SANS COMPREHENSIVE TEST SCRIPT
2026 QUESTIONS WITH SOLUTIONS 100%
CORRECT.
⩥ LDAP - Lightweight Directory Access Protocol. Ans: An Internet
Protocol (IP) and data storage model that supports authentication and
directory functions. It is a remote access authentication protocol.
Vendors = Microsoft Active Directory, CA eTrust Directory, Apache
Directory Server, Novell eDirectory, IBM SecureWay and Tivoli
Directory Server, Sun Directlry Server. OpenLDAP and tinyldap open
source versions.
⩥ User Account. Ans: Allows a user to authenticate to system services
and be granted authorization to access them; however, authentication
does not imply authorization.
⩥ Service Account. Ans: Is an account that a service on your computer
uses to run under and access resources. This should not be a user's
personal account. Can also be an account that is used for a scheduled
task (e.g., batch job account) or an account that is used in a script that is
run outside of a specific user's context. (Ref GIAC White Paper)
,⩥ Default Account. Ans: System login account predefined in a
manufactured system to permit initial access when system is first put
into service. (pciscanner)
⩥ Guest Account. Ans: For users who don't have a permanent account
on your computer or domain. It allows people to use your computer
without having access to personal files. Per MSFT cannot install
software or hardware, change settings, or create a password. (MSFT)
⩥ Account expiration. Ans: A time limit that is applied to the life of an
account, so that it can be used only for a predetermined period of time.
(MSFT)
⩥ Access Control List (ACL). Ans: List of subjects (including groups,
machines, processes*) that are authorized to access a particular object.
Typically, the types of access are read, write, execute, append, modify,
delete and create. (Harris) (*NIST)
⩥ Access Reconciliation. Ans: The action of making accounts consistent.
A process used to compare two sets of records to ensure the data are in
agreement and are accurate.
⩥ Configuration Control. Ans: Process of controlling modifications to
hardware, firmware, software and documentation to protect the
information system against improper modification prior to, during, and
after system implementation. (NIST)
,⩥ Baseline Configuration. Ans: A set of specifications for a system that
has been formally reviewed and agreed on at a given point in time, and
which can be changed only through change control procedures. Used as
a basis for future builds, releases, and/or changes. (NIST)
⩥ Baseline. Ans: A process that identifies a consistent basis for an
organization's security architecture, taking into account system-specific
parameters, such as different operating systems. (Dummies)
A minimum level of security necessary throughout the organization
(CISA)
⩥ Configuration Auditing. Ans: Check that:
- Change was recorded correctly and work matched the Request for
Change (RFC)
- Change had appropriate risk level
- Configuration items updated appropriately
- Documentation updated
(CISCO)
⩥ WSUS - Windows Server Update Services. Ans: Next version of
automatic updates for internal use. Built into Windows Server 2003.
Previously called Software Update Services (SUS) and Windows Update
Services (WUS) but now obsolete.
, (Day 3, Page 56-57)
⩥ Attack - Man-in-the-Middle (MITM). Ans: A type of attack in which
an attacker intercepts messages between two parties and forwards a
modified version of the orginal message. (Dummies)
⩥ Attack - Spoofing. Ans: Technique used to forge TCP/IP packet
information or email header information. In network attacks it is used to
gain access to systems by impersonating the IP address of a trusted host.
In email the sender address is forged to trick an email users into opening
or responding to an email. (Dummies)
⩥ Attack - Social Engineering. Ans: A low tech attack method that
employs techniques such as dumpster diving and shoulder surfing.
(Dummies) A practice of obtaining confidential information by
manipulation of legitimate users (ISA)
⩥ Attack - Denial of Service (DoS). Ans: An attack on a system or
network with the intention of making the system or network unavailable
for use. (Dummies) In the context of ICS, can refer to loss of process
function, not just loss of data communictions. (ISA)
⩥ Data Manipulation. Ans: A process of altering register data so as to
change output status, without altering the ladder program.
