Security+ 701 - Quiz 2

An administrator discovers that some files on a database server were recently encrypted.

The administrator sees from the security logs that the data was last accessed by a domain user. Which of the following best describes the type of attack that occurred?

• Insider threat

• Social engineering

• Watering-hole

• Unauthorized attacker

Answer explanation

An insider threat is a type of attack that originates from someone who has legitimate access to an organization's network, systems, or data. In this case, the domain user who encrypted the files on the database server is an example of an insider threat, as they abused their access privileges to cause harm to the organization. Insider threats can be motivated by various factors, such as financial gain, revenge, espionage, or sabotage.

Social engineering: Social engineering involves manipulating individuals into divulging confidential information or performing actions that compromise security. While social engineering attacks can involve insiders, the scenario does not provide evidence of social engineering tactics being used in this specific incident.

Watering-hole: A watering-hole attack involves compromising websites that are frequently visited by the target organization's employees, with the goal of infecting visitors' devices with malware. This scenario does not align with the characteristics of a watering-hole attack, as it involves file encryption on a database server.

Unauthorized attacker: An unauthorized attacker refers to an external individual or entity

attempting to gain unauthorized access to an organization's systems or data. In this scenario, the data was accessed by a domain user, suggesting that the access was not unauthorized from an external perspective.

While troubleshooting a firewall configuration, a technician determines that a "deny any" policy should be added to the bottom of the ACL. The technician updates the policy, but the new policy causes several company servers to become unreachable. Which of the following actions would prevent this issue?

• Documenting the new policy in a change request and submitting the request to change

  management

• Testing the policy in a non-production environment before enabling the policy in the production

  network

• Disabling any intrusion prevention signatures on the 'deny any' policy prior to enabling the new

  policy

• Including an 'allow any policy above the 'deny any' policy

Answer explanation

Testing the policy in a non-production environment allows the technician to assess its impact and

ensure that it does not inadvertently block legitimate traffic. This helps to identify and address any

potential issues or conflicts before implementing the policy in the production network, thereby

minimizing the risk of disrupting services or causing downtime.

Which of the following is the best way to secure an on-site data center against intrusion

from an insider?

• Bollards

• Access badge

• Motion sensor

• Video surveillance

Answer explanation

To secure an on-site data center against intrusion from an insider, the best measure is to use an access badge system. Access badges control who can enter restricted areas by verifying their identity and permissions, thereby preventing unauthorized access from insiders.

Access badge: Provides controlled and monitored access to restricted areas, ensuring that only authorized personnel can enter.

Bollards: Provide physical barriers to prevent vehicle access but do not prevent unauthorized personnel entry.

Motion sensor: Detects movement but does not control or restrict access.

Video surveillance: Monitors and records activity, but does not physically prevent intrusion.

A cyber operations team informs a security analyst about a new tactic malicious actors are

using to compromise networks. SIEM alerts have not yet been configured. Which of the following best describes what the security analyst should do to identify this behavior?

• Digital forensics

• E-discovery

• Incident response

• Threat hunting

Answer explanation

Threat hunting is the process of proactively searching for signs of malicious activity or compromise in

a network, rather than waiting for alerts or indicators of compromise (IOCs) to appear. Threat hunting can help identify new tactics, techniques, and procedures (TTPs) used by malicious actors, as well as uncover hidden or stealthy threats that may have evaded detection by security tools. Threat hunting requires a combination of skills, tools, and methodologies, such as hypothesis generation, data collection and analysis, threat intelligence, and incident response. Threat hunting can also help improve the security posture of an organization by providing feedback and recommendations for security improvements.

Here's a breakdown why the other options are less relevant:

Digital forensics: Digital forensics typically involves investigating a known incident to collect and analyze evidence. While it might be used later if a compromise is confirmed, it's not the initial approach for identifying the new tactic in this scenario.

E-discovery: E-discovery is a legal process for collecting and producing electronic evidence relevant to a legal case. It's not the primary focus for proactively identifying ongoing malicious activity.

Incident response: Incident response is a structured process for handling a confirmed security breach. While it might be triggered if the threat hunt identifies a successful compromise, it's not the initial step for proactive threat detection.

A security administrator is reissuing a former employee's laptop. Which of the following is

the best combination of data handling activities for the administrator to perform? (Choose two.)

• Data retention

• Certification

• Destruction

• Classification

• Sanitization

Answer explanation

The best combination of data handling activities for reissuing a former employee's laptop would be:

Sanitization and Destruction.

Explanation:

● Sanitization: This process involves securely erasing all data on the laptop to ensure that no sensitive or residual data

from the previous user can be recovered or accessed by the new user. This is crucial for maintaining data security

and privacy.

● Destruction: This term is often associated with the permanent removal of data, either by physically destroying

storage media or by securely erasing data in a way that it cannot be recovered. In the context of reissuing a laptop,

"destruction" might refer to securely wiping the storage medium to ensure that no remnants of the previous data

remain.

Other options:

● Data retention: Involves keeping data for a specified period, which is not relevant when reissuing a laptop that

should be wiped clean.

● Certification: Typically involves verifying that a system meets certain standards, which is not directly related to

preparing a laptop for reissue.

● Classification: Involves categorizing data based on its sensitivity, which is more relevant to data management than

preparing a laptop for reuse.

● Enumeration: Refers to identifying and listing resources (like files or directories), which is not directly related to the

secure handling of data when reissuing a device.

To improve the security at a data center, a security administrator implements a CCTV

system and posts several signs about the possibility of being filmed. Which of the following best

describe these types of controls? (Select two).

• Preventive

• Deterrent

• Corrective

• Directive

• Detective

Answer explanation

Explanation:

The CCTV system and signs about the possibility of being filmed serve as both deterrent and detective controls.

