1202 PE's 2

Multiple users with identical hardware report screens filled with static when moving their mouse. All systems received security patches and updates last night. What action should you take?

• Disable the DirectX service in services.msc

• Reboot the system into Safe Mode and allow the user to continue their work

• Rollback the video card driver and wait for a new driver to be released

• Use SFC to ensure all system files are correct and not corrupted

• Rollback the video card driver and wait for a new driver to be released

Since the issue first appears after the systems received their latest security patch and updates, the video card driver was likely updated last night. Therefore, you should roll back the driver and verify that this solves the issue. If it does, then you should wait for a new version of the video card driver to be released by the manufacturer or submit a trouble ticket to the manufacturer to let them know there is an issue with their current driver's version. According to the CompTIA Troubleshooting Methodology, you should always question the obvious and ask yourself what has recently changed.

Which of the following authentication protocols was developed by Cisco to provide authentication, authorization, and accounting services?

• Kerberos

• TACACS+

• CHAP

• RADIUS

• TACACS+

TACACS+ is an extension to TACACS (Terminal Access Controller Access Control System) and was developed as a proprietary protocol by Cisco. The Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that operates on port 1812 and provides centralized Authentication, Authorization, and Accounting management for users who connect and use a network service, but Cisco did not develop it. Kerberos is a network authentication protocol designed to provide strong mutual authentication for client/server applications using secret-key cryptography developed by MIT. Challenge-Handshake Authentication Protocol (CHAP) is used to authenticate a user or network host to an authenticating entity. CHAP is an authentication protocol but does not provide authorization or accounting services.

During the reconnaissance phase of a penetration test, you have determined that your client's employees all use Android smartphones that connect back to the corporate network over a secure VPN connection. Which of the following methods would MOST likely be the best method for exploiting these?

• Use a tool like ICSSPLOIT to target specific vulnerabilities

• Use web-based exploits against the device's web interfaces

• Identify a jailbroken device for easy exploitation

• Use social engineering to trick a user into opening a malicious APK

• Use social engineering to trick a user into opening a malicious APK

When targeting mobile devices, you must first determine if the company uses iPhones or Android-based devices. If they are using Android-based devices, you can use social engineering to trick a user into installing a malicious APK. As a penetration tester, you can create a malicious APK using msfvenom in the Metasploit framework. The user can install it directly from your website instead of the Google Play store.

Whenever you reboot your domain controller, you notice it takes a very long time to boot up. As the server is booting, you hear noises that sound like a steady series of clicks coming from the hard drive. Which of the following is the BEST action to help speed up the boot time of the server?

• Terminate processes in the Task Manager

• Defragment the hard drive

• Remove unnecessary applications from startup

• Perform a Disk Cleanup

• Defragment the hard drive

OBJ 3.1: Defragging is a simple process when file fragments are put together to speed up file access. File fragments are put together, and quality defragmentation utilities also assemble the free space into a single block to prevent future fragmentation. By defragmenting the hard drive, the server doesn't have to spend as much time accessing the information, and it can boot up faster. Based on the clicking noises, it sounds like the system has to access many parts of the drive to load the files. 

Which of the following security controls provides Windows system administrators with an efficient way to deploy system configuration settings across many devices?

• HIPS

• Patch Management

• Anti-Malware

• GPO

GPO

Microsoft's Group Policy Object (GPO) is a collection of Group Policy settings that defines what a system will look like and how it will behave for a defined group of users. A Group Policy is the primary administrative tool for defining and controlling how programs, network resources, and the operating system operate for users and computers in an organization. In an active directory environment, Group Policy is applied to users or computers based on their membership in sites, domains, or organizational units. A host-based intrusion prevention system (HIPS) is a device or software application that monitors a system for malicious activity or policy violations. Any malicious activity or violation is prevented and reported. Anti-malware software is a program that scans a device or network for known viruses, Trojans, worms, and other malicious software. Patch management is the process of distributing and applying updates to the software to prevent vulnerabilities from being exploited by an attacker or malware. Proper patch management is a technical control that would prevent future outbreaks.

What anti-malware solution is installed as a dedicated on-premise appliance to scan all incoming traffic and prevent malware from being installed on any of your clients without requiring the installation of any software on your clients?

• Cloud-based anti-malware

• Network-based anti-malware

• Signature-based anti-malware

• Host-based anti-malware

• Network-based anti-malware

The network-based anti-malware can help prevent malware attacks by scanning all incoming data to prevent malware from being installed and infecting a computer. Network-based anti-malware solutions can be installed as a rack-mounted, in-line network appliance in your company's on-premise datacenter to protect every client and server on the network without having to install software on each of the clients. Network-based anti-malware solutions often come as part of a unified threat management (UTM) appliance. Cloud antivirus is a programmatic solution that offloads antivirus workloads to a cloud-based server, rather than bogging down a user's computer with a complete antivirus suite. Cloud-based solutions do not use on-premise appliances as part of their installation. Host-based anti-malware relies upon the installation of an agent to detect threats such as viruses, spam, and rootkits to protect the client it is installed upon. Host-based malware often uses signatures to detect and remove malicious code. Signature-based anti-malware is a generic category of malware that may be implemented through host-based, network-based, or cloud-based anti-malware solutions. Anti-malware either operates using signature-based detection, behavioral-based detection, or heuristic-based detection.

