SEC+Practice Quiz B27-B48

A recent security audit has discovered email addresses and passwords located in a packet capture. Which of the following did the audit identify?

• Weak encryption

• Improper patch management

• Insecure protocols

• Open ports

Answer explanation

C. Insecure protocols An insecure protocol will transmit information "in the clear," or without any type of encryption or protection. The incorrect answers: A. Weak encryption A weak encryption cipher will appear to protect data, but instead can be commonly circumvented to reveal the plaintext. In this example, the email addresses and passwords were not encrypted and could be viewed in a packet capture. B. Improper patch management Maintaining systems to the latest patch version will protect against vulnerabilities and security issues. Sending information in the clear over the network is not commonly associated with an unpatched system. D. Open ports Open ports are usually associated with a service or application on a device. An open port is not commonly associated with any encryption or protected network communication. More information: SY0-601, Objective 1.6 - Vulnerability Types https://professormesser.link/601010601

A company has connected their wireless access points and have enabled WPS. Which of the following security issues would be associated with this configuration?

A. Brute force ❍ B. Client hijacking ❍ C. Cryptographic vulnerability ❍ D. Spoofing

• A. Brute force

• B. Client hijacking

• C. Cryptographic vulnerability

• D. Spoofing

Answer explanation

A. Brute force A WPS personal identification number (PIN) was designed to have only 11,000 possible iterations, making a brute force attack possible if the access point doesn’t provide any protection against multiple guesses. The incorrect answers: B. Client hijacking The processes of adding a device through WPS occurs well before any app or client is used. C. Cryptographic vulnerability The vulnerability in WPS is based on a limited number of PIN options and not a cryptographic shortcoming. D. Spoofing Spoofing an existing device would not provide access to a WPS-enabled network. More information: SY0-601, Objective 3.4 - Wireless Authentication Methods https://professormesser.link/601030402

An organization has traditionally purchased insurance to cover a ransomware attack, but the costs of maintaining the policy have increased above the acceptable budget. The company has now decided to cancel the insurance policies and deal with ransomware issues internally. Which of the following would best describe this action?

• A. Mitigation

• B. Acceptance

• C. Transference

• D. Risk-avoidance

Answer explanation

B. Acceptance Risk acceptance is a business decision that places the responsibility of the risky activity on the organization itself. The incorrect answers: A. Mitigation If the organization was to purchase additional backup facilities and update their backup processes to include offline backup storage, they would be mitigating the risk of a ransomware infection. C. Transference Purchasing insurance to cover a risky activity is a common method of transferring risk from the organization to the insurance company. D. Risk-avoidance To avoid the risk of ransomware, the organization would need to completely disconnect from the Internet and disable all methods that ransomware might use to infect a system. This risk response technique would most likely not apply to ransomware. More information: SY0-601, Objective 5.4 - Risk Management Types https://professormesser.link/601050401

Which of these threat actors would be the MOST likely to deface a website to promote a political agenda?

• A. Organized crime

• B. Nation state

• C. Hacktivist

• D. Competitor

Answer explanation

C. Hacktivist A hacktivist often has a political statement to make, and their hacking efforts would commonly result in a public display of that information. The incorrect answers: A. Organized crime Organized crime is usually motivated by money. An organized crime group is more interested in stealing information than defacing sites. B. Nation state Nation states are highly sophisticated hackers, and their efforts are usually focused on obtaining confidential government information or disrupting governmental operations. D. Competitor A competitor may be interested in making another company look bad, but the reason for the denial of services is not commonly based on a political agenda. More information: SY0-601, Objective 1.5- Threat Actors https://professormesser.link/601010501

An IPS report shows a series of exploit attempts were made against externally facing web servers. The system administrator of the web servers has identified a number of unusual log entries on each system. Which of the following would be the NEXT step in the incident response process?

• A. Check the IPS logs for any other potential attacks

• B. Create a plan for removing malware from the web servers

• C. Disable any breached user accounts

• D. Disconnect the web servers from the network

Answer explanation

D. Disconnect the web servers from the network The unusual log entries on the web server indicate that the system may have been exploited. In that situation, the servers should be isolated to prevent access to or from those systems. The incorrect answers: A. Check the IPS logs for any other potential attacks Before looking for additional exploits, the devices showing a potential exploit should be isolated and contained. B. Create a plan for removing malware from the web servers The recovery process should occur after the systems have been isolated and contained. C. Disable any breached user accounts This is part of the recovery process, and it should occur after isolation and containment of the exploited servers. More information: SY0-601, Objective 4.2 - Incident Response Process https://professormesser.link/601040201

A security administrator is viewing the logs on a laptop in the shipping and receiving department and identifies these events:

8:55:30 AM | D:\Downloads\ChangeLog-5.0.4.scr | Quarantine Success 9:22:54 AM | C:\Program Files\Photo Viewer\ViewerBase.dll | Quarantine Failure 9:44:05 AM | C:\Sales\Sample32.dat | Quarantine Success

Which of the following would BEST describe the circumstances surrounding these events?

