Font size
WorksheetsSecurity+ Part 3 Implementation
Total questions: 90
Worksheet time: 2hrs 30mins
A user reports to the help desk that he is getting "cannot resolve address" error messages from his browser. Which port is likely a problem on his firewall?
22
53
161
162
What is a weakness of the DNS protocol?
Requests and replies are sent in plaintext
It doesn't provide billing standardization in cloud infrastructures
TCP can be used for large transfers such as zone transfers
Its encryption capabilities are slow
Which of the following is a benefit of DNSSEC?
Scalability
Lower expenditures from operations capital (OpsCap) expenditures
Enables origin authentication, authenticated denial of existence, and data integrity
Availability and confidentiality
What is the Secure Shell (SSH) protocol?
It is an encrypted remote terminal connection program used for remote connections to a server
It provides dynamic network address translation
It provides Software as a Service (SaaS)
It provides snapshots of physical machines at a point in time.
What is the purpose of the Secure/Multipurpose Internet Mail Extensions (S/MIME) protocol?
It is used in audio encryption
It optimizes the use of ports 80 and 443
It encrypts HTTP traffic
It provides cryptographic protections to emails
What is the purpose of Lightweight Directory Access Protocol Secure (LDAPS)?
It leverages encryption protections of SSH to secure FTP transfers
It uses an SSL/TLS tunnel to connect LDAP services
It digitally signs DNS records
It provides both symmetric and asymmetric encryption
Which port does FTPS use?
53
83
990
991
You are a security admin for XYZ company. You suspect that company emails using the default POP and IMAP email protocols and ports are getting intercepted while in transit. Which of the following ports should you consider using?
Ports 995 and 993
Ports 53 and 22
Ports 110 and 143
Ports 161 and 16240
What is the purpose of the Simple Network Management Protocol version 3 (SNMPv3)?
It provides asymmetric encryption values
It achieves specific communication goals
It provides a common language for developers
It is used to securely manage devices on IP-based networks
What is the purpose of HTTPS?
To allow enumeration and monitoring of network resources
To use SSL or TLS to encrypt a channel over which HTTP traffic is transmitted
To implement Single Sign-On
To enhance communication protocols
Fuzz testing works best in which of the following testing environments?
Known environment testing
Partially known environment testing
Unknown environment testing
Fuzz testing works equally well in all of the above
Which code analysis method is performed while the software is executed, either on a target system or an emulated system?
Static analysis
Runtime analysis
Sandbox analysis
Dynamic analysis
Which of the following are associated with endpoint protection? (Choose all that apply)
EDR
TPM
DLP
HTTP headers
You have a series of web servers that you wish to harden. Which of the following is the best solution for this case?
A block list/deny list
An allow list
Secure cookies
Code signing
You are examining the server infrastructure and wish to harden the machines in your server farm. Which is thee first task you should perform across all your servers?
Apply a block list/deny list
Apply an allow list
Block open ports and disable unused services
Employ disk encryption
Databases can use which of the following for security? (Choose all that apply)
Tokenization
Salting
Code signing
Secure cookies
When you're creating a website, which of the following will provide protection against user attacks against your site? (Choose all that apply)
Tokenization
HTTP headers
Code signing
Fuzzing
Your firm has 200 desktops in three sites, split among a dozen business departments. Which of the following would be the first that you should ensure is working correctly to reduce risk?
Application security
Secure Boot
Patch management
Secure cookies
You have a database full of very sensitive data. Salespeople need to access some of this sensitive data when onsite with a customer. The best method to prevent leakage of critical data during these access sessions would be to employ which of the following?
Salting
Hashing
Block list
Tokenization
Which of the following elements is not part of the Root of Trust?
Registry
UEFI
TPM PCR
Digital signatures
A network-based intrusion prevention system (NIPS) relies on what other technology at its core?
VPN
IDS
NAT
ACL
You have been asked to prepare a report on network-based intrusion detection systems that compares the NIDS solutions from two potential vendors your company is considering. One solution is signature based and one is behavior based. Which of the following lists what your report will identify as the key advantage of each?
