Cram

Practice2

1. 01

   A SOC team wants to tailor an operating system into a lean security-analysis platform, adding only the packages it needs. Which property of Linux makes this possible?

   →It is open source

2. 02

   Why is the Linux CLI valued by SOC analysts even though a GUI makes many tasks easier?

   →It is powerful and works remotely

Practice3

1. 01

   An admin must restart a server and kick out all currently connected users. Which command can do both?

   →shutdown

2. 02

   An admin connected over SSH must edit a firewall rules file on a remote server that offers no graphical interface. What kind of tool does she need?

   →A command-line text editor

3. 03

   Linux treats memory, disks, directories and the monitor as files. From the OS standpoint, what does showing information on the display mean?

   →Writing to the display's file

Practice4

1. 01

   An admin edits a service's configuration file and saves it, but the service behaves as before. What is usually needed?

   →Restart the service

2. 02

   A new Linux server has several services enabled by default for historical reasons that are no longer required. What hardening step fits?

   →Stop them and block autostart

3. 03

   How does the course categorize Linux log files?

   →Application, event, service, system

4. 04

   On a Debian server, where are the MySQL debug, failure and success messages logged?

   →/var/log/mysql.log

Practice3

1. 01

   The mount command shows /dev/sda1 on / type ext4. What does the / represent?

   →The root file system

2. 02

   In the listing -rwxrw-r-- 1 analyst staff 253 May 20 12:49 space.txt, what does the 1 after the permissions show?

   →Number of hard links

3. 03

   Which command creates a hard link named space.hard.txt to the existing file space.txt?

   →ln space.txt space.hard.txt

Practice1

1. 01

   A remote user connects over the network and starts a graphical application on a Linux server running X. Where does the application run?

   →On the server

Practice5

1. 01

   On Arch Linux, which command installs a package by name?

   →pacman -S

2. 02

   Which Arch Linux command does the same job as apt-get update on Debian?

   →pacman -Syy

3. 03

   A regular user can list everyone's processes with ps. What is needed to kill another user's process?

   →Root privileges

4. 04

   An attacker runs telnet 209.165.200.224 80 and the reply includes Server: nginx/1.12.0. What is the attacker's likely next step?

   →Research nginx 1.12.0 flaws

5. 05

   After mounting a compromised drive from a trusted live CD, which set of methods can be used to inspect it for a rootkit?

   →Behavioral, signature, difference, memory dump

Practice9

1. 01

   A technician needs several antimalware programs to clean an infected PC completely. How should she run them?

   →One program at a time

2. 02

   Software that may not be malicious but breaks security policy and can interfere with the organisation's software or network services.

   →Unapproved software

3. 03

   What does HIPS stand for?

   →Host-based Intrusion Prevention System

4. 04

   What does EDR stand for?

   →Endpoint Detection and Response

5. 05

   What does DLP stand for?

   →Data Loss Prevention

6. 06

   What does NGFW stand for?

   →Next-Generation Firewall

7. 07

   Encryption of the entire contents of a drive, including temporary files and memory, which Windows provides through BitLocker.

   →Full disk encryption

8. 08

   The Apple component that protects low-level hardware and lets only genuine, unaltered Apple OS software run.

   →Boot ROM

9. 09

   An Apple tool that removes existing malware infections when Apple updates detection rules, and checks for infections at restart and login.

   →Malware Removal Tool

Practice1

1. 01

   A company wants independent, high-quality reviews before choosing a host-based security suite. Which organisation provides them?

   →AV-TEST

Practice4

1. 01

   An analyst is inspecting a host-based firewall log and is overwhelmed by DNS lookups and other routine events. What should she do?

   →Filter and parse the logs

2. 02

   Host-based firewalls whose rules are managed centrally instead of one machine at a time.

   →Distributed firewall

3. 03

   A trait of some malware families where attackers create variations that change the signature just enough to evade detection.

