Network Risk Management Solutions Key Review

Network Risk Management Review Questions 1. Your organization has just approved a special budget for a network security upgrade. What procedure should you conduct in order to make recommendations for the upgrade priorities? a. Data breach b. Security audit c. Exploitation d. Posture assessment Answer: d. Posture assessment 2. Which type of DoS attack orchestrates an attack using uninfected computers? a. DDoS (Distributed DoS) attack b. Spoofing attack c. DRDoS (Distributed Reflection DoS) attack d. PDoS (Permanent DoS) attack 1 Answer: c. DRDoS (Distributed Reflection DoS) attack 3. A company accidentally sends a newsletter with a mistyped website address. The address points to a website that has been spoofed by hackers in order to collect information from people who make the same typo. What kind of attack is this? a. Phishing b. Baiting c. Quid pro quo d. Tailgating Answer: a. Phishing 4. A former employee discovers six months after he starts work at a new company that his account credentials still give him access to his old company’s servers. He demonstrates his access to several friends to brag about his cleverness and talk badly about the company. What kind of attack is this? a. Principle of least privilege b. Insider threat c. Vulnerability d. Denial of service Answer: b. Insider threat 5. A spoofed DNS record spreads to other DNS servers. What is this attack called? 2 a. ARP poisoning b. DHCP snooping c. MitM attack d. DNS poisoning Answer: d. DNS poisoning 6. Which of these attacks is a form of Wi-Fi DoS attack? a. Rogue DHCP server b. FTP bounce c. Deauthentication attack d. Amplified DRDoS attack Answer: c. Deauthentication attack 7. Leading up to the year 2000, many people expected computer systems the world over to fail when clocks turned the date to January 1, 2000. What type of threat was this? a. Ransomware b. Logic bomb c. Virus d. Worm 3 Answer: b. Logic bomb 8. What kind of attack simulation detects vulnerabilities and attempts to exploit them? a. Red team-blue team exercise b. Vulnerability scanning c. Security audit d. Penetration testing Answer: d. Penetration testing 9. Which of the following is considered a secure protocol? a. FTP b. SSH c. Telnet d. HTTP Answer: b. SSH 10. A company wants to have its employees sign a document that details some project-related information that should not be discussed outside the project’s team members. What type of document should they use? a. AUP 4 b. NDA c. MDM d. BYOD Answer: b. NDA 11. What is the difference between a vulnerability and an exploit? Answer: A weakness of a system, process, or architecture that could lead to compromised information or unauthorized access is known as a vulnerability. The act of taking advantage of a vulnerability is known as an exploit. 12. What are the four phases in the social engineering attack cycle? Answer: 1) Research. 2) Building trust. 3) Exploit. 4) Exit. 13. List five subtypes of DoS attacks. Answer: Distributed DoS, distributed reflection DoS, amplified DRDoS, permanent DoS, and friendly DoS 14. What type of scanning might identify that Telnet is running on a server? Answer: Port scanning 15. Give an example of biometric detection. Answer: Answers might include iris color patterns, hand geometry, facial recognition, or fingerprints 16. What unique characteristic of zero-day exploits make them so dangerous? 5 Answer: The vulnerability is exploited before the software developer has the opportunity to provide a solution for it or before the user applies the published solution. 17. What characteristic of ARP makes it particularly vulnerable to being used in a DoS attack? Answer: ARP performs no authentication. 18. A neighbor hacks into your secured wireless network on a regular basis, but you didn’t give him the password. What loophole was most likely left open? Answer: The default password was not changed. 19. Which form of SHA was developed by private designers? Answer: SHA-3 20. Why might organizations be willing to take on the risk of BYOD? Answer: BYOD practices can be cheaper for organizations to implement and tend to improve efficiency and morale for employees and students. 6