CompTIA Security+ Exam Cram: Domain 3.0: Threats and Vulnerabilities

Jan 24, 2012

␡

⎙ Print

Page 1 of 3 Next >

This chapter provides sample questions (with answers and explanations) to help you prepare for the Domain 3 portion of the Security+ exam.

This chapter is from the book 

CompTIA Security+ SY0-301 Practice Questions Exam Cram, 3rd Edition

Learn More Buy

Securing your resources is a challenge in any working environment. After all, resources are now commonly attacked through software, hardware, and peripherals. Domain 3 of the Security+ exam requires that you understand how to identify and minimize system threats to thwart would-be attackers and that you recognize the different types of assessment tools that are available to discover security threats and vulnerabilities. Be sure to give yourself plenty of time to review all these concepts because there are quite a few. The following list identifies the key areas from Domain 3.0 (which counts as 21% of the exam) that you need to master:

Analyze and differentiate among types of malware
Analyze and differentiate among types of attacks
Analyze and differentiate among types of social engineering attacks
Analyze and differentiate among types of wireless attacks
Analyze and differentiate among types of application attacks
Analyze and differentiate among types of mitigation and deterrent techniques
Implement assessment tools and techniques to discover security threats and vulnerabilities
Within the realm of vulnerability assessments, explain the proper use of penetration testing versus vulnerability scanning

Practice Questions

Objective 3.1: Analyze and differentiate among types of malware.

Which of the following is the most common result of a buffer overflow?
- A. Privilege escalation
- B. Disguised malicious programs
- C. Code replication
- D. Collection of personal data
Quick Answer: 180

Detailed Answer: 184
Which of the following best describes a virus?
- A. An action that exceeds the storage-space allocation of an application
- B. A program disguised as a useful application
- C. A program designed to attach itself to other code and replicate
- D. Software that communicates information from a user’s system without notifying the user
Quick Answer: 180

Detailed Answer: 184
Which of the following is best describes a Trojan?
- A. It infects other systems only after a user executes the application that it is buried in.
- B. It sends messages to a computer with an IP address indicating that the message is coming from a trusted host.
- C. It collects personal information, or changes your computer configuration without appropriately obtaining prior consent.
- D. It is self-replicating and therefore needs no user intervention.
Quick Answer: 180

Detailed Answer: 184
Which of the following best describes a rootkit?
- A. Software used for the collection of personal data
- B. Software hidden on a computer for the purpose of compromising the system
- C. Software that provides the originator with the venue to propagate
- D. Software that reports data such as surfing habits and sites visited
Quick Answer: 180

Detailed Answer: 185
Which of the following is considered a worm?
- A. Melissa
- B. Acid Rain
- C. Code Red
- D. Mocmex
Quick Answer: 180

Detailed Answer: 185
A disgruntled employee creates a utility for purging old emails from the server. Inside the utility is code that will erase the server’s hard drive contents on January 1, 2012. This is an example of which of the following attacks?
- A. Virus
- B. Logic bomb
- C. Spoofing
- D. Trojan horse
Quick Answer: 180

Detailed Answer: 185
Which of the following best describes spyware?
- A. Software used for the collection of personal data
- B. Software hidden on a computer for the purpose of compromising the system
- C. Software that provides the originator with the venue to propagate
- D. Software that reports data such as surfing habits and sites visited
Quick Answer: 180

Detailed Answer: 185
Which of the following is the best reason not to request to be removed from a mailing list in a reply to an unsolicited email?
- A. It allows the sender to spoof your email address.
- B. It is a waste of time because the sender very seldom removes you from the list.
- C. It verifies that you have a legitimate, working email address.
- D. It allows the sender to collect personal data.
Quick Answer: 180

Detailed Answer: 185
Which of the following are methods by which email spam lists are created? (Select all correct answers.)
- A. Searching the Web for addresses
- B. Scanning newsgroup postings
- C. Stealing Internet mailing lists
- D. Stealing user email address books
Quick Answer: 180

Detailed Answer: 185
Which of the following best describes programming errors that result in allowing someone to gain unauthorized administrative access?
- A. Buffer overflow
- B. Virus
- C. Trojan
- D. Logic bomb
Quick Answer: 180

Detailed Answer: 186
Which of the following best describes malware that takes advantage of a security hole, and then automatically replicates to other systems running the same software?
- A. Spyware
- B. Virus
- C. Trojan
- D. Worm
Quick Answer: 180

Detailed Answer: 186
Which of the following is a type of malware that is disguised as a useful application?
- A. Spyware
- B. Virus
- C. Trojan
- D. Worm
Quick Answer: 180

Detailed Answer: 186
Which of the following is a type of malware associated with collecting personal information without appropriately obtaining prior consent?
- A. Spyware
- B. Virus
- C. Trojan
- D. Worm
Quick Answer: 180

Detailed Answer: 186
Which of the following is a type of malware hidden on a computer mainly for the purpose of compromising the system and getting escalated privileges?
- A. Spyware
- B. Spam
- C. Adware
- D. Rootkit
Quick Answer: 180

Detailed Answer: 187
Which of the following is a type of malware that provides the spam or virus originator with a venue to propagate?
- A. Logic bomb
- B. Botnet
- C. Adware
- D. Rootkit
Quick Answer: 180

Detailed Answer: 187
Which of the following is true with regard to antispyware programs?
- A. They must be updated regularly.
- B. They can detect rootkits.
- C. They can detect botnets.
- D. They do not have to be updated.
Quick Answer: 180

Detailed Answer: 187
Which of the following best describes the primary security issue with botnets?
- A. They are malicious.
- B. They can remain undetected.
- C. They can execute code.
- D. They are remotely controlled.
Quick Answer: 180

Detailed Answer: 187
Which of the following is also referred to as slag code?
- A. Logic bomb
- B. Botnet
- C. Adware
- D. Rootkit
Quick Answer: 180

Detailed Answer: 187
A buffer overflow can result in which of the following? (Select all correct answers.)
- A. Overwriting of data or memory storage
- B. A denial of service
- C. Automatic code replication to other hosts
- D. Execution of arbitrary code at a privileged level
Quick Answer: 180

Detailed Answer: 187
Which of the following are virus types? (Select all correct answers.)
- A. Polymorphic
- B. Polynomial
- C. Stealth
- D. Covert
Quick Answer: 180

Detailed Answer: 188
Which of the following best describes a boot sector virus?
- A. Can change each time it is executed to avoid detection
- B. Uses techniques to avoid detection
- C. Is placed into the first sector of the hard drive
- D. Infects executable program files and becomes active in memory
Quick Answer: 180

Detailed Answer: 188
Which of the following is another name for a botnet?
- A. Privilege escalation
- B. Global hook
- C. Honeynet
- D. Zombie army
Quick Answer: 180

Detailed Answer: 188
Which of the following is most like spyware?
- A. Virus
- B. Trojan
- C. Spam
- D. Worm
Quick Answer: 180

Detailed Answer: 188
Which of the following best describes what rootkits use for stealth activity?
- A. Global hooks
- B. Tracking software/adware
- C. Privilege escalation
- D. Social engineering
Quick Answer: 180

