View
67
Download
1
Category
Tags:
Preview:
DESCRIPTION
Practice Test for those taking FORESEC Network Security Exam.
Citation preview
CompTIA SY0-301 Security+ 100-Question Practice Exam
Developed for www.GetCertified4Less.com
(Author to remain anonymous)
This practice exam has been developed exclusively for
GetCertified4Less.Com. Answers and explanations on last pages.
1. In which of the cloud computing infrastructure types clients, instead
of buying all the hardware and software, purchase computing resources as
an outsourced service from suppliers who own and maintain all the
necessary equipment?
A. IaaS
B. PaaS
C. SaaS
D. RAS
2. WPA2 is also known as:
A. 802.1X
B. 802.11
C. 802.3
D. 802.11i
3. Which of the following devices operates at Layer 3 of the OSI model?
A. Passive hub
B. Switch
C. Router
D. Active hub
4. One of the measures used in securing an Ethernet switch includes
disabling unused ports.
A. True
B. False
5. A cloud computing infrastructure type where applications are hosted
over a network (typically Internet) eliminating the need to install and
run the software on the customer's own computers is called:
A. Thick client
B. SaaS
C. Virtualization
D. IaaS
6. RAID 0: (Select two answers)
A. Offers fault tolerance and redundancy
B. Requires at least three drives to implement
C. Doesn't offer fault tolerance
D. Requires at least two drives to implement
7. Which of the following terms refers to a logical grouping of computers
that allow computer hosts to act as if they were attached to the same
broadcast domain, regardless of their physical location?
A. VLAN
B. DMZ
C. MAC filtering
D. SNMP community
8. A group that consists of SNMP devices and one or more SNMP managers is
called:
A. SNMP trap
B. Network Management System (NMS)
C. SNMP community
D. Management Information Base (MIB)
9. VLAN membership can be set through: (Select all that apply)
A. Trunk port
B. Switch ports
C. Encryption
D. MAC address
10. A lightly protected subnet placed on the outside of the company's
firewall consisting of publicly available servers is also referred to as:
A. VPN
B. Access Point (AP)
C. VLAN
D. DMZ
11. Which of the following attacks uses multiple compromised computer
systems against its target?
A. DoS
B. Botnet
C. Logic bomb
D. DDoS
12. What is the purpose of non-repudiation?
A. Preventing someone from denying that they took a specific action
B. Ensuring that received data hasn't changed in transit
C. Hiding one piece of data in another piece of data
D. Transforming plaintext to ciphertext
13. Which of the following refers to one of the testing stages in the
software development process performed by customers or end users?
A. UAC
B. NAT
C. UAT
D. EULA
14. Using a telephone system to manipulate a user into disclosing
confidential information is called:
A. Shoulder surfing
B. Spoofing
C. Vishing
D. Tailgating
15. Which of the following fall(s) into the category of social
engineering attacks? (Select all that apply)
A. Whaling
B. MAC spoofing
C. Xmas attack
D. Vishing
E. Spear phishing
16. The practice of sending unsolicited messages over Bluetooth is also
known as:
A. SPIM
B. Bluejacking
C. Phishing
D. Bluesnarfing
17. Gaining unauthorized access to a Bluetooth device is also referred to
as:
A. Interference
B. Bluesnarfing
C. Bluejacking
D. Pharming
18. Which of the following terms refers to a microchip embedded on the
motherboard of a personal computer or laptop that can store keys,
passwords and digital certificates?
A. FRU
B. EFS
C. TPM
D. HCL
19. Phishing scams targeting a specific group of users are also referred
to as:
A. Bluejacking
B. Spear phishing
C. Tailgating
D. Pharming
20. Unsolicited messages received over an instant messaging system are
also known as:
A. Spim
B. Spoofing
C. Spam
D. Bluejacking
21. What is war chalking?
A. Scanning for open ports
B. Finding unsecured wireless networks
C. SSID discovery
D. Marking unsecured wireless networks
22. A piece of hardware and associated software / firmware that usually
attaches to the inside of a PC or server and provides at least the
minimum of cryptographic functions is called:
A. OUI
B. BIOS
C. HSM
D. PKI
23. Which of the following solutions is used to hide the internal IP
addresses by modifying IP address information in IP packet headers while
in transit across a traffic routing device?
A. NAC
B. ACL
C. NAT
D. DMZ
24. Which of the following is an acronym for a risk assessment formula
defining probable financial loss due to a risk over a one-year period?
A. ARO
B. ALE
C. SLE
D. UAT
25. Malicious code activated by a specific event is also known as:
A. Logic bomb
B. Denial of service
C. Computer worm
D. Xmas attack
26. Security measures that can be applied to mobile devices include:
(Select all that apply)
A. Quality of Service (QoS)
B. Encryption and passwords
C. Load balancing
D. Remote sanitation
E. Voice encryption
27. Which of the following port numbers is used by Kerberos?
A. 23
B. 80
C. 22
D. 88
28. SHA and MD5 are examples of:
A. Encryption algorithms
B. Virus signatures
C. Hash functions
D. Trust models
29. Which of the following protocols periodically reauthenticates a
client?
A. PAP
B. SHA
C. CHAP
D. MD5
30. Which IPsec mode provides whole packet encryption?
A. Tunnel
B. Payload
C. Transport
D. Host-to-host
31. A set of rules enforced in a network that restrict the use to which
the network may be put is also known as:
A. OEM
B. AUP
C. FAQ
D. UAT
32. A group of computers running malicious software under control of a
hacker is also referred to as:
A. Botnet
B. Ethernet
C. Subnet
D. Intranet
33. Which of the following terms refers to software or hardware based
security solutions designed to detect and prevent unauthorized use and
transmission of confidential information outside of a corporate network?
