Chapter 4 Domain 4.0 Security Operations

Chapter 4 1. 2. 3. 4. 5. ■ Domain 4.0: Security Operations John wants to harden his organization’s routers. If there are no currently known vulnerabilities or issues with the device, which of the following hardening options will provide the biggest benefit? A. Moving their administrative interfaces to a protected VLAN B. Disabling unnecessary services C. Installing the most current patch level for the OS D. Enabling SNMP-­based logging Jackson is reviewing his organization’s logs and discovers multiple new user accounts created after business hours using administrative credentials. What term describes searching for potential issues like this? A. IoC creation B. Threat hunting C. Root cause analysis D. Eradication Cynthia is concerned about attacks against an application programming interface (API) that her company provides for its customers. What should she recommend to ensure that the API is only used by customers who have paid for the service? A. Require authentication. B. Install and configure a firewall. C. Filter by IP address. D. Install and use an IPS. Greg wants to gain admission to a network which is protected by a network access control (NAC) system that recognized the hardware address of systems. How can he bypass this protection? A. Spoof a legitimate IP address. B. Conduct a denial-­of-­service attack against the NAC system. C. Use MAC cloning to clone a legitimate MAC address. D. None of the above. Melissa’s organization has deployed a firewall that uses three interfaces to provide services. The first interface connects to the Internet, the second to a network where the organization’s web servers reside, and the third to a secured network where the organization’s workstations are connected. What type of firewall architecture has Melissa’s organization deployed? A. An ACL B. A screened subnet Chapter 4 6. 7. 8. 9. ■ Domain 4.0: Security Operations C. A binary firewall D. A multihomed, multiroute NGFW CVE is an example of what type of feed? A. A threat intelligence feed B. A vulnerability feed C. A critical infrastructure listing feed D. A critical virtualization exploits feed Amanda scans a Red Hat Linux server that she believes is fully patched and discovers that the Apache version on the server is reported as vulnerable to an exploit from a few months ago. When she checks to see if she is missing patches, Apache is fully patched. What has occurred? A. A false positive B. An automatic update failure C. A false negative D. An Apache version mismatch Telnet, RSH, and FTP are all examples of what? A. File transfer protocols B. Unsecure protocols C. Core protocols D. Open ports What term describes data that is collected from publicly available sources that can be used in an intelligence context? A. OPSEC B. OSINT C. STIX D. IntCon 10. Patrick has subscribed to a commercial threat intelligence feed that is only provided to subscribers who have been vetted and who pay a monthly fee. What industry term is used to refer to this type of threat intelligence? A. Proprietary threat intelligence B. OSINT Chapter 4 C. ELINT D. Corporate threat intelligence ■ Domain 4.0: Security Operations 11. Susan receives $10,000 for reporting a vulnerability to a vendor who participates in a program to identify issues. What term is commonly used to describe this type of payment? A. A ransom B. A zero-­day disclosure C. A bug bounty D. A payday 12. Ben runs a vulnerability scan using up-­to-­date definitions for a system that he knows has a vulnerability in the version the web server is running. The vulnerability scan does not show that issue when he reviews the report. What has Ben encountered? A. A silent patch B. A missing vulnerability update C. A false negative D. A false positive 13. Angela reviews bulletins and advisories to determine what threats her organization is likely to face. What type of activity is this associated with? A. Incident response B. Threat hunting C. Penetration testing D. Vulnerability scanning 14. Frank is using the cloud hosting service’s web publishing service rather than running his own web servers. Where will Frank need to look to review his logs to see what types of traffic his application is creating? A. Syslog B. Apache logs C. The cloud service’s web logs D. None of the above 15. The following graphic shows a report from an OpenVAS vulnerability scan. What should Charles do first to determine the best fix for the vulnerability shown? Chapter 4 ■ Domain 4.0: Security Operations A. Disable PHP-­CGI. B. Upgrade PHP to version 5.4. C. Review the vulnerability descriptions in the CVEs listed. D. Disable the web server. 16. Ian runs a vulnerability scan, which notes that a service is running on TCP port 8080. What type of service is most likely running on that port? A. SSH B. RDP C. MySQL D. HTTP Chapter 4 ■ Domain 4.0: Security Operations 17. Carolyn runs a vulnerability scan of a network device and discovers that the device is running services on TCP ports 22 and 443. What services has she most likely discovered? A. Telnet and a web server B. FTP and a Windows file share C. SSH and a web server D. SSH and a Windows file share 18. Susan is responsible for application development in her company. She wants to have all web applications tested before they are deployed live. She wants to use a test system that is identical to the live server. What is this called? A. A production server B. A development server C. A test server D. A predeployment server 19. Alexandra is preparing to run automated security tests against the code that developers in her organization have completed. Which environment is she most likely to run them in if the next step is to deploy the code to production? A. Development B. Test C. Staging D. Production 20. Chris wants to limit who can use an API that his company provides and be able to log usage of the API uniquely to each organization that they provide access to. What solution is most often used to do this? A. Firewalls with rules for each company’s public IP address B. User credentials for each company C. API keys D. API passwords 21. Angela wants to ensure that IoT devices in her organization have a secure configuration when they are deployed and that they are ready for further configuration for their specific purposes. What term is used to describe these standard configurations used as part of her configuration management program? A. A baseline configuration B. An essential settings list C. A preinstall checklist D. A setup guide Chapter 4 ■ Domain 4.0: Security Operations 22. Chris is following the CIS Windows Server 2022 benchmark and notices that it recommends that Computer Configuration\Policies\Administrative Templates\Windows Components\ Search\Allow indexing of encrypted files is set to disabled. What potential issue would this help to prevent? A. Data leakage B. Denial of service C. Insecure service D. Dark web access 23. Elizabeth wants to implement a cloud-­based authorization system. Which of the following protocols is she most likely to use for that purpose? A. OpenID B. Kerberos C. SAML D. OAuth 24. Tony wants to implement a biometric system for entry access in his organization. Which of the following systems is likely to be most accepted by members of his organization’s staff? A. Fingerprint B. Retina C. Iris D. Voice 25. What is the primary threat model against static codes used for multifactor authentication? A. Brute force B. Collisions C. Theft D. Clock mismatch 26. Nadine’s organization stores and uses sensitive information, including Social Security numbers. After a recent compromise, she has been asked to implement technology that can help prevent this sensitive data from leaving the company’s systems and networks. What type of technology should Nadine implement? A. Stateful firewalls B. OEM C. DLP D. SIEM 27. Social login, the ability to use an existing identity from a site like Google, Facebook, or a Microsoft account, is an example of which of the following concepts? A. Federation B. AAA C. Privilege creep D. Identity and access management Chapter 4 ■ Domain 4.0: Security Operations 28. Charles has configured his multifactor system to require both a PIN and a password. How many effective factors does he have in place once he presents both of these and his username? A. One B. Two C. Three D. Four 29. Naomi is designing her organization’s wireless network and wants to ensure that the design places access points in areas where they will provide optimum coverage. She also wants to plan for any sources of RF interference as part of her design. What should Naomi do first? A. Contact the FCC for a wireless map. B. Conduct a site survey. C. Disable all existing access points. D. Conduct a port scan to find all existing access points. 30. Charlene wants to provision her organization’s standard set of marketing information to mobile devices throughout her organization. What MDM feature is best suited to this task? A. Application management B. Remote wipe C. Content management D. Push notifications 31. Denny wants to deploy antivirus for his organization and wants to ensure that it will stop the most malware. What deployment model should Denny select? A. Install antivirus from the same vendor on individual PCs and servers to best balance visibility, support, and security. B. Install antivirus from more than one vendor on all PCs and servers to maximize coverage. C. Install antivirus from one vendor on PCs and from another vendor on the server to provide a greater chance of catching malware. D. Install antivirus only on workstations to avoid potential issues with server performance. 32. Madhuri’s web application converts numbers that are input into fields by specifically typing them and then applies strict exception handling. It also sets a minimum and maximum length for the inputs that it allows and uses predefined arrays of allowed values for inputs like months or dates. What term describes the actions that Madhuri’s application is performing? A. Buffer overflow prevention B. String injection C. Input validation D. Schema validation Chapter 4 ■ Domain 4.0: Security Operations 33. You’re outlining your plans for implementing a wireless network to upper management. What wireless security standard should you adopt if you don’t want to use enterprise authentication but want to provide secure authentication for users that doesn’t require a shared password or passphrase? A. WPA3 B. WPA C. WPA2 D. WEP 34. You are the chief security officer (CSO) for a large company. You have discovered malware on one of the workstations. You are concerned that the malware might have multiple functions and might have caused more security issues with the computer than you can currently detect. What is the best way to test this malware? A. Leave the malware on that workstation until it is tested. B. Place the malware in a sandbox environment for testing. C. It is not important to analyze or test it; just remove it from the machine. D. Place the malware on a honeypot for testing. 35. Isaac is reviewing his organization’s secure coding practices document for customer-­facing web applications and wants to ensure that their input validation recommendations are appropriate. Which of the following is not a common best practice for input validation? A. Ensure validation occurs on a trusted server. B. Validate all client-­supplied data before it is processed. C. Validate expected data types and ranges. D. Ensure validation occurs on a trusted client. 36. Isaac wants to prevent corporate mobile devices from being used outside of his company’s buildings and corporate campus. What mobile device management (MDM) capability should he use to allow this? A. Patch management B. IP filtering C. Geofencing D. Network restrictions 37. Sophia wants to test her company’s web application to see if it is handling business logic properly. Which testing method would be most effective for this? A. Static code analysis B. Fuzzing C. Baselining D. Version control Chapter 4 ■ Domain 4.0: Security Operations 38. Endpoint detection and response has three major components that make up its ability to provide visibility into endpoints. Which of the following is not one of those three parts? A. Data search B. Malware analysis C. Data exploration D. Suspicious activity detection 39. Carl has been asked to set up access control for a server. The requirements state that users at a lower privilege level should not be able to see or access files or data at a higher privilege level. What access control model would best fit these requirements? A. MAC B. DAC C. RBAC D. SAML 40. Jack wants to deploy a network access control (NAC) system that will stop systems that are not fully patched from connecting to his network. If he wants to have full details of system configuration, antivirus version, and patch level, what type of NAC deployment is most likely to meet his needs? A. Agentless, preadmission B. Agent-­based, preadmission C. Agentless, postadmission D. Agent-­based, postadmission 41. Eric wants to provide company-­purchased devices, but his organization prefers to provide end users with choices among devices that can be managed and maintained centrally. What mobile device deployment model best fits this need? A. BYOD B. COPE C. CYOD D. VDI 42. Claire is concerned about an attacker getting information regarding network devices and their configuration in her company. Which protocol should she implement that would be most helpful in mitigating this risk while providing management and reporting about network devices? A. RADIUS B. TLS C. SNMPv3 D. SFTP Chapter 4 ■ Domain 4.0: Security Operations 43. Eric is responsible for his organization’s mobile device security. They use a modern mobile device management (MDM) tool to manage a BYOD mobile device environment. Eric needs to ensure that the applications and data that his organization provides to users of those mobile devices remain as secure as possible. Which of the following technologies will provide him with the best security? A. Storage segmentation B. Containerization C. Full-­device encryption D. Remote wipe 44. Tara is concerned about staff in her organization sending email with sensitive information like customer Social Security numbers (SSNs) included in it. What type of solution can she implement to help prevent inadvertent exposures of this type of sensitive data? A. FDE B. DLP C. S/MIME D. POP3S 45. Mason is responsible for security at a company that has traveling salespeople. The company has been using ABAC for access control to the network. Which of the following is an issue that is specific to ABAC and might cause it to incorrectly reject logins? A. Geographic location. B. Wrong password. C. Remote access is not allowed by ABAC. D. Firewalls usually block ABAC. 46. Darrell is concerned that users on his network have too many passwords to remember and might write down their passwords, thus creating a significant security risk. Which of the following would be most helpful in mitigating this issue? A. Multifactor authentication B. SSO C. SAML D. LDAP 47. Frank is a security administrator for a large company. Occasionally, a user needs to access a specific resource that they don’t have permission to access. Which access control methodology would be most helpful in this situation? A. Mandatory access control (MAC) B. Discretionary access control (DAC) C. Role-­based access control D. Rule-­based access control Chapter 4 ■ Domain 4.0: Security Operations 48. Oliver needs to explain the access control scheme used by both the Windows and Linux filesystems. What access control scheme do they implement by default? A. Role-­based access control B. Mandatory access control C. Rule-­based access control D. Discretionary access control 49. Stefan just became the new security officer for a university. He is concerned that student workers who work late on campus could try to log in with faculty credentials. Which of the following would be most effective in preventing this? A. Time-­of-­day restrictions B. Usage auditing C. Password length D. Credential management 50. Chloe has noticed that users on her company’s network frequently have simple passwords made up of common words. Thus, they have weak passwords. How could Chloe best mitigate this issue? A. Increase minimum password length. B. Have users change passwords more frequently. C. Require password complexity. D. Implement single sign-­on (SSO). 51. A companywide policy is being created to define various security levels. Which of the following systems of access control would use documented security levels like Confidential or Secret for information? A. RBAC B. MAC C. DAC D. BAC 52. Users in your network are able to assign permissions to their own shared resources. Which of the following access control models is used in your network? A. DAC B. RBAC C. MAC D. ABAC Chapter 4 ■ Domain 4.0: Security Operations 53. Cynthia is preparing a new server for deployment, and her process includes turning off unnecessary services, setting security settings to match her organization’s baseline configurations, and installing patches and updates. What is this process known as? A. OS hardening B. Security uplift C. Configuration management D. Endpoint lockdown 54. John is performing a port scan of a network as part of a security audit. He notices that the domain controller is using secure LDAP. Which of the following ports would lead him to that conclusion? A. 53 B. 389 C. 443 D. 636 55. Which of the following access control methods grants permissions based on the user’s position in the organization? A. MAC B. RBAC C. DAC D. ABAC 56. Gary is designing his cloud infrastructure and needs to provide a firewall-­like capability for the virtual systems he is running. Which of the following cloud capabilities acts like a virtual firewall? A. Security groups B. Dynamic resource allocation C. VPC endpoints D. Instance awareness 57. Henry is an employee at Acme Company. The company requires him to change his password every three months. He has trouble remembering new passwords, so he keeps switching between just two passwords. Which policy would be most effective in preventing this? A. Password complexity B. Password history C. Password length D. Multifactor authentication 58. Tracy wants to limit when users can log in to a stand-­alone Windows workstation. What should Tracy do to meet this requirement? A. Set login time restrictions. B. Turn the system off automatically during hours it should not be used. Chapter 4 ■ Domain 4.0: Security Operations C. Hire security guards to monitor the space. D. Disable remote login during the hours the system should not be used. 59. Lucas is looking for an XML-­based open standard for exchanging authentication information. Which of the following would best meet his needs? A. SAML B. OAuth C. RADIUS D. NTLM 60. Murali is preparing to acquire data from various devices and systems that are targets in a forensic investigation. Which of the following devices is the least volatile according to the order of volatility? A. Backups B. CPU cache C. Local disk D. RAM 61. What phase of the incident response process should be placed at point A in the following image? A Eradication Incident Response Process Containment A. Simulations B. Review C. Recovery D. Patching Preparation Analysis Detection Chapter 4 ■ Domain 4.0: Security Operations 62. Brent wants to use a tool to help him analyze malware and attacks and wants to cover a broad range of tactics and tools that are used by adversaries. Which of the following is broadly implemented in technical tools and covers techniques and tactics without requiring a specific order of operations? A. The CIS Benchmark B. The Dark Web Analysis Project C. The MITRE ATT&CK framework D. The CVSS standard 63. Ted needs to preserve a server for forensic purposes. Which of the following should he not do? A. Turn the system off to ensure that data does not change. B. Remove the drive while the system is running to ensure that data does not change. C. Leave the machine connected to the network so that users can continue to use it. D. All of the above. 