Detailed Answer: 188
Which of the following is the most effective method to avoid rootkit infection?
- A. Never responding to the sender of an unsolicited email message
- B. Running operating systems from an account with lesser privileges
- C. Properly disabling the accounts of all terminated employees
- D. Only downloading trusted applications
Quick Answer: 180

Detailed Answer: 188
Which of the following best describes a botnet?
- A. A program designed to execute malicious actions when a certain event occurs or a period of time goes by
- B. A large number of programs disguised as useful applications
- C. A large number of computers that forward transmissions to other computers on the Internet
- D. Exploitation in software code that takes advantage of a programming flaw
Quick Answer: 180

Detailed Answer: 188
Which of the following terms is most closely related to software exploitation that crashes the system and leaves it in a state where arbitrary code can be executed?
- A. Logic bomb
- B. Privilege escalation
- C. Spam
- D. Trojan
Quick Answer: 180

Detailed Answer: 189
Which of the following are the most effective ways to prevent an attacker from exploiting software? (Select all correct answers.)
- A. Apply current patches
- B. Do not allow Internet access
- C. Apply current service packs
- D. Monitor the Web for newly discovered vulnerabilities
Quick Answer: 180

Detailed Answer: 189
Which of the following virus is a hybrid of boot and program viruses?
- A. Polymorphic
- B. Macro
- C. Stealth
- D. Multipartite
Quick Answer: 180

Detailed Answer: 189
Which of the following malware finds other systems running the same vulnerable software and then replicates itself without any user interaction?
- A. Virus
- B. Trojan
- C. Worm
- D. Logic bomb
Quick Answer: 180

Detailed Answer: 189
Which of the following is the main difference between a Trojan and a virus?
- A. A Trojan requires user interaction and a virus does not.
- B. A Trojan does not replicate itself and a virus does.
- C. A virus does not require user interaction and a Trojan does.
- D. A virus does not replicate itself and a Trojan does.
Quick Answer: 180

Detailed Answer: 189
Which of the following are indications that a computer may contain spyware? (Select all correct answers.)
- A. The browser home page changes.
- B. It takes a long time for the Windows desktop to come up.
- C. Clicking a link does nothing or goes to an unexpected website.
- D. The email inbox contains an unsolicited email message.
Quick Answer: 180

Detailed Answer: 189
Which of the following are acceptable ways of dealing with spam? (Select all correct answers.)
- A. Delete the email without opening it.
- B. Reply back and try to identify the spammer.
- C. Turn off the preview function of your email software.
- D. Immediately call the local law enforcement office.
Quick Answer: 180

Detailed Answer: 190
Which of the following are ways a rootkit can be installed? (Select all correct answers.)
- A. By accessing documents on the local intranet.
- B. Included as part of software package.
- C. An unpatched vulnerability.
- D. The user downloads it.
Quick Answer: 180

Detailed Answer: 190
Which of the following is a type of malware that can use encryption to protect outbound communications and piggyback on commonly used ports to communicate without interrupting other applications that use that port?
- A. Logic bomb
- B. Botnet
- C. Adware
- D. Rootkit
Quick Answer: 180

Detailed Answer: 190
The system administrator abruptly leaves the organization after being passed over for a promotion. Two weeks later, employees report they cannot access files. It has been determined that at midnight the system suddenly began deleting files. Which of the following is the most likely type of malicious code that caused this event?
- A. Logic bomb
- B. Botnet
- C. Adware
- D. Rootkit
Quick Answer: 180

Detailed Answer: 190
Which of the following would best describe the type of malicious code that enters a system through a freeware program that the user installed?
- A. Virus
- B. Trojan
- C. Worm
- D. Logic bomb
Quick Answer: 180

Detailed Answer: 190
Which of the following type of virus avoids antivirus software detection by changing form each time it is executed?
- A. Polymorphic
- B. Macro
- C. Stealth
- D. Multipartite
Quick Answer: 180

Detailed Answer: 190
Which of the following is an automated computer program controlled by outside sources with the intention of forwarding transmissions to other computers on the Internet?
- A. Logic bomb
- B. Adware
- C. Bot
- D. Virus
Quick Answer: 180

Detailed Answer: 191
Which of the following are steps taken to protect a network from malicious code? (Select all correct answers.)
- A. Do not use any type of removable media from another user without first scanning the disk.
- B. Open all attachments sent to you by people you might know.
- C. Install firewalls or intrusion-prevention systems on client machines.
- D. Subscribe to security newsgroups.
Quick Answer: 180

Detailed Answer: 191

Objective 3.2: Analyze and differentiate among types of attacks.

Which of the following ports should be blocked when it has been determined that an intruder has been using Telnet for unauthorized access?
- A. 110
- B. 21
- C. 23
- D. 443
Quick Answer: 180

Detailed Answer: 191
Which of the following ports should be blocked when it has been determined that an intruder has been using SNMP for unauthorized access? (Select all correct answers.)
- A. 161
- B. 162
- C. 443
- D. 4445
Quick Answer: 180

Detailed Answer: 191
Which of the following best describes TCP/IP hijacking?
- A. Providing false identity information to gain unauthorized access
- B. An established connection without specifying a username or password
- C. An attacker takes control of a session between the server and a client
- D. Redirecting traffic by changing the IP record for a specific domain
Quick Answer: 180

Detailed Answer: 191
Which of the following best describes spoofing?
- A. Providing false identity information to gain unauthorized access
- B. An established connection without specifying a username or password
- C. An attacker takes control of a session between the server and a client
- D. Redirecting traffic by changing the IP record for a specific domain
Quick Answer: 180

Detailed Answer: 191
Which of the following best describes a null session?
- A. Providing false identity information to gain unauthorized access
- B. An established connection without specifying a username or password
- C. An attacker takes control of a session between the server and a client
- D. Redirecting traffic by changing the IP record for a specific domain
Quick Answer: 180

Detailed Answer: 192
Which of the following best describes DNS poisoning?
- A. Providing false identity information to gain unauthorized access
- B. An established connection without specifying a username or password
- C. An attacker taking control of a session between the server and a client
- D. Redirecting traffic by changing the IP record for a specific domain
Quick Answer: 180

Detailed Answer: 192
Which of the following best describes a man-in-the-middle attack?
- A. An attacker takes advantage of the add/grace period to monopolize names without ever paying for them.
- B. Packets are captured, the pertinent information is extracted, and then packets are placed back on the network.
- C. An attack that typically involves flooding a listening port on a machine with packets to disrupt service.
- D. An attacker intercepts traffic and then tricks the parties at both ends into believing that they are communicating with each other.
Quick Answer: 180

Detailed Answer: 192
Which of the following best describes a replay attack?
- A. An attacker takes advantage of the add/grace period to monopolize names without ever paying for them.
- B. Packets are captured, the pertinent information is extracted, and then packets are placed back on the network.
- C. An attack that typically involves flooding a listening port on a machine with packets to disrupt service.
- D. An attacker intercepts traffic and then tricks the parties at both ends into believing that they are communicating with each other.
Quick Answer: 180

