Security+ Study Guide-01 Mastering Security Basics

Management within your organization has defined a use case to support the confidentiality of data stored in a database. Which of the following solutions will BEST meet this need?

• Hashing

• Disk redundancies

• Encryption

• Patching

Answer explanation

Encryption is the best choice to provide confidentiality of any type of information, including data stored in a database.

Hashing supports a use case of supporting integrity.

Disk redundancies provide resilience and increase availability.

Patching systems increases availability and reliability

Apu manages network devices in his store and maintains copies of the configuration files for all the managed routers and switches. On a weekly basis, he creates hashes for these files and compares them with hashes he created on the same files the previous week. Which of the following use cases is he MOST likely supporting?

• Supporting confidentiality

• Supporting integrity

• Supporting encryption

• Supporting availability

Answer explanation

He is most likely using a use case of supporting integrity. By verifying that the hashes are the same on the configuration files, he is verifying that he files have not changed.

Confidentiality is enforced with encryption, access controls, and steganography.

Encryption is a method of enforcing confidentiality, and it doesn't use hashes. Availability ensures systems are up and operational when needed.

Which of the following is a cryptographic algorithm that will create a fixed-length output from a data file but cannot be used to re-create the original data file?

• MD5

• AES

• IDS

• SIEM

Answer explanation

Message Digest 5 (MD5) is a hashing algorithm that creates a fixed-length, irreversible output. Hashing algorithms cannot re-create the original data file from just the hash.

Advanced Encryption Standard (AES) is an encryption algorithm, and you can re-create the original data file by decrypting it.

An intrusion detection system (IDS) is not a cryptographic algorithm but it is a detective control.

A security information and event management (SIEM) system provides centralized logging.

Your organization host an e-commerce web server selling digital products. The server randomly experiences a high volume of sales and usage, which causes spikes in resource usage. These spikes occasionally take the server down. Which of the following should be implemented to prevent these outages?

• Elasticity

• Scalability

• Normalization

• Stored procedures

Answer explanation

Elasticity is the best choice because it allows the server to dynamically scale up or out as needed in response to high resource usage.

Scalability isn't the best answer because it is done manually, however, the high resource usage is random and manually adding resources can't respond to the random spikes quick enough.

Normalization refers to organizing tables and columns in a database to reduce redundant data and improve overall database performance.

Stored procedures are a group of SQL statements that execute as a whole and help prevent SQL injection attacks.

An administrator recently installed an IDS to help reduce the impact of security incidents. Which of the following BEST identifies the control type of an IDS?

• Preventative

• Physical

• Deterrent

• Detective

Answer explanation

An intrusion detection system (IDS) is a detective control. It can detect malicious traffic after it enters a network.

A preventative control, such as an intrusion prevention system (IPS), prevent malicious traffic from entering the network. An IDS uses technology and is not a physical control.

Deterrent controls attempt to discourage a threat, but attackers wouldn't know if a system had an IDS, so the IDS can't deter attacks.

Maggie works in the security section of the IT department. Her primary responsibilities are to monitor security logs, analyze trends reported by the SIEM, and validate alerts. Which of the following choices BEST identifies the primary security control she's implementing?

• Compensating

• Preventative control

• Detective control

• Corrective control

Answer explanation

Monitoring security logs, analyzing trend reports from a security information and event management (SIEM), and validating alerts from a SIEM are detective controls. Detective controls try to detect security incidents after they happened. A compensating control is an alternative control used when a primary security control is not feasible or is not yet deployed.

Preventative controls attempt to prevent incidents, but the scenario doesn't specifically describe any preventative controls.

A corrective control attempts to reverse the impact of a security incident after it has happened.

A server in your network's DMZ was recently attacked. The firewall logs show that the server was attacked from an external IP address with the following socket: 72.52.230.233:6789. You want to see if the connection is still active. Which of the following would be BEST to use?

• tracert

• arp

• netstat

• dig

Answer explanation

The netstat command can be sued to display a list of open connections, including both the IP address and the port (or a socket). None of the other commands display active connections.

The tracert command list the routers between two systems.

The arp command shows the contents of the Address Resolution Protocol (ARP) cache.

The dig command can be used on Linux system to query Domain Name System (DNS) servers.

You suspect that traffic in your network is being rerouted to an unauthorized router within your network. Which of the following command-line tools would help you narrow down the problem?

• ping

• tracert

• ipconfig

• netstat

Answer explanation

You can use tracert to track packet flow through a network, and if an extra router has been added to your network, tracert will identify it.

You can use ping to check connectivity with a remote system, but it doesn't show the route.

The ipconfig command shows the network setting on a Windows computer, but it doesn't identify failed routers.

Netstat shows active connections and other network statistics on a local system, but it doesn't identify network paths.

Homer is complaining that he frequently has trouble accessing files on a server in the network. You determine the server's IP address is 172.16.17.11, but ping doesn't show any problem. You decide to use pathping and see the following results:

C:\>pathping 172.16.17.11

Tracing route to 172.16.17.11 over a maximum of 30 hops:

0 192.168.7.34

1 192.168.7.1

2 192.168.5.1

3 10.5.48.1

4 10.80.73.150

5 172.16.17.11

Computing statistics for 125 seconds...

Source to Here This Node/Link

Hop RTT Lost/Sent=Pct Lost/Sent=Pct Address

0 192.168.7.34 0/100 = 0% |

1 45 ms 0 / 100 = 0% 0/100 = 0% 192.168.7.1 14/100 = 14% |

2 25 ms 15 / 100 = 15% 0 / 100 = 0% 192.168.5.1 0/100 = 0% |

3 22 ms 16 / 100 = 16% 0 / 100 = 0% 10.5.48.1 0/100 = 0% |

4 --- 100/100 = 100% 100/100 = 100% 10.80.73.150 0/100 = 0% |

5 23 ms 16 / 100 = 16% 0/100 = 0% 172.16.17.11

Which of the following is the MOST likely problem?

• The router with the IP address of 10.80.73.150

• The router with the IP address of 192.168.5.1

• The segment between 192.168.7.1 and 192.168.5.1

• The router with the IP address of 192.168.7.1

Answer explanation

The segment between 192.168.7.1 and 192.168.5.1 is most likely the problem. The results show packet loss of 14 percent on this segment.

The router at 10.80.73.150 (hop 4) is showing 100 percent packet loss but the traffic is still getting to the server at 172.16.17.11 (hop 5). This indicates the router at 10.80.73.150 is not responding to ICMP traffic.

The packet loss between the source and 192.168.5.1 is due to the packet loss on the previous network segment.

There is no packet loss to 192.168.7.1

You're troubleshooting a connectivity issue with a server that has an IP address of 192.168.1.10 from your Linux system. The server does not respond to the ping command, but you suspect that a router is blocking the ping traffic. Which of the following choices would you use to verify the server is responding to traffic?

• hping

• ipconfig

• netstat

• arp

Answer explanation

The hping command can be used in place of the ping command when network devices are blocking ping commands using Internet Control Message Protocol (ICMP) traffic.

It can send packets using TCP and other protocols instead of ICMP.

The ipconfig command is used to view TCP/IP configuration information.

Netstat shows active connections and network statistics. The arp command shows the contents of the arp cache and does not use echo commands.