WorksheetsCIT26 Practice Final Exam 70Q
Total questions: 91
Worksheet time: 50mins
Users report that a database file on the main server cannot be accessed. A database administrator verifies the issue and notices that the database file is now encrypted. The organization receives a threatening email demanding payment for the decryption of the database file. What type of attack has the organization experienced?
DoS attack
ransomware
man-in-the-middle attack
Trojan horse
What two kinds of personal information can be sold on the dark web by cybercriminals? (Choose two.)
city of residence
Facebook photos
name of a pet
street address
name of a bank
Involved in hunting for potential threats and implements threat detection tools
Tier 1 Alert Analyst
Tier 2 Incident Responder
Tier 3 Subject Matter Expert
Involved in deep investigation of incidents
Tier 1 Alert Analyst
Tier 2 Incident Responder
Tier 3 Subject Matter Expert
Monitors incoming alerts and verifies that a true incident has occurred
Tier 1 Alert Analyst
Tier 2 Incident Responder
Tier 3 Subject Matter Expert
How does a security information and event management system (SIEM) in a SOC help the personnel fight against security threats?
by analyzing logging data in real time
by dynamically implementing firewall rules
by combining data from multiple technologies
by integrating all security devices and appliances in an organization
Which statement describes the state of the administrator and guest accounts after a user installs Windows desktop version to a new computer?
By default, both the administrator and guest accounts are enabled.
By default, both the administrator and guest accounts are disabled.
By default, the administrator account is enabled but the guest account is disabled.
By default, the guest account is enabled but the administrator account is disabled.
What is a purpose of entering the nslookup cisco.com command on a Windows PC?
to connect to the Cisco server
to test if the Cisco server is reachable
to check if the DNS service is running
to discover the transmission time needed to reach the Cisco server
Which two actions can be taken when configuring Windows Firewall? (Choose two.)
Enable MAC address authentication.
Turn on port screening.
Manually open ports that are required for specific applications.
Allow a different software firewall to control access.
Perform a rollback.
Based on the command output shown, which file permission or permissions have been assigned to the other user group for the data.txt file?
ls –l data.txt
-rwxrw-r-- sales staff 1028 May 28 15:50 data.txt
read, write, execute
read
read, write
full access
What are three benefits of using symbolic links over hard links in Linux? (Choose three.)
Symbolic links can be exported.
They can be encrypted.
They can link to a file in a different file system.
They can link to a directory.
They can show the location of the original file.
What is the Internet?
It is a network based on Ethernet technology.
It provides network access for mobile devices.
It provides connections through interconnected global networks.
It is a private network for an organization with LAN and WAN connections.
Which two protocols are associated with the transport layer? (Choose two.)
TCP
IP
UDP
PPP
ICMP
At which OSI layer is a source IP address added to a PDU during the encapsulation process?
network layer
data link layer
transport layer
application layer
When a connectionless protocol is in use at a lower layer of the OSI model, how is missing data detected and retransmitted if necessary?
Connectionless acknowledgements are used to request retransmission.
Upper-layer connection-oriented protocols keep track of the data received and can request retransmission from the upper-level protocols on the sending host.
Network layer IP protocols manage the communication sessions if connection-oriented transport services are not available.
The best-effort delivery process guarantees that all packets that are sent are received.
What is the prefix length notation for the subnet mask 255.255.255.224?
/25
/26
/27
/28
If the default gateway is configured incorrectly on the host, what is the impact on communications?
The host is unable to communicate on the local network.
The host can communicate with other hosts on the local network, but is unable to communicate with hosts on remote networks.
The host can communicate with other hosts on remote networks, but is unable to communicate with hosts on the local network.
There is no impact on communications.
What are two ICMPv6 messages that are not present in ICMP for IPv4? (Choose two.)
Destination Unreachable
Neighbor Solicitation
Route Redirection
Router Advertisement
Time Exceeded
Which protocol is used by the traceroute command to send and receive echo-requests and echo-replies?
SNMP
ICMP
Telnet
TCP
Which two types of messages are used in place of ARP for address resolution in IPv6? (Choose two.)
echo reply
broadcast
neighbor solicitation
echo request
neighbor advertisement
What are two problems that can be caused by a large number of ARP request and reply messages? (Choose two.)
A large number of ARP request and reply messages may slow down the switching process, leading the switch to make many changes in its MAC table.
All ARP request messages must be processed by all nodes on the local network.
The ARP request is sent as a broadcast, and will flood the entire subnet.
The network may become overloaded because ARP reply messages have a very large payload due to the 48-bit MAC address and 32-bit IP address that they contain.
Switches become overloaded because they concentrate all the traffic from the attached subnets.
