SECURITY+ (Q151-176)

QUESTION 151

The Chief information Security Officer wants to prevent exfilitration of sensitive information from employee cell phones when using public USB power charging stations. Which of the following would be the Best solution to implement?

• A. DLP

• B. USB data blocker

• C. USB OTG

• D. Disabling USB ports

Answer explanation

B.

USB data blocker

The best solution to prevent data exfiltration from employee cell phones when using public USB power charging stations is to implement USB data blockers (also known as "USB condoms"). USB data blockers are small devices that prevent data transfer while allowing charging to occur safely.

When you connect your phone to a USB charging station, the charging cable typically has both data transfer and power capabilities. This creates a potential security risk as hackers could modify the USB charging station to siphon off sensitive information from connected devices.

By using a USB data blocker, it blocks the data transfer pins in the USB cable, ensuring that only power flows through the cable, and data transfer is disabled. This effectively prevents any attempt to exfiltrate sensitive information from the employee's cell phones while charging at public USB power stations.

Option A (DLP - Data Loss Prevention) is not the best solution in this context as it is a broader approach used to prevent data leaks or exfiltration across various channels, not specifically tailored to the use case of public USB charging stations.

Option C (USB OTG - USB On-The-Go) is a technology that enables devices like smartphones to act as USB hosts and communicate with other USB peripherals. While it is useful in certain scenarios, it does not address the specific security concern of data exfiltration from public USB charging stations.

Option D (Disabling USB ports) might be an effective solution in a controlled corporate environment, but it is not practical for public USB charging stations, where users need to charge their devices quickly and easily. Disabling USB ports would inconvenience users and might not be feasible in public locations. Additionally, it may not address the issue when employees need to use USB peripherals legitimately in other situations.

QUESTION 152

A security manager has tasked the security operations center with locating all web servers that respond to an unsecure protocol. Which of the following commands could an analyst run to find requested servers?

• A. nslookup 10.10.10.0

• B. nmap -p 80 10.10.10.0/24

• C. pathping 10.10.10.0 -p 80

• D. no -1 -p 80

Answer explanation

B.

nmap -p 80 10.10.10.0/24

The correct command to find web servers that respond to an unsecure protocol (in this case, unencrypted HTTP on port 80) is option B:

nmap -p 80 10.10.10.0/24

Explanation:

• "nmap" is a powerful network scanning tool used to discover hosts and services on a computer network.

• "-p 80" specifies that the scan is targeting port 80, which is the default port for unencrypted HTTP communication.

• "10.10.10.0/24" is the CIDR notation for a range of IP addresses. It represents all IP addresses from 10.10.10.1 to 10.10.10.254 in a /24 subnet, which covers a typical local network.

By running this nmap command, the security analyst will scan the specified IP range for devices that have port 80 open, which indicates the presence of web servers responding to unsecure (HTTP) requests. The security operations center can then identify these servers and take appropriate actions to secure them properly.

QUESTION 153

A company wants the ability to restrict web access and monitor the websites that employees visit.

Which of the following would BEST meet these requirements?

• A. internet proxy

• B. VPN

• C. WAF

• D. Firewall

Answer explanation

A.

Internet proxy

An internet proxy would be the best option to meet the requirements of restricting web access and monitoring the websites that employees visit. Here's why:

1. Restrict web access: An internet proxy acts as an intermediary between the users (employees) and the internet. By configuring the proxy server, the company can enforce access control policies, blocking certain websites or categories of websites deemed inappropriate or unrelated to work.

2. Monitor website visits: Internet proxies can log and analyze web traffic passing through them. They provide detailed reports on the websites visited, the amount of data transferred, and the users accessing those websites. This monitoring capability helps in identifying potential security risks, productivity issues, and compliance violations.

Option B (VPN - Virtual Private Network) is not the best choice because VPNs are used to establish secure connections between remote users and the company's internal network. While VPNs can provide some level of privacy for user traffic, they do not inherently provide the granularity and control needed to restrict web access and monitor website visits as effectively as an internet proxy.

Option C (WAF - Web Application Firewall) is designed to protect web applications from various attacks, such as SQL injection and cross-site scripting. While it can provide security for web applications, it does not have the primary functionality of restricting web access or monitoring websites visited by employees.

Option D (Firewall) is a network security device that monitors and controls incoming and outgoing network traffic based on predetermined security rules. While firewalls can be configured to block access to specific websites, they generally lack the extensive monitoring and reporting capabilities required for comprehensive website monitoring, as provided by internet proxies.

