Add the required firewall rule to allow the
server administrator to securely work on the
web server's configuration.
Source
Destination
Protocol
Port
Action
192.168.1.0/24
10.1.2.33
TCP
80
Pass
Any
Any
Any
Any
Block
On the real test, these might be objects you can
drag and drop in place in the grey slots above.
Or maybe each empty line will be a drop-down
menu with the below choices.
192.168.1.0/24
10.1.2.0/24
TCP
22
Pass
192.168.1.44/32
10.1.2.33/32
TCP
22
Pass
192.168.1.0/24
10.1.2.0/24
TCP
443
Pass
192.168.1.44/32
10.1.2.33/32
TCP
443
Pass
Examine this network map.
Add the two required firewall rules to allow the
user workstations to query the primary DNS server,
and also allow the secondary DNS server to synchronize
with the primary.
Source
Destination
Protocol
Port
Action
192.168.1.0/24
10.1.2.33/32
TCP
80
Pass
Any
Any
Any
Any
Block
On the real test, these might be objects you can
drag and drop in place in the grey slots above.
Or maybe each empty line will be a drop-down
menu with the below choices.
192.168.1.0/24
10.1.2.66/32
TCP
80
Pass
192.168.1.0/24
10.1.2.66/32
TCP
53
Pass
192.168.1.0/24
10.1.2.66/32
UDP
53
Pass
192.168.1.200/32
10.1.2.66/32
UDP
53
Pass
192.168.1.200/32
10.1.2.66/32
TCP
80
Pass
192.168.1.200/32
10.1.2.66/32
TCP
53
Pass
Suheb, the IT department manager, needs to be able to assess
organizational security at any time, and identify issues
before they become big problems.
Which should he use?
Monthly audits
Continuous monitoring
Continuous improvement
Baseline analysis
Chuck, a network engineer, needs to compartmentalize traffic
flow on the Intranet, and authenticate each connected
endpoint device.
What should he use?
Select two.
NAC
DLP
802.3
VLAN
Akio, a systems engineer, needs to implement a technical
defense that verifies the validity of the operating system
itself before booting the system.
He hopes this will solve the problem of root kits and other
kernel modification.
What should he use?
Anti-malware scanning
BIOS checks
UEFI
Trusted supply chain
Philip, a system administrator, has been asked for
recommendations for protecting compute servers
in the data center.
Which should he suggest?
Select three.
FM-200
Biometrics
DLP
Remote wipe
Mantrap
GPS tracking
Your company is being targeted by numerous
spearphishing attempts.
Which defense do you recommend?
Security awareness training
Pop-up blocker
Spam filter
Mail application-layer firewall
Network intrusion prevention system
You observe this command output.
Server: 192.168.1.3
Address: 192.168.1.3#53
** server can't find www.faasdfjh.com: NXDOMAIN
Which of these are appropriate defenses for a mobile device?
Select three.
Remote wipe
Cable lock
FM-200
Biometrics
GPS tracking
Transparent proxy
Tony, a network engineer, has been tasked by his manager with
monitoring the more sensitive internal networks, to spot
and block attacks.
What should Tony use?
SIEM
HIDS
HIPS
NIDS
NIPS
Yoyodyne Corporation plans to use Active Directory
for single sign-on throughout the enterprise.
Which network protocols must be added to the ALLOW
list in all internal router ACLs?
Select two.
LDAP
LDAPS
Kerberos
X.500
Dmitri's company wants to establish SSO.
The initial analysis concluded that they need a system
that handles both authentication and authorization with tokens.
Dmitri has concluded that the protocol used by Facebook and
LinkedIn is the most promising.
He is favoring:
SAML
OAUTH
OpenID
WS-Federation
Shibboleth
Pedro's manager has been given a recommendation that they
implement a single-sign on solution in which user sessions
will have cryptographic software tokens providing
their identity,
their authorization to use services,
and the cryptographic keys used to secure their communication.
What should Pedro recommend?
Kerberos
RADIUS
SAML
VPN
Mikhail, a system administrator, has been asked by Kelli,
a database administrator, to create an account for the new
database project.
The account should require authenticated access,
have auditing enable,
but incapable of interaction,
with credentials that rarely if ever change.