Detailed Answer: 192
Which of the following best describes a DDoS attack?
- A. An attacker takes advantage of the add/grace period to monopolize names without ever paying for them.
- B. Packets are captured, the pertinent information is extracted, and then packets are placed back on the network.
- C. An attack that typically involves flooding a listening port on a machine with packets to disrupt the resources.
- D. An attacker intercepts traffic and then tricks the parties at both ends into believing that they are communicating with each other.
Quick Answer: 180

Detailed Answer: 192
Which of the following methods can be used to mitigate DDoS attacks? (Select all correct answers.)
- A. Setting up filters on external routers to drop all ICMP packets
- B. Reducing the amount of time before the reset of an unfinished TCP connection
- C. Increasing the amount of time before the reset of an unfinished TCP connection
- D. Setting up a filter that denies traffic originating from the Internet that shows an internal network address
Quick Answer: 180

Detailed Answer: 192
Which of the following best describes ARP poisoning?
- A. Broadcasting a fake reply to an entire network
- B. Changing the IP record for a specific domain
- C. Sending fragmented UDP packets
- D. Distributing zombie software
Quick Answer: 180

Detailed Answer: 193
Which of the following attacks is associated with services using an interprocess communication share such as network file and print-sharing services?
- A. DNS spoofing
- B. Null sessions
- C. ARP poisoning
- D. DNS kiting
Quick Answer: 180

Detailed Answer: 193
Which of the following sends hundreds of ICMP packets to the host to block or reduce activity?
- A. DNS spoofing
- B. ARP poisoning
- C. Man-in-the-middle
- D. Denial of service
Quick Answer: 180

Detailed Answer: 193
Which of the following type of attacks is most likely being executed when an unauthorized service is relaying information to a source outside the network?
- A. DNS spoofing
- B. ARP poisoning
- C. Man-in-the-middle
- D. Denial of service
Quick Answer: 180

Detailed Answer: 193
Which of the following best describes the primary security issue with null sessions?
- A. The sessions are not terminated properly.
- B. The connection is not authenticated.
- C. The connection is not encrypted.
- D. The sessions are remotely controlled.
Quick Answer: 180

Detailed Answer: 193
Which of the following is the most effective way to reduce null session vulnerability?
- A. Reducing the reset time of an unfinished TCP connection
- B. Using the signing capabilities of certificates
- C. Setting up filters to drop all ICMP packets
- D. Disabling NetBIOS over TCP/IP
Quick Answer: 180

Detailed Answer: 193
Which of the following are effective ways to mitigate spoofing attacks? (Select all correct answers.)
- A. Editing the Registry on Windows-based computers to restrict anonymous access
- B. Using IPsec to secure transmissions between critical servers and clients
- C. Denying traffic originating from the Internet that shows an internal network address
- D. Using the signing capabilities of certificates on servers and clients
Quick Answer: 180

Detailed Answer: 194
Which of the following is the most effective method to mitigate session hijacking?
- A. Denying traffic originating from the Internet that shows an internal network address
- B. Forcing users to reauthenticate before allowing transactions to occur
- C. Reducing the amount of time before the reset of an unfinished TCP connection
- D. Setting up filters on external routers to drop all incoming ICMP packets
Quick Answer: 180

Detailed Answer: 194
When mitigating null session vulnerability, which of the following ports should be closed? (Select all correct answers.)
- A. 161
- B. 162
- C. 139
- D. 445
Quick Answer: 180

Detailed Answer: 194
Which of the following sessions can typically result in a man-in-the-middle attack? (Select all correct answers.)
- A. Telnet
- B. Wireless
- C. Email
- D. Samba
Quick Answer: 180

Detailed Answer: 194
Which of the following are ways to minimize the effects of DNS poisoning when hosting your own DNS? (Select all correct answers.)
- A. Checking that the hosting server is not open-recursive
- B. Running operating systems from an account with lesser privileges
- C. Using different servers for authoritative and recursive lookups
- D. Disabling recursive access for networks to resolve names that are not in zone files
Quick Answer: 180

Detailed Answer: 194
Which of the following are the most effective methods to mitigate ARP poisoning on a large network? (Select all correct answers.)
- A. Using equipment that offers port security
- B. Using static mapping for IP addresses and ARP tables
- C. Using script-based mapping for IP addresses and ARP tables
- D. Deploying monitoring tools or an intrusion detection system (IDS)
Quick Answer: 180

Detailed Answer: 194
Which of the following best describes privilege escalation?
- A. A default set of user credentials
- B. Data transmitted that can be easily sniffed
- C. Accidental or intentional access to resources
- D. Application code functions allowing unauthorized access
Quick Answer: 180

Detailed Answer: 195
Which of the following best describes a back door?
- A. A default set of user credentials
- B. Data transmitted that can be easily sniffed
- C. Accidental or intentional access to resources
- D. Application code functions allowing unauthorized access
Quick Answer: 180

Detailed Answer: 195
In a corporate environment, which of the following is most vulnerable to DoS attacks?
- A. Internal user systems
- B. Network resources
- C. Network storage
- D. Internal servers
Quick Answer: 180

Detailed Answer: 195
Which of the following best describes a denial-of-service (DoS) attack?
- A. Intentional access to resources not intended for access by the user
- B. Application code functions that allow unauthorized access to network resources
- C. Attempt to block access by overwhelming network availability
- D. Attempt to directly access the resources through unauthorized means
Quick Answer: 180

Detailed Answer: 195
Which of the following is the best method to mitigate attacks against networking devices and services installed with a default set of user credentials?
- A. Replacing them on an as-needed basis
- B. Replacing them when an attack has been detected
- C. Replacing them with unique strong logon credentials
- D. Replacing them with the same strong logon credential
Quick Answer: 180

Detailed Answer: 195
Which of the following is the most common origin of back doors?
- A. Created during application development
- B. Created during system certification
- C. Created during user interface testing
- D. Created during implementation
Quick Answer: 180

Detailed Answer: 196
Which of the following should be performed when implementing distributed wireless network configurations spanning multiple buildings or open natural areas?
- A. Land survey
- B. Building inspection
- C. OSHA inspection
- D. Site survey
Quick Answer: 180

Detailed Answer: 196
Which of the following is most closely linked to privilege escalation?
- A. SSID broadcast
- B. Application flaws
- C. Application development
- D. Automated attacks
Quick Answer: 180

Detailed Answer: 196
Which of the following is most closely linked to weak passwords?
- A. SSID broadcast
- B. Application flaws
- C. Application development
- D. Automated attacks
Quick Answer: 181

Detailed Answer: 196
Which of the following is most closely linked to back doors?
- A. SSID broadcast
- B. Application flaws
- C. Application development
- D. Automated attacks
Quick Answer: 181

Detailed Answer: 197
Which of the following is most closely linked to default accounts?
- A. Network resources
- B. Application flaws
- C. Network credentials
- D. Automated attacks
Quick Answer: 181

Detailed Answer: 197
Which of the following is most closely linked to denial of service?
- A. Network resources
- B. SSID broadcast
- C. Network credentials
- D. Application development
Quick Answer: 181

Detailed Answer: 197
Which of the following best describes the situation where User A can read User B’s email without specific authorization?
- A. Privilege escalation
- B. Default accounts
- C. Weak passwords
- D. Back door
Quick Answer: 181

