Jason Dion Section 7 Practice exam Question and answers 2022

Jason Dion Section 7 Practice exam Question and answers 2022A cybersecurity analyst is working at a college that wants to increase the security of its network by implementing vulnerability scans of centrally managed workstations, student laptops, and faculty laptops. Any proposed solution must be able to scale up and down as new students and faculty use the network. Additionally, the analyst wants to minimize the numbrt of false positives to ensure accuracy in their results. The chosen solution must also be centrally-managed through an enterprise console. Which of the following scanning topologies would be BEST able to meet these requirements? ​ A.Active scanning engine installed on the enterprise console B.Passive scanning engine located at the core of the network infrastructure ​ C.Combination of cloud-based and server-based scanning engines ​ D.Combination of server-based and agent-based scanning engines A.Active scanning engine installed on the enterprise console Explanation OBJ-2: Since the college wants to ensure there is a centrally-managed enterprise console, using an active scanning engine installed on the enterprise console would best meet these requirements. Then, the college's cybersecurity analysts could perform scans on any devices that are connected to the network using the active scanning engine at the desired intervals. D.Agent-based scanning would be ineffective since the college cannot force the installation of the agents onto each of the personally owned devices brought in by the students or faculty. C.A cloud-based or server-based engine may be useful, but it won't address the centrally-managed requirement. Passive scanning is less intrusive but is subject to a high number of false positives. Marta's organization is concerned with the vulnerability of a user's account being vulnerable for an extended period of time if their password was compromised. Which of the following controls should be configured as part of their password policy to minimize this vulnerability? A. Minimum password length B.Password history C.Password expiration D.Password complexiy C.Password Expiration Explanation OBJ-4: A password expiration control in the policy would force users to change their password at specific intervals of time. This will then locks out a user who types in the incorrect password or create an alter that the user's account has been potentially compromised. While the other options are good components of password security to prevent an overall compromise, they are not effective against the vulnerability described in this particular scenario as it states the issue is based on time. B.Password history is used to determine the number of unique passwords a user must use before they can use an old password again. D.The Passwords must meet complexity requirements policy setting determines whether passwords must meet a series of guidelines that are considered important for a strong password. A.Maximum password length creates a limit to how long the password can be, but a longer password is considered stronger against a brute force attack. 00:02 01:10 Praveen is currently investigating activity from an attacker who compromised a host on the network. The individual appears to have used credentials belonging to a janitor. After breaching the system, the attacker entered some unrecognized commands with very long strings of text and then began using the sudo command to carry out actions. What type of attack has just taken place? A.Session hijacking B.Phishing C.Social Engineering D,Privilege escalation D,Privilege escalation Which of the following secure coding best practices ensures special characters like <, >, /, and ' are not accepted from the user via a web form? A.Session management B.Output encoding C.Input validation D.Error handling C.Input validation You have been tasked to create some baseline system images in order to remediate vulnerabilities found in different operating systems. Before any of the images can be deployed, they must be scanned for malware and vulnerabilities. You must ensure the configurations meet industry-standard benchmarks and that the baselining creation process can be repeated frequently. What vulnerability option would BEST create the process requirements to meet the industry-standard benchmarks? A.Utilizing a known malware plugin B.Utilizing a authorized credential scan C. Utilizing a non-credential scan D,Utilizing an operating system SCAP plugin D,Utilizing an operating system SCAP plugin OBJ-2: Security Content Automation Protocol (SCAP) is a multi-purpose framework of specifications that supports automated configuration, vulnerability and patch checking, technical control compliance activities, and security measurement. It is an industry-standard and support testing for compliance. The other options will not allow for a truly repeatable process since individual scans would occur each time, instead of comparing against a known good baseline. Which model of software development emphasizes individuals and interactions over processes and tools, customer collaboration over contract negotiation, and working software over comprehensive documentation? A.RAD B.Waterfall C.Agile D.SPiral C.Agile Explanation OBJ-4: Agile software development is characterized by the principles of the Agile Manifesto. The Agile Manifesto emphasizes individuals and interactions over the processes and tools that Spiral and Waterfall rely on. It also focuses on working software, customer collaboration, and responding to change as key elements of the Agile process. B.The waterfall model is a breakdown of project activities into linear sequential phases, where each phase depends on the deliverables of the previous one and corresponds to a specialization of tasks. A.Rapid Application Development (RAD) is a form of agile software development methodology that prioritizes rapid prototype releases and iterations. Unlike the Waterfall method, RAD emphasizes the use of software and user feedback over strict