64. Jessica wants to review the network traffic that her Windows system has sent to determine if a file containing sensitive data was uploaded from the system. What Windows log file can she use to find this information? A. The application log B. The network log C. The security log D. None of the above 65. What term is used to describe the documentation trail for control, analysis, transfer, and final disposition of evidence for digital forensic work? A. Evidence log B. Paper trail C. Chain of custody D. Digital footprint 66. Nathan needs to know how many times an event occurred and wants to check a log file for that event. Which of the following grep commands will tell him how many times the event happened if each occurrence is logged independently in the logfile.txt log file, and uses a unique event ID, event101? A. grep logfile.txt -­ n 'event101' B. grep -­ c 'event101' logfile.txt C. grep logfile.txt -­ c 'event101' D. grep -­ c event101 -­ i logfile.txt Chapter 4 ■ Domain 4.0: Security Operations 67. Eric wants to determine how much bandwidth was used during a compromise and where the traffic was directed to. What technology can he implement before the event to help him see this detail and allow him to have an effective bandwidth monitoring solution? A. A firewall B. NetFlow C. Packetflow D. A DLP 68. Naomi has acquired an image of a drive as part of a forensic process. She wants to ensure that the drive image matches the original. What should she create and record to validate this? A. A third image to compare to the original and new image B. A directory listing to show that the directories match C. A photographic image of the two drives to show that they match D. A hash of the drives to show that their hashes match 69. Ryan has been asked to run Nessus on his network. What type of tool has he been asked to run? A. A fuzzer B. A vulnerability scanner C. A WAF D. A protocol analyzer 70. Michelle wants to check for authentication failures on a RedHat Linux–based system. Where should she look for these event logs? A. /var/log/auth.log B. /var/log/fail C. /var/log/events D. /var/log/secure 71. Nelson has discovered malware on one of the systems he is responsible for and wants to test it in a safe environment. Which of the following tools is best suited to that testing? A. strings B. scanless C. Cuckoo D. Sn1per 72. Lucca wants to review metadata related to a JPEG file. What will he need to do to review it? A. Change the JPEG to a GIF to see the metadata. B. Download the metadata file from the original author. C. Use a metadata viewer. D. Analyze the hash of the file. Chapter 4 ■ Domain 4.0: Security Operations 73. Jason is conducting a forensic investigation and has retrieved artifacts in addition to drives and files. What should he do to document the artifacts he has acquired? A. Image them using dd and ensure that a valid MD5sum is generated. B. Take a picture of them, label them, and add them to the chain-­of-­custody documentation. C. Contact law enforcement to properly handle the artifacts. D. Engage legal counsel to advise him how to handle artifacts in an investigation. 74. Joseph is writing a forensic report and wants to be sure he includes appropriate detail. Which of the following would not typically be included while discussing analysis of a system? A. Validation of the system clock’s time settings B. The operating system in use C. The methods used to create the image D. A picture of the person from whom the system was taken 75. Elaine wants to determine what websites a user has recently visited using the contents of a forensically acquired hard drive. Which of the following locations would not be useful for her investigation? A. The browser cache B. The browser history C. The browser’s bookmarks D. Session data 76. Susan has discovered evidence of a compromise that occurred approximately five months ago. She wants to conduct an incident investigation but is concerned about whether the data will exist. What policy guides how long logs and other data are kept in most organizations? A. The organization’s data classification policy B. The organization’s backup policy C. The organization’s retention policy D. The organization’s legal hold policy 77. Alaina sets her antimalware solution to move infected files to a safe storage location without removing them from the system. What type of setting has she enabled? A. Purge B. Deep-­freeze C. Quarantine D. Retention 78. A senior vice president in the organization that Chuck works in recently lost a phone that contained sensitive business plans and information about suppliers, designs, and other important materials. After interviewing the vice president, Chuck finds out that the phone did not have a passcode set and was not encrypted, and that it could not be remotely wiped. Chapter 4 ■ Domain 4.0: Security Operations What type of control should Chuck recommend for his company to help prevent future issues like this? A. Use containment techniques on the impacted phones. B. Deploy a DLP system. C. Deploy an MDM system. D. Isolate the impacted phones. 79. Charles wants to ensure that the forensic work that he is doing cannot be repudiated. How can he validate his attestations and documentation to ensure nonrepudiation? A. Encrypt all forensic output. B. Digitally sign the records. C. Create a MD5 checksum of all images. D. All of the above. 80. Megan needs to conduct a forensic investigation of a virtual machine (VM) hosted in a VMware environment as part of an incident response effort. What is the best way for her to collect the VM? A. As a snapshot using the VMware built-­in tools B. By using dd to copy the VM to an external drive C. By using dd to copy the VM to an internal drive D. By using a forensic imaging device after removing the server’s drives 81. Which of the following groups is not typically part of an incident response team? A. Law enforcement B. Security analysts C. Management D. Communications staff 82. Bob needs to block Secure Shell (SSH) traffic between two security zones. Which of the following Linux iptables firewall rules will block that traffic from the 10.0.10.0/24 network to the system the rule is running on? A. iptables -­ A INPUT -­ p tcp -­ -­ dport 22 -­ i eth0 -­ s 10.0.10.0/ 24 -­ j DROP B. iptables -­ D OUTPUT -­ p udp -­ dport 21 -­ i eth0 -­ s 10.0.10 .255 -­ j DROP C. iptables -­ A OUTPUT -­ p udp -­ -­ dport 22 -­ i eth0 -­ s 10.0.10 .255 -­ j BLOCK D. iptables -­ D INPUT -­ p udp -­ -­ dport 21 -­ I eth0 -­ s 10.0.10.0/ 24 -­ j DROP Chapter 4 ■ Domain 4.0: Security Operations 83. A Windows system that Maria is responsible for has been experiencing service outages. The outages correspond to processes run on another system in the datacenter, and Maria believes that unexpected traffic may be sent to the Windows system. Which of the following data sources should Maria use to best understand what is happening? A. Perform a packet capture. B. Enable a network firewall. C. Use SIEM logs. D. Perform a forensic drive copy. 84. Amanda’s organization does not currently have an incident response plan. Which of the following reasons is not one she should present to management in support of creating one? A. It will prevent incidents from occurring. B. It will help responders react appropriately under stress. C. It will prepare the organization for incidents. D. It may be required for legal or compliance reasons. 85. Which of the following scenarios is least likely to result in data recovery being possible? A. A file is deleted from a disk. B. A file is overwritten by a smaller file. C. A hard drive is quick-­formatted. D. A disk is degaussed. 86. Henry records a video of the removal of a drive from a system as he is preparing for a forensic investigation. What is the most likely reason for Henry to record the video? A. To meet the order of volatility B. To establish guilt beyond a reasonable doubt C. To ensure data preservation D. To document the chain of custody and provenance of the drive 87. Charlene wants to set up a tool that can allow her to see all the systems a given IP address connects to and how much data is sent to that IP by port and protocol. Which of the following tools is not suited to meet that need? A. IPFIX B. IPSec C. sFlow D. NetFlow 88. Tools like PRTG and Cacti that monitor SNMP information are used to provide what type of information for an incident investigation? A. Authentication logs B. Bandwidth monitoring C. System log information D. Email metadata Chapter 4 ■ Domain 4.0: Security Operations 89. The company Charles works for has recently had a stolen company cell phone result in a data breach. Charles wants to prevent future incidents of a similar nature. Which of the following mitigation techniques would be the most effective? A. Enable FDE via MDM. B. A firewall change. C. A DLP rule. D. A new URL filter rule. 90. What incident response step is missing from point X in the following image? Preparation Lessons Learned Detection Incident Response Process Recovery Eradication A. Business continuity B. Containment C. Response D. Discovery Analysis X 91. Jill has been asked to perform data recovery due to her forensic skills. What should she tell the person asking to perform data recovery to give her the best chance of restoring lost files that were accidentally deleted? A. Immediately reboot using the reset switch to create a lost file memory dump. B. Turn off Secure Delete so that the files can be more easily recovered. C. Do not save any files or make any changes to the system. D. All of the above. Chapter 4 ■ Domain 4.0: Security Operations 92. Veronica has completed the recovery phase of her organization’s incident response plan. What phase should she move into next? A. Preparation B. Lessons learned C. Recovery D. Documentation 93. Michelle has been asked to sanitize a number of drives to ensure that sensitive data is not exposed when systems are removed from service. Which of the following is not a valid means of sanitizing hard drives? A. Physical destruction B. Degaussing C. Quick-­formatting the drives D. Zero-­wiping the drives 94. Bart is investigating an incident, and needs to identify the creator of a Microsoft Office document. Where would he find that type of information? A. In the filename B. In the Microsoft Office log files C. In the Windows application log D. In the file metadata 95. Nathaniel wants to allow Chrome through the Windows Defender firewall. What type of firewall rule change will he need to permit this? A. Allow TCP 80 and 443 traffic from the system to the Internet. B. Add Chrome to the Windows Defender Firewall allowed applications. C. Allow TCP 80 and 443 traffic from the Internet to the system. D. All of the above. 96. What key forensic tool used to generate reports about what happened relies on correctly set system clocks to work properly? A. Disk hashing B. Timelining C. Forensic disk acquisition D. File metadata analysis 97. Valerie is writing her organization’s forensic playbooks and knows that the state that she operates in has a data breach notification law. Which of the following key items is most likely to be influenced by that law? A. Whether Valerie calls the police for forensic investigation help B. The maximum amount of time until she has to notify customers of sensitive data breaches C. The certification types and levels that her staff have to maintain D. The maximum number of residents that she can notify about a breach Chapter 4 ■ Domain 4.0: Security Operations 98. As part of a breach response, Naomi discovers that Social Security numbers (SSNs) were sent in a spreadsheet via email by an attacker who gained control of a workstation at her company’s headquarters. Naomi wants to ensure that more SSNs are not sent from her environment. What type of mitigation technique is most likely to prevent this while allowing operations to continue in as normal a manner as possible? A. Antimalware installed at the email gateway B. A firewall that blocks all outbound email C. A DLP rule blocking SSNs in email D. An IDS rule blocking SSNs in email 99. Troy wants to review metadata about an email he has received to determine what system or server the email was sent from. Where can he find this information? A. In the email message’s footer B. In the to: field C. In the email message’s headers D. In the from: field 100. Isabelle wants to gather information about what systems a host is connecting to, how much traffic is sent, and similar details. Which of the following options would not allow her to perform that task? A. IPFIX B. NetFlow C. NXLog D. sFlow 101. Valerie wants to check to see if a SQL injection attack occurred against her web application on a Linux system. Which log file should she check for this type of information? A. The security log B. The DNS log C. The auth log D. The web server log 102. Jean’s company is preparing for litigation with another company that they believe has caused harm to Jean’s organization. What type of legal action should Jean’s lawyer take to ensure that the company preserves files and information related to the legal case? A. A chain-­of-­custody demand letter B. An e-­discovery notice C. A legal hold notice D. An order of volatility Chapter 4 ■ Domain 4.0: Security Operations 103. What type of mitigation places a malicious file or application in a safe location for future review or study? A. Containment B. Quarantine C. Isolation D. Deletion 104. What phase of the incident response process often involves adding firewall rules and patching systems to address the incident? A. Preparation B. Detection C. Recovery D. Analysis 105. Tim wants to check the status of malware infections in his organization using the organization’s security information and event management (SIEM) device. What SIEM dashboard will tell him about whether there are more malware infections in the past few days than normal? A. The alerts dashboard B. The sensors dashboard C. The trends dashboard D. The bandwidth dashboard 106. Michelle has been asked to use the CIS benchmark for Windows as part of her system security process. What information will she be using? A. Information on how secure Windows is in its default state B. A set of recommended security configurations to secure Windows C. Performance benchmark tools for Windows systems, including network speed and firewall throughput D. Vulnerability scan data for Windows systems provided by various manufacturers 107. All of your organization’s traffic flows through a single connection to the Internet. Which of the following terms best describes this scenario? A. Cloud computing B. Load balancing C. Single point of failure D. Virtualization 108. Nina is tasked with putting radio frequency identification (RFID) tags on every new piece of equipment that enters her datacenter that costs more than $500. What type of organizational policy is most likely to include this type of requirement? A. A change management policy B. An incident response policy Chapter 4 C. An asset management policy D. An acceptable use policy Domain 4.0: Security Operations ■ 109. Megan is reviewing her organization’s datacenter network diagram as shown in the following image. What should she note for point A on the diagram? Internet Service Provider Point B Internet Point A Firewalls Routers Point C Core Switches Point D A. A wireless link B. A redundant connection C. A wired link D. A single point of failure Edge Switches 110. Juan’s team is in charge of responding to potential phishing attacks and advertises an infosec@example.com email address to his organization to send examples of potential phishing attacks to. Which of the following is not a benefit Juan’s team would get from automating the creation of tickets in their support tool based on these emails? A. The ability to track whether they’ve been resolved B. Automated phishing prevention C. The ability to correlate multiple emails into a single event D. The ability to trigger additional actions Chapter 4 ■ Domain 4.0: Security Operations 111. Valerie wants to implement an email security framework that will help to ensure that only authorized systems send email on behalf of her domains. Which of the following should she implement? A. DKIM B. DMARC C. STP D. SPF 112. Jake is investigating a service outage and notices the following traffic using a Wireshark packet capture. Which of the following issues is most likely occurring? A. An email phishing campaign B. A SQL injection attack C. A dropped network connection D. A denial-­of-­service attack Chapter 4 ■ Domain 4.0: Security Operations 113. Gary wants to deploy a tool that will allow him to identify and effectively respond to ransomware that might target systems that his company owns. He knows that he is likely to need to identify threats based on behavior rather than just using signatures, and he wants to have a dashboard-­style view of his data. What tool should Gary select to meet this need? A. IPS B. NAC C. DLP D. EDR 114. Carl wants to test his organization’s incident response process. He conducts a tabletop exercise for his security team. Which of the following best describes this type of exercise? A. A scenario is introduced and each member of the team takes actions that they would use to respond to the scenario. B. Third-­party penetration testers work with the security team to address issues they discovered during their penetration test. C. The security team meets to talk through what they would do in a given scenario and takes notes on what works and what doesn’t. D. The organization’s datacenter is manually forced to fail over to an alternate site to test the scenario’s objectives. 115. Michelle wants to determine why attackers were able to take her organization’s web server cluster offline after an incident occurred. What process should she and her team follow to determine this? A. Threat hunting B. Root cause analysis C. A lessons learned analysis D. Recovery 116. Randy wants to harden mobile devices used by his organization. Which of the following is not a typical mobile device hardening step? 117. A. Disable Bluetooth. B. Use strong screen lock passwords. C. Install software updates. D. Jailbreak the device. Lucca wants to ensure that his organization’s mobile device connections are secure. Which of the following connectivity options is the most secure choice? A. WPA2 Personal B. WPA3 Personal C. WPA3 Enterprise D. WPA4 Enterprise Chapter 4 ■ Domain 4.0: Security Operations 118. The percentage of the value of an asset that is lost due to an incident or loss event is known as what? A. Asset depreciation B. Exposure factor C. Annual loss event D. Asset valuation adjustment 119. Derek’s organization has recently set up a notification process that sends a text message to system administrators when security exception log events occur on the systems they are responsible for. Unfortunately, Derek and his team have received dozens of alerts at all times of the day due to the log event happening for failed logins when users type their passwords incorrectly. What should Derek and his team do next to help with this? A. Set alert thresholds. B. Engage in alert tuning. C. Disable the alerts. D. Move the alerts to email. 