Behavioral: low false-negative rate;
Signature: ability to detect zero-day attacks
Behavioral: ability to detect zero-day attacks;
Signature: low false-positive rates
Behavioral: high false-positive rate;
Signature: high speed of detection
Behavioral: low false-positive rate;
Signature: high false-positive rate
How can proxy servers improve security?
They use TLS-based encryption to access all sites
They can control which sites and content employees access, lessening the chance of malware exposure
They enforce appropriate use of company resources
They prevent access to phishing sites
What technology can check the client's health before allowing access to the network?
DLP
Reverse proxy
NIDS/NIPS
NAC
What kind of device provides tamper protection for encryption keys?
HSM
IPSec
Jump Server
HTML5
What is the purpose of the DNS protocol?
It provides a function for charging SaaS on a per-use basis
It supports the networking infrastructure
It translates names into IP addresses
It defines tenants in a public cloud
A user reports to the help desk that he is getting "cannot resolve address" error messages from his browser. Which port is likely a problem on his firewall?
22
553
440
53
What is the primary purpose of a screened subnet?
To prevent direct access to secure servers from the Internet
To provide a place for corporate servers to reside so they can access the Internet
To create a safe computing environment next to the Internet
To slow down traffic coming and going to the network
What is the best tool to ensure network traffic priorities for video conferencing are maintained?
QoS
VLAN
Network segmentation
Next-generation firewall
If you wish to monitor 100 percent of the transmissions from your customer service representatives to the Internet and other internal services, which is the best tool to use?
SPAN port
TAP
Mirror port
Aggregator switches
The use of an eight-digit PIN to set up a wireless connection is part of which of the following?
WPA
SAE
WPA3
WPS
What is the role of EAP in wireless connections?
It is a framework for establishing connectivity
It is a framework for passing authentication information
It is a framework to secure the authentication process
It is an actual encryption method used during authentication
What is the primary difference between WPA2-Personal and WPA2-Enterprise?
The use of a pre-shared secret
The number of concurrent supported users
Licensing costs on a per-user basis
The use of SAE for connections
You are setting up a Wi-Fi hotspot for guest visitors. What is the best method of establishing connections?
Open access
A posted password visually available on site
Use of a PSK solution
Captive portal
What is the most secure means of establishing connectivity to a Wi-Fi access point?
CCMP
SAE protocol
WPA2
IEEE 802.1X
A site survey will reveal all of the following except which one?
Optimal access point placement
Captive portal location
Channel allocations
Link speeds across the site
Forward secrecy exists for which of the following protocols?
WPS
WPA2
WPA3
All of the above
Your boss has asked you to set up wireless connectivity at a new company location. However, she is concerned about planning, coverage, and security regarding AP placement. She wants you to ensure coverage and address security concerns. Which of the following should you consider using while setting up this new location? (Select three)
RADIUS federation
Site survey
Wi-Fi analyzer
Heat map
You are using EAP-TTLS, which includes what unique aspect?
It cannot be used in WPA3
It requires client-side certificates
It cannot be used with CHAP
It is easier to set up than other EAP schemes
Which protocol allows the passing of legacy authentication protocols such as PAP, CHAP, and MS-CHAP?
EAP-TTLS
EAP-TLS
SAE
CCMP
Which of the following is a weakness of cellular technology?
Multiple vendors in a nationwide network
Less availability in rural areas
Multiple cell towers in close proximity in urban areas
Strong signals in areas of reasonable population
What frequency spectrum does Bluetooth use?
1.7 GHz
2.4 GHz
5 GHz
6.4 GHz
You need to use cryptographic keys between several devices. Which of the following can manage this task?
MAM solutions
Firmware OTA updates
USB OTG
MicroSD HSM
Which of the following are the three modes supported by Bluetooth 4.0?
Classic, Low Speed, High Energy
Enhanced Data Rate, Backward Compatible, High Energy
Classic, High Speed, Low Energy
Synchronous, High Speed, Low Energy
What is the primary use of near field communication (NFC)?
Establishing radio communications over a short proximity
Communication in sparsely populated areas
Long-distance connectivity
Communication in noisy industrial environments
You need to manage a whole host of different endpoints in the enterprise, including mobile devices, iPads, printers, PCs and phones. Which of the following is the most comprehensive solution?
