Security+ Guide to Network Security Fundamentals (Chapter 1-15 Questions)--Mark Ciampa (6th Edition)

*Chapter 1*

*Introduction to Network Security*

Ian recently earned his security certification and has been offered a promotion to a position that requires him to analyze and design security solutions as well as identifying users' needs. Which of these generally recognized security positions has Ian been offered?

*a. Security administrator*

b. Security technician

c. Security officer

d. Security manager

Alyona has been asked by her supervisor to give a presentation regarding reasons why security attacks continue to be successful. She has decided to focus on the issue of widespread vulnerabilities. Which of the following would Alyona NOT include in her presentation?

a. Large number of vulnerabilities

b. End-of-life systems

c. Lack of vendor support

*d. Misconfigurations*

Tatyana is discussing with her supervisor potential reasons why a recent attack was successful against one of their systems. Which of the following configuration issues would NOT covered?

a. Default configurations

b. Weak configurations

*c. Vulnerable business processes*

d. Misconfigurations

What is a race condition?

a. When a vulnerability is discovered and there is a race to see if it can be patched before it is exploited by attackers.

*b. When two concurrent threads of execution access a shared resource simultaneously, resulting in unintended consequences.*

c. When an attack finishes its operation before antivirus can complete its work.

d. When a software update is distributed prior to a vulnerability being discovered.

Which the following is NOT a reason why it is difficult to defend against today's attackers?

a. Delay in security updating

*b. Greater sophistication of defense tools*

c. Increased speed of attacks

d. Simplicity of attack tools

Which of the following is NOT true regarding security?

a. Security is a goal.

b. Security includes the necessary steps to protect from harm.

c. Security is a process.

*d. Security is a war that must be won at all costs.*

Adone is attempting to explain to his friend the relationship between security and convenience. Which of the following statements would he use?

a. "Security and convenience are not related."

b. "Convenience always outweighs security."

*c. "Security and convenience are inversely proportional."*

d. "Whenever security and convenience intersect, security always wins."

Which of the following ensures that only authorized parties can view protected information?

a. Authorization

*b. Confidentiality*

c. Availability

d. Integrity

Which of the following is NOT a successive layer in which information security is achieved?

a. Products

b. People

c. Procedures

*d. Purposes*

Complete this definition of information security: That which protects the integrity, confidentiality, and availability of information _____.

a. on electronic digital devices and limited analog devices that can connect via the Internet or through a local area network.

b. through a long-term process that results in ultimate security.

c. using both open-sourced as well as supplier-sourced hardware and software that interacts appropriately with limited resources.

*d. through products, people, and procedures on the devices that store, manipulate, and transmit the information.*

Which of the following is an enterprise critical asset?

a. System software

*b. Information*

c. Outsourced computing services

d. Servers, routers, and power supplies

Gunnar is creating a document that explains risk response techniques. Which of the following would he NOT list and explain in his document?

*a. Extinguish risk*

b. Transfer risk

c. Mitigate risk

d. Avoid risk

Which act requires banks and financial institutions to alert their customers of their policies in disclosing customer information?

a. Sarbanes-Oxley Act (Sarbox)

b. Financial and Personal Services Disclosure Act

c. Health Insurance Portability and Accountability Act (HIPAA)

*d. Gramm-Leach-Bliley Act (GLBA)*

Why do cyberterrorists target power plants, air traffic control centers, and water systems?

a. These targets are government-regulated and any successful attack would be considered a major victory.

b. These targets have notoriously weak security and are easy to penetrate.

*c. They can cause significant disruption by destroying only a few targets.*

d. The targets are privately owned and cannot afford high levels of security.

Which tool is most commonly associated with nation state threat actors?

a. Closed-Source Resistant and Recurrent Malware (CSRRM)

*b. Advanced Persistent Threat (APT)*

c. Unlimited Harvest and Secure Attack (UHSA)

d. Network Spider and Worm Threat (NSAWT)

An organization that practices purchasing products from different vendors is demonstrating which security principle?

a. Obscurity

*b. Diversity*

c. Limiting

d. Layering

What is an objective of state-sponsored attackers?

a. To right a perceived wrong

b. To amass fortune over of fame

*c. To spy on citizens*

d. To sell vulnerabilities to the highest bidder

Signe wants to improve the security of the small business where she serves as a security manager. She determines that the business needs to do a better job of not revealing the type of computer, operating system, software, and network connections they use. What security principle does Signe want to use?

