SEC+Practice Quiz B6-B26

A security administrator has performed an audit of the organization’s production web servers, and the results have identified banner information leakage, web services running from a privileged account, and inconsistencies with SSL certificates. Which of the following would be the BEST way to resolve these issues?

• A. Server hardening

• B. Multi-factor authentication

• C. Enable HTTPS

• D. Run operating system updates

Answer explanation

: A. Server hardening Many applications and services include secure configuration guides that can assist in hardening the system. These hardening steps will make the system as secure as possible while simultaneously allowing the application to run efficiently. The incorrect answers: B. Multi-factor authentication Although multi-factor authentication is always a good best practice, simply enabling multiple authentication methods would not resolve the issues identified during the audit. C. Enable HTTPS Most web servers will use HTTPS to ensure that network communication is encryption. However, the encrypted network traffic would not correct the issues identified during the audit. D. Run operating system updates Keeping the system up to date is another good best practice, but the issues identified during the audit were not bugs related to the operating systems. All of the issues identified in the audit appear to be related to the configuration of the web server, so any resolution will focus on correcting these configuration issues. More information: SY0-601, Objective 5.2 - Secure Configurations https://professormesser.link/601050203

A shipping company stores information in small regional warehouses around the country. The company keeps an IPS online at each warehouse to watch for suspicious traffic patterns. Which of the following would BEST describe the security control used at the warehouse?

• A. Managerial

• B. Compensating

• C. Physical

• D. Detective

Answer explanation

D. Detective An IPS can detect and record any intrusion attempt. The incorrect answers: A. Managerial Managerial controls would control how people act, such as security policies and standard operating procedures. B. Compensating A compensating control can’t prevent an attack, but it can compensate when an attack occurs. For example, a compensating control would be the re-imaging process or a server restored from backup if an attack had been identified. C. Physical A physical control would block access. For example, a door lock or security guard would be a physical control. More information: SY0-601, Objective 5.1 - Security Controls https://professormesser.link/601050101

The Vice President of Sales has asked the IT team to create daily backups of the sales data. The Vice President is an example of a:

• A. Data owner

• B. Data protection officer

• C. Data steward

• D. Data processor

Answer explanation

: A. Data owner The data owner is accountable for specific data, and is often a senior officer of the organization. The incorrect answers: B. Data protection officer The data protection officer (DPO) is responsible for the organization's data privacy. The DPO commonly sets processes and procedures for maintaining the privacy of data. C. Data steward The data steward manages access rights to the data. In this example, the IT team would be the data steward. D. Data processor The data processor is often a third-party that processes data on behalf of the data controller. More information: SY0-601, Objective 5.5 - Data Roles and Responsibilities https://professormesser.link/601050504

A security engineer is preparing to conduct a penetration test. Part of the preparation involves reading through social media posts for information about a third-party website. Which of the following describes this practice?

• A. Partially known environment

• B. OSINT

• C. Exfiltration

• D. Active footprinting

Answer explanation

B. OSINT OSINT (Open Source Intelligence) describes the process of obtaining information from open sources, such as social media sites, corporate websites, online forums, and other publicly available locations. The incorrect answers: A. Partially known environment A partially known environment test describes how much information the attacker knows about the test. The attacker may have access to some information about the test, but not all information is disclosed. C. Exfiltration Exfiltration describes the theft of data by an attacker. D. Active footprinting Active footprinting would show some evidence of data gathering. For example, performing a ping scan or DNS query wouldn’t exploit a vulnerability, but it would show that someone was gathering information. More information: SY0-601, Objective 1.8 - Reconnaissance https://professormesser.link/601010802

A company would like to automate their response when a virus is detected on company devices. Which of the following would be the BEST way to implement this function?

• A. Active footprinting

• B. IaaS

• C. Vulnerability scan

• D. SOAR

Answer explanation

D. SOAR SOAR (Security Orchestration, Automation, and Response) provides security teams with integration and automation of processes and procedures. The incorrect answers: A. Active footprinting Active footprinting will gather information about a system, but it does not provide any ongoing monitoring or response features. B. IaaS IaaS (Infrastructure as a Service) is a type of cloud service that provides the basic hardware required to install an OS and application. IaaS does not provide ongoing monitoring for security events or automation features. C. Vulnerability scan A vulnerability scan will identify any known vulnerabilities that may be associated with a system. However, a vulnerability scan will not identify real-time infections or automate the response. More information: SY0-601, Objective 4.4 - Security Configurations https://professormesser.link/601040402

A user in the accounting department has received an email from the CEO requesting payment for a recently purchased tablet. However, there doesn't appear to be a purchase order associated with this request. Which of the following would be the MOST likely attack associated with this email?