Which network monitoring tool saves captured network frames in PCAP files?
Wireshark
SNMP
NetFlow
SIEM
What is the TCP mechanism used in congestion avoidance?
three-way handshake
socket pair
two-way handshake
sliding window
What kind of message is sent by a DHCPv4 client requesting an IP address?
DHCPDISCOVER broadcast message
DHCPDISCOVER unicast message
DHCPOFFER unicast message
DHCPACK unicast message
Why is DHCP preferred for use on large networks?
Large networks send more requests for domain to IP address resolution than do smaller networks.
DHCP uses a reliable transport layer protocol.
It prevents sharing of files that are copyrighted.
t is a more efficient way to manage IP addresses than static address assignment.
Hosts on large networks require more IP addressing configuration settings than hosts on small networks.
What is a characteristic of DNS?
DNS relies on a hub-and-spoke topology with centralized servers.
DNS servers can cache recent queries to reduce DNS query traffic.
All DNS servers must maintain mappings for the entire DNS structure.
DNS servers are programmed to drop requests for name translations that are not within their zone.
Refer to the exhibit. A cybersecurity analyst is viewing captured packets forwarded on switch S1. Which device has the MAC address d8:cb:8a:5c:d5:8a?router
DG
PC-A
router ISP
web server
DNS server
R1 replaces the address 192.168.10.10 with a translated inside global address
Step 1
Step 2
Step 3
Step 4
Step 5
R1 checks the NAT configuration to determine if this packet should be translated
Step 1
Step 2
Step 3
Step 4
Step 5
R1 selects an available global address from the dynamic address pool
Step 1
Step 2
Step 3
Step 4
Step 5
The host sends packets that request a connection to the server at the address 209.165.200.254
Step 1
Step 2
Step 3
Step 4
Step 5
If there is no translation entry for this IP address, R1 determines that the source address 192.168.10.10 must be translated.
Step 1
Step 2
Step 3
Step 4
Step 5
A technician is configuring email on a mobile device. The user wants to be able to keep the original email on the server, organize it into folders, and synchronize the folders between the mobile device and the server. Which email protocol should the technician use?
POP3
IMAP
MIME
SMTP
What are two differences between HTTP and HTTP/2? (Choose two.)
HTTP/2 uses different status codes than HTTP does to improve performance.
HTTP/2 uses a compressed header to reduce bandwidth requirements.
HTTP has a different header format than HTTP/2 has.
HTTP/2 issues requests using a text format whereas HTTP uses binary commands.
HTTP/2 uses multiplexing to support multiple streams and enhance efficiency.
It encapsulates the Layer 3 packet into a new Layer 2 frame and forwards the frame out the exit interface
Step 1
Step 2
Step 3
It de-encapsulates the Layer 2 frames header and trailer to expose the Layer 3 packet
Step 1
Step 2
Step 3
It examines the destination IP address to find the best path in the routing table
Step 1
Step 2
Step 3
What is the purpose of CSMA/CA?
to prevent collisions
to prevent loops
to filter traffic
to isolate traffic
Which statement describes a typical security policy for a DMZ firewall configuration?
Traffic that originates from the outside interface is permitted to traverse the firewall to the inside interface with few or no restrictions.
Traffic that originates from the DMZ interface is selectively permitted to the outside interface.
Traffic that originates from the inside interface is generally blocked entirely or very selectively permitted to the outside interface.
Return traffic from the outside that is associated with traffic originating from the inside is permitted to traverse from the outside interface to the DMZ interface.
Return traffic from the inside that is associated with traffic originating from the outside is permitted to traverse from the inside interface to the outside interface.
What are two shared characteristics of the IDS and the IPS? (Choose two.)
Both are deployed as sensors.
Both analyze copies of network traffic.
Both use signatures to detect malicious traffic.
Both have minimal impact on network performance.
Both rely on an additional network device to respond to malicious traffic.
In an attempt to prevent network attacks, cyber analysts share unique identifiable attributes of known attacks with colleagues. What three types of attributes or indicators of compromise are helpful to share? (Choose three.)
features of malware files
IP addresses of attack servers
system ID of compromised systems
BIOS of attacking systems
changes made to end system software
Used to determine the possible consequences of successful attacks on the network
Penetration Testing
Network Scanning
Vulnerability
Used to discover available resources on the network
Penetration Testing
Network Scanning
Vulnerability
Used to find weaknesses and misconfiguration on network systems
Penetration Testing
Network Scanning
Vulnerability
Which two statements describe access attacks? (Choose two.)
Port redirection attacks use a network adapter card in promiscuous mode to capture all network packets that are sent across a LAN.
Password attacks can be implemented by the use of brute-force attack methods, Trojan horses, or packet sniffers.