Detailed Answer: 197
Which of the following best describes the situation where a software designer puts in shortcut entry points to allow rapid code evaluation and testing?
- A. Privilege escalation
- B. Default accounts
- C. Weak passwords
- D. Back door
Quick Answer: 181

Detailed Answer: 198
Which of the following attacks are associated with weak passwords? (Select all correct answers.)
- A. Packet sniffing
- B. Automated attacks
- C. Social engineering
- D. Denial of service
Quick Answer: 181

Detailed Answer: 198
Which of the following attacks are associated with fringe service industries such as online casinos?
- A. Packet sniffing
- B. Automated attacks
- C. Social engineering
- D. Denial of service
Quick Answer: 181

Detailed Answer: 198
Which of the following is an email attack that is targeted toward a specific individual?
- A. Spear Phishing
- B. Vishing
- C. Smishing
- D. Pharming
Quick Answer: 181

Detailed Answer: 199
Which of the following is an attack where the attacker will often use a fake caller-ID to appear as a trusted organization and attempt to get the individual to enter account details via the phone?
- A. Spear Phishing
- B. Vishing
- C. Smishing
- D. Pharming
Quick Answer: 181

Detailed Answer: 199
Which of the following is an attack that redirects victims to a bogus website, even if they correctly entered the intended site?
- A. Spear Phishing
- B. Vishing
- C. Smishing
- D. Pharming
Quick Answer: 181

Detailed Answer: 199
Which of the following attacks involves using phishing methods through text messaging?
- A. Spear Phishing
- B. Vishing
- C. Smishing
- D. Pharming
Quick Answer: 181

Detailed Answer: 199
Which of the following is a type of advertising message that targets users of instant messaging (IM) services?
- A. Vishing
- B. Spim
- C. Spam
- D. Phishing
Quick Answer: 181

Detailed Answer: 199
Which of the following observing attacks observes how a host responds to an odd TCP/IP packet?
- A. DNS spoofing
- B. Null sessions
- C. ARP poisoning
- D. Xmas attack
Quick Answer: 181

Detailed Answer: 200
Which of the following attacks is accomplished by gaining the trust of a computer that is trusted by the target network?
- A. Packet sniffing
- B. Transitive access
- C. Social engineering
- D. Denial of service
Quick Answer: 181

Detailed Answer: 200

Objective 3.3: Analyze and differentiate among types of social engineering attacks.

A help desk employee receives a call from someone who is posing as a technical aide attempting to update some type of information, and asks for identifying user details that may then be used to gain access. Which of the following type of attack has occurred?
- A. Pharming
- B. Social engineering
- C. Phishing
- D. Shoulder surfing
Quick Answer: 181

Detailed Answer: 200
A help desk employee receives a call from the administrative assistant. She has received an email stating if she doesn’t respond within 48 hours with certain personal information, the corporate bank account will be closed. Which of the following type of attack has occurred?
- A. Pharming
- B. Social engineering
- C. Phishing
- D. Shoulder surfing
Quick Answer: 181

Detailed Answer: 200
The help desk is flooded with calls from users that received an email warning them of a new virus. The mail instructed the users to search for and delete several files from their systems. Many of the users who attempted to reboot their systems after deleting the specified files are having difficulties and the machines are not rebooting properly. Which of the following type of attack has occurred?
- A. Pharming
- B. Hoax
- C. Phishing
- D. Spam
Quick Answer: 181

Detailed Answer: 200
An organization discovers that many employees have been responding to chain letter emails. Which of the following is the greatest concern to the organization?
- A. Undue burden on resources.
- B. They may contain viruses.
- C. Theft of proprietary information.
- D. Nothing. Chain letters are harmless.
Quick Answer: 181

Detailed Answer: 200
An organization allows employees to access confidential data remotely. Many of the sales staff spend extended time in public places and use this downtime to catch up on work. Which of the following is the greatest concern to the organization?
- A. Virus infection
- B. Social engineering
- C. Dumpster diving
- D. Shoulder surfing
Quick Answer: 181

Detailed Answer: 201
Which of the following type of attacks is intended to go after high-profile targets such as an executive within a company?
- A. Spear Phishing
- B. Vishing
- C. Smishing
- D. Whaling
Quick Answer: 181

Detailed Answer: 201
An employee receives an automated call from the organization’s bank asking the employee to enter the bank account number and pin on the telephone keypad to verify account information for their records. Which of the following type of attack has occurred?
- A. Spear Phishing
- B. Vishing
- C. Smishing
- D. Whaling
Quick Answer: 181

Detailed Answer: 201
The employees in the financial department of your organization have received emails from the local credit union, asking them to click on a link inside the email to update their passwords and user IDs because of a recent security breach. Which of the following type of attack has occurred?
- A. Spear Phishing
- B. Vishing
- C. Smishing
- D. Whaling
Quick Answer: 181

Detailed Answer: 201
An organization does not have a policy on proper document disposal. When Mary goes outside to empty her trash, a nice young man has been offering to do it for her. Which of the following best describes the attack that is taking place?
- A. Virus infection
- B. Social engineering
- C. Dumpster diving
- D. Shoulder surfing
Quick Answer: 181

Detailed Answer: 202
As Joe is about to enter a secured building, a nice young woman runs up behind him, smiles, and follows him into the building without using her own ID. Which of the following type of attack has occurred?
- A. Pharming
- B. Social engineering
- C. Shoulder surfing
- D. Tailgating
Quick Answer: 181

Detailed Answer: 202

Objective 3.4: Analyze and differentiate among types of wireless attacks.

Which of the following best describes a major security issue when implementing WAPs?
- A. WEP is the default encryption.
- B. The SSID is broadcast in plain text.
- C. They are hard to physically locate.
- D. Any node can view the data of another node.
Quick Answer: 181

Detailed Answer: 202
Which of the following best describes why data emanation is a security risk in wireless networks? (Select all correct answers.)
- A. It uses 802.1x transmissions that generate detectable radio-frequency signals funneled into one direction.
- B. Sniffing the data may use many solutions to increase the distance over which detection is possible.
- C. Sniffing the data may use many solutions to reduce the distance over which transmission is possible.
- D. It uses 802.1x transmissions that generate detectable radio-frequency signals in all directions.
Quick Answer: 181

Detailed Answer: 202
Which of the following is the primary method to mitigate the vulnerabilities associated with communication over an 802.1x wireless link?
- A. Authorization
- B. Authentication
- C. Encryption
- D. Identification
Quick Answer: 181

Detailed Answer: 203
Which of the following type of attacks is associated with the use of wireless communication? (Select all correct answers.)
- A. Packet sniffing
- B. Session hijacking
- C. Man-in-the-middle
- D. Spam relaying
Quick Answer: 181

Detailed Answer: 203
Which best describes why session hijacking is possible in wireless communication?
- A. There is no authorization mechanism.
- B. There is no authentication mechanism.
- C. The authentication mechanism is one-way.
- D. The authorization mechanism is one-way.
Quick Answer: 181