A. EULA
B. DLP
C. UAT
D. LTO
34. Penetration test of a computer system without the prior knowledge on
how the system works is also known as:
A. Auditing
B. White hat testing
C. Black box testing
D. White box
35. Finding vulnerability in an application by feeding it incorrect input
is also known as:
A. Patching
B. Exception handling
C. Application hardening
D. Fuzzing
36. Which of the following is an example of a biometric authentication?
A. Password
B. Smart card
C. Fingerprint scanner
D. User name
37. Which of the following is an example of a multi-factor
authentication?
A. Password and biometric scan
B. User name and PIN
C. Smart card and identification badge
D. Iris and fingerprint scan
38. Steganography allows for:
A. Hiding data within another piece of data
B. Data encryption
C. Checking data integrity
D. Hashing
39. An IPv6 address consists of:
A. 32 bits
B. 48 bits
C. 64 bits
D. 128 bits
40. Which of the following acronyms refers to any type of information
pertaining to an individual that can be used to uniquely identify that
individual?
A. PIN
B. PII
C. ID
D. Password
41. Which of the following terms refers to a rogue access point?
A. Computer worm
B. Backdoor
C. Evil twin
D. Trojan horse
42. Antivirus software can be kept up to date through: (Select all that
apply)
A. Virus signature updates
B. Virtualization
C. Auditing
D. Engine updates
43. In this access control model every resource has a sensitivity label
matching a clearance level assigned to a user.
A. RBAC
B. DAC
C. HMAC
D. MAC
44. Which of the following is used to prevent switching loops?
A. UTP
B. HMAC
C. STP
D. RAS
45. TCP port 23 is used by:
A. SMTP
B. SSH
C. Telnet
D. TFTP
46. A chronological record outlining persons in possession of an evidence
is also referred to as:
A. Chain of custody
B. Data handling chain
C. Information classification
D. Evidence timeline
47. Sticky note with a password kept on sight in the user's cubicle would
be a violation of which of the following policies?
A. Data labeling policy
B. Clean desk policy
C. User account policy
D. Password complexity
48. A policy outlining ways of collecting and managing personal data is
also known as:
A. Acceptable use policy
B. Audit policy
C. Privacy policy
D. Data loss prevention
49. Which of the following solutions is used for controlling temperature
and humidity?
A. Faraday cage
B. UART
C. EMI shielding
D. HVAC
50. A maximum acceptable period of time within which a system must be
restored after failure is also known as:
A. Recovery Time Objective (RTO)
B. Mean Time To Restore (MTTR)
C. Maximum Tolerable Period of Disruption (MTPOD)
D. Mean Time Between Failures (MTBF)
51. Which of the following provides confidentiality?
A. SHA-1
B. RAID 0
C. MD5
D. AES
52. Which of the following authentication protocols offer(s)
countermeasures against replay attacks? (Select all that apply)
A. NTP
B. PAP
C. Kerberos
D. CHAP
53. Which of the following provide the means for checking data integrity?
(Select two answers)
A. WEP
B. RC4
C. SHA-1
D. WPA2
E. MD5
54. Which of the following are symmetric-key algorithms? (Select all that
apply)
A. AES
B. DES
C. RSA
D. Diffie-Hellman
E. 3DES
55. Which of the following provide availability? (Select all that apply)
A. RAID 5
B. RAID 0
C. Encryption
D. RAID 1
E. Hot site
56. 802.1x is an IEEE standard defining:
A. Token ring networks
B. Port-based network access control
C. VLAN tagging
D. Wireless networking
57. Allowing a program through a firewall is also referred to as
creating:
A. Entry
B. Tunnel
C. Access Control list (ACL)
D. Exception
58. The last default rule on a firewall is to:
A. Create an exception
B. Allow all traffic
C. Deny all traffic
D. Unblock all ports
59. Which of the following protocols was designed as a secure replacement
for Telnet?
A. ICMP
B. FTP
C. IPv6
D. SSH
60. TCP port 22 is used by default by: (Select all that apply)
A. FTP
B. SSH
C. SMTP
D. SCP
E. SFTP
61. Which of the following ports are used by NetBIOS? (Select all that
apply)
A. 137
B. 161
C. 138
D. 162
E. 139
62. Which of the following sequences of steps adheres to the order of
volatility while collecting an evidence?
A. Memory dump, disk files, temporary files, archival media
B. Archival media, disk files, temporary files, memory dump
C. Memory dump, temporary files, disk files, archival media
D. Temporary files, memory dump, archival media, disk files
63. Phishing scams targeting people holding high positions in an
organization or business are also known as:
A. Tailgating
B. Shoulder surfing
C. Pharming
D. Whaling
64. Which of the following prevents a computer screen from being viewed
by others nearby?
A. Firewall
B. Privacy screen
C. Multi-factor authentication
D. HIPS
65. Which of the following measures should be used in order to prevent
shoulder surfing? (Select two answers)
A. Cable locks
B. Video surveillance
C. Privacy filters
D. Security guards
E. Screensavers
66. What is tailgating?
A. Gaining unauthorized access to restricted areas by following another
person
B. Manipulating a user into disclosing confidential information
C. Scanning for unsecured wireless networks while driving in a car
D. Looking over someone's shoulder in order to get information
67. The term war driving refers to:
A. Penetration test
B. Scanning for unsecured wireless networks while driving in a car
C. Vulnerability scan
D. Marking unsecured wireless networks
68. Which of the following terms refers to an access control method based
on user identity?
