Jason Dion Practice Exam 3

Reed & Jamario Security Services has recommended your company use a port-based system to prevent unauthorized users and devices. Which of the following are they recommending?

Fail-closed.

Fail-open.

802.1X.

IDS.

802.1X.

Which of the following solutions should a data center implement to guarantee customer data remains unreadable in the event of a physical server compromise?

Data deduplication.

RAID.

Full disk encryption.

Server clustering.

Full disk encryption.

A company allows its employees to use their personal mobile devices for work-related tasks, such as accessing company email and sensitive documents. The IT department is concerned about the security risks to company data when these devices are lost. Which of the following aspects of an MDM will address this concern effectively?

Installing antivirus software on the company's network servers.

Enforcing full device encryption on all employee mobile devices.

Requiring employees to use strong passwords for their personal email accounts.

Enabling remote wiping of devices.

Enabling remote wiping of devices.

Enabling the Mobile Device Management's (MDM's) ability to conduct a remote wipe of the device is the best solution to the issue of a lost or stolen device.

Which of the following network designs involves using air-gapping, disconnecting cables, or locking devices to prevent unauthorized access or interference?

Physical isolation.

Decentralization.

SDN.

Logical segmentation

Physical isolation.

Physical isolation is a network design that involves using air-gapping, disconnecting cables, or locking devices to prevent unauthorized access or interference

Which of the following BEST describes an individual who doesn't have authorized access but attempts to breach security using malware or social engineering?

Insider threat.

Contractor.

External threat actor.

Business partner.

External threat actor.

Which of the following encryption standards is primarily used for securing data at rest and in transit through symmetric key cryptography?

RSA.

AES.

SHA.

HMAC.

AES.

AES (Advanced Encryption Standard) is a symmetric encryption standard used to protect data at rest and in transit, ensuring confidentiality and security.

Which of the following approaches ensures real-time or near-real-time duplication of data to a secondary location for purposes like high availability, disaster recovery, and load balancing?

Snapshots.

Differential backups.

Journaling.

Replication.

Replication.

Which of the following technologies allows running code without managing any underlying infrastructure?

SDN.

IaC.

Serverless.

Virtualization.

Serverless.

At Dion Training, a tech company, the security team is conducting a review of their security measures to enhance the protection of their facilities. Which of the following is an essential component of an organization's governance to ensure that access to buildings and sensitive areas is appropriately restricted?

Change management procedures.

Information security policies.

Physical security standards.

AUP.

Physical security standards.

Why might an organization be particularly concerned about introducing automation tools that become single points of failure during secure operations?

Challenges in upholding data confidentiality.

Issues related to system scalability and slow authentication.

Potential gaps in maintaining data integrity.

Compromised availability leading to operational disruptions.

Compromised availability leading to operational disruptions

Jason, an IT administrator for Kelly Innovations LLC, is tasked with enforcing specific access rights only for the marketing department. Given the tools available on a Windows Active Directory network, which would be the MOST effective way for Jason to accomplish this?

Linking a GPO to the organizational unit containing marketing department users.

Applying a local group policy on individual marketing department computers.

Linking a GPO to a site.

Creating a new domain for the marketing department.

Linking a GPO to the organizational unit containing marketing department users.

Organizational units (OUs) in Active Directory allow administrators to group related accounts. By linking a GPO to an OU specific to the marketing department, Jason can enforce access rights exclusively for that department.

Which attribute of a threat actor refers to their ability to develop unique exploit techniques and tools?

Capability.

Sophistication.

Resources.

Funding.

Capability.

Which of the following is a type of human vector attack that involves creating a fake website address or domain name that resembles a legitimate one, but with slight spelling or punctuation differences?

Typosquatting.

Pretexting.

Business email compromise.

Impersonation.

Typosquatting.

Maria, a cybersecurity analyst, is examining logs from a server with crucial financial data. She spots a few anomalies: a two-hour log gap without planned maintenance, a spike in outbound traffic to an unknown IP just before this gap, multiple failed logins from a foreign IP using valid usernames, and a higher CPU usage during the log gap despite no recorded actions. Which of these observations should Maria be MOST concerned with?

The sudden two-hour gap in the logs.

