SEC+ Quiz1

You've hired a third-party to gather information about your company's servers and data. The third-party will not have direct access to your internal network but can gather information from any other source. Which of the following would BEST describe this approach?

• Backdoor testing

• Passive footprinting

• OS fingerprinting

• Partially known environment

Answer explanation

Passive footprinting focuses on learning as much information from open sources such as social media, corporate websites, and business organizations.

Which of these protocols use TLS to provide secure communication? (Select TWO)

• HTTPS

• FTPS

• SNMPv2

• DNSSEC

• SSHTLS

Answer explanation

TLS (Transport Layer Security) is a cryptographic protocol used to encrypt network communication. HTTPS is the Hypertext Transfer Protocol over TLS, and FTPS is the File Transfer Protocol over TLS. An earlier version of TLS is SSL (Secure Sockets Layer). Although we don’t commonly see SSL in use any longer, you may see TLS communication referenced as SSL.

Which of these threat actors would be MOST likely to attack systems for direct financial gain?

• Organized crime

• Hacktivist

• Nation state

• Competitor

Answer explanation

An organized crime actor is motivated by money, and their hacking objectives are usually based around objectives that can be easily exchanged for financial capital.

A security incident has occurred on a file server. Which of the following data sources should be gathered to address file storage volatility? (Select TWO)

• Partition data

• Kernel statistics

• ROM data

• Temporary file systems

• Process table

Answer explanation

Both temporary file system data and partition data are part of the file storage subsystem.

An IPS at your company has found a sharp increase in traffic from all-in-one printers. After researching, your security team has found a vulnerability associated with these devices that allows the device to be remotely controlled by a third-party. Which category would BEST describe these devices?

• IoT

• RTOS

• MFD

• SoC

Answer explanation

An all-in-one printer that can print, scan, and fax is often categorized as an MFD (Multifunction Device).

Which of the following standards provides information on privacy and managing PII?

• ISO 31000

• ISO 27002

• ISO 27701

• ISO 27001

Answer explanation

The ISO (International Organization for Standardization) 27701 standard extends the ISO 27001 and 27002 standards to include detailed management of PII (Personally Identifiable Information) and data privacy

Elizabeth, a security administrator, is concerned about the potential for data exfiltration using external storage drives. Which of the following would be the BEST way to prevent this method of data exfiltration?

• Create an operating system security policy to prevent the use of removable media

• Monitor removable media usage in host-based firewall logs

• Only allow applications that do not use removable media

• Define a removable media block rule in the UTM

Answer explanation

Removable media uses hot-pluggable interfaces such as USB to connect storage drives. A security policy in the operating system can prevent any files from being written to a removable drive.

A CISO (Chief Information Security Officer) would like to decrease the response time when addressing security incidents. Unfortunately, the company does not have the budget to hire additional security engineers. Which of the following would assist the CISO with this requirement?

• ISO 27701

• PKI

• IaaS

• SOAR

Answer explanation

SOAR (Security Orchestration, Automation, and Response) is designed to make security teams more effective by automating processes and integrating third-party security tools.

An insurance company has created a set of policies to handle data breaches. The security team has been given this set of requirements based on these policies: Access records from all devices must be saved and archived; Any data access outside of normal working hours must be immediately reported; Data access must only occur inside of the country; Access logs and audit reports must be created from a single database. Which of the following should be implemented by the security team to meet these requirements?

• Enable time-of-day restrictions on the authentication server

• Consolidate all logs on a SIEM

• Add additional password complexity for accounts that access data

• Restrict login access by IP address and GPS location

• Require government-issued identification during the onboarding process

Answer explanation

Adding location-based policies will prevent direct data access from outside of the country. Saving log information from all devices and creating audit reports from a single database can be implemented through the use of a SIEM (Security Information and Event Manager). Adding a check for the time-of-day will report any access that occurs during non-working hours.

Rodney, a security engineer, is viewing this record from the firewall logs: "UTC 04/05/2018 03:09:15809 AV Gateway Alert 136.127.92.171 80 -> 10.16.10.14 60818 Gateway Anti-Virus Alert: xPACK.A_7854 (Trojan) blocked." Which of the following can be observed from this log information?

• A. The victim's IP address is 136.127.92.171

• B. A download was blocked from a web server

• C. A botnet DDoS attack was blocked

• D. The Trojan was blocked, but the file was not

Answer explanation

A download was blocked from a web server A traffic flow from a web server port number (80) to a device port (60818) indicates that this traffic flow originated on port 80 of the web server. A file download is one of the most common ways to deliver a Trojan, and this log entry shows that the file containing the XPACK.A_7854 Trojan was blocked.