IAS1-Assessment Test (BSIT3102)

The organization that Chris works for has disabled automatic updates. What is the most common reason for disabling automatic updates for organizational systems?

• To avoid disruption of the work process for office workers

• To prevent security breaches due to malicious patches and updates

• To avoid issues with problematic patches and updates

• All of the above

Answer explanation

The most common reason to disable automatic patching is to avoid issues with problematic or flawed patches and updates. In most environments the need to patch regularly is accepted and handled for office workers without causing significant disruption. That concern would be different if the systems being patched were part of an industrial process or factory production environment. Malicious patches from legitimate sources such as an automatic update repository are exceptionally rare and are not a common concern or driver of this behavior. For more information, see Chapter 11 .

Which of the following is the least volatile according to the forensic order of volatility?

• The system's routing table

• Logs

• Temp files

• CPU registers

Answer explanation

Logs, along with any file that is stored on disk without the intention of being frequently overwritten, are the least volatile item listed. In order from most volatile to least from the answers here, you could list these as CPU registers, the system's routing table, temp files, and logs. For more information, see Chapter 15 .

Ed wants to trick a user into connecting to his evil twin access point (AP). What type of attack should he conduct to increase his chances of the user connecting to it?

• A disassociation attack

• An application denial-of-service attack

• A known plain-text attack

• A network denial-of-service attack

Answer explanation

If Ed can cause his target to disassociate from the access point they are currently connected to, he can use a higher transmission power or closer access point to appear higher in the list of access points. If he is successful at fooling the user or system into connecting to his AP, he can then conduct on-path attacks or attempt other exploits. Denial-of-service attacks are unlikely to cause a system to associate with another AP, and a known plain text attack is a type of cryptographic attack and is not useful for this type of attempt. For more information, see Chapter 12 .

What term is used to describe wireless site surveys that show the relative power of access points on a diagram of the building or facility?

• Signal surveys

• db maps

• AP topologies

• Heatmaps

Answer explanation

Site surveys that show relative power on a map or diagram are called heatmaps. They can help show where access points provide a strong signal, and where multiple APs may be competing with each other due to channel overlap or other issues. They can also help identify dead zones where signal does not reach. Signal surveys, db maps, and AP topologies were made up for this question. For more information, see Chapter 13 .

What hardware device is used to create the hardware root of trust for modern desktops and laptops?

• System memory

• A HSM

• The CPU

• The TPM

Answer explanation

A hardware root of trust provides a unique element that means that a board or device cannot be replicated. A Trusted Platform Module (TPM) is commonly used to provide the hardware root of trust. CPUs and system memory are not unique in this way for common desktops and laptops, and a hardware security module (HSM) is used to create, manage, and store cryptographic certificates as well as perform and offload cryptographic operations. For more information, see Chapter 11 .

Angela wants to prevent users in her organization from changing their passwords repeatedly after they have been changed so that they cannot reuse their current password. What two password security settings does she need to implement to make this occur?

• Set a password history and a minimum password age.

• Set a password history and a complexity setting.

• Set a password minimum and maximum age.

• Set password complexity and maximum age

Answer explanation

Angela needs to retain a password history and set a minimum password age so that users cannot simply reset their password until they have changed the password enough times to bypass the history. For more information, see Chapter 8 .

Chris wants to establish a backup site that is fully ready to take over for full operations for his organization at any time. What type of site should he set up?

• A cold site

• A clone site

• A hot site

• A ready site

Answer explanation

Hot sites are ready to take over operations in real time. Cold sites are typically simply ready buildings with basic infrastructure

Which of the following is not a common constraint of embedded Technet24 and specialized systems?

• Computational power

• Overly complex firewall settings

• Lack of network connectivity

• Inability to patch

Answer explanation

Embedded and specialized systems tend to have lower-power CPUs, less memory, less storage, and often may not be able to handle CPU-intensive tasks like cryptographic algorithms or built-in security tools. Thus, having a firewall is relatively unlikely, particularly if there isn't network connectivity built in or the device is expected to be deployed to a secure network. For more information, see Chapter 11 .

Gary is reviewing his system's SSH logs and sees logins for the user named “Gary” with passwords like password1, password2 … PassworD. What type of attack has Gary discovered?

• A dictionary attack

• A rainbow table attack

• A pass-the-hash attack

• A password spraying attack

Answer explanation

A dictionary attack will use a set of likely passwords along with common variants of those passwords to try to break into an account. Repeated logins for a single user ID with iterations of various passwords is likely a dictionary account. A rainbow table is used to match a hashed password with the password that was hashed to that value. A pass-the-hash attack provides a captured authentication hash to try to act like an authorized user. A password spraying attack uses a known password (often from a breach) for many different sites to try to log in to them. For more information, see Chapter 4 .

Kathleen wants to set up a system that allows access into a high security zone from a low-security zone. What type of solution should she configure?

• VDI

• A container

• A screened subnet

• A jump server

Answer explanation

Jump servers are systems that are used to provide a presence and access path in a different security zone. VDI is a virtual desktop infrastructure and is used to provide controlled virtual systems for productivity and application presentation among other uses. A container is a way to provide a scalable, predictable application environment without having a full underlying virtual system, and a screened subnet is a secured zone exposed to a lower trust level area or population. For more information, see Chapter 12 .