Detailed Answer: 203
Which of the following best describes why a man-in-the-middle attack is possible in wireless communication?
- A. The request for connection by the client is a bidirectional open broadcast.
- B. The request for connection by the access point is a bidirectional open broadcast.
- C. The request for connection by the access point is an omnidirectional open broadcast.
- D. The request for connection by the client is an omnidirectional open broadcast.
Quick Answer: 181

Detailed Answer: 203
Which of the following best describes war-driving?
- A. Driving around with a laptop system configured to listen for open access points
- B. Dialing a large range of telephone numbers in search of devices that can be exploited
- C. Marking landmarks to indicate the presence of an available access point
- D. Accessing an open public WAP for a monthly fee or commission from the end user
Quick Answer: 181

Detailed Answer: 203
Which of the following best describes war-chalking?
- A. Driving around with a laptop system configured to listen for open access points
- B. Dialing a large range of telephone numbers in search of devices that can be exploited
- C. Marking landmarks to indicate the presence of an available access point
- D. Accessing an open public for a monthly fee or commission from the end user
Quick Answer: 181

Detailed Answer: 203
Which of the following best describes bluejacking?
- A. Driving around with a laptop configured to listen for open access points
- B. Sending broadcast spam from a nearby Bluetooth-enabled device
- C. Deleting data on a Bluetooth device that has opened a connection
- D. Marking landmarks to indicate an available open access point
Quick Answer: 181

Detailed Answer: 203
Which of the following best describes bluesnarfing?
- A. Driving around with a laptop configured to listen for open access points
- B. Sending broadcast spam from a nearby Bluetooth-enabled device
- C. Deleting data on a Bluetooth device that has opened a connection
- D. Marking landmarks to indicate an available open access point
Quick Answer: 181

Detailed Answer: 204
Which of the following best describes a WLAN technology that uses Ethernet protocols?
- A. Wi-Fi
- B. i-Mode
- C. Bluetooth
- D. WAP
Quick Answer: 181

Detailed Answer: 204
Which of the following best describes the situation that allows using reflective tube waveguides such as a Pringle’s can to capture data?
- A. Weak encryption
- B. Session hijacking
- C. War-driving
- D. Data emanation
Quick Answer: 181

Detailed Answer: 204
Which of the following best describes the situation that allows a hijacker to wait until the authentication cycle is completed, then generate a signal that causes the client to think it has been disconnected from the access point?
- A. Weak encryption
- B. Session hijacking
- C. War-driving
- D. Data emanation
Quick Answer: 181

Detailed Answer: 204
Which of the following best describes what might allow data transacted over an 802.1x wireless link to be passed in clear form?
- A. Weak encryption
- B. Session hijacking
- C. War-driving
- D. Data emanation
Quick Answer: 181

Detailed Answer: 205
Which of the following best describes the situation where an attack is aimed at pairing with the attacker’s device for unauthorized access, modification, or deletion of data?
- A. Bluejacking
- B. Bluesnarfing
- C. War-driving
- D. War-chalking
Quick Answer: 181

Detailed Answer: 205
Which of the following best describes the situation that allows an attack aimed at the identification of existing wireless networks, the SSID used, and any known WEP keys?
- A. Weak encryption
- B. Session hijacking
- C. War-driving
- D. Data emanation
Quick Answer: 181

Detailed Answer: 205
Which of the following best describes the situation where an attack is aimed at generating messages that appear to be from the device itself?
- A. Bluejacking
- B. Bluesnarfing
- C. War-driving
- D. War-chalking
Quick Answer: 181

Detailed Answer: 205
In which of the following attacks would the implementation of a rogue AP with stronger signal strength than more remote permanent installations be found?
- A. Weak encryption
- B. Man-in-the-middle
- C. War-driving
- D. Data emanation
Quick Answer: 181

Detailed Answer: 206
The Wi-Fi Protected Access standards were developed by the Wi-Fi Alliance to replace which of the following?
- A. DES
- B. WAP
- C. AES
- D. WEP
Quick Answer: 181

Detailed Answer: 206
WSL is equivalent to which of the following layers of the OSI model?
- A. Session
- B. Transport
- C. Network
- D. Presentation
Quick Answer: 181

Detailed Answer: 205

Objective 3.5: Analyze and differentiate among types of application attacks.

Which of the following are identified vulnerabilities of the Java language? (Select all correct answers.)
- A. Buffer overflows
- B. Unauthorized file upload
- C. Email exposure
- D. Unexpected redirection
Quick Answer: 181

Detailed Answer: 206
Which of the following most accurately describes how Java applets execute?
- A. When the web server retrieves the directory web page
- B. When the web server’s browser loads the hosting web page
- C. When the client machine’s browser loads the hosting web page
- D. When the operating system loads the hosting web page
Quick Answer: 181

Detailed Answer: 206
Which of the following best describes the reason Java applets are a security risk?
- A. Java is compiled on the client browser.
- B. Java is a precompiled language.
- C. Java is compiled by the client operating system.
- D. Java applets execute on the hosting web server.
Quick Answer: 181

Detailed Answer: 207
Which of the following are identified vulnerabilities of JavaScript? (Select all correct answers.)
- A. Buffer overflows
- B. Unauthorized file upload
- C. Email exposure
- D. Unexpected redirection
Quick Answer: 181

Detailed Answer: 207
Which of the following is the most effective method to mitigate vulnerabilities exposed by earlier forms of Java?
- A. Keeping machines up-to-date with new version releases
- B. Disabling third-party browser extensions
- C. Setting the pop-up blocker setting to high
- D. Enabling Integrated Windows Authentication
Quick Answer: 181

Detailed Answer: 207
ActiveX and its controls share many of the same vulnerabilities present in which of the following?
- A. Cookies
- B. JavaScript
- C. Embedded Java applets
- D. Common Gateway Interface script
Quick Answer: 181

Detailed Answer: 207
Which of the following is the most realistic method to mitigate having cookies expose long-term browsing habits?
- A. Disabling third-party browser extensions
- B. Regularly clearing the browser cookie cache
- C. Configuring client browsers to block all cookies
- D. Disabling automatic code execution on client browsers
Quick Answer: 181

Detailed Answer: 207
Which of the following is the most effective method to mitigate buffer overflows or cross-site scripting attacks?
- A. Blocking third-party cookies
- B. Accepting only numeric data input
- C. Disabling third-party browser extensions
- D. Validating data input
Quick Answer: 181

Detailed Answer: 207
Which of the following is most likely to use a tracking cookie?
- A. Spyware
- B. Credit Union
- C. Trojan
- D. Shopping cart
Quick Answer: 181

Detailed Answer: 208
Which of the following best describes what the exploitation of Simple Mail Transfer Protocol (SMTP) relay agents is used for?
- A. Buffer overflow
- B. Logic bomb
- C. Spyware
- D. Spam
Quick Answer: 181

Detailed Answer: 208
Which of the following best describes a tracking cookie?
- A. Beneficial
- B. Permanent
- C. Temporary
- D. Valuable
Quick Answer: 181

Detailed Answer: 208
S-HTTP communicates over which of the following ports?
- A. 80
- B. 443
- C. 110
- D. 4445
Quick Answer: 181

