Security + Exams Questions 167 (G) Part 4 Q76-Q99

After a recent vulnerability scan, a security engineer needs to harden the routers within the corporate network. Which of the following is the most appropriate to disable?

• Console access

• Routing protocols

• VLANs

• Web-based administration

Answer explanation

Disabling web-based administration is crucial for hardening routers, as it reduces the attack surface by preventing unauthorized remote access. Other options like console access and routing protocols are necessary for network functionality.

A security administrator needs a method to secure data in an environment that includes some form of checks so track any changes. Which of the following should the administrator set up to achieve this goal?

• SPF

• GPO

• NAC

• FIM

Answer explanation

FIM (File Integrity Monitoring) is designed to track changes to files and data, providing checks to secure data integrity. This makes it the best choice for the administrator's needs.

An administrator is reviewing a single server's security logs and discovers the following: Which of the following best describes the action captured in this log file?

• Brute-force attack

• Privilege escalation

• Failed password audit

• Forgotten password by the user

Answer explanation

The log indicates multiple failed login attempts, characteristic of a brute-force attack where an attacker tries various passwords to gain unauthorized access.

A security engineer is implementing FDE for all laptops in an organization. Which of the following are the most important for the engineer to consider as part of the planning process? (Choose two.)

• Key escrow

• Digital signatures

• Data tokenization

• Public key management

• TPM presence

Answer explanation

Key escrow is crucial for recovering encryption keys, while TPM presence ensures hardware-based security for FDE. Both are essential for effective full disk encryption implementation.

A security analyst scans a company's public network and discovers a host is running a remote desktop that can be used to access the production network. Which of the following changes should the security analyst recommend?

• Changing the remote desktop port to a non-standard number

• Setting up a VPN and placing the jump server inside the firewall

• Using a proxy for web connections from the remote desktop server

• Connecting the remote server to the domain and increasing the password length

Answer explanation

Setting up a VPN and placing the jump server inside the firewall provides a secure access method, protecting the production network from unauthorized access, unlike merely changing the port or other options.

An enterprise has been experiencing attacks focused on exploiting vulnerabilities in older browser versions with well-known exploits. Which of the following security solutions should be configured to best provide the ability to monitor and block these known signature-based attacks?

• ACL

• DLP

• IDS

• IPS

Answer explanation

Explanation:

• IPS: An IPS actively monitors network traffic and can detect malicious packets based on predefined signatures, allowing it to not only identify attacks but also actively block them from reaching the target system. This makes it ideal for preventing attacks that utilize well-known exploits. 

Security controls in a data center are being reviewed to ensure data is properly protected and that human life considerations are included. Which of the following best describes how the controls should be set up?

• Remote access points should fail closed.

• Logging controls should fail open.

• Safety controls should fail open.

• Logical security controls should fail closed.

Answer explanation

Safety controls should fail open to ensure that in the event of a failure, human life is prioritized and access is maintained for emergency situations, while other controls can be designed to fail closed for security.

Which of the following would be best suited for constantly changing environments?

• RTOS

• Containers

• Embedded systems

• SCADA

Answer explanation

Containers are ideal for constantly changing environments due to their ability to quickly deploy, scale, and manage applications. They provide flexibility and isolation, making them suitable for dynamic workloads compared to RTOS, embedded systems, or SCADA.

Which of the following incident response activities ensures evidence is properly handled?

• E-discovery

• Chain of custody

• Legal hold

• Preservation

Answer explanation

Explanation:

• Chain of custody: This refers to the detailed documentation tracking the movement, handling, and storage of evidence from the time it's collected until it's presented in court, ensuring its integrity and admissibility. 

An accounting clerk sent money to an attacker's bank account after receiving fraudulent instructions to use a new account. Which of the following would most likely prevent this activity in the future?

• Standardizing security incident reporting

• Executing regular phishing campaigns

• Implementing insider threat detection measures

• Updating processes for sending wire transfers

Answer explanation

Updating processes for sending wire transfers would establish clear protocols and verification steps, reducing the risk of falling for fraudulent instructions in the future.