   →Polymorphism

4. 04

   Security staff complain their anomaly-based HIDS raises many alerts that turn out to be harmless. Why does this happen?

   →Non-malware changes alter behaviour

Practice4

1. 01

   What does BYOD, one of the trends expanding the attack surface, stand for?

   →Bring Your Own Device

2. 02

   A small business wants a free, ready-made blocklist service instead of building its own. Which example does the course name?

   →The Spamhaus Project

3. 03

   Cisco AMP has rolled back network events to get a copy of a suspicious download. Where should the file go next?

   →Into a sandbox such as Threat Grid

4. 04

   An online sandbox with rich interactive reports that captures screenshots of the malware and maps its tactics to the MITRE ATT&CK Matrix.

   →ANY.RUN

Practice5

1. 01

   Encrypting copyrighted music, films and books so they cannot be copied without a key that only licensed parties receive.

   →Digital rights management

2. 02

   Sensitive information that may belong to a government body and is considered secret, confidential or restricted access.

   →Classified information

3. 03

   Analysts watch event logs, system alerts and access logs in real time so they can spot an attack within seconds. Which availability measure is this?

   →Activity monitoring

4. 04

   The security team practises response protocols and restoring critical systems, and staff and customers know how to respond to a disaster. Which availability measure is this?

   →Disaster planning

5. 05

   An administrator restores files from last week's backup just to confirm the data could be recovered after a loss. Which availability measure is this?

   →Backup testing

Practice8

1. 01

   Combining multiple hard drives in an array so the operating system sees them as a single disk, improving performance and fault tolerance.

   →RAID

2. 02

   Remote storage that uses space at a data center provider and is reachable from any computer with Internet access, usually by subscription.

   →Cloud storage

3. 03

   An organisation moves its data from direct-attached storage to RAID, SAN and NAS. Which challenge does it now take on?

   →Configuring, testing and monitoring the system

4. 04

   To boost security and decrease data loss, what should an organisation do about direct-attached storage devices?

   →Limit the types of data stored on them

5. 05

   Networks using copper and fibre optic media that can serve a LAN or span great distances as a WAN.

   →Wired networks

6. 06

   Which standard protocols define the structure and format of data packets, and are open source and fully available to the public?

   →IP and HTTP

7. 07

   A report prints with jumbled columns because the wrong data delimiters were used. In which stage of data in process did the corruption happen?

   →Output

8. 08

   A disconnected, malfunctioning sensor keeps feeding bad readings into a monitoring database. In which stage of data in process is integrity lost?

   →Input

Practice5

1. 01

   A data centre installs fingerprint and iris scanners to confirm the identity of anyone trying to reach its servers. Which safeguard is this?

   →Hardware-based access control

2. 02

   A manager suggests running security awareness training once and then stopping. Why is that not enough?

   →New threats and techniques keep emerging

3. 03

   Which of these is a recommended way to build a culture of security awareness in an organisation?

   →Make it part of onboarding

4. 04

   Organisations establish standards because of which of the most important security principles?

   →Consistency

5. 05

   A document lists the specific websites, newsgroups and bandwidth-intensive applications users may not access on company computers. Which policy component is this?

   →Acceptable use policy

Practice10

1. 01

   In a bank's e-banking threat list, an attacker uses the exposed e-banking servers to break into an internal bank system. Which identified threat is this?

   →Internal system compromise

2. 02

   A bank employee finds a flaw in the e-banking system and uses it to mount an attack. Which identified threat is this?

   →Insider attack on the system

3. 03

   An attacker alters the code of the e-banking application and makes transactions by impersonating a legitimate user. Which identified threat is this?

   →Phony transactions from an external server

4. 04

   A bank customer types the wrong account number and submits an incorrect transfer request. Which identified e-banking threat does this fall under?

   →Data input errors

5. 05

   IT checks in a new delivery of laptops that was bought after usage data justified the purchase, and adds them to the inventory. Which lifecycle stage is this?

