1.
What feature of a network switch allows the network administrator to capture network traffic when monitoring or troubleshooting the network?
Correct Answer
D. Port Mirroring
Explanation
The port mirroring feature of a network switch is designed to send a copy of any data destined for a group of ports to a monitored port. The network administrator connects their monitoring station to the monitored port in order to monitor the network traffic.
2.
Your manager has been reading about hackers capturing network traffic in a switched network environment and is wondering how it is possible that hackers can do this. How can this be accomplished? (Select all that apply.)
Correct Answer(s)
A. ARP Poisioning
D. MAC flooding
Explanation
Hackers can use a few different techniques to bypass the filtering feature of a switch. The hacker can use ARP poisoning, which poisons the ARP cache on all systems, forcing them to send data to the hacker’s system. Another technique is MAC flooding, which involves the hacker sending bogus MAC addresses to the switch, which causes the switch to not trust the MAC address table. As a result the switch starts flooding all frames (sends the frames to every port) where the hacker is connected and running sniffer software.
3.
Your company has a web application that seems to be running slowly. Your manager is wondering what can be done to improve the performance. How do you respond?
Correct Answer
B. Install a load balancer
Explanation
A load balancer can be used to split the workload between multiple systems, in this case multiple web servers. Load balancing is a common solution for optimizing performance on web sites or even mail servers.
4.
Which of the following devices could be used to limit which web sites users on the network can visit?
Correct Answer
C. Proxy server
Explanation
Proxy servers are used to control outbound Internet access by filtering web sites users can surf and applications they can use.
5.
Which TCP/IP protocol is used to convert the IP address to a MAC address?
Correct Answer
A. ARP
Explanation
The ARP protocol is responsible for converting the IP address to a MAC address.
6.
What ICMP type is used to identify echo request messages?
Correct Answer
C. 8
Explanation
The ICMP type for echo request messages is ICMP type 8.
7.
Which of the following identifies the stages of the three-way handshake?
Correct Answer
B. SYN, ACK/SYN, ACK
Explanation
The order of the packets for a three-way handshake is SYN, ACK/SYN, and then ACK.
8.
Which of the following represents ports used by secure TCP applications? (Select all that apply.)
Correct Answer(s)
B. 22
E. 443
Explanation
SSH, which is a secure protocol to replace Telnet, uses port 22, while HTTPS is a secure replacement for HTTP traffic and uses port 443.
9.
You are the network administrator for a small company, and you wish to follow security best practices that relate to the switch. Which of the following should you do? (Select all that apply.)
Correct Answer(s)
A. Disable unused ports
C. Configure port security
E. Enable console password
Explanation
When securing devices such as a switch, ensure the administration port, such as a console port, has a password configured. Also disable any unused port and configure port security on the ports.
10.
What popular feature of a switch allows you to create communication boundaries between systems connected to the switch?
Correct Answer
E. VLANs
Explanation
When you place systems in a VLAN, by default they cannot communicate with systems outside the VLAN. You can have a router route the information from one VLAN to another.
11.
As requested by your manager you purchase two servers to participate in a server cluster so that if one server fails, the other server will take over the workload. Which of the following goals of security has been met?
Correct Answer
D. Availability
Explanation
Availability is ensuring that the company asset, such as a server and its data, is available at all times. You can help offer availability by using RAID, server clusters, or performing regular backups.
12.
You have protected the contents of a highly sensitive file by encrypting the data using Windows EFS. Which of the following goals of security has been satisfied?
Correct Answer
A. Confidentiality
Explanation
Confidentiality involves ensuring untrusted parties cannot view sensitive information. You typically implement confidentiality by encrypting data and communications or by setting permissions on the resource.
13.
You have managed the file permissions on a file so that unauthorized persons cannot make modifications to the file. What goal of security has been met?
Correct Answer
C. Integrity
Explanation
Integrity deals with ensuring that the data has not been altered after being sent to the recipient or stored on the server. In this example, you have modified the permissions so that unauthorized changes to the file cannot be made, which is ensuring the integrity of the file.
14.
You have configured your network so that each person on the network must provide a username and password to gain access. Presenting a username is an example of what?
Correct Answer
B. Identification
Explanation
Presenting a username to the system is an example of how the user identifies themselves to the system.
15.
You have configured the permissions on the accounting folder so that the Accounting group can create, modify, and delete content in the folder; the Managers group can read the contents of the folder; and all other users have been denied access. This is an example of which of the following?
Correct Answer
C. Authorization
Explanation
Authorization typically involves configuring an access control list such as a permission list and specifying what level of access to a resource a user may have.
16.
