CySA+Sy Test 03

Ty is reviewing the scan report for a Windows system joined to his organization’s domain and finds the vulnerability shown here. What should be Ty’s most significant concern related to this vulnerability?

• The presence of this vulnerability indicates that an attacker may have compromised his

  network.

• The presence of this vulnerability indicates a misconfiguration on the target server.

• The presence of this vulnerability indicates that the domain security policy may be lacking

  appropriate controls.

• The presence of this vulnerability indicates a critical flaw on the target server that must

  be addressed immediately.

Answer explanation

The presence of this vulnerability does indicate a misconfiguration on the targeted server,

but that is not the most significant concern that Ty should have. Rather, he should be alarmed

that the domain security policy does not prevent this configuration and should know that

many other systems on the network may be affected. This vulnerability is not an indicator of

an active compromise and does not rise to the level of a critical flaw.

Heidi runs a vulnerability scan of the management interface of her organization’s virtualization platform and finds the severity 1 vulnerability shown here. What circumstance, if present, should increase the severity level of this vulnerability to Heidi?

• Lack of encryption

• Missing security patch

• Exposure to external networks

• Out-of-date antivirus signatures

Answer explanation

This vulnerability has a low severity, but that could be dramatically increased if the

management interface is exposed to external networks. If that were the case, it is possible that an attacker on a remote network would be able to eavesdrop on administrative connections and steal user credentials. Out-of-date antivirus definitions and missing security patches may also be severe vulnerabilities, but they do not increase the severity of this specific

vulnerability. The lack of encryption is already known because of the nature of this vulnerability, so confirming that fact would not change the severity assessment.

Rowan ran a port scan against a network switch located on her organization’s internal network and discovered the results shown here. She ran the scan from her workstation on the employee VLAN. Which one of the following results should be of greatest concern to her?

• Port 22

• Port 23

• Port 80

• Ports 8192 to 8194

Answer explanation

Both ports 22 and 23 should be of concern to Rowan because they indicate that the network switch is accepting administrative connections from a general-use network. Instead, the switch should accept administrative connections only from a network management VLAN. Of these two results, port 23 should be of the greatest concern because it indicates that the switch is allowing unencrypted telnet connections that may be subject to eavesdropping. The results from ports 80 and 8192 to 8194 are of lesser concern because they are being filtered by a firewall.

Evan is troubleshooting a vulnerability scan issue on his network. He is conducting an external scan of a website located on the web server shown in the diagram. After checking the web server logs, he saw no sign of the scan requests. Which one of the following causes is the least likely issue for him to troubleshoot?

• The scans are being blocked by an intrusion prevention system.

• The scans are being blocked by a rule within the web server application.

• The scans are being blocked by a network firewall.

• The scans are being blocked by a host firewall.

Answer explanation

All of the scenarios described here could result in failed vulnerability scans and are plausible on this network. However, the fact that the web server logs do not show any denied

requests indicates that the issue is not with the web server application itself. If this were the

case, Evan would see evidence of it in the web server logs.

Sam is looking for evidence of software that was installed on a Windows system. He believes that the programs were deleted and that the suspect used both registry and log cleaners to hide evidence. What Windows feature can’t he use to find evidence of the use of these programs?

• The MFT

• Volume shadow copies

• The shim (application compatibility) cache

• Prefetch files

Answer explanation

The shim cache is used by Windows to track scripts and programs that need specialized

compatibility settings. It is stored in the registry at shutdown, which means that a thorough

registry cleanup will remove program references from it. The master file table (MFT), volume

shadow copies, and prefetch files can all contain evidence of deleted applications.

Mila is evaluating the security of an application developed within her organization. She would like to assess the application’s security by supplying it with invalid inputs. What technique is Mila planning to use?

• Fault injection

• Stress testing

• Mutation testing

• Fuzz testing

Answer explanation

Fuzz testing involves sending invalid or random data to an application to test its ability to handle unexpected data. Fault injection directly inserts faults into error-handling paths, particularly error-handling mechanisms that are rarely used or might otherwise be missed during normal testing. Mutation testing is related to fuzzing and fault injection, but rather than changing the inputs to the program or introducing faults to it, mutation testing makes small modifications to the program itself. Stress testing is a performance test that ensures applications and the systems that support them can stand up to the full production load.

A port scan conducted during a security assessment shows the following results. What type of device has most likely been scanned?

--View Image--

• A wireless access point

• A server

• A printer

• A switch

Answer explanation

Although TCP ports 21, 23, 80, and 443 are all common ports, 515 and 9100 are commonly associated with printers

Which of the following is not one of the major categories of security event indicators

described by NIST 800-61?

• Alerts from IDS, IPS, SIEM, AV, and other security systems

• Logs generated by systems, services, and applications

• Exploit developers

• Internal and external sources

Answer explanation

NIST identifies four major categories of security event indicators: alerts, logs, publicly

available information, and people both inside and outside the organization. Exploiting

developers may provide some information but is not a primary source of security event

information.

During an nmap scan of a network, Charles receives the following response from nmap:

Starting Nmap 7.80 ( https://nmap.org )

Nmap done: 256 IP addresses (0 hosts up) scanned in 29.74 seconds

What can Charles deduce about the network segment from these results?

• There are no active hosts in the network segment.

• All hosts on the network segment are firewalled.

• The scan was misconfigured.

• Charles cannot determine if there are hosts on the network segment from this scan.

Answer explanation

A host that is not running any services or that has a firewall enabled that prevents

responses can be invisible to nmap. Charles cannot determine whether there are hosts on this

network segment and may want to use other means such as ARP queries, DHCP logs, and

other network layer checks to determine whether there are systems on the network.

Oskar is designing a vulnerability management program for his company, a hosted service

provider. He would like to check all relevant documents for customer requirements that

may affect his scanning. Which one of the following documents is least likely to contain this

information?

• BPA

• SLA

• MOU

• BIA

Answer explanation

The business impact assessment (BIA) is an internal document used to identify and

assess risks. It is unlikely to contain customer requirements. Service level agreements (SLAs),

business partner agreements (BPAs), and memorandums of understanding (MOUs) are much more likely to contain this information.