What type of account should Mikhail create?
Ordinary user
Privileged user
Administrator
Guest
Service
Management
Which password policy setting would require a user to
include both digits and special characters in their
password?
Prohibiting dictionary words
Length
Complexity
Maximum age
Minimum age
Expiration
Length
A military contractor is very worried about physical intrusion.
They need to keep unauthorized individuals out of sensitive
areas.
Inappropriately allowing an unauthorized individuals into
an area is classified as which of the following:
False Acceptance
False Rejection
False Positive
False Negative
Fail Open
Fail Closed
Which of these is an open-source standards-based solution
for single sign-on web authentication, based largely on SAML?
OAUTH
OpenID
EAP-TLS
Shibboleth
WS-Federation
Mutual authentication involves which two?
Select two.
192.168.1.4 at dc:a6:32:36:a9:4e [ether] on enp9s0
192.168.1.218 at b8:27:eb:1f:f6:87 [ether] on enp9s0
192.168.1.20 at b8:27:eb:03:6b:37 [ether] on enp9s0
192.168.1.205 at b8:27:eb:f9:ea:4d [ether] on enp9s0
192.168.1.7 at b8:27:eb:95:25:5b [ether] on enp9s0
192.168.1.40 at 00:12:79:df:81:b1 [ether] on enp9s0
192.168.1.254 at 38:94:ed:fa:48:88 [ether] on enp9s0
192.168.1.42 at 00:1c:50:ac:72:1e [ether] on enp9s0
192.168.1.3 at dc:a6:32:36:a9:4e [ether] on enp9s0
;; connection timed out; no servers could be reached
What is wrong?
DNS cache poisoning has happened
Your workstation cannot contact the nameserver
The domain does not exist
There is no host with the requested name
Which of these can you put in a boot script to
prevent MitM?
nmap -sS -sV -T5 192.168.12.72
arp -s 00:13:3B:12:6f:aa 192.168.12.72
tcpdump -i eth0 host 192.168.12.72 or ether host 00:13:3b:12:6f:aa
netstat -an
ping 192.168.12.72
Which of these are advantages of WPA/2 Enterprise
over WPA/2 PSK?
Select two.
PKI
Stronger cipher suite
Higher performance
Integrated Active Directory
RADIUS
Tasha, a network engineer, is designing a wireless solution
for her large corporation.
She needs to specify the current best encryption,
supporting 802.1x with either LEAP or EAP-TLS.
What should she use?
Select three.
CCMP
AES-GCM-256
WPA/2 PSK
WPA/2 Enterprise
RADIUS
Active Directory
Isaac is a cybersecurity architect for a financial services
company.
He has been tasked with securing key escrow.
The escrow storage is extremely sensitive.
What should he use to implement trustworthy key escrow?
Asymmetric encryption
M-of-N control
Certificate chaining
Off-site storage
Ellen is a webmaster for a major high technology company.
She will use virtual hosting to provide six web sites
with unique domain names on a single server: weyland-yutani.com www.weyland-yutani.com weyland-yutani.net www.weyland-yutani.net weyland-yutani.org www.weyland-yutani.org
That is, the same corporation name in three top-level domains,
both with and without leading "www.".
What would be the most economic way to obtain certificates?
Self-signed certificates
Wildcard certificates
Server Alternative Names
Six individual certificates
Which of the following is not needed to enable any user
to encrypt a message which only the intended recipient
can read?
PKI
Public keys
Private keys
Hashing
Lee is a security analyst at a software development company.
Their data is worth far more than the hardware on which it
is stored, and confidentiality is protected with strong
encryption.
However, management is also concerned about availability.
Lee has been tasked with providing availability of cleartext
versions of encrypted software, even if an employee
loses or destroys their decryption key.
What should be set up?
Escrow
Secret sharing
Certificate chaining
Key pinning
Key stapling
Charlize, a data archivist for a government agency, needs
to protect the confidentiality of a large data set.
A government regulation requires the use of the
Advanced Encryption Standard for this category of data.
But in which mode should she employ that cipher?
CBC
CCMP
ECB
GCM
Gary works for a bank, and is designing a wireless solution
for customers to use during their visits to bank branches.
Which two technologies should he deploy?
Select two.