A company has had several virus infections over the past few months. The root cause was determined to be known vulnerabilities in the software applications in use by the company. What should an administrator implement to prevent future outbreaks?

• Host-based intrusion detection systems

• Acceptable use policies

• Incident response team

• Patch management

Patch management

Since the viruses exploited known vulnerabilities, there should be patches available from the manufacturer/vendor. Patch management is the process of distributing and applying updates to the software to prevent vulnerabilities from being exploited by an attacker or malware. Proper patch management is a technical control that would prevent future outbreaks. An acceptable use policy (AUP) is a document stipulating constraints and practices that a user must agree to for access to a corporate network or the Internet. While some items in the AUP might help prevent a malware infection (such as not allowing users to download and run programs from the internet), it is considered an administrative control, and choosing a technical control like patch management would better protect the network. An incident response team or emergency response team is a group of people who prepare for and respond to any emergency incident, such as a natural disaster or an interruption of business operations. An incident response team will respond to the virus infections, but they would not prevent them from occurring. Host-based intrusion detection systems (HIDS) help organizations to identify threats inside the network perimeter by monitoring host devices for malicious activity that, if left undetected, could lead to serious breaches. A HIDS may detect the effects of a virus infection, such as a client becoming a zombie in a botnet, but it will not prevent these outbreaks from occurring.

A user reports they can't access websites. You want to figure out whether the problem is with their internet connection or specifically with DNS resolution. Which of the following would be the best IP address to ping to determine the problem?

• 169.254.12.64

• 192.168.1.123

• 172.30.15.12

• 8.8.8.8

8.8.8.8

8.8.8.8 is Google's public DNS server, which is a well-known, reliable external IP address on the internet. Pinging this address tests whether the user has working internet connectivity. 169.254.12.64 is an APIPA (Automatic Private IP Addressing) address which are self-assigned when a device cannot obtain an IP address from a DHCP server. Pinging an APIPA address would only test local link connectivity, not internet connectivity, and wouldn't help diagnose the DNS issue. 172.30.15.12 and 192.168.1.123 are private IP addresses. Pinging a private IP only tests connectivity within the local network, not to the internet and wouldn't help determine if the problem is with internet connectivity or DNS resolution.

A user with an older laptop running Windows 7 that has only 2 GB of RAM, 32 GB of SSD, and a 1.7 GHz 64-bit processor. The user would like to upgrade to a newer OS since Windows 7 is now considered end-of-life. Which of the following operating systems should the technician recommend to ensure the BEST performance on this computer?

• Windows 8.1

• Windows 10

• Windows 8

• Windows 11

Windows 10

The user should update their laptop to Windows 10 since it is not considered end-of-life yet and will support being installed on a laptop with only 2 GB of RAM. Windows 10 minimum requirements for a 32-bit operating system are a 1 GHz processor, 1 GB of RAM, and at least 32 GB of hard drive space. Windows 10 minimum requirements for a 64-bit operating system are a 1 GHz processor, 2 GB of RAM, and at least 32 GB of hard drive space. Windows 11 requires a 1 GHz processor, 4 GB of RAM, and 64 GB of hard drive space. Windows 8 and Windows 8.1 are considered end-of-life and should not be installed.

Dion Training needs an open wireless network for instructors to use IoT devices that don't support encryption, but wants to prevent students from connecting to the IoT devices. Which configuration setting would BEST meet these requirements?

• MAC filtering

• Signal Strength

• QoS

• NAT

MAC filtering

OBJ 2.10: Since the instructors need to keep the wireless network open, the BEST option is to implement MAC filtering to prevent the students from connecting to the network while still keeping the network open. Since the instructors would most likely use the same devices to connect to the network, it would be relatively easy to implement a MAC filtering based allow list of devices that are allowed to use the open network and reject any other devices not listed by the instructors (like the student's laptops or phones). Reducing the signal strength would not solve this issue since students and instructors are in the same classrooms. Using Network Address Translation and Quality of Service will not prevent the students from accessing or using the open network. 

Dion Training is worried about the security of the data on their corporate smartphones if lost or stolen. The Chief Security Officer has instructed that the devices be configured so that unauthorized users cannot access the data. Which TWO of the following settings would provide the BEST security and protection for the corporate smartphones' data?

• Require complex passwords

• Enable device lockouts after 3 failed attempts

• Enable a pattern lock

• Disable the installation of applications from untrusted sources

• Configure the ability to perform a remote wipe

• Enable full device encryption

• Configure the ability to perform a remote wipe

• Enable full device encryption

The BEST protections for the data would involve enabling full disk encryption and configuring the ability to perform a remote wipe. Even if the device is lost or stolen, its data would be unreadable if it was using full disk encryption. Additionally, by configuring the ability to wipe the device's storage remotely, the data would be erased before a thief can access it. The other options are all valid options to increase security, but they do not directly address the issues presented in the scenario.

You are renting space in another company's data center. To protect your server from being physically accessed when you are not in the building, what device should you use?