Which of the following are considered biometrics? (Select all that apply)
Correct Answer(s)
D. Fingerprint
E. Retina scan
Explanation
Biometrics is using a characteristic of yourself to authenticate to a system. Popular examples of biometrics are fingerprint reading, retina scanning, and voice recognition.
17.
Before an individual is authorized to access resources on the network, they are first ________ with the network.
Correct Answer
A. Authenticated
Explanation
Before authorization can occur each individual must first be authenticated to the system or network. Authentication is the proving of your identity by typically using a password (authentication) to go with the username (identification).
18.
You have taken the time to create and implement security policies within your organization. This is an example of which of the following?
Correct Answer
D. Due care
Explanation
Due care is the act of doing the right thing. In this example, the action is the creation of
the security policy that should exist in all organizations.
19.
All accountants need to be able to modify the accounting data except for Bob. Due to Bob’s job requirements, you have ensured that Bob receives only the read permission to the accounting data. This is an example of which of the following?
Correct Answer
C. Least privilege
Explanation
A very important principle of security is the concept of least privilege. Least privilege is
the principle that you should always give only the minimum level of permissions or rights to an
individual.
20.
Which of the following represents the reasoning for implementing rotation of duties in your environment?
Correct Answer
A. To limit fraudulent activities within the organization
Explanation
Rotation of duties is designed to hold people responsible for their actions by having
someone else take over the position at a later time. Someone holding this position will not be
likely to perform fraudulent activities knowing that someone else will detect that activity once
placed in the position.
21.
Within most organizations the person who writes the check is not the person who signs the check. This is an example of which of the following?
Correct Answer
B. Separation of duties
Explanation
Having the person that writes the check being different than the person who signs the
check is an example of separation of duties.
22.
After creating and implementing the company security policy, you verify that policies are being followed on a regular basis by performing regular audits. This is an example of which of the following?
Correct Answer
A. Due diligence
Explanation
Due diligence is the assessing and verifying of actions and the assessing of risks to a
company. In this example, you are verifying that the policy is being followed.
23.
What type of hacker learns hacking techniques so that they can better defend against a malicious hacker?
Correct Answer
C. White-hat
Explanation
A white-hat hacker learns hacking techniques to learn how to defend against a
malicious hacker.
The other options are incorrect for the following reasons:
A black-hat hacker is someone who hacks for financial gain
or malicious reasons. A gray-hat hacker is someone who learns of a vulnerability and then
publishes it to the world. There is no such thing as a yellow-hat hacker.
24.
The entity that is responsible for deciding the level of protection that is placed on data and that is ultimately responsible for the security of that data is which of the following?
Correct Answer
B. Owner
Explanation
The owner decides on the value of the asset and what level of protection is needed. The
owner is management within the organization, and they are ultimately responsible for securing
the environment.
25.
The entity that is responsible for implementing the appropriate security controls to protect an asset is which of the following?
Correct Answer
A. Custodian
Explanation
The custodian is responsible for implementing the controls to protect the asset and is
your IT staff.
26.
Which type of policy is not optional and must be adhered to?
Correct Answer
B. Standard
Explanation
A standard is the type of policy that must be followed.
The other answers are incorrect for the following reasons:
A procedure is a step-by-step document that demonstrates how
to accomplish specific tasks. A guideline is a policy that makes a recommendation that does not
need to be followed. Least privilege is incorrect because it is not a type of policy but a principle
of security that involves ensuring that you always give the lowest privileges or permissions
needed to accomplish a goal.
27.
Which of the following are considered PII-related information that must be secured at all times? (Choose all that apply)
Correct Answer(s)
B. Driver’s license
D. Social Security number
Explanation
Personal Identifiable Information (PII) is unique information about a person that
should be protected at all times and kept confidential.
28.
What is the first step in creating a security policy?
Correct Answer
A. Obtain management approval and support.
Explanation
The first step to creating a security policy is to get approval and support from upper-level
management. Although downloading sample templates may be a great idea to
help you create the policies, it is not the first thing that needs to be done. Creating the AUP
and reviewing job roles are also not correct answers because you always need to obtain support
from management first when dealing with policies.
29.
One of the network administrators in the office has been monitoring the proxy server logs and notices that Bob has visited some inappropriate web sites. What policy is this in violation of?
Correct Answer
C. AUP
Explanation
The acceptable use policy (AUP) contains the rules for proper computer, Internet,
e-mail, and device usage within the company. The firewall policy contains rules for what type of traffic is allowed to
pass through firewalls, and the proxy server policy is similar to the firewall policy and is
designed to control what traffic is allowed to go inside and outside the network. The hiring
policy contains rules surrounding the process for HR to follow when hiring a new employee.
