SEC+Practice Quiz B49-B69

A company has signed an SLA with an Internet service provider. Which of the following would BEST describe the content of this SLA?

• A. The customer will connect to partner locations over an IPsec tunnel

• B. The service provider will provide 99.999% uptime

• C. The customer applications use HTTPS over tcp/443

• D. Customer application use will be busiest on the 15th of each month

Answer explanation

B. The service provider will provide 99.999% uptime An SLA (Service Level Agreement) is a contract that specifies the minimum terms for provided services. It’s common to include uptime, response times, and other service metrics in an SLA. The incorrect answers: A. The customer will connect to partner locations over an IPsec tunnel A service level agreement describes the minimum service levels provided to the customer. You would not commonly see descriptions of how the service will be used in the SLA contract. C. The customer applications use HTTPS over tcp/443 The protocols used by the customer’s applications aren’t part of the service requirements from the ISP. D. Customer application use will be busiest on the 15th of each month The customer’s application usage isn’t part of the service requirements from the ISP. More information: SY0-601, Objective 5.3 - Third-party Risk Management https://professormesser.link/601050302

An attacker has created many social media accounts and is posting information in an attempt to get the attention of the media. Which of the following would BEST describe this attack?

• A. On-path

• B. Watering hole

• C. Influence campaign

• D. Phishing

Answer explanation

C. Influence campaign Influence campaigns are carefully crafted attacks that exploit social media and traditional media. The incorrect answers: A. On-path An on-path attack uses an attacker in the middle of a conversation to capture or modify information as it traverses the network. B. Watering hole A watering hole attack uses a carefully selected attack location to infect visitors to a specific website. D. Phishing A phishing attack traditionally uses email in an effort to convince the victim to disclose private or sensitive information. More information: SY0-601, Objective 1.1 - Influence Campaigns https://professormesser.link/601010108

Which of the following would be the BEST way to protect credit card account information when performing real-time purchase authorizations?

A. Masking ❍ B. DLP ❍ C. Tokenization ❍ D. NGFW

• A. Masking

• B. DLP

• C. Tokenization

• NGFW

Answer explanation

C. Tokenization Tokenization is a technique that replaces user data with a non-sensitive placeholder, or token. Tokenization is commonly used on mobile devices to purchase using a credit card without transmitting the credit card number. The incorrect answers: A. Masking Data masking hides sensitive data by hiding the information or replacing it with a non-sensitive alternative. An example of masking would be replacing an account number on a receipt with hash marks. B. DLP DLP (Data Loss Prevention) solutions can identify and block sensitive data from being sent over the network. DLP does not provide any additional security or protection for real-time financial transactions. D. NGFW An NGFW (Next-Generation Firewall) is an application-aware security technology. NGFW solutions can provide additional controls for specific applications, but they won't provide any additional account protections when sending financial details. More information: SY0-601, Objective 2.1 - Protecting Data https://professormesser.link/601020102

The network design of an online women's apparel company includes a primary data center in the United States and secondary data centers in London and Tokyo. Customers place orders online via HTTPS to servers at the closest data center, and these orders and customer profiles are then centrally stored in the United States data center. The connections between all data centers use Internet links with IPsec tunnels. Fulfillment requests are sent from the United States data center to shipping locations in the customer’s country. Which of the following should be the CIO’s MOST significant security concern with this existing network design?

A. IPsec connects data centers over public Internet links ❍ B. Fulfillment requests are shipped within the customer’s country ❍ C. Customer information is transferred between countries ❍ D. The data centers are located geographically distant from each other

• A. IPsec connects data centers over public Internet links

• B. Fulfillment requests are shipped within the customer’s country

• C. Customer information is transferred between countries

• D. The data centers are located geographically distant from each other

Answer explanation

C. Customer information is transferred between countries Data sovereignty laws can mandate how data is handled. Data that resides in a country is usually subject to the laws of that country, and compliance regulations may not allow the data to be moved outside of the country. The incorrect answers: A. IPsec connects data centers over public Internet links Connecting remote locations using IPsec tunnels over public Internet connections is a common method of securely linking sites together. If someone was to capture the data traversing these links, they would find that all of the data was encrypted. B. Fulfillment requests are shipped within the customer’s country There are no significant security issues associated with shipments within the same country. D. The data centers are located geographically distant from each other A best practice for many international organizations is to have data centers in geographically diverse locations to minimize the impact of any single data center outage. More information: SY0-601, Objective 2.1 - Protecting Data https://professormesser.link/601020102

A government transport service has installed access points that support WPA3. Which of the following technologies would provide enhanced security for PSK while using WPA3?

