WGU C845 TASK 3 AND SSCP CYBER
COMPREHENSIVE EXAM TEST
◉Angela wants to test a web browser's handling of unexpected data
using an automated tool. What tool should she choose?
A. Nmap
B. zzuf
C. Nessus
D. Nikto. Answer: B. zzuf is the only fuzzer on the list, and zzuf is
specifically designed to work with tools like web browsers, image
viewers, and similar software by modifying network and file input to
application. Nmap is a port scanner, Nessus is a vulnerability
scanner, and Nikto is a web server scanner.
◉Saria wants to log and review traffic information between parts of
her network. What type of network logging should she enable on her
routers to allow her to perform this analysis?
A. Audit logging
B. Flow logging
,C. Trace logging
D. Route logging. Answer: B. Flows, also often called network flows,
are captured to provide insight into network traffic for security,
troubleshooting, and performance management. Audit logging
provides information about events on the routers, route logging is
not a common network logging function, and trace logs are used in
troubleshooting specific software packages as they perform their
functions.
◉Ben's manager expresses concern about the coverage of his scan.
Why might his manager have this concern?
A. Ben did not test UDP services.
B. Ben did not discover ports outside the "well-known ports."
C. Ben did not perform OS fingerprinting.
D. Ben tested only a limited number of ports.. Answer: D. Nmap only
scans 1000 TCP and UDP ports by default, including ports outside
the 0-1024 range of "well-known" ports. By usin the defaults for
nmap, Ben missed 64,535 ports. OS fingerprinting won't cover more
ports but would have provided a best guess of the OS running on the
scanned system.
◉Allie is responsible for reviewing authentication logs on her
organization's network. She does not have the time to review all
logs, so she decides to choose only records where there have been
four or more invalid authentication attempts. What technique is
Allie using to reduce the size of the pool?
,A. Sampling
B. Random selection
C. Clipping
D. Statistical analysis. Answer: C. The two main methods of choosing
records from a large pool for further analysis are sampling and
clipping. Sampling uses statistical techniques to choose a sample
that is representative of the entire pool, while clipping uses
threshold values to select those records that exceed a predefined
threshold because they may be of most interest to analysts.
◉Jim has been contracted to conduct a gray box penetration test,
and his clients have provided him with the following information
about their networks so that he can scan them:
Data center: 10.10.10.0/24
Sales: 10.10.11.0/24
Billing: 10.10.12.0/24
Wireless: 192.168.0.0/16
What problem will Jim encounter if he is contracted to conduct a
scan from offsite?
A. The IP ranges are too large to scan efficiently.
B. The IP addresses provided cannot be scanned.
C. The IP ranges overlap and will cause scanning issues.
, D. The IP addresses provided are RFC 1918 addresses.. Answer: D.
The IP addresses that his clients have provided are RFC 1918
nonroutable IP addresses, and Jim will not be able to scan them from
off-site. To succeed in his penetration test, he will have to either first
penetrate their network border or place a machine inside their
network to scan from the inside. IP addresses overlapping is not a
real concern for scanning, and the ranges can easily be handled by
current scanning systems.
◉Susan wants to use her SIEM to deliver notifications when events
occur. Which of the following should she ensure is set to prevent
responders from ignoring the notifications?
A. An automated daily email with dashboard information.
B. A required login when notifications are sent.
C. Automated timeline creation for incident data.
D. Appropriate thresholds for notification.. Answer: D. One of the
most common reasons for notifications to be ignored is receiving too
many due to improperly set thresholds. Susan should work with
responders and administrators to ensure that thresholds are set to
effectively detect incidents without generating undue numbers for
notifications. Automated email is useful to ensure that recipients get
information but won't meet the need for real-time notifications for
actuals issues. Requiring logins when notifications are sent and help
to ensure data is not exposed, but this does not help with preventing
staff from ignoring them; adding another step may cause fewer staff
to read them. Finally, timelines are useful, but they won't prevent
notifications from being ignored.
