securityplus 26-50

NO.26 An organization maintains several environments in which patches are developed and tested before deployed to an operation status. Which of the following is the environment in which patches will be deployed just prior to being put into an operational status?

• (A). Development

• (B). Test

• (C). Production

• (D). Staging

Answer explanation

Test Ortamı (Staging) özelliğini kullanarak tek tıkla sitenizin birebir kopyasını oluştabilirsiniz. Böylece yayında ve ziyarete açık olan sitenizi riske atmadan, kopyası üzerinde dilediğiniz geliştirme, düzenleme ve değişiklikleri gerçekleştirebilirsiniz.

 

Kopyası oluşturulmuş siteniz arama motorları tarafından görünür değildir ve indexlenmez. Sitenize, özel oluşturulmuş test ortamı URL adresi üzerinden erişebilir, sayfaları ve içerikleri görüntüleyebilirsiniz.

NO.27 A security analyst is investigating suspicious traffic on the web server located at IP address 10.10.1.1. A search of the WAF logs reveals the following output:

Which of the following is MOST likely occurring?

• (A). XSS attack

• (B). SQLi attack

• (C). Replay attack

• (D). XSRF attack

NO.28 Company engineers regularly participate in a public Internet forum with other engineers throughout the industry. Which of the following tactics would an attacker MOST likely use in this scenario?

• (A). Watering-hole attack

• (B). Credential harvesting

• (C). Hybrid warfare

• (D). Pharming

Answer explanation

An attack in which an attacker targets specific groups or organizations, discovers which websites they

frequent, and injects malicious code into those sites.

Watering-hole saldırısı: Bir saldırganın belirli grupları veya kuruluşları hedef aldığı, hangi web sitelerini sık sık kullandıklarını keşfettiği ve bu sitelere kötü amaçlı kod enjekte ettiği bir saldırı.

NO.29 Which of the following is a targeted attack aimed at compromising users within a specific industry or group?

• (A). Watering hole

• (B). Typosquatting

• (C). Hoax

• (D). Impersonation

Answer explanation

A targeted attack refers to a type of threat in which threat actors actively pursue and compromise a

target entity's infrastructure while maintaining anonymity. These attackers have a certain level of

expertise and have sufficient resources to conduct their schemes over a long-term period. They can

adapt, adjust, or improve their attacks to counter their victim's defenses. Background Targeted

attacks often employ similar methods found in traditional online threats such as malicious emails,

compromised or malicious sites, exploits, and malware. Targeted attacks differ from traditional

online threats in many ways: * Targeted attacks are typically conducted as campaigns. APTs are often

conducted in campaigns-a series of failed and successful attempts over time to get deeper and

deeper into a target's network-and are thus not isolated incidents. * They usually target specific

industries such as businesses, government agencies, or political groups. Attackers often have longterm

goals in mind, with motives that include, but are not limited to, political gain, monetary profit,

or business data theft. Attackers often customize, modify and improve their methods depending on

the nature of their target sector and to circumvent any security measures implemented. Phases of a

Targeted Attack * Intelligence gathering. Threat actors identify and gather publicly available

information about their target to customize their attacks. This initial phase aims to gain strategic

information not only on the intended target's IT environment but also on its organizational structure.

The information gathered can range from the business applications and software an enterprise

utilizes to the roles and relationships that exist within it. This phase also utilizes social engineering

techniques that leverage recent events, work-related issues or concerns, and other areas of interest

for the intended target. * Point of entry. Threat actors may use varied methods to infiltrate a target's

infrastructure. Common methods include customized spearphishing email, zero-day or software

exploits, and watering hole techniques. Attackers also utilize instant-messaging and social networking

platforms to entice targets to click a link or download malware. Eventually, establishing a connection

with the target is acquired. * Command-and-control (C&C) communication. After security has been

breached, threat actors constantly communicate to the malware to either execute malicious routines

or gather information within the company network. Threat actors use techniques to hide this

communication and keep their movements under the radar. * Lateral movement. Once inside the

network, threat actors move laterally throughout the network to seek key information or infect other

valuable systems. * Asset/Data Discovery. Notable assets or data are determined and isolated for

future data exfiltration. Threat actors have access to "territories" that contain valuable information

and noteworthy assets. These data are then identified and transferred through tools like remote

access Trojans (RATs) and customized and legitimate tools. A possible technique used in this stage

may be sending back file lists in different directories so attackers can identify what are valuable. *

Data Exfiltration. This is the main goal of targeted attacks. An attack's objective is to gather key

information and transfer this to a location that the attackers control. Transferring such data can be

conducted quickly or gradually. Targeted attacks strive to remain undetected in the network in order

to gain access to the company's crown jewels or valuable data. These valuable data include

intellectual property, trade secrets, and customer information. In addition, threat actors may also

seek other sensitive data such as top-secret documents from government or military institutions.

Once a targeted attack is successful and has reached as far as the data exfiltration stage, it is not

difficult for attackers to draw out the data. Although targeted attacks are not known to specifically target consumers, their data are also at risk once target business sectors have been infiltrated. As a

result, such attacks (if successful) may damage a company's reputation.

https://www.trendmicro.com/vinfo/us/security/definition/targetedattacks#:~:

text=A%20targeted%20attack%20refers%20to,over%20a%20long%2Dterm%20period.

NO.30 A user reports falling for a phishing email to an analyst. Which of the following system logs would the analyst check FIRST?

• (A). DNS

• (B). Message gateway

• (C). Network

• (D). Authentication

NO.31 A company labeled some documents with the public sensitivity classification. This means the documents can be accessed by:

• (A). employees of other companies and the press

• (B). all members of the department that created the documents

• (C). only the company's employees and those listed in the document

• (D). only the individuate listed in the documents

NO.32 Given the following logs:

Which of the following BEST describes the type of attack that is occurring?

• (A). Rainbow table

• (B). Dictionary

• (C). Password spraying

• (D). Pass-the-hash

NO.33 Which of the following is a benefit of including a risk management framework into an organization's security approach?

• (A). It defines expected service levels from participating supply chain partners to ensure system

  outages are remediated in a timely manner

• (B). It identifies specific vendor products that have been tested and approved for use in a secure

  environment.

• (C). It provides legal assurances and remedies in the event a data breach occurs

• (D). It incorporates control, development, policy, and management activities into IT operations.

NO.34 Business partners are working on a security mechanism to validate transactions securely. The requirement is for one company to be responsible for deploying a trusted solution that will register and issue artifacts used to sign encrypt, and decrypt transaction files. Which of the following is the BEST solution to adopt?

• (A). PKI

• (B). Blockchain

• (C). SAML

• (D). OAuth

Answer explanation

PKI (Public Key Infrastructure) Nedir? Sertifikaların ve anahtar ikililerinin yönetimini sağlayan yazılımsal ve yordamsal bütünlüğe PKI denmektedir.

NO.35 A website developer is working on a new e-commerce website and has asked an information security expert for the most appropriate way to store credit card numbers to create an easy reordering process. Which of the following methods would BEST accomplish this goal?

• (A). Salting the magnetic strip information

• (B). Encrypting the credit card information in transit.

• (C). Hashing the credit card numbers upon entry.

• (D). Tokenizing the credit cards in the database