• A. Spear phishing

• B. Watering hole attack

• C. Invoice scam

• D. Credential harvesting

Answer explanation

C. Invoice scam Invoice scams attempt to take advantage of the miscommunication between different parts of the organization. Fake invoices are submitted by the attacker, and these invoices can sometimes be incorrectly paid without going through the expected verification process. The incorrect answers: A. Spear phishing Spear phishing is a directed attack that attempts to obtain private or personal information. In this example, the result was to obtain payment and not to gather private information. B. Watering hole attack A watering hole attack requires users to visit a central website or location. This example did not require the user to visit any third-party websites. D. Credential harvesting Credential harvesting attempts to transfer password files and authentication information from other computers. More information: SY0-601, Objective 1.1 - Other Social Engineering Attacks https://professormesser.link/601010109

A company has been informed of a hypervisor vulnerability that could allow users on one virtual machine to access resources on another virtual machine. Which of the following would BEST describe this vulnerability?

• A. Containerization

• B. Service integration

• C. SDN

• D. VM escape

Answer explanation

D. VM escape A VM (Virtual Machine) escape is a vulnerability that allows communication between separate VMs. The incorrect answers: A. Containerization Containerization is an application deployment architecture that uses a self-contained group of application code and dependencies. Many separate containers can run on a single system B. Service integration Service Integration and Management (SIAM) allows the integration of many different service providers into a single management system. This simplifies the application management and deployment process when using separate cloud providers. C. SDN SDN (Software-Defined Networking) separates the control plane of networking devices from the data plane. This allows for more automation and dynamic changes to the infrastructure. More information: SY0-601, Objective 2.2 - Virtualization Security https://professormesser.link/601020205

While working from home, users are attending a project meeting over a web conference. When typing in the meeting link, the browser is unexpectedly directed to a different website than the web conference. Users in the office do not have any issues accessing the conference site. Which of the following would be the MOST likely reason for this issue?

• A. Bluejacking

• B. Wireless disassociation

• C. DDoS

• D. DNS poisoning

Answer explanation

D. DNS poisoning An attacker that gains access to a DNS (Domain Name System) server can modify the configuration files and redirect users to a different website. Anyone using a different DNS server may not see any problems with connectivity to the original site. The incorrect answers: A. Bluejacking Bluejacking allows a third-party to send unsolicited messages to another device using Bluetooth. The attack in this example did not use Bluetooth as an attack vector. B. Wireless disassociation Wireless disassociation would cause users on a wireless network to constantly disconnect. Wireless disassociation would not cause a redirection of a website URL (Uniform Resource Locator). C. DDoS DDOS (Distributed Denial of Service) would attack a service from many different devices and cause the service to be unavailable. In this example, the service did not have any availability problems to valid users. More information: SY0-601, Objective 1.4 - DNS Attacks https://professormesser.link/601010409

A company is launching a new internal application that will not start until a username and password is entered and a smart card is plugged into the computer. Which of the following BEST describes this process?

• A. Federation

• B. Accounting

• C. Authentication

• D. Authorization

Answer explanation

C. Authentication The process of proving who you say you are is authentication. In this example, the password and smart card are two factors of authentication, and both reasonably prove that the person logging in is authentic. The incorrect answers: A. Federation Federation provides a way to authenticate and authorize between two different organizations. In this example, the authentication process uses internal information without any type of connection or trust to a third-party. B. Accounting Accounting will document information regarding a user’s session, such as login time, data sent and received, files transferred, and logout time. D. Authorization The authorization process assigns users to resources. This process commonly occurs after the authentication process is complete. More information: SY0-601, Objective 2.4 - Authentication Methods https://professormesser.link/601020401

An online retailer is planning a penetration test as part of their PCI DSS validation. A third-party organization will be performing the test, and the online retailer has provided the Internet-facing IP addresses for their public web servers but no other details. What penetration testing methodology is the online retailer using?

• A. Known environment

• B. Passive footprinting

• C. Partially known environment

• D. Ping scan

Answer explanation

C. Partially known environment A partially known environment test is performed when the attacker knows some information about the victim, but not all information is available. The incorrect answers: A. Known environment A known environment test is performed when the attacker has complete details about the victim’s systems and infrastructure. B. Passive footprinting Passive footprinting is the process of gathering information from publicly available sites, such as social media or corporate websites. D. Ping scan A ping scan is a type of network scan that can identify devices connected to the network. A ping scan is not a type of penetration test. More information: SY0-601, Objective 1.8 - Penetration Testing https://professormesser.link/601010801