   →Procurement

6. 06

   Staff upgrade the memory and modify the configuration of some ageing workstations to keep them productive for another two years. Which lifecycle stage is this?

   →Maintenance

7. 07

   A model for borderless networks where the attacker only needs to pull off certain pieces, each of which protects but also offers a path toward the most confidential data.

   →Security artichoke

8. 08

   A company's staff mostly work from phones and cloud apps with no clear network edge. An attacker compromises one phone and uses it to reach more data without breaking through any other layer. Which model describes this?

   →Security artichoke

9. 09

   A defense strategy that builds a barrier of several protections, ideally each harder to beat than the last, such as a password-protected server inside a locked building behind a fence.

   →Layering

10. 10

    The defense strategy which holds that complexity does not guarantee security, and that a solution should be simple on the inside but complex on the outside.

    →Simplicity

Practice1

1. 01

   The settings configured for a system that form the template for all similar systems, such as the required applications for every workstation the organisation deploys.

   →Baseline configuration

Practice5

1. 01

   Increased productivity, reduced IT and operating costs, better mobility for employees and greater appeal for hiring are benefits of which program?

   →BYOD

2. 02

   A firm lets staff read company email on their own phones. IT wants security settings and software configurations pushed to every phone on the network from one console. Which tool should it use?

   →MDM software

3. 03

   A policy written and maintained by HR covering salary, pay schedule, benefits and vacations that new hires review and sign.

   →Employee policy

4. 04

   A constantly evolving document, much like a continuity plan, that sets security objectives, defines rules of behaviour for users and administrators, and specifies system requirements.

   →Security policy

5. 05

   What does INFOSEC stand for?

   →Information Systems Security

Practice3

1. 01

   A security team is choosing a biometric system and lists speed, acceptability, reliability and enrolment time. Which factor does the course call the most important?

   →Accuracy

2. 02

   In a card reader system, an employee swipes an access badge. What happens next?

   →The reader reads a number on the badge

3. 03

   A data center needs access control that can judge unusual situations and respond instantly on the spot. Which control fits best?

   →Security guards

Practice4

1. 01

   Attackers modify the confirmation links in a newsletter's sign-up emails and script the process to flood the database with thousands of bogus subscribers. What kind of attack is this?

   →Automated input attack

2. 02

   A system multiplies the first nine digits of an ISBN by 10 down to 2, adds the results and computes the number needed to reach a multiple of 11. Which validation criterion is this?

   →Check digit

3. 03

   Two staff open the same record. The first can edit it, but the second only gets a read-only version until the first finishes. What practice is this?

   →Version control

4. 04

   An organisation sees repeated unauthorised access to its systems. Which countermeasures does the course recommend?

   →Use MFA and monitor log files

Practice1

1. 01

   A finance lead needs to transfer a customer payment file securely to a colleague's remote system. Which protocol fits?

   →SCP

Practice1

1. 01

   An administrator finds unauthorised network probing and port scanning on the LAN. Which countermeasure matches this threat?

   →Run post-configuration penetration tests

Practice2

1. 01

   Of the ways a smartphone can communicate, such as Wi-Fi, Bluetooth, NFC, IR and USB, which one is wired?

   →USB

2. 02

   An employee's company phone is stolen on a train. What lets the organisation delete the data on it?

   →Remote wiping

Practice3

1. 01

   PCs on a network use 192.0.2.100 as their gateway. The forwarding router fails and the standby router takes over, yet the PCs stay online. Why?

   →They use the virtual router IP address

2. 02

   Staff keep falling for callers who pretend to be IT support. Which physical facility countermeasure addresses this social engineering threat?

   →Regular security awareness training

3. 03

   Laptops keep going missing from an office. Which physical facility countermeasure matches this threat?

   →An asset tagging system

Practice4

1. 01

   A team deploys Raspberry Pi based sensors and notes they have poor authentication and cannot be patched. What does the course say must therefore be accepted?

   →A level of implied trust

2. 02

   An intrusion detection system is added to a VoIP network. Which attack does the course say it helps detect?

