Attempt 5
Question 1: Incorrect

We have removed a server from our production environment. We format the hard drives, install a new OS, and application on the disks. We then put the newly installed server back into production. Which of these would be TRUE about the original data a week later?


We can still recover files that has not been overwritten yet, formatting just removes the file structure.
Question 2: Skipped

We are asked to help design the policies for our organization in regarding to PHI. What is that?


PHI is the abbreviation for Personal Health Information.
Question 3: Correct

We are using the CIA triad to, at a high level, explain IT security to our board of directors. Which of these are the 3 legs of the CIA triad?


The CIA (Confidentiality, Integrity, Availability) Triad: Confidentiality – We keep our data and secrets secret. Integrity – We ensure the data has not been altered. Availability – We ensure authorized people can access the data they need, when they need to.
Question 4: Incorrect

In our data management, which of these BEST describe the data owner responsibilities?


Data/Information Owner: Management level, they assign sensitivity labels and backup frequency. This could be you or a Data Owner from HR, Payroll or other departments.
Question 5: Correct

What would we use a Security Information and Event Management (SIEM) system for?


SIEM (Security Information and Event Management) provides real-time analysis of security alerts generated by network hardware and applications.
Question 6: Correct

Jane is using the Scrum project management methodology. Which of these would be some of the core team roles in the Scrum framework? (Select all that apply).


Scrum is a framework for managing software development. Scrum is designed for teams of approximately 10 individuals, and generally relies on two-week development cycles, called “sprints”, as well as short daily stand-up meetings. The three core roles in the Scrum framework. The product owner: Representing the product’s stakeholders, the voice of the customer, and is accountable for ensuring that the team delivers value to the business. Development team: Responsible for delivering the product at the end of each sprint (sprint goal). The team is made up of 3–9 individuals who do the actual work (analysis, design, develop, test, technical communication, document, etc.). Scrum master: Facilitates and accountable for removing impediments to the ability of the team to deliver the product goals and deliverables. Not a traditional team lead or project manager but acts as a buffer between the team and any distracting influences. The scrum master ensures that the Scrum framework is followed.
Question 7: Skipped

As part of our backup solution we use our retention policy to decide how long we should keep our backups. What should we base that decision on?


Data Retention: Data should not be kept beyond the period of usefulness or beyond the legal requirements (whichever is greater).
Question 8: Correct

When an attacker is using intimidation, it is a form of what?


Social engineering uses people skills to bypass security controls. Intimidation (If you don’t bad thing happens) – Virus on the network, credit card compromised, lawsuit against your company, intimidation is most effective with impersonation and vishing attacks.
Question 9: Correct

Which organization is responsible for delegating IP address ranges to ISPs in North America?


The world is divided into RIR (Regional Internet Registry) regions and organizations in those areas delegate the address space they have control over. ARIN (American Registry for Internet Numbers): United States, Canada, several parts of the Caribbean region, and Antarctica.
Question 10: Skipped

Which layer of the Open Systems Interconnect (OSI) model isolates traffic into broadcast domains?


Layer 3: Network Layer: Expands to many different nodes (IP) – The Internet is IP based. Isolates traffic into broadcast domains.
Question 11: Correct

Which of these hackers would you hire to do penetration testing?


White Hat hackers: Professional Pen Testers trying to find flaws so we can fix it (Ethical Hackers). Black Hat hackers: Malicious hackers, trying to find flaws to exploit them (Crackers – they crack the code). Gray/Grey Hat hackers: They are somewhere between the white and black hats, they go looking for vulnerable code, systems or products. They often just publicize the vulnerability (which can lead to black hats using it before a patch is developed). Gray hats sometimes also approach the company with the vulnerability and ask them to fix it and if nothing happens they publish. Script Kiddies: They have little or no coding knowledge, but many sophisticated hacking tools are available and easy to use. They pose a very real threat. They are just as dangerous as skilled hackers; they often have no clue what they are doing.
Question 12: Incorrect

Which type of software development uses programming pairs?


XP (Extreme programming) uses programming in pairs or doing extensive code review. Intended to improve software quality and responsiveness to changing customer requirements. Uses advocates frequent releases in short development cycles, intended to improve productivity and introduce checkpoints at which new customer requirements can be adopted.
Question 13: Correct

Which type of Intrusion Prevention System (IPS) response prevents authorized traffic?


False Positive: Normal traffic and the system detects it and acts.
Question 14: Correct

As part of improving the security posture of our organization we have added multifactor authentication. Which of these pairs does NOT constitute multifactor authentication?


Multifactor authentication uses authentication from more than one factor (something you know, are or have). Passwords and usernames are not multifactor, they are both knowledge factors.
Question 15: Correct

For access control management, which of these is considered something you have?


Things in your possession, not things you know (knowledge factor) or something you are (biometrics).
Question 16: Correct

Which of these is a TRUE statement about the TCP protocol?


TCP (Transmission Control Protocol): Reliable, Connection oriented, Guaranteed delivery, 3 way handshake, slower/more overhead, data reassembled.
Question 17: Incorrect

When we implement centralized logging, we want it to be:


Centralized Logging: Should be automated, secure and even administrators should have limited access.
Question 18: Correct

What is your public key in asymmetric encryption?


Asymmetric Encryption uses 2 keys: a Public Key and a Private Key (Key Pair). Your Public Key is publicly available. Used by others to encrypt messages sent to you. Since the key is asymmetric, the ciphertext can’t be decrypted with your public Key. Your Private Key – You keep this safe. You use it to decrypt messages sent with your public key.
Question 19: Correct

We have a contract with some penetration testers. In which phase would the tester look for vulnerabilities and design the attack?


Discovery (planning): Finding the vulnerabilities, design the attacks.
Question 20: Correct

You hear a colleague talk about polyinstantiation. What does that mean?