30.
The technical team is putting together the firewall solution and needs to know what type of traffic is to pass through the firewall. What policy can the technical team use to find out what traffic is to pass through the firewall?
Correct Answer
D. Firewall policy
Explanation
The firewall policy contains the detailed information needed to know what the company’s approved firewall configuration is. The acceptable use policy (AUP) contains the rules for proper computer, Internet, e-mail, and device usage within the company. The hiring policy contains rules surrounding the process for HR to follow when hiring a new employee. The VPN policy
contains details on the approved VPN solution and what the requirements are for employees to
be able to VPN into the network from a remote location.
31.
The network administrator is configuring the network and wants to put restrictions on user passwords such as the length of the password, password complexity, and password history. Where can the administrator find out what the values of those settings should be set to?
Correct Answer
B. Password policy
Explanation
The password policy contains the password requirements that need to be enforced on the network servers. The VPN policy contains details on the approved VPN solution and what the requirements are for employees to be able to VPN into the network from a remote location. The acceptable use policy (AUP) contains the rules for proper computer, Internet e-mail, and device usage within the company. The secure disposal of computers policy contains the rules governing how to get rid of old computers and equipment and requires that all confidential data is securely removed from the device or computer.
32.
Doug is the network administrator for a law firm and has just purchased 20 new systems for the employees. Doug has collected all of the old computers from the employees and has searched through the hard drives and deleted any DOC and XLS files before handing the computers over to the local school. What policy may Doug be in violation of?
Correct Answer
D. Secure disposal of computers
Explanation
The secure disposal of computers policy contains the rules surrounding what to do with equipment that is no longer needed in the company. The policy should state that all hard drives have to be physically destroyed before passing the computers on, so that you can ensure that no confidential data can be retrieved from the system.
33.
Data classification labels are applied to ______, while clearance levels are applied to ______.
Correct Answer
C. Information, employees
Explanation
Information within the company is assigned a data classification label, while the employees are then given a clearance level. For example, a document may be assigned the top secret classification label so that for an employee to gain access to the information, they must have the top secret clearance level.
34.
Bob requires the capabilities to change the system time on the computers, but instead of adding Bob to the Administrators group (who can change the time on the computer), you grant Bob the Change System Time right. This is an example of following which security principle?
Correct Answer
A. Least privilege
Explanation
The concept of least privilege is to ensure you give only the minimal permissions or rights needed to perform a task. Job rotation is a security principle that requires employees to rotate through job positions on a regular basis in order to detect any improper activities. Separation of duties is a security principle that involves dividing a job into multiple tasks with each task being performed by a different employee. The acceptable use policy (AUP) contains the rules for proper computer, Internet, e-mail, and device usage within the company.
35.
Which of the following is a good reason to ensure all employees take vacation time each year?
Correct Answer
B. To hold employees accountable for any suspicious activity
Explanation
The security reason to implement mandatory vacation is so that while they are on vacation, you can hopefully detect improper activity performed by an employee. If the employee is always around, they will continue to avoid detection of their activity.
36.
Management is concerned that an employee may be able to hide fraudulent activity for long durations while working for the company. What would you recommend to help detect an improper activity performed by employees?
Correct Answer
D. Job rotation
Explanation
Implementing the security principle known as job rotation is a great way to detect fraudulent activities performed by employees. The concept of least privilege is to ensure you give only the minimal permissions or rights needed to perform a task. The acceptable use policy (AUP) contains the rules for proper computer, Internet, e-mail, and device usage within the company. Disabling the user account and access cards will not help you detect fraudulent activity—you need someone to take over the job role for a while in hopes they will discover improper activity by the previous employee.
37.
Management has come to you to let you know that John, a longtime employee of the company, has been stealing money from the company. Management and HR are headed into a meeting with John to let him know he is no longer needed. What should you do while they are in the meeting?
Correct Answer
C. Disable the employee’s user accounts and access cards
Explanation
You will want to verify with management before they head into the meeting what your responsibilities are, and they will typically inform you of what corporate policy is surrounding the termination of employment, but typically you want to disable the account while notice is given to the employee so that when the employee comes out of the meeting, they cannot access company assets and do any damage.
38.
Sue comes to you asking if it is okay if she downloads movies to her company laptop with a P2P program so that she can watch the movies while she is away on business. Which of the following is the best response?
Correct Answer
A. Educate Sue on the fact that those programs are popular ways to spread viruses, so no, the
company does not allow P2P software on its systems.
Explanation
The key point here is to educate the user on company policy regarding the use of P2P software with company assets. Explain to the user the risks associated with downloading content from untrusted sources, and explain that P2P software is where a lot of viruses come from.
