Computer Security Practice Test (Answer Key)

Topic 3, Exam Pool C Question #:1 - (Exam Topic 3) A security engineer is installing a WAF to protect the company’s website from malicious web requests over SSL. Which of the following is needed to meet the objective? A. A reverse proxy B. A decryption certificate C. A split-tunnel VPN D. Load-balanced servers Answer: A Question #:2 - (Exam Topic 3) A systems administrator is considering different backup solutions for the IT infrastructure. The company is looking for a solution that offers the fastest recovery time while also saving the most amount of storage used to maintain the backups. Which of the following recovery solutions would be the BEST option to meet these requirements? A. Snapshot B. Differential C. Full D. Tape Answer: B Explanation There are mainly three types of backup: full, differential, and incremental. Let’s dive in to know more about the types of backup, the difference between them and which one would be the best fit for your business. A basic graphic displaying the difference between full backup, differential backup, and incremental backup. Full Backup A full backup is the most complete type of backup where you clone all the selected data. This includes files, folders, SaaS applications, hard drives and more. The highlight of a full backup is the minimal time it requires to restore data. However, since as everything is backed up in one go, it takes longer to backup compared to other types of backup. The other common issue with running full backups is that it overloads storage space. That’s why most businesses tend to run a full backup and occasionally follow it up with differential or incremental backup. This reduces the burden on the storage space, increasing backup speed. Differential Backup A differential backup straddles the line between a full and an incremental backup. This type of backup involves backing up data that was created or changed since the last full backup. To put it simply, a full backup is done initially, and then subsequent backups are run to include all the changes made to the files and folders. It lets you restore data faster than full backup since it requires only two backup components: an initial full backup and the latest differential backup. Let’s see how a differential backup works: Day 1 – Schedule a full backup Day 2 – Schedule a differential backup. It will cover all the changes that took place between Day 1 and Day 2 Day 3 – Schedule a differential backup. It will make a copy of all the data that has changed from Day 2 (this includes the full backup on Day 1 + differential backup) and Day 3. Incremental Backup The first backup in an incremental backup is a full backup. The succeeding backups will only store changes that were made to the previous backup. Businesses have more flexibility in spinning these types of backups as often as they want, with only the most recent changes stored. Incremental backup requires space to store only the changes (increments), which allows for lightning-fast backups. Difference Between Full, Differential and Incremental Backups Full Differential Incremental Storage Space High Medium to High Low Backup Speed Slowest Fast Fastest Restoration Speed Fastest Fast Slowest Media Required for Recovery Most recent backup only Most recent full backup & most recent differential backup Most recent full backup & all incremental backups since full backup Duplication Stores a lot of duplicate files Stores duplicate files No duplicate files Question #:3 - (Exam Topic 3) A security analyst is Investigating a malware incident at a company. The malware Is accessing a command-and-control website at www.comptia.com. All outbound Internet traffic is logged to a syslog server and stored in /logfiles/messages. Which of the following commands would be BEST for the analyst to use on the syslog server to search for recent traffic to the command-and-control website? A. Option A B. Option B C. Option C D. Option D Answer: C Question #:4 - (Exam Topic 3) As part of a company's ongoing SOC maturation process, the company wants to implement a method to share cyberthreat intelligence data with outside security partners. Which of the following will the company MOST likely implement? A. TAXII B. TLP C. TTP D. STIX Answer: C Explanation TTPs Within Cyber Threat Intelligence Tactics, techniques and procedures (TTPs) are the “patterns of activities or methods associated with a specific threat actor or group of threat actors.” Analysis of TTPs aids in counterintelligence and security operations by describing how threat actors perform attacks. Top threats facing an organization should be given priority for TTP maturation. Smaller organizations may benefit strategically by outsourcing research and response. One acronym everyone working on a cybersecurity team should be familiar with is TTPs – tactics, techniques and procedures – but not everyone understands how to use them properly within a cyber threat intelligence solution. TTPs describe how threat actors (the bad guys) orchestrate, execute and manage their operations attacks. (“Tactics” is also sometimes called “tools” in the acronym.) Specifically, TTPs are defined as the “patterns of activities or methods associated with a specific threat actor or group of threat actors,” according to the Definitive Guide to Cyber Threat Intelligence. Topic 1, Exam Pool A Question #:5 - (Exam Topic 1) A network administrator is setting up wireless access points in all the conference rooms and wants to authenticate device using PKI. Which of the following should the administrator configure? A. A captive portal B. PSK C. 802.1X D. WPS Answer: C Question #:6 - (Exam Topic 1) A vulnerability assessment report will include the CVSS score of the discovered vulnerabilities because the score allows the organization to better. A. validate the vulnerability exists in the organization's network through penetration testing B. research the appropriate mitigation techniques in a vulnerability database C. find the software patches that are required to mitigate a vulnerability D. prioritize remediation of vulnerabilities based on the possible impact. Answer: D Explanation The Common Vulnerability Scoring System (CVSS) is a free and open industry standard for assessing the severity of computer system security vulnerabilities. CVSS attempts to assign severity scores to vulnerabilities, allowing responders to prioritize responses and resources according to threat https://en.wikipedia.org/wiki/Common_Vulnerability_Scoring_System Question #:7 - (Exam Topic 1) Which of the following describes the BEST approach for deploying application patches? A. Apply the patches to systems in a testing environment then to systems in a staging environment, and finally to production systems. B. Test the patches in a staging environment, develop against them in the development environment, and then apply them to the production systems C. Test the patches m a test environment apply them to the production systems and then apply them to a staging environment D. Apply the patches to the production systems apply them in a staging environment, and then test all of them in a testing environment Answer: A Question #:8 - (Exam Topic 1) A university with remote campuses, which all use different service providers, loses Internet connectivity across all locations. After a few minutes, Internet and VoIP services are restored, only to go offline again at random intervals, typically within four minutes of services being restored. Outages continue throughout the day, impacting all inbound and outbound connections and services. Services that are limited to the local LAN or WiFi network are not impacted, but all WAN and VoIP services are affected. Later that day, the edge-router manufacturer releases a CVE outlining the ability of an attacker to exploit the SIP protocol handling on devices, leading to resource exhaustion and system reloads. Which of the following BEST describe this type of attack? (Choose two.) A. DoS B. SSL stripping C. Memory leak D. Race condition E. Shimming F. Refactoring Answer: A C Explanation "According to its self-reported version, the Cisco IOS software running on the remote device is affected by a denial of service vulnerability in the Session Initiation Protocol (SIP) gateway implementation due to improper handling of malformed SIP messages. An unauthenticated, remote attacker can exploit this, via crafted SIP messages, to cause memory leakage, resulting in an eventual reload of the affected device." Topic 2, Exam Pool B Question #:9 - (Exam Topic 2) A security analyst sees the following log output while reviewing web logs: Which of the following mitigation strategies would be BEST to prevent this attack from being successful? A. Secure cookies B. Input validation C. Code signing D. Stored procedures Answer: B Question #:10 - (Exam Topic 2) A security engineer at an offline government facility is concerned about the validity of an SSL certificate. The engineer wants to perform the fastest check with the least delay to determine if the certificate has been revoked. Which of the following would BEST these requirement? A. RA B. OCSP C. CRL D. CSR Answer: C Explanation A CRL can still be preferred over the use of OCSP if a server has issued many certificates to be validated within a single revocation period. It may be more efficient for the organization to download a CRL at the beginning of the revocation period than to utilize the OCSP standard, necessitating an OCSP response every time a certificate requires validation.