Polyinstantiation  (Alternative Facts) – Two (or more) instances of the same file depending on who accesses it. The real information may be available to subjects with Top Secret clearance, but different information will be available to staff with Secret or lower clearance.
Question 21: Correct

When someone is typosquatting, what are they doing?


Typosquatting – Buying an URL that is VERY close to real website name (Can be illegal in certain circumstances).
Question 22: Incorrect

Senior leadership has approved the use of flash drives. Which type of memory do they use?


Flash Memory: Small portable drives (USB sticks are an example); they are a type of EEPROM.
Question 23: Skipped

When we talk about referential databases, what does referential integrity mean?


Referential integrity: When every foreign key in a secondary table matches a primary key in the parent table. It is broken if not all foreign keys match the primary key.
Question 24: Skipped

As part of our server hardening, are blocking all ports on our servers, unless specified as something we needed open in the technical design documentation. When we block TCP/UDP port 3389, what are we blocking?


Microsoft Terminal Server (RDP) uses TCP/UDP port 3389.
Question 25: Correct

When we are using knowledge-based factors in our authentication process, we would use all of these, EXCEPT which?


Single-use password is not a knowledge based factor, it is a possession based factor.
Question 26: Correct

We are implementing Active Directory (AD) to use for managing our access control. Which of these OS families have AD natively included in their processes and services?


AD (Active Directory): Included in most Windows Server OS as a set of processes and services. Directory service that Microsoft developed for Windows domain networks. Originally it was only in charge of centralized domain management. As of Windows Server 2008, AD became an umbrella term for a broad range of directory-based identity-related services.
Question 27: Correct

We often allow users to use “secret questions and answers” to unlock their accounts, because it makes our administrators workload lighter. Can they also be used as an attack vector?


Secret questions like “Where were you born?” are poor examples of a knowledge factor, it is known by a lot of people and can often be researched easily.
Question 28: Skipped

When we are implementing new access control mechanisms, looking at the IAAA model, what could we use for identification?


User names are used for identification, we should never allow group logins or accounts. Your name, username, ID number, employee number, SSN etc.
Question 29: Correct

Which is the MOST secure encryption type of these 4?


DES, Blowfish and RC4 are no longer considered secure, AES is still considered secure.
Question 30: Skipped

As part of a security assessment we are having an external company do penetration testing. What do we call a penetration test where the tester has full admin level knowledge about our organization and IT infrastructure? (Select all that apply).


White box (Crystal/Clear) Pen testing: (Full Knowledge). The attacker has knowledge of the internal network and access to it like a privileged employee would. Normally Administrator access employee with full knowledge of our environment. There is no full box, gray is partial knowledge and black is no knowledge.
Question 31: Correct

We have decided to implement job rotation in our organization. What can that help prevent?


Job rotation: For the exam, think of it as a way to detect errors and frauds. It is easier to detect fraud, and there is less chance of collusion between individuals if they rotate jobs. It also helps with employee burnout, and it helps employees understand the entire business. This can be too cost prohibitive for the exam/real life; make sure that on the exam, the cost justifies the benefit.
Question 32: Correct

Which of these would NOT be part of a good identity and access provisioning lifecycle?


Account should be locked when employees leave the organization. Deleting them makes it harder to audit, deactivation/locking is preferred.
Question 33: Correct

Using EEPROM makes work easier for our IT staff, what is one of the dangers associated with it?


EEPROM (Electrically Erasable Programmable Read Only Memory) – These are Electrically Erasable, you can use a flashing program. This is still called Read Only. The ability to write to the BIOS makes it vulnerable to attackers.
Question 34: Correct

When we are reviewing our audit logs, it is which type of a control?


Audit log reviews is a detective control, we look at what happened after it happened, looking for patterns and issues.
Question 35: Skipped

Which security principle is Clark-Wilson based on?


Clark-Wilson – Integrity: Separates end users from the backend data through ‘Well-formed transactions’ and ‘Separation of Duties’. The model uses Subject/Program/Object. We have discussed the Subject/Object relationship before, but this puts a program between the two. We don’t allow people access to our inventory when they buy from us. We give them a limited functionality interface they can access.
Question 36: Correct

When we are talking about RAM what are we referencing?


RAM (Random Access Memory) is volatile memory. It loses the memory content after a power loss(or within a few minutes). This can be memory sticks or embedded memory.
Question 37: Skipped

Which of these is the WEAKEST form of authentication we can implement?


Something you know – Type 1 Authentication: Passwords, pass phrase, PIN etc., also called Knowledge factors. It is the weakest form of authentication, and can easily be compromised.
Question 38: Correct

What was the intent of the US Electronic Communications Privacy Act of 1986 (ECPA)?


Electronic Communications Privacy Act (ECPA) was designed for protection of electronic communications against warrantless wiretapping, but it was very weakened by the Patriot Act.
Question 39: Correct

As part of our software testing, we are doing static software testing. What are we doing?


Static testing – Passively testing the code, it is not running. This is walkthroughs, syntax checking, and code reviews. Looks at the raw source code itself looking for evidence of known insecure practices, functions, libraries, or other characteristics having been used in the source code.
Question 40: Correct

We are wanting to erase EPROM memory to update to the latest firmware. How would we do that?


EPROM (Erasable Programmable Read Only Memory) – Can be erased (flashed) and written many times, by shining an ultraviolet light (flash) on a small window on the chip (normally covered by foil).
Question 41: Skipped

What is a WEAKNESS of the Challenge Handshake Authentication Protocol (CHAP)?


CHAP (Challenge-Handshake Authentication Protocol): The CHAP server stores plaintext passwords of each client, an attacker gaining access to the server can steal all the client passwords stored on it. Provides protection against replay attacks by the peer through the use of an incrementally changing identifier and of a variable challenge-value. Requires the client and server know the plaintext of a shared secret, but it is never sent over the network. Providing better security compared to PAP which is vulnerable for both these reasons. Used by PPP (Point to Point Protocol) servers to validate the remote clients. CHAP periodically verifies the identity of the client by using a three-way handshake.
Question 42: Incorrect

When the patriot act was signed into law in 2001, it allowed law enforcement to do what?