Buffer overflow attacks write data beyond the allocated buffer memory to overwrite valid data or to exploit systems to execute malicious code.
To detect listening services, port scanning attacks scan a range of TCP or UDP port numbers on a host.
Trust exploitation attacks often involve the use of a laptop to act as a rogue access point to capture and copy all network traffic in a public location, such as a wireless hotspot.
After complaints from users, a technician identifies that the college web server is running very slowly. A check of the server reveals that there are an unusually large number of TCP requests coming from multiple locations on the Internet. What is the source of the problem?
A DDoS attack is in progress.
The server is infected with a virus.
There is insufficient bandwidth to connect to the server.
There is a replay attack in progress.
What are two monitoring tools that capture network traffic and forward it to network monitoring devices? (Choose two.)
SIEM
Wireshark
SNMP
SPAN
network tap
Which network monitoring tool is in the category of network protocol analyzers?
SNMP
SPAN
Wireshark
SIEM
What kind of ICMP message can be used by threat actors to perform network reconnaissance and scanning attacks?
ICMP redirects
ICMP unreachable
ICMP mask reply
ICMP router discovery
A flood of packets with invalid source IP addresses requests a connection on the network. The server busily tries to respond, resulting in valid requests being ignored. What type of attack has occurred?
UDP flood
TCP session hijacking
TCP reset
TCP SYN flood
An attacker is redirecting traffic to a false default gateway in an attempt to intercept the data traffic of a switched network. What type of attack could achieve this?
ARP cache poisoning
DHCP spoofing
DNS tunneling
TCP SYN flood
What is the most common goal of search engine optimization (SEO) poisoning?
to trick someone into installing malware or divulging personal information
to overwhelm a network device with maliciously formed packets
to build a botnet of zombies
to increase web traffic to malicious sites
The likelihood of undesireable consequences
threat
vulnerability
exploit
risk
a mechanism used to compromise an asset
threat
vulnerability
exploit
risk
a weakness in a system
threat
vulnerability
exploit
risk
a potential danger to an asset
threat
vulnerability
exploit
risk
Which section of a security policy is used to specify that only authorized individuals should have access to enterprise data?
statement of scope
Internet access policy
acceptable use policy
campus access policy
identification and authentication policy
A network security specialist is tasked to implement a security measure that monitors the status of critical files in the data center and sends an immediate alert if any file is modified. Which aspect of secure communications is addressed by this security measure?
data integrity
nonrepudiation
data confidentiality
origin authentication
A network administrator is configuring an AAA server to manage TACACS+ authentication. What are two attributes of TACACS+ authentication? (Choose two.)
encryption for only the password of a user
encryption for all communication
separate processes for authentication and authorization
UDP port 1645
single process for authentication and authorization
What three services are offered by FireEye? (Choose three.)
blocks attacks across the web
identifies and stops email threat vectors
creates firewall rules dynamically
identifies and stops latent malware on files
subjects all traffic to deep packet inspection analysis
Which three algorithms are designed to generate and verify digital signatures? (Choose three.)
IKE
AES
DSA
RSA
ECDSA
What are the two important components of a public key infrastructure (PKI) used in network security? (Choose two.)
intrusion prevention system
certificate authority
digital certificates
pre-shared key generation
symmetric encryption algorithms
recognizing various characteristics of known malware files
agent-based
behavior-based
signature-based
heuristics-based
analyzing suspicious activities
agent-based
behavior-based
signature-based
heuristics-based
recognizing general features shared by various types of malware
agent-based
behavior-based
signature-based
heuristics-based
Which statement describes the anomaly-based intrusion detection approach?
It compares the operations of a host against a well-defined security policy.
It compares the signatures of incoming traffic to a known intrusion database.
It compares the antivirus definition file to a cloud based repository for latest updates.
It compares the behavior of a host to an established baseline to identify potential intrusions.
A network administrator is creating a network profile to generate a network baseline. What is included in the critical asset address space element?
the list of TCP or UDP processes that are available to accept data
the IP addresses or the logical location of essential systems or data
the time between the establishment of a data flow and its termination
the TCP and UDP daemons and ports that are allowed to be open on the server
What are the three impact metrics contained in the CVSS 3.0 Base Metric Group? (Choose three.)
attack vector
availability
confidentiality
exploit
integrity
How might corporate IT professionals deal with DNS-based cyber threats?
Use IPS/IDS devices to scan internal corporate traffic.
Monitor DNS proxy server logs and look for unusual DNS queries.
Limit the number of DNS queries permitted within the organization.
Limit the number of simultaneously opened browsers or browser tabs.
How does using HTTPS complicate network security monitoring?
