Security+ Study Guide-05 Securing Hosts and Data

Attackers recently exploited vulnerabilities in a web server hosted by your organization. Management has tasked administrator with checking the server and eliminating any weak configurations on it.

Which of the following will meet this goal?

• Installing a NIDS

• Disabling unnecessary services

• Enabling root acounts

• Implementing SSL encryption

Answer explanation

Unnecessary open ports and services are common elements that contribute to weak configurations so it’s important to close ports that aren’t needed and disable unnecessary services.

A network-based intrusion detection system (NIDS) helps protect internal systems, but a NIDS would not be installed on the server and administrators are tasked with checking the server.

Unsecured root accounts indicate a weak configuration. If root accounts are disabled, enabling them won’t increase security on the server.

Secure Sockets Layer (SSL) is a weak encryption protocol and should not be implemented on servers.

The BizzFad organization develops and sells software. Occasionally they update the software to fix security vulnerabilities and/or add additional features. However, before resealing these updates to customers, they test them in different environments.

Which of the following solutions provides the BEST method to test the updates?

• Baseline configuration

• BYOD

• Sandbox

• Change management

Answer explanation

A sandbox provides a simple method of testing updates. It provides an isolated environment and is often used for testing.

A baseline configuration is a starting point of a computing environment.

Bring your own device (BYOD) refers to allowing employee-owned mobile devices in a network and is not related to this question. Change management practices ensure changes are not applied until they are approved and documented.

Network administrators have identified what appears to be malicious traffic coming from an internal computer, but only when no one is logged on the computer. You suspect the system is infected with malware. It periodically runs an application that attempts to run hping3 via remote websites. After comparing the computer with a list of applications from the master image, they verify this application is likely the problem.

What allowed them to make this determination?

• Version control

• Sandbox

• Blacklist

• Integrity measurements

Answer explanation

The master image is the baseline, and the administrators performed integrity measurements to identify baseline deviations. By comparing the list of applications in the baseline with the applications running on the suspect computer, it's possible to identify unauthorized applications.

None of the other answers include the troubleshooting steps necessary to discover the problem.

Version control tracks software version as software is updated.

A sandbox is an isolated are of a system, typically used to test applications.

A blacklist is a list of prohibited applications

While investigating a recent data breach, investigators discovered a RAT on Bart's computer. Antivirus software didn't detect it. Logs show a user with local administrator privileges installed it.

Which of the following answer has the BEST change of preventing this from happening again in the future?

• Enforce an application allow list

• Enforce an application block list

• Implement a BYOD policy

• Implement a DLP policy

Answer explanation

Enforcing an application allow list (sometimes called an application whitelist) would prevent this. An application allow list identifies the only applications that can be installed on a computer and would not include a malicious remote access tool (RAT).

An application block list identifies applications to block, but malware changes so often, this wouldn’t help.

Code signing verifies code is valid and hasn’t been modified.

A bring your own device (BYOD) policy identifies mobile devices employees can buy and connect to a network but is unrelated to this question.

A data loss protection (DLP) system typically monitors outgoing traffic and wouldn’t stop a user from installing a malicious application.

Salespeople within a company regularly take company-owned laptops with them on the road. The company wants to implement a solution to protect laptop drives against data theft.

• DLP

• HSM

• MDM

• SEDs

Answer explanation

Self-encrypting drives (SEDs) are the best solution. SEDs have encryption circuitry built into the drive. They encrypt and decrypt data without user interaction, though it's common to require personnel to use credentials to unlock the SED when booted.

A data loss prevention (DLP) solution typically monitors outgoing traffic to prevent confidential information from getting outside the organization.

A hardware security module (HSM) is used to manage, generate, and store cryptographic keys. It's generally used on a network instead of on laptops.

Mobile device management (MDM) refers to technologies used to manage mobile devices.

Managers within your organization want to implement a secure boot for some key computers. During the boot process, each computer should send data to a remote system to check the computer's configuration.

Which of the following will meet this goal?

• Trusted Platform Module

• Hardware root of trust

• Remote attestation

• Tokenization

Answer explanation

A remote attestation process checks a computer during the boot cycle and sends a report to a remote system. The remote system attests or confirms that the computer is secure.

None of the other answers sends data to a remote system.

A Trusted Platform Module (TPM) is a hardware chip on a motherboard and provides a local secure boot process.

A TPM includes an encryption key burned into the CPU, which provides a hardware root of trust. Tokenization replaces sensitive data with a token or substitute value, and this token can be used in place of the original data.

Your organization recently updated its security policy to prohibit the use of external storage devices. The goal is to reduce threats from insiders.

Which of the following methods would have the BEST chance of reducing the risk of data exfiltration using external storage devices?

• Train employees about the policy

• Monitor firewall logs to detect data exfiltration

• Block write capabilities to removable media

• Implement a network-based DLP solution

Answer explanation

Blocking write capabilities to removable media is the best choice. This can be done with a data loss prevention (DLP) solution on all computers. Training employees might help, but it won’t stop an insider threat.

Monitoring firewall logs might detect data exfiltration out of the network, but it won’t monitor the use of external storage devices.

A network-based DLP solution might detect and stop data exfiltration out of the network, but it would stop users from copying data to removable media.

Maggie, the new CTO at your organization, wants to reduce costs by utilizing more cloud services. She has directed the use of a cloud service instead of purchasing all the hardware and software needed for an upcoming project. She also wants to ensure that the cloud provider maintains all the required hardware and software.

Which of the following BEST describes the cloud computing service model that will meet these requirements?

• IaaS

• PaaS

• SaaS

• XaaS

Answer explanation

Platform as a Service (PaaS) provides customers with a preconfigured computing platform including the hardware and software. The cloud provider maintains the hardware and specified software such as the operating system and key applications such as a web server application.

Infrastructure as a Service (IaaS) is a cloud computing option where the vendor provides access to a computer, but customers must install the operating system and maintain the system.

Software as a Service (SaaS) provides access to specific applications such as an email application.

Anything as a Service (XaaS) refers to cloud services beyond IaaS, PaaS, and SaaS.

You are asked to research prices for cloud-based services. The cloud service provider needs to supply servers, storage, and networks, but nothing else.

Which of the following will BEST meet your needs?

• IaaS

• PaaS

• SaaS

• XaaS

Answer explanation

An Infrastructure as a Service (IaaS) cloud model provides clients with hardware but nothing else.

A Platform as a Service (PaaS) model provides customers with a computing platform including operating systems and some applications.

A Software as a Service (SaaS) model provides customers with one or more applications.

Anything as a Service (XaaS) refers to cloud services beyond IaaS, PaaS, and SaaS, but this scenario clearly describes an IaaS model.

Your organization has been using more cloud resources and Lisa, the new CIO, is concerned about security. She want to add a service that is logically placed between the organization's network and the cloud provider. This service will monitor all network traffic and ensure that data sent to the cloud for storage is encrypted.

Which of the following will BEST meet these requirements?

• CASB

• Storage permissions

• A storage encryption policy

• Firewall

Answer explanation

A cloud access security broker (CASB) is placed between a network and a cloud provider and would meet the chief information officer (CIO) requirements. It can monitor traffic and enforce security policies, such as ensuring all data sent to the cloud is encrypted. Permissions should be set on cloud storage locations to ensure only authorized personnel can access them, but they don’t encrypt the data.

A storage encryption policy can be created to require encryption of data stored in the cloud, but the policy wouldn’t monitor all traffic to and from the cloud.

A firewall can filter traffic, but it doesn’t include all the capabilities of a CASB, such as verifying data is encrypted.