Module One Knowledge Check

Module One Knowledge Check Score: 100%  Question 1:  Correct Which of the following describes a configuration baseline? A collection of security settings that can be automatically applied to a device The minimum services required for a server to function A list of common security settings that a group or all devices share A set of performance statistics that identifies normal operating performance EXPLANATION A configuration baseline is a set of consistent requirements for a workstation or server. Configuration baselines include a component that ensures that all workstations and servers comply with the security goals of the organization. A security template is a saved set of configuration values that produce the system configuration as specified in the configuration baseline. When you apply the security template to a system, the settings within the template are applied to the system. A performance baseline is a set of performance statistics that identify normal operating performance.  Question 2:  Correct What is the most obvious means of providing non-repudiation in a cryptography system? Shared secret keys Hashing values Public keys Digital signatures EXPLANATION Digital signatures, which are private keys from an asymmetric cryptographic system, are the most obvious means of providing non-repudiation. Only a single person is in possession of their private key. If a message is found with their digital signature, they are the only user who could possibly have created and transmitted it. Public keys are useful for restricting delivery, such as using them as digital envelopes, but they don't provide non-repudiation. Hashing values protect integrity, but they don't provide non-repudiation. Shared secret keys do not provide true non-repudiation because two entities hold copies of the shared key.  Question 3:  Correct You have been given a laptop to use for work. You connect the laptop to your company network, use it from home, and use it while traveling. You want to protect the laptop from internet-based attacks. Which solution should you use? Host-based firewall VPN concentrator Network-based firewall Proxy server EXPLANATION A host-based firewall inspects traffic received by a host. Use a host-based firewall to protect against attacks when there is no network-based firewall, such as when you connect to the internet from a public location. A network-based firewall inspects traffic as it flows between networks. For example, you can install a network-based firewall on the edge of your private network that connects to the internet to protect against attacks from internet hosts. A VPN concentrator is a device connected to the edge of a private network that is used for remote access VPN connections. Remote clients establish a VPN connection to the VPN concentrator and are granted access to the private network. A proxy server is an Application-level firewall that acts as an intermediary between a secure private network and the public. Access to the public network from the private network goes through the proxy server.  Question 4:  Correct You create a new document and save it to a hard drive on a file server on your company's network. Then you employ an encryption tool to encrypt the file using AES. This activity is an example of accomplishing which security goal? Availability Integrity Confidentiality Non-repudiation EXPLANATION Encrypting a file while it is stored on a hard drive is usually done to provide protection for the object's confidentiality. Hashing is used to provide integrity. Using mechanisms like backups and avoiding single points of failure provide availability protection. Non-repudiation is usually provided for during a secured communication, not while a file is stored on a hard drive.  Question 5:  Correct A script kiddie is a threat actor who lacks knowledge and sophistication. Script kiddie attacks often seek to exploit well-known vulnerabilities in systems. What is the BEST defense against script kiddie attacks? Keep systems up to date and use standard security practices. Have appropriate physical security controls in place. Properly secure and store data backups. Build a comprehensive security approach that uses all aspects of threat prevention and protection. Implement email filtering systems. EXPLANATION Because script kiddies lack knowledge and sophistication, their attacks often seek to exploit wellknown vulnerabilities in systems. As such, defense against script kiddies involves keeping systems upto-date and using standard security practices. Having appropriate physical security controls in place is one of the steps that can be used to protect insider threat actors. Implementing email filtering systems and proper securing and storing data backups are two of the steps that can be used to protect against organized crime threat actors. Because nation states use so many different attack vectors and unknown exploits, defending against these attacks involves building a comprehensive security approach that uses all aspects of threat prevention and protection.  Question 6:  Correct Which of the following actions should you take to reduce the attack surface of a server? Disable unused services. Install a host-based IDS. Install anti-malware software. Install the latest patches and hotfixes. EXPLANATION Attack surface reduction (ASR) cuts down on the software or services running on a system. By removing unnecessary software, features, or services, you eliminate possible attacks directed at those components. When removing unnecessary components, you should: Use role separation by installing services on separate physical systems. If a single system is compromised, only the few services on that system are affected. For many new systems, unnecessary services are often installed by default. Following installation, remove unneeded services, protocols, and applications. When removing existing services, determine the unneeded services and their dependencies before altering the system. Adding anti-malware or a host-based intrusion detection system (IDS) adds a level of protection (defense in depth) but does not reduce the number of components running on the system. Applying patches is necessary to fix security problems with software or the operating system. But if the system is not running a specific piece of software, the patches that apply to that software are irrelevant and do not need to be applied.  Question 7:  Correct Which of the following algorithms are used in asymmetric encryption? (Select two.) RSA AES Twofish Diffie-Hellman Blowfish EXPLANATION RSA and Diffie-Hellman are asymmetric algorithms. RSA, one of the earliest encryption algorithms, can also be used for digital signatures. The Diffie-Hellman Protocol was created in 1976 but is still in use today in technologies such as SSL, SSH, and IPsec.  Question 8:  Correct Which of the following threat actors seeks to defame, shed light on, or cripple an organization or government? Competitor Script kiddie Hacktivist Nation state Insider EXPLANATION A hacktivist is any individual whose attacks are politically motivated. Instead of seeking financial gain, hacktivists want to defame, shed light on, or cripple an organization or government. Hacktivists often work alone. Occasionally, they create unified groups with like-minded hackers. For example, the website wikileaks.org is a repository of leaked government secrets, some of which have been obtain by hacktivists. Script kiddies are usually motivated by the chance to impress their friends or garner attention in the hacking community. Insider threat actors can be motivated by negative feelings toward their employer, bribes from a competitor, or personal financial gain. Competitors could be motivated by financial gain, competitor defamation, or obtaining industry secrets. There are two primary motives for nation state attacks,seeking to obtain sensitive information (such as government secrets) or seeking to cripple the target's network or infrastructure.  Question 9:  Correct Which of the following is the correct definition of a threat? Instance of exposure to losses from an attacker The likelihood of an attack taking advantage of a vulnerability Any potential danger to the confidentiality, integrity, or availability of information or systems Absence or weakness of a safeguard that could be exploited EXPLANATION A threat is any potential danger to the confidentiality, integrity, or availability of information or systems. Risk is the likelihood of a threat taking advantage of a vulnerability. A vulnerability is the absence or weakness of a safeguard that could be exploited. An exposure is an instance of exposure to losses from a threat agent.  Question 10:  Correct Which of the following is a firewall function? Encrypting Frame filtering Packet filtering FTP hosting EXPLANATION Firewalls often filter packets by checking each packet against a set of administrator-defined criteria. If the packet is not accepted, it is simply dropped.