CySA Module 5 - Infrastructure Controls

Peter has just been hired as a network engineer and has recently been examining the company's core router configuration. He notices that the current configuration would allow an incoming packet from the Internet to have a source IP address within the 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16 address space. Which of the following should Peter do?

• Create a rule on the switches that connect to the router to discard any traffic with those addresses in the source IP field.

• Modify the ACL on the router to prevent the traffic from transferring to the internal network from the Internet for those addresses.

• Replace the router with a stateless firewall.

• Nothing. The router configuration is correct.

A solutions architect has designed a new web-based application that will be hosted on a cloud service provider. The web server will be publicly accessible, and the database server it uses will be located in a private subnet that is only accessible from the subnet where the public-facing web server is located. The database server will not be accessible directly from the Internet. Which of the following might the solutions architect implement in order to manage and maintain the database server?

A security engineer has found that an industrial control system used in one of his company's manufacturing plants has a vulnerability that could halt production in the entire plant if exploited. The ICS doesn't need to be accessible from the Internet—it should only be accessed from the control room located within the same building. Which of the following could be implemented as the most effective way to prevent this system from being discovered and exploited?

• Next-generation firewall

• Proxy server

• Air gapping

• Secure admin workstation

A system administrator is looking for solutions to distract any intruders that make it past the company's perimeter protections. This would give the security team more time to respond. Which of the following might the system administrator choose to deploy to meet this goal?

• NIDS

• ACLs

• Honeynet

• VLAN

A system administrator has just been hired at a company that has been experiencing rapid growth in its second year of operation. When the company began, users simply were given permissions for the files or directories to which they needed access by the owners of the files and directories. Which of the following should the system administrator recommend to accommodate this new growth?

• RBAC

• DAC

• TACACS

• NAC

A user is trying to log into a system and receives the error message below. Which of the following types of access control is the organization most likely using? Error: You are not allowed to access this resource. Your access: Confidential. Required: Secret. All attempts to access this resource are logged. Please contact the administrator if you believe this message to be in error.

• DAC

• RuBAC

• ABAC

• MAC

Which of the following terms describes the technology that the security administrator has implemented?

• Sinkhole

• Honeypot

• NIDS

• NIPS

Vince wants to configure a firewall on the perimeter of his organization's network to block all unsolicited incoming traffic. However, he still needs servers behind the firewall to be able to access the Internet for patching purposes. Which of the following types of firewalls might he decide to install?

• Stateless firewall

• Web application firewall

• Stateful firewall

• Portless firewall

Sarita is a network engineer for a growing organization. Her company plans to open branch offices and connect them via encrypted tunnels to the headquarters building via the Internet. Which of the following should Sarita implement?

• Load balancer

• SCADA

• VPN

• ICS

Belva is performing an audit of the e-mail server when she discovers that one of the accounts is sending a lot of e-mails all day that contain attachments. After a bit more research, she finds that the attachments contain extensive proprietary and confidential information. She decides to implement a system that could detect information in these attachments that would violate company policy by being sent outside of the organization. Which of the following systems is she looking to implement?

• Buffer filtering

• DLP

• PoS

• Access point probe