A. HMAC
B. DAC
C. MAC
D. RBAC
69. An access control model in which access to resources is granted or
denied depending on Access Control List (ACL) entries is also known as:
A. Mandatory Access Control
B. Lattice-Based Access Control
C. Role-Based Access Control
D. Rule-Based Access Control
70. Which of the following actions can be taken by an IDS? (Select two
answers)
A. Terminating process
B. Closing down connection
C. Reconfiguring firewall
D. Logging
E. Sending an alert
71. Which of the following are the features of a Common Access Card
(CAC)? (Select all that apply)
A. Provides access to low security areas
B. Any type of identification badge with a photo
C. Smart card
D. Issued by United States Department of Defense (DoD)
72. An authentication subsystem that enables a user to access multiple,
connected system components (such as separate hosts on a network) after a
single login at only one of the components is also referred to as:
A. SSO
B. TLS
C. SSL
D. WAP
73. What is the name of a storage solution used to retain copies of
private encryption keys?
A. Trusted OS
B. Key escrow
C. Proxy
D. Recovery agent
74. Copies of lost private encryption keys can be retrieved from a key
database by:
A. Power users
B. Recovery agents
C. GPS tracking
D. Backup operators
75. Zero-day attack exploits:
A. New accounts
B. Patched software coding errors
C. Vulnerability that is present in already released software but unknown
to the software developer
D. Well known vulnerability
76. Which of the following can stop attacks on the network?
A. NIPS
B. HIDS
C. HIPS
D. NIDS
77. A type of attack exploiting the TCP three-way handshake process is
also known as:
A. SYN flood
B. Xmas attack
C. DNS poisoning
D. Man-in-the-middle attack
78. Which type of intrusion detection relies on the previously
established baseline of normal network activity?
A. MD-IDS
B. Signature-based IDS
C. Managed Switch
D. AD-IDS
79. Which security measure is in place when a client is denied access to
the network due to outdated antivirus software?
A. IPsec
B. NAC
C. DMZ
D. NAT
80. What type of protocols ensure the privacy of a VPN connection?
A. OSPF
B. IPv6
C. Tunneling
D. Telnet
81. Packet sniffer is a common term for:
A. Multilayer switch
B. Port scanner
C. Router
D. Protocol Analyzer
82. Which of the following ports are used by the File Transfer Protocol
(FTP)? (Select two answers)
A. 22
B. 20
C. 25
D. 23
E. 21
83. Penetration test with the prior knowledge on how the system that is
to be tested works is also known as:
A. White hat
B. Sandbox
C. White box
D. Black box
84. Which of the following measures fall(s) into the category of
detective security controls? (Select all that apply)
A. IPS
B. Security guard
C. IDS
D. Video surveillance
85. HTTPS runs on TCP port:
A. 443
B. 80
C. 143
D. 137
86. Paper shredder would help in preventing what kind of threats? (Select
all that apply)
A. Dumpster diving
B. Tailgating
C. Zero-day attack
D. Social engineering
87. Public/private key pair is a feature of:
A. WEP
B. Asymmetric encryption
C. PII
D. Symmetric encryption
88. Coding errors and security vulnerabilities in software that has
already been released can be rectified through:
A. Fuzzing
B. Application hardening
C. Patch management
D. Virtualization
89. Penetration testing: (Select all that apply)
A. Bypasses security controls
B. Only identifies lack of security controls
C. Actively tests security controls
D. Exploits vulnerabilities
E. Passively tests security controls
90. Which of the following would be the fastest in validating a digital
certificate?
A. IPX
B. OCSP
C. CRL
D. OSPF
91. The term Trusted OS refers to an operating system:
A. Admitted to a network through NAC
B. Implementing patch management
C. That has been authenticated on the network
D. With enhanced security features
92. A monitored host or network specifically designed to detect
unauthorized access attempts is also known as:
A. Botnet
B. Rogue access point
C. Honeypot
D. Flood guard
93. Software that performs unwanted and harmful actions in disguise of a
legitimate and useful program is also referred to as:
A. Trojan horse
B. Spyware
C. Logic bomb
D. Adware
94. Which of the following fall into the category of physical security
measures? (Select all that apply)
A. Mantrap
B. Vulnerability scanner
C. Access list
D. Honeypot
E. Hardware lock
95. What are the features of Elliptic Curve Cryptography (ECC)? (Select
two answers)
A. Asymmetric encryption
B. Shared key
C. Suitable for small wireless devices
D. High processing power requirements
E. Symmetric encryption
96. Which of the following allows for encrypting e-mail messages?
A. PGP
B. OVAL
C. SMTP
D. PPP
97. What type of system can be compromised through phreaking?
A. PBX
B. PGP
C. ATX
D. BIOS
98. Which of the following acronyms refers to a lightweight consumer
electronic device?
A. KDC
B. CA
C. SLED
D. PED
99. Advanced Encryption Standard (AES): (Select all that apply)
A. Is a symmetric encryption algorithm
B. Uses 128-, 192-, and 256-bit keys
C. Is an asymmetric encryption algorithm
D. Uses block cipher algorithm
E. Requires multiple passes to encrypt data
100. Which of the following is a stream cipher?
A. DES
B. AES
C. RC4
D. 3DES
ANSWERS
1. Answer: A. IaaS
Explanation: Infrastructure as a Service (IaaS) is one of the cloud
computing infrastructure types where clients, instead of buying all the
hardware and software, purchase computing resources as an outsourced
service from suppliers who own and maintain all the necessary equipment.
The clients usually pay for computational resources on a per-use basis.
In IaaS, cost of the service depends on the amount of consumed resources.
2. Answer: D. 802.11i
Explanation: IEEE 802.11i standard is also known as WPA2. The two terms,
802.11i and Wi-Fi Protected Access II (WPA2) are used synonymously to
mean the new security standard for wireless networks.
3. Answer: C. Router
Explanation: Routers operate at Layer 3 (Network Layer) of the OSI model.
Switches operate at Layer 2 (Data link layer) of the OSI model. Hubs
operate at Layer 1 (Physical layer) of the OSI model.
4. Answer: A. True
Explanation: One of the measures used in securing an Ethernet switch
includes disabling unused ports.