COMPREHENSIVE EXAM TEST
◉Angela wants to test a web browser's handling of unexpected data
using an automated tool. What tool should she choose?
A. Nmap
B. zzuf
C. Nessus
D. Nikto. Answer: B. zzuf is the only fuzzer on the list, and zzuf is
specifically designed to work with tools like web browsers, image
viewers, and similar software by modifying network and file input to
application. Nmap is a port scanner, Nessus is a vulnerability
scanner, and Nikto is a web server scanner.
◉Saria wants to log and review traffic information between parts of
her network. What type of network logging should she enable on her
routers to allow her to perform this analysis?
A. Audit logging
B. Flow logging
,C. Trace logging
D. Route logging. Answer: B. Flows, also often called network flows,
are captured to provide insight into network traffic for security,
troubleshooting, and performance management. Audit logging
provides information about events on the routers, route logging is
not a common network logging function, and trace logs are used in
troubleshooting specific software packages as they perform their
functions.
◉Ben's manager expresses concern about the coverage of his scan.
Why might his manager have this concern?
A. Ben did not test UDP services.
B. Ben did not discover ports outside the "well-known ports."
C. Ben did not perform OS fingerprinting.
D. Ben tested only a limited number of ports.. Answer: D. Nmap only
scans 1000 TCP and UDP ports by default, including ports outside
the 0-1024 range of "well-known" ports. By usin the defaults for
nmap, Ben missed 64,535 ports. OS fingerprinting won't cover more
ports but would have provided a best guess of the OS running on the
scanned system.
◉Allie is responsible for reviewing authentication logs on her
organization's network. She does not have the time to review all
logs, so she decides to choose only records where there have been
four or more invalid authentication attempts. What technique is
Allie using to reduce the size of the pool?
,A. Sampling
B. Random selection
C. Clipping
D. Statistical analysis. Answer: C. The two main methods of choosing
records from a large pool for further analysis are sampling and
clipping. Sampling uses statistical techniques to choose a sample
that is representative of the entire pool, while clipping uses
threshold values to select those records that exceed a predefined
threshold because they may be of most interest to analysts.
◉Jim has been contracted to conduct a gray box penetration test,
and his clients have provided him with the following information
about their networks so that he can scan them:
Data center: 10.10.10.0/24
Sales: 10.10.11.0/24
Billing: 10.10.12.0/24
Wireless: 192.168.0.0/16
What problem will Jim encounter if he is contracted to conduct a
scan from offsite?
A. The IP ranges are too large to scan efficiently.
B. The IP addresses provided cannot be scanned.
C. The IP ranges overlap and will cause scanning issues.
, D. The IP addresses provided are RFC 1918 addresses.. Answer: D.
The IP addresses that his clients have provided are RFC 1918
nonroutable IP addresses, and Jim will not be able to scan them from
off-site. To succeed in his penetration test, he will have to either first
penetrate their network border or place a machine inside their
network to scan from the inside. IP addresses overlapping is not a
real concern for scanning, and the ranges can easily be handled by
current scanning systems.
◉Susan wants to use her SIEM to deliver notifications when events
occur. Which of the following should she ensure is set to prevent
responders from ignoring the notifications?
A. An automated daily email with dashboard information.
B. A required login when notifications are sent.
C. Automated timeline creation for incident data.
D. Appropriate thresholds for notification.. Answer: D. One of the
most common reasons for notifications to be ignored is receiving too
many due to improperly set thresholds. Susan should work with
responders and administrators to ensure that thresholds are set to
effectively detect incidents without generating undue numbers for
notifications. Automated email is useful to ensure that recipients get
information but won't meet the need for real-time notifications for
actuals issues. Requiring logins when notifications are sent and help
to ensure data is not exposed, but this does not help with preventing
staff from ignoring them; adding another step may cause fewer staff
to read them. Finally, timelines are useful, but they won't prevent
notifications from being ignored.