QUESTION 154

Server administrator want to configure a cloud solution so that computing memory and processor usage is maximized most efficiently acress a number of virtual servers. They also need to avoid potential denial-of-service situations caused

by availiability. Which of the following should administrator configure to maximize system availability while efficiently utilizing available computing power?

• A. Dynamic resource allocation

• B. High availability

• C. Segmentation

• D. Container security

Answer explanation

A.

Dynamic resource allocation

The administrator should configure dynamic resource allocation to maximize system availability while efficiently utilizing available computing power. Dynamic resource allocation is a feature commonly found in cloud computing environments and virtualization technologies that allows the system to allocate computing resources (such as memory and processor) to virtual servers based on demand.

Here's why dynamic resource allocation is the best option:

1. Efficient utilization of computing power: With dynamic resource allocation, the system can allocate resources to virtual servers as needed. When a virtual server requires more computing power, the system can automatically allocate additional resources. Similarly, when a virtual server's workload decreases, the resources can be reclaimed and utilized by other virtual servers. This flexibility ensures that computing power is efficiently utilized across the cloud environment.

2. Maximizing system availability: In a cloud environment, system availability is crucial to avoid potential denial-of-service situations and downtime. Dynamic resource allocation enables load balancing and ensures that virtual servers are distributed across the available hardware resources. If one physical server or host experiences issues, the virtual servers can be quickly moved to other healthy hosts, reducing the risk of service interruption and improving overall availability.

Option B (High availability) is important, but it is not the best answer in this context because high availability refers to a design approach that aims to minimize downtime by redundant systems and failover mechanisms. While it contributes to system availability, it doesn't directly address the efficient utilization of computing power.

Option C (Segmentation) is a security concept that involves dividing a network into smaller segments to control traffic and improve security. While segmentation can enhance security and isolation, it is not directly related to maximizing computing power and system availability.

Option D (Container security) is focused on securing containers, which are lightweight, portable, and scalable environments for running applications. While container security is important in cloud environments, it is not directly related to maximizing system availability and efficient resource utilization.

QUESTION 155

An audit Identified Pll being utilized In the development environment of a critical application. The Chief Privacy Officer (CPO) Is adamant that this data must be removed; however, the developers are concerned that without real data they

cannot perform functionality tests and search for specific data. Which of the following should a security professional implement to BEST satisfy both the CPO's and the development team's requirements?

• A. Data anonymlzallon

• B. Data encryption

• C. Data masking

• D. Data tokenization

Answer explanation

C.

Data masking

Data masking would be the best option to satisfy both the Chief Privacy Officer's (CPO) requirement of removing sensitive Personally Identifiable Information (PII) while allowing the development team to perform functionality tests and search for specific data.

Data masking, also known as data obfuscation or data anonymization, involves modifying or scrambling sensitive data in a way that retains its format and structure but removes any identifiable information. It allows the development team to work with realistic data that maintains the relationships and characteristics required for testing and development purposes, while ensuring that the original PII is not accessible.

By using data masking techniques, the critical application's development environment can have datasets that look and feel like real data but do not expose sensitive PII. This satisfies the CPO's requirement to protect privacy while still enabling the development team to carry out their essential tasks.

Option A (Data anonymization) and Option D (Data tokenization) are similar to data masking, but they might not retain the necessary relationships and data characteristics required for functional testing. Data anonymization typically involves removing all identifiers, which might render the test data less useful for testing specific scenarios. Data tokenization replaces sensitive data with unique tokens but does not necessarily maintain data relationships.

Option B (Data encryption) is not the best fit for this scenario. While data encryption is essential for protecting sensitive data in storage and transit, it would not allow the development team to work with realistic data that retains the same characteristics and relationships required for proper testing and development. Encryption would render the data unreadable without the appropriate decryption keys, making it impractical for functional testing.

QUESTION 156

A forensics investigator is examining a number of unauthorized payments the were reported on the company's website. Some unusual log entries show users received an email for an unwanted mailing list and clicked on a link to attempt to

unsubscribe. One of the users reported the email to the phishing team, and the forwarded email revealed the link to be:

<a href-"https://www.company.com/payto.do?routing=00001111&accc=22223334&amount250">Click here to unsubscribe</a>

Which of the following will the forensics investigator MOST likely determine has occurred?

• A. SQL injection

• B. CSRF

• C. XSS

• D. XSRF

Answer explanation

B.