Detailed Answer: 208
HTTPS communicates over which of the following ports?
- A. 80
- B. 443
- C. 110
- D. 4445
Quick Answer: 181

Detailed Answer: 208
Which of the following exploits are associated with SSL certificates? (Select all correct answers.)
- A. Ill-formatted requests
- B. Small key sizes
- C. Outdated CRLs
- D. Buffer overflows
Quick Answer: 181

Detailed Answer: 208
Which of the following vulnerabilities are associated with LDAP? (Select all correct answers.)
- A. Ill-formatted requests
- B. Small key sizes
- C. Outdated CRLs
- D. Buffer overflows
Quick Answer: 181

Detailed Answer: 209
Which of the following vulnerabilities are associated with FTP? (Select all correct answers.)
- A. Buffer overflows
- B. Anonymous file access
- C. Unencrypted authentication
- D. Improper formatted requests
Quick Answer: 181

Detailed Answer: 208
FTP over SSL communicates over which of the following ports?
- A. 21
- B. 80
- C. 22
- D. 81
Quick Answer: 181

Detailed Answer: 208
Which of the following are security concerns when allowing IM applications on the network? (Select all correct answers.)
- A. The capture of cached logs containing conversations
- B. Malware spreading through IM contacts
- C. Unauthorized data and video sharing
- D. Improper formatted requests
Quick Answer: 181

Detailed Answer: 209
Which of the following are exploits for CGI scripts? (Select all correct answers.)
- A. Buffer overflows.
- B. Anonymous file access.
- C. Arbitrary commands may be executed on the server.
- D. Arbitrary commands may be executed on the client.
Quick Answer: 182

Detailed Answer: 209
An attacker places code within a web page that redirects the client’s browser to attack yet another site when a client’s browser opens the web page. This is an example of what type of attack?
- A. Unencrypted authentication
- B. Session hijacking
- C. Buffer overflow
- D. Cross-site scripting
Quick Answer: 182

Detailed Answer: 209
Which of the following best describes Java or JavaScript?
- A. Java applets allow access to cache information.
- B. JavaScript can provide access to files of known name.
- C. JavaScript runs even after the applet is closed.
- D. Java applets can execute arbitrary instructions on the server.
Quick Answer: 182

Detailed Answer: 210
Which of the following is another name for identification of configuration details of the server that may be helpful to later identify unauthorized access attempts?
- A. Profiling
- B. Reporting
- C. Abstracting
- D. Hyperlinking
Quick Answer: 182

Detailed Answer: 210
Which of the following is the most likely reason it is dangerous to maintain cookie session information?
- A. It provides custom user configuration settings.
- B. It may expose sensitive information about secured sites.
- C. It allows multiple actual connections to a web server.
- D. It may allow automatic code execution on client browsers.
Quick Answer: 182

Detailed Answer: 210
Which of the following are browser-based vulnerabilities? (Select all correct answers.)
- A. Session hijacking
- B. SQL injection
- C. Buffer overflows
- D. Social engineering
Quick Answer: 182

Detailed Answer: 210
Which of the following is of most concern for a security administrator when allowing peer-to-peer networking?
- A. Buffer-overflow attacks can go unnoticed.
- B. Unauthorized file upload to network servers.
- C. Connections are negotiated directly between clients.
- D. Arbitrary commands may be executed on the server.
Quick Answer: 182

Detailed Answer: 210

Objective 3.6: Analyze and differentiate among types of mitigation and deterrent techniques.

Physically unsecured equipment is vulnerable to which of the following type of attacks?
- A. Brute force
- B. Social engineering
- C. Malware
- D. Rootkits
Quick Answer: 182

Detailed Answer: 210
Which of the following is the primary goal of a physical security plan?
- A. To deny access to most users allowing only corporate officers
- B. To allow access to all visitors without causing undue duress
- C. To allow only trusted use of resources via positive identification
- D. To deny access to all except users deemed credible
Quick Answer: 182

Detailed Answer: 211
Which of the following may be used to prevent an intruder from monitoring users in very high-security areas? (Select all correct answers.)
- A. Picket fencing
- B. Painted glass
- C. Frosted glass
- D. Chain-link fencing
Quick Answer: 182

Detailed Answer: 211
Which of the best describes the physical area known as no-man’s land?
- A. An area of cleared land surrounding a building
- B. An area of bushes surrounding a building
- C. A holding area between two entry points
- D. A receiver mechanism that reads an access card
Quick Answer: 182

Detailed Answer: 211
Which of the following best describes a mantrap?
- A. An area of cleared land surrounding a building
- B. An area of bushes surrounding a building
- C. A holding area between two entry points
- D. A receiver mechanism that reads an access card
Quick Answer: 182

Detailed Answer: 211
Which of the following best describes the difference between a cipher lock and a wireless lock?
- A. A cipher lock is opened by a receiver mechanism, whereas a wireless lock has a punch code entry.
- B. A cipher lock is opened with a key, whereas a wireless lock has a remote control mechanism.
- C. A cipher lock is opened with a remote control mechanism, whereas a wireless lock is opened with a key.
- D. A cipher lock has a punch code entry, whereas a wireless lock is opened by a receiver mechanism.
Quick Answer: 182

Detailed Answer: 211
Which of the following type of surveillance would the organization implement if it was required that the parking lot be constantly monitored?
- A. CCTV cameras
- B. Security guards
- C. Keycard gate
- D. Motion detectors
Quick Answer: 182

Detailed Answer: 211
Which of the following technologies are used in external motion detectors? (Select all correct answers.)
- A. Infrared
- B. Sound
- C. RFID
- D. Ultrasonic
Quick Answer: 182

Detailed Answer: 211
Which of the following best describes mandatory physical control?
- A. User access is closely monitored and very restricted with no exceptions.
- B. Common needs are predetermined, and access is allowed with the same key.
- C. Access is delegated to parties responsible for that building or room.
- D. Each individual has a unique key that corresponds to his or her access needs.
Quick Answer: 182

Detailed Answer: 211
Which of the following best describes role-based physical control?
- A. User access is closely monitored and very restricted with no exceptions.
- B. Common needs are predetermined and access is allowed with the same key.
- C. Access is delegated to parties responsible for that building or room.
- D. Each individual has a unique key that corresponds to his or her access need.
Quick Answer: 182

Detailed Answer: 212
Which of the following physical safeguards would provide the best protection for a building that houses top-secret sensitive information and systems? (Choose all that apply.)
- A. Mantrap
- B. No-man’s land
- C. Wooden fence
- D. Door access system
Quick Answer: 182

Detailed Answer: 212
Which of the following physical safeguards would be most commonly implemented in security for banks?
- A. Mantraps
- B. Security dogs
- C. Painted glass
- D. Video surveillance
Quick Answer: 182

Detailed Answer: 212
Which of the following is the main security concern of implementing motion detectors?
- A. They can easily be deactivated.
- B. They can easily be fooled.
- C. They are extremely sensitive.
- D. They are extremely expensive.
Quick Answer: 182

Detailed Answer: 212
Running which of the following commands is the quickest way to tell which ports are open and which services are running on the machine?
- A. netstat
- B. nbtstat
- C. ipconfig
- D. msconfig
Quick Answer: 182