Multiple failed login attempts from a foreign IP.

The spike in outbound traffic to the unfamiliar IP address.

The increase in CPU usage during the missing log period.

The sudden two-hour gap in the logs.

Which of the following BEST describes Policy-driven access control in the Zero Trust approach?

Bases access decisions on predefined security policies.

Relies on continuous user behavior assessment.

Ensures secure data transfer post-access decision.

Contains potential threats by segmenting the network.

Bases access decisions on predefined security policies.

An attacker tries to gain access to an account by rapidly guessing commonly used passwords across multiple accounts, hoping to find one that works. This technique avoids triggering account lockouts by using different usernames with each attempt. What type of attack is this?

Password spraying.

Dictionary attack.

Rainbow table attack.

Brute force attack.

Password spraying.

Which of the following ports, if left open and unmonitored, might allow database queries from unauthorized external sources?

Port 53.

Port 21.

Port 443.

Port 1433.

Port 1433.

Port 1433 is the default for Microsoft SQL Server.

Sofia, an HR manager, requests access to the company's payroll system to view employee records. The IT team grants her permission to view the data but restricts her from modifying any records or accessing other sensitive system areas. What principle is being applied in this case?

Separation of duties.

Least privilege.

Discretionary access control.

Job rotation.

Least privilege.

Which of the following statements is NOT true regarding the security implications in the procurement process?

Vendor reputation and capabilities should be thoroughly evaluated to ensure they meet the necessary security standards

The procurement process must consider compatibility with existing infrastructure to maintain a similar level of security across all assets

Procurement contracts should include clauses delineating liability if assets provided by vendors lead to a security breach

Once a vendor is selected for procurement, there is no ongoing need to periodically re-evaluate their suitability.

Once a vendor is selected for procurement, there is no ongoing need to periodically re-evaluate their suitability.

What is the term for a type of open service port that is commonly used for remote access servers and can be used to perform on-path attacks on a Windows computer, but not on computers using other operating systems?

Telnet

VNC

SSH

RDP.

RDP.

Remote Desktop Protocol (RDP) port is a type of open service port that is commonly used for remote desktop servers and can be exploited by attackers to perform screen capture, keystroke logging, or malware delivery attacks. It is the default port for RDP, the protocol used to remotely control a Windows based system’s desktop. Virtual Network Computing (VNC) port is a type of open service port that is commonly used for remote desktop servers and can be exploited by attackers to perform screen capture, keystroke logging, or malware delivery attacks. It is the default port for VNC, the protocol used to remotely view and interact with a system’s desktop. It is not specific to Windows-based systems. Telnet port is a type of open service port that is commonly used for remote access servers and can be exploited by attackers to perform eavesdropping, data theft, or brute force attacks. It is the default port for Telnet, the protocol used to access remote systems without encryption. Telnet is cross-platform, not Windows based. Secure Shell (SSH) port is a type of open service port that is commonly used for remote access servers and can be exploited by attackers to perform on-path attacks, such as session hijacking or replay. It is the default port for SSH, the protocol used to securely access remote systems. SSH is cross-platform, not Windows based.

Which of the following is an aspect of asset management that ensures that each IT asset is clearly associated with a specific individual or department, providing clarity on responsibilities and access rights?

Monitoring.

Decommissioning.

Ownership.

Acquisition.

Ownership.

Sarah, a cloud engineer, often needs to perform maintenance on cloud resources. To ensure high security, her organization wants to grant her access credentials that last only for the duration of her maintenance task and then automatically expire. Which of the following methods is BEST suited for this scenario?

Static access tokens.

Ephemeral credentials.

Principle of least privilege.

Time-of-day restrictions.

Ephemeral credentials.

Ephemeral credentials are temporary and designed for short-lived purposes, thus reducing the risk of those credentials being misused or compromised.

The IT team at Dion Training Solutions noticed that one of their servers was suddenly using 95% of its processing power. This was highly unusual as the typical utilization was around 40%. Upon investigation, they found a process they didn't recognize consuming a large portion of the resources. Which of the following statements describes the MOST likely situation faced by the Dion Training Solutions IT team?

User-initiated large data transfer.