CSRF (Cross-Site Request Forgery)

The forensics investigator will most likely determine that a CSRF (Cross-Site Request Forgery) attack has occurred based on the provided information.

Explanation:

• In a CSRF attack, the attacker tricks a user into unknowingly executing unwanted actions on a different website that the user is authenticated to access.

• In this case, the user received an email for an unwanted mailing list and clicked on a link to attempt to unsubscribe. However, the link's actual URL points to a different website (https://www.company.com/payto.do), not the original website for the mailing list.

• The URL contains parameters such as routing, accc, and amount, which are likely used for making unauthorized payments or financial transactions on the attacker's website.

• The attack leverages the user's existing authentication on the original website to perform these unauthorized actions on the attacker's website without the user's knowledge or consent.

Option A (SQL injection) involves exploiting vulnerabilities in a web application's database queries to manipulate or disclose data from the database. The provided scenario does not involve any indications of SQL injection.

Option C (XSS - Cross-Site Scripting) involves injecting malicious scripts into web pages viewed by other users. While the scenario mentions unusual log entries, it does not describe any indication of malicious scripts being executed on the user's browser.

Option D (XSRF - Cross-Site Request Forgery) is the same as CSRF, just a less commonly used acronym. So, it is essentially the same as the correct answer.

QUESTION 157

A Chief Information Security Officer wants to ensure the organization is validating and checking the Integrity of zone transfers. Which of the following solutions should be implemented?

• A. DNSSEC

• B. LOAPS

• C. NGFW

• D. DLP

Answer explanation

A.

DNSSEC (Domain Name System Security Extensions) should be implemented to ensure the organization is validating and checking the integrity of zone transfers.

Explanation:

• DNSSEC is a set of extensions to DNS that adds an extra layer of security by digitally signing DNS data. It provides a mechanism to ensure the integrity and authenticity of DNS data from the authoritative DNS server to the requesting client.

• With DNSSEC, digital signatures are used to verify that the DNS data received by the client is legitimate and has not been altered in transit. This prevents DNS data from being tampered with or modified by attackers during zone transfers.

• Zone transfers in DNS involve the replication of DNS data from one DNS server (the master server) to another (the secondary server). Ensuring the integrity of zone transfers is essential to prevent unauthorized modifications to DNS data during replication.

Option B (LOAPS) is not a recognized security solution or technology in the context of validating and checking the integrity of zone transfers. It might be a non-standard or specific acronym unrelated to the given scenario.

Option C (NGFW - Next-Generation Firewall) is a network security device that incorporates traditional firewall capabilities with additional advanced security features such as intrusion prevention, application awareness, and deep packet inspection. While NGFWs are essential for network security, they do not directly address the specific requirement of validating and checking the integrity of zone transfers.

Option D (DLP - Data Loss Prevention) is a security strategy focused on identifying, monitoring, and preventing the unauthorized disclosure of sensitive information. DLP is not directly related to DNS security or the validation of zone transfers.

Therefore, the correct solution to implement for validating and checking the integrity of zone transfers is DNSSEC (Option A).

QUESTION 158

To reduce and limit software and infrastructure costs, the Chief Information Officer has requested to move email services to the cloud. The cloud provider and the organization must have security controls to protect sensitive data. Which of

the following cloud services would BEST accommodate the request?

• A. laas

• B. Paas

• C. Daas

• D. SaaS

Answer explanation

D.

SaaS (Software as a Service) would be the best cloud service to accommodate the Chief Information Officer's request to move email services to the cloud while reducing and limiting software and infrastructure costs and ensuring security controls for sensitive data.

Explanation:

• SaaS is a cloud computing model where a third-party provider hosts applications and makes them available to customers over the internet. In this case, the email service would be hosted and managed by the cloud provider, eliminating the need for the organization to maintain email infrastructure on-premises.

• SaaS solutions offer a pay-as-you-go pricing model, which can help reduce software and infrastructure costs. The organization only pays for the services they use, and the cloud provider handles the underlying infrastructure and maintenance.

• Reputable SaaS providers typically implement robust security controls to protect sensitive data. These controls may include data encryption, access controls, multi-factor authentication, regular backups, and compliance with various security standards and regulations.

Option A (IaaS - Infrastructure as a Service) would not be the best fit for the request as it provides raw computing resources (virtual machines, storage, networking) for users to manage and deploy their applications. The organization would still need to set up and manage the email service, which might not be the most cost-effective and resource-efficient solution.