Detailed Answer: 212
Which of the following protocols is used for monitoring the health of network equipment, computer equipment, and devices?
- A. SNAP
- B. SMTP
- C. SDLC
- D. SNMP
Quick Answer: 182

Detailed Answer: 212
Which of the following are effective ways to protect the network infrastructure from attacks aimed at antiquated or unused ports and protocols? (Select all correct answers.)
- A. Keeping only protocols installed by default
- B. Allowing traffic only on necessary ports
- C. Removing any unnecessary protocols
- D. Allowing only traffic requested by users
Quick Answer: 182

Detailed Answer: 212
Which of the following would be considered a best practice for improved server performance when deciding where to store log files?
- A. Store in the system directory of a machine in the DMZ
- B. Store in the system directory on the local machine
- C. Store on a nonsystem striped or mirrored disk volume
- D. Store on a nonsystem disk volume on the local machine
Quick Answer: 182

Detailed Answer: 213
Which of the following would be considered a best security practice when deciding where to store log files?
- A. Stored in the system directory on the local machine
- B. Stored in a data directory on a server in the intranet
- C. Stored in the system directory of a machine in the DMZ
- D. Stored in a centralized repository of an offline volume
Quick Answer: 182

Detailed Answer: 213
An organization requires the implementation of an enterprise application logging strategy. Which of the following would be a critical analysis consideration when choosing a solution?
- A. A proprietary custom-built solution
- B. Already built-in application logging solutions
- C. A solution that uses standard protocols and formats
- D. A variety of solutions that each use different formats
Quick Answer: 182

Detailed Answer: 213
Internet Information Services (IIS) logs can be used for which of the following purposes? (Select all correct answers.)
- A. Assess content
- B. Identify bottlenecks
- C. End processes
- D. Investigate attacks
Quick Answer: 182

Detailed Answer: 213
Which of the following most accurately describes best practice for using Microsoft DNS logging?
- A. Only the user events should be logged.
- B. Only pertinent events should be logged.
- C. All events should be logged so nothing is missed.
- D. Nothing should be logged until there is a need for it.
Quick Answer: 182

Detailed Answer: 213
Which of the following would be the first place an administrator would look when troubleshooting UNIX- or Linux-based systems?
- A. Mtools.conf
- B. Msconfig
- C. Event Viewer
- D. Syslogd
Quick Answer: 182

Detailed Answer: 213
Which of the following would be considered best practices for system logging? (Select all correct answers.)
- A. For easy compilation, keep log files in plain text.
- B. When permissible, encrypt the log files.
- C. Store log files on a standalone system.
- D. Store log files on individual system data partitions.
Quick Answer: 182

Detailed Answer: 213
Which of the following would an administrator use to end applications that get hung up without having to reboot the machine?
- A. Network Monitor
- B. Task Manager
- C. Event Viewer
- D. Performance Console
Quick Answer: 182

Detailed Answer: 213
Which of the following would provide information for troubleshooting remote-access policy issues?
- A. Internet Information Services logging
- B. Critical and error-level logging
- C. Authentication and accounting logging
- D. Event Viewer Application logging
Quick Answer: 182

Detailed Answer: 214
Which of the following types of logging events are most commonly found in antivirus software? (Select all correct answers.)
- A. Updates
- B. Dropped packets
- C. Quarantined viruses
- D. Update history
Quick Answer: 182

Detailed Answer: 214
An organization primarily contracts workers and is concerned about remote-access usage and remote-authentication attempts. Which of the following would the organization implement to track this type of activity?
- A. Firewall logging
- B. RRAS logging
- C. IIS logging
- D. System logging
Quick Answer: 182

Detailed Answer: 214
Which of the following best describes auditing?
- A. The process of measuring the performance of a network
- B. The process of collecting data to be used for monitoring
- C. The process of tracking users and actions on the network
- D. The process of observing the state of a system
Quick Answer: 182

Detailed Answer: 214
Which of the following are unintended consequences when auditing is not clear-cut or built around the organizational goals and policies? (Select all correct answers.)
- A. Irrelevant information is gathered.
- B. Important security events are deleted.
- C. User hard drives quickly run out of space.
- D. System administrators have reduced workloads.
Quick Answer: 182

Detailed Answer: 214
A systems administrator is tasked with auditing user privileges. Which of the following steps must be taken? (Select two correct answers.)
- A. Enable logging within the operating system.
- B. Enable auditing within the operating system.
- C. Specify the resources to be audited.
- D. Specify the audit file storage directory.
Quick Answer: 182

Detailed Answer: 214
An organization has primarily contract workers and is concerned about unauthorized and unintentional access on these accounts. Which of the following would the organization audit to track this type of activity?
- A. Group policies
- B. Retention policies
- C. DHCP events and changes
- D. Access use and rights changes
Quick Answer: 182

Detailed Answer: 214
Which of the following is true about the auditing of failed logon events and successful login events?
- A. Only failed events should be audited.
- B. Only successful events should be audited.
- C. Both successful and failed events should be audited.
- D. Neither one should be audited unless absolutely necessary.
Quick Answer: 182

Detailed Answer: 214
Which of the following best describes the activity that involves collecting information used for monitoring and reviewing purposes?
- A. Auditing
- B. Logging
- C. Baselining
- D. Inspecting
Quick Answer: 182

Detailed Answer: 215
Which of the following best describes the unintended consequence of turning on all auditing counters for all objects?
- A. Reduced user productivity
- B. Reduced I/O activity on user machines
- C. Reduced administrative overhead
- D. Reduced server performance
Quick Answer: 182

Detailed Answer: 215
Which of the following best describes how settings will actually be applied to an object in a group policy?
- A. Individually applied to the object and only from the last policy
- B. A combination of all the settings that can affect the object
- C. Only from settings within the domain where the object is located
- D. A combination of only local group policies that affect the object
Quick Answer: 182

Detailed Answer: 215
An administrator is attempting to resolve some issue with multiple group policies on several computers. Which of the following tools would be used to script GPO troubleshooting of multiple computers?
- A. Gpupdate
- B. Gpresult
- C. Resultant Set of Policy
- D. Group Policy object
Quick Answer: 182

Detailed Answer: 215
Which of the following tools is used to review the effects of Group Policy settings on a particular computer?
- A. Resultant Set of Policy
- B. Group Policy object
- C. Gpupdate
- D. Local Security settings
Quick Answer: 182

Detailed Answer: 215
An organization is concerned with unusual activity indicating that an intruder is attempting to gain access to the network. Which of the following event categories should be audited?
- A. Audit success events in the account management
- B. Success events in the policy change on domain controllers
- C. Success and failure events in the system events
- D. Audit success events in the logon event category
Quick Answer: 182

Detailed Answer: 215
An organization wants a record of when each user logs on to or logs off from any computer. Which of the following event categories should be audited?
- A. Audit success events in the account management event
- B. Success events in the policy change on domain controllers
- C. Success and failure events in the system events
- D. Audit success events in the logon event category
Quick Answer: 182

Detailed Answer: 215
An organization wants to verify when users log on to or log off from the domain. Which of the following event categories should be audited?
- A. Audit success events in the account management event
- B. Success events in the policy change on domain controllers
- C. Success events in the account logon on domain controllers
- D. Audit success events in the logon event category
Quick Answer: 182

Detailed Answer: 216

Objective 3.7: Implement assessment tools and techniques to discover security threats and vulnerabilities.