39.
What is the term used for when someone slips through an open door behind you after you have unlocked the door?
Correct Answer
C. Tailgating
Explanation
Tailgating or piggybacking is the term we use in the security field for someone who enters a locked door behind you after it is opened by an authorized person. Be sure to educate employees on tailgating!
40.
You are talking with management about ways to limit security threats such as tailgating within the company. Management has said there is no money to spend on controls such as mantraps—what can you do to reduce the risk of tailgating?
Correct Answer
B. Training and awareness.
Explanation
One of the ways to control tailgating in highly secure environments is to use a mantrap—an area between two locked doors where one door does not open until the first door is closed. Solutions such as mantraps or revolving doors are great solutions but they cost money. A cheap solution in low secure environments is to educate the employees on tailgating and to not open the door if someone is hanging around the entrance.
41.
Your manager has called you into the office and has expressed concerns about a number of news reports on social engineering attacks. Your manager would like to know what can be done to protect the company against social engineering attacks. What would you recommend to your manager?
Correct Answer
B. User awareness and training.
Explanation
User awareness and training is the only way to protect against social engineering attacks. Technology solutions such as firewalls, antivirus software, and physical security will always help a little, but to truly protect against social engineering attacks, you need to educate the users so they are aware of security best practices.
42.
Which of the following controls will help protect against tailgating?
Correct Answer
D. Mantrap
Explanation
A mantrap is an area between two locked doors. The second door cannot be opened until the first door is locked, which helps employees entering the facility notice anyone who may try to enter along with them.
43.
What is the term used for a phishing attack that is targeted toward a specific person such as the executive of a company?
Correct Answer
A. Whaling
Explanation
Whaling is the term for targeting the phishing attack to “the big fish” in the company. With a whaling attack the e-mail message is typically personalized by using the name of that individual. Phishing is sending a generic e-mail to a mass group of people in hopes that someone clicks the link that goes to the fake web site. Pharming is modifying DNS or the hosts file to lead people to the wrong site. Spim is spamming (sending unsolicited e-mails) through instant messenger applications.
44.
What type of attack results in the victim’s system not being able to perform its job function?
Correct Answer
C. Denial of service
Explanation
A denial of service attack involves the hacker causing a system to not perform its job role by overburdening the system with traffic. The DoS attack could cause the system to crash or slow the system down.
45.
The hacker has managed to poison everyone’s ARP cache so that all traffic to the Internet is being sent to the hacker’s system before they route it out to the Internet. What type of attack is this?
Correct Answer
D. MiTM
Explanation
When the hacker positions himself between two systems and is receiving a copy of all traffic before passing it on to the real destination, this is a man-in-the-middle (MiTM) attack.
46.
What file can the hacker modify after compromising your system that could lead you to the wrong web site?
Correct Answer
B. Hosts
Explanation
The hosts file on a system is used to resolve domain names to IP addresses and can be used by the hacker to lead you to the wrong web site if the hacker gains access to this file.
47.
What type of attack is a smurf attack?
Correct Answer
A. DDoS
Explanation
A smurf attack is an example of a DDoS attack. It involves the hacker spoofing the IP address so that ping messages appear to come from the victim. When all of the systems that were pinged reply to the ping message, they overburden the victim’s system.
48.
John has been studying hacking techniques used by hackers and decides to send a packet to your system, but ensures that he alters the source IP address of the packet so it looks like it came from someone else. What type of attack is this?
Correct Answer
D. Spoofing
Explanation
Spoofing is when someone alters the source address of a message. IP spoofing is the altering of the source IP address, MAC spoofing is when the hacker alters the source MAC address, and e-mail spoofing is when the hacker alters the source e-mail address of a message.
49.
Your manager has been reading a lot about popular password attacks such as dictionary attacks and brute-force attacks. Your manager is worried that your company is susceptible to such attacks. Which of the following controls will help protect against a brute-force attack?
Correct Answer
B. Account lockout
Explanation
To protect against a brute-force attack, you need to take the time away from the hacker. Implementing an account lockout policy takes time away from the hacker so that they can try logging only a few times before the account is locked and unusable.
50.
Which of the following methods is a popular method to protect against dictionary attacks?
Correct Answer
A. Password complexity
Explanation
Implementing password complexity is a way to countermeasure dictionary attacks on the network. Implementing an account lockout policy is a potential way to protect against a dictionary attack, but for certification exams we associate account lockout as a method of protecting against brute-force attacks. A network firewall will not protect you from internal password attacks, and an intrusion detection system may notify you of the suspicious traffic, but will not protect against the password attack.