   →ARP poisoning

3. 03

   A car maker wants to protect in-vehicle systems against unauthorised tracking, wireless jamming and spoofing. Which countermeasure is recommended?

   →Encrypt communication between controllers

4. 04

   A plant operator worries that a worm like Stuxnet could reach the industrial controllers from the office LAN. What is the recommended prevention?

   →Segregate the SCADA network from the LAN

Practice10

1. 01

   A user logs on to the corporate network successfully but gets an error when trying to use the high-speed colour printer. Which AAA service has stopped her?

   →Authorization

2. 02

   An auditor sees a log entry that says user student accessed host server XYZ using SSH for 15 minutes. Which AAA service produced it?

   →Accounting

3. 03

   A user wants one password for every system so it is easy to remember. What is the main risk the course warns about?

   →One cracked password opens every account

4. 04

   An entry system that staggers the flow of people into a secured area and traps unwanted visitors, usually a two-door vestibule holding one person at a time.

   →Mantrap

5. 05

   An allowed threshold for errors, such as failed logins, before a red flag is raised.

   →Clipping level

6. 06

   The AAA service that tracks what users access, how long they use it and any changes they make. It is not financial bookkeeping.

   →Accounting

7. 07

   The control that enforces the rules set by the authorization policy, using a unique identifier such as a username so the system can tell each user apart.

   →Identification

8. 08

   A credit-card-sized plastic card with an embedded chip that processes, stores and safeguards data such as digital signatures, used as something you have.

   →Smart card

9. 09

   An authorization policy that grants access based on an employee's position within the organization.

   →Authority-level policy

10. 10

    Tracing an action back to the person or process that made a change to a system, then collecting and reporting that usage data for auditing or billing.

    →Accountability

Practice2

1. 01

   A device fails the security checks when it joins the network, and the system blocks, isolates or repairs it automatically. What kind of system is doing this?

   →Network access control

2. 02

   The zero trust pillar concerned with applications in the cloud and data centers, such as an API, microservice or container accessing a database.

   →Workloads

Practice3

1. 01

   A Windows local policy that creates a security log tracking events such as account logons, object access, policy changes and privilege use.

   →Audit policy

2. 02

   An authentication protocol where the client's password is sent as a hash and only the authentication server needs a certificate.

   →EAP

3. 03

   A standard in which an organization authenticates your identity and authorizes network access, with credentials or a certificate confirmed by a RADIUS server.

   →802.1x

Practice2

1. 01

   A security team wants accounting records from every router and switch kept in one place so auditing user actions is simpler. Which setup gives this?

   →Centralized AAA

2. 02

   What does LDAP stand for, a directory a centralized AAA server can use for user authentication and group membership?

   →Lightweight Directory Access Protocol

Practice4

1. 01

   Comparing each packet against ordered entries using Layer 3 and Layer 4 header information to decide whether to forward or drop it.

   →Packet filtering

2. 02

   Corporate policy says voice traffic must be forwarded as fast as possible to avoid interruption. Which ACL task does this describe?

   →Provide priority to traffic classes

3. 03

   Policy demands that access to the Human Resources network be restricted to authorized users only. Which ACL task does this describe?

   →Basic security for network access

4. 04

   What does QoS stand for, used with ACLs to identify voice traffic and forward it first?

   →Quality of Service

Practice1

1. 01

   One ACE in ACL 10 must permit only networks 192.168.10.0/24 and 192.168.11.0/24. Which address and wildcard pair fits?

   →192.168.10.0 0.0.1.255

Practice3

1. 01

   Before configuring a complex ACL with many ACEs, what does the course recommend doing first?

   →Write the policy in a text editor

2. 02

   An admin creates one named ACL called Web and later another called WEB. How does the router treat them?

   →As two different ACLs

3. 03

   The named ACL BROWSING permits tcp any 192.168.10.0 0.0.0.255 established so web replies reach inside hosts. How is it applied on R1 G0/0/0?

