SEC+PracticeQuiz A66-86

A security administrator has been asked to respond to a potential security breach of the company’s databases, and they need to gather the most volatile data before powering down the database servers. In which order should they collect this information?

• A. CPU registers, temporary files, memory, remote monitoring data

• B. Memory, CPU registers, remote monitoring data, temporary files

• C. Memory, CPU registers, temporary files, remote monitoring data

• D. CPU registers, memory, temporary files, remote monitoring data

Answer explanation

D. CPU registers, memory, temporary files, remote monitoring data The most volatile data disappears quickly, so data such as the CPU registers and information in memory will be lost before temporary files and remote monitoring data are no longer available. The incorrect answers: A. CPU registers, temporary files, memory, remote monitoring data Memory is more volatile than temporary files. B. Memory, CPU registers, remote monitoring data, temporary files CPU registers are more volatile than memory, and temporary files are more volatile than remote monitoring data. C. Memory, CPU registers, temporary files, remote monitoring data CPU registers are more volatile than information in memory. More information: SY0-601, Objective 4.5 - Forensics Data Acquisition https://professormesser.link/601040502

A Linux administrator is downloading an updated version of her Linux distribution. The download site shows a link to the ISO and a SHA256 hash value. Which of these would describe the use of this hash value?

• Verifies that the file was not corrupted during the file transfer

• Provides a key for decrypting the ISO after download

• Authenticates the site as an official ISO distribution site

• Confirms that the file does not contain any malware

Answer explanation

A. Verifies that the file was not corrupted during the file transfer Once the file is downloaded, the administrator can calculate the file’s SHA256 hash and confirm that it matches the value on the website. The incorrect answers: B. Provides a key for decrypting the ISO after download ISO files containing public information are usually distributed without any encryption, and a hash value would not commonly be used as a decryption key. C. Authenticates the site as an official ISO distribution site Although it’s important to download files from known good sites, providing a hash value on a site would not provide any information about the site’s authentication. D. Confirms that the file does not contain any malware A hash value doesn’t inherently provide any protection against malware. More information: SY0-601, Objective 2.8 - Hashing and Digital Signatures https://professormesser.link/601020803

A company's security policy requires that login access should only be available if a person is physically within the same building as the server. Which of the following would be the BEST way to provide this requirement?

• TOTP

• Biometric scanner

• PIN

• SMS

Answer explanation

B. Biometric scanner A biometric scanner would require a person to be physically present to verify authentication. The incorrect answers: A. TOTP A TOTP (Time-based One-Time Password) generator may be associated with a single person, but the TOTP code does not guarantee that a person is physically present. C. PIN Although a PIN (Personal Identification Number) can be used as an authentication factor, the use of the PIN does not guarantee that a person is physically present. D. SMS SMS messages are commonly used as authentication factors. However, the use of a mobile device to receive the SMS message does not guarantee that the owner of the mobile device is physically present. More information: SY0-601, Objective 2.7 - Physical Security Controls https://professormesser.link/601020701

Your development team has installed a new application and database to a cloud service. After running a vulnerability scanner on the application instance, you find that the database is available for anyone to query without providing any authentication. Which of these vulnerabilities is MOST associated with this issue?

• Improper error handling

• Open permissions

• Race Condition

• Memory Leak

Answer explanation

B. Open permissions Just like your local systems, proper permissions and security controls are also required when information is added to a cloud-based system. If any of your systems leave an open door, your data may be accessible by anyone on the Internet. The incorrect answers: A. Improper error handling This issue wasn’t associated with any error messages, so this wouldn’t be categorized as a problem with error handling. C. Race condition If two processes occur simultaneously without any prior consideration, bad things could happen. In this example, a single vulnerability scan has identified the issue and other processes do not appear to be involved. D. Memory leak An application with a memory leak will gradually use more and more memory until the system or application crashes. The issue in this question was related to permissions and not available resources. More information: SY0-601, Objective 1.6 - Vulnerability Types https://professormesser.link/601010601

Employees of an organization have received an email offering a cash bonus for completing an internal training course. The link in the email requires users to login with their Windows Domain credentials, but the link appears to be located on an external server. Which of the following would BEST describe this email?

• Whaling

• Vishing

• Smishing

• Phishing

Answer explanation

D. Phishing Phishing is the process of manipulating a victim to disclose personal or private information. An email asking for login details from a server not under the control of the company would describe a phishing attempt. The incorrect answers: A. Whaling Whaling is phishing targeted towards individuals at a higher level of an organization. These persons are usually in upper management or have access to the financial operations of the company. B. Vishing Vishing, or voice phishing, is using voice communication for the phishing process. This phishing attempt used an email message, so it would not be categorized as vishing. C. Smishing Smishing, or SMS phishing, is an attacker using SMS or text messaging when phishing. Smishing text messages often include a link to a server where personal information or login credentials may be requested by the attacker. More information: SY0-601, Objective 1.1 - Phishing https://professormesser.link/601010101

Which of the following risk management strategies would include the purchase and installation of an NGFW?