• USB lock

• Entry control roster

• Smart card

• Server lock

Server lock

A server lock is a physical locking mechanism installed on a server cabinet to prevent unauthorized from accessing the servers. The server lock could be a cipher lock, biometric lock, or a simple keyed lock depending on the level of security needed. USB lock prevents unauthorized data transfer through USB ports, reducing the risk of data leakage, data theft, computer viruses, and malware by physically locking and blocking the USB Ports. A smart card, chip card, PIV card, or integrated circuit card is a physical, electronic authorization device used to control access to a resource. It is typically a plastic credit card-sized card with an embedded integrated circuit chip. In high-security environments, employee badges may contain a smart card embedded chip that must be inserted into a smart card reader to log in or access information on the system. An entry control roster is an administrative control used to log each person who enters or leaves a secure room.

Which of the following regulations or standards protects applies to credit card transactions?

• PHI

• PII

• PCI DSS

• NIST

PCI DSS

PCI DSS is a set of standards that apply to credit card transactions. NIST (National Institute of Standards and Technology) is an organization which has developed frameworks for cybersecurity. PHI (Personal Health Information) refers to data retained by healthcare providers. PII (Personal Identifiable Information) is data that uniquely identifies individuals.

You attempt to boot a Windows 10 laptop and receive an "Operating System Not Found" error on the screen. You can see the hard disk listed in the EFI/BIOS of the system. Which of the following commands should you use to add the Windows installation to the boot manager?

• bootrec /rebuildbcd

• bootrec /fixmbr

• bootrec /fixboot

• diskpart list

• bootrec /rebuildbcd

The Boot Configuration Data (BCD) stores the list of known Windows installations that can be booted from a hard drive. If the Windows installation is not listed, the computer will be unable to boot into Windows. To add a missing Windows installation to the Boot Configuration Database (BCD), you should use the command "bootrec /rebuildbcd" and reboot the computer. If the disk cannot be detected, enter the system setup and try modifying settings (or even resetting the default settings). If the system firmware reports the disk's presence, but Windows still will not boot, use a startup repair tool to open a recovery mode command prompt and use the bootrec tool to repair the drive's boot information. The "bootrec /fixmbr" command is used to attempt a repair of the master boot record of a drive. The "bootrec /fixboot" command is used to attempt a repair of the boot sector of a drive. The diskpart command is a command-line disk-partitioning utility available for Windows that is used to view, create, delete, and modify a computer's disk partitions.

A user needs to upgrade from Windows 10 to Windows 11 while preserving all applications, user profiles, documents, and PST files. Which installation type should you use?

• Clean installation

• Repair upgrade

• Unattended installation

• In-place upgrade

In-place upgrade

OBJ 1.2: An in-place upgrade will preserve all of the user's files and applications during the upgrade process from Windows 10 to Windows 11. An in-place upgrade is an installation of the new operating system on top of an existing version of the operating system. An in-place upgrade will preserve the applications, user settings, and data files that already exist on the computer. A clean install is an installation of the new operating system on a new computer or a computer that has been recently formatted. A clean install will completely replace the operating system software on the computer with the new operating system. During a clean install, all of the user’s data, settings, and applications will be deleted. An unattended installation is a software or operating system installation where the configuration information is derived from an input file. Repair installation is a type of installation that attempts to replace the existing version of the operating system files with a new copy of the same version. A repair installation is useful when trying to repair a Windows computer that will not boot or when you believe the system files have become corrupted. 

Which of the following commands is used to edit a text file on a Linux server?

• grep

• nano

• pwd

• cat

nano

The nano utility is an easy-to-use command-line text editor for Linux systems. Nano includes the functionality of a regular text editor, as well as syntax highlighting, multiple buffers, search and replace with regular expression support, spellchecking, UTF-8 encoding, and more. The cat (short for “concatenate“) command is one of the most frequently used commands in Linux/Unix. The cat command allows the creation of single or multiple files, view file contents, concatenate files, and redirect output in the terminal to a file. The grep is a command-line utility for searching plain-text data sets for lines that match a regular expression. The grep command works on Unix, Linux, and macOS operating systems. Grep is an acronym that stands for Global Regular Expression Print. The pwd command displays the present working directory (current directory) path to the terminal or display. If you are working on a Linux system and are unsure of where you are in the directory structure, type "pwd" and hit enter to display the path to the screen.

Joanne is having a drink at a coffee shop near her office. She takes out her Windows 10 laptop and connects it to the coffee shop’s wireless network to check her email. Which type of network should she select to hide their computer from other devices on the network and prevent file sharing with other patrons of the coffee shop?

• private

• Home

• Public

• Work

Public

Joanne should select the public network type when connecting to this coffee shop's wireless network. The Network and Sharing Center in the Control Panel allows a technician to see information and modify the configuration settings of the network adapters in the workstation. The Network and Sharing Center is used to connect to a network using broadband, dial-up, or VPN connection, or add/remove file and printer sharing over the network on the workstation. When connecting to a network for the first time, the user must select if it is a public or private network. A public network will hide your computer from other devices on the network and prevent file and printer sharing. A private network is considered trusted, allows the computer to be discoverable to other devices on the network, and supports the use of file and printer sharing. In older versions of Windows, there were also Home and Work network types, but those have since been merged into public and private network types, as well.

Which type of installation would require an answer file to install the operating system?