120. Jill wants to configure her IPS to detect a SQL injection attack that has become increasingly common against an open source web application that her organization runs. What information would she need to create a signature for the attack? A. The source IP address B. The SQL code C. The hash of the attack D. The source port 121. Ben’s organization has hired a new HR supervisor, Jack. When Jack was hired, Ben was asked to provide Jack with the same rights and permissions as the other HR supervisor, Erin. What is the most important issue Ben should identify with this process if the organization wants to follow identity and access management best practices? A. Jack’s account should be provisioned based on his role, not on Erin’s rights. B. Jack may not be senior enough to have access to the same systems as Erin does. C. Erin may work with a different staff than Jack does. D. Jack should not have access to Erin’s files. 122. Ian wants to deploy multifactor tokens to his organization. Which of the following provides the greatest security? A. Hardware tokens B. Application-­based tokens C. SMS multifactor D. Extended password length Chapter 4 ■ Domain 4.0: Security Operations 123. Gurvinder wants to explain the advantages of investing in automating security workflows to his organization’s leadership. Recent audit findings have shown that systems are not all fully patched and that settings may vary between systems using the same operating system. Which common benefit of automation should he emphasize with leadership? A. Enforcing baselines B. Scaling in a secure manner C. Improving reaction time D. Automation’s role as a workforce multiplier 124. Jake wants to understand the root cause of a security incident. He knows a number of the events that occurred, but he wants to engage other staff members to define the root cause. What common root cause analysis (RCA) technique should he use? A. The Five W’s B. A fishbone diagram C. The Five Why’s D. A recursion analysis 125. Amanda is testing her company’s incident response process and has her staff perform actual recovery actions without impacting production to validate how long it would take to accomplish them. What type of event has she conducted? A. A fail over test B. A simulation C. A plan review D. A tabletop exercise 126. Liam’s company has been notified of impending legal action and has been told to place a legal hold on related items. What must Liam’s company do? A. Continue their normal operations, including data life-cycle–related activities. B. Identify data covered by the hold and preserve it, regardless of normal data life cycles or activities. C. Engage a law firm to preserve the data required by the legal hold. D. Contact law enforcement to allow them to gather the data required by the legal hold. 127. Paul wants to integrate his organization’s web application with common cloud identity providers like Google and Microsoft. What authentication standard should he select if he wants to maximize interoperability? A. OAuth B. Kerberos C. LDAP D. Active Directory Chapter 4 ■ Domain 4.0: Security Operations 128. Jim wants to ensure that users who are located in his organization’s London office have access to the building. What type of access control scheme should he select to best fit this specific need? A. Rule BAC B. ABAC C. Role BAC D. MAC 129. Dane wants to implement passwordless authentication for his organization. What type of device should he issue to his users to support this type of authentication? A. A password manager B. An RFID card C. A security key D. A biometric token 130. Ensuring that inetd services like echo, time, rsh, and telnet are not enabled are all examples of what type of action? A. Preventing SQL injection B. Hardening a Linux system C. Hardening a Windows system D. Patching insecure services 131. What mobile device deployment model provides the least control for the organization and leaves the end user with the greatest choice? A. BYOD B. COPE C. CYOD D. COBO 132. Akio has set the Secure Cookie attribute as part of her web application’s process for sending new cookies to users. What does this attribute do? A. It encrypts the cookie’s content when it is stored. B. It stores the cookie on the server instead of on the remove device. C. It removes the cookie after it has been used. D. It requires that the cookie be sent only via HTTPS. 133. Helen wants to sign her code. What will the output of code signing be? A. An encrypted copy of the code using her private key B. A signed hash of the software using her private key C. A signed hash of the software using her public key D. An encrypted copy of the code using her public key Chapter 4 ■ Domain 4.0: Security Operations 134. Naomi’s organization has recently acquired another company. Naomi is concerned about asset tracking and inventory because the acquired company does not have an inventory of their systems and devices. What major security concern should she express about this from a hardware asset management perspective? A. There may not be an appropriate hardware life-cycle process. B. Manufacturer support may not be possible without an inventory. C. There is no way to know if systems are missing. D. Vulnerability scans may not be accurate without an inventory. 135. As part of his CI/CD pipeline process, Felix reviews source code manually to identify any flaws or security concerns. What type of process is Felix following? A. Dynamic analysis B. Agile code development C. Static analysis D. Internal review 136. As part of his research, Pedro uses a TOR browser to access threat actors’ sites. He is able to see information about recent breaches and can download data dumps provided by the threat actors. What information source is Pedro using? A. The dark web B. An information-­sharing organization C. Proprietary information D. A threat feed 137. Alaina has completed the eradication and recovery steps of the incident response process. What step commonly comes after these two phases? A. A lessons learned session B. Detection C. Training D. A tabletop exercise 138. Lucca knows that the CVSS environmental score is made up of three components, including an impact metric. What three components does he need to consider as part of the impact metric score? A. Confidentiality, integrity, and availability B. Network, disk, and memory C. Severity, likelihood, and impact D. Probability, impact, and cost Chapter 4 ■ Domain 4.0: Security Operations 139. What tool is commonly used to allow for measurement and monitoring of security settings to align with NIST 800-­53 controls? A. SAML B. CVE C. CVSS D. SCAP 140. Adam has implemented a WPA3 Enterprise network. What type of encryption will be used to protect data sent across the Wi-­Fi connection? A. AES B. 3DES C. SHA-­1 D. SHA-­256 141. Tom wants to set up an authentication service for network devices. Which of the following is commonly used for authentication to enterprise network devices? A. Kerberos B. SAML C. TKIP D. OpenID 142. Ian wants to test embedded device web servers for potential security issues with the version of the web server software. What tool should he select to do this most effectively across his large organization’s network of IoT devices? A. A WAF B. Pentesting C. A vulnerability scanner D. A port scanner 143. Tom wants his email servers to reject email that is not authenticated in a way to prevent spoofing. Which of the following should he implement? A. SPF B. DMARC C. DKIM D. TLS 144. Wayne has identified a vulnerable server that is part of his organization’s critical infrastructure but that is no longer supported by the vendor and for which no additional patches exist. Every time Wayne scans the server using his vulnerability scanner, the services on the device crash. What should Wayne do? A. Report the server as vulnerable and suggest that it be replaced immediately. B. Disable the network connection on the device and isolate the server to protect it. Chapter 4 ■ Domain 4.0: Security Operations C. Identify a third-­party insurance provider who will insure the organization against potential issues with the server. D. Document an exemption, remove the server from automated scans, and implement compensating controls. 145. Valentine’s organization wants to ensure that users who sign up for their web services are who they claim to be. As part of the process they ask for information like birth date, Social Security number, and previous addresses. What type of activity is Valentine’s organization engaging in? A. Provisioning user accounts B. Identity proofing C. Deprovisioning user accounts D. Social identity 146. Sam has completed patching of a critical vulnerability. What step is often performed next to ensure that the patching occurred properly? A. Noting false positives B. Rebooting the system C. Rescanning the system D. Performing an audit 147. Joan’s organization has recently remediated issues in their credit card processing environment. If Joan wants to be able to attest to the security of the environment, what action might she need to take to prove the security of the environment to customers? A. Have third-­party auditors validate the remediation. B. Rescan the systems and document the differences between the scans. C. Rescan the systems and provide updated reports to customers. D. Allow customers to scan the systems to validate the changes. 148. Alan wants to configure his firewall to allow Microsoft SQL traffic through to the database server from web application servers in a screened subnet design. What is the minimum set of ports that he should port to allow this? A. TCP 3389 and 1433 B. TCP 1433 C. TCP 8080 D. TCP 139 and 445 149. Which of the following terms refers to the process of establishing a standard for security? A. Baselining B. Security evaluation C. Hardening D. Normalization Chapter 4 ■ Domain 4.0: Security Operations 150. Zhen’s new organization has informed him that they used a COPE model for their mobile devices. What does this tell Zhen about what he can do with the device? A. He can choose what device he uses, but the organization will own it. B. He will be provided with a device but can use it for reasonable personal use. C. He will be provided with a device and can only use it for business purposes. D. He will have to bring his own device but can use it for personal and business use. 151. The Windows Task Manager can be used to identify malware through what technique? A. Dynamic analysis B. Process auditing C. CVSS matching D. Vulnerability scanning 152. Ujama wants to deploy a network device that will allow him to use policy-­based controls for email as well as active defenses against phishing attacks before email is delivered to his users. Which of the following devices is best suited to this purpose? A. A web application firewall B. An email security gateway C. A DKIM appliance D. A DMARC appliance 153. Allison wants to aggregate her logs and have them automatically correlated and reported on. What sort of tool should she acquire for her organization? A. MDM B. A jump server C. SDN D. SIEM 154. Natasha’s staff have been complaining about repetitive tasks that must be manually accomplished to secure endpoint devices, then they are deployed. What could Natasha ask her team to do to address this? A. Leverage automation and scripting. B. Deploy fewer devices. C. Leverage baselines. D. Move devices to the cloud. 155. Which of the following methods typically provides the greatest insight into vulnerabilities that exist on systems owned by a company? A. Penetration tests B. Authenticated scans C. Unauthenticated scans D. Port scans Chapter 4 ■ Domain 4.0: Security Operations 156. Quarantine and isolation are both common options in what phase of the incident response process? A. Detection B. Analysis C. Containment D. Eradication 157. Rick is reviewing Linux system permissions and finds a directory that is set to: -rwxr--r-Who will have access to the directory to read the file? A. The user B. The user and their group C. All users D. No users except root 158. Beena is granted access to her organization’s customer information because she is a data steward; her access occurs between 8 a.m. and 5 p.m., and it is occurring from a known workstation that has passed security checks. What type of access control scheme is in use? A. Rule-­based access control B. Role-­based access control C. Mandatory access control D. Attribute-­based access control 159. Juan wants to use his IDS to detect anomalous behavior. What type of detection technique would most effectively help him identify unknown new attacks? A. Trend analysis B. Signature-­based detection C. IP-­based detection D. Port-­based detection 160. Geenah wants to identify where Wi-­Fi signals are weakest in her building. What should she create to visually display signal coverage and strength throughout her building? A. A war walk B. A spectrum analysis C. An SSID plot D. A heatmap 161. What term describes the concept that individuals should be given the minimum permissions necessary to accomplish their role or tasks? A. Zero trust B. Provisioning C. Least privilege D. Deprovisioning Chapter 4 ■ Domain 4.0: Security Operations 162. Joanna wants to explain the advantages of automation for user and resource provisioning. Which of the following is not an advantage of automation over manual processes for provisioning? A. Automation ensures consistency in the provisioning process. B. Automation provides faster provisioning. C. Automation decreases mistakes in provisioning. D. Automation provides auditability of provisioning. 163. Bug bounty programs are an example of what type of program? A. Contracted penetration testing B. Responsible disclosure C. Third-­party bounty D. Trusted threat 164. Jack is hardening a Cisco switch based on the CIS IOS benchmark. As part of the configuration process, he configures settings including ntp authenticate and ntp trusted-­key. Why would Jack configure this on his network switches? A. To ensure that the switch has Network Terminal Protocol enabled B. To prevent attackers from modifying logs C. To prevent attackers from capturing network time traffic D. To ensure that network time is from a trusted source 165. Tony wants to use a cellular connection to transfer data to his organization. What should he do to ensure that his data is as secure as possible? A. Make sure he is connected to his cellular provider’s towers. B. Fully patch the phone. C. Use a VPN. D. Deploy a security baseline to the phone. 166. The hospital that Isabella works for leverages threat information from the Health-­ISAC as part of their security team’s work. What type of threat information provider is the Health-­ISAC? A. An OSINT provider B. A dark web source C. An information-­sharing organization D. A proprietary threat data source 167. Mark presents his driver’s license as part of the creation of his user account for a secure online service. What process requires this type of information to validate ownership of an identity? A. Attestation B. Provisioning C. SSO D. De-­provisioning Chapter 4 ■ Domain 4.0: Security Operations 168. Hector is concerned about Bluetooth security. Which of the following is a legitimate security concern about Bluetooth? A. It is not encrypted. B. Bluetooth is only useful at short range. C. Bluejacking may occur. D. Bluetooth devices can be fingerprinted. 169. Privileged access management (PAM) tools provide functions for enterprise access management. Which of the following is not a common PAM component? A. Just-­in-­time permissions B. Password vaulting C. Ephemeral credentials D. Password persistence 170. What role do port scans play in asset tracking? A. Enumeration of assets. B. They provide OSINT. C. Version tracking for assets. D. They do not play a role in asset tracking. 171. A fingerprint is an example of what type of authentication factor? A. Something you know B. Something you have C. Something you are D. Somewhere you are 172. Dana wants to ensure that her software acquisition process for open source software is as secure as possible. What should she to do validate the security of the open source software? A. Ensure that the software source code is escrowed. B. Review the source code for the software. C. Check dependencies for known vulnerabilities. D. Purchase the software from a software vendor. 173. Sharon wants to implement WPA3 Enterprise. What technology will she need to use for authorization after wireless devices associate with access points? A. LDAP B. 802.1X C. Kerberos D. SAML Chapter 4 ■ Domain 4.0: Security Operations 174. What purpose do the password history and password minimum age settings have in Windows? A. To prevent attackers from resetting passwords B. To prevent brute-­force attacks C. To prevent password reuse D. To ensure proper password expiration 175. A CVSS score is based on what three metric groups of data? A. Scope, Impact, Environmental B. Base, Temporal, and Environmental C. Risk, Threat, Impact D. Time, Risk, Scope 176. Quentin wants to decommission solid-­state drives (SSDs). What process should he follow if he wants to be absolutely certain that the data cannot be recovered? A. Zero wiping B. Destruction C. Sanitation D. Reformatting 177. What challenge is commonly encountered when organizations want to harden IoT devices? A. The devices have limited security options. B. The devices cannot run current operating systems. C. Industry benchmarks for security are not up-­to-­date. D. Central management tools only support new devices. 178. Guillermo wants to establish his organization’s security baseline for Linux systems. After selecting the CIS benchmark that best matches his organization’s commonly used Linux distribution, what should he do next? A. Deploy the benchmark to a test system to see how it performs in normal use. B. Install SELinux to allow for the baseline to be implemented fully. C. Review the baseline to determine any settings that are not a good fit for the organization’s usage. D. Identify the deployment method for the baseline to the Linux systems. 179. Renee has implemented WPA3 Enterprise, and she wants to use an EAP protocol for secure authentication. What EAP version should she implement? A. LEAP B. EAP-­TLS C. EAP-­PSK D. EAP-­PWD 180. The organization that Chris works for has recently acquired another company. As part of the acquisition, Chris is preparing to address the data that the newly acquired company Chapter 4 ■ Domain 4.0: Security Operations used, including setting up rules to handle it in his data loss prevention (DLP) system. What step is commonly required prior to data being protected by a DLP system? A. Hashing the data and creating signatures B. Encrypting the data C. Classifying and tagging the data D. Applying a mandatory access control scheme to the data 181. Mark wants to have a way to determine if attackers have modified files on a critical web application server. What type of tool should he deploy if he wants to be able to check for changes of this nature? A. Drive encryption B. File availability monitoring C. File encryption D. File integrity monitoring 182. Katie’s organization uses an IoC feed that helps her to identify new threats. A recent feed update includes the following hash for Emotet malware: cecc5bba6193d744837e689e68bc25c43eda7235 Where is Katie most likely going to be able to use this hash to identify potential attacks? A. Via her EDR tools B. Via her firewall C. Via her system logs D. All of the above 183. Which of the following tools is best suited to deploying and maintaining a secure baseline for Windows systems for an entire enterprise? A. PowerShell B. Group Policy C. Manual configuration D. Script-­based deployments 184. Perry wants to ensure that an unsecure protocol is secured when in transit through his local network. What solution could he adopt to ensure that this traffic is protected? A. Use SD-­WAN. B. Wrap the protocol using TLS. C. Encrypt all files that are sent using AES. D. Encrypt all files that are sent using SHA-­1. 