5. Answer: B. SaaS
Explanation: Software as a Service (SaaS) is a type of cloud computing
infrastructure where applications are hosted over a network (typically
Internet) eliminating the need to install and run the software on the
customer's own computers and simplifying maintenance and support.
Compared to conventional software deployment which requires licensing fee
and often investment in additional hardware on the client side, SaaS can
be delivered at a lower cost by providing remote access to applications
and pricing based on monthly or annual subscription fee.
6. Answers: C and D. Doesn't offer fault tolerance and Requires at least
two drives to implement
Explanation: Redundant Array of Independent Disks (RAID) is a collection
of different data storage schemes (referred to as RAID levels) that allow
for combining multiple hard disks into a single logical unit in order to
increase fault tolerance and performance. RAID Level 0 breaks data into
fragments called blocks and each block of data is written to a separate
disk drive. This greatly improves performance as every physical disk
drive handles only a part of the workload related to write and read
operations. Each consecutive physical drive included in this type of
array improves the speed of read/write operations by adding more hardware
resources to handle decreasing amount of workload. The main disadvantage
of RAID 0 is that it doesn't offer any fault tolerance. Each of the
drives holds only part of the information and in case of failure of any
of the drives there is no way to rebuild the array which in turn results
in the loss of all data. RAID 0 requires minimum of two disk drives to
implement.
7. Answer: A. VLAN
Explanation: Virtual Local Area Network (VLAN) is a logical grouping of
computers that may be physically located on different parts of a LAN.
VLANs allow computer hosts to act as if they were attached to the same
broadcast domain, regardless of their physical location. VLAN membership
can be configured through software instead of physically relocating
devices or connections, and VLANs are often created with the use of
switches equipped with additional software features. By default, all
ports on a switch are typically labeled as VLAN1, and virtual networks
are created by changing this assignment (labeling one of the ports as
VLAN2, another as VLAN3, etc.). Multiple switches on a LAN can be
configured this way, and physically dispersed hosts that connect to e.g.
VLAN2 port on any of those switches become a part of a single logical
subnet.
8. Answer: C. SNMP community
Explanation: SNMP community is a group that consists of SNMP devices and
one or more SNMP managers. Simple Network Management Protocol (SNMP) is a
UDP-based, Application Layer protocol used in network management systems
to monitor network-attached devices. SNMP is typically integrated into
most modern network infrastructure devices such as routers, bridges,
switches, servers, printers, copiers, fax machines, and other network-
attached devices. An SNMP-managed network consists of three key
components: a managed device, a network-management software module that
resides on a managed device (Agent), and a network management system
(NMS) which executes applications that monitor and control managed
devices and collect SNMP information from Agents. All SNMP-compliant
devices include a virtual database called Management Information Base
(MIB) containing information about configuration and state of the device
that can be queried by the SNMP management station. The manager receives
notifications (Traps and InformRequests) on UDP port 162. The SNMP Agent
receives requests on UDP port 161, and before answering a request from
SNMP manager, SNMP Agent verifies that the manager belongs to an SNMP
community with access privileges to the Agent. An SNMP community is a
group that consists of SNMP devices and one or more SNMP managers. The
community has a name, and all members of a community have the same access
privileges. An SNMP device or Agent may belong to more than one SNMP
community and it will not respond to requests from management stations
that do not belong to one of its communities. The relationship between
SNMP server system and the client systems is defined by the so called
community string which acts like a password. In terms of security, SNMP
version 1 and version 2 offer only authentication based on community
strings sent in cleartext. SNMPv3 provides authentication, packet
encryption, and hashing mechanisms that allow for checking whether data
has changed in transit.
9. Answers: B and D. Switch ports and MAC address
Explanation: VLAN membership can be set either through switch ports where
a device connecting to a certain switch port automatically becomes a
member of the VLAN assigned to that port (static VLAN), or through
mapping the VLAN membership with the MAC address of the device connected
to the port (dynamic VLAN). Dynamic VLANs are configured through the use
of server software that relies on a database containing MAC-address-to-
VLAN mappings. When a device connects to the dynamic port on a switch its
MAC address is sent to the server, and if the matching entry in its
database is found the server sends the VLAN number for that port.
10. Answer: D. DMZ
Explanation: Demilitarized Zone (DMZ) is a lightly protected subnet
placed on the outside of the company's firewall consisting of publicly
available servers. The purpose of DMZ is to offer services, such as web
browsing, FTP, or e-mail, to both the public and internal clients without
compromising the security of the private LAN.
11. Answer: D. DDoS
Explanation: As opposed to the simple Denial of Service (DoS) attacks
that usually are performed from a single system, a Distributed Denial of
Service (DDoS) attack uses multiple compromised computer systems to
perform attack against its target. The intermediary systems that are used
as platform for the attack are the secondary victims of the DDoS attack;
they are often referred to as zombies, and collectively as a botnet. The
goal of DoS and DDoS attacks is to flood the bandwidth or resources of a
targeted system so that it becomes overwhelmed with false requests and in
result doesn't have time or resources to handle legitimate requests.
12. Answer: A. Preventing someone from denying that they took a specific
action
Explanation: The purpose of non-repudiation is to prevent someone from
denying that they take a specific action.
13. Answer: C. UAT
Explanation: User Acceptance Testing (UAC) is one of the testing stages
in the software development process performed by customers or end users.
14. Answer: C. Vishing
Explanation: The practice of using a telephone system to manipulate a
user to disclose confidential information is called vishing. Vishing
falls into the category of social engineering attacks.
15. Answers: A, D, and E. Whaling, Vishing, and Spear phishing
Explanation: Social engineering techniques are aimed at manipulating
people into performing actions they are not authorized to perform or
disclosing confidential information. Whaling, vishing, and spear phishing
are all examples of social engineering techniques.