PATRIOT Act of 2001: Expands law enforcement electronic monitoring capabilities. Allows search and seizure without immediate disclosure.
Question 43: Skipped

One of your coworkers is telling you about our new policies for PII. What is she referring to?


PII is the abbreviation for Personally Identifiable Information.
Question 44: Correct

What could be one of the NEGATIVE consequences of implementing Single Sign On (SSO) in our organization?


SSO (Single sign-on): Users use a single sign-on for multiple systems. If an attacker compromises a single password they have access to everything that user can access. Often deployed in organizations where users have to access 10+ systems, and they think it is too burdensome to remember all those passwords. SSO have the same strong password requirements as normal single system passwords.
Question 45: Correct

Bob is working on designing new access controls across our organization. Which documentation should he reference to know how and what to implement?


Our Access Control is determined by our policies, procedures, and standards. This outlines how we grant access whom to what: We use least privilege, need to know, and we give our staff and systems exactly the access they need and no more.
Question 46: Skipped

In incident management, which of these is NOT a recognized category of events and/or incidents?


Behavioral is a subset of human, and no a recognized category.
Question 47: Correct

In the TCP/IP model, frames and bits are the PDUs of which layer?


Frames and bits are the PDUs of the Link and physical layer of the TCP/IP model. (Frames are OSI layer 2 and bits are OSI layer 1).
Question 48: Skipped

What could a vulnerability scan possibly help us find?


A vulnerability scanner tool is used to scan a network or system for a list of predefined vulnerabilities such as system misconfiguration, outdated software, or a lack of patching.
Question 49: Skipped

When we talk about using cryptanalysis in our work, what are we doing?


Cryptanalysis is the science of breaking encrypted communication. Cryptanalysis is used to breach cryptographic security systems and gain access to the contents of encrypted messages, even if the cryptographic key is unknown. It uses mathematical analysis of the cryptographic algorithm, as well as side-channel attacks that do not target weaknesses in the cryptographic algorithms themselves, but instead exploit weaknesses in their implementation and the devices that run them.
Question 50: Correct

After a major security breach, we are wanting to a lessons learned. Why is that?


Lessons Learned: This phase is often overlooked, we removed the problem, we have implemented new controls and safeguards. We can learn a lot from lessons learned, not just about the specific incidence, but how well we handle them, what worked, what didn’t. How can we as an organization grow and become better next time we have another incidence, while we may have fixed this one vulnerability there are potentially 100’s of new ones we know nothing about yet. At the end of lessons learned we produce a report to senior management, with our finding, we can only make suggestions, they are ultimately in charge (and liable).
Question 51: Correct

We are implementing biometric authentication. What would be a good reason to do that?


Biometric features rarely change unless we have a serious accident. It is more difficult to copy, people can’t change them unless they get surgery and it is normally more expensive than possession or knowledge factors.
Question 52: Incorrect

In Scrum project management, what is the Scrum master’s role?


Scrum master: Facilitates and accountable for removing impediments to the ability of the team to deliver the product goals and deliverables. Not a traditional team lead or project manager but acts as a buffer between the team and any distracting influences. The scrum master ensures that the Scrum framework is followed.
Question 53: Correct

Why would we choose a centralized access control system over a decentralized one?


Centralized Pros: (Decentralized Cons): All systems and locations have the same security posture. Easier to manage: All records, configurations and policies are centralized and only configured once per policy. Attackers look for the weakest link in our chain, if a small satellite office is not following our security posture, they can be an easy way onto our network. It is more secure, only a few people have access and can make changes to the system. It can also provide separation of duties, the local admin can’t edit/delete logs from their facility. SSO can be used for user access to multiple systems with one login. Centralized Con’s: (Decentralized Pros): Traffic overhead and response time, how long does it take for a door lock to authenticate the user against the database at the head office? Is connectivity to the head office stable, is important equipment on redundant power and internet?
Question 54: Correct

When we talk about WORM media, what are we referring to?


WORM Media (Write Once Read Many): CD/DVDs can be WORM Media (R), if they are not R/W (Read/Write).
Question 55: Skipped

Which industry is the US Gramm-Leach-Bliley Act (GLBA) focused on?


Gramm-Leach-Bliley Act (GLBA): Applies to financial institutions; driven by the Federal Financial Institutions Examination Council (FFIEC); enforced by member agencies, OCC, FDIC, FRB, NCUA, and CFPB. Enacted in 1999, requires protection of the confidentiality and integrity of consumer financial information.
Question 56: Correct

In IT Security we are talking about something as an event, what does that mean?


Event: An observable change in state, this is neither negative nor positive, it is just something has changed. A system powered on, traffic from one segment to another, an application started.
Question 57: Incorrect

What is one of the key benefit of using a Host-based Intrusion Prevention System (HIPS) over a Network-based Intrusion Prevention System (NIPS)?


Host based, on a client, normally a server or workstation. Can look at the actual data (it is decrypted at the end device), NIDS/NIPS can’t look at encrypted packets.
Question 58: Correct

Which of these protocols is NOT found on layer 7 of the Open Systems Interconnection (OSI) model?


PAP is a layer 5 protocol (used for setting up sessions). FTP, LDAP and HTTP are all layer 7 protocols.
Question 59: Skipped

Which of these encryption methods is truly unbreakable if it is implemented right?


One-Time Pad: Cryptographic algorithm where plaintext is combined with a random key. It is the only existing mathematically unbreakable encryption. While it is unbreakable it is also very impractical. It has ONE use per pad; they should never be reused. Characters on the pad have to be truly random. The pads are kept secure.
Question 60: Correct

In our digital forensics, which of these should NEVER happen?


Digital forensics should always be done on bit level copies of the original, never the original.
Question 61: Skipped

Active Directory (AD) uses trust domains; one domain establishes a trust relationship with another domain. Which of these is NOT an AD trust domain?