planning and requirements recording. D.Spiral development is a risk-driven software development model that guides a team to adopt elements of one or more process models, such as incremental, waterfall, or evolutionary prototyping. What containment techniques is the strongest possible response to an incident? ​ A.Segmentation ​ B.Enumeration ​ C.Isolating affected systems ​ D.Isolating the attacker C.Isolating affected systems Explanation OBJ-3: Isolation involves removing an affected component from whatever larger environment it is a part of. This can be everything from removing a server from the network after it has been the target of a DoS attack, to placing an application in a sandbox virtual machine (VM) outside of the host environments it usually runs on. Segmentation-based containment is a means of achieving the isolation of a host or group of hosts using network technologies and architecture. A.Segmentation uses VLANs, routing/subnets, and firewall ACLs to prevent a host or group of hosts from communicating outside the protected segment. Removal is not an industry term used but would be a synonym for isolation. B.Enumeration is defined as the process of extracting user names, machine names, network resources, shares, and services from a system. C.Isolating the attacker would only stop their direct two-way communication and control of the affected system, but it would not be the strongest possible response since there could be malicious code still running on your victimized machine. Which of the following provides a standard nomenclature for describing security-related software flaws? ​ A.CVE ​ B.VPC ​ C.SOX ​ D.SIEM A.CVE Explanation OBJ-2: Common Vulnerabilities and Exposures (CVE) is an element of the Security Content Automation Protocol (SCAP) that provides a standard nomenclature for describing security flaws or vulnerabilities. D.A SIEM is a solution that provides real-time or near-real-time analysis of security alerts generated by network hardware and applications. B.A VPC is a private network segment made available to a single cloud consumer on a public cloud. C.The Sarbanes-Oxley Act (SOX) dictates requirements for the storage and retention of documents relating to an organization's financial and business operations, including the type of documents to be stored and their retention periods. Which of the following technologies is NOT a shared authentication protocol? ​ A.LDAP B.OpenID Connect ​ C.OAuth ​ D.Facebook Connect A.LDAP Explanation OBJ-4: LDAP can be used for single sign-on but is not a shared authentication protocol. OpenID, OAuth, and Facebook Connect are all shared authentication protocols. B.Open ID Connect (OIDC) is an authentication protocol that can be implemented as special types of OAuth flows with precisely defined token fields. C.OAuth is designed to facilitate the sharing of information (resources) within a user profile between sites. Nick is participating in a security exercise as part of the network defense team for his organization. Which team is Nick playing on? ​ A.Blue team ​ B.Yellow team ​ C.Red team ​ D.White team A.Blue team Explanation OBJ-1.4: Penetration testing can form the basis of functional exercises. One of the best-established means of testing a security system for weaknesses is to play "war game" exercises in which the security personnel split into teams: red, blue, and white. C.The red team acts as the adversary. The blue team acts as the defenders. D.The white team acts as the referees and sets the parameters for the exercise. B.The yellow team is responsible for building tools and architectures in which the exercise will be performed. Jonathan's team completed the first phase of their incident response process. They are currently assessing the time to recover from the incident. Using the NIST recoverability effort categories, the team has decided that they can predict the time to recover, but this requires additional resources. How should he categorize this using the NIST model? ​ A.Extended ​ B.Regular ​ C.Supplemented D.Non-recoverable C.Supplemented Explanation OBJ-3: Based on the scenario given, the best choice is supplemented. The NIST keys are to remember that each level has additional unknowns as well as resources that increase the severity level from regular to supplemented then to extended. D.Non-recoverable situations exist when whatever happened cannot be remediated. In this case, an investigation would be started. In a non-governmental agency, this phase might even include notifying law enforcement. This question may seem beyond the scope of the exam, but the objectives allow for "other examples of technologies, processes, or tasks pertaining to each objective may also be included on the exam although not listed or covered" in the bulletized lists of the objectives. The exam tests the equivalent to 4 years of hands-on experience in a technical cybersecurity job role. The content examples listed in the objectives are meant to clarify the test objectives and should not be construed as a comprehensive listing of all the content of this examination. Therefore, questions like this are fair game on test day. That said, your goal is not to score 100% on the exam; it is to pass it. Don't let questions like this throw you off on test day. If you aren't sure, take your best guess and move on! Which of the following categories of controls are firewalls, intrusion detection systems, and a RADIUS server classified as? ​ A.Compensating controls ​ B.Technical controls C.Physical controls ​ D.Administrative controls B.Technical Controls Explanation OBJ-4: Firewalls, intrusion detection systems, and a RADIUS server are all examples of technical controls. Technical controls are implemented as a system of hardware, software, or firmware. D. Administrative controls involve processes and procedures. C.Physical controls include locks, fences, and other controls over physical access. A.Compensating controls are controls that are put in place to cover any gaps and reduce the risk remaining after using other types of controls.