OS Security
This Windows security tool provides antimalware protection and has been included with Windows since Windows 8.
What is Windows Defender?
This command is primarily used to determine what ports are being used for network communication.
What is netstat?
This is a secondary copy of data that can be used to restore information following an attack.
What is a data backup?
This term describes applying the latest updates to hardware and software.
What is patching?
This Windows tool provides an interface for viewing collections of system events and logs.
What is Event Viewer?
This interface allows users and administrators to interact with a computer by entering commands rather than primarily using a graphical interface.
What is a command-line interface (CLI)?
This command-line utility accepts a hostname and returns the IP address associated with it.
What is nslookup?
This network scanning utility can help administrators identify nodes based on network activity.
What is Nmap?
This low-level software allows an operating system to communicate with hardware components.
What is a device driver?
The value of a log file depends heavily on the ability to compare these two types of behavior.
What are normal and abnormal behavior?
A Windows Defender Firewall rule can control traffic coming into or out of a computer. Name both types.
What are inbound and outbound rules?
An administrator wants to monitor network traffic and examine the contents of packets. Which command-line utility should be used?
What is tcpdump?
An administrator scans the network every week and compares each scan with the previous hardware inventory. Why?
To identify unauthorized or unexpected changes to network assets.
This type of software is transferred to an onboard chip and controls basic hardware operations.
What is firmware?
This logging system separates log-message generation from log-message storage, making it more difficult for an attacker to erase evidence.
What is syslog?
An administrator creates separate groups for Accounting and Sales and gives each group different permissions based on its job responsibilities. What type of access control is being used?
What is role-based access control (RBAC)?
An administrator needs to run tcpdump with superuser privileges on a Linux system. What command can be placed before tcpdump?
What is sudo?
Name three important elements of a robust backup strategy.
A company refuses to update its operating systems because "everything is working fine." Why is this a security concern?
Because updates and patches help reduce or eliminate known security vulnerabilities.
Antimalware software compares files and network messages against this type of database information.
What are malware signatures?
An attacker gains limited access to a computer and then attempts to obtain administrator-level permissions. What attack technique is being attempted?
What is privilege escalation?
A technician runs netstat and wants to see only ports that are actively listening. Which option should be used?
What is -l?
Match the compliance requirement to the situation:
A hospital stores patients' health information.
A school stores student educational records.
A company processes credit-card payments.
HIPAA — healthcare information
FERPA — educational information
PCI DSS — payment-card information
Name the four asset components identified in the workbook that can post notable events to the Windows Event Viewer.
A security administrator discovers several infected computers during a malware investigation. According to the workbook, what should generally happen first in a well-designed malware remediation procedure?
Contain the damage and infection by removing detected infected systems from the network.