• 802.1X

• SAE

• WEP

• WPS

Answer explanation

B. SAE WPA3 (Wi-Fi Protected Access 3) enhances the PSK (Pre-Shared Key) authentication process by privately deriving session keys instead of sending the key hashes across the network. The incorrect answers: A. 802.1X 802.1X is a standard for authentication using AAA (Authentication, Authorization and Accounting) services. 802.1X is commonly used in conjunction with LDAP, RADIUS, or a similar authentication service. C. WEP WEP (Wired Equivalent Privacy) is an older wireless encryption algorithm that was ultimately found to have cryptographic vulnerabilities. D. WPS WPS (Wi-Fi Protected Setup) is a standard method of connecting devices to a wireless network without requiring a PSK or passphrase. More information: SY0-601, Objective 3.4 - Wireless Cryptography https://professormesser.link/601030401

A security administrator has found a keylogger installed alongside an update of accounting software. Which of the following would prevent the transmission of the collected logs? ❍ A. Prevent the installation of all software ❍ B. Block all unknown outbound network traffic at the Internet firewall ❍ C. Install host-based anti-virus software ❍ D. Scan all incoming email attachments at the email gateway

• A. Prevent the installation of all software

• B. Block all unknown outbound network traffic at the Internet firewall

• C. Install host-based anti-virus software

• D. Scan all incoming email attachments at the email gateway

Answer explanation

B. Block all unknown outbound network traffic at the Internet firewall Keylogging software has two major functions; record keystrokes, and transmit those keystrokes to a remote location. Local file scanning and software best-practices can help prevent the initial installation, and controlling outbound network traffic can block unauthorized file transfers. The incorrect answers: A. Prevent the installation of all software Blocking software installations may prevent the initial malware infection, but it won’t provide any control of outbound keylogged data. C. Install host-based anti-virus software A good anti-virus application can identify malware before the installation occurs, but anti-virus does not commonly provide any control of network communication. D. Scan all incoming email attachments at the email gateway Malware can be installed from many sources, and sometimes the source is unexpected. Scanning or blocking executables at the email gateway can help prevent infection but it won’t provide any control of outbound file transfers. More information: SY0-601, Objective 1.2 - An Overview of Malware https://professormesser.link/601010201

A user in the marketing department is unable to connect to the wireless network. After authenticating with a username and password, the user receives this message: -- -- -- The connection attempt could not be completed. The Credentials provided by the server could not be validated. Radius Server: radius.example.com Root CA: Example.com Internal CA Root Certificate -- -- -- The AP is configured with WPA3 encryption and 802.1X authentication. Which of the following is the MOST likely reason for this login issue?

• A. The user’s computer is in the incorrect VLAN

• B. The RADIUS server is not responding

• C. The user’s computer does not support WPA3 encryption

• D. The user is in a location with an insufficient wireless signal

• E. The client computer does not have the proper certificate installed

Answer explanation

E. The client computer does not have the proper certificate installed The error message states that the server credentials could not be validated. This indicates that the certificate authority that signed the server’s certificate is either different than the CA certificate installed on the client’s workstation, or the client workstation does not have an installed copy of the CA’s certificate. This validation process ensures that the client is communicating to a trusted server and there are no man-in-the-middle attacks occurring. The incorrect answers: A. The user’s computer is in the incorrect VLAN The RADIUS server certificate validation process should work properly from all VLANs. The error indicates that the communication process is working properly, so an incorrect VLAN would not be the cause of this issue. B. The RADIUS server is not responding If the RADIUS server had no response to the user, then the process would simply timeout. In this example, the error message indicates that the communication process is working between the RADIUS server and the client’s computer. C. The user’s computer does not support WPA3 encryption The first step when connecting to a wireless network is to associate with the 802.11 access point. If WPA3 encryption was not supported, the authentication process would not have occurred and the user’s workstation would not have seen the server credentials. D. The user is in a location with an insufficient wireless signal The error message regarding server validation indicates that the wireless signal is strong enough to send and receive data on the wireless network. More information: SY0-601, Objective 3.9 - Public Key Infrastructure https://professormesser.link/601030901

A security administrator has created a new policy that prohibits the use of MD5 hashes due to collision problems. Which of the following describes the reason for this new policy?