COPE-based solutions
MAM solutions
MDM solutions
UEM solutions
What is the disadvantage of infrared (IR) technology?
It has a high data rate
It cannot penetrate solid objects
It can penetrate walls
It uses a slow encryption technology
What is the main security concern with Universal Serial Bus (USB) technology?
It connects to cell phones for easy charging
It uses proprietary encryption
It automounts and acts like a hard drive attached to the computer
It uses older encryption technology
Why is it important to establish policies governing remote wiping of mobile devices?
Mobile devices typically do not mix personal and business data
Mobile devices are more easily secured
Thieves cannot decrypt mobile devices
They are more susceptible to loss than other devices
What is the purpose of geofencing?
It can be used to remotely wipe a lost device
It makes securing the mobile device simpler
It enables devices to be recognized by location and have actions taken
It can enforce device locking with a strong password
The policies and procedures employed to connect the IAM systems of the enterprise and the cloud to enable communication with the data are referred to as what?
API inspection and integration
Secrets management
Dynamic resource allocation
Container security
Which of the following terms is not related to storage security in the cloud?
Permissions
High availability
Segmentation
Encryption
Resource policies involve all the following except?
Permissions
IAM
Cost
Access
Virtual networking in a cloud environment can include all the following except?
VPC endpoint
Public subnets
Private subnets
Network function virtualization
What structure is used to manage users in cloud environments?
Permissions
Incident awareness
Dynamic resource allocations
Security groups
Which of the following is a security policy enforcement point placed between cloud service consumers and cloud service providers to manage enterprise security policies as cloud-based resources are accessed?
SWG
VPC endpoint
CASB
Resource policies
Secure web gateways operate by inspecting at what point in the communication channel?
Security group membership
Application layer
Instance awareness
API inspection
Which of the following are critical in cloud security? (Choose all that apply)
Firewalls
Integration and auditing
Secrets management
Encryption
High availability is dependent on which of the following?
Secrets management
Dynamic resource allocation
Container security
CASB
Which is the most critical element in understanding your current cloud security posture?
Cloud service agreement
Networking security controls
Encryption
Application security
A friend of yours who works in the IT department of a bank tells you that tellers are allowed to log in to their terminals only from 9am to 5pm Monday through Saturday. What is this restriction an example of?
User auditing
Least privlege
Time-of-day restrictions
Account verification
Your organization is revamping its account management policies and you've been asked to clarify the difference between account disablement and account lockout. Which of the following statements best describes that difference?
Account disablement removes the user and all their data files; account lockout does not.
Account lockout typically only affects the ability to log in; account disablement removes all privileges
Account lockout is permanent; account disablement is easily reversible
Account disablement requires administrative privileges to execute; account lockout can be performed by any user.
Password policies are needed for all of the following except?
Password complexity
Password history
Password reuse
Password language
Which of the following is used to identify when a device is within a specified distance of a location?
Geofencing
Geoproximity
Geodistance
Geotagging
Account audits are used for all of the following except?
Testing password strength
Verification of user training
Verification of use employment/authorization
Testing for password policy enforcement
Which of the following represents the greatest risk when used?
Service accounts
Users accounts
Guest accounts
Shared accounts
When a new login request comes from a geographically distant location, for a user with a history of recent local logins, what policy can best help address legitimacy?
Impossible travel time
Geolocation
Network location
Time-of-day restrictions
You wish to tokenize account credentials so people can carry their passwords with them and not have to remember or type in long passwords. The best solution would involve which of the following?
Identity providers (IdP's)
SSH keys
Smart card
Password managers
On a web-facing interface, where your employees can gain access to the network, you wish to employ security against brute force attacks. One of the most cost-effective tools is to enforce which of the following?
Geofencing policy
Password complexity policy
Account lockout policy
Certificates
Which type of policy sets the direction for the security team to manage who can access what resources in a system?
Account permissions policy
Time-based login policies
Password policies
Time-of-day restriction policies
Your organization needs a system for restricting access to files based on the sensitivity of the information in those files. You might suggest which of the following access control systems?