16. Answer: B. Bluejacking
Explanation: Sending unsolicited messages over Bluetooth is also referred
to as bluejacking.
17. Answer: B. Bluesnarfing
Explanation: Gaining unauthorized access to a Bluetooth device is also
referred to as bluesnarfing.
18. Answer: C. TPM
Explanation: Trusted Platform Module (TPM) is a specification, published
by the Trusted Computing Group (TCG), for a microcontroller that can
store secured information, and also the general name of implementations
of that specification. Trusted Platform Modules are hardware based
security microcontrollers that store keys, passwords and digital
certificates and protect this data from external software attacks and
physical theft. TPMs are usually embedded on the motherboard of a
personal computer or laptop, but they can also be used in other devices
such as mobile phones or network equipment.
19. Answer: B. Spear phishing
Explanation: Phishing is a fraudulent attempt to trick a user, usually
via e-mail message, into disclosing personal information. Phishing scams
targeting a specific group of users are also referred to as spear
phishing. Spear phishing scams that go one step further by targeting
people holding high positions in an organization or business are also
known as whaling.
20. Answer: A. Spim
Explanation: Unsolicited messages received over an instant messaging
system are commonly referred to as spim.
21. Answer: D. Marking unsecured wireless networks
Explanation: The practice of marking symbols in public places that
indicate the presence of an unsecured wireless connection is also
referred to as war chalking.
22. Answer: C. HSM
Explanation: Hardware Security Module (HSM) is a piece of hardware and
associated software/firmware that usually attaches to the inside of a PC
or server and provides at least the minimum of cryptographic functions.
These functions include (but are not limited to) encryption, decryption,
key generation, and hashing.
23. Answer: C. NAT
Explanation: Network Address Translation (NAT) is a technology that
provides an IP proxy between a private LAN and a public network such as
the Internet. Computers on the private LAN can access the Internet
through a NAT-capable router which handles the IP address translation.
NAT hides the internal IP addresses by modifying IP address information
in IP packet headers while in transit across a traffic routing device.
24. Answer: B. ALE
Explanation: Annualized Loss Expectancy (ALE) is a risk assessment
formula defining probable financial loss due to a risk over a one-year
period. It is defined as:
Annualized Loss Expectancy (ALE) = Annual Rate of Occurrence (ARO) x
Single Loss Expectancy (SLE)
25. Answer: A. Logic bomb
Explanation: Malicious code activated by a specific event is also known
as logic bomb.
26. Answers: B, D, and E. Encryption and passwords, Remote sanitation,
and Voice encryption
Explanation: Security measures that can be applied to mobile devices
include device encryption, strong passwords, remote sanitation feature,
and voice encryption. Remote sanitation allows for sending a signal that
will trigger wiping all the data on the phone. Stolen or lost device can
also be located with the use of General Positioning System (GPS) tracking
feature.
27. Answer: D. 88
Explanation: Port number 88 is used by the Kerberos authentication
protocol. Port 22 is used by Secure Shell (SSH). Port 23 is used by
Telnet. HyperText Transfer Protocol (HTTP) uses port number 80.
28. Answer: C. Hash functions
Explanation: SHA and MD5 are examples of hash functions.
29. Answer: C. CHAP
Explanation: Challenge Handshake Authentication Protocol (CHAP) is a
remote access authentication protocol that periodically reauthenticates a
client at random intervals in order to prevent session hijacking.
30. Answer: A. Tunnel
Explanation: IPsec can be implemented in a host-to-host transport mode
(where only the payload of the IP packet is usually encrypted and/or
authenticated) or in a network tunnel mode (where the entire IP packet is
encrypted and/or authenticated).
31. Answer: B. AUP
Explanation: Acceptable Use Policy (AUP) is a set of rules enforced in a
network that restrict the use to which the network may be put.
32. Answer: A. Botnet
Explanation: A group of computers running malicious software under
control of a hacker is also referred to as botnet.
33. Answer: B. DLP
Explanation: Data Loss Prevention (DLP) solutions are software or
hardware based security solutions designed to detect and prevent
unauthorized use and transmission of confidential information outside of
a corporate network.
34. Answer: C. Black box testing
Explanation: Testing a computer system without the prior knowledge on how
the system works is also known as black box testing.
35. Answer: D. Fuzzing
Explanation: Finding vulnerability in an application by feeding it
incorrect input is also known as fuzzing, or fuzz test.
36. Answer: C. Fingerprint scanner
Explanation: In computer security, user's identity can be verified either
by examining something that the user knows (a user name or password),
something that the user has (a physical object such as smart card), or
something that the user is (unique trait of every single person such as
finger print or pattern of a human eye iris). Biometric authentication
systems are based on examining the unique traits of a user and
fingerprint scanner is an example of a biometric device.
37. Answer: A. Password and biometric scan
Explanation: Authentication is proving user identity to a system.
Authentication process can be based on three categories of authentication
factors: user names and passwords (something that the user knows),
physical tokens such as smart cards (something that the user has), or
unique traits of every single person, such as fingerprints (fingerprint
scanner). Multi-factor authentication requires authentication factors
from two or more different categories.
38. Answer: A. Hiding data within another piece of data
Explanation: Steganography allows for hiding data within another piece of
data.
39. Answer: D. 128 bits
Explanation: An IPv6 addresses consist of 128 bits compared to 32 bits in
IPv4. IPv6 addresses are written in eight groups of four hexadecimal
digits separated by colons (IPv4 addresses are made of four groups of
decimal digits separated by dots).
