

• Access auditing

• Strong passwords

• User awareness training

• Acceptable use policy

Answer explanation

The best countermeasure to social engineering is user awareness training. If users understand the importance of security and the restrictions on types of information, they are less likely to reveal confidential information or perform unauthorized activities at the prompting of a stranger or a claimed identity over the phone.

Which of the following is a common form of social engineering attack?

• Stealing the key card of an employee and using that to enter a secured building.

• Using a sniffer to capture network traffic.

• Distributing false information about your organization's financial status.

• Hoax virus information emails.

Answer explanation

Hoax virus information emails are a form of social engineering attack. This type of attack preys on email recipients who are fearful and will believe most information if it is presented in a professional manner. All too often, the victims of these attacks fail to double check the information or instructions with a reputable third-party anti-virus software vendor before implementing the recommendations. Usually these hoax messages instruct the reader to delete key system files or download Trojan horses. Social engineering relies on the trusting nature of individuals to take an action or allow unauthorized action.

Mark received an email from a software company claiming his account will be disabled soon. The email contains several spelling errors, an attachment, and states he should open the attachment for further instructions. What should Mark do?

• Reply to the sender and ask if the attachment is safe

• Forward the email to a friend and ask for advice

• Open the attachment because he has anti-virus software installed

• Delete the email without opening the attachment

Answer explanation

Mark should delete the email without opening the attachment. There are a variety of spelling errors, which wouldn't likely happen if the email were from a real software company. The attachment almost certainly contains malware that would install on Mark's system if he opened it. He should not forward or reply to the email.

Which of the following describes a Man-in-the-Middle attack?

• An IP packet is constructed which is larger than the valid size.

• A person over the phone convinces an employee to reveal their logon credentials.

• Malicious code is planted on a system where it waits for a triggering event before activating.

• An attacker intercepts communications between two network hosts by impersonating each host.

Answer explanation

A Man-in-the-Middle attack is a technological attack where a malicious person intercepts network communications between two hosts, posing as the sender to the receiver and as the receiver to the sender.

Convincing an employee to reveal his logon credentials over the phone is an example of a social engineering attack. Constructing an IP packet which is larger than the valid size is a form of denial-of-service attack. Planting malicious code on a system where it waits for a triggering event before activating is a logic bomb.

A technician walks into the office with a UPS. What sort of threat will this device prepare a system for?

• Power outage

• Denial-of-service

• Wiretapping

• Data redundancy

Answer explanation

Critical systems such as database servers and web servers need to be equipped with a UPS, or uninterruptible power supply. These devices provide a temporary power source during an outage that gives the system enough time to shut down cleanly without data loss or corruption.

Data redundancy is a method of increasing fault tolerance by storing data in a way that ensures that the data is recoverable in case of hardware failures. RAID arrays and replication are two data redundancy strategies.

A denial-of-service attack attempts to overload a system so that the services it provides are no longer available to legitimate network clients.

Wiretapping is a form of eavesdropping that uses programs such as packet sniffers to capture data being transmitted over a network.

A large number of compromised computers are infected with malware that allows an attacker (herder) to control them to spread email spam and launch denial-of-service attacks. Which of the following does this security threat describe?

• Man-in-the-middle

• Spoofing

• Phishing

• Zombie/botnet

Answer explanation

Devices that are infected with malware that can be remotely controlled by an attacker are known as zombies. A collection of these zombies that are controlled by the same attacker are known as a botnet (robot network).

Phishing is an attempt to trick a user into compromising personal information or downloading malware. Most often it involves an email containing a malicious attachment or hyperlink.

A man-in-the-middle (MITM) attack intercepts communications between two systems and alters the message before sending it on to the original recipient.

Spoofing is when an entity misrepresents itself by using a fake IP address or, more commonly, a fake email address that resembles a real address. The person being spoofed may not immediately discover that the address is fake.

You work for a company that offers their services through the Internet. Therefore, it is critical that your website performs well. As a member of the IT technician staff, you receive a call from a fellow employee who informs you that customers are complaining that they can't access your website. After doing a little research, you have determined that you are a victim of a denial-of-service attack.

As a first responder, which of the following is the next BEST step to perform?

• Prevent such an incident from occurring again.

• Contain the problem.

• Hire a forensic team to gather evidence.

• Investigate how the attack occurred.

Answer explanation

You have already identified the issue, so the next step is to take actions to stop the attack and contain the damage. Although it is important to preserve as much information as possible to assist in later investigations, it might be better to stop the attack, even if doing so alerts the attacker or results in the loss of evidence regarding the attack.

Which of the following are the BEST steps you can take to avoid having your mobile device exploited by a hacker or infected by a virus? (Select two.)

• Keep the operating system up to date

• Lock the screen with some form of authentication

• Keep your device always in your possession

• Avoid anti-virus apps

• Keep an up-to-date remote backup

Answer explanation

Keeping the operating systems up to date with the latest updates and patches will help because they often contain fixes for known security issues. Configure the screen lock to require some sort of authentication to physically access your device.

A remote backup is an essential disaster recovery solution but will not prevent hacker exploitation or virus infection. Having your device always in your possession, it can still be hacked and infected by a virus if not protected. Anti-virus apps for Android devices will protect your device, but you should do some research to make sure you get the most effective one. Turning off locations services does not improve your device's security and it will make it harder to find your device if you lose it.

In which of the following situations should you expect total privacy?

• Social networking

• Emailing messages and attachments

• Instant messaging

• Financial transactions

Answer explanation

Entering personal information or conducting financial transactions online is convenient and efficient. There is an expectation of privacy offered by the financial institution. However, consumers need to adopt safeguards to protect themselves against identity theft and fraud.

Email, social networking, and instant messaging are often free or employer provided services and have specific expectations that communication in many situations is not private. For example, a free email provider may scan your email and attachments to send you targeted ads.

In which of the following should you expect some privacy?

• Emailing an important document to a friend using an employer email system

• Personally identifiable information entered into a human resource database

• Sharing a photo through a mobile phone app

• Metadata stored by a web browser

Answer explanation

A person should have an expectation of some privacy for any PII entered into a database.

Metadata is typically used by third parties for marketing and sales use, such as when you visit a vendor's website. Metadata will be stored on your computer that identifies you the next time you visit a web site, and targeted ads may be displayed based on your previous searches or interactions.

There is no expectation of privacy for employer-based email systems and all data transmitted is considered business related.

Sharing a photo through a mobile phone app, such as an instant messenger, does not typically provide an expectation of privacy but depends on the privacy statement from the application vendor.