One-way trust, Two-way trust, Trusted domain, Transitive trust and Intransitive trust are all trust domains, there is no reflective trust.
Question 62: Incorrect

On which layer of the Open Systems Interconnect (OSI) model do we establish the connection between 2 applications?


Layer 5: Session Layer: Establishes connection between 2 applications: Setup > Maintenance > Tear Down.
Question 63: Skipped

Which of these is NOT covered by the Wassenaar Arrangement?


Wassenaar Arrangement – 1996 – present. Limits exports on military and “dual-use” technologies. Cryptography is part of that. Some nations also use it to prevent their citizens from having strong encryption (easier to spy on your own people if they can’t use strong cryptography).
Question 64: Skipped

We are implementing several new countermeasures to make our organization less susceptible to fraud. As part of that we are implementing mandatory vacations. How would we use those?


Mandatory vacations: Done to ensure one person is not always performing the same task, someone else has to cover and it can keep fraud from happening or help us detect it. Their accounts are locked and an audit is performed on the accounts. If the employee has been conducting fraud and covering it up, the audit will discover it. The best way to do this is to not give too much advance notice of vacations.
Question 65: Skipped

Which type of security governance and management would we want to see in our organization?


We always want top-down security governance and management, we want senior leadership on our side. Top-Down: IT leadership is on board with IT Security, they lead and set the direction. Bottom-Up: IT Security is seen as a nuisance and not a helper, often change when breaches happen.
Question 66: Skipped

To establish a TCP session, we are using the TCP 3-way handshake. What is the correct order of the handshake?


The 3-way handshake is client SYN > Server SYN/ACK > Client ACK.
Question 67: Skipped

Why would an organization offer to use a source code escrow to their customers?


Source code escrow: The deposit of the source code of software with a third party escrow agent. Escrow is typically requested by a party licensing software (the licensee), to ensure maintenance of the software instead of abandonment or orphaning. The software source code is released to the licensee if the licensor files for bankruptcy or otherwise fails to maintain and update the software as promised in the software license agreement.
Question 68: Skipped

Which of these is NOT a normal phase of a white hat hacker’s strategy?


White hat hackers use many of the same tools and approaches that black hats would, but they do not delete their tracks, audit files or logs.
Question 69: Skipped

As part of our updated security posture, we have started blocking TCP/UDP port 22 as a default. What are we blocking?


SSH (Secure Shell) uses the well-known TCP/UDP port 22.
Question 70: Skipped

What would we NOT look at in a security assessment?


Security Assessments: A full picture approach to assessing how effective our access controls are, they have a very broad scope. We would not look at Employee performance. Security assessments often span multiple areas, and can use some or all of these components: Policies, procedures, and other administrative controls. Assessing the real world-effectiveness of administrative controls. Change management. Architectural review. Penetration tests. Vulnerability assessments. Security audits.
Question 71: Skipped

The port numbers we use can categorized as well-known, registered, or dynamic/private/ephemeral ports. Which of these is NOT a well-known port?


Well-known Ports are the ports from port 0-1023, they are mostly used for protocols.
Question 72: Skipped

Which of these would be an IP socket-pair?


Socket Pairs (TCP): 2 sets of IP and Port (Source and Destination). This could be Source pair: Destination pair: Well-known ports are often translated, port 443 is https.
Question 73: Skipped

There are a lot of challenges with audit record management. Which of these is not NOT of them?


Audit record management typically faces five distinct problems: Log are not reviewed on a regular and timely basis. Audit logs and audit trails are not stored for a long enough time period. Logs are not standardized or viewable by correlation toolsets – they are only viewable from the system being audited. Log entries and alerts are not prioritized. Audit records are only reviewed for the bad stuff.
Question 74: Skipped

We have had a lot of employee complaints since we started blocking TCP/UDP port 80. What are we blocking?


Hypertext Transfer Protocol (HTTP) uses TCP/UDP port 80, can also use port 8008 and 8080 .
Question 75: Skipped

When our organization is buying custom developed third party software, which of these should NOT be a concern?


We should address support, who owns the code and how good the software development company is, we can’t really see what other companies say about the software it is being custom developed for us.
Question 76: Skipped

Which is NOT one of the (ISC)² ethics canons?


ISC2 Code of Ethics Canons: Protect society, the common good, necessary public trust and confidence, and the infrastructure. Act honorably, honestly, justly, responsibly, and legally. Provide diligent and competent service to principles. Advance and protect the profession.
Question 77: Skipped

In software acceptance testing, what is the purpose of production acceptance testing?


Compatibility/production testing: Does the software interface as expected with other applications or systems? Does the software perform as expected in our production environment vs. the development environment
Question 78: Skipped

We are in a court of law and we are presenting real evidence. What constitutes real evidence?


Real Evidence is tangible and physical objects, in IT Security it is things like hard disks, USB drives and not the data on them.
Question 79: Skipped

Which of these is NOT an example of broken authentication or session management (OWASP A2)?


A2 Broken Authentication and Session Management. Sessions do not expire or take too long to expire. Session IDs are predictable. 001, 002, 003, 004, etc. Tokens, session IDs, Passwords, etc., are kept in plaintext. Pseudo random session IDs would be a broken authentication counter measure.
Question 80: Skipped

What is happening when we experience buffer overflows?


