Security 7

A systems administrator deployed a monitoring solution that does not require installation on the endpoints that the solution is monitoring. Which of the following is described in this scenario?

• Agentless solution

• Client-based soon

• Open port

• File-based solution

Answer explanation

Agentless monitoring does not require the installation of software on the target device. It uses standard protocols to collect information, making it less intrusive and less resource intensive.

A security analyst is reviewing the source code of an application in order to identify misconfigurations and vulnerabilities. Which of the following kinds of analysis best describes this review?

• Dynamic

• Static

• Gap

• Impact

Answer explanation

Static analysis refers to reviewing the source code of an application without executing it, in order to identify misconfigurations, vulnerabilities, and potential security flaws. This is the type of analysis the security analyst is performing by examining the code directly. Dynamic analysis (A) involves analyzing the application while it is running, to detect vulnerabilities that only appear during execution. Gap analysis (C) identifies discrepancies between current security measures and desired standards, but is not focused on source code review. Impact analysis (D) assesses the potential consequences of identified vulnerabilities but is not the process of reviewing source code directly.

Which of the following agreement types is used to limit external discussions?

• BPA

• NDA

• SLA

• MSA

Answer explanation

A. BPA: Business Process Automation

B. NDA: Non-Disclosure Agreement

C. SLA: Service Level Agreement

D. MSA: Master Service Agreement

A security analyst is evaluating a SaaS application that the human resources department would like to implement. The analyst requests a SOC 2 report from the SaaS vendor. Which of the following processes is the analyst most likely conducting?

• Internal audit

• Penetration testing

• Attestation

• Due diligence

Answer explanation

D. Due diligence In this context, due diligence refers to the process of evaluating the security, compliance, and risk associated with a third-party vendor or service, such as a SaaS application. Requesting a SOC 2 report is a common part of the due diligence process to assess the vendor's controls related to security, availability, processing integrity, confidentiality, and privacy. Internal audit (A) refers to an organization's internal review of its own processes, not an external vendor. Penetration testing (B) involves actively testing for vulnerabilities by simulating attacks, which is not applicable here. Attestation (C) refers to a third-party audit or certification, such as the SOC 2 report itself, but the analyst is conducting due diligence by requesting the report.

Which of the following is used to conceal credit card information in a database log file?

• Tokenization

• Masking

• Hashing

• Obfuscation

Answer explanation

B. Masking Masking is used to conceal sensitive information, such as credit card numbers, by replacing or hiding parts of the data. In the context of database log files, masking ensures that sensitive information is not exposed while maintaining the usability of the data for other purposes. Tokenization (A) replaces sensitive data with a token that can only be mapped back to the original data using a secure system, but it is not typically used for log file entries. Hashing (C) converts data into a fixed-length hash, but it's a one-way function, making it unsuitable if the original data needs to be retrieved. Obfuscation (D) refers to making data less understandable but is less structured and secure than masking for specific data like credit card numbers.

An organization recently started hosting a new service that customers access through a web portal. A security engineer needs to add to the existing security devices a new solution to protect this new service. Which of the following is the engineer most likely to deploy?

• Layer 4 firewall

• NGFW

• WAF

• UTM

Answer explanation

C. WAF (Web Application Firewall) A Web Application Firewall (WAF) is specifically designed to protect web applications by filtering, monitoring, and blocking HTTP/S traffic to and from a web service. Since the organization is hosting a new service through a web portal, a WAF would be the most appropriate solution to protect against common web-based attacks like SQL injection, cross-site scripting (XSS), and other OWASP Top 10 threats. Layer 4 firewall (A) provides protection at the transport layer, which is too low-level to specifically protect web applications. NGFW (Next-Generation Firewall) (B) adds application-level filtering and protection, but is generally broader in scope, not specifically tailored to web applications. UTM (Unified Threat Management) (D) is a multi-functional security device but doesn't provide the specialized web application protection that a WAF offers. Thus, WAF is the most suitable solution for protecting a web service accessed via a portal.

Which of the following topics would most likely be included within an organization's SDLC?

• Service-level agreements

• Information security policy

• Penetration testing methodology

• Branch protection requirements

Answer explanation

D. Branch protection requirements Branch protection requirements are related to the version control and development process within the SDLC, ensuring that code changes are reviewed, tested, and approved before being merged into main branches. This helps maintain code quality and security throughout the development process. Penetration testing is usually conducted as part of the testing phase or after deployment to identify vulnerabilities and security weaknesses. It is a separate process from the core stages of the SDLC but is an important aspect of ensuring the security and robustness of the application once development is completed.

Which of the following control types is AUP an example of?

• Physical

• Managerial

• Technical

• Operational

Answer explanation

Managerial Controls - Aka administrative controls. Involve the strategic planning and governance side of security. Ensures that the org’s security strategies align with its business goals and its risk tolerance. Risk assessments Security policies Training programs Incident response strategies Operational Controls - Procedures and measures designed to protect data on a day-to-day basis and are mainly governed by internal processes and human actions. Backup procedures Account reviews User awareness training programs AUP = Acceptable Use Policy. Security policies = Managerial Controls.

An organization is adopting cloud services at a rapid pace and now has multiple SaaS applications in use. Each application has a separate log-in, so the security team wants to reduce the number of credentials each employee must maintain. Which of the following is the first step the security team should take?

• Enable SAML.

• Create OAuth tokens.

• Use password vaulting.

• Select an IdP.

Answer explanation

The correct answer is D. Select an IdP (Identity Provider). The first step in reducing the number of credentials employees must maintain is to select an Identity Provider (IdP). An IdP centralizes authentication and allows users to log in once and gain access to multiple applications, usually through a single sign-on (SSO) mechanism. Once an IdP is in place, other technologies like SAML (Security Assertion Markup Language) or OAuth can be configured to manage authentication with the SaaS applications. A. Enable SAML is a protocol used for authentication, but it requires an IdP to manage authentication. B. Create OAuth tokens is a way to grant limited access to resources but also requires an IdP or similar system to manage identities. C. Use password vaulting is a temporary solution that stores passwords, but it doesn't reduce the need for multiple log-ins, nor does it provide the benefits of centralized identity management.

A company's online shopping website became unusable shortly after midnight on January 30, 2023. When a security analyst reviewed the database server, the analyst noticed the following code used for backing up data:

IF DATE () = "01/30/202" THEN BEGIN DROP DATABASE WebShopOnline; END

Which of the following should the analyst do next?

• Check for recently terminated DBAs.

• Review WAF logs for evidence of command injection.

• Scan the database server for malware.

• Search the web server for ransomware notes

Answer explanation

A. Check for recently terminated DBAs. The code indicates that the database was intentionally dropped based on a specific date, which suggests that someone with access and knowledge of the database setup (such as a database administrator) may have executed or scheduled this command. Checking for recently terminated DBAs could help identify if an insider threat or an ex-employee had a role in this incident.