• Transference

• Mitigation

• Acceptance

• Risk-Avoidance

Answer explanation

B. Mitigation Mitigation is a strategy that decreases the threat level. This is commonly done through the use of additional security systems and monitoring, such as an NGFW (Next-Generation Firewall). The incorrect answers: A. Transference Transference would move the risk from one entity to another. Adding an NGFW would not transfer any risk to another party. C. Acceptance The acceptance of risk is a position where the owner understands the risk and has decided to accept the potential results. D. Risk-avoidance With risk-avoidance, the owner of the risk decides to stop participating in a high-risk activity. This effectively avoids the risky activity and prevents any future issues. More information: SY0-601, Objective 5.6 - Risk Management Types https://professormesser.link/601050401

Which of the following would be the BEST way to confirm the secure baseline of a deployed application instance?

• A. Compare the production application to the sandbox

• Perform an integrity measurement

• Compare the production application to the previous version

• Perform QA testing on the application instance

Answer explanation

B. Perform an integrity measurement An integrity measurement is designed to check for the secure baseline of firewall settings, patch levels, operating system versions, and any other security components associated with the application. These secure baselines may vary between different application versions. The incorrect answers: A. Compare the production application to the sandbox A sandbox is commonly used as a development environment. Security baselines in a production environment can be quite different when compared to the code in a sandbox. C. Compare the production application to the previous version The newer version of an application may have very different security requirements than previous versions. D. Perform QA testing on the application instance QA (Quality Assurance) testing is commonly used for finding bugs and verifying application functionality. The primary task of QA is not generally associated with verifying security baselines. More information: SY0-601, Objective 2.3 - Secure Deployments https://professormesser.link/601020301

A member of the accounting team was out of the office for two weeks, and an important financial transfer was delayed until they returned. Which of the following would have prevented this delay?

• Split knowledge

• Least privilege

• Job rotation

• Dual Control

Answer explanation

C. Job rotation Job rotation moves employees through different job roles as part of their normal work environment. This policy limits the potential for fraud and allows others to cover responsibilities if someone is out of the office. The incorrect answers: A. Split knowledge The use of split knowledge limits the information that any one person would know. In this example, having knowledge of part of the process would not have helped with processing the financial transfer. B. Least privilege Least privilege is a security policy that limits the rights and permissions of a user to only those tasks required for their job role. In this example, having properly configured privileges would not have provided any contingency for this delayed transaction. D. Dual control With dual control, two persons must be present to perform a business function. In this example, one of the employees is out of the office and dual control would not be possible.More information: SY0-601, Objective 5.3 - Personnel Security https://professormesser.link/60105030

. A security analyst has identified a number of sessions from a single IP address with a TTL equal to zero. One of the sessions has a destination of the Internet firewall, and a session immediately after has a destination of your DMZ server. Which of the following BEST describes this log information?

• A. Someone is performing a vulnerability scan against the firewall and DMZ server

• Users are performing DNS lookups

• C. A remote user is grabbing banners of the firewall and DMZ server

• D. Someone is performing a traceroute to the DMZ server

Answer explanation

D. Someone is performing a traceroute to the DMZ server A traceroute maps each hop by slowly incrementing the TTL (Time to Live) value during each request. When the TTL reaches zero, the receiving router drops the packet and sends an ICMP (Internet Control Message Protocol) TTL Exceeded message back to the original station. The incorrect answers: A. Someone is performing a vulnerability scan against the firewall and DMZ server Vulnerability scans are usually very specific requests, and they won’t get to their destination if the TTL is zero. The question did not provide any information that would indicate an active vulnerability scan. B. Users are performing DNS lookups Properly working DNS (Domain Name System) responses would not have a TTL of zero, and nothing in the question indicated information that would commonly be included in a DNS query. C. A remote user is grabbing banners of the firewall and DMZ server Banners can provide useful reconnaissance information about a service, but the TTL of zero and the lack of connection to a specific service would not indicate a banner grabbing session. More information: SY0-601, Objective 4.1 - Reconnaissance Tools Part 1 https://professormesser.link/601040101 106 Practice Exam A - Answers A67. An attacker has sent more information than expected in a single A

An attacker has sent more information than expected in a single API call, and this has allowed the execution of arbitrary code. Which of the following would BEST describe this attack?

• A. Buffer overflow

• B. Replay attack

• C. Session hijacking

• D. DDoS

Answer explanation

A. Buffer overflow The results of a buffer overflow can cause random results, but sometimes the actions can be repeatable and controlled. In the best possible case for the hacker, a buffer overflow can be manipulated to execute code on the remote device. The incorrect answers: B. Replay attack A replay attack does not require the sending of more information than expected, and often a replay attack consists of normal traffic and expected application input. C. Session hijacking Session hijacking doesn't require any data overflows, and commonly the hijack occurs without any unusual input. D. DDoS A DDoS (Distributed Denial of Service) renders a service unavailable, and it involves the input of many devices to operate. A DDoS would not require sending more information than expected, and it rarely results in the execution of arbitrary code. More information: SY0-601, Objective 1.3 - Buffer Overflows https://professormesser.link/601010304