40. Answer: B. PII
Explanation: Personally Identifiable Information (PII) includes any type
of information pertaining to an individual that can be used to uniquely
identify that individual. Identity of a person can be established by
tracing their most basic attributes such as name, surname, phone number
or traditional mailing address, but also through their social security or
credit card numbers, IP or email addresses, or data collected via
biometric devices. Security of Personally Identifiable Information has
become major concern for companies and organizations due to the
accessibility of this type of data over the Internet, but also due to
misuse of personal electronic devices such as USB drives or smartphones
that are easily concealable and can carry large amounts of data.
41. Answer: C. Evil twin
Explanation: Evil twin is another term for a rogue access point. Rogue
access point will have the same network name as the legitimate access
point and can be set up by a hacker in order to steal user credentials or
for the purpose of traffic eavesdropping.
42. Answers: A and D. Virus signature updates and Engine updates
Explanation: Antivirus software can be kept up to date through virus
signature updates and engine updates. Engine updates equip the antivirus
application with tools to recognize and remove new malware types, virus
signature updates add new malicious code patterns to the virus database
used by the antivirus application as a reference for malware scanning.
43. Answer: D. MAC
Explanation: Mandatory Access Control (MAC) is an access control model
where every resource has a sensitivity label matching a clearance level
assigned to a user (in order to be able to access the resource, user's
clearance level must be equal or higher than the sensitivity level
assigned to the resource). With mandatory access control users cannot set
or change access policies at their own discretion; labels and clearance
levels can only be applied and changed by an administrator.
44. Answer: C. STP
Explanation: Spanning Tree Protocol (STP) is used to prevent switching
loops. Switching loop occurs when there's more than one active link
between two network switches, or when two ports on the same switch become
connected to each other.
45. Answer: C. Telnet
Explanation: TCP port 23 is used by Telnet.
46. Answer: A. Chain of custody
Explanation: A chronological record outlining persons in possession of an
evidence is also referred to as chain of custody. Chain of custody is
used to ensure that the evidence hasn't been tampered with on its way
from collection to the presentation in a court of law.
47. Answer: B. Clean desk policy
Explanation: Sticky note with a password kept on sight in the user's
cubicle would be a violation of clean desk policy. From the security
standpoint, "clean desk" means user area organized in a way that
minimizes the risk of disclosure of sensitive data.
48. Answer: C. Privacy policy
Explanation: A policy outlining ways of collecting and managing personal
data is also known as privacy policy.
49. Answer: D. HVAC
Explanation: Heating, Ventilation, and Air Conditioning (HVAC) systems
are used for controlling temperature and humidity.
50. Answer: A. Recovery Time Objective (RTO)
Explanation: A maximum acceptable period of time within which a system
must be restored after failure is also known as Recovery Time Objective
(RTO). RTOs are established at the Business Impact Analysis (BIS) stage
of the Business Continuity Planning (BCP). The goal of a Business Impact
Analysis is to determine the impact of any disruption of the activities
that support the organization's key products and services. A key aspect
of determining the impact of a disruption is identifying the so called
Maximum Tolerable Period of Disruption (MTPOD), which is the maximum
amount of time that an enterprise's key products or services can be
unavailable or undeliverable after an event that causes disruption to
operations. The goal of Recovery Time Objective is to ensure that the
Maximum Tolerable Period of Disruption (MTPD) for each activity is not
exceeded.
51. Answer: D. AES
Explanation: Confidentiality is achieved by encrypting data so that it
becomes unreadable to anyone except the person with the decryption key.
Advanced Encryption Standard (AES) is one of the encryption techniques
used in computer security providing data confidentiality.
52. Answers: C and D. Kerberos and CHAP
Explanation: A replay attack occurs when an attacker intercepts user
credentials and tries to use this information later for gaining
unauthorized access to resources on a network. Kerberos and Challenge
Handshake Authentication Protocol (CHAP) are authentication protocols
offering countermeasures against replay attacks. Kerberos supports a
system of time stamped tickets that grant access to resources and expire
after a certain period of time. CHAP prevents replay attacks by
periodically reauthenticating clients during session.
53. Answers: C and E. SHA-1 and MD5
Explanation: Secure Hash Algorithm (SHA) and Message Digest (MD) are a
series of hashing functions used for checking data integrity (SHA-1 and
MD5 are the most popular versions).
54. Answers: A, B, and E. AES, DES, and 3DES
Explanation: Advanced Encryption Standard (AES), Data Encryption Standard
(DES), and Triple DES (3DES) are all examples of symmetric-key
algorithms. Rivest-Shamir-Adleman (RSA) and Diffie-Hellman are asymmetric
cryptography solutions.
55. Answers: A, D, and E. RAID 5, RAID 1, and Hot site
Explanation: Availability provides assurance that resources can be used
when needed. Redundant Array of Independent Disks (RAID) is a collection
of different data storage schemes (referred to as RAID levels) that allow
for combining multiple hard disks into a single logical unit in order to
increase fault tolerance and performance. RAID levels increase
availability allowing the system to remain operational even when one of
its components (hard drives) fails (this applies to all RAID levels
except RAID 0 which doesn't provide any fault tolerance). Hot site is an
alternate site where a company can move its operations in case of failure
of the main site.
56. Answer: B. Port-based network access control
Explanation: 802.1x is an IEEE standard for port-based network access
control (sometimes confused with 802.11x, which is a general term for a
family of wireless networking standards).
57. Answer: D. Exception
Explanation: Allowing a program through a firewall is also known as
creating an exception.
58. Answer: C. Deny all traffic
Explanation: The last default rule on a firewall is to deny all traffic
that comes from a source not listed on the firewall's Access Control List
(ACL).
59. Answer: D. SSH
Explanation: Secure Shell (SSH) is a tunneling protocol for secure remote
login and other secure network services designed as a replacement for
Telnet and other insecure remote shells.