*a. Obscurity*

b. Layering

c. Diversity

d. Limiting

What are industry-standard frameworks and reference architectures that are required by external agencies known as?

a. Compulsory

b. Mandatory

c. Required

*d. Regulatory*

What is the category of threat actors that sell their knowledge of vulnerabilities to other attackers or governments?

a. Cyberterrorists

b. Competitors

*c. Brokers*

d. Resource managers

*Chapter 2*

*Malware and Social Engineering Attacks*

Which of the following is NOT a primary trait of malware?

*a. Diffusion*

b. Circulation

c. Infection

d. Concealment

Which type of malware requires a user to transport it from one computer to another?

a. Worm

b. Rootkit

c. Adware

*d. Virus*

Which of the mutation completely changes a virus from its original form by rewriting its own code whenever it is executed?

a. Betamorphic

b. Oligomorphic

c. Polymorphic

*d. Metamorphic*

Ebba received a message from one of her tech support employees. In violation of company policy, a user had downloaded a free program to receive weather reports, but the program had also installed malware on the computer that gave the threat actor unrestricted access to the computer. What type of malware had been downloaded?

a. Virus

b. Ransonware

*c. RAT*

d. Trojan

Linnea's father called her to say that a message suddenly appeared on his screen that says his software license has expired and he must immediately pay $500 to have it renewed before control of the computer will be returned to him. What type of malware is this?

a. Persistent virusware

b. Trojanware

*c. Blocking ransonware*

d. Lockoutware

Astrid's computer screen suddenly days that all files are now locked until money is transferred to a specific account, at which time she will receive a means to unlock the files. What type of malware has infected her computer?

a. Bitcoin malware

*b. Crypto-malware*

c. Blocking virus

d. Networked worm

What is the name of the threat actor's computer that gives instructions to an infected computer?

*a. Command and control (C&C) server*

b. Resource server

c. Regulating Net Server (RNS)

d. Monitoring and Infecting (M&I) server

Which of these could NOT be defined as a logic bomb?

a. If the company's stock price drops below $100, then credit Juni's account with 10 additional years of retirement credit.

b. Erase all data if Matilda's name is removed from the list of employees.

c. Reformat the hard drive three months after Sigrid left the company.

*d. Send spam email to Moa's inbox on Tuesday.*

Which of the following is NOT correct about a rootkit?

a. A rootkit is able to hide its presence of the presence of other malware.

b. A rootkit accesses "lower layers" of the operating system.

*c. A rootkit is always the payload of the Trojan.*

d. The risk of a rootkit is less today than previously.

d. The risk of a rootkit is less today than previously.

Which of these is a general term used for describing software that gathers information without the user's consent?

a. Gatherware

b. Adware

*c. Spyware*

d. Scrapeware

Which statement regarding a keylogger is NOT true?

a. Keyloggers can be used to capture passwords, credit card numbers, or personal information.

*b. Software keyloggers are generally easy to detect.*

c. Hardware keyloggers are installed between the keyboard connector and computer keyboard USB port.

d. Software keyloggers can be designed to send captured information automatically back to the attacker through the internet.

A watering hole attack is directed against __________.

a. wealthy individuals

*b. a smaller group of specific users*

c. all users of a large corporation

d. attackers who send spam

__________ sends phishing message only to wealthy individuals.

*a. Whaling*

b. Spear phishing

c. Target phishing

d. Microing

Lykke receives a call while working at the helpdesk from someone who needs his account reset immediately. When Lykke questions the caller, he says, "If you don't reset my account immediately, I will call your supervisor!" What psychological approach is the caller attempting to use Lykke?

a. Familiarity

b. Scarcity

*c. Intimidation*

d. Consensus

Hedda pretends to be the help desk manager and called Steve to trick him into giving her his password. What social engineering attach has Hedda performed?

a. Aliasing

b. Duplicity

*c. Impersonation*

d. Luring

How can an attacker use a hoax?