   →ip access-group BROWSING out

Practice1

1. 01

   An editing approach that deletes one faulty line by its ID shown in show access-lists, then re-enters it under that same ID.

   →Sequence number method

Practice4

1. 01

   An administrator wants only the PC at 192.168.10.10 to open Telnet or SSH sessions to the router itself. Which configuration fits?

   →access-class on vty lines

2. 02

   The ACL placement factor that asks whether the organization controls both the source and the destination networks.

   →Extent of organizational control

3. 03

   Priya places a standard ACL on the router right next to the subnet she wants to restrict, intending to block it from one server only. What goes wrong?

   →Subnet is blocked everywhere

4. 04

   Company A wants to block Telnet and FTP from its 192.168.11.0/24 LAN to Company B, but does not control Company B's router. Where should the extended ACL go on R1?

   →G0/0/1 inbound, on the LAN side

Practice2

1. 01

   R1 G0/0 connects to the 192.168.1.0/24 LAN. To stop spoofed packets from the inside, what should its inbound ACL permit?

   →Only sources in 192.168.1.0/24

2. 02

   A firewall ACL should explicitly permit only the services outside users need from a company server. Which services does the course name as often allowed?

   →DNS, SMTP and FTP

Practice2

1. 01

   What does RA stand for in rogue IPv6 RAs that make dual-stack hosts obtain an IPv6 address?

   →Router Advertisement

2. 02

   In the IPv6 ACL keyword nd-ns, what does NS stand for?

   →Neighbor Solicitation

Practice17

1. 01

   RSA key setup: p = 5, q = 11. What is φ(n)?

   →40

2. 02

   RSA with p = 5, q = 11 and public exponent e = 3. What is the private exponent d?

   →27

3. 03

   RSA public key (e, n) = (3, 55). Encrypt the message M = 9.

   →14

4. 04

   RSA private key (d, n) = (27, 55). The ciphertext C = 14 arrives. What message does decryption recover?

   →9

5. 05

   With p = 5, q = 11 and e = 3, a student solves 3 × d mod 55 = 1 and gets d = 37. What went wrong?

   →Used n instead of φ(n)

6. 06

   An RSA key has φ(n) = 40. Which of these is a valid public exponent e?

   →7

7. 07

   RSA with p = 7, q = 13 and e = 5. What is the private exponent d?

   →29

8. 08

   An RSA key pair is (3, 33) public and (7, 33) private. Bob signs M = 4 with his private key. What signature does he send?

   →16

9. 09

   Bob wants every reader to be sure a message really came from him. Which key does he encrypt it with?

   →Bob's private key

10. 10

    A message decrypts correctly with Alice's public key. What does that prove?

    →Alice sent it

11. 11

    Diffie-Hellman with p = 17, g = 3. Alice's private value is a = 4. What is her public value A?

    →13

12. 12

    Diffie-Hellman with p = 17, g = 3, a = 4, b = 6, so A = 13 and B = 15. What is the shared key?

    →16

13. 13

    Diffie-Hellman with p = 13. Alice's private value is a = 5 and she receives B = 11 from Bob. What shared key does she compute?

    →7

14. 14

    An attacker records an entire Diffie-Hellman exchange. Which values has the attacker seen?

    →p, g, A and B

15. 15

    Mallory sits between Alice and Bob and runs one Diffie-Hellman exchange with each of them. Why does plain DH not stop this?

    →DH does not authenticate either party

16. 16

    A colleague says the VPN is secure because Diffie-Hellman encrypts all its data. What is the correct view?

    →DH only creates the key; another cipher encrypts data

17. 17

    Alice wants only Bob to read her message and also wants Bob to know it came from her unchanged. What should she send?

    →Message under Bob's public key, hash under her private key

Practice1

1. 01

   Malware on an infected host talks to its command and control server over TLS, and the firewall cannot see the commands. How can this traffic be detected?

   →Decrypt it and compare with attack signatures