Assessment Test

The organization that Chris works for has disabled automatic updates. What is the most common reason for disabling automatic updates for organizational systems?

• To avoid disruption of the work process for office workers

• To prevent security breaches due to malicious patches and updates

• To avoid issues with problematic patches and updates

• All of the above

Answer explanation

Key Phrase: "Disabling automatic updates"

Explanation: Disabling automatic updates is typically done to avoid issues caused by problematic or faulty patches.
Why others are wrong:
A: While disruption is a concern, it’s not the main reason for disabling updates.
B: Malicious patches are extremely rare.
D: Not all of the above reasons are typical.

Which of the following is the least volatile according to the forensic order of volatility?

• The system's routing table

• Logs

• Temp files

• CPU registers

Answer explanation

Key Phrase: "Least volatile"

Explanation: Logs are generally stored on disk, making them less volatile than memory-related data.
From least to most volatile:
1. Logs

2. 2. Temp files

3. 3. System's routing table

• 4. CPU registers

Ed wants to trick a user into connecting to his evil twin access point (AP). What type of attack should he conduct to increase his chances of the user connecting to it?

• A disassociation attack

• An application denial-of-service attack

• A known plain-text attack

• A network denial-of-service attack

Answer explanation

Key Phrase: "Trick user into connecting to evil twin"

Explanation: A disassociation attack forces the target device to disconnect from its current AP, making it more likely to connect to the attacker's AP.
Why others are wrong:
B: DoS attacks do not typically cause a switch to another AP.
C: Known-plaintext and cryptographic attacks are irrelevant to this situation.
D: A DoS attack targets availability, not association.

What term is used to describe wireless site surveys that show the relative power of access points on a diagram of the building or facility?

• Signal surveys

• db maps

• AP topologies

• Heat maps

Answer explanation

Key Phrase: "Wireless site surveys, relative power, diagram"

Explanation: Heatmaps show signal strength on a visual diagram, highlighting areas of good and poor coverage.
Why others are wrong:
A: Signal surveys are similar but don’t focus specifically on visual representation.
B: db maps and AP topologies are not standard terms for this purpose.

What hardware device is used to create the hardware root of trust for modern desktops and laptops?

• System memory

• HSM

• The CPU

• The TPM

Answer explanation

Key Phrase: "Hardware root of trust"

Explanation: The TPM is a secure hardware chip used to establish a root of trust and safeguard cryptographic keys.
Why others are wrong:
A: System memory is not designed to provide a root of trust.
B: HSMs are used for cryptographic operations, not establishing a root of trust in PCs.
C: The CPU doesn’t provide the same level of security as the TPM for this purpose.

Angela wants to prevent users in her organization from changing their passwords repeatedly after they have been changed, so they cannot reuse their current password. What two password security settings does she need to implement to make this occur?

• Set a password history and a minimum password age.

• Set a password history and a complexity setting.

• Set a password minimum and maximum age.

• Set password complexity and maximum age.

Answer explanation

Key Phrase: "Prevent users from reusing current password"

Explanation: The password history prevents users from reusing old passwords, and the minimum age prevents users from resetting their password too quickly.
Why others are wrong:
B: Password complexity settings don’t address reusing passwords.
C: Minimum and maximum age is unrelated to preventing reuse.
D: Complexity and age settings don’t directly prevent reuse.

Chris wants to establish a backup site that is fully ready to take over for full operations for his organization at any time. What type of site should he set up?

• A cold site

• A clone site

• A hot site

• A ready site

Answer explanation

Key Phrase: "Fully ready backup site"

Explanation: A hot site is a fully equipped backup site ready to take over operations immediately.
Why others are wrong:
A: A cold site is basic and requires setup before it becomes operational.
B: A clone site is not a common industry term.
D: "Ready site" is not a standard term.

Which of the following is NOT a common constraint of embedded and specialized systems?

• Computational power

• Overly complex firewall settings

• Lack of network connectivity

• Inability to patch

Answer explanation

Key Phrase: "Constraints of embedded systems"

Explanation: Embedded systems typically have fewer resources and may lack advanced security like complex firewalls, but this isn’t a major constraint.
Why others are wrong:
A: Embedded systems are often resource-constrained in terms of CPU and memory.
C: Network connectivity is often limited in embedded systems.
D: Patching limitations are a key constraint for embedded systems.

Gary is reviewing his system's SSH logs and sees logins for the user named “Gary” with passwords like password1, password2, ... PassworD. What type of attack has Gary discovered?

• A dictionary attack

• A rainbow table attack

• A pass-the-hash attack

• • A password spraying attack

Answer explanation

Key Phrase: "SSH logs, repetitive password attempts"

Explanation: A dictionary attack tries multiple passwords, often based on common patterns like password1, password2, etc.
Why others are wrong:
B: Rainbow tables are used to crack hashed passwords, not for repeated login attempts.
C: A pass-the-hash attack uses a captured hash, not a direct password attempt.
D: A password spraying attack targets many accounts with the same password.

Kathleen wants to set up a system that allows access into a high-security zone from a low-security zone. What type of solution should she configure?

• VDI

• A container

• A screened subnet

• A jump server

Answer explanation

Key Phrase: "Access from low-security to high-security zone"

Explanation: A jump server is a controlled point of entry between different security zones.
Why others are wrong:
A: VDI is for virtual desktop environments, not security zone access.
B: A container is for applications, not for zone-to-zone access.
C: A screened subnet is a zone that’s exposed, but it’s not specifically for high-to-low security access.