HTTPS can be used to infiltrate DNS queries.
HTTPS adds complexity to captured packets.
Web browser traffic is directed to infected servers.
HTTPS cannot protect visitors to a company-provided web site.
Which three pieces of information are found in session data? (Choose three.)
user name
source and destination port numbers
Layer 4 transport protocol
source and destination IP addresses
source and destination MAC addresses
What are two elements that form the PRI value in a syslog message? (Choose two.)
facility
header
severity
hostname
timestamp
Refer to the exhibit. Which field in the Sguil application window indicates the priority of an event or set of correlated events?
CNT
ST
Pr
AlertID
What is indicated by a true negative security alert classification?
An alert is verified to be an actual security incident.
Normal traffic is correctly ignored and erroneous alerts are not being issued.
An alert is incorrectly issued and does not indicate an actual security incident.
Exploits are not being detected by the security systems that are in place.
Which two types of network traffic are from protocols that generate a lot of routine traffic? (Choose two.)
SSL traffic
STP traffic
IPsec traffic
routing updates traffic
Windows security auditing alert traffic
How is the event ID assigned in Sguil?
Each event in the series of correlated events is assigned a unique ID.
All events in the series of correlated events are assigned the same event ID.
All events in the series of correlated events are assigned the same event group ID.
Only the first event in the series of correlated events is assigned a unique ID.
Which type of evidence supports an assertion based on previously obtained evidence?
best evidence
corroborating evidence
direct evidence
indirect evidence
Place the evidence collection priority from most volatile to least volatile as defined by the IETF guidelines.
routing table,ARP cache, process table, kernel statistics, RAM
1.(most volatile) - 7. (least volatile)
1.
2.
3.
4.
5.
Place the evidence collection priority from most volatile to least volatile as defined by the IETF guidelines.
non-volatile media, fixed and removable
1.(most volatile) - 7. (least volatile)
1.
2.
3.
4.
5.
Place the evidence collection priority from most volatile to least volatile as defined by the IETF guidelines.
memory registers, caches
1.(most volatile) - 7. (least volatile)
1.
2.
3.
4.
5.
Place the evidence collection priority from most volatile to least volatile as defined by the IETF guidelines.
temporary file systems
1.(most volatile) - 7. (least volatile)
1.
2.
3.
4.
5.
Place the evidence collection priority from most volatile to least volatile as defined by the IETF guidelines.
remote logging and monitoring data
1.(most volatile) - 7. (least volatile)
1.
2.
3.
4.
5.
Place the evidence collection priority from most volatile to least volatile as defined by the IETF guidelines.
physical interconnections and topologies
1.(most volatile) - 7. (least volatile)
3.
4.
5.
6.
7.
Place the evidence collection priority from most volatile to least volatile as defined by the IETF guidelines.
archival media, tape or backups
1.(most volatile) - 7. (least volatile)
3.
4.
5.
6.
7.
When dealing with a security threat and using the Cyber Kill Chain model, which two approaches can an organization use to help block potential exploitations on a system? (Choose two.)
Conduct full malware analysis.
Train web developers for securing code.
Collect email and web logs for forensic reconstruction.
Build detections for the behavior of known weaponizers.
Perform regular vulnerability scanning and penetration testing.
What is the goal of an attack in the installation phase of the Cyber Kill Chain?
Break the vulnerability and gain control of the target.
Establish command and control (CnC) with the target system.
Create a back door in the target system to allow for future access.
Use the information from the reconnaissance phase to develop a weapon against the target.
Which activity is typically performed by a threat actor in the installation phase of the Cyber Kill Chain?
Harvest email addresses of user accounts.
Obtain an automated tool to deliver the malware payload.
Open a two-way communication channel to the CnC infrastructure.
Install a web shell on the target web server for persistent access.
What will a threat actor do to create a back door on a compromised target according to the Cyber Kill Chain model?
Collect and exfiltrate data.
Add services and autorun keys.
Obtain an automated tool to deliver the malware payload.
Open a two-way communications channel to the CnC infrastructure.
What is the responsibility of the human resources department when handling a security incident?
Coordinate the incident response with other stakeholders and minimize the damage of the incident.
Review the incident policies, plans, and procedures for local or federal guideline violations.
Perform actions to minimize the effectiveness of the attack and preserve evidence.
Apply disciplinary measures if an incident is caused by an employee.
Which NIST incident response life cycle phase includes continuous monitoring by the CSIRT to quickly identify and validate an incident?
detection and analysis
preparation
containment, eradication, and recovery
postincident activities
After containment, what is the first step of eradicating an attack?
Patch all vulnerabilities.
Change all passwords.
Identify all hosts that need remediation.
Hold meetings on lessons learned.