60. Answers: B, D, and E. SSH, SCP, and SFTP
Explanation: Secure Shell (SSH) runs by default on the TCP port 22. Apart
from providing the ability to log in remotely and execute commands on a
remote host, SSH is also used for secure file transfer through the SSH-
based protocols such as Secure Copy (SCP) or SSH File Transfer Protocol
(SFTP).
61. Answers: A, C, and E. 137, 138, and 139
Explanation: Network Basic Input / Output System (NetBIOS) is a name
resolution service used in Local Area Networks (LANs). NetBIOS uses ports
137, 138, and 139. Ports 161 and 162 are reserved for the Simple Network
Management Protocol (SNMP).
62. Answer: C. Memory dump, temporary files, disk files, archival media
Explanation: Order of volatility refers to a sequence of steps in which
different types of evidence should be collected. To preserve the order of
volatility while collecting an evidence traces that can be easily lost
(such as contents of the memory which are erased after powering the
system down) should be collected first.
63. Answer: D. Whaling
Explanation: Phishing is a fraudulent attempt to trick a user, usually
via e-mail message, into disclosing personal information. Phishing scams
targeting a specific group of users are also referred to as spear
phishing. Spear phishing scams that go one step further by targeting
people holding high positions in an organization or business are also
known as whaling.
64. Answer: B. Privacy screen
Explanation: Privacy screen (also privacy filter) is a protective overlay
placed on the screen that narrows the viewing angle so data is only
visible directly in front of the monitor and cannot be seen by others
nearby. Privacy screen is one of the countermeasures against shoulder
surfing.
65. Answers: C and E. Privacy filters and Screensavers
Explanation: Privacy filters and password protected screensavers are
examples of countermeasures against shoulder surfing (looking over
someone's shoulder in order to get information).
66. Answer: A. Gaining unauthorized access to restricted areas by
following another person
Explanation: The practice of gaining unauthorized access to restricted
areas by following another person is called tailgating.
67. Answer: B. Scanning for unsecured wireless networks while driving in
a car
Explanation: The term war driving refers to scanning for unsecured
wireless networks while driving in a car. Marking symbols in public
places that indicate the presence of an unsecured wireless connection is
known as war chalking.
68. Answer: B. DAC
Explanation: Discretionary Access Control (DAC) is an access control
method based on user identity. In DAC, every object has an owner who at
his/her own discretion determines what kind of permissions other users
can have to that object.
69. Answer: D. Rule-Based Access Control
Explanation: Rule Based Access Control (RBAC) is an access control model
in which access to resources is granted or denied depending on Access
Control List (ACL) entries. An ACL specifies which users or system
processes are granted access to objects, as well as what operations are
allowed on given objects. Each entry in a typical ACL specifies a subject
and an operation. When a subject requests an operation on an object in an
ACL-based security model, the operating system first checks the ACL for
an applicable entry to decide whether the requested operation is
authorized. In computer networks, Rule-Based Access Control model is
usually implemented in network devices such as firewalls in order to
control inbound and outbound traffic based on filtering rules.
70. Answers: D and E. Logging and Sending an alert
Explanation: Intrusion Detection Systems (IDSs) rely on passive response
which might include recording an event in logs or sending a notification
alert. An IDS doesn't take any active steps in order to prevent an
intrusion.
71. Answers: C and D. Smart card and Issued by United States Department
of Defense (DoD)
Explanation: Common Access Card (CAC) is a type of smart card issued by
the United States Department of Defense for military and non-military
personnel.
72. Answer: A. SSO
Explanation: An authentication subsystem that enables a user to access
multiple, connected system components (such as separate hosts on a
network) after a single login at only one of the components is also
referred to as Single Sign-On (SSO). A single sign-on subsystem typically
requires a user to log in once at the beginning of a session, and then
during the session grants further access to multiple, separately
protected hosts, applications, or other system resources, without further
login action by the user.
73. Answer: B. Key escrow
Explanation: Key escrow is a storage solution used to retain copies of
private encryption keys.
74. Answer: B. Recovery agents
Explanation: Copies of lost private encryption keys can be retrieved from
key escrow by recovery agents. Recovery agent is an individual with
access to key database and permission level allowing him/her to extract
keys from escrow.
75. Answer: C. Vulnerability that is present in already released software
but unknown to the software developer
Explanation: Zero-day attack exploits a vulnerability that is present in
already released software but unknown to the software developer.
76. Answer: A. NIPS
Explanation: Network Intrusion Prevention system (NIPS) inspects network
traffic in real-time and has the capability to stop the attack.
77. Answer: A. SYN flood
Explanation: A type of attack exploiting the TCP three-way handshake
process is also known as SYN flood attack. Three-way handshake is used
for connections over TCP and ends with an ACK packet sent from a client
to a server confirming that the connection has been established. SYN
flood attack skips this step forcing the server to use up resources in
order to handle multiple half-open connections eventually making it
unable to process legitimate requests. SYN flood is a type of Denial-of-
Service (DoS) attack.
78. Answer: D. AD-IDS
Explanation: Anomaly-Detection Intrusion Detection System (AD-IDS) relies
on the previously established baseline of normal network activity in
order to detect intrusions. A Signature-based IDS relies on known attack
patterns to detect an intrusion.
79. Answer: B. NAC
Explanation: Network Access Control (NAC) defines a set of rules enforced
in a network that the clients attempting to access the network must
comply with. With NAC, policies can be enforced before or after end-
stations gain access to the network. NAC can be implemented as Pre-
admission NAC, where a host must, for example, be virus free or have
patches applied before it is allowed to connect to the network, and/or
Post-admission NAC, where a host is being granted/denied permissions
based on its actions after it has been provided with the access to the
network.
80. Answer: C. Tunneling
Explanation: Virtual Private Network (VPN) is a logical, restricted-use
network created with the use of encryption and tunneling protocols over
physical, public network links. VPN users can connect securely to a
private LAN over unsecure public links thanks to the tunneling protocols
that provide link encryption.