Discretionary access control
Mandatory access control
Confidential access control
File-based access ccontrol
Which of the following describes a major difference between NTFS and FAT32 file systems?
NTFS supports user-level access differentiation
FAT32 supports group-level access differentiation
FAT32 natively encrypts files and directories
NTFS logs all file access using secure tokens
Your organization has grown too large to support assigning permissions to users individually. Within your organization, you have large groups of users who perform the same duties and need the same type and level of access to the same files. Rather than assigning individual permissions, your organization may wish to consider using which of the following access control methods?
Group-based access control
Shift-based access control
Role-based access control
File-based access control
A ticket-granting server is an important element in which of the following authentication models?
802.1X
RADIUS
TACACS+
Kerberos
Which of the following is an open standard that uses security tokens and assertions and allows you to access multiple websites with one set of credentials?
PAP
CHAP
SSO
SAML
What protocol is used for RADIUS?
UDP
NetBIOS
TCP
Proprietary
What are accounts with greater than "normal" user access called?
Privileged accounts
System accounts
Superuser accounts
Audit accounts
You have to implement an OpenID solution. What is the typical relationship with existing systems?
OpenID is used for authentication, OAuth is used for authorization
OpenID is used for authorization, OAuth is used for authentication
OpenID is not compatible with OAuth
OpenID only works with Kerberos
You wish to create an access control scheme that enables the CFO to access financial data from his machine, but not from the machine in the reception area of the lobby. Which access control model is best suited for this?
Role-based access control
Conditional access control
Mandatory access control
Discretionary access control
You need to design an authentication system where users who have never connected to the system can be identified and authenticated in a single process. Which is the best solution?
RADIUS
Password vault-based authentication
TPM-based authentication
Knowledge-based authentication
You are asked by the senior system administrator to refresh the SSL certificates on the web servers. The process is to generate a certificate signing request (CSR), send it to a third party to be signed, and then apply the return information to the CSR. What is this an example of?
Pinning
Borrowed authority
Third-party trust model
Stapling
A certificate authority consists of which of the following?
Hardware and software
Policies and procedures
People who manage certificates
All of the above
Your manager wants you to review the company's internal PKI system's CPS for applicability and verification and to ensure that it meets current needs. What are you most likely to focus on?
Revocations
Trust level provided to users
Key entropy
How the keys are stored
You are preparing an email to send to a colleague at work, and because the message information is sensitive, you decide you should encrypt it. When you attempt to apply the certificate that you have for the colleague, the encryption fails. The certificate was listed as still valid for another year, and the certificate authority is still trusted and working. What happened to this user's key?
It was using the wrong algorithm
You are querying the incorrect certificate authority
It was revoked
The third-party trust model failed
Which of the following is a requirement for a CRL?
It must have the email addresses of all the certificate owners
It must contain a list of all expired certificates
It must contain information about all the subdomains covered by the CA
It must be posted to a public directory
What does OCSP do?
It reviews the CRL for the client and provides a status about the certificate being validated
It outlines the details of a certificate authority, including how identities are verified, the steps the CA follows to generate certificates, and why the CA can be trusted
It provides for a set of values to be attached to the certificate
It provides encryption for digital signatures
The X.509 standard applies to which of the following?
SSL providers
Digital certificates
Certificate revocation lists
Public key infrastructure
You are browsing a website when your browser provides you with the following warning message: "There is a problem with this website's security certificate." When you examine the certificate, it indicates that the root CA is not trusted. What most likely happened to cause this error?
The certificate was revoked
The certificate does not have enough bit length for the TLS protocol
The server's CSR was not signed by a trusted CA
The certificate has expired
You are issued a certificate from a CA, delivered by email, but the file does not have an extension. The email notes that the root CA, the intermediate CAs, and your certificate are all attached in the file. What format is your certificate likely in?
DER
CER
PEM
PFX
Why is pinning more important on mobile devices?
It uses elliptic curve cryptography
it uses less power for pinned certificate requests
It reduces network bandwidth usage by combining multiple CA requests into one
It allows caching of a known good certificate when roaming to low-trust networks