(www.toolingu.com)
2026 QUESTIONS WITH SOLUTIONS 100%
CORRECT.
⩥ LDAP - Lightweight Directory Access Protocol. Ans: An Internet
Protocol (IP) and data storage model that supports authentication and
directory functions. It is a remote access authentication protocol.
Vendors = Microsoft Active Directory, CA eTrust Directory, Apache
Directory Server, Novell eDirectory, IBM SecureWay and Tivoli
Directory Server, Sun Directlry Server. OpenLDAP and tinyldap open
source versions.
⩥ User Account. Ans: Allows a user to authenticate to system services
and be granted authorization to access them; however, authentication
does not imply authorization.
⩥ Service Account. Ans: Is an account that a service on your computer
uses to run under and access resources. This should not be a user's
personal account. Can also be an account that is used for a scheduled
task (e.g., batch job account) or an account that is used in a script that is
run outside of a specific user's context. (Ref GIAC White Paper)
,⩥ Default Account. Ans: System login account predefined in a
manufactured system to permit initial access when system is first put
into service. (pciscanner)
⩥ Guest Account. Ans: For users who don't have a permanent account
on your computer or domain. It allows people to use your computer
without having access to personal files. Per MSFT cannot install
software or hardware, change settings, or create a password. (MSFT)
⩥ Account expiration. Ans: A time limit that is applied to the life of an
account, so that it can be used only for a predetermined period of time.
(MSFT)
⩥ Access Control List (ACL). Ans: List of subjects (including groups,
machines, processes*) that are authorized to access a particular object.
Typically, the types of access are read, write, execute, append, modify,
delete and create. (Harris) (*NIST)
⩥ Access Reconciliation. Ans: The action of making accounts consistent.
A process used to compare two sets of records to ensure the data are in
agreement and are accurate.
⩥ Configuration Control. Ans: Process of controlling modifications to
hardware, firmware, software and documentation to protect the
information system against improper modification prior to, during, and
after system implementation. (NIST)
,⩥ Baseline Configuration. Ans: A set of specifications for a system that
has been formally reviewed and agreed on at a given point in time, and
which can be changed only through change control procedures. Used as
a basis for future builds, releases, and/or changes. (NIST)
⩥ Baseline. Ans: A process that identifies a consistent basis for an
organization's security architecture, taking into account system-specific
parameters, such as different operating systems. (Dummies)
A minimum level of security necessary throughout the organization
(CISA)
⩥ Configuration Auditing. Ans: Check that:
- Change was recorded correctly and work matched the Request for
Change (RFC)
- Change had appropriate risk level
- Configuration items updated appropriately
- Documentation updated
(CISCO)
⩥ WSUS - Windows Server Update Services. Ans: Next version of
automatic updates for internal use. Built into Windows Server 2003.
Previously called Software Update Services (SUS) and Windows Update
Services (WUS) but now obsolete.
, (Day 3, Page 56-57)
⩥ Attack - Man-in-the-Middle (MITM). Ans: A type of attack in which
an attacker intercepts messages between two parties and forwards a
modified version of the orginal message. (Dummies)
⩥ Attack - Spoofing. Ans: Technique used to forge TCP/IP packet
information or email header information. In network attacks it is used to
gain access to systems by impersonating the IP address of a trusted host.
In email the sender address is forged to trick an email users into opening
or responding to an email. (Dummies)
⩥ Attack - Social Engineering. Ans: A low tech attack method that
employs techniques such as dumpster diving and shoulder surfing.
(Dummies) A practice of obtaining confidential information by
manipulation of legitimate users (ISA)
⩥ Attack - Denial of Service (DoS). Ans: An attack on a system or
network with the intention of making the system or network unavailable
for use. (Dummies) In the context of ICS, can refer to loss of process
function, not just loss of data communictions. (ISA)
⩥ Data Manipulation. Ans: A process of altering register data so as to
change output status, without altering the ladder program.
(www.toolingu.com)