• Clean

• Upgrade

• Unattended

• Repair

• Unattended

OBJ 1.2: An unattended installation is a traditional method of deploying a Windows operating system in a large enterprise environment. Unattended installations use an answer file that contains user input to various GUI dialog boxes that would otherwise appear during the installation process. Unattended installation is the most practical way to install Windows when the client computers have different hardware components, and an image file cannot be used. Unattended installations save deployment time and can be used either for clean installs or in-place upgrades. A clean install is a means of installing the operating system to a new computer or completely replacing the operating system on an old computer. All existing user data or settings will be deleted during the setup process when a clean installation is conducted. An in-place upgrade is a means of installing an operating system on top of an existing version of the operating system. Applications, user settings, and data files are retained when conducting an in-place upgrade. A repair is used to check and replace any modified system files within the operating system. 

Your company is setting up a system to accept credit cards in their retail and online locations. Which of the following compliance types should you be MOST concerned with dealing with credit cards?

• PHI

• PII

• GDPR

• PCI-DSS

PCI-DSS

The Payment Card Industry Data Security Standard (PCI-DSS) applies to companies of any size that accept credit card payments. If your company intends to accept card payment and store, process, and transmit cardholder data, you need to securely host your data and follow PCI compliance requirements. The General Data Protection Regulation (GDPR) is a regulation created in the European Union that creates provisions and requirements to protect the personal data of European Union (EU) citizens. Transfers of personal data outside the EU Single Market are restricted unless protected by like-for-like regulations, such as the US’s Privacy Shield requirements. Personally identifiable information (PII) is data used to identify, contact, or locate an individual. Information such as social security number (SSN), name, date of birth, email address, telephone number, street address, and biometric data is considered PII. Protected health information (PHI) refers to medical and insurance records, plus associated hospital and laboratory test results.

Which of the following types of installations would you use on a system with slow performance or one that you cannot isolate a single cause of the system's issues?

• Image deployment

• Repair installation

• Remote network installation

• In-place upgrade

Repair Installation

OBJ 1.2: Repair installation is a type of installation that attempts to replace the existing version of the operating system files with a new copy of the same version. A repair installation is useful when trying to repair a Windows computer that will not boot or when you believe the system files have become corrupted. An image deployment is a type of installation that uses a clone of an existing installation stored in an image file to perform the installation. The image can contain the base OS and configuration settings, service packs and updates, applications software, and whatever else is required. An image can be stored on DVD or USB media or can be accessed over a network. A remote network installation connects to a shared folder containing the installation files. During the remote network installation, the target PC will boot to a Preboot eXecution Environment (PXE) and then copy the files to a temporary location on its hard drive before fully installing them to the target PC. Most commonly, a remote network installation will be combined with an image deployment for a more efficient installation across the network. An in-place upgrade is an installation of the new operating system on top of an existing version of the operating system. An in-place upgrade will preserve the applications, user settings, and data files that already exist on the computer. 

Jason checks the Dion Training server room and finds that it currently has over 80% humidity. Which of the following risks to the servers could occur due to this high humidity level?

• Corrosion of the servers

• An under-voltage event

• An over-voltage event

• Accidental static discharge

Corrosion of the servers

When humidity is high, corrosion is the biggest threat. When humidity is high, the water in the air can react with the components in the servers and cause corrosion. When humidity is low, static electricity is built up and can lead to an accidental release which damages components. In a computer server room or work area, the humidity should be kept between 40-60% to prevent electrostatic discharge from low humidity and corrosion from high humidity. An electrostatic discharge (ESD) is the release of a charge from metal or plastic surfaces that occurs when a potential difference is formed between the charged object and an oppositely charged conductive object. This electrical discharge can damage silicon chips and computer components if they are exposed to it.

Which of the following file types are commonly used to create applications that can be run on Linux, macOS, and Windows?

.vbs

.sh

.ps1

.py

.py

Python is a general-purpose programming language that can develop many different kinds of applications. It is designed to be easy to read, and the programs use fewer lines of code compared to other programming languages. The code runs in an interpreter. Python is preinstalled on many Linux distributions and can be installed on Windows. Python scripts are saved using the .py extension. A shell script is a file that contains a list of commands to be read and executed by the shell in Linux and macOS. A .sh file is used for a shell script and its first line always begins with #!/bin/bash that designates the interpreter. This line instructs the operating system to execute the script. Shell scripts allow you to perform various functions. These functions include automation of commands and tasks of system administration and troubleshooting, creating simple applications, and manipulating text or files. VBScript is a scripting language based on Microsoft’s Visual Basic programming language. Network administrators often use VBScript to perform repetitive administrative tasks. With VBScript, you can run your scripts from either the command-line or the Windows graphical interface. Scripts that you write must be run within a host environment. Windows 10 provides Internet Explorer, IIS, and Windows Script Host (WSH) for this purpose. Windows PowerShell enables you to perform management and administrative tasks in Windows 7 and later. It is fully integrated with the operating system and supports both remote execution and scripting. Microsoft provides the Windows PowerShell Integrated Scripting Environment (ISE) to help create and manage your Windows PowerShell scripts. If you want to save a series of PowerShell commands in a file to rerun them later, you effectively create a PowerShell script by creating a text file with a .ps1 extension. The file can contain a series of PowerShell commands, with each command appearing on a separate line.

Every new employee at Dion Training must sign a document to show they understand the proper rules for using the company's computers. This document states that the new employee has read the policy that dictates what can and cannot be done from the corporate workstations. Which of the following documents BEST describes this policy?