Buffer overflow (buffer overrun): An anomaly where a program, while writing data to a buffer, overruns the buffer’s boundary and overwrites adjacent memory locations, happen from improper coding when a programmer fails to perform bounds checking. Buffers are areas of memory set aside to hold data, often while moving it from one section of a program to another, or between programs. Buffer overflows can often be triggered by malformed inputs, if one assumes all inputs will be smaller than a certain size and the buffer is created to be that size, if an anomalous transaction produces more data it could cause it to write past the end of the buffer. If this overwrites adjacent data or executable code, this may result in erratic program behavior, including memory access errors, incorrect results, and crashes. By sending in data designed to cause a buffer overflow, it is possible to write into areas known to hold executable code, and replace it with malicious code.
Question 81: Skipped

As part of our risk management, we are working on quantitative risk analysis. Select all the terms we would use in this phase:


Quantitative Risk Analysis – We want exactly enough security for our needs. This is where we put a number on that. We find the asset’s value: How much of it is compromised, how much one incident will cost, how often the incident occurs and how much that is per year. Asset Value (AV) – How much is the asset worth? Exposure factor (EF) – Percentage of Asset Value lost? Single Loss Expectancy (SLE) – (AV x EF) – What does it cost if it happens once? Annual Rate of Occurrence (ARO) – How often will this happen each year? Annualized Loss Expectancy (ALE) – This is what it cost per year if we do nothing.
Question 82: Skipped

Jack is looking at different types of encryption. Which of these is a type of asymmetric encryption?


RSA is asymmetric. 3DES, RC6 and Twofish are all symmetric forms of encryption.
Question 83: Skipped

We often refer to 0-day vulnerabilities when we talk about IT security vulnerabilities. What would constitute 0-day vulnerabilities?


0day vulnerabilities: Vulnerabilities not generally known or discovered, the first time an attack is seen is considered day 0, hence the name. From a vulnerability is discovered it is now only a short timespan before patches or signatures are released on major software.
Question 84: Skipped

When would we deploy honeypots?


While honeypots can be useful, we do not want to lure attackers in (entrapment). If we deployed one each time we launched a system we could have 1000’s of them, and during an attack we are busy with more important things.
Question 85: Skipped

With the CIA triad in mind, if we have too much confidentiality which other control will suffer the MOST?


Finding the right mix of Confidentiality, Integrity and Availability is a balancing act. This is really the cornerstone of IT Security – finding the RIGHT mix for your organization. Too much Confidentiality and the Availability can suffer.
Question 86: Skipped

Prior to an external structured audit, we would often do an ‘unstructured’ audit. Who would perform that?


Unstructured audits: Internal auditors to improve our security and find flaws, often done before an external audit.
Question 87: Skipped

Looking at our data management, what is the users role?


Users: These are the users of the data. User awareness must be trained; they need to know what is acceptable and what is not acceptable, and the consequences for not following the policies, procedures and standards.
Question 88: Skipped

Diameter was designed to replace Radius, but the change never happened. Where is Diameter COMMONLY used now?


Diameter is largely used in the 3/4G space, RADIUS is used elsewhere. Was intended to replacement for RADIUS, but the use cases changed and both now have different uses. Also provides centralized AAA (Authentication, Authorization, and Accounting) management for users who connect and use a network service.
Question 89: Skipped

Our organization is using least privilege in our user access management. How are our users assigned privileges?


Least Privilege also called “Minimum necessary access”, we give our users and systems exactly the access they need, no more, no less.
Question 90: Skipped

What are some of the dangers if we chose to NOT use proper and regular patching of our systems?


Patches are released to fix known security vulnerabilities, not applying leaves us open to those vulnerabilities that the attackers also know about.
Question 91: Skipped

Which of these could be some of the ways we can protect our data, when an employee is actively using it?


Data in Use: (We are actively using the files/data, it can’t be encrypted). Use good practices: Clean Desk policy, Print Policy, Allow no ‘Shoulder Surfing’, maybe the use of view angle privacy screen for monitors, locking computer screen when leaving workstation.
Question 92: Skipped

If our organization have role-based access control and need to know policies, which of these actions are allowed?


Role based access control assigns access to roles, with added need to know, just because you have access does not mean you are allowed the data. You need a valid reason for accessing the data. If you do not have one you can be terminated/sued/jailed/fined.
Question 93: Skipped

What would a penetration testing Statement Of Work (SOW) NOT include?


Penetration Testing (Pen Testing) have very clear rules of engagement defined in a SOW (Statement Of Work). Which IP ranges, time frame, tools, POC, how to test, what to test.
Question 94: Skipped

Which process would we use to handle updates to our environments?


Change Management: Often called change control, a formalized process on how we handle changes to our environments. If done right we will have full documentation, understanding and we communicate changes to appropriate parties. The change review board should be comprised of both IT and other operational units from the organization, we may consider impacts on IT, but we are there to serve the organization, they need to understand how it will impact them and raise concerns if they have any.
Question 95: Skipped

To ensure the confidentiality, integrity, and availability of our backup tapes, where would it be appropriate to store them?


Where do we keep our sensitive data? It should be kept in a secure, climate-controlled facility, preferably geographically distant or at least far enough away that potential incidents will not affect that facility too. Many older breaches were from bad policies around tape backups. Tapes were kept at the homes of employees instead of at a proper storage facility or in a storage room with no access logs and no access restrictions (often unencrypted).
Question 96: Skipped

In which order would you use the Software Development Life Cycle (SDLC)?


SDLC (Software Development Life Cycle): The SDLC is not really a methodology, but a description of the phases in the life cycle of software development. These phases are (in general), investigation, analysis, design, build, test, implement, maintenance and support (and disposal). Can have security built into each step of the process, for the exam it always does.
Question 97: Skipped

BIBA’s Invocation Property prohibits users from what?


Invocation Property: “No Read or Write UP”. Subjects can never access or alter data on a higher level.
Question 98: Skipped

Jane is explaining how using AI can help predict healthcare issues for patients. What is AI?


AI (Artificial Intelligence): Intelligence exhibited by machines, rather than humans or other animals. True AI is a topic of discussion; what was considered AI years ago has been achieved, and once the goal is reached, the AI definition is tweaked a little.
Question 99: Skipped

When would a logic bomb go off?


Logic Bombs – Malicious code that executes at a certain time or event – they are dormant until the event (IF/THEN). IF Bob is not getting an annual bonus over $10,000, THEN execute malicious code. IF date and time 5/15/18 00:02:12, THEN execute malicious code.
Question 100: Skipped

What does SOC2 type 1 report on?