*a. a hoax could convince a user that a bad Trojan is circulating and that he should change his security settings.*

b. By sending out a hoax, an attacker can convince a user to read his email more often.

c. A user who receives multiple hoaxes count contact his supervisor for help.

d. Hoaxes are not used by attackers today.

Which of these items retrieved through dumpster diving would NOT provide useful information?

a. Calendars

b. Organizational charts

c. Memos

*d. Books*

__________ is following an authorized person through a secure door.

a. Tagging

*b. Tailgating*

c. Backpacking

c. Caboosing

Each of these is a reason why adware is scorned EXCEPT __________.

a. it displays objectionable content

*b. it displays the attacker's programming skills*

c. it can interfere with a user's productivity

d. it can cause a computer to crash or slow down

What is term used for a threat actor who controls multiple bots in a botnet?

*a. Bot herder*

b. Zombie shepherd

c. Rogue IRC

d. Cyber-root

*Chapter 3*

*Basic Cryptography*

The Hashed Message Authentication code (HMAC) __________.

a. encrypts only the message

b. encrypts only the key

*c. encrypts the key and the message*

d. encrypts the DHE key only

What is the latest version of the Secure Hash Algorithm?

a. SHA-2

*b. SHA-3*

c. SHA-4

d. SHA-5

Alexel was given a key to a substitution cipher. The key showed that the entire alphabet was rotated 13 steps. What type of cipher is this?

a. AES

b. XANDA13

*c. ROT13*

d. Alphabetic

Abram was asked to explain to one of his coworkers the XOR cipher. he showed his coworkers and example of adding two bits, 1 and 1. What is the result of this sum?

a. 2

b. 1

*c. 0*

d. 16

Which of the following key exchanges uses the same keys each time?

a. Diffe-Hellman-RSA (DHRSA)

b. Diffe-Hellman Ephemeral (DHE)

*c. Diffe-Hellman (DH)*

d. Ellipic-Curve Diffe-Hellman (ECDH)

Public key systems that are different for each session are called __________.

a. Public Key Exchange (PKE)

*b. perfect forward secrecy*

c. Elliptic Curve Diffe-Hellman (ECDH)

d. Diffe-Hellman (DH)

What is data called that is to be encrypted by imputing it into a cryptographic algorithm?

a. Opentext

*b. Plaintext*

c. Cleartext

d. Ciphertext

Which of these is NOT a basic security protection for information that cryptography can provide/

a. Authenticity

*b. Risk Loss*

c. Integrity

d. Ciphertext

Which areas of a file CANNOT be used by steganography to hide data?

a. In areas that contain the content data itself

b. In the file header fields that describes the file

c. In data that is used to describe the content or structure of the actual data

*d. In the directory structure of the file system*

Proving that a user sent an email message is known as ___________.

*a. Non-repudiation*

b. Repudiation

c. Integrity

d. Availability

A(n) __________ is not decrypted but is only used for comparison purposes.

a. Key

b. Stream

*c. Digest*

d. Algorithm

Which of these is NOT a characteristic of a secure hash algorithm?

*a. Collision should be rare.*

b. A message cannot be produced from a predefined hash.

c. The results of a hash function should not be reversed.

d. The hash should always be the same fixed size.

Alyosha was explaining to a friend the importance of protecting a cryptographic key from cryptoanalysis. He said that the key should not relate in a simple way to the cipher text. Which protection is Alyosha describing?

a. Diffusion

*b. Confusion*

c. Integrity

d. Chaos

Which of the these is the strongest symmetric cryptographic algorithm?

a. Data Encryption Standard

b. Triple Data Encryption Standard

*c. Advanced Encryption Standard*

d. RC1

If Bob wants to send a secure message to Alice using a asymmetric algorithm, which key does he use to encrypt the message?

a. Alice's private key

b. Bob's public key

*c. Alice's public key*

d. Bob's private key

Egor wanted to use a digital signature. Which of the following benefits will the digital signature not provide?

a. Verify the sender

b. Prove the integrity of the message

*c. Verify the receiver*

d. Enforce nonrepudiation

Illya was asked to recommend the most secure asymmetric cryptographic algorithm to his supervisor. Which of the following did he choose?

a. SHA-2

b. ME-312

c. BTC-2

*d. RSA*

At a staff meeting one of the technicians suggested that the enterprise protect its new web server by hiding it and not telling anyone where it is located. Iosif raised his hand and said that security through obscurity was a poor idea. Why sis he say that?

a. It is an unproven approach and has never been tested.

b. It would be too closely to have one isolated server by itself.