Deterrent controls: Aim to discourage potential attackers from attempting unauthorized actions.

Posting signs about CCTV serves as a deterrent by warning individuals that their actions are being monitored.

Detective controls: Identify and record unauthorized or suspicious activity. The CCTV system itself functions as a detective control by capturing and recording footage that can be reviewed later.

Preventive controls: Aim to prevent security incidents but are not directly addressed by the CCTV and signs in this context.

Corrective controls: Aim to correct or mitigate the impact of a security incident.

Directive controls: Provide guidelines or instructions but are not directly addressed by the CCTV and signs.

Compensating controls: Provide alternative measures to compensate for the absence or failure of primary controls.

A security administrator is deploying a DLP solution to prevent the exfiltration of sensitive

customer data. Which of the following should the administrator do first?

• Block access to cloud storage websites.

• Create a rule to block outgoing email attachments.

• Apply classifications to the data.

• Remove all user permissions from shares on the file server.

Answer explanation

Data classification is the process of assigning labels or tags to data based on its sensitivity, value, and risk. Data classification is the first step in a data loss prevention (DLP) solution, as it helps to identify what data needs to be protected and how. By applying classifications to the data, the security administrator can define appropriate policies and rules for the DLP solution to prevent the exfiltration of sensitive customer data.

A security administrator is configuring fileshares. The administrator removed the default permissions and added permissions for only users who will need to access the fileshares as part of their job duties. Which of the following best describes why the administrator performed these actions?

• Encryption standard compliance

• Data replication requirements

• Least privilege

• Access control monitoring

Answer explanation

The security administrator's actions of removing default permissions and adding permissions only for

users who need access as part of their job duties best describe the principle of least privilege.

This principle ensures that users are granted the minimum necessary access to perform their job

functions, reducing the risk of unauthorized access or data breaches.

Least privilege: Limits access rights for users to the bare minimum necessary for their job duties,

enhancing security by reducing potential attack surfaces.

Encryption standard compliance: Involves meeting encryption requirements, but it does not explain

the removal and assignment of specific permissions.

Data replication requirements: Focus on duplicating data across different systems for redundancy

and availability, not related to user permissions.

Access control monitoring: Involves tracking and reviewing access to resources, but the scenario is

about setting permissions, not monitoring them.

An organization's internet-facing website was compromised when an attacker exploited a buffer overflow. Which of the following should the organization deploy to best protect against similar attacks in the future?

• NGFW

• WAF

• TLS

• SD-WAN

Answer explanation

A buffer overflow is a type of software vulnerability that occurs when an application writes more data to a memory buffer than it can hold, causing the excess data to overwrite adjacent memory locations.

This can lead to unexpected behavior, such as crashes, errors, or code execution. A buffer overflow can be exploited by an attacker to inject malicious code or commands into the application, which can compromise the security and functionality of the system. An organization's internet-facing website

was compromised when an attacker exploited a buffer overflow. To best protect against similar attacks in the future, the organization should deploy a web application firewall (WAF). A WAF is a type of firewall that monitors and filters the traffic between a web application and the internet. A WAF can detect and block common web attacks, such as buffer overflows, SQL injections, cross-site scripting (XSS), and more. A WAF can also enforce security policies and rules, such as input validation, output encoding, and encryption. A WAF can provide a layer of protection for the web application, preventing attackers from exploiting its vulnerabilities and compromising its data.

NGFW (Next-Generation Firewall): While NGFWs provide advanced security features such as deep packet inspection, intrusion prevention, and application-level filtering, they are typically deployed at the network perimeter and focus on protecting against a wide range of network-based threats. While NGFWs may provide some protection against certain types of attacks targeting web applications, they are not specifically designed to defend against buffer overflow attacks and may not offer the same level of protection as a dedicated WAF.

TLS (Transport Layer Security): TLS is a cryptographic protocol used to secure

communication over the internet, providing encryption and authentication to protect data transmitted between clients and servers. While TLS helps to secure data in transit and prevent eavesdropping, it does not directly protect against buffer overflow attacks targeting web applications.

SD-WAN (Software-Defined Wide Area Network): SD-WAN is a technology used to optimize and manage wide area networks (WANs) by dynamically routing traffic based on application

requirements and network conditions. While SD-WAN can improve network performance and reliability, it is not specifically designed to protect against web application vulnerabilities or

buffer overflow attacks.

Which of the following is the most common data loss path for an air-gapped network?

• Bastion host

• Unsecured Bluetooth

• Unpatched OS

• Removable devices

Answer explanation

An air-gapped network is a network that is physically isolated from other networks, such as the internet, to prevent unauthorized access and data leakage. However, an air-gapped network can still be compromised by removable devices, such as USB drives, CDs, DVDs, or external hard drives, that are used to transfer data between the air-gapped network and other networks.

Removable devices can carry malware, spyware, or other malicious code that can infect the airgapped network or exfiltrate data from it. Therefore, removable devices are the most common data loss path for an air- gapped network.

Bastion host: A bastion host is a highly secured server located on a network perimeter that is specifically designed to withstand attacks. While a compromised bastion host could potentially lead to data loss, it's less likely to be a common data loss path in an air-gapped network where external connections are minimized or non-existent.

Unsecured Bluetooth: Bluetooth is a wireless communication technology that could pose security risks if left unsecured, allowing unauthorized devices to connect and potentially access data. However, in an air-gapped

network, Bluetooth is typically not used due to the network's isolation from external devices and networks.

Unpatched OS: An unpatched operating system (OS) could contain vulnerabilities that could be exploited by

attackers to gain unauthorized access to data. However, in an air-gapped network, the risk of exploitation through

unpatched OS vulnerabilities is reduced because the network is isolated from external threats and does not typically receive updates from external sources.