SOC 2 Type 1 report on management’s description of a service organization’s system and the suitability of the design of controls.
Question 101: Skipped

Which type of Intrusion Detection Systems (IDS) and Intrusion Prevention System (IPS) are completely vulnerable to 0-day attacks?


Signature based: Looks for known malware signatures. Faster since they just check traffic against malicious signatures. Easier to set up and manage, someone else does the signatures for us. They are completely vulnerable to 0 day attacks, and have to be updated constantly to keep up with new vulnerability patterns.
Question 102: Skipped

What could be one of the ways we could protect our data-at-rest?


Data at Rest (Stored Data): This is data on Disks, Tapes, CDs/DVDs, USB Sticks. We use disk encryption (full/partial), USB encryption, tape encryption (avoid CDs/DVDs). Encryption can be Hardware or Software Encryption.
Question 103: Skipped

We are using some of the best practice rules on our passwords requirements. Which of these would NOT be part of that?


Minimum password age is implemented to prevent users from cycling through the last used passwords to return to their favorite password again. They should also use contain minimum length, upper/lower case letters, numbers and symbols, they should not contain full words or other easy to guess phrases.
Question 104: Skipped

When we are categorizing disasters for our Business Continuity Plan (BCP), we would categorize them into which of these categories? (Select all that apply).


We categorize disasters in 3 categories: natural, human, or environmental. Natural: Anything caused by nature; this could be earthquakes, floods, snow, tornados, etc. Human: Anything caused by humans; they can be intentional or unintentional disasters; unintentional could be an employee using a personal USB stick on a PC at work and spreading malware, which would be just as bad as if an attacker had done it, but the employee was just ignorant, careless, or didn’t think it would matter. Environmental (not to be confused with natural disasters); Anything in our environment; could be power outage/spikes, hardware failures, provider issues, etc.
Question 105: Skipped

We are throughout our organization using Intrusion detection systems (IDS) and Intrusion prevention system (IPS). What are some of the COMMON types of those?


IDSs (Intrusion Detection Systems) and IPSs (Intrusion Prevention Systems) can be categorized into 2 types and with 2 different approaches to identifying malicious traffic. Network based, placed on a network segment (a switch port in promiscuous mode). Host based, on a client, normally a server or workstation. Signature (Pattern) matching, similar to anti virus, it matches traffic against a long list of known malicious traffic patterns. Heuristic (Behavioral) based, uses a normal traffic pattern baseline to monitor for abnormal traffic.
Question 106: Skipped

What is LDAP COMMONLY used for?


LDAP (The Lightweight Directory Access Protocol) is commonly used for central usernames and passwords storage, many different applications and services can connect to the LDAP server to validate users. Open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an IP network. Application layer protocol and use TCP and UDP port 389.
Question 107: Skipped

Those acting under “the color of law” can act on an exigent circumstance. What would constitute exigent circumstances?


Exigent circumstances apply if there is an immediate threat to human life or of evidence destruction. This will later be decided by a court if it was justified. Only applies to law enforcement and those operating under the “color of law” – Title 18. U.S.C. Section 242 – Deprivation of Rights Under the Color of Law.
Question 108: Skipped

When we talk about auditing in the IAAA model, what does that mean?


Accountability (often referred to as Auditing): Trace an Action to a Subjects Identity: Proves who performed given action, it provides non-repudiation. Group or shared accounts are never OK, they have zero accountability. Uses audit trails and logs, to associate a subject with its actions.
Question 109: Skipped

We want to be able to restore our systems with no more than 48 hours of data loss. Which of these could be a backup rotation we could chose to implement?


If we can have no more than 48 hours of data loss the only viable option is a daily backup.
Question 110: Skipped

After a major security incident, we need to provide the chain of custody logs for one of the compromised hard drives. Which of these should NOT be part of the logs?


With the chain of custody everything is documented: Who had it when? What was done? When did they do it? Not what was found.
Question 111: Skipped

Which type of access control model is based on a subject’s clearance?


MAC – (Mandatory Access Control) is system-enforced access control based on a subject’s clearance and an object’s labels.
Question 112: Skipped

The Central Processing Unit (CPU) consists of which two elements?


CPU (Central Processing Unit) is the brains of the system. Arithmetic logic unit (ALU) performs arithmetic and logic operations. It’s a processor that registers that supply operands (Object of a Mathematical Operation) to the ALU and stores the results of ALU operations. It does all the math. Control unit (CU) handles fetching (from memory) and execution of instructions by directing the coordinated operations of the ALU, registers and other components. It also sends instructions to the ALU.
Question 113: Skipped

As part of our layered defense, and to prevent unauthorized devices on our network, we have added the MAC sticky command. Where would we configure that?


Good switch security includes shut down unused ports, add mac-sticky and hardcode if ports are access or trunk ports. Making all ports trunk ports is a bad idea.
Question 114: Skipped

When you discover a software vulnerability, you notify the vendor of the vulnerability for them to fix it. What is the term used for this?


Responsible/Partial disclosure: Telling the vendor, they have time to develop a patch and then disclose it. If they do nothing we can revert to the full disclosure forcing them to act.
Question 115: Skipped

We are using cloud computing and have chosen to use IaaS. Who is responsible for the databases?


IaaS – (Infrastructure as a Service) The vendor provides infrastructure up to the OS, the customer adds the OS and up.
Question 116: Skipped

When our organization is using mandatory access control. What would subjects have?


Subjects have Clearance assigned to them. A formal decision on a subject’s current and future trustworthiness. The higher the clearance, the more in-depth the background checks should be (always in military, not always in business).
Question 117: Skipped

After a security breach, Bob has been asked to ensure evidence integrity. What would he do with the compromised hard drive?