MOU

SOW

AUP

SLA

AUP

An acceptable use policy (AUP) is a document stipulating constraints and practices that a user must agree to for access to a corporate network or the internet. For example, an AUP may state that they must not attempt to break any computer network security, hack other users, or visit pornographic websites from their work computer. A service level agreement (SLA) is a contract that outlines the detailed terms under which a service is provided, including reasons the contract may be terminated. A statement of work (SOW), or a scope of work, is a document that outlines all the work that is to be performed, as well as the agreed-upon deliverables and timelines. A memorandum of understanding (MOU) is a preliminary or exploratory agreement to express an intent to work together that is not legally binding and does not involve monetary exchange.

Which of the following commands can be used to install software on a Linux system?

• yum

• grep

• cat

• nano

yum

The yum command is a package manager used with RPM-based Linux distributions to install new software packages, remove existing software packages, upgrade existing software packages, and even upgrade the entire operating system. The cat (short for “concatenate“) command is one of the most frequently used commands in Linux/Unix. The cat command allows the creation of single or multiple files, view file contents, concatenate files, and redirect output in the terminal to a file. The nano utility is an easy-to-use command-line text editor for Linux systems. Nano includes the functionality of a regular text editor, as well as syntax highlighting, multiple buffers, search and replace with regular expression support, spellchecking, UTF-8 encoding, and more. The grep is a command-line utility for searching plain-text data sets for lines that match a regular expression. The grep command works on Unix, Linux, and macOS operating systems. Grep is an acronym that stands for Global Regular Expression Print.

Which of the following is considered a form of regulated data?

• PII

• DMCA

• AUP

• DRM

PII

The four forms of regulated data covered by the exam are PII (Personally Identifiable Information), PCI (Payment Card Industry), GDPR (General Data Protection Regulation), and PHI (Protected Health Information). Personally identifiable information (PII) is data used to identify, contact, or locate an individual. Information such as social security number (SSN), name, date of birth, email address, telephone number, street address, and biometric data is considered PII. An acceptable use policy (AUP) is a document stipulating constraints and practices that a user must agree to for access to a corporate network or the Internet. While some items in the AUP might help prevent a malware infection (such as not allowing users to download and run programs from the internet), it is considered an administrative control, and choosing a technical control like patch management would better protect the network. Digital rights management (DRM) is a copyright protection technology for digital media. DRM solutions usually try to restrict the number of devices allowed for playback of a licensed digital file, such as a music track or ebook. The Digital Millennium Copyright Act (DMCA) is a 1998 United States copyright law that implements two 1996 treaties of the World Intellectual Property Organization that criminalizes production and dissemination of technology, devices, or services intended to circumvent measures that control access to copyrighted works.

You're configuring a printer for a small office with 4 computers connected to a 4-port switch/router/modem with no open ports. The network has no servers or domain controller. Which method would BEST allow all computers to access the printer?

• Configure a print server and connect the printer to it

• Configure the printer to support Bluetooth printing

• Configure it as a shared printer connected to one of the four workstations

• Configure the printer to support cloud printing

Configure it as a shared printer connected to one of the four workstations

Due to the small size of the network and the lack of additional open switch ports, it would BEST to connect the printer to one of the workstations and configure it as a shared printer. This will allow any of the other workstations to print to the shared printer via the connected workstation. This allows the workstation to act as a print server, which means that the computer must always be left on or the rest of the users would be unable to print. Bluetooth printing is set up as a one-to-one pairing between a single computer and a single printer that is located within 10 feet. Since this is a small office, they do not have a dedicated server to configure for use as a print server. Cloud printing is only supported by some printers and the question doesn't specify if this printer supports this feature.

A user receives 'Windows Update service is not running' error. After the technician fixes the DLL registration, what should be done NEXT?

• Register the Windows Update service's DLL files

• Rollback the device drivers

• Reboot the computer

• Restart the network services

Reboot the computer

If any of the .DLL files involved with Windows Update are not correctly registered, you may also encounter this problem. To solve it, open services.msc and stop the Windows Update service. Then, open a Command Prompt as the administrator and use regsvr32 for each of the 6 Windows Update DLL files (wuapi.dll, wuaueng.dll, wups.dll, wups2.dll, wuwebv.dll, and wucltux.dll). Then, open services.msc and restart the Windows Update service. Finally, restart your computer for these changes to take effect.

Your company's wireless network was recently compromised by an attacker who utilized a brute force attack against the network's PIN to gain access. Once connected to the network, the attacker modified the DNS settings on the router and spread additional malware across the entire network. Which TWO of the following configurations were most likely used to allow the attack to occur?

• Default administrative login credentials

• WPA2 encryption enabled

• TKIP encryption protocols

• WPS enabled

• Router with outdated firmware

• Guest network enabled

• Default administrative login credentials

• WPS enabled

OBJ 2.10: Wireless networks that rely on a PIN to connect devices use the Wi-Fi Protected Setup (WPS). It is a wireless network security standard that tries to make connections between a router and wireless devices faster and easier. WPS relies on an 8-digit PIN, but it is easily defeated using a brute force attack due to a poor design. Once connected to the network using the WPS PIN, the attacker may have logged into the router using the default administrative login credentials and then modified the router/gateway's DNS. Commonly, many network administrators forget to change the default username/password of their devices, leaving an easy vulnerability for an attacker to exploit. 

