CySA+Sy Test 02

As a penetration tester, Max uses Wireshark to capture all of his testing traffic. Which of the

following is not a reason that Max would capture packets during penetration tests?

• To document the penetration test

• To scan for vulnerabilities

• To gather additional information about systems and services

• To troubleshoot issues encountered when connecting to targets

Answer explanation

Although packet capture can help Max document his penetration test and gather

additional information about remote systems through packet analysis, as well as help troubleshoot connection and other network issues, sniffers aren’t useful for scanning for vulnerabilities on their own.

Rich recently configured new vulnerability scans for his organization’s business intelligence systems. The scans run late at night when users are not present. Rich received complaints from the business intelligence team that the performance burden imposed by the scanning is causing their overnight ETL jobs to run too slowly and they are not completing before business hours. How should Rich handle this situation?

• Rich should inform the team that they need to run the ETL jobs on a different schedule.

• Rich should reconfigure the scans to run during business hours.

• Rich should inform the team that they must resize the hardware to accommodate both

  requirements.

• Rich should work with the team to find a mutually acceptable solution.

Answer explanation

Rich should not attempt to solve this problem on his own or dictate a specific solution.

Instead, he should work with the business intelligence team to find a way to both meet their

business requirements and accomplish the security goals achieved by scanning.

Javier ran a vulnerability scan of a new web application created by developers on his team and received the report shown here. The developers inspected their code carefully and do not believe that the issue exists. They do have a strong understanding of SQL injection issues and have corrected similar vulnerabilities in other applications. What is the most likely scenario in this case?

• Javier misconfigured the scan.

• The code is deficient and requires correction.

• The vulnerability is in a different web application running on the same server.

• The result is a false positive.

Answer explanation

Blind SQL injection vulnerabilities are difficult to detect and are a notorious source of false positive reports. Javier should verify the results of the tests performed by the developers but should be open to the possibility that this is a false positive report, as that is the most likely scenario.

During an incident investigation, Mateo is able to identify the IP address of the system that was used to compromise multiple systems belonging to his company. What can Mateo determine from this information?

• The identity of the attacker

• The country of origin of the attacker

• The attacker’s domain name

• None of the above

Answer explanation

Although it may be tempting to assign blame based on an IP address, attackers frequently

use compromised systems for attacks. Some may also use cloud services and hosting companies where they can purchase virtual machines or other resources using stolen credit cards. Thus, knowing the IP address from which an attack originated will typically not provide

information about an attacker. In some cases, deeper research can identify where an attack

originated, but even then, knowing the identity of an attacker is rarely certain.

After a major compromise involving what appears to be an APT, Jaime needs to conduct a forensic examination of the compromised systems. Which containment method should he recommend to ensure that he can fully investigate the systems that were involved while minimizing the risk to his organization’s other production systems?

• Sandboxing

• Removal

• Isolation

• Segmentation

Answer explanation

Completely removing the systems involved in the compromise will ensure that they cannot impact the organization’s other production systems. Although attackers may be able to detect this change, it provides the best protection possible for the organization’s systems.

Piper is attempting to remediate a security vulnerability and must apply a patch to a production database server. The database administration team is concerned that the patch will disrupt business operations. How should Piper proceed?

• She should deploy the patch immediately on the production system.

• She should wait 60 days to deploy the patch to determine whether bugs are reported.

• She should deploy the patch in a sandbox environment to test it prior to applying it in

  production.

• She should contact the vendor to determine a safe time frame for deploying the patch in

  production.

Answer explanation

Piper should deploy the patch in a sandbox environment and then thoroughly test it prior to releasing it in production. This reduces the risk that the patch will not work well in her environment. Simply asking the vendor or waiting 60 days may identify some issues, but it

does not sufficiently reduce the risk because the patch will not have been tested in her company’s

environment.

Kent ran a vulnerability scan of an internal CRM server that is routinely used by employees, and the scan reported that no services were accessible on the server. Employees continued to use the CRM application over the Web without difficulty during the scan. What is the most likely source of Kent’s result?

• The server requires strong authentication.

• The server uses encryption.

• The scan was run from a different network perspective than user traffic.

• The scanner’s default settings do not check the ports used by the CRM application.

Answer explanation

The most likely scenario is that Kent ran the scan from a network that does not have

access to the CRM server. Even if the server requires strong authentication and/or encryption,

this would not prevent ports from appearing as open on the vulnerability scan. The CRM

server runs over the web, as indicated in the scenario. Therefore, it is most likely using ports

80 and/or 443, which are part of the default settings of any vulnerability scanner.

Steve needs to perform an Nmap scan of a remote network and wants to be as stealthy as

possible. Which of the following nmap commands will provide the stealthiest approach to

his scan?

• nmap -P0 -sT 10.0.10.0/24

• nmap -sT -T0 10.0.10.0/24

• nmap -P0 -sS 10.0.10.0/24

• nmap -P0 -sS -T0 10.0.10.0/24

Answer explanation

Nmap provides multiple scan modes, including a TCP SYN scan, denoted by the -sS flag. This is far stealthier than the full TCP connect scan, which uses the -sT flag. Turning off pings with the -P0

flag helps with stealth, and setting the scan speed using the -T flag to either a 0 for paranoid or a 1 for sneaky will help bypass many IDSs by falling below their detection threshold.

After performing threat hunting, Lakshman determines that it would be appropriate to disable some services on his organization’s database servers. What activity is Lakshman engaging in?

• Establishing a hypothesis

• Gathering evidence

• Reducing the attack surface

• Executable process analysis

Answer explanation

Disabling unnecessary services reduces the attack service by decreasing the number of

possible attack vectors for gaining access to a server.

Jenna is configuring the scanning frequency for her organization’s vulnerability scanning program. Which one of the following is the least important criteria for Jenna to consider?

• Sensitivity of information stored on systems

• Criticality of the business processes handled by systems

• Operating system installed on systems

• Exposure of the system to external networks

Answer explanation

Of the criteria listed, the operating system installed on the systems is the least likely to

have a significant impact on the likelihood and criticality of discovered vulnerabilities. All

operating systems are susceptible to security issues.