Evidence Integrity – It is vital that the evidence’s integrity cannot be questioned. We do this with hashes; any forensics is done on copies and never the originals. We make a bit level copy of the original, hash it, and the copy should match. We do another hash after the forensics, and that should be the same as the prior two.
Question 118: Skipped

On which layer of the Open Systems Interconnection model (OSI model) would we find the broadcast address FF:FF:FF:FF:FF:FF?


FF:FF:FF:FF:FF:FF is the layer 2 broadcast address. Layer 2 uses mac addresses.
Question 119: Skipped

Which of these authentication protocols is no longer considered secure?


TACACS (The Terminal Access Controller Access Control System): Centralized access control system requiring users to send an ID and reusable (vulnerable) passwords for authentication, because of this it is no longer considered secure. Uses TCP/UDP port 49. TACACS has generally been replaced by TACACS+ and RADIUS.
Question 120: Skipped

What would be one of the EASIEST ways to confirm if our access control mechanics are working?


Audit log reviews is the easiest way to confirm our access control mechanisms are working.
Question 121: Skipped

Looking at our incident management plan, which of these can we possibly mitigate with a redundant geographical distant site?


Disaster: Our entire facility is unusable for 24 hours or longer. If we are geographically diverse and redundant we can mitigate this a lot. Yes, a snowstorm can be a disaster.
Question 122: Skipped

After an attack on our servers, who should handle digital forensic evidence?


People handling digital forensic evidence should always be trained in proper handling.
Question 123: Skipped

When we are performing background checks on our new employees, we would NEVER look at which of these?


When we hire new staff we often do background to ensure we minimize our risks. We can check: References, Degrees, Employment, Criminal, Credit history (less common, more costly). We have new staff sign an NDA (Non-Disclosure Agreement). It is illegal to check or inquire about political preference.
Question 124: Skipped

We have 100 users all needing to communicate with each other. If we are using asymmetric encryption how many keys would we need?


Asymmetric encryption uses 2 keys per user, so we would need 200 keys.
Question 125: Skipped

Which of these protocols is NOT found on layer 3 of the OSI model?


IMAP is a layer 7 protocol. IP, IPSEC, IKE, ICMP, … are all layer 3 protocols.

By in anakyst

the Patriot Act was the first of many changes to surveillance laws that made it easier for the government to spy on ordinary Americans by expanding the authority to monitor phone and email communications, collect bank and credit reporting records, and …


Patriot Act

Hastily passed 45 days after 9/11 in the name of national security, the Patriot Act was the first of many changes to surveillance laws that made it easier for the government to spy on ordinary Americans by expanding the authority to monitor phone and email communications, collect bank and credit reporting records,



The USA PATRIOT Act is an Act of the United States Congress that was signed into law by U.S. President George W. Bush on October 26, 2001. USA PATRIOT is an acronym that stands for Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism. Wikipedia

Originally published: 26 October 2001

An EPROM (rarely EROM), or erasable programmable read-only memory, is a type of programmable read-only memory (PROM) chip that retains its data when its power supply is switched off. Computer memory that can retrieve stored data after a power supply has been turned off and back on is called non-volatile. It is an array of floating-gate transistors individually programmed by an electronic device that supplies higher voltages than those normally used in digital circuits. Once programmed, an EPROM can be erased by exposing it to strong ultraviolet light source (such as from a mercury-vapor lamp). EPROMs are easily recognizable by the transparent fused quartz window on the top of the package, through which the silicon chip is visible, and which permits exposure to ultraviolet light during erasing.

Electronic Communications Privacy Act of 1986 (ECPA), 18 U.S.C. §§ 2510-2523.

Background.  The Electronic Communications Privacy Act and the Stored Wire Electronic Communications Act are commonly referred together as the Electronic Communications Privacy Act (ECPA) of 1986.  The ECPA updated the Federal Wiretap Act of 1968, which addressed interception of conversations using “hard” telephone lines, but did not apply to interception of computer and other digital and electronic communications.  Several subsequent pieces of legislation, including The USA PATRIOT Act, clarify and update the ECPA to keep pace with the evolution of new communications technologies and methods, including easing restrictions on law enforcement access to stored communications in some cases.

General Provisions. The ECPA, as amended, protects wire, oral, and electronic communications while those communications are being made, are in transit, and when they are stored on computers. The Act applies to email, telephone conversations, and data stored electronically.

Civil Rights and Civil Liberties. “The structure of the SCA reflects a series of classifications that indicate the drafters’ judgments about what kinds of information implicate greater or lesser privacy interests. For example, the drafters saw greater privacy interests in the content of stored emails than in subscriber account information. Similarly, the drafters believed that computing services available ‘to the public’ required more strict [sic] regulation than services not available to the public…To protect the array of privacy interests identified by its drafters, the [Act] offers varying degrees of legal protection depending on the perceived importance of the privacy interest involved. Some information can be obtained from providers with a subpoena; other information requires a special court order; and still other information requires a search warrant. In addition, some types of legal process require notice to the subscriber, while other types do not.”

The Act reflects a general approach of providing greater privacy protection for materials in which there are greater privacy interests. For a more in-depth analysis, U.S. Dept. of Justice, Searching and Seizing Computers and Obtaining Electronic Evidence In Criminal Investigations (2009), pp. 115-116, (287pp | 1.01mb | PDF).

Specific Provisions.  The ECPA has three titles:

Title I of the ECPA, which is often referred to as the Wiretap Act, prohibits the intentional actual or attempted interception, use, disclosure, or “procure[ment] [of] any other person to intercept or endeavor to intercept any wire, oral, or electronic communication.”  Title I also prohibits the use of illegally obtained communications as evidence. 18 U.S.C. § 2515..