Hardware malfunction.

Malicious activity.

Scheduled backup activity.

Malicious activity.

Dion Training needs to regulate the devices connecting to its network. To make things more secure, the devices should be regulated based on their unique physical addresses. Which of the following features would BEST address their needs?

Port security.

Jump server.

TLS.

Fail-open.

Port security.

Which of the following statements is NOT true regarding the importance of Archiving?

Archiving helps organizations store data safely for long-term retention and regulatory compliance.

Archiving speeds up searches for older data, making the retrieval of data faster and more effective.

Archiving is crucial for providing historical context to help in future data analysis and investigations.

Archiving can improve system performance by moving less frequently accessed data off primary systems.

Archiving speeds up searches for older data, making the retrieval of data faster and more effective.

Archiving doesn’t speed up searches for older data.

Which of the following statements is NOT true concerning the significance of NetFlow?

Correct answer

NetFlow can interpret traffic flow patterns and identify the type of network attack that is occurring

Your answer is incorrect

NetFlow can help with capacity planning and understanding network performance issues

NetFlow helps provide an understanding of network traffic flow, enhancing security by identifying unusual patterns

NetFlow can identify the source and destination of traffic, making it easier to spot potential threats

NetFlow can interpret traffic flow patterns and identify the type of network attack that is occurring.

NetFlow allows for the visualization of flow patters, but it cannot interpret traffic flow patterns. It is up to the security analyst to interpret the data.

Jason is working on a legacy application that processes user inputs. He notices that unchecked user inputs can be used to manipulate memory locations directly, leading to potential memory injection attacks. To counter this vulnerability, what should Jason prioritize?

Enable firewalls and intrusion detection systems.

Upgrade to the latest version of the application.

Implement stringent input validation and sanitation.

Use a different programming language.

Implement stringent input validation and sanitation.

As a network administrator responsible for evaluating a company's encryption protocol method for wireless devices, you have discovered that the company is currently utilizing a deprecated encryption protocol that poses a significant security threat. Which of the following is the MOST appropriate encryption protocol to recommend upgrading to?

WEP.

AES.

TKIP.

WPA.

AES.

Unlike WEP, an outdated encryption protocol that has been widely exploited and that has become insecure, AES is currently the most secure and widely adopted encryption protocol for wireless networks.

What is the main danger that comes from Shadow IT?

A large scale service disruption.

Financial losses.

A larger attack surface.

Data losses.

A larger attack surface.

Shadow IT is a type of threat actor that is the result of unauthorized or unapproved IT systems or devices within an organization.  Shadow IT can introduce security risks because the unauthorized system or device may provide attackers with a way to gain access to an otherwise secure system.

A company wants to ensure the integrity and confidentiality of its operating system files during both transit and storage. Which of the following is the MOST effective approach for protecting these files?

Backup and compression.

Firewalls and IDS.

Encryption and digital signing.

Regular patching and updates.

Encryption and digital signing.

Encrypting ensures that unauthorized parties cannot understand the content of the OS files, while digitally signing them verifies the integrity of the files, ensuring they haven't been tampered with.

ABAC.

DAC.

MAC.

RBAC.

Attribute Based Access Control determines access through a combination of contexts and system wide attributes.

Discretionary Access Control is an authorization model where the owner of the resource decides who is allowed to access it.

MAC is an authorization model where access to resources is determined by a set of rules defined by a central authority.

Rule-Based Access Control is an authorization model that assigns permissions to roles, rather than individual users.

Reginald, an IT Manager, is the owner of a file on a server and wants to grant his colleagues access to the file. He is the only one who can decide who is allowed access to the file and what actions they can perform on it. Which authorization model is being used in this scenario?

ABAC.

DAC.

MAC.

RBAC.

DAC.

Which of the following control types BEST characterizes a policy that requires employees to visibly display their badges within a facility, mainly to remind them of security expectations and discourage potential unauthorized access?

Detective Control.

Corrective Control.

Directive Control.

Deterrent Control.

Deterrent Control.

An organization is evaluating its IT infrastructure to determine the probability of data breaches and the impact such breaches would have on its operations. Sarah has been assigned to estimate the financial consequences and the probability of these potential security incidents. What type of risk assessment is Sarah conducting?