• A. The antivirus application identified three viruses and quarantined two viruses

• B. The host-based firewall blocked two traffic flows

• C. A host-based whitelist has blocked two applications from executing

• D. A network-based IPS has identified two known vulnerabilities

Answer explanation

A. The antivirus application identified three viruses and quarantined two viruses The logs are showing the name of files on the local device and a quarantine disposition, which indicates that two of the files were moved (quarantined) to a designated area of the drive. This will prevent the malicious files from executing and will safely store the files for any future investigation. The second file in the list failed the quarantine process, and was most likely because the library was already in use by the operating system and could not be moved. The incorrect answers: B. The host-based firewall blocked two traffic flows A host-based firewall will allow or deny traffic flows based on IP address, port number, application, or other criteria. A host-based firewall does not block traffic flows based on the name of an existing file, and the firewall process would not quarantine or move files to other folders. 8:55:30 AM | D:\Downloads\ChangeLog-5.0.4.scr | Quarantine Success 9:22:54 AM | C:\Program Files\Photo Viewer\ViewerBase.dll | Quarantine Failure 9:44:05 AM | C:\Sales\Sample32.dat | Quarantine Success Practice Exam B - Answers 197 C. A host-based whitelist has blocked two applications from executing The “quarantine” disposition refers to a file that has been moved from one location to another. A whitelist function would simply stop the application from executing without changing the location of an application file. D. A network-based IPS has identified two known vulnerabilities The logs from a network-based IPS (Intrusion Prevention System) would not commonly be located on a user’s laptop, and those logs would display allow or deny dispositions based on the name of a known vulnerability. A network-based IPS would also not commonly move (quarantine) files on an end-user’s computer. More information: SY0-601, Objective 4.3 - Log Files https://professormesser.link/601040303

. In the past, an organization has relied on the curated Apple App Store to avoid issues associated with malware and insecure applications. However, the IT department has discovered an iPhone in the shipping department that includes applications that are not available on the Apple App Store. How did the shipping department user install these apps on their mobile device?

A. Sideloading ❍ B. MMS install ❍ C. OTA updates ❍ D. Tethering

• A. Sideloading

• B. MMS install

• C. OTA updates

• D. Tethering

Answer explanation

A. Sideloading If Apple’s iOS has been circumvented using jailbreaking, then apps can be installed without using the Apple App Store. This installation process that circumvents the App Store is called sideloading. The incorrect answers: B. MMS install Text messages that prompt to install an application will link to the App Store version of the application. C. OTA updates OTA (Over the Air) updates are commonly provided from the carrier and are not part of mobile app installations. D. Tethering Tethering uses a mobile phone as a communications medium to the Internet, and it does not have any relationship to the apps that are installed on the mobile device. More information: SY0-601, Objective 3.5 - Mobile Device Enforcement https://professormesser.link/601030504

A security administrator is designing a storage array that would maintain an exact replica of all data without striping. The array needs to operate normally if a single drive was to fail. Which of the following would be the BEST choice for this storage system?

• A. RAID 1

• B. RAID 5

• C. RAID 0

• D. RAID 10

Answer explanation

A. RAID 1 RAID (Redundant Array of Independent Disks) type 1 maintains a mirror (or exact duplicate) of data across multiple drives. If a single drive was to fail, the mirror would continue to operate with the redundant data. The incorrect answers: B. RAID 5 RAID 5 provides redundancy through striping with parity. Although RAID 5 arrays would continue to operate through a single drive failure, the data is not replicated across drives. C. RAID 0 RAID 0 is a striped storage system with no parity, and a single drive failure does not maintain uptime or any redundancy of data. D. RAID 10 RAID 10 or RAID 1+0 maintains mirrored drives that contain striped data. More information: SY0-601, Objective 2.5 - Disk Redundancy https://professormesser.link/601020501

A transportation company has moved their reservation system to a cloud-based infrastructure. The security manager would like to monitor data transfers, identify potential threats, and ensure that all data transfers are encrypted. Which of the following would be the BEST choice for these requirements?

• VPN

• CASB

• NGFW

• DLP

Answer explanation

B. CASB A CASB (Cloud Access Security Broker) is used to implement and manage security policies when working in a cloud-based environment. The incorrect answers: A. VPN A VPN (Virtual Private Network) can provide an encrypted tunnel for data transfers, but it doesn't provide any monitoring or threat identification. C. NGFW An NGFW (Next-Generation Firewall) is a useful security tool, but it doesn't provide any cloud-based security policy monitoring. D. DLP DLP (Data Loss Prevention) can monitor data to prevent the transfer of sensitive information, but it doesn't identify threats or force the transfer of encrypted data. More information: SY0-601, Objective 3.6 - Cloud Security Solutions https://professormesser.link/601030605

Which of the following control types is associated with a bollard?

• A. Physical

• B. Corrective

• C. Detective

• D. Compensating

Answer explanation

A. Physical A physical control includes real-world security features such as fences, locks, or bollards. The incorrect answers: B. Corrective A corrective control is designed to mitigate any potential damage. A bollard does not provide any mitigation functions. C. Detective A detective security control may not prevent access, but it can identify and record a security event. A bollard does not identify or record security events. D. Compensating A compensating attack doesn't provide any prevention, but it can restore access through other means. A bollard does not have any method of compensating for a potential attack. More information: SY0-601, Objective 5.1 - Security Controls https://professormesser.link/601050101