MCyber_Chap9

Which antimalware software approach can recognize various characteristics of known malware files to detect a threat?

• Routing-based
• Behavior-based
• Signature-based
• Heuristics-based

Answer explanation

Antimalware programs may detect viruses using three different approaches:

1) Signature-based – by recognizing various characteristics of known malware files

2) Heuristics-based – by recognizing general features shared by various types of malware

3) Behavior-based – through analysis of suspicious activities

Which device in a LAN infrastructure is susceptible to MAC address-table overflow and spoofing attacks?

• Firewall
• Workstation
• Server
• Switch

Answer explanation

Switches are LAN infrastructure devices interconnecting endpoints.

They are susceptible to LAN-related attacks including MAC address-table overflow attacks, spoofing attacks, LAN storm attacks, STP manipulation attacks, and VLAN attacks.

In most host-based security suites, which function provides robust logging of security-related events and sends logs to a central location?

• Intrusion detection and prevention
• Anti-phishing
• Telemetry
• Safe browsing

Answer explanation

The telemetry functionality in most host-based security suites provides robust logging functionality and submits logs to a central location for analysis.

Which technology might increase the security challenge to the implementation of IoT in an enterprise environment?

• CPU processing speed
• Data storage
• Cloud computing
• Network bandwidth

Answer explanation

With cloud computing, boundaries of enterprise networks are expanded to include locations on the Internet for which the enterprises are not responsible.

Malicious software might access the internal network endpoints to attack internal networks.

Which statement describes agentless antivirus protection?

• Host-based antivirus systems provide agentless antivirus protection.
• The antivirus protection is provided by the router that is connected to a cloud service.
• The antivirus protection is provided by the ISP.
• Antivirus scans are performed on hosts from a centralized system.

Answer explanation

Host-based antivirus protection is also known as agent-based. Agent-based antivirus runs on every protected machine.

Agentless antivirus protection performs scans on hosts from a centralized system.

Which HIDS is an open source product?

• Tripwire
• OSSEC
• Cisco AMP
• AlienVault USM

Answer explanation

The Open Source HIDS SECurity (OSSEC) software is an open source HIDS that uses a central manager server and agents that are installed on the hosts that are to be monitored.

In Windows Firewall, when is the Domain profile applied?

• When the host accesses the Internet
• When the host checks emails from an enterprise email server
• When the host is connected to a trusted network such as an internal business network
• When the host is connected to an isolated network from the Internet by another security device

Answer explanation

The Domain profile in Windows Firewall configuration is for connections to a trusted network, such as a business network, that is assumed to have an adequate security infrastructure.

What is a host-based intrusion detection system (HIDS)?

• It detects and stops potential direct attacks but does not scan for malware.
• It is an agentless system that scans files on a host for potential malware.
• It identifies potential attacks and sends alerts but does not stop the traffic.
• It combines the functionalities of antimalware applications with firewall protection.

Answer explanation

Host-intrusion detection system (HIDS) is a software installed on a device or server to monitor suspicious activity and detect malicious requests. Module 9 (Slide 12)

As described by the SANS Institute, which attack surface includes the exploitation of vulnerabilities in wired and wireless protocols used by IoT devices?

• Human Attack Surface
• Internet Attack Surface
• Network Attack Surface
• Software Attack Surface

Answer explanation

The SANS Institute describes three components of the attack surface:

1) Network Attack Surface – exploitation of vulnerabilities in networks

2) Software Attack Surface – exploitation of vulnerabilities in web, cloud, or host-based software applications

3) Human Attack Surface – exploitation of weaknesses in user behavior

Which statement describes the term attack surface?

• It is the total sum of vulnerabilities in a system that is accessible to an attacker.
• It is the group of hosts that experiences the same attack.
• It is the network interface where attacks originate.
• It is the total number of attacks toward an organization within a day.

Answer explanation

An attack surface is the total sum of the vulnerabilities in a system that is accessible to an attacker.

The attack surface can consist of open ports on servers or hosts, software that runs on Internet-facing servers, wireless network protocols, and even users.