81. Answer: D. Protocol analyzer
Explanation: Packet sniffer is a common term for protocol analyzer.
82. Answers: B and E. 20 and 21
Explanation: File Transfer Protocol (FTP) is an unencrypted file exchange
protocol. FTP employs TCP ports 20 and 21. Connection established over
TCP port 20 (the data connection) is used for exchanging data, connection
made over TCP port 21 (the control connection) remains open for the
duration of the whole session and is used for session administration
(commands, identification, passwords, etc.).
83. Answer: C. White box
Explanation: Penetration test of a computer system with the prior
knowledge on how the system works is also known as white box testing.
84. Answers: C and D. IDS and Video surveillance
Explanation: Intrusion Detection System (IDS) and video surveillance are
examples of detective security controls. Intrusion Prevention System
(IPS) and Security guard are examples fall into the category of
preventative controls.
85. Answer: A. 443
Explanation: HTTPS runs on TCP port 443. HTTPS supports encryption and
can use either Secure Sockets Layer (SSL) or Transport Layer Security
(TLS) protocol for securing web traffic.
86. Answers: A and D. Dumpster diving and Social engineering
Explanation: Dumpster diving is a practice of sifting through trash for
discarded documents containing sensitive data. Documents containing names
and surnames of the employees along with the information about positions
held in the company and other data can be used to facilitate social
engineering attacks. Having the documents shredded or incinerated before
disposal makes dumpster diving less effective and also mitigates the risk
of social engineering attacks.
87. Answer: B. Asymmetric encryption
Explanation: Public/private key pair is a feature of asymmetric
encryption.
88. Answer: C. Patch management
Explanation: Coding errors and security vulnerabilities in software that
has already been released can be rectified through patch management.
89. Answers: A, C, and D. Bypasses security controls, Actively tests
security controls, and Exploits vulnerabilities
Explanation: Penetration testing bypasses security controls and actively
tests security controls by exploiting vulnerabilities. Passive testing of
security controls, identification of vulnerabilities and missing security
controls or common misconfigurations are the features of a vulnerability
scan.
90. Answer: B. OCSP
Explanation: Online Certificate Status Protocol (OCSP) allows for
querying Certificate Authority (CA) for validity of a digital
certificate. Another solution for checking whether a certificate has been
revoked is Certificate Revocation List (CRL). CRLs are updated regularly
and sent out to interested parties. Compared to CRL, OCSP allows for
querying the CA at any point in time and retrieving information without
any delay.
91. Answer: D. With enhanced security measures
Explanation: The term Trusted OS refers to an operating system with
enhanced security features. The most common access control model used in
Trusted OS is Mandatory Access Control (MAC). Examples of Trusted OS
implementations include Security Enhanced Linux (SELinux) and FreeBSD
with the TrustedBSD extensions.
92. Answer: C. Honeypot
Explanation: A monitored host or network specifically designed to detect
unauthorized access attempts is also known as a honeypot. This type of
system contains no valuable data and is used to divert the attacker's
attention from the corporate network. Multiple honeypots set up on a
network are known as a honeynet.
93. Answer: A. Trojan horse
Explanation: Software that performs unwanted and harmful actions in
disguise of a legitimate and useful program is also referred to as a
Trojan horse. This type of malware may act like a legitimate program and
have all the expected functionalities, but apart from that it will also
contain a portion of malicious code appended to it that the user is
unaware of.
94. Answers: A, C, and E. Mantrap, Access list, and Hardware lock
Explanation: Mantraps, physical access lists, and hardware locks fall
into category of physical security measures. Mantraps are two-door
entrance points connected to a guard station. A person entering mantrap
from the outside remains inside until he/she provides authentication
token required to unlock the inner door. Physical access lists allow
guards to check credentials of people entering the facility and also to
record and compare the number of people who have entered and left the
premises.
95. Answers: A and C. Asymmetric encryption and Suitable for small
wireless devices
Explanation: Elliptic Curve Cryptography (ECC) is a type of asymmetric
encryption. ECC provides strong encryption while requiring less
processing power than other encryption methods which makes it suitable
for small wireless devices such as handhelds and cell phones.
96. Answer: A. PGP
Explanation: Pretty Good Privacy (PGP) allows for encryption of e-mail
messages. PGP can also be used to digitally sign e-mails.
97. Answer: A. PBX
Explanation: Phreaking refers to the exploitation of telecommunications
systems. Private Branch Exchange (PBX) system is a private telephone
network used within an enterprise. PBX systems can be compromised through
phreaking.
98. Answer: D. PED
Explanation: Personal Electronic Device (PED) is a lightweight consumer
electronic devices that include mobile phones, Personal Digital
Assistants (PDAs), laptops and tablets, digital cameras, portable game
consoles, optical media players, MP3 players, USB drives, calculators,
earphones, and other lightweight portable electronic devices.
99. Answers: A, B, and D. Is a symmetric encryption algorithm, Uses 128-,
192-, and 256-bit keys, and Uses block cipher algorithm
Explanation: Advanced Encryption Standard (AES) is a strong symmetric
encryption algorithm. AES uses block cipher algorithm with the block size
of 64 bits (compared to stream ciphers which process data by encrypting
individual bits, block cipher divides data into separate fragments and
encrypts each fragment separately). AES uses 128-, 192-, and 256-bit
encryption keys.
100. Answer: C. RC4
Explanation: Rivest Cipher 4 (RC4) is a symmetric stream cipher. Advanced
Encryption Standard (AES), Data Encryption Standard (DES) and Triple DES
(3DES) are all block ciphers. RC4 is used in Wired Equivalent Privacy
(WEP) standard for wireless encryption and Secure Sockets Layer (SSL) for
Internet traffic encryption.
Recommended