Which of the following is a software utility that will scan a single machine or a range of IP addresses checking for a response on service connections?
- A. Port scanner
- B. Network mapper
- C. Protocol analyzer
- D. Vulnerability scanner
Quick Answer: 182

Detailed Answer: 216
Which of the following is a software utility that will scan a range of IP addresses testing for the presence of known weaknesses in software configuration and accessible services?
- A. Port scanner
- B. Network mapper
- C. Protocol analyzer
- D. Vulnerability scanner
Quick Answer: 182

Detailed Answer: 216
Which of the following is a software utility that is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications?
- A. Port scanner
- B. Network mapper
- C. Protocol analyzer
- D. Vulnerability scanner
Quick Answer: 182

Detailed Answer: 216
Which of the following is a software utility that is used to conduct network assessments over a range of IP addresses and compiles a listing of all systems, devices, and hardware present within a network segment?
- A. Port scanner
- B. Network mapper
- C. Protocol analyzer
- D. Vulnerability scanner
Quick Answer: 182

Detailed Answer: 217
Which of the following best describes the purpose of OVAL?
- A. An abstract description for layered communications and computer network protocol design
- B. A family of standards dealing with local area networks and metropolitan area networks
- C. An international standard setting body composed of representatives from various national standards organizations
- D. An international language for representing vulnerability information allowing the development of vulnerability test tools
Quick Answer: 182

Detailed Answer: 217
An administrator working in the Department of Homeland Security needs to document standards for the assessment process of systems. Which of the following would be most useful to the administrator?
- A. OVAL
- B. IEEE
- C. ISO
- D. ISSA
Quick Answer: 182

Detailed Answer: 217
An organization wants to select an assessment tool for creating an inventory of services hosted on networked systems. Which of the following should the organization choose?
- A. Port scanner
- B. Network mapper
- C. Protocol analyzer
- D. Vulnerability scanner
Quick Answer: 182

Detailed Answer: 217
An organization wants to select an assessment tool that will examine individual protocols and specific endpoints. Which of the following should the organization choose?
- A. Port scanner
- B. Network mapper
- C. Protocol analyzer
- D. Vulnerability scanner
Quick Answer: 182

Detailed Answer: 217
An organization wants to select an assessment tool for checking particular versions and patch levels of a service. Which of the following should the organization choose?
- A. Port scanner
- B. Network mapper
- C. Protocol analyzer
- D. Vulnerability scanner
Quick Answer: 182

Detailed Answer: 218
Which of the following assessment techniques are typically conducted using automated software programs designed to check code, as well as manual human checks, by someone not associated with development?
- A. Architecture reviews
- B. Code reviews
- C. Design reviews
- D. Attack Surface determination
Quick Answer: 182

Detailed Answer: 218
Which of the following refers to the amount of running code, services, and user-interaction fields and interfaces?
- A. Architecture reviews
- B. Code reviews
- C. Design reviews
- D. Attack Surface determination
Quick Answer: 182

Detailed Answer: 218
Which of the following assessment techniques typically provides the capability to identify faulty components and interaction between various elements?
- A. Architecture reviews
- B. Code reviews
- C. Design reviews
- D. Attack Surface determination
Quick Answer: 182

Detailed Answer: 218
When using a password cracker to test mandatory complexity guidelines, which of the following should the password cracker provide?
- A. The password only
- B. The password and hash value
- C. The username and password
- D. The strength of the password
Quick Answer: 182

Detailed Answer: 219
An organization wants to select an assessment tool that will report information used to identify single points of failure. Which of the following should the organization choose?
- A. Port scanner
- B. Network mapper
- C. Protocol analyzer
- D. Vulnerability scanner
Quick Answer: 182

Detailed Answer: 219
Which of the following tools is often referred to as a packet sniffer?
- A. Port scanner
- B. Network mapper
- C. Protocol analyzer
- D. Vulnerability scanner
Quick Answer: 182

Detailed Answer: 219

Objective 3.8: Within the realm of vulnerability assessments, explain the proper use of penetration testing versus vulnerability scanning.

Which of the following is best described as a friendly attack against a network to test the security measures put into place?
- A. Vulnerability assessment
- B. Penetration test
- C. Security assessment
- D. Compliance test
Quick Answer: 183

Detailed Answer: 219
Which of the following are the most serious downsides to conducting a penetration test? (Select all correct answers.)
- A. They can cause some disruption to network operations.
- B. The help desk can be flooded by affected users.
- C. They can generate false data in IDS systems.
- D. External users can have difficulty accessing resources.
Quick Answer: 183

Detailed Answer: 220
Which of the following is true about inexperienced internal systems administrators performing penetration tests against the organizational network? (Select all correct answers.)
- A. It is a safe practice.
- B. It is a bad practice.
- C. It may be a violation of privacy laws.
- D. It does not violate any privacy laws.
Quick Answer: 183

Detailed Answer: 220
Which of the following is true about the relationship between vulnerability assessment and penetration testing?
- A. They are inversely related.
- B. They are contradictory.
- C. They are separate functions.
- D. They are complementary.
Quick Answer: 183

Detailed Answer: 220
Which of the following is the main security risk of penetration testing?
- A. It can conceal aggression that is unrelated to the test.
- B. It can affect user connectivity and resource access.
- C. It can disrupt the normal business environment.
- D. It can weaken the network’s security level.
Quick Answer: 183

Detailed Answer: 220
Which of the following is conducted with the assessor having no information or knowledge about the inner workings of the system or knowledge of the source code?
- A. Black box
- B. White box
- C. Gray box
- D. Green box
Quick Answer: 183

Detailed Answer: 220
In which of the following types of testing would a developer test if programming constructs are placed correctly and carry out the required actions?
- A. Black box
- B. White box
- C. Gray box
- D. Green box
Quick Answer: 183

Detailed Answer: 220
An organization wants to select an assessment tool that will create graphical details suitable for reporting on network configurations. Which of the following should the organization choose?
- A. Port scanner
- B. Network mapper
- C. Protocol analyzer
- D. Vulnerability scanner
Quick Answer: 183

Detailed Answer: 221
An organization wants to select an assessment tool that will directly test user logon password strength. Which of the following should the organization choose?
- A. Password Locker
- B. Password generator
- C. Password cracker
- D. Password keychain
Quick Answer: 183

Detailed Answer: 221
Which of the following best describes the difference between a port scanner and a vulnerability scanner?
- A. Port scanners test only for the availability of services; vulnerability scanners check for a particular version or patch level of a service.
- B. Port scanners compile a listing of all hardware present within a network segment; vulnerability scanners check for the availability of services.
- C. Vulnerability scanners test only for the availability of services; port scanners check for a particular version or patch level of a service.
- D. Vulnerability scanners compile a listing of all hardware present within a network segment; port scanners test for the availability of services.
Quick Answer: 183

Detailed Answer: 221