Option B (PaaS - Platform as a Service) provides a development platform and environment to build, deploy, and manage applications. While PaaS could be used to develop custom email applications, it would require additional development efforts and might not be the most efficient solution for just hosting email services.

Option C (DaaS - Desktop as a Service) is not relevant to the request for moving email services to the cloud. DaaS refers to virtual desktop infrastructure delivered over the internet, allowing users to access virtualized desktops hosted by a cloud provider.

Therefore, the best cloud service to move email services to the cloud while reducing costs and ensuring security controls for sensitive data is SaaS (Option D).

QUESTION 159

An audit Identified Pll being utilized In the development environment of a critical application. The Chief Privacy Officer (CPO) Is adamant that this data must be removed; however, the developers are concerned that without real data they

cannot perform functionality tests and search for specific data. Which of the following should a security professional implement to BEST satisfy both the CPO's

and the development team's requirements?

• A. Data anonymlzallon

• B. Data encryption

• C. Data masking

• D. Data tokenization

Answer explanation

C.

Data masking

Data masking would be the best option to satisfy both the Chief Privacy Officer's (CPO) requirement of removing sensitive Personally Identifiable Information (PII) while allowing the development team to perform functionality tests and search for specific data.

Explanation:

• Data masking, also known as data obfuscation or data anonymization, involves modifying or scrambling sensitive data in a way that retains its format and structure but removes any identifiable information. It allows the development team to work with realistic data that maintains the relationships and characteristics required for testing and development purposes, while ensuring that the original PII is not accessible.

• By using data masking techniques, the critical application's development environment can have datasets that look and feel like real data but do not expose sensitive PII. This satisfies the CPO's requirement to protect privacy while still enabling the development team to carry out their essential tasks.

Option A (Data anonymization) and Option D (Data tokenization) are similar to data masking, but they might not retain the necessary relationships and data characteristics required for functional testing. Data anonymization typically involves removing all identifiers, which might render the test data less useful for testing specific scenarios. Data tokenization replaces sensitive data with unique tokens but does not necessarily maintain data relationships.

Option B (Data encryption) is not the best fit for this scenario. While data encryption is essential for protecting sensitive data in storage and transit, it would not allow the development team to work with realistic data that retains the same characteristics and relationships required for proper testing and development. Encryption would render the data unreadable without the appropriate decryption keys, making it impractical for functional testing.

Therefore, the best solution to satisfy both the CPO's and the development team's requirements is Data masking (Option C).

QUESTION 160

Which of the following are the BEST ways to implement remote home access to a company's intranet systems if establishing an always-on VPN is not an option? (Select Two)

• A. Install VPN concentrations at home offices

• B. Create NAT on the firewall for intranet systems

• C. Establish SSH access to a jump server

• D. Implement a SSO solution

• E. Enable MFA for intranet systems

Answer explanation

C.

Establish SSH access to a jump server E. Enable MFA for intranet systems

Explanation:

C. Establish SSH access to a jump server: SSH (Secure Shell) access to a jump server allows employees to securely access the company's intranet systems through a bastion host or a jump server. This approach adds an extra layer of security by providing a centralized point of entry into the internal network. Users connect to the jump server first, and from there, they can access the internal systems. SSH is a secure protocol, and using a jump server helps control access and monitor activities effectively.

E. Enable MFA for intranet systems: Multi-Factor Authentication (MFA) adds an additional layer of security to the authentication process. Even if an attacker manages to obtain login credentials, they would still need an additional factor (such as a one-time code sent to the user's phone) to complete the login process. Enabling MFA for intranet systems significantly enhances security and helps prevent unauthorized access in case login credentials are compromised.

Option A (Install VPN concentrations at home offices) suggests setting up VPN concentrators at home offices. This would be similar to an always-on VPN approach but distributed to individual home offices. While it may provide secure remote access, it might not be practical to set up and manage VPN concentrators for each home office.

Option B (Create NAT on the firewall for intranet systems) involves setting up Network Address Translation (NAT) rules on the firewall to allow access to specific internal systems from the internet. While NAT can provide remote access, it lacks the strong security controls provided by VPN or SSH jump servers.

Option D (Implement a SSO solution) is a good security practice for managing user access, but it alone does not address the need for secure remote home access to intranet systems.

Option F (Configure SNMPv3 server and clients) is unrelated to remote home access to intranet systems. SNMP (Simple Network Management Protocol) is primarily used for network monitoring and management, not for providing remote access.