Attacks, Threats, and Vulnerabilities
Using an open connection to a small company's network, an attacker submitted arbitrary queries on port 389 to the domain controllers. The attacker initiated the query from a client computer. What type of injection attack did the attacker perform?
What is an LDAP injection?
A system engineer enhances the security of a network by adding firewalls to both the external network and the internal company network. The firewalls are products of two separate companies. This is an example of what type of security control practice?
What is vendor diversity?
A security assessor uses a technique to test for vulnerabilities and code quality during the development phase. Which of the following is most likely happening during this phase?
What is dynamic analysis?
A cybersecurity student has been using dig and whois to query hosting records and check external DNS services when a fellow student recommends a tool that packages similar functions and tests into a single query. Conclude what tool the student recommended.
What is dnsenum?
The network administrator adjusts the firewall to prevent employees from accessing streaming websites during business hours. What type of control would prevent the end-user from accessing the YouTube channel?
A. Managerial
B. Technical
C. Detective
D. Preventative
What is a technical control?
The tool used by an attacker to gain access to a resource is called what?
What is a threat vector?
What part of AAA allows the IT department to monitor what people are doing on the network?
What is Accounting?
When you want to secure a file transfer using SSH, which protocols would you use?
A. SFTP
B. Telnet
C. SCP
D. FTPS
What is SFTP & SCP?
What tool can gather email accounts, employee names, subdomains, IPs, URLs and other OSINT data for a particular company name?
What is the Harvester?
What type of risk describes the likelihood and impact of a risk after mitigation, transference, or acceptance measures have been applied?
What is residual risk?
By modifying query traffic, an attacker compromised a legitimate site's web server via a Denial of Service (DoS) attack and redirected traffic intended for the legitimate domain, to go instead, to the attacker's malicious IP address. What type of attack did the hacker perform?
What is DNS Server Cache Poisoning?
A system can detect when a server fails and no longer sends clients to the downed server. Instead the system reroutes the traffic to other servers to share the load, providing high availability. What hardware/software component is being used?
What is a load balancer?
Which file must be downloaded regularly in order for antivirus software to remain effective?
What is the definition & signature file?
In digital forensics, what is order of volatility?
What is the order in which you collect digital evidence?
A user shares an online newspaper article titled, “Amazon Hiring Frenzy,” to several acquaintances. Which data classification does this best represent?
A. Confidential
B. Critical
C. PII
D. Public
What is Public?
Using social engineering, an attacker called an employee to extract the name and contact information of the Chief Information Security Officer (CISO). What social engineering deception did the attacker utilize?
What is Vishing?
A systems administrator in an organization sets up a shared drive for employees. The drive contains company files that should not be modified or corrupted. Which of the following solutions could the administrator use to ensure integrity of the files?
What is hashing?
Which of the following would secure an endpoint and provide attestation signed by a trusted platform module (TPM)?
A. Endpoint detection and response
B. Host intrusion prevention system
C. Secure cookies
D. Measure boot
What is measured boot?
Select the methods of containment based on the concept of isolation. (Select all that apply.)
A. Blackhole
B. Physical disconnection/air gapping
C. Sandboxing
D. Sinkhole
What is a blackhole, physical disconnection/air gapping, and sandboxing?
An information security officer creates a document that identifies downtime, likelihood of occurrence, the probable impact of the downtime, and steps to mitigate the downtime and scores the likelihood based on defined security controls. What is the information security officer creating?
What is a risk register?
During which type of penetration test does the tester skip the reconnaissance phase of the test?
What is a white box pen test?
Which Redundant Array of Inexpensive Disks (RAID) combines mirroring and striping and is the better option for mission critical applications?
What is Raid 10?
When using IPsec, which mode encrypts the entire packet?
What is tunnel mode?
After a recent incident, investigators are performing forensics on a Windows server. While using various tools to examine damaged data, they discover the timestamps on an NT file system (NTFS) volume do not seem correct and are a few hours different from local time. What determination should the experts conclude as the reason for the timestamp discrepancy?
What is NTFS timestamps are in UTC?
What equation is needed for a quantitative risk assessment?
What is SLE x ARO = ALE