185. Annie wants to implement a passwordless authentication system. Which of the following would not meet her needs? A. Windows Hello B. A PIN-­based factor C. A cell-­phone authenticator application D. A FIDO2 security key Chapter 4 ■ Domain 4.0: Security Operations 186. Laura wants to harden an ICS and SCADA devices her organization uses to manage critical infrastructure. The devices are old and unsupported, without recent updates. What hardening techniques are most likely to be available to her to help deal with these devices? A. Isolation B. Segmentation C. Adding host-­based firewalls D. Configuring host-­based IPS 187. Bob uses an IoC feed to allow his SIEM to identify and correlate common malicious activity. What phase of the incident response process best describes this? A. Preparation B. Detection C. Containment D. Eradication 188. Yael’s organization has received a very convincing phishing email that has resulted in staff clicking on a malicious link. If Yael can’t remove the email from inboxes, which of the following options will allow her to quickly prevent users from being compromised? A. Set up DNS filtering using the URL from the email. B. Disable the organization’s Internet connection. C. Block inbound traffic from the phishing email’s source IP. D. Enable reputation services for the email. 189. Nick is reviewing his system configurations and notes that logon event auditing settings on the system are set as shown in the example figure. What concern should he express about the setting? Chapter 4 ■ Domain 4.0: Security Operations A. Log files may fill up quickly. B. Successful authentication will not be logged. C. Failed authentication will not be logged. D. Policy may not be enforced properly. 190. Brian is reviewing vulnerabilities discovered as part of a vulnerability scan. He sees a score for a vulnerability of 3.0. What does he know about this vulnerability based on its score? A. It is a high-­severity vulnerability and should be addressed quickly. B. It is a low-­severity vulnerability and may not need to be addressed. C. It is a medium-­severity vulnerability and should be reviewed before being addressed. D. It is a critical vulnerability and should be addressed immediately. 191. Nick wants to allow email servers to validate that email from his servers is actually from them. What email security framework should he adopt to allow this? A. DKIM B. DMARC C. SPF D. SMTP 192. Jack wants to configure a Linux system to use mandatory access controls. What tool should he select that is commonly used to provide this functionality? A. Group Policy B. CIS benchmarks C. SELinux D. Containerization 193. What process is commonly used with open source tools to ensure that dependencies are secure? A. Static analysis B. Package monitoring C. Fagan testing D. Port scanning 194. Yarif wants to harden his SaaS cloud infrastructure. Which of the following hardening techniques is he most likely to be able to implement in an SaaS environment? A. Host-­based firewalls B. Least privilege C. Operating system security configuration D. Physical security for systems Chapter 4 ■ Domain 4.0: Security Operations 195. Which of the following is not a technical control used to address a vulnerability? A. Insurance B. Patching C. Segmentation D. Firewalling 196. Kelsey’s organization has established an asset and inventory management process for servers. Which of the following is not a common part of asset tracking? A. Data classification B. Identifying owners C. Documenting acquisition dates D. Sanitization 197. Kirk needs to allow system administrators to access root passwords in emergencies. What type of solution could he implement to allow them to check out passwords when needed while also tracking those checkouts and requiring the passwords to be changed after use? A. EAP B. Multifactor authentication C. An enterprise password manager D. Passwordless 198. Selah wants to prevent staff in her organization from visiting malicious websites while they’re in the office. If she wants to use the most up-­to-­date threat data, what web filter capability should she take advantage of? A. Agent-­based web filtering B. Reputation tools C. A centralized web filtering proxy D. URL scanning 199. Joe has configured ACLs on a Cisco network device. The ACL he has configured is as follows: interface ethernet0 ip access-­ group 111 in ! access-­ list 111 deny tcp any any eq http access-­ list 111 permit ip any any access-­ list 111 deny tcp any any eq https What does this ACL do? A. Blocks HTTP traffic B. Blocks both HTTP and HTTPS traffic C. Prevents web application attacks D. Allows for inspection of web traffic Chapter 4 ■ Domain 4.0: Security Operations 200. The use of machine learning and algorithms to analyze user behavior in order to identify anomalous behavior is a feature of what specialized type of tool? A. UEBA B. SIEM C. EDR D. DMARC 201. What password best practice is supported by the ability to set password history in Windows? A. Password length B. Password complexity C. Password reuse D. Password age 202. Donna is reviewing a script that was found on a Windows system. What does the following script do? $ip = "10.1.1.101" $svc_name = "WinDefend" get-­ service -­ ComputerName $ip | Where-­ Object {$_.Name -­ eq $svc_name} | Stop-­ Service | Set-­ Service -­ StartupType Disabled A. Stops the Windows Defender service B. Starts the Windows Defender service C. Stops and disables the Windows Defender service D. Enables the Windows Defender service 203. Batu has been asked to build scripts that will allow automated ticket creation through a new help desk tool for his organization. As he considers the lifespan of the scripts, which of the following concerns should he address to ensure that the scripts do not become an issue over time? A. Their initial creation cost B. Their ongoing supportability C. Existing technical debt D. Whether they’re a single point of failure 204. Alex is responsible for his organization’s vulnerability management program. A recent vulnerability scan shows that IoT devices that are used for building automation are vulnerable to a known issue with their built-­in web server. After reviewing the manufacturer’s website, Alex is unable to find an updated operating system or software update. He chooses to move the IoT devices to a protected VLAN and require a jump server to access them. What vulnerability remediation option has he used? A. A compensating control B. Patching C. Insurance D. An exemption Chapter 4 ■ Domain 4.0: Security Operations 205. Wiping a drive and reinstalling from known good media is an example of what incident response option? A. Recovery B. Containment C. Eradication D. Root cause elimination 206. Melissa’s company wants to contract with a third-­party organization to oversee their hardware decommissioning and disposal process. What should she ask the company to do to prove that the disposal process was done properly? A. Certification. B. Follow a data retention policy. C. Provide photographic evidence. D. Keep a log of devices. 207. Sally wants to identify a way to prioritize vulnerabilities discovered by her vulnerability scanner. Which of the following options will allow her to prioritize vulnerabilities effectively while taking her own organization’s needs into account? A. Use CVSS base and temporal metrics. B. Use a qualitative risk assessment process. C. Use CVSS scores that include environmental metrics. D. Use a quantitative risk assessment process. 208. Henry wants to prevent password reuse outside of his organization from impacting the accounts his staff use. Which of the following password settings can have the largest impact if passwords are reused outside of his organization and they are breached due to a security issue at the third-­party site or service? A. Password expiration policies B. Password length policies C. Password complexity policies D. Password minimum age policies 209. Fuzzing is an example of what type of code analysis? A. Static analysis B. Code review C. Pentesting D. Dynamic analysis 210. Steve’s organization is concerned about the potential for devices they are purchasing to be modified before they reach the organization. Which of the following solutions will help the most in preventing this potential issue? A. Buying from a value-­added reseller B. Buying directly from the OEM Chapter 4 C. Buying from a gray market seller D. Buying from a local reseller ■ Domain 4.0: Security Operations 211. What password setting has the greatest impact when attempting to prevent brute-­force password cracking? A. Password history settings B. Password length increases C. Password expiration settings D. Password length decreases 212. Jill wants to identify a potential network-­based distributed denial-­of-­service (DDoS) attack. Which of the following log sources is most likely to provide information that will allow her to identify the attack? A. OS-­specific security logs B. Endpoint logs C. IDS/IPS logs D. Authentication logs 213. Jake has configured WPA3 Personal for his network. What feature makes WPA3 more secure than WPA2’s PSK mode? A. SAE B. PKI C. TLS D. EAP 214. Molly wants to harden embedded systems in her environment. Which of the following options is most likely to be available? A. Hardening benchmarks. B. Central management tools. C. Add-­on security software. D. None; embedded systems have very limited hardening options. 215. Jean wants to use an identity proofing process as part of her user account creation process. Which of the following is most likely to be useful for identity proofing? A. A Google email account B. A state or nationally issued ID C. A Facebook account D. A credit card Chapter 4: Domain 4.0: Security Operations 1. A. While all of these are best practices, moving the device’s administrative interface to a protected VLAN will provide the most significant improvement in security since there are no known issues or vulnerabilities at the moment. If there were, patching or disabling services would quickly move up the list. 2. B. Threat hunting is the process of searching for threats, often using IoCs, threat intelligence, technological tools, and expertise to identify threats that might impact an organization. IoC creation involves documenting and defining an indicator of compromise. Root cause analysis looks for the underlying cause of an issue or event, and eradication is the complete removal of a threat or artifacts of malicious activity. 3. A. The simplest way to ensure that APIs are only used by legitimate users is to require the use of authentication. API keys are one of the most frequently used methods for this. If an API key is lost or stolen, the key can be invalidated and reissued, and since API keys can be matched to usage, Cynthia’s company can also bill customers based on their usage patterns if they want to. A firewall or IP restrictions may be able to help, but they can be fragile; customer IP addresses may change. An intrusion prevention system (IPS) can detect and prevent attacks, but legitimate usage would be hard to tell from those who are not customers using an IPS. 4. C. Greg can clone a legitimate Media Access Control (MAC) address if he can identify one on the network. Greg can do this by checking for a MAC label on some devices or by capturing traffic on the network if he can physically access it. 5. B. Screened subnet designs use a firewall with three interfaces, one for the Internet or an untrusted network, one for a protected but front-­facing network, and one for a shielded or protected network. ACLs (access control lists) use rules to control access. This design may use ACLs, but an ACL alone does not describe it. Binary firewalls were made up for this question, and while an NGFW may be multihomed, “multiroute” is not a term used to describe this design. Appendix ■ Answers to Review Questions 6. B. The Common Vulnerabilities and Exposures (CVE) list has entries that describe and provide references to publicly known cybersecurity vulnerabilities. A CVE feed will provide updated information about new vulnerabilities and a useful index number to cross reference with other services. 7. A. This is an example of a false positive. A false positive can cause a vulnerability to show that was not actually there. This sometimes happens when a patch or fix is installed but the application does not change in a way that shows the change, and it has been an issue with updates where the version number is the primary check for a vulnerability. When a vulnerability scanner sees a vulnerable version number but a patch has been installed that does not update it, a false positive report can occur. A false negative would report a patch or fix where there was actually a vulnerability. Automatic updates were not mentioned, nor was a specific Apache version. 8. B. All of these protocols are unsecure. FTP has been replaced by secure versions in some uses (SFTP/FTPS), whereas Telnet has been superseded by SSH in modern applications. RSH is outmoded and should be seen only on truly ancient systems. If you find a system or device exposing these protocols, you will need to dig in further to determine why they are exposed and how they can be protected if they must remain open for a legitimate reason. 9. B. OSINT, or open source intelligence, is intelligence information obtained from public sources like search engines, websites, domain name registrars, and a host of other locations. OPSEC, or operational security, refers to habits such as not disclosing unnecessary information. STIX is the Structured Threat Intelligence Exchange protocol, and IntCon was made up for this question. 10. A. Proprietary, or closed threat, intelligence is threat intelligence that is not openly available. OSINT, or open source threat intelligence, is freely available. ELINT is a military term for electronic and signals intelligence. Corporate threat intelligence was made up for this question. 11. C. Bug bounties are increasingly common and can be quite lucrative. Bug bounty websites match vulnerability researchers with organizations that are willing to pay for information about issues with their software or services. Ransoms are sometimes demanded by attackers, but this is not a ransom since it was voluntarily paid as part of a reward system. A zero-­day disclosure happens when a vulnerability is disclosed and the organization has not been previously informed and allowed to fix the issue. Finally, you might feel like $10,000 is a payday, but the term is not used as a technical term and doesn’t appear on the exam. 12. C. A false negative occurs with a vulnerability scanning system when a scan is run and an issue that exists is not identified. This can be because of a configuration option, a firewall, or other security setting or because the vulnerability scanner is otherwise unable to detect the issue. A missing vulnerability update might be a concern if the problem did not specifically state that the definitions are fully up-­to-­date. Unless the vulnerability is so new that there is no definition, a missing update shouldn’t be the issue. Silent patching refers to a patching technique that does not show messages to users that a patch is occurring. A false positive would have caused a vulnerability to show that was not actually there. This sometimes happens when a patch or fix is installed but the application does not change in a way that shows the change. Chapter 4: Domain 4.0: Security Operations 13. B. Threat hunting can involve a variety of activities such as intelligence fusion, combining multiple data sources and threat feeds, and reviewing advisories and bulletins to remain aware of the threat environment for your organization or industry. Incident response happens once an incident has occurred, penetration testing tests security from an attacker’s perspective, and vulnerability scanning seeks to identify vulnerabilities using testing through technical means like connecting to services or checking local version information. 14. C. Since Frank is using the cloud service provider’s web services, he will need to review the logs that they capture. If he has not configured them, he will need to do so, and he will then need a service or capability to analyze them for the types of traffic he is concerned about. Syslog and Apache logs are both found on a traditional web host, and they would be appropriate if Frank was running his own web servers in the infrastructure-­as-­a-­service (IaaS) environment. 15. C. Although it may be tempting to immediately upgrade, reading and understanding the CVEs for a vulnerability is a good best practice. Once Charles understands the issue, he can then remediate it based on the recommendations for that specific problem. Disabling PHP or the web server would break the service, and in this case, only newer versions of PHP than 5.4 have the patch Charles needs. 16. D. Although 80 and 443 are the most common HTTP ports, it is common practice to run additional web servers on port 8080 when a nonstandard port is needed. SSH would be expected to be on port 22, RDP on 3389, and MySQL on 3306. 17. C. A network device running SSH on port 22 and a web server on TCP port 443 is a very typical discovery when running a vulnerability scan. Without any demonstrated issues, Carolyn should simply note that she saw those services. Telnet runs on port 21, an unencrypted web server will run on TCP 80 in most cases, and Windows file shares use a variety of ports, including TCP ports 135–139 and 445. 18. C. A test server should be identical to the production server. This can be used for functional testing as well as security testing, before deploying the application. The production server is the live server. A development server would be one the programmers use during development of a web application, and predeployment server is not a term typically used in the industry. 19. C. Staging environments, sometimes called preproduction environments, are typically used for final quality assurance (QA) and validation before code enters the production environment as part of a deployment pipeline. Staging environments closely mirror production, allowing realistic testing and validation to be done. Development and test environments are used to create the code and for testing while it is being developed. 20. C. Application programming interface (API) keys are frequently used to meet this need. An API key can be issued to an individual or organization, and then use of the API can be tracked to each API key. If the API key is compromised or abused, it can be revoked and a new API key can be issued. Firewall rules written to use public IP addresses can be fragile, since IP addresses may change or organizations may have a broad range of addresses that may be in use, making it hard to validate which systems or users are using the API. Credentials, including passwords, are not as frequently used as API keys. Appendix ■ Answers to Review Questions 21. A. Baseline configurations, per NIST 800-­53: “Baseline configurations serve as a basis for future builds, releases, and/or changes to information systems. Baseline configurations include information about information system components (e.g., standard software packages installed on workstations, notebook computers, servers, network components, or mobile devices; current version numbers and patch information on operating systems and applications; and configuration settings/parameters), network topology, and the logical placement of those components within the system architecture. Maintaining baseline configurations requires creating new baselines as organizational information systems change over time. Baseline configurations of information systems reflect the current enterprise architecture.” 