A cybersecurity analyst is auditing your company's network logs and identifies that a USB mass storage device was previously inserted into many of the company's servers. The logs also showed dozens of failed login attempts before a successful login occurred on the servers. Which TWO of the following actions are recommended to eliminate the vulnerabilities identified by the cybersecurity analyst?

• Lockout the account after 3 failed login attempts

• Install the operating system security updates

• Remove administrative permissions

• Install a host-based firewall on the servers

• Change the default credentials on the servers

• Modify the AutoRun settings

• Lockout the account after 3 failed login attempts

• Modify the AutoRun settings

Since the USB mass storage device was used to connect to the servers, it is recommended to modify the AutoRun settings. To prevent the password guessing attacks used, the servers should be configured to lock out any account after 3 failed login attempts. The other options are all considered good security practices, but they do not directly address the issues presented in this scenario.

(This is a simulated Performance-Based Question. if this was the real certification exam, you would have to click on each device on the network diagram to open it and view/edit its configuration.) Wireless network users recently began experiencing speed and performance issues on your network after Access Point 2 (AP2) was replaced last night due to a recent hardware failure. The original wireless network was installed according to a wireless consultant's specifications and has always worked properly without any past issues. Now that you are at the client's office, you logged into each of the devices and saw the following configuration settings.Based on the configurations shown, which of the following settings should you change to bring the wireless network back to optimal performance? (Please select any or all options that apply) (See IMAGES)

• Change AP2's Channel from 1 to 6

• Change AP1's and AP3's Mode from G to B

• Change AP1's Channel from 1 to 6

• Change AP2 from Auto/Auto to 100/Full

• Change AP1 and AP3 from 100/Full to Auto/Auto

• Change AP2's Mode from B to G

• Change AP2's Channel from 1 to 6

• Change AP2 from Auto/Auto to 100/Full

• Change AP2's Mode from B to G

By comparing the configurations on the three different APs, we can see that AP1 and AP3 are set on channels 1 and 11, but AP2 is set to channel 1. This will cause interference between AP1 and AP2 since they are both on the same channel and can have overlapping coverage zones based on the floorplan of this office. Therefore, you should change AP2 to channel 6 to avoid interference. Also, AP1 and AP3 are using Wireless G (which supports 54 Mbps), but AP2 is set to Wireless B (which only supports 11 Mbps). This is causing the performance issue and lower speeds for the wireless users, so AP2 should be set to Wireless G to match the rest of the network. Finally, AP2 is set to Auto/Auto, but AP1 and AP3 are set to 100/Full. For best performance, AP2 should be set to 100/Full to match AP1 and AP3. AP2 has likely been unable to properly negotiate its switch port speed, so by setting it to 100/Full you can ensure the fastest possible connection between the switch port and AP2. By comparing the configurations on the three different APs, we can see that AP1 and AP3 are set on channels 1 and 11, but AP2 is set to channel 1. This will cause interference between AP1 and AP2 since they are both on the same channel and can have overlapping coverage zones based on the floorplan of this office. Therefore, you should change AP2 to channel 6 to avoid interference. Also, AP1 and AP3 are using Wireless G (which supports 54 Mbps), but AP2 is set to Wireless B (which only supports 11 Mbps). This is causing the performance issue and lower speeds for the wireless users, so AP2 should be set to Wireless G to match the rest of the network. Finally, AP2 is set to Auto/Auto, but AP1 and AP3 are set to 100/Full. For best performance, AP2 should be set to 100/Full to match AP1 and AP3. AP2 has likely been unable to properly negotiate its switch port speed, so by setting it to 100/Full you can ensure the fastest possible connection between the switch port and AP2.

A network technician is tasked with designing a firewall to improve security for an existing FTP server on the company network. The FTP server must be accessible from the Internet. The security team is concerned that the FTP server could be compromised and used to attack the domain controller hosted within the company's internal network. What is the BEST way to mitigate this risk?

• Migrate the FTP server from the internal network to a screened subnet

• Add a deny rule to the firewall's ACL that blocks port 21 outbound

• Upgrade the FTP server to an SFTP server since it is more secure

• Configure the firewall to utilize an implicit deny statement

• Migrate the FTP server from the internal network to a screened subnet

A screened subnet (formerly called a demilitarized zone or DMZ) is a perimeter network that protects an organization's internal local area network (LAN) from untrusted traffic. A screened subnet is placed between the public internet and private networks. Public servers, such as the FTP server, should be installed in a screened subnet so that additional security mitigations like a web application firewall or application-aware firewall can be used to protect them. SFTP (Secure File Transfer Protocol) is a file transfer protocol that leverages a set of utilities that provide secure access to a remote computer to deliver secure communications by leveraging a secure shell (SSH) connection to encrypt the communication between the client and the server. This will prevent an attacker from eavesdropping on the communications between the SFTP server and a client, but it will not prevent an attacker from exploiting the SFTP server itself. An implicit deny is when a user or group is not granted specific permission in the security settings of an object, but they are not explicitly denied either. This is a best practice to enable, but the FTP server would still have some open ports, such as ports 20 and 21, to operate. These ports could then be used by the attacker to connect to the FTP server and exploit it. Adding a deny rule to the firewall's ACL that blocks port 21 outbound would simply prevent internal network users and servers from accessing external FTP servers. This would in no way prevent the exploitation of the company's FTP server since it has port 21 open and listening for inbound connections.