*c. It would be essential impossible to keep its location a secret from everyone.*

d. It depends too heavily upon non-repudiation in order for it to succeed.

What is a characteristic of the Trusted Platform Module (TPM)?

*a. It provides cryptographic services in hardware instead of software*

b. It allows the user to boot a corrupted disk and repair it.

c. It is available only on Windows computers running BitLocker.

d. It includes a pseudorandom number generator (PRNG).

Which of these has an onboard key generator and key storage facility, as well as accelerated symmetric and asymmetric encryption, and can back up sensitive material in encrypted form?

a. Trusted Platform Module (TPM)

*b. Hardware Security Module (HSM)*

c. Self-encrypting hard disk drives (SED)

d. Encrypted hardware-based USB devices

*Chapter 4*

*Advanced Cryptography and PKI*

Which of the following is NOT a method for strengthening a key?

a. Randomness

b. Cryptoperiod

c. Length

*d. Variability*

Which of the following clock ciphers XORs each block of plaintext with the previous block of ciphertext before being encrypted?

a. Electronic Code Book (ECB)

b. Galois/Counter (GCM)

c. Counter (CTR)

*d. Cipher Block Chaining (CBC)*

What entity calls in crypto modules to perform cryptographic tasks?

a. Certificate Authority (CA)

b. OCSP Chain

c. Intermediate CA

*d. Cypto service provider*

__________ are symmetric keys to encrypt and decrypt information exchanged during the session and to verify its integrity.

a. Encrypted signatures

*b. Session keys*

c. Digital certificates

d. Digital digests

Which of these is considered the strongest cryptographic transport protocol?

*a. TLS v1.2*

b. TLS v1.0

c. SSL v2.0

d. SSL v2.0

The strongest technology that would assure Alice that Bob is the sender of the message is a(n) __________.

*a. digital signature*

b. encrypted signature

c. digest

d. digest certificate

A digital certificate associates __________.

a. a user's public key with his private key

*b. the user's identity with his public key*

c. a user's private key with the public key

d. a private key with a digital signature

Digital certificates can be used for each of these EXCEPT __________.

*a. to verify the authenticity of the Registration Authorizer.*

b. to encrypt channels to provide secure communication between clients and servers

c. to verify the identity of clients and servers on the Web

d. to encrypt messages for secure email communication

An entity that issues digital certificates is a __________.

a. certificate signatory (CS)

b. digital signer (DN)

*c. certificate authority (CA)*

d. signature authority (SA)

A centralized directory of digital certificates is called a(n) ___________.

a. Digital Signature Permitted Authorization (DSPA)

b. Digital Signature Approval List (DSAP)

*c. Certificate Repository (CR)*

d. Authorized Digital Signature (ADS)

__________ performs a real-time lookup of a digital certificate's status.

a. Certificate Revocation List (CRL)

b. Real-Time CA Verification (RTCAV)

*c. Online Certificate Status Protocol (OCSP)*

d. CA Registry Database (CARD)

__________ is a protocol for securely accessing a remote computer.

a. Transport Layer Security (TLS)

*b. Secure Shell (SSH)*

c. Secure Sockets layer (SSL)

d. Secure Hypertext Transport Protocol (SHTTP)

What is a value that can be used to ensure that hashed plaintext will not consistently result in the same digest?

a. Algorithm

b. Initialization vector (IV)

c. Nonce

*d. Salt*

Which digital certificate displays the name of the entity behind the website?

a. Online Certificate Status Certificate

*b. Extended Validation (EV) Certificate*

c. Session Certificate

d. X.509 Certificate

Which trust model has multiple CAs, one of which acts as a facilitator?

*a. Bridge*

b. Hierarchical

c. Distributed

d. Web

Which statement is NOT true regarding hierarchical trust models?

