Chapter 8

As a security professional, there is a possibility to have access to sensitive data and assets. What is one item a security professional should understand in order to make informed ethical decisions?

• partnerships

• potential gain

• potential bonus

• laws governing the data

Answer explanation

Ethics in the security profession are extremely important because of the sensitivity of the data and assets. Compliance to government and state

requirements is needed in order to make good judgments.

An organization has implemented a private cloud infrastructure. In order to secure the infrastructure from potential threats. What three tactics can be implemented to protect the private cloud? (Choose three.)

• Hire a consultant.

• Test inbound and outbound traffic.

• Disable ping, probing, and port scanning.

• Update devices with security fixes and patches.

Answer explanation

Chapter 8 - Slides 13 - Private Cloud (WAN) Domain
Organizations can manage threats to the private cloud using the following methods:
1) Disable ping, probing, and port scanning.
2) Implement intrusion detection and prevention systems.
3) Monitor inbound IP traffic anomalies.
4) Update devices with security fixes and patches.
5) Conduct penetration tests post configuration.
6) Test inbound and outbound traffic.
7) Implement a data classification standard.
8) Implement file transfer monitoring and scanning for unknown file type.

Types of information security positions.

• Definers

• Builders

• Monitors

• Security Guards

Answer explanation

Chapter 8 - Slides 56 - Exploring the Cybersecurity Profession
Information security positions can be categorized as::
- definers
- builders
- monitors

A company is attempting to lower the cost in deploying commercial software and is considering a cloud based service. Which cloud based service would be best to host the software?

• Infrastructure as a service (IaaS)

• Platform as a service (PaaS)

• RaaS

• Software as a Service (SaaS)

Answer explanation

Chapter 8 - Slides 15 - Public Cloud Domain

Software as a service (SaaS) provides access to software that is centrally hosted and accessed by users via a web browser on the cloud.

Three different service models exist from which an organization may choose:

1) Software as a service (SaaS) – a subscription-based model that provides access to software that is centrally hosted and accessed by users via a web browser.

2) Platform as a service (PaaS) – provides a platform that allows an organization to develop, run, and manage its applications on the service’s hardware using tools that the service provides.

3) Infrastructure as a service (IaaS) – provides virtualized computing resources such as hardware, software, servers, storage and other infrastructure components over the Internet.

What are two potential threats to applications? (Choose two.)

• data loss

• social engineering

• power interruptions

• unauthorized access

Answer explanation

Chapter 8 - Slides 19 - Application Domain
Threats to applications can include the following:
1) Unauthorized access to data centers, computer rooms, and wiring closets
2) Server downtime for maintenance purposes
3) Network operating system software vulnerability
4) Unauthorized access to systems
5) Data loss
6) Downtime of IT systems for an extended period
7) Client/server or web application development vulnerabilities

What three services does CERT provide? (Choose three.)

• develop attack tools

• resolve software vulnerabilities

• develop tools, products, and methods to analyze vulnerabilities

• develop tools, products, and methods to conduct forensic examinations

Answer explanation

Chapter 8 - Slides 41/42 - Cybersecurity Information Websites
CERT provides multiple services, including:
1) helps to resolve software vulnerabilities

2) develops tools, products, and methods to conduct forensic examinations

3) develops tools, products, and methods to analyze vulnerabilities

4) develops tools, products, and methods to monitor large networks

5) helps organizations determine how effective their security-related practices are

A school administrator is concerned with the disclosure of student information due to a breach. Under which act is student information protected?

• Children’s Internet Protection Act (CIPA)

• Children’s Online Privacy Protection Act (COPPA)

• Family Education Records and Privacy Act (FERPA)

• Health Insurance Portability & Accountability Act (HIPAA)

Answer explanation

Chapter 8 - Slides 34 - Cyber Laws and Liability

The Family Education Records and Privacy Act (FERPA) prohibits the improper disclosure of personal education records

A security professional is asked to perform an analysis of the current state of a company network. What tool would the security professional use to scan the network only for security risks?

• malware

• packet analyzer

• pentest

• vulnerability scanner

Answer explanation

Chapter 8 - Slides 48 - Cybersecurity Weapons (In Notes Pane)

Vulnerability scanners are commonly used to scan for the following vulnerabilities:

1) Use of default passwords or common passwords

2) Missing patches

3) Open ports

4) Misconfiguration of operating systems and software

5) Active IP addresses

A breach occurs in a company that processes credit card information. Which industry specific law governs credit card data protection?

• Electronic Communications Privacy Act (ECPA)

• Gramm-Leach-Bliley Act (GLBA)

• Payment Card Industry Data Security Standard (PCI DSS)

• Sarbanes-Oxley Act (SOX)

Answer explanation

Chapter 8 - Slides 28 - Cyber Laws and Liability
The Payment Card Industry Data Security Standard (PCI DSS) governs how to protect credit card data as merchants and banks exchange transactions.

Why is Kali Linux a popular choice in testing the network security of an organization?

• It can be used to intercept and log network traffic.

• It is a network scanning tool that prioritizes security risks.

• It can be used to test weaknesses by using only malicious software.

• It is an open source Linux security distribution and contains over 300 tools.

Answer explanation

Chapter 8 - Slides 52 - Cybersecurity Weapons
Kali is an open source Linux security distribution. IT professionals use Kali Linux to test the security of their networks. Kali Linux incorporates more than 300 penetration testing and security auditing programs on a Linux platform.