Lesson 11

Which of the following BEST explains why Telnet should be replaced with SSH for device administration across a routed network?

• Telnet uses a non-standard port that firewalls commonly block.

• Telnet transmits credentials and session data in plaintext.

• SSH consumes less bandwidth than Telnet for the same tasks.

• SSH does not require user authentication by default.

A security engineer is configuring a web server to support TLS. Which item MUST the engineer install before clients can establish an HTTPS session on port 443?

• A valid CRL distribution point

• A public root certificate in the server trust store

• A server digital certificate signed by a trusted CA

• An OCSP stapling service on the firewall

An organization wants to harden its directory service so that user credentials are never sent in clear text. Which protocol and port combination satisfies this requirement?

• LDAP over TCP 389

• LDAPS over TCP 636

• LDAP with anonymous bind over TCP 389

• Kerberos over UDP 88

During an LDAP security review, an auditor discovers several service accounts using simple bind. What is the PRIMARY risk of continuing to use simple bind?

• Passwords are hashed with weak ciphers.

• Passwords are transmitted without encryption.

• The server cannot verify a user’s distinguished name.

• Anonymous access to all directory objects is enabled.

A network device currently accepts SNMPv1 queries from any host that knows the community string. Which remediation will MOST improve the security of the management plane?

• Change the default community string to “public2”.

• Enable SNMPv2c and limit access to port 162.

• Disable SNMP entirely and rely on Syslog.

• Upgrade to SNMPv3 and enforce user-based authentication with encryption.

A systems administrator needs to secure file transfers while keeping the control connection on port 21. Which solution should the administrator deploy?

• SFTP

• FTPS implicit TLS

• FTPES (explicit TLS)

• TFTP with IPSec tunnel

An email gateway submits messages to the organization’s SMTP server over port 587. Which statement BEST describes how STARTTLS is typically used in this scenario?

• The SMTP server automatically encrypts every session before greeting the client.

• The client requests to upgrade the plaintext connection to TLS after the initial HELO/EHLO.

• Port 587 is reserved exclusively for SMTP over implicit TLS.

• STARTTLS provides end-to-end message encryption that replaces S/MIME.

A desktop mail client is configured for POP3S. Which default port should the firewall allow to permit the connection?

• TCP 110

• TCP 143

• TCP 993

• TCP 995

Which of the following summarizes the key advantage of IMAPS over POP3S for a mobile workforce?

• Messages are automatically deleted from the server, freeing storage.

• Multiple devices can maintain synchronized mailbox folders on the server.

• IMAPS eliminates the need for TLS certificates.

• IMAPS sends less metadata over the wire, preserving privacy.

Which email-security mechanism checks the sender’s IP against a list of authorized IP addresses declared in the sender domain’s DNS TXT record?

• DKIM

• SPF

• DMARC

• S/MIME