• A. Two different messages have different hashes

• B. The original message can be derived from the hash

• C. Two identical messages have the same hash

• D. Two different messages share the same hash

Answer explanation

D. Two different messages share the same hash A well-designed hashing algorithm will create a unique hash value for every possible input. If two different inputs create the same hash, the hash algorithm has created a collision. The incorrect answers: A. Two different messages have different hashes In normal operation, two different inputs will create two different hash outputs. B. The original message can be derived from the hash Hashing is a one-way cipher, and you cannot derive the original message from a hash value. C. Two identical messages have the same hash Two identical messages should always create exactly the same hash output. More information: SY0-601, Objective 1.2 - Cryptographic Attacks https://professormesser.link/601010214

Jack, a security administrator, has been tasked with hardening all of the internal web servers to prevent on-path attacks and to protect the application traffic from protocol analysis. These requirements should be implemented without changing the configuration on the client systems. Which of the following should Jack include in his project plan? (Select TWO)

• A. Add DNSSEC records on the internal DNS servers

• B. Use HTTPS over port 443 for all server communication

• C. Use IPsec for client connections

• D. Create a web server certificate and sign it with the internal CA

• E. Require FTPS for all file transfers

Answer explanation

B. Use HTTPS over port 443 for all server communication, and D. Create a web server certificate and sign it with the internal CA Using the secure HTTPS (Hypertext Transfer Protocol Secure) protocol will ensure that all network communication is protected between the web server and the client devices. If someone manages to capture the network traffic, they would be viewing encrypted data. A signed certificate from a trusted internal CA (Certificate Authority) allows web browsers to trust that the web server is the legitimate server endpoint. If someone attempts an on-path attack, the certificate presented will not validate and a warning message will appear in the browser. The incorrect answers: A. Add DNSSEC records on the internal DNS servers DNSSEC (Domain Name System Security Extensions) records are useful to validate the IP address of a device, but they would not prevent an on-path attack. DNSSEC also doesn’t provide any security of the network communication itself. C. Use IPsec for client connections IPsec (IP Security) would provide encrypted communication, but it is not commonly used between a web client and web server. It would also require additional configuration changes on the client devices. E. Require FTPS for all file transfers Web server communication occurs with HTTP or the encrypted HTTPS protocols. The FTPS (File Transfer Protocol Secure) protocol is not commonly used between web clients and servers. More information: SY0-601, Objective 3.1 - Secure Protocols https://professormesser.link/601030101

A security administrator has identified the installation of a RAT on a database server and has quarantined the system. Which of the following should be followed to ensure that the integrity of the evidence is maintained? ❍ A. Perfect forward secrecy ❍ B. Non-repudiation ❍ C. Chain of custody ❍ D. Legal hold

• A. Perfect forward secrecy

• B. Non-repudiation

• C. Chain of custody

• Legal hold

Answer explanation

C. Chain of custody A chain of custody is a documented record of the evidence. The chain of custody also documents the interactions of every person who comes into contact with the evidence. The incorrect answers: A. Perfect forward secrecy Perfect forward secrecy (PFS) is an encryption technique that limits the use of session keys. PFS is not used to insure the integrity of evidence. B. Non-repudiation Non-repudiation ensures that the author of a document cannot be disputed. Non-repudiation does not provide any method of tracking and managing digital evidence. D. Legal hold A legal hold is a technique for preserving important evidence, but it doesn't provide any mechanism for the ongoing integrity of that evidence. More information: SY0-601, Objective 4.5 - Digital Forensics https://professormesser.link/601040501