Threat Modeling.

Quantitative Risk Assessment.

Residual Risk Analysis.

Qualitative Risk Assessment.

Quantitative Risk Assessment.

Which of the following security features, integral to incident response, keeps track of activities and is used as proof during incidents that all regulations were followed?

Event monitoring.

Incident logs.

Operational history.

Audit trails.

Audit trails.

Audit trails are detailed records that log sequential activities within a system, providing crucial data for detecting, examining, and understanding the nature of security breaches.

While monitoring the company's encrypted data transmissions, Jamario noticed that certain data streams, which usually employed robust encryption protocols, were now using older, less-secure encryption standards. He recognized this could make the data more vulnerable to unauthorized decryption. Which of the following BEST captures the type of attack Jamario discovered affecting Kelly Innovations LLC's encrypted transmissions?

Key exchange attack.

Cryptographic downgrade.

Data obfuscation.

Cipher Block Chaining (CBC) Attack.

Cryptographic downgrade.

Which type of agreement defines the terms of a partnership between two organizations and how they will collaborate on specific projects or initiatives?

BPA.

MOU.

MSA.

SLA.

MOU

MSA

A Master Service Agreement is a comprehensive contract that sets forth the general terms and conditions that will govern multiple future engagements between the parties. It may reference specific work orders or statements of work for individual projects.

BPA

A Business Partners Agreement is a comprehensive contract that sets forth the general terms and conditions that will govern multiple future engagements between the parties. It may reference specific work orders or statements of work for individual projects.

Which system offers a consistent and standardized method for naming and referring to specific publicly known security vulnerabilities and exposures in software and systems?

CVE.

Responsible disclosure program.

CVSS.

Vulnerability prioritization.

CVE.

The CVE (Common Vulnerability Enumeration) provides a unique identifier for publicly disclosed security vulnerabilities and exposures. It ensures that the cybersecurity community speaks a consistent language when discussing specific vulnerabilities.

CVSS

CVSS (Common Vulnerability Scoring System) rates the severity of vulnerabilities,

Responsible Disclosure Program

A responsible disclosure program allows vulnerabilities to be reported directly to organizations. It helps in patching vulnerabilities but doesn't name them consistently.

Repair Now, a do-it-yourself education company wants to proactively identify and address known weaknesses in its cybersecurity posture that could compromise the company's security. Which of the following operational security controls would help the company achieve this?

Vulnerability management.

Firewall.

Intrusion detection system.

Encryption.

Vulnerability Management.

In the realm of digital forensics, which activity is a primary focus during the preservation phase?

Generating and documenting cryptographic hashes of digital evidence to verify its integrity.

Performing keyword searches on electronic documents to identify pertinent information.

Recording the specific tools and methodologies used during the evidence collection phase.

Drafting a comprehensive summary of findings and presenting it to stakeholders.

Generating and documenting cryptographic hashes of digital evidence to verify its integrity.

At Kelly Innovations Corp., during a routine audit, Alex discovered that the database supporting their CRM application was corrupted. He immediately informed Kevin, the senior database administrator. Kevin decided to restore the database from the most recent clean backup, ensuring that the CRM would be functional with minimal data loss. What action is Kevin taking to address the issue?

Application recovery.

Database indexing.

Database defragmentation.

Data mirroring.

Application recovery.

What is the first step in the risk management process that involves determining what potential threats and vulnerabilities exist within an organization's environment?

Risk analysis.

Risk register.

Risk mitigation.

Risk identification.

Risk identification.

Risk identification is the first step in the risk management process. It involves identifying potential threats and vulnerabilities that could pose a risk to an organization's assets or operations.

What are the steps in the in the risk Management Process?

1.Risk identification.

2.Risk analysis.

3.Risk register.

4. Risk mitigation.

An organization aims to elevate its security posture through improved system configurations. Which of the following BEST describes how automation supports this initiative?

Accelerating hardware upgrades.

Facilitating remote team collaborations.

Enhancing user authentication protocols.

Enforcing consistent baselines across devices.

Enforcing consistent baselines across devices.

What is the primary purpose of internal compliance reporting?

