Pen used to do a practice exam.

Initial Quiz

Initial Quiz

  1. Your CEO has met with the CEO of another company, and they have agreed to work together to develop a new service. Authentication and identity management will be connected across the two organizations. Given the sensitivity of the development project, user authentication and authorization will use a centralized server running the best available trusted third-party service. Users will receive identity and service tokens from a unified authentication and authorization service, which requires that system clocks be synchronized across the organizations. Applications will be limited to those written with the API of that service. What do you need?
    1. BPA
    2. Federation
    3. Kerberos
    4. KDC
    5. NTP
    6. Kerberization
  2. Last week, Susan, a staff member in the Human Resources department, did a Google search and clicked on one of the links on the first page of results. That took her to a strange page. She went back, realized she had misspelled her search, corrected that, and found what she needed. Today she logged on to her bank site from work and noticed some mysterious transfers from her account to a bank in Eastern Europe. What has happened?
    1. Clickjacking
    2. Ransomware
    3. Crimeware
    4. Extortionware
    5. Spyware
  3. Management has decided that they want wireless security, but they don't have the resources to do key management and maintain certificates. What should they use?
    1. WEP
    2. WAP
    3. WPA
    4. WPA/2-E
    5. WPS
  4. Charlie, a network engineer, has been directed to set up network security that will require a device to authenticate itself onto the network and verify that patching and anti-virus signatures are updated, before allowing the user to try to authentication. What should Charlie use?
    1. 802.1i
    2. 802.1x
    3. 802.1q
    4. 802.11i
  5. The content management group is considering the use of DNS Round Robin technology. What benefit could this provide?
    1. Load balancing
    2. Transparent proxying
    3. Anti-spoofing
    4. Risk mitigating
  6. News reports tell of a major DDoS against a famous company. You receive a letter from your ISP saying that your home computer is sending malicious Linux-sourced traffic. But you don't own a Linux computer, in fact you don't own any computer. Your home electronics are limited to a smart TV with a Blu-ray player and a DVR. What has happened?
    1. Nothing, your ISP is wrong
    2. RAT
    3. BOT
    4. Trojan
  7. Liz is a security analyst for the IT department of a large university with a correspondingly large number of users. She has been investigating a sophisticated privilege escalation attack. She has determined that the attacker used an ordinary user account with a rather large user ID number. The attack changed that to a very low user ID number, associated with a highly privileged system account. Which of these did the attack utilize?
    1. Improper account configuration
    2. Memory leak
    3. Buffer overflow
    4. Integer overflow
    5. Race condition
  8. Management has decided to use geo-fencing to restrict mobile device operation to company premises. Which technology should you select?
    1. BYOD
    2. COPE
    3. CYOD
    4. BODE
  9. Users are reporting that they can't access the financial department's secure web page. The following command output is observed. What is wrong? 
    $ netstat -an
Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address          Foreign Address        (state)
tcp4       0      0 10.138.0.3.22          184.16.205.240.50966   ESTABLISHED
tcp4       0      0 127.0.0.1.9000         127.0.0.1.37632        TIME_WAIT
tcp4       0      0 127.0.0.1.11628        127.0.0.1.9000         TIME_WAIT
tcp4       0      0 127.0.0.1.12042        127.0.0.1.9000         TIME_WAIT
tcp4       0      0 10.138.0.3.80          130.15.4.209.46944     TIME_WAIT
tcp4       0      0 10.138.0.3.80          46.229.168.70.15234    TIME_WAIT
tcp4       0      0 10.138.0.3.80          173.187.65.22.50598    ESTABLISHED
tcp4       0      0 10.138.0.3.80          212.3.84.1.55989       ESTABLISHED
tcp4       0      0 10.138.0.3.80          212.3.84.1.55987       ESTABLISHED
tcp4       0      0 10.138.0.3.80          212.3.84.1.55988       TIME_WAIT
tcp4       0      0 10.138.0.3.80          212.3.84.1.55986       TIME_WAIT
tcp4       0      0 *.80                   *.*                    LISTEN
tcp4       0      0 127.0.0.1.9000         *.*                    LISTEN
tcp4       0      0 *.22                   *.*                    LISTEN
tcp4       0      0 127.0.0.1.25           *.*                    LISTEN
udp4       0      0 127.0.0.1.123          *.*                    
udp4       0      0 10.138.0.3.123         *.*                    
udp4       0      0 *.123                  *.*                    
udp4       0      0 *.514                  *.*
    1. The web server is down
    2. The server is up but its web service isn't running
    3. The certificate is expired
    4. The certificate has been revoked
    5. HTTPS isn't enabled
    6. A firewall is blocking connections
  10. Your company operates in multiple geographic regions and countries, requiring regulatory compliance with multiple sets of laws. The regulations vary, but all focus on protecting personal privacy. Management has decided to use technology that protects sensitive data through the difficulty of calculating certain attributes of elliptical shapes. The mathematics would allow you to quantify the degree of security. What do you need to investigate?
    1. AES-256
    2. EF
    3. DHE
    4. ECC
  11. Jenny can unlock her work mobile phone by drawing a pattern on the screen with her finger. This mode of authentication verifies:
    1. Something you know
    2. Something you have
    3. Something you are
    4. Something you do
    5. Somewhere you are
  12. Dmitri's company wants to establish SSO. The initial analysis concluded that they need a system that handles both authentication and authorization with tokens. Dmitri has concluded that the protocol used by Facebook and LinkedIn is the most promising. He is favoring:
    1. SAML
    2. OAUTH
    3. OpenID
    4. WS-Federation
    5. Shibboleth
  13. Which of these can you put in a boot script to prevent MitM?
    1. nmap -sS -sV -T5 192.168.12.72
    2. arp -s 00:13:3B;12:6f:aa 192.168.12.72
    3. tcpdump -i eth0 host 192.168.12.72 or ether host 00:13:3b:12:6f:aa
    4. netstat -an
    5. ping 192.168.12.72
  14. The company's software development, customer service, and order processing operations are based at three separate facilities. Top management has determined that if there were a massive outage at the sales site, the customer service facility would best be able to assist sales operations. Which of these are they advocating?
    1. Tabletop exercises
    2. Walk-through exercises
    3. Failover
    4. Alternate processing sites
    5. Alternate business practices
  15. Charlotte is in charge of VPN access to the data analysis facility. She has read that it is helpful to pad a secret with a short text value before encrypting it. What concept is she considering?
    1. Salt
    2. Nonce
    3. Hash
    4. PBKDF2

Answers to initial quiz

To the Cybersecurity Page