Your Windows 10 workstation is attempting to boot up when it receives the following error, "BOOTMGR is missing; Press Ctrl+Alt+Del to restart." To fix this, you insert your Windows installation disc and reboot into the Command Prompt under the System Recovery Options. Which of the following commands should you enter in the command prompt?

• sfc /fixboot

• diskpart /repair

• bootrec /fixboot

• chkdsk /repair

• bootrec /fixboot

The partition boot sector is stored on the hard disk drive and contains the necessary code to start the Windows boot process. If this partition is corrupt or not properly configured during a Windows install, it would lead to “BOOTMGR is missing or corrupt” errors at startup. You should reboot into the command Prompt under the System Recovery Options using the Windows installation disc to fix this. Then, you should enter bootrec /fixboot. If the master boot record is corrupted, you can also run bootrec /fixmbr and the bootrec /fixboot to solve this issue. The diskpart command is a command-line disk-partitioning utility available for Windows that is used to view, create, delete, and modify a computer's disk partitions. The chkdsk command is used to check the file system and file system metadata of a volume for logical and physical errors. If used without parameters, chkdsk displays only the status of the volume and does not fix any errors. If used with the /f, /r, /x, or /b parameters, it fixes errors on the volume. The system file checker (SFC) command is a utility in Windows that allows users to scan for and restore corrupted Windows system files from the command line.

You are applying for a job at a cybersecurity firm. The application requests you enter your social security number, date of birth, and email address to conduct a background check as part of the hiring process. Which of the following types of information have you been asked to provide?

• IP

• PII

• CUI

• PHI

• PII

Personally identifiable information (PII) is data used to identify, contact, or locate an individual. Information such as social security number (SSN), name, date of birth, email address, telephone number, street address, and biometric data is considered PII. Protected health information (PHI) refers to medical and insurance records, plus associated hospital and laboratory test results. Proprietary information or intellectual property (IP) is information created and owned by the company, typically about the products or services that they make or perform. Controlled Unclassified Information (CUI) is federal non-classified information that must be safeguarded by implementing a uniform set of requirements and information security controls to secure sensitive government information.

A user reports that a specific social media app on their Android phone has been crashing immediately upon launch for the past two days. Other apps function normally, the device has adequate storage space, and the app was working fine earlier in the week without any recent updates. What is the BEST first troubleshooting step to resolve this issue?

• Check for and install any Android operating system updates

• Uninstall and reinstall the application

• Clear the application's cache and data

• Restart the smartphone to refresh the operating system

• Clear the application's cache and data

App cache stores temporary files like images, videos, and data to speed up loading times, but when cache becomes corrupted or excessively large, it can cause apps to malfunction, crash on startup, or behave erratically. Clearing cache removes these temporary files without affecting user login credentials or personal settings initially. Clearing data performs a more thorough reset that removes all app information including login sessions. This basically returns the app to first-install state. Clearing the cache and data is the least disruptive first step that directly addresses the most common cause of single-app crashes, so it is the best place to start troubleshooting the device. While uninstalling and reinstalling the application would ultimately resolve cache and data corruption issues, it's more time-consuming and disruptive than necessary for a first step. Reinstalling requires downloading the entire application again (which consumes data and time), forces the user to log back into their account, reconfigure all app settings and preferences, and potentially lose locally stored data like drafts or offline content. Restarting can resolve temporary system glitches, memory leaks, or process conflicts, it is normally used when these issues are affecting multiple apps. Since the problem is specific to one application rather than a system-wide issue, restarting the device isn't a good first step. If the issue is with the cache or data for the one application, then restarting the device won't fix the issue. Since the issue is with only one app, updating the operating system is unlikely to resolve the issue.

An IT supervisor is training new technicians about regulatory compliance during electronic disposal. Which action accurately aligns with regulatory best practices?

• Physically destroying all electronic devices on-site immediately after retirement.

• Donating equipment directly without data sanitization to charitable organizations.

• Permanently storing retired electronics within company-owned secure locations.

• Recycling electronic equipment through certified disposal service providers.

Recycling electronic equipment through certified disposal service providers.

OBJ 2.9 - Recycling electronic equipment through certified disposal services aligns with regulatory and environmental guidelines by ensuring equipment is handled safely and responsibly. Physically destroying all devices on-site immediately may not always be practical or environmentally responsible. Permanent storage of retired electronics creates compliance issues related to space, safety, and regulatory requirements over the long term. Direct donations without sanitization increase risk and violate data privacy compliance.

Which of the following is the LEAST secure wireless security and encryption protocol?

• WPA

• WPA2

• WPA3

• WEP

• WEP

Wired equivalent privacy (WEP) is an older mechanism for encrypting data sent over a wireless connection. WEP is considered vulnerable to attacks that can break its encryption. WEP relies on the use of a 24-bit initialization vector to secure its preshared key. Wi-Fi protected access (WPA) is an improved encryption scheme for protecting Wi-Fi communications that was designed to replace WEP. WPA uses the RC4 cipher and a temporal key integrity protocol (TKIP) to overcome the vulnerabilities in the older WEP protection scheme. Wi-Fi protected access version 2 (WPA2) replaced the original version of WPA after the completion of the 802.11i security standard. WPA2 features an improved method of key distribution and authentication for enterprise networks, though the pre-shared key method is still available for home and small office networks. WPA2 uses the improved AES cipher with counter mode with cipher-block chaining message authentication protocol (CCMP) for encryption. Wi-Fi protected access version 3 (WPA3) has replaced WPA2 as the most secure wireless encryption method. WPA3 uses the simultaneous authentication of equals (SAE) to increase the security of preshared keys. WPA3 provides the enhanced open mode that encrypts transmissions from a client to the access point when using an open network. WPA3 Enterprise mode supports the use of AES with the Galois/counter mode protocol (GCMP-256) for the highest levels of encryption.

