Security+ Study Guide-07 Protecting Against Advanced Attacks

An IDS has sent multiple alerts in response to increased traffic. Upon investigation, you realize it is due to a spike in network traffic from several sources. Assuming this is malicious, which of the following is the MOST likely explanation?

• An ARP poisoning attack

• A DNS poisoning attack

• A domain hijacking attack

• A DDoS attack

Answer explanation

A distributed denial-of-service (DDoS) attack causes spikes in network traffic as multiple systems attempt to connect to a server and deplete the target’s resources.

An Address Resolution Protocol (ARP) poisoning attack attempts to mislead systems about the source media access control (MAC) address.

A Domain Name System (DNS) poisoning attack attempts to redirect web browsers to malicious URLs.

In a domain hijacking attack, an attacker changes a domain name registration without permission from the owner.

While investigating performance issues on a web server, you verified that the CPU usage was about 10 percent five minutes ago. However, it now shows that the CPU usage has been averaging 98 for the last two minutes.

Which of the following BEST describes what this web server is experiencing?

• Resource exhaustion

• DDoS

• A buffer overflow attack

• A memory leak

Answer explanation

CPU usage averaging 98 percent indicates resource exhaustion. The scenario doesn’t indicate the cause of the increased usage, so resource exhaustion is the best answer.

A distributed denial-of-service (DDoS) attack could cause this. However, a surge in traffic from an effective marketing campaign sent via email could also cause a surge in resource usage.

A buffer overflow attack is a type of DDoS attack, but the scenario doesn’t give enough information to indicate a buffer overflow attack has taken place.

The scenario only mentions CPU usage, so there isn’t any indication of a memory leak.

An administrator regularly connects to a server using SSH without any problems. Today, he sees a message similar to the following graphic when he connects to the server.

Which of the following is the MOST likely reason for this message?

• Rogue access point

• On-path attack

• MAC flodding

• ARP poisoning

Answer explanation

The message indicates a potential man-in-the-middle (MITM) attack, which is also known as an on-path attack. Specifically, it indicates that the key on the host system has changed, which may be due to the administrator connecting to the MITM system instead of the target system.

None of the other answers are related to incorrect cryptographic keys. A rogue access point is an unauthorized wireless access point.

Media access control (MAC) flooding is an attack on a switch, attempting to overload it with different MAC addresses.

An Address Resolution Protocol (ARP) poisoning attack misleads computers or switches about a system’s actual MAC address.

Homer complains that his system started acting erratically today. You discover that malware infected his system, but you discover he didn't open any email during the day. He mentions that he has been browsing the Internet all day.

Which of the following could you check to see where the malware MOST likely originated?

• Web server logs

• Mail server logs

• PowerShell logs

• DNS server logs

Answer explanation

Domain Name System (DNS) logs will record DNS queries, such as what hostnames it resolved to IP addresses. The log entries would show all the domains that Homer visited during the day. One of these is most likely the one that downloaded malware onto his system.

A web server would show activity on the web server, but you wouldn’t have access to web servers controlled by others.

Homer didn’t open any email, so the mail server logs wouldn’t help.

PowerShell logs may show activity, but only if the malware used PowerShell. However, the PowerShell logs are unlikely to show who ran PowerShell scripts.

While reviewing logs for a web application, a security analyst notices that it was crashed several times, reporting a memory error. Shortly after it crashes, the logs show malicious code that isn't part of a known application.

Which of the following is MOST likely occurring?

• Buffer overflow

• ARP poisoning

• Privilege escalation

• Replay

Answer explanation

Buffer overflow attacks often cause an application to crash and expose system memory. Attackers then write malicious code into the exposed memory and use different techniques to get the system to run this code. None of the other attacks insert malicious code into memory.

An Address Resolution Protocol (ARP) poisoning attack attempts to mislead systems about the source media access control (MAC) address.

Privilege escalation techniques attempt to give an attacker more rights and permissions.

In a replay attack, the attacker intercepts data and typically attempts to use the intercepted data to impersonate a user or system.

Web developers are implementing error handling in a database application accessed by a web browser.

Which of the following would be the BEST way to implement this?

• Display a detailed error message but log generic information on the error

• Display a generic error message but log detailed information on the error

• Display a generic error message and log generic information on the error

• Display a detailed error message and log detailed information on the error

Answer explanation

You should display a generic error message but log detailed information on the error.

Detailed error messages to the user are often confusing to them and give attackers information they can use against the system.

Logging generic information makes it more difficult to troubleshoot the problem later.

A web developer is adding input validation techniques to a website application.

Which of the following should the developer implement during this process?

• Validation on the server-side

• Validation on the client-side

• Normalization techniques

• Memory management techniques

Answer explanation

At a minimum, input validation should be performed on the server-side.

Client-side validation can be combined with server-side validation, but attackers can bypass client-side input validation if it is used alone.

Normalization techniques organize tables and columns in a database to reduce redundant data but have nothing to do with input validation.

Memory management is a secure coding technique that helps prevent memory errors.

Developers in the YCDA organization have created an application that users can download and install on their computers. Management wants to provide users with a reliable method of verifying that the application has not been modified after YCDA released it.

Which of the following methods provides the BEST solution?

• Code signing

• Input validation

• Obfuscation

• Stored procedures

Answer explanation

Code signing provides a digital signature for the code, verifies the publisher of the code, and verifies that it hasn’t been modified since the publisher released it. None of the other answers verify the application hasn’t been modified.

Input validation verifies data is valid before using it.

Code obfuscation or code camouflage techniques make the code more difficult to read.

Stored procedures are used with SQL databases and can be used for input validation.

Your organization is preparing to deploy a web-based application, which will accept user input.

Which of the following will BEST test the reliability of this application to maintain availability and data integrity?

• Static code analysis

• Input validation

• Error handling

• Dynamic code analysis

Answer explanation

Dynamic code analysis techniques test an application during its execution and is the best choice of the available answers to verify the application can maintain availability and data integrity.

Static code analysis (such as a manual code review) is done without executing any code, but it won’t test its reliability.

Input validation is the practice of checking data for validity before using it, but this is done within the application, not as a method to test the application.

Error-handling techniques are also done within the application.

Several developers in your organization are working on a software development project. Recently, Bart made an unauthorized change to the code that effectively broke several modules. Unfortunately, there isn't any record of who made the change or details of the change. Management wants to ensure it is easy to identify who makes any changes in the future.

Which of the following provides the BEST solution for this need?

• Dynamic code analysis

• Version control

• Static code analysis

• Use of third-party SDKs

Answer explanation

A version control system will track all changes to a software project, including who made the change and when.

Dynamic code analysis techniques test an application during its execution.

Static code analysis examines the code without executing it as a method of code testing.

The use of third-party software development kits (SDKs) is a secure coding technique, but it won’t detect unauthorized changes.