To provide compliance updates to the organization's management.

To request additional information from agencies that are in charge of compliance.

To prove to third party auditors that a company is complying with its internal processes.

To report compliance status to the public.

To provide compliance updates to the organization's management.

The primary purpose of internal compliance reporting is to provide updates on compliance status, identify potential issues, and inform the organization's management about its adherence to regulatory requirements and policies.

Which of the following vulnerabilities is unique to cloud computing environments, posing risks related to unauthorized access and data manipulation?

Cross-site scripting (XSS).

Side loading.

Insecure Interfaces and APIs.

Buffer overflow.

Insecure Interfaces and APIs.

- Insecure Interfaces and APIs are a type of vulnerability that arises when the interaction between users and cloud services through interfaces and APIs is not secure, exposing systems to potential unauthorized access and manipulation of data.

A company’s systems were compromised, and sensitive data was stolen. After investigating, it was found that the breach occurred through a Trojan installed on an employee’s mobile phone. The employee had bypassed the Mobile Device Management (MDM) security controls to install an unauthorized game, which either introduced the Trojan or allowed attackers to exploit the phone's weakened security. Which of the following is the MOST probable cause of this vulnerability?

Misconfiguration of security settings.

SQL injection in the mobile app.

Insecure network configuration.

Buffer overflow on the mobile device.

Misconfiguration of security settings

Which of the following statements BEST explains the importance of the Chain of Custody in incident response?

The chain of custody determines the individuals or groups responsible for the incident and helps in legal proceedings.

The chain of custody is the process of securing and preserving evidence related to a security incident for potential use in legal proceedings.

The chain of custody involves following the processes as they are laid out in the incident response plan from Preparation to Lessons Learned.

The chain of custody is the process of systematically analyzing how the incident referred, linking the events from inception to the point of attack.

The chain of custody is the process of securing and preserving evidence related to a security incident for potential use in legal proceedings.

Which of the following statements is NOT true concerning the significance of SNMP?

SNMP allows network administrators to monitor network performance, find and solve network problems, and plan for network growth.

SNMP assists in collecting information from various network devices to ensure proper functioning and security.

SNMP makes it possible to manage network performance, control network configuration, and store data about network components.

SNMP ensures secure communication among software applications and allows security analysts to monitor these communications.

SNMP ensures secure communication among software applications and allows security analysts to monitor these communications.

As a security analyst, you are reviewing application logs while investigating a suspected breach. Which of the following pieces of information is NOT typically documented in the application log data?

Server IP address where the application is hosted.

The physical location of the user accessing the application.

Timestamps of application activity.

User IDs related to specific application transactions.

The physical location of the user accessing the application.

Abdul has suggested that his company perform a supply chain analysis of all of the company's vendors. This will be expensive and time consuming. Why is it important that the company conduct a supply chain analysis despite the costs?

To assess the vendor's compliance with legal regulations, so the company will remain in compliance.

To identify potential security risks associated with the vendor's supply chain.

To determine the vendor's customer satisfaction ratings so that only the best suppliers are chosen.

To evaluate the vendor's financial stability so the supply chain won't be broken due to a bankruptcy or closing.

To identify potential security risks associated with the vendor's supply chain.

An organization has recently decided to utilize multiple operating systems and applications on a single physical server to optimize resource usage and reduce costs. Which of the following BEST represents this approach?

Microservices.

Virtualization.

Serverless computing.

SDN.

Virtualization.

A major software update is scheduled for deployment in a company's production environment. To ensure that any unforeseen issues or conflicts can be reverted to the previous stable state, what should the IT team have in place?

Backout plan.

Standard operating procedure.

Maintenance window.

Approval process.

Backout plan.

Which concept is an important reliability metric in maintenance management and represents the average time between failures for a non-repairable system?

Risk assessment.

MTTR.

MTBF.

FMEA.

MTBF.

Which of the following statements BEST describes the role of a data processor in data governance?

Sets the strategic direction and policies for organizational data management.

Directly responsible for classifying data and defining access permissions.

Assesses and manages risks related to data security and compliance.

Processes personal data for controllers and ensures implementation of security measures.

Processes personal data for controllers and ensures implementation of security measures.