*a. It is designed for use on a large scale*.

b. The root signals all digital certificate authorities with a signal key.

c. It assigns a single hierarchy with one master CA.

d. The master CA is called the root.

Public key infrastructure (PKI) __________.

a. generates public/private keys automatically

b. creates private key cryptography

*c. is the management of digital certificates*

d. requires the use of an RA instead of a CA

A(n) __________ is a published set of rules that govern the operation pf a PKI.

a. signature resource guide (SRG)

b. enforcement certificate (EF)

c. certificate practice statement (CPS)

*d. certificate policy (CP)*

Which of these is NOT part of the certificate life cycle?

a. WXpiration

b. Revocation

*c. Authorization*

d. Creation

__________ refers to a situation in which keys are managed by a third party, such as a trusted CA.

a. Key authorization

*b. Key escrow*

c. Remote key administration

d. Trusted key authority

*Chapter 5*

*Networking and Server Attacks*

Which attacks intercepts communication between a web browser and the underlying computer?

a. Man-in-the-middle (MITM)

*b. Man-in-the-browser (MITB)*

c. Replay

d. ARP poisoning

Olivia was asked to protect the system from a DNS poisoning attack. What are the locations she would need to protect?

a. Web server buffer and host DNS server

b. Reply referrer and domain buffer

b. Web browser and browser add-on

*d. Host table and external DNS server*

Newton is concerned that attackers could be exploiting a vulnerability in software to gain access to resources that the user normally would be restricted from accessing. What type of attack is he worried about?

*a. Privilege escalation*

b. Session replay

c. Scaling exploit

d. Amplification

Which of the following adds new functionality to the web browser so that users can play music, view videos, or display special graphical images within the browser?

a. Extensions

b. Scripts

*c. Plug-ins*

d. Add-ons

An attacker who manipulates the maximum size of an integer type would be performing what kind of attack?

*a. integer overflow*

b. buffer overflow

c. number overflow

d. heap overflow

What kind of attack is performed by an attacker who takes advantage of the inadvertent and unauthorized access built through three succeeding systems that all trust one another?

*a. privilege escalation*

b. cross-site attack

c. horizontal access attack

d. transverse attack

Which statement is correct regarding why traditional network security devices cannot be used to block web application attacks?

a. The complex nature of TCP/IP allows for too many ping sweeps to be blocked.

b. Web application attacks use web browsers that cannot be controlled on a local computer.

c. Network security devices cannot prevent attacks from web resources.

*d. Traditional network security devices ignore the content of HTTP traffic, which is the vehicle of web application attacks.*

What is the difference between a DoS and a DDoS attack?

a. DoS attacks are faster than DDoS attacks

*b. DoS attacks use fewer computers than DDoS attacks*

c. DoS attacks do not use DNS servers as DDoS attacks do

d. DoS attacks user more memory than a DDoS attack

John was explaining about an attack that accepts user input without validating it and uses that input in a response. What type of attack was he describing?

a. SQL

*b. XSS*

c. XSRF

d. DDoS DNS

Which attack uses the user's web browser settings to impersonate that user?

a. XDD

*b. XSRF*

c. Domain hijacking

d. Session hijacking

What is the basis of an SQL injection attack?

a. to expose SQL code so that it can be examined

b. to have the SQL server attack client web browsers

*c. to insert SQL statements through unfiltered user input*

d. to link SQL servers into a botnet

Which action cannot be performed through a successful SQL injection attack?

a. discover the names of different fields in a table

*b. reformat the web application server's hard drive*

c. display a list of customer telephone numbers

d. erase a database table

Attackers who register domain names that are similar to legitimate domain names are performing _____.

a. Address resolution

b. HTTP manipulation

c. HTML squatting

*d. URL hijacking*

What type of attack involves manipulating third-party ad networks?

a. Session advertising

*b. Malvertising*

c. Clickjacking

d. Directory traversal

Why are extensions, plug-ins, and add-ons considered to be security risks?

a. They are written in Java, which is a weak language.

*b. They have introduced vulnerabilities in browsers.*

c. They use bitcode.

d. They cannot be uninstalled.