Exceptions.  Title I provides exceptions for operators and service providers for uses “in the normal course of his employment while engaged in any activity which is a necessary incident to the rendition of his service” and for “persons authorized by law to intercept wire, oral, or electronic communications or to conduct electronic surveillance, as defined in section 101 of the Foreign Intelligence Surveillance Act (FISA) of 1978.” 18 U.S.C. § 2511. It provides procedures for Federal, State, and other government officers to obtain judicial authorization for intercepting such communications, and regulates the use and disclosure of information obtained through authorized wiretapping. 18 U.S.C. §§ 2516-2518. A judge may issue a warrant authorizing interception of communications for up to 30 days upon a showing of probable cause that the interception will reveal evidence that an individual is committing, has committed, or is about to commit a “particular offense” listed in Section 2516. 18 U.S.C. § 2518. Title II of the ECPA, which is called the Stored Communications Act (SCA), protects the privacy of the contents of files stored by service providers and of records held about the subscriber by service providers, such as subscriber name, billing records, or IP addresses. 18 U.S.C. §§ 2701-12. Title III of the ECPA, which addresses pen register and trap and trace devices, requires government entities to obtain a court order authorizing the installation and use of a pen register (a device that captures the dialed numbers and related information to which outgoing calls or communications are made by the subject) and/or a trap and trace (a device that captures the numbers and related information from which incoming calls and communications coming to the subject have originated).  18 U.S.C. §§ 3121 – 3127. No actual communications are intercepted by a pen register or trap and trace.  The authorization order can be issued on the basis of certification by the applicant that the information likely to be obtained is relevant to an ongoing criminal investigation being conducted by the applicant’s agency. Amendments. The ECPA was significantly amended by the Communications Assistance to Law Enforcement Act (CALEA) in 1994, the USA PATRIOT Act in 2001, the USA PATRIOT reauthorization acts in 2006, and the FISA Amendments Act of 2008 (116pp | 303kb | PDF). Other acts have made specific amendments of lesser significance.

Source: Page created by the DHS/Office for Civil Rights and Civil Liberties and the DHS/Privacy Office in cooperation with the DOJ, Office of Justice Programs, Bureau of Justice Assistance.

5 Common Encryption Algorithms and the Unbreakables of the Future

Möchten Sie diesen Beitrag in Deutsch zu lesen? Lesen Sie die Deutsch-Version hier.

While security is an afterthought for many PC users, it’s a major priority for businesses of any size. It has to be when the Ponemon Institute tells us that security breaches are costing companies millions every year.

Even if you don’t have millions to lose, protecting what you do have should be a high priority.

There are several forms of security technology available, but encryption is one that everyday computer users should know about.

How Encryption Works

Encryption is an interesting piece of technology that works by scrambling data so it is unreadable by unintended parties. Let’s take a look at how it works with the email-friendly software PGP (or GPG for you open source people).

Say I want to send you a private message, so I encrypt it using either one of these programs. Here’s the message:

wUwDPglyJu9LOnkBAf4vxSpQgQZltcz7LWwEquhdm5kSQIkQlZtfxtSTsmaw q6gVH8SimlC3W6TDOhhL2FdgvdIC7sDv7G1Z7pCNzFLp0lgB9ACm8r5RZOBi N5ske9cBVjlVfgmQ9VpFzSwzLLODhCU7/2THg2iDrW3NGQZfz3SSWviwCe7G mNIvp5jEkGPCGcla4Fgdp/xuyewPk6NDlBewftLtHJVf =PAb3

Once encrypted, the message literally becomes a jumbled mess of random characters. But, equipped with the secret passcode I text you, you can decrypt it and find the original message.

Come on over for hot dogs and soda!

Whether it’s in transit like our hot dog party email or resting on your hard drive, encryption works to keep prying eyes out of your business – even if they happen to somehow gain access to your network or system. If you want to learn more about how encryption helps protect business data, you can read our article on how encryption aids cloud security.

The technology comes in many forms, with key size and strength generally being the biggest differences in one variety from the next.

Secure Data with Encryption to Protect Vulnerable Information

1. Triple DES

Triple DES was designed to replace the original Data Encryption Standard (DES) algorithm, which hackers eventually learned to defeat with relative ease. At one time, Triple DES was the recommended standard and the most widely used symmetric algorithm in the industry.

Triple DES uses three individual keys with 56 bits each. The total key length adds up to 168 bits, but experts would argue that 112-bits in key strength is more like it.

Despite slowly being phased out, Triple DES still manages to make a dependable hardware encryption solution for financial services and other industries.

2. RSA

RSA is a public-key encryption algorithm and the standard for encrypting data sent over the internet. It also happens to be one of the methods used in our PGP and GPG programs.

Unlike Triple DES, RSA is considered an asymmetric algorithm due to its use of a pair of keys. You’ve got your public key, which is what we use to encrypt our message, and a private key to decrypt it. The result of RSA encryption is a huge batch of mumbo jumbo that takes attackers quite a bit of time and processing power to break.

3. Blowfish

Blowfish is yet another algorithm designed to replace DES. This symmetric cipher splits messages into blocks of 64 bits and encrypts them individually.

Blowfish is known for both its tremendous speed and overall effectiveness as many claim that it has never been defeated. Meanwhile, vendors have taken full advantage of its free availability in the public domain.

Blowfish can be found in software categories ranging from e-commerce platforms for securing payments to password management tools, where it used to protect passwords. It’s definitely one of the more flexible encryption methods available.

4. Twofish

Computer security expert Bruce Schneier is the mastermind behind Blowfish and its successor Twofish. Keys used in this algorithm may be up to 256 bits in length and as a symmetric technique, only one key is needed.

Twofish is regarded as one of the fastest of its kind, and ideal for use in both hardware and software environments. Like Blowfish, Twofish is freely available to anyone who wants to use it. As a result, you’ll find it bundled in encryption programs such as PhotoEncrypt, GPG, and the popular open source software TrueCrypt.

5. AES

The Advanced Encryption Standard (AES) is the algorithm trusted as the standard by the U.S. Government and numerous organizations.

Although it is extremely efficient in 128-bit form, AES also uses keys of 192 and 256 bits for