Which of the following commands is used on a Linux system to change a user's password on the system?

• passwd

• chown

• pwd

• chmod

passwd

The passwd command is used to change a user's account password on a Linux system. A normal user can run passwd to change their password, and a system administrator (the superuser) can use passwd to change another user's password or define how that account's password can be used or changed. The chmod command sets the permissions of files or directories on a Linux system. A set of flags associated with each file determines who can access that file and how they can access it. These flags are called file permissions or modes. The command name chmod stands for change mode and it restricts the way a file can be accessed. The chown command is used to change the owner of the file, directory, or link in Linux. The pwd command displays the present working directory (current directory) path to the terminal or display. If you are working on a Linux system and are unsure of where you are in the directory structure, type "pwd" and hit enter to display the path to the screen.

During a disaster recovery, which of the following statements is true?

• A virtual machine cannot be used for redundancy or load balancing

• A virtual machine has more downtime than a physical server

• Both a virtual machine and a physical server has the same downtime

A virtual machine has less downtime than a physical server

A virtual machine can usually be restored much faster than a physical server. Physical servers must be modified to fit the right drivers for the disk drives, NIC, and other necessary components whenever they must be rebuilt after a crash. Often, a new physical server will also be required to replace a faulty one, and then the right drivers are needed to ensure a smooth transition. Conversely, a virtual machine can be recreated using another instance, clone, or restoration from a backup in much less time. Therefore, the downtime associated with virtual machines and their restoral is much lower.

What kind of attack is an example of IP spoofing?

• ARP Poisoning

• On-Path Attack

• Cross-SIte Scripting

• SQL Injections

On-path attack

An on-path attack (formerly known as a man-in-the-middle attack) intercepts communications between two systems. For example, in an HTTP transaction, the target is the TCP connection between client and server. Using different techniques, the attacker splits the original TCP connection into 2 new connections, one between the client and the attacker and the other between the attacker and the server. This often uses IP spoofing to trick a victim into connecting to the attack. SQL injection is a code injection technique used to attack data-driven applications. Malicious SQL statements are inserted into an entry field for execution, such as dumping the database contents to the attacker. An on-path attack is an attack where the attacker secretly relays and possibly alters the communications between two parties who believe that they are directly communicating with each other. ARP Poisoning, also known as ARP Spoofing, is a type of cyber attack carried out over a Local Area Network (LAN) that involves sending malicious ARP packets to a default gateway on a LAN to change the pairings in its IP to MAC address table. Cross-Site Scripting (XSS) attacks are a type of injection in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in a browser side script, to a different end-user.

Your supervisor has requested remote access to a particular server to check on specific data and processes in the evenings and weekends. You are concerned that the server could become infected and want to take some precautions. Which of the following is the MOST important thing to do before granting remote access to the server to your supervisor?

• Disable internet access from the server outside of normal business hours

• Educate your supervisor on safe internet browsing techniques

• Set the server's anti-virus software to automatically update itself and perform a full scan every Saturday night

• Install the latest security updates and patches to the server

Install the latest security updates and patches to the server

OBJ 2.10: To prevent infection, it is important that all servers and workstations remain patched and up to date on their security updates. After that, the next best thing would be to set up the anti-virus to update itself daily and run a full scan nightly automatically. Beyond that, educating your supervisor would be a good idea, as well. Disabling the internet access outside of normal business hours would not work since this would block your supervisor from accessing the server from their home. 

What is the native file system format used by Windows 10 during installation?

• exFAT

• FAT32

• APFS

• NTFS

NTFS

The New Technology File System (NTFS) is a proprietary file system developed exclusively for Windows. It provides a 64-bit addressing scheme, allowing for large volumes and file sizes. In theory, the maximum volume size is 16 Exabytes. Still, NTFS's actual implementations are limited to between 137 GB and 256 Terabytes, depending on the version of Windows and the allocation unit size. It is the default file system used by Windows. NTFS's only significant drawback is that it is not fully supported by operating systems other than Windows. macOS can read NTFS drives but cannot write to them. Linux distributions and utilities may be able to support NTFS to some degree. The extensible file allocation table (exFAT) is a file system optimized for external flash memory storage devices such as USB flash drives and SD cards. exFAT supports a maximum volume size of up to 128 PB with a recommended maximum volume size of 512 TB for the best reliability. The file allocation table 32-bit (FAT32) is the 32-bit file system supported by Windows, macOS, and Linux computers. FAT32 can support maximum volume sizes of up to 2 TB and maximum file sizes of up to 4 GB. The Apple file system (APFS) is the default file system for Mac computers using macOS 10.13 or later and features strong encryption, space sharing, snapshots, fast directory sizing, and improved file system fundamentals.