22. A. Indexing encrypted files will mean that an unencrypted index is stored, potentially exposing the content of encrypted files. Disabling the indexing service for encrypted files helps to protect them. There is no denial-­of-­service scenario for this unless a vulnerability in the indexing service is discovered and none is mentioned. The service is not exposed via the network, and dark web access is not accomplished via indexing services. 23. D. OAuth is a common authorization service used for cloud services. It allows users to decide which websites or applications to entrust their information to without requiring them to give them the user’s password. OpenID is frequently paired with OAuth as the authentication layer. Kerberos is more frequently used for on-­site authentication, and SAML is Security Assertion Markup Language. 24. A. Fingerprint reader systems are the most widely accepted biometric systems in common use for entry access and other purposes today. Facial recognition systems are increasingly in use and are also likely to be more accepted by user populations based on their broad deployment in phones, but they are not listed as an option. Both retina and iris scans are less likely to be accepted, whereas voice systems are both relatively uncommon and more disruptive for frequent usage. 25. C. Static codes are typically recorded in a secure location, but if they are not properly secured, or are otherwise exposed, they can be stolen. Brute-­force attempts should be detected and prevented by backoff algorithms and other techniques that prevent attacks against multifactor authentication systems. Collisions exist with hashing algorithms, not with static multifactor codes, and clock mismatch issues occur for time-­based one-­time password (TOTP) codes. 26. C. The best answer from this list is DLP, or data loss prevention technology. DLP is designed to protect data from being exposed or leaking from a network using a variety of techniques and technology. Stateful firewalls are used to control which traffic is sent to or from a system, but will not detect sensitive data. OEM is an original equipment manufacturer, and security information and event management (SIEM) can help track events and incidents but will not directly protect data itself. 27. A. Social login is an example of a federated approach to using identities. The combination of identity providers and service providers, along with authorization management, is a key part of federation. AAA (authentication, authorization, and accounting) is typically associated with protocols like RADIUS. Privilege creep occurs as staff members change jobs and their privileges are not adjusted to only match their current role. IAM is a broader set of identity and access management practices. Although IAM may be involved in federated identity, this question does not directly describe IAM. Chapter 4: Domain 4.0: Security Operations 28. A. Although it may seem like Charles has presented two factors, in fact he has only presented two types of things he knows along with his identity. To truly implement a multifactor environment, he should use more than one of something you have, something you know, and something you are. 29. B. A site survey is the process of identifying where access points should be located for best coverage and identifying existing sources of RF interference, including preexisting wireless networks and other devices that may use the same radio frequency spectrum. By conducting a site survey, Naomi can guide the placement of her access points as well as create a channel design that will work best for her organization. 30. C. Mobile device management (MDM) suites often provide the ability to manage content on devices as well as applications. Using content management tools can allow Charlene to provision files, documents, and media to the devices that staff members in her organization are issued. Application management would be useful for apps. Remote wipe can remove data and applications from the device if it is lost or stolen, or an employee leaves the organization. Push notifications are useful when information needs to be provided to the device user. 31. C. In this scenario, Denny specifically needs to ensure that he stops the most malware. In situations like this, vendor diversity is the best way to detect more malware, and installing a different vendor’s antivirus (AV) package on servers like email servers and then installing a managed package for PCs will result in the most detections in almost all cases. Installing more than one AV package on the same system is rarely recommended, since this often causes performance issues and conflicts between the packages—­in fact, at times AV packages have been known to detect other AV packages because of the deep hooks they place into the operating system to detect malicious activity! 32. C. The application includes input validation techniques that are used to ensure that unexpected or malicious input does not cause problems with the application. Input validation techniques will strip out control characters, validate data, and perform a variety of other actions to clean input before it is processed by the application or stored for future use. This validation may help prevent buffer overflows, but other techniques described here are not used for buffer overflow prevention. String injection is actually something this helps to prevent, and schema validation looks at data to ensure that requests match a schema, but again this is a narrower description than the broad range of input validation occurring in the description. 33. A. WPA3 supports SAE, or simultaneous authentication of equals, providing a more secure way to authenticate that limits the potential for brute-­force attacks and allows individuals to use different passwords. WPA is not as secure as WPA2, and WEP is the oldest, and least secure, wireless security protocol. WPA2 is not as secure as WPA3 but remains in use due to broad deployment. 34. B. The correct answer is to use a sandboxed environment to test the malware and determine its complete functionality. A sandboxed system could be an isolated virtual machine (VM) or an actual physical machine that is entirely isolated from the network. Leaving the malware on a production system is never the correct approach. You should test or analyze the malware to determine exactly what malware it is, allowing you to respond to the threat properly. A honeypot is used for luring and trapping attackers, not for testing malware. Appendix ■ Answers to Review Questions 35. D. Isaac knows that trusting client systems to be secure is not a good idea, and thus ensuring that validation occurs on a trusted client is not an appropriate recommendation. Ensuring that validation occurs on a trusted server, that client data is validated, and that data types and ranges are reasonable are all good best practices for him to recommend. 36. C. Isaac can configure a geofence that defines his corporate buildings and campus. He can then set up a geofence policy that will only allow devices to work while they are inside that geofenced area. Patch management, IP filtering, and network restrictions are not suitable solutions for this. 37. A. Static code analysis can help identify business logic issues by leveraging expert knowledge and understanding of the business process and logic involved. Fuzzing is a technique whereby the tester intentionally enters incorrect values into input fields to see how the application will handle it but doesn’t directly test business logic. Baselining is the process of establishing security standards, and version control simply tracks changes in the code—­it does not test the code. 38. B. Endpoint detection and response (EDR) focuses on identifying anomalies and issues, but it is not designed to be a malware analysis tool. Instead, the ability to search and explore data, identify suspicious activities, and coordinate responses is what makes up an EDR tool. 39. A. Mandatory access control (MAC) is the correct solution. It will not allow lower privileged users to even see the data at a higher privilege level. Discretionary access control (DAC) has each data owner configure their own security. Role-­based access control (RBAC) could be configured to meet the needs, but it’s not the best solution for these requirements. Security Assertion Markup Language (SAML) is not an access control model. 40. B. An agent-­based, preadmission system will provide greater insight into the configuration of the system using the agent, and using a preadmission model will allow the system configuration to be tested before the system is allowed to connect to the network. Agentless NAC uses scanning and/or network inventory techniques and will typically not have as deep a level of insight into the configuration and software versions running on a system. Postadmission systems make enforcement decisions based on what users do after they gain admission to a network, rather than prior to gaining admission, allowing you to quickly rule out two of these options. 41. C. CYOD, or choose your own device, allows users to choose a device that is corporate owned and paid for. Choices may be limited to set of devices, or users may be allowed to choose essentially any device depending on the organization’s deployment decisions. BYOD allows users to bring their own device, whereas COPE, or corporate-­owned, personally enabled, provides devices to users that they can then use for personal use. VDI uses a virtual desktop infrastructure as an access layer for any security model where specialized needs or security requirements may require access to remote desktop or application services. 42. C. If Claire is using Simple Network Management Protocol (SNMP) to manage and monitor her network devices, she should make sure she is using SNMPv3 and that it is properly configured. SNMPv3 can provide information about the status and configuration of her network devices. Remote Authentication Dial-­In User Service (RADIUS) might be used to authenticate to the network, but Transport Layer Security (TLS) and SSH File Transfer Protocol (SFTP) are not specifically used for the purposes described. Chapter 4: Domain 4.0: Security Operations 43. B. Containerization will allow Eric’s company’s tools and data to be run inside of an application-­based container, isolating the data and programs from the self-­controlled bring your own device (BYOD) devices. Storage segmentation can be helpful, but the operating system itself as well as the applications would remain a concern. Eric should recommend full-­device encryption (FDE) as a security best practice, but encrypting the container and the data it contains can provide a reasonable security layer even if the device itself is not fully encrypted. Remote wipe is helpful if devices are lost or stolen, but the end user may not be okay with having the entire device wiped, and there are ways to work around remote wipes, including blocking cellular and Wi-­Fi signals. 44. B. Data loss prevention (DLP) tools allow sensitive data to be tagged and monitored so that if a user attempts to send it, they will be notified, administrators will be informed, and if necessary, the data can be protected using encryption or other protection methods before it is sent. Full-­disk encryption (FDE) would protect data at rest, and S/MIME and POP3S would protect mail being retrieved from a server but would not prevent the SSNs from being sent. 45. A. Attribute-­based access control (ABAC) looks at a group of attributes, in addition to the login username and password, to make decisions about whether or not to grant access. One of the attributes examined is the location of the person. Since the users in this company travel frequently, they will often be at new locations, and that might cause ABAC to reject their logins. Wrong passwords can certainly prevent login, but are not specific to ABAC. ABAC does not prevent remote access, and a firewall can be configured to allow, or prohibit, any traffic you wish. 46. B. Single sign-­on (SSO) is designed specifically to address this risk and would be the most helpful. Users have only a single logon to remember; thus, they have no need to write down the password. OAuth (Open Authorization) is an open standard for token-­based authentication and authorization on the Internet. It does not eliminate the use or need for multiple passwords. Multifactor authentication helps prevent risks due to lost passwords, but does not remove the need for multiple passwords by itself. Security Assertion Markup Language (SAML) and Lightweight Directory Access Protocol (LDAP) do not stop users from needing to remember multiple passwords. 47. D. Rule-­based access control applies a set of rules to an access request. Based on the application of the rules, the user may be given access to a specific resource that they were not explicitly granted permission to. MAC, DAC, and role-­based access control wouldn’t give a user access unless that user has already been explicitly given that access. 48. D. Both the Windows and Linux filesystems work based on a discretionary access control scheme where file and directory owners can determine who can access, change, or otherwise work with files under their control. Role-­based access controls systems determine rights based on roles that are assigned to users. Rule-­based access control systems use a series of rules to determine which actions can occur, and mandatory access control systems enforce control at the operating system level. 49. A. Restricting each faculty account so that it is only usable when that particular faculty member is typically on campus will prevent someone from logging in with that account after hours, even if they have the password. Usage auditing may detect misuse of accounts but will not prevent it. Longer passwords are effective security, but a longer password can still be stolen. Credential management is always a good idea, but it won’t address this specific issue. Appendix ■ Answers to Review Questions 50. C. Password complexity requires that passwords have a mixture of uppercase letters, lowercase letters, numbers, and special characters. This would be the best approach to correct the problem described in the question. Longer passwords are a good security measure but will not correct the issue presented here. Changing passwords won’t make those passwords any stronger, and SSO will have no effect on the strength of passwords. 51. B. Mandatory access control (MAC) is based on documented security levels associated with the information being accessed. Role-­based access control (RBAC) is based on the role the user is placed in. Discretionary access control (DAC) lets the data owner set access control. BAC is not an access control model. 52. A. Discretionary access control (DAC) allows data owners to assign permissions. Role-­based access control (RBAC) assigns access based on the role the user is in. Mandatory access control (MAC) is stricter and enforces control at the OS level. Attribute-­cased access control (ABAC) considers various attributes such as location, time, and computer in addition to username and password. 53. A. OS hardening is the process of securing an operating system by patching, updating, and configuring the operating system to be secure. Configuration management is the ongoing process of managing configurations for systems, rather than this initial security step. Both security uplift and endpoint lockdown were made up for this question. 54. D. Secure Lightweight Directory Access Protocol (LDAPS) uses port 636 by default. DNS uses port 53, LDAP uses 389, and secure HTTP uses port 443. 55. B. Role-­based access control (RBAC) grants permissions based on the user’s position within the organization. Mandatory access control (MAC) uses security classifications to grant permissions. Discretionary access control (DAC) allows data owners to set permissions. Attribute-­based access control (ABAC) considers various attributes such as location, time, and computer, in addition to username and password. 56. A. Security groups are a virtual firewall for instances, allowing rules to be applied to traffic between instances. Dynamic resource allocation is a concept that allows resources to be applied as they are needed, including scaling up and down infrastructure and systems on the fly. Virtual private cloud (VPC) endpoints are a way to connect to services inside of a cloud provider without an Internet gateway. Finally, instance awareness is a concept that means that tools know about the differences between instances, rather than treating each instance in a scaling group as the same. This can be important during incident response processes and security monitoring for scaled groups, where resources may all appear identical without instance awareness. 57. B. If the system maintains a password history, that will prevent any user from reusing an old password. Password complexity and length are common security settings but would not prevent the behavior described. Multifactor authentication helps prevent brute-­force attacks and reduces the potential impact of stolen passwords but would not help with this scenario. 58. A. Setting login time restrictions is a common method to control when a system can be used. Turning off a system does not prevent it from being turned back on. Guards are expensive compared to a simple technical control limiting logins, and disabling remote login does not prevent local login. Chapter 4: Domain 4.0: Security Operations 59. A. Security Assertion Markup Language (SAML) is an XML-­based, open standard format for exchanging authentication and authorization data between parties. OAuth allows an end user’s account information to be used by third-­party services, without exposing the user’s password. RADIUS is a remote access protocol. New Technology LAN Manager (NTLM) is not XML-­based. 60. A. Backups are considered to be the least volatile type of storage since they change at a much slower pace and, in fact, may be intentionally retained for long periods of time without changing. In this list, CPU cache will change the most frequently, then RAM, then local disk contents. 61. C. After eradication of the issue has been completed, recovery can begin. Recovery can include restoration of services and a return to normal operations. 62. C. The MITRE ATT&CK framework focuses on techniques and tactics. CIS Benchmarks are security configuration baselines, the Dark Web Analysis Project was made up for this question, and the CVSS standard is a vulnerability scoring system and is not a useful framework for analyzing malware and attacks. 63. D. To properly preserve the system, Ted needs to ensure that it does not change. Turning off the system will cause anything in memory to be lost, which may be needed for the investigation. Removing the drive while a system is running can cause data to be lost. Instead, live-­imaging the machine and its memory may be required. Allowing users to continue to use a machine will result in changes, which can also damage Ted’s ability to perform a forensic investigation. 64. D. Windows does not log network traffic at a level of granularity that will show if a file has been uploaded. Basic traffic statistics can be captured, but without additional sensors and information-­gathering capabilities, Jessica will not be able to determine if files are sent from a Windows system. 65. C. The chain of custody in forensic activities tracks who has a device, data, or other forensic artifact at any time, when transfers occur, who performed analysis, and where the item, system, or device goes when the forensic process is done. Evidence logs may be maintained by law enforcement to track evidence that is gathered. Paper trail and digital footprint are not technical terms used for digital forensics. 66. B. The -­c flag for grep counts the number of occurrences for a given string in a file. The -­n flag shows the matched lines and line numbers. Even if you’re not sure about which flag is which, the syntax should help on a question like this. When using grep, the pattern comes before the filename, allowing you to rule out two of the options right away. 67. B. Network flows using NetFlow or sFlow would provide the information that Eric wants, with details of how much traffic was used, when, and where traffic was directed. A firewall or data loss prevention (DLP) would not show the bandwidth detail, although a firewall may show the connection information for events. Packetflow was made up for this question and is not a technology used for this purpose. Appendix ■ Answers to Review Questions 68. D. Hashing using MD5 or SHA1 is commonly used to validate that a forensic image matches the original drive. Many forensic duplicators automatically generate a hash of both drives when they complete the imaging process to ensure that there is a documentation chain for the forensic artifacts. A third image may be useful but does not validate this. Directory listings do not prove that drives match, and photos, though useful to document the drives and serial numbers, do not validate the contents of the drives. 69. B. Nessus is a popular vulnerability scanning tool. It is not a fuzzer, web application firewall (WAF), or protocol analyzer. 70. D. Red Hat stores authentication log information in /var/log/secure instead of /var/ log/auth.log used by Debian and Ubuntu systems. Knowing the differences between the major distributions can help speed up your forensic and incident investigations, and consistency is one of the reasons that organizations often select a single Linux distribution for their infrastructure whenever it is possible to do so. 71. C. Cuckoo, or Cuckoo Sandbox, is a malware analysis sandbox that will safely run malware and then analyze and report on its behavior. strings is a command-­line tool that retrieves strings from binary data. scanless is a tool described as a port scraper, which retrieves port information without running a port scan by using websites and services to run the scan for you. Sn1per is a pen test framework. 72. C. Metadata viewing tools will allow Lucca to view the metadata that is embedded in the file itself. Metadata is not downloaded separately or available via the hash for a JPEG file. 73. B. When artifacts are acquired as part of an investigation, they should be logged and documented as part of the evidence related to the investigation. Artifacts could include a piece of paper with passwords on it, tools or technology related to an exploit or attack, smartcards, or any other element of an investigation. 74. D. Forensic reports should include appropriate technical detail. Analysis of a system does not include a picture of the person from whom the system was acquired. 75. C. The browser cache, history, and session information will all contain information from recently visited sites. Bookmarks may indicate sites that a user has visited at some point, but a bookmark can be added without visiting a site at all. 76. C. Organizations define retention policies for different data types and systems. Many organizations use 30-­, 45-­, 90-­, 180-­, or 365-­day retention policies, with some information required to be kept longer due to law or compliance reasons. Susan’s organization may keep logs for as little as 30 days depending on storage limitations and business needs. Data classification policies typically impact how data is secured and handled. Backup policies determine how long backups are retained and rotated and may have an impact on data if the logs are backed up, but backing up logs are a less common practice due to the space they take up versus the value of having logs backed up. Legal hold practices are common, but policies are less typically defined for legal holds since requirements are set by law. Chapter 4: Domain 4.0: Security Operations 77. C. A quarantine process or setting will preserve malicious or dangerous files and programs without allowing them to run. This allows defenders to retrieve them for further analysis as well as to return them to use if they are determined not to be malicious, or if the malicious components can be removed from needed files. Purging, deep-­freezing, and retention are not terms used to describe this behavior or setting. 78. C. Chuck should recommend a mobile device management (MDM) system to ensure that organizational devices can be managed and protected in the future. Data loss prevention (DLP) will not stop a lost phone from being a potential leak of data, isolating the phones is not a realistic scenario for devices that will actually be used, nor is containment because the phone is out of the organization’s control once lost. 79. B. The most important action Charles can take while working with his forensic artifacts to provide nonrepudiation is to digitally sign the artifacts and information that he is creating in his evidence records. Encrypting the output will ensure its confidentiality but will not provide nonrepudiation by itself. MD5 checksums for images are commonly gathered but must then be signed so that they can be validated to ensure they have not been modified. 80. A. The best way to capture a virtual machine from a running hypervisor is usually to use the built-­in tools to obtain a snapshot of the system. Imaging tools are not typically capable of capturing machine state, and dd is not designed to capture VMs. Removing a server’s drives can be challenging due to possible RAID and other specific server configuration items, and doing so might impact all other running VMs and services on the system. 81. A. Law enforcement is not typically part of organizational incident response teams, but incident response teams often maintain a relationship with local law enforcement officers. Security analysts, management, and communication staff as well as technical experts are all commonly part of a core incident response team. 82. A. Even if you’re not familiar with iptables, you can read through these rules and guess which rule includes the right details. DROP makes sense for a block, and you should know that SSH will be a TCP service on port 22. 83. A. A packet capture will show attempts to connect to the service and will help Maria determine if there is unexpected traffic to the system. A network firewall could stop the traffic, but analyzing the actual traffic itself is best done with a packet capture. Logs may be useful as part of the analysis, but again, packet captures will provide more information. A forensic disk image is not useful for reviewing network traffic. 84. A. Incident response plans don’t stop incidents from occurring, but they do help responders react appropriately and prepare the organization for incidents, and may be required for legal or compliance reasons. 85. D. Degaussing a drive uses strong magnetic fields to wipe it and is the least likely to result in recoverable data. Deleted files can often be recovered because only the file index information will be removed until that space is needed and is overwritten. Quick formats work in a similar way and will leave remnant data, and files that are overwritten by smaller files will also leave fragments of data that can be recovered and analyzed. Appendix ■ Answers to Review Questions 86. D. Henry’s most likely use for the video is to document the forensic process, part of the chain of custody and provenance of the forensic data he acquires. The order of volatility helps determine what devices or drives he would image first. There is no crime being committed, so establishing guilt is not relevant to this scenario, and the video will not ensure data is preserved on a drive during a forensic process. 87. B. IPSec is not a tool used to capture network flows. sFlow, NetFlow, and IPFIX are all used to capture network flow information, which will provide the information Charlene needs. 88. B. PRTG and Cacti are both network monitoring tools that can provide bandwidth monitoring information. Bandwidth monitors can help identify exfiltration, heavy and abnormal bandwidth usage, and other information that can be helpful for both incident identification and incident investigations. If you encounter a question like this on the exam, even if you’re not familiar with either tool, you can use your knowledge of what Simple Network Management Protocol (SNMP) is used for to identify which of the categories is most likely correct. 89. A. A variety of configuration changes could be pushed to mobile devices to help: setting passcodes, enabling full-­disk encryption (FDE) on mobile devices via organizationally deployed mobile device management (MDM), or even preventing some sensitive files from being downloaded or kept on those devices could all help. Firewall rules, data loss prevention (DLP) rules, and URL filters will not prevent a stolen device from being accessed and the data being exposed. 90. B. The Security+ exam outline talks about seven incident response process steps: Preparation, Detection, Analysis, Containment, Eradication, Recovery, and Lessons Learned. 91. C. Jill wants the least possible changes to occur on the system, so she should instruct the user to not save any files or make any changes. Rebooting the system will not create a memory dump, and may cause new files to be written or changed if patches were waiting to install or other changes are set to occur during a reboot. Turning off Secure Delete or making other changes will not impact the files that were deleted prior to that setting change. 92. B. The IR process used for the Security+ exam outline is Preparation, Detection, Analysis, Containment, Eradication, Recovery, and Lessons Learned. Veronica should move into the lessons learned phase. 93. C. Quick formatting merely deletes file indexes rather than removing and overwriting files, making it inappropriate for sanitization. Physical destruction will ensure that the data is not readable, as will degaussing and zero wiping. 94. D. Microsoft Office places information like the name of the creator of the file, editors, creation and change dates, and other useful information in the file metadata that is stored in each Office document. Bart can simply open the Office document to review this information, or he can use a forensic or file metadata tool to review it. Filenames may contain the creator’s name, but this would only be if the creator included it. Microsoft Office does not create or maintain a log, and the application log for Windows does not contain this information. Chapter 4: Domain 4.0: Security Operations 95. B. Windows Defender Firewall operates on a per-­application model and can filter traffic based on whether the system is on a trusted private network or a public network. Nathaniel should allow Chrome by name in the firewall, which will allow it to send traffic without needing to specify ports or protocols. 96. B. Building a timeline, particularly from multiple systems, relies on accurately set system clocks or adding a manually configured offset. Disk hashing and acquisition does not need an accurate system clock, and file metadata can be reviewed even without an accurate clock, although accurate clock information or knowing the offset can be useful for analysis. 97. B. Data breach notification laws often build in a maximum length of time that can pass before notification is required. They also often include a threshold for notification, with a maximum number of exposed individuals before the state or other authorities must be notified. They do not include a maximum number of individuals who can be notified, nor do they typically have specific requirements about police involvement in forensic investigations or certification types or levels. 98. C. A data loss prevention (DLP) tool that can scan and review emails for SSN style data is the most effective tool listed here. Naomi may want to set the tool to block all emails with potential SSNs, and then review those emails manually to ensure that no further emails leave while allowing legitimate emails to pass through. An intrusion detection system (IDS) might look tempting as an answer, but an IDS can only detect, not stop, the traffic, which would allow the SSNs to exit the organization. Antimalware and firewalls will not stop this type of event. 99. C. Email headers contain a significant amount of metadata, including where the email was sent from. The from: field lists a sender but does not indicate where the email was actually sent from. The to: field lists who the email was sent to, and footers are not used to store this information for email. 100. C. NXLog is a log collection and centralization tool. IPFIX, NetFlow, and sFlow all gather data about network traffic, including source, destination, port, protocol, and amount of data sent to be collected. 101. D. SQL injection (SQLi) attempts are sent as HTTP or HTTPS requests to a web server, meaning that Valerie will be able to see the attacks in the web server log. Domain Name System (DNS) logs, if available, will not show these. Auth logs show logins, not web or SQL Server queries or requests. Unlike Windows, there is no security log file for Linux, although there is a secure log for some systems. 102. C. A legal hold notice will inform the company that they must preserve and protect information related to the case. None of the other items are terms used in this process. 103. B. A quarantine setting will place a malicious or suspect file in a safe location and will keep it there until a set timeframe has passed or until an administrator takes action to deal with it. This can allow you to further analyze the file or to restore it if it was an incorrect identification or if the file is needed for another purpose. Containment is used to limit the extent of an incident or attack, isolation keeps a system or device from connecting to or accessing others, and deleting a file wouldn’t keep it around. Appendix ■ Answers to Review Questions 104. C. The recovery phase often involves adding firewall rules and patching systems in addition to rebuilding systems. Although preparation may involve configuring firewall rules or regular patching, it does not do so in response to an incident. Detection attempts to identify events and issues, and analysis involves investigating the events. 105. C. Tim should look at the trend information for malware detections to check to see if there are more infections being detected than during recent weeks. This can be a useful indicator of a change, due to a new malware technique or package; a successful attack that has resulted in staff members clicking malicious links or opening malicious emails; or other paths into the organization. Tim could then check with users whose systems reported the malware to see what had occurred. Alerts might show the infections but would not show the data over time as easily as trends. Sensors will show individual places data is gathered, and bandwidth dashboards can show useful information about which systems are using more or less bandwidth, but the trends dashboard remains the right place for Tim to look in this situation. 106. B. The Center for Internet Security (CIS) benchmarks provide recommendations for how to secure an operating system, application, or other covered technology. Michelle will find Windows-­specific security configuration guidelines and techniques. 107. C. A single point of failure (SPOF) is a single weakness that can bring down an entire system and prevent it from working. Cloud computing allows the delivery of hosted service over the Internet. Load balancing spreads traffic or other load between multiple systems or servers. Virtualization uses a system to host virtual machines that share the underlying resources such as RAM, hard drive, and CPU. 108. C. Asset management policies typically include all stages of an asset’s life cycle, and asset tags like those described are used to track assets in many organizations. Change management, incident response, and acceptable use policies do not require asset tagging. 109. D. The diagram shows a fully redundant internal network with pairs of firewalls, routers, and core switches, but with a single connection to the Internet. This means that Megan should consider how her organization would connect to the outside world if that link was severed or disrupted. There is no indication whether this is a wired or wireless link, and the image does not show a redundant link. 110. B. Support tools typically require additional steps or integrations to take action on a ticket and a human is often involved to ensure that legitimate emails do not result in the creation of unwanted rules or responses. Juan’s team could use the ticketing system to track whether emails are dealt with, to correlate them, and potentially to trigger additional actions. 111. D. The Sender Policy Framework (SPF) lists IP addresses of systems allowed to send email in DNS TXT records for a domain. DKIM (DomainKeys Identified Mail) validates a domain’s identity using a public key pair, validating the authenticity of the sender. DMARC (domain-­based message authentication, reporting, and conformance) controls how unauthenticated messages are handled by mailbox providers, including quarantining, rejecting, or rejecting messages. STP is not an email security framework. Chapter 4: Domain 4.0: Security Operations 112. D. The packet capture shows a high volume of SYN packets, indicating a potential SYN flood, a type of denial-­of-­service attack. There is no information to indicate SMTP traffic for a phishing campaign, nor is there HTTP traffic for SQL injection against an application. While SYN traffic is commonly seen when a connection is lost, this traffic is repeated at a rapid pace rather than a typical reconnection attempt. 113. D. Endpoint detection and response (EDR) tools combine behavior-­based detection capabilities with centralized dashboards and advanced response capabilities. Intrusion prevention systems (IPSs) can detect network threats but aren’t well suited to detecting behaviors on endpoint systems. NAC (network access control) is used to limit who can connect to a network. Data loss prevention (DLP) systems monitor for data exfiltration as well as data that is sent both inadvertently and on purpose outside the organization that shouldn’t be. 114. C. Tabletop exercises involve teams sitting down to talk through an exercise. Teams don’t perform actions or even simulate them, third-­party penetration testers are not reviewing their data, and no actual fail overs occur. 115. B. Root cause analysis is a process used to determine the underlying cause of an issue such as why attackers were able to successfully take down Michelle’s web server cluster. Threat hunting is used to proactively look for threats using a variety of techniques, including OSINT and leveraging indicators of compromise. Lessons learned processes look for takeaways from events and incidents to allow organizations to improve their processes and procedures. Recovery is part of the incident response process but focuses on restoring the organization to normal operation. 116. D. Jailbreaking is not a typical hardening process and is instead used to bypass device security to allow additional control of the device. While individuals may jailbreak devices, organizations rarely permit it. The NSA provides a guide to mobile device security practices at https://media.defense.gov/2021/Sep/16/2002855921/-­1/-­1/0/MOBILE_ DEVICE_BEST_PRACTICES_FINAL_V3%20-­%20COPY.PDF, which includes many practices such as disabling Bluetooth, using strong passwords, and keeping device software up-­to-­date. 117. C. WPA3 Enterprise is the most secure option. It provides for central authentication as well as encryption. WPA4 has not yet been released. WPA2 and WPA3 Personal are not centrally managed, giving Lucca’s organization less control over who connects. 118. B. The EF (exposure factor) for an asset is the value of the asset that would be lost in the event of a loss or damage scenario. Depreciation is a financial term that writes down the cost of a capital item over a given lifespan; annualized loss expectancy is a risk-­related term, not annual loss event; and asset valuation adjustment was made up for this question. 119. B. Derek’s team needs to carefully consider what alerts should be sent, why, and how often. That will require alert tuning. Simply setting alert thresholds may miss critical events, disabling alerts will not achieve the goal of enabling this type of notification, and moving the alerts to email will typically result in a less timely response. Appendix ■ Answers to Review Questions 120. B. Jill can build a signature if she has an example of the SQL code. IPS signatures require data to match against potential attack traffic. A source IP address would only match specific potential attackers instead of the many different potential sources. A hash of the attack would detect one specific version of the attack, but a SQL injection (SQLi) attack may have multiple versions or configurations. The source port will vary with each request and isn’t useful in most cases. 121. A. While all of these are potential problems, Jack’s account should not be provisioned to match Erin. Instead, provisioning based on role is an IAM best practice. Jack’s seniority, the staff he works with, and file access should all be determined by his role. 122. A. Hardware tokens provide the greatest security because they need to be physically present to be used. Application-­based tokens are more secure than SMS in many cases because SMS can be redirected or accessed through SIM-­swapping and other attacks. Extending password length does not provide a second factor and is the least secure of these options by far. 123. A. The lack of consistency could be addressed by enforcing baselines across the organization. Gurvinder should emphasize this, then explain the other common benefits of security automation, including scaling in a secure manner, improving reaction time, automation’s impact as a workforce multiplier, efficiency, employee retention advantages, and the ability to more easily standardize infrastructure configurations. 124. C. The Five Why’s process is well suited to interviews because it asks “Why” each time an answer is provided to get to a root cause. The Five W’s are a common reference in journalism to who, what, when, where, and why—­not a root cause analysis tool. Fishbone diagrams are commonly used for RCA, but are not as useful for an interview process. They’re more likely to be used after the interview to see how answers and events fit together. Recursion analysis is not an RCA process. 125. B. Amanda has conducted a simulation, or walk-­through, where actual recovery actions are simulated to ensure that recovery plans will work as expected. A fail over test moves production to a backup environment like a hot site, and a plan review is just that—­a review of the response plan. A tabletop exercise involves discussions about the scenario and what would be done without taking any actual action. 126. B. Legal holds require organizations and individuals to preserve data related to pending or active litigation, regardless of its normal data life cycle once the hold notice is received. This means that Liam needs to identify and preserve the data and that normal processes like wiping drives or reusing backup media may not be possible. It does not necessarily mean that Liam’s company must engage a lawyer to preserve the data, and law enforcement is not typically involved in legal holds. 127. A. OAuth is an open standard widely supported by cloud identity providers. Kerberos is used for internal use rather than for external integrations; LDAP is used for some services but is no longer a common choice for this type of integration with cloud service providers compared to options like OAuth, SAML, and OpenID-­based integrations; and Active Directory is used by Microsoft but is not as interoperable. Chapter 4: Domain 4.0: Security Operations 128. B. Attribute-­based access control (ABAC) provides access based on attributes like location, age, rank, or other attributes of a user. Rule-­based access control uses defined rules to make access decisions. Role-­based access control uses a user’s role in an organization to make access control decisions, and mandatory access control (MAC) enforces access control using centralized control. 129. C. Security keys are commonly used for passwordless authentication since they can provide both a physical token and cryptographic login credentials that are unlocked using a password, fingerprint reader, or camera. A password manager does not provide this but does securely store and manage passwords. RFID cards are simply something you have, and biometrics are typically not tokens—­they’re data stored to match a user’s biometric signature. 130. B. Older, insecure services like chargen, daytime, echo, time, rsh, and telnet are all managed by inetd in Linux distributions. Disabling these services is a common item in security hardening benchmarks like the CIS benchmarks. These services are not Windows services, they are not SQL-­related, and disabling them is not a type of patching. 131. A. Bring your own device (BYOD) leaves the choice of device in the hands of the end user. Since the device is the end user’s device, it often means that the organization has less, if any, control over the device. Corporate-­owned, personally enabled (COPE) allows users to use organizationally owned devices for their own use. Choose your own device (CYOD) lets users choose a device that the organization owns. COBO, or company-­owned, business-­ only, is a model that only allows business use of business-­provided devices. 132. D. The Secure Cookie attribute is intended to keep cookies secure in transit. That means that it requires secure cookies be sent only via HTTPS. It does not encrypt the cookie at rest, store it on the server instead of the remote system, nor does it remove the cookie after it has been used. 133. B. Code signing uses the signing organization or individual’s private key to sign a hash of the code. This allows the code to be verified using the organization’s or individual’s public key. Signing code does not involve encrypting it. 134. C. Without an inventory, organizations may misplace, lose, or even have devices stolen. That may result in data breaches or simply loss of assets. A hardware life cycle process is an operational concern; manufacturer support is typically tied to individual devices; and vulnerability scans are possible without an inventory, but Naomi may not know what the device itself is until she physically locates it. 135. C. Static analysis processes for code involve reviewing the source code itself. Dynamic analysis processes use running code. Agile is a project management framework, and internal review is not a term used to describe this. 136. A. Sites accessible using TOR are considered part of the dark web. Information-­sharing organizations like ISACs share information in an industry vertical or among other organizations that participate. Proprietary information is provided by vendors, typically as part of a contract or service. Threat feeds may be public or private and provide information about threats in a digestible format for use with security tools. Appendix ■ Answers to Review Questions 137. A. A lessons learned session is commonly conducted at the end of an incident response process. Once eradication and recovery are complete, incident response processes are typically over and the response effort can be reviewed. The lessons learned are then leveraged as part of the preparation process to be ready for the next incident. That may involve more training, tabletop exercises, or additional detection methods. 138. A. The CVSS environmental score’s impact metric takes into account confidentiality, integrity, and availability risks, with each rated between high, medium, and low levels. It is not a direct rating of network, disk, memory, severity, likelihood, probability, or cost. 139. D. The Security Content Automation Protocol (SCAP) is frequently used to allow for monitoring and measurement of NIST 800-­53-based controls. SAML is used for authorization and authentication, and CVE and CVSS are used to identify and rank vulnerabilities. 140. A. WPA3 Enterprise uses Advanced Encryption Standard (AES) and can use 128-­, 192-­, and 256-­bit keys. It does not support 3DES, and both SHA-­1 and SHA-­256 are hashing algorithms. 141. A. Kerberos is one of a small number of commonly used AAA protocols for network devices. SAML and OpenID are more commonly used for federated services, and TKIP is an encryption method. 142. C. Vulnerability scanners are perfectly suited to this type of task and can be configured to specifically test the web servers that are part of the IoT devices to increase the speed of the scan. A WAF is used to protect web applications and servers, not to assess vulnerabilities and security issues. Pentesting can identify these problems but is typically not fast or scalable. Port scanners identify open ports and service but don’t identify vulnerabilities as effectively as a dedicated vulnerability scanning tool will. 143. B. DMARC, or Domain-­based Message Authentication, Reporting, and Conformance, controls how unauthenticated messages are handled by mailbox providers, including quarantining, rejecting, or rejecting messages. SPF (Sender Policy Framework) lists IP addresses of systems allowed to send email in DNS TXT records for a domain. DomainKeys Identified Mail (DKIM) validates a domain’s identity using a public key pair, validating the authenticity of the sender. TLS (Transport Layer Security) is used to encrypt data in motion. 144. D. In most organization, Wayne’s next steps should be to document the exemption due to the criticality of the server and its extenuating circumstances. Removing the server from scans will prevent it from being effectively impacted by a denial-­of-­service attack each time a scan occurs, but this also means that compensating controls should be implemented if possible. Reporting the server as vulnerable and suggesting it be replaced does not remediate the server or protect it, and will continue to allow it to fail based on future scans. Disabling the device’s network connection will also cause a service outage. Insurance will not prevent service outages or protect the device. 145. B. Identity proofing is used to validate a user’s claim to an identity. Here, Valentine’s company uses information that only a legitimate owner of that identity should have easy access to. Provisioning is the process of creating an account and providing it with Chapter 4: Domain 4.0: Security Operations appropriate resources and rights. Deprovisioning removes accounts and rights. Social identity is the process of using existing user accounts like those found through Facebook or Google to create accounts for existing users at other organizations like Valentine’s. 146. C. Organizations often immediately rescan a system after patching to ensure that the patching worked. While this isn’t an absolutely certain means of validating the patch, it helps to quickly ensure that patching was effective across many machines. Noting false positives may occur if the patch was successful, but systems continue to show as vulnerable. Rebooting may be done but doesn’t necessarily validate the patching installation’s success, and performing an audit may be done but is a less common next step. 147. A. Third-­party audit documentation is a common practice for organizations that want to attest to their customers that they have a secure environment. Rescanning systems and providing vulnerability scans is not a common practice, nor is allowing customers to conduct their own scans of production systems. 148. B. TCP port 1433 is the minimum port requirement for a Microsoft SQL server connection. TCP 3389 is used for Remote Desktop Protocol (RDP). TCP 8080 is a common alternate port for web servers, and TCP 139 and 445 are used for SMB connections. 149. A. Baselining is the process of establishing a standard for security. A change from the original baseline configuration is referred to as baseline deviation. Security evaluations or audits check security but don’t establish security standards. Hardening is the process of securing a given system, but it does not establish security standards. Normalization is the process of removing redundant entries from a database. 150. B. COPE, or company-­owned, personally enabled, models allow staff to use organizationally owned devices for reasonable personal use. CYOD, or choose your own device, allows users to pick their company-­owned device from a list of approved devices. COBO, or company-­owned, business-­only, is just that—­users can only use the devices for business purposes. BYOD asks users to bring their own device, often leaving organizations with limited or no control of the device. 151. B. Process auditing involves reviewing processes to identify unknown or unexpected processes. During incident response scenarios, this is often initially done via the Task Manager. Dynamic analysis is a code review process that uses running code. CVSS matching was made up for this question, and vulnerability scanning tests open services and doesn’t involve the Task Manager. 152. B. Email security gateways are appliances or software virtual appliances that provide anti-­ spam, anti-­phishing, and other email security–related services. They’re purpose-­built to deliver exactly the capabilities that Ujama is looking for. A WAF (web application firewall) is used to protect web applications. DKIM and DMARC are both email security frameworks, but they’re not implemented as appliances themselves. 153. D. A SIEM (security information and event management) tool is designed to aggregate, analyze, correlate, alert on, and report on log entries. MDM (mobile device management) is used to manage mobile devices, jump servers provide access from less secure zones to more secure zones, and SDN is software-­defined networking. Appendix ■ Answers to Review Questions 154. A. Leveraging automation and scripting to increase employee happiness and retention as well as improving efficiency and realizing time savings is a common strategy in situations like this. Deploying fewer devices only works if the organization needs fewer devices, baselines are most useful when paired with automation and scripting for deployment, and a physical endpoint device typically can’t be moved to the cloud. 155. B. Authenticated scans can identify vulnerabilities that are not visible to unauthenticated scans. Penetration testers may not be able to obtain access equivalent to authenticated scans, so an authenticated scan is more likely to provide detailed data. Port scans do not provide deep vulnerability data. 156. C. Quarantine and isolation are both commonly used in the containment phase of an incident to ensure that impacted systems are unable to impact other systems or parts of the organization. Files may also be quarantined to prevent further impact from malware. Detection and analysis typically do not involve quarantine and isolation, but quarantine and isolation may carry through into the eradication phase before systems are returned to normal operation. 157. C. Linux permissions are read left to right for user, group, and other. With r’s at each location, this means everyone can read the contents of the directory. Only the user can write and execute files in the directory. 158. A. A set of rules that defines who can access the data has determined if Beena is granted access. Here, rules assess her role, the time of day, and the workstation’s status. This is not accomplished using a classification or clearance system like MAC uses, and it does not rely on just an attribute like Beena’s location or other information about her. 159. A. Trend analysis is commonly used as part of behavior-­based detections, which can help identify new attacks. Signatures require knowledge of existing attacks to match signatures. IP-­and port-­based detection is useful for known attacks but not typically useful for unknown attacks. 160. D. Heatmaps are used to show signal strength and coverage, allowing organizations to identify areas where there may be poor coverage or where multiple signals may conflict. War walking (and war driving) are techniques used to map wireless access points to geographic locations. Spectrum analysis and SSID plots are not terms used for this type of activity. 161. C. The concept of least privilege is that only the minimum rights or privileges required to accomplish a role or task are provided. Zero trust requires continuous authentication and authorization, and least privilege is part of a zero trust environment, but zero trust goes beyond least privilege. Provisioning and deprovisioning are part of the account life cycle, and provisioning should respect the concept of least privilege. 162. D. Automation provides many advantages for the provisioning process, including improving consistency, decreasing the potential for mistakes, and providing faster provisioning. It does not specifically address auditability in ways that manual processes cannot. Regardless of how provisioning is done, audit logs and trails should be created for all events, not just automated ones. Chapter 4: Domain 4.0: Security Operations 163. B. Bug bounty programs are frequently part of responsible disclosure programs intended to provide a way for third parties to report security issues and to be incentivized to report them in responsible ways. Bug bounties can help identify flaws, but they’re not typically part of contracted penetration testing engagements. Third-­party bounty is not a typical way of describing them, and trusted threat programs were made up for this question. 164. D. Even if you’re not familiar with specific Cisco IOS commands and configuration you can quickly determine that this is a Network Time Protocol (NTP)-­related setting. Authenticating NTP and ensuring a trusted key is enabled would help to ensure that network time is trusted and secure. This prevents attackers from conducting attacks that rely on modifying network time or the switch recording incorrect time in its logs. There is no Network Terminal Protocol, this does not impact logs, and network time traffic is not encrypted. 165. C. Using a VPN is a best practice over any untrusted or potentially untrusted network connection. Patching the phone and deploying a security baseline are good for the phone’s security, but they won’t help directly with the security of data in transit. 166. C. ISACs, or Information Sharing and Analysis Centers, are information-­sharing organizations established to connect organizations in verticals like health care, government, utilities, and higher education. While it may provide OSINT information, they go far beyond that. They are not typically found via the dark web and don’t require TOR to access their information, and they are not commercial or proprietary threat data sources. 167. A. Attestation is the verification of ownership or that a person matches who they claim to be. In this case, Mark presents his driver’s license to attest to his own identity. Provisioning is the creation of accounts and the granting of rights, and deprovisioning is the removal of accounts and rights for accounts. SSO is single sign-­on. 168. D. Bluetooth devices can be fingerprinted relatively easily, making it easy to identify individual users who have Bluetooth turned on. Modern Bluetooth traffic is encrypted, its relatively short range is not a security concern, and Bluejacking sends unwanted spam, which isn’t a direct data security issue. 169. D. PAM tools provide a variety of capabilities, including just-­in-­time permissions, password vaulting, and ephemeral credentials. Password persistence was made up for this question and is not a typical feature. 170. A. Port scans can help with enumeration of assets when an inventory does not exist. They do not provide OSINT; OSINT is a passive information-­gathering process and a scan is an active process. Version tracking via port scans is inaccurate and does not provide full information. Identifying assets via port scans is a reasonably common part of asset management, particularly for initial discovery. 171. C. Fingerprints are biometric factors and are something you are. Something you know is a knowledge factor like a password or PIN. Something you have is a hardware token, RFID card, or other similar factor. Somewhere you are is a geographic factor based on location such as GPS coordinates. Appendix ■ Answers to Review Questions 172. C. Dependency checking for open source software is a common best practice to help ensure that underlying components do not have known security vulnerabilities. There are dependency security checking applications and tools available that Dana could use to help with this process. Software source code escrow is often used to ensure that organizations can obtain the software code if a company goes out of business or other adverse events occur that might endanger the company relying on the code. Reviewing the source code for an entire application is outside of the scope and capability of the majority of organizations, particularly when other dependencies are included. Purchasing software from a known vendor can help, but does not necessarily ensure that the software is secure and dependencies don’t introduce or include known issues. 173. B. Sharon knows that Enterprise mode authentication is typically done with 802.1X. LDAP and Kerberos are not typically used for this, and SAML is more frequently part of federated and cloud services. 174. C. Windows supports both password history and a minimum password age to help prevent users from simply resetting their password over and over again until they can reuse their preferred password. This does not prevent attackers from resetting passwords or using brute-­force attacks and doesn’t ensure password expiration. 175. B. CVSS scores are based on base metrics like the attack vector; complexity; scope; user interaction required and privileges required; the temporal group, which includes exploit code maturity, remediation level, and report confidence; and the environmental group, including confidentiality, availability, and integrity requirements. While scope, impact, risk, and threat all play into these elements, CVSS calls the three metric groups Base, Temporal, and Environmental. 176. B. In scenarios where the data needs to be guaranteed to be unrecoverable, physical destruction is a common choice. Zero wiping and reformatting both leave remnant data on SSDs, and sanitization processes are reasonably secure but cannot always be guaranteed to result in total data removal. 177. A. IoT devices often have very limited security options, if any. That means that hardening them using built-­in tools and configurations is limited, if not impossible. IoT devices typically use their own OS; benchmarks are rarely available, not just out-­of-­date; and central management for many IoT devices is frequently not available. 178. C. Reviewing any baseline to determine its fit for the organization and how the organization’s systems and services operate is an appropriate next step after selecting a benchmark. Deploying SELinux may be necessary for some features depending on the distribution in use, but nothing in the question indicates that this is required. Once the benchmark has been modified to purpose and suitability, it can be tested, and further modifications can be made if necessary. Finally, it can be deployed and managed. 179. B. EAP-­TLS provides TLS-­based Transport Layer Security as part of a secure authentication implementation. LEAP is the Lightweight Extensible Authentication Protocol, which was in use before 802.11i but is now largely outdated. EAP-­PSK uses a preshared key for mutual authentication and does not rely on public key encryption, but it is not supported in WPA3 deployments. EAP-­PWD uses a shared password for authentication and, like EAP-­ PSK, is not supported by WPA3. Chapter 4: Domain 4.0: Security Operations 180. C. DLP systems often rely on classification, tagging, and metadata to help them identify sensitive data that the organization handles and which could be exfiltrated or sent inadvertently outside of the organization. Hashing and creating signatures is more commonly associated with filesystem-­monitoring tools. Encrypting the data is not required by a DLP and may actually make it harder for the DLP to identify the data. Applying a mandatory access control scheme to the data is not a typical step in preparing for DLP-­based protection. 181. D. File integrity monitoring tools use hashes to validate that files match their original content. If the files change, the hashes will not match, allowing the tool to alert administrators that a change has occurred. Drive encryption and file encryption both protect the confidentiality of data but don’t indicate changes without a signature. File availability monitoring is not a typical tool, although system or service availability monitoring is. 182. A. Endpoint detection and response (EDR) tools are most likely to use hashing to match known malicious files like this. Firewalls may provide the capability, but system logs do not, ruling out the “all of the above” option. 183. B. Group Policy is the most common way of deploying baselines throughout Windows organizations. Group Policy Objects (GPOs) are set and managed across the entire Active Directory organization, allowing them to be modified for groups or specific purposes while inheriting most settings from the top of the organizational structure. PowerShell is a scripting tool, and both PowerShell and Group Policy are commonly used for specific purposes, but GPOs are typically preferred at scale. Manual configuration is not recommended for an entire organization. 184. B. A common technique to ensure that traffic sent via unsecure protocols remains secure is to wrap it using TLS. SD-­WAN is used to manage external connectivity, and there is no mention of files, only of an unsecure protocol. Even if files were encrypted, the rest of the traffic might leak information. Hashing does not leave data recoverable, making it unusable for this type of use in almost all cases. 185. B. Passwordless authentication avoids making users provide a password or PIN by using a proof of identity from a device or token. Windows Hello, cell-­based authenticator applications, and FIDO2 security keys all support this, but entering a PIN does not. 186. B. Since ICS and SCADA devices need connectivity as part of their design, Laura knows that using segmentation to place the devices in a secure network is likely her best hardening option. Isolating the devices would break the functionality of ICS/SCADA systems. Neither ICS nor SCADA devices typically have support for host-­based firewalls or host-­based IPS. 187. B. The detection and analysis phases of the incident response process both commonly leverage IoCs to detect and then correlate information to identify incidents. Preparation might involve setting up threat feeds and building automations to help notify security administrators of issues. Containment and eradication may leverage threat data to help understand common actions taken by threat actors, but the SIEM detecting and correlating events is not typically part of containment or eradication. 188. A. Enabling DNS filtering based on the URL from the email is the most effective option listed. Disabling the organization’s Internet connection will result in additional disruption. Blocking the email’s source IP for an already received email will not be effective, nor will enabling reputation services for email after the email has already been received. Appendix ■ Answers to Review Questions 189. B. Successful authentications will not be logged based on these settings. Having access to both successes and failures can be useful when investigating incidents, particularly if attackers have stolen credentials. Text-­based log files take up minimal space on most workstations and servers and should not be a significant concern. While the message notes that the policy may be overridden, Nick’s primary concern should be missing log data. 190. B. CVSS scores range from 0 to 10.0, with 10.0 being the most critical. A score of .1–3.9 is considered a low rating, meaning that Brian can take his time to review and remediate the risk. Scores of 4.0–6.9 are medium, 7.0–8.9 are high, and 9.0–10.0 are critical. 191. A. DKIM (DomainKeys Identified Mail) validates a domain’s identity using a public key pair, validating the authenticity of the sender. DMARC (Domain-­based Message Authentication, Reporting, and Conformance) controls how unauthenticated messages are handled by mailbox providers, including quarantining, rejecting, or rejecting messages. The Sender Policy Framework (SPF) lists IP addresses of systems allowed to send email in DNS TXT records for a domain. STP is not an email security framework. The Simple Mail Transfer Protocol (SMTP) is the default email protocol. 192. C. SELinux is a Linux kernel module that provides a variety of security capabilities and access control methods, including support for MAC (mandatory access control) for Linux systems. Group Policy is a Windows tool, the CIS benchmarks provide security configuration recommendations for systems but do not directly provide mandatory access control, and containerization is used to make application installations portable. 193. B. Package monitoring tools review the dependencies and packages that make up open source tools to identify vulnerable components. Static analysis is manual review of code. Fagan testing is a formal code analysis process. Port scanning is not used to monitor for dependency security. 194. B. SaaS environments allow customers to manage information, data, devices, accounts, and identities. That means that ensuring least privilege is used is possible through use of accounts and identities. Host-­based firewalls, OS configurations, and physical security are all the responsibility of the SaaS provider. 195. A. Unlike the other controls listed, insurance simply transfers the risk to another organization at a cost. It does not take any action to prevent the risk from occurring. Patching, segmentation, and firewalling are all technical controls. 196. D. Sanitization is part of decommissioning and disposal processes, not asset management. Tracking data classification used on systems, identifying owners, and documenting acquisition dates for warranty and life-­cycle tracking are all common parts of this process. 197. C. Enterprise password managers provide functionality just like this, allowing passwords to be stored securely and tracked on use. EAP is an authentication protocol; multifactor authentication adds one or more factors, increasing security, but doesn’t provide the functionality described; and passwordless isn’t designed for a checkout and reset function. Chapter 4: Domain 4.0: Security Operations 198. B. Using threat data from reputation tools will best fit Selah’s needs. Agent-­based web filtering is used when systems will be mobile or connected to networks that are not controlled centrally. Centralized web filtering proxies and URL scanning are useful general controls, but reputation tools answer the specific need more directly. 199. A. ACLs are interpreted in the order they are listed. This ACL is not properly written if it is intended to block HTTPS because the ACL order includes a rule that allows any traffic after the rule that blocks HTTP is processed. This means that traffic will first be checked to see if it is HTTP traffic. If it is not, it will be allowed, and thus will bypass the HTTPS block. It will not prevent web application attacks since HTTPS can pass the ACL, and no specific configuration is set for inspection of web traffic. 200. A. User and entity behavior analytics (UEBA) tools are specifically designed to use behavior-­based analytic tools leveraging machine learning and algorithmic analysis. SIEM is used to correlate events and log data as part of ongoing monitoring. EDR focuses on malicious behavior detection on endpoints. DMARC is used for email security. 201. C. Password history is intended to prevent password reuse in Windows. It is commonly paired with a minimum password age to prevent users from simply resetting their password multiple times until they can reuse their password, and a longer history is used to make this more difficult too. It does not influence password length or complexity. 202. C. This script will stop and disable the Windows Defender service on a system with IP address 10.1.1.101. You can identify both the Stop-­Service and StartupType Disabled values in the script to determine what it is likely to do. It does not start Windows Defender, nor does it enable the service. 203. B. Since Batu has been asked to consider the lifespan of the scripts, ensuring that they’re supportable in an ongoing manner is the biggest concern. Initial cost is typically small compared to the ongoing benefit of scripts like these. Existing technical debt is not a major concern for automated ticket creation with a new tool, and while having a single point of failure can be a concern, automated ticket outages are a point-­in-­time concern not a lifetime-­centered concern. 204. A. Alex has used a compensating control because he cannot remediate the underlying vulnerability. This reduces the risk by preventing the devices from being available on the network to untrusted devices and users. He cannot patch, no insurance was purchased, and no exemption was granted or registered. 205. C. Eradication efforts focus on completely removing all artifacts of a compromise or event. Wiping drives to ensure that no remnant malware or other artifacts remain, then reinstalling using known good media are examples of eradication processes. Restoring the system to service after it has been remediated occurs after eradication. Containment efforts attempt to limit the potential spread or ongoing impact of an incident, and root cause analysis is used to determine the underlying causes of an issue, incident, or event. Root cause elimination is not a commonly used term for this. Appendix ■ Answers to Review Questions 206. A. Certification of destruction can include photographic evidence, logs, and other data that demonstrate the disposal contract was followed. Data retention policies are applied internally, not to third-­party companies that are contracted for disposal. 207. C. CVSS environmental scores help organizations take their own requirements and risks into account. That means that Sally can use numeric scores to prioritize risk while using her organization’s needs and unique threat model. Qualitative and quantitative risk assessments are useful, but they are not as well suited to leveraging data from a vulnerability scanner in a timely manner. 208. A. Password expiration polices help reduce the length of time a password could be exposed for. Henry knows that if his staff change their password periodically that it can help avoid issues with reuse on other sites. He also knows that multifactor is a more effective solution and that he should focus his time there as well. Password length and complexity don’t matter if the password was compromised elsewhere, and minimum age policies are used to prevent reuse in the organization by resetting passwords over and over again to return to an original desired password. Note that policies like this don’t stop reuse outside of a user’s organization on 3rd party sites! 209. D. Fuzzing, the process of feeding unexpected and random input to programs to see how they behave, is an example of dynamic analysis where the code is actually run to test it. Static analysis involves reviewing the code, as does code review. Fuzzing is typically done as part of software testing rather than penetration testing, but it may be used by pentesters. 210. B. Ensuring supply chain security can be challenging, but buying directly from a vendor can remove opportunities for devices to be modified. Trusted value-­added resellers are the second best choice. Buying from the gray market or a reseller typically adds additional opportunities for device modification. 211. B. Increasing password length makes it harder to crack. Decreasing the password length would make passwords easier to crack. History and expiration do not influence brute-­force attacks unless the expiration happens to land during the time the password cracking was attempted. 212. C. IDS and IPS devices are the only network security device in this list. Other common logs used to identify potential DDoS attacks include network logs and firewall logs. Application and web server logs may be useful if the DDoS is associated with an application. OS-­ specific security logs, endpoint logs, and authentication logs are not typical places to find useful information for a network-­based DDoS attack. 213. A. SAE (Simultaneous Authentication of Equals) provides a secure authentication mode that replaced WPA2’s preshared key session key negotiation process. PKI is public key encryption and is not the solution in use. TLS is Transport Layer Security, used to encrypt data in motion, and EAP is an authentication protocol. 214. D. Embedded systems typically have few, if any hardening options because of their purpose-­built functionality. Benchmarks are rarely available for them, and most are not designed for central management or adding on security software. Chapter 5: Domain 5.0: Security Program Management and Oversight 215. B. Identity proofing uses information about a user to prove that they are who they claim to be. A state or nationally issued ID is a better proof than a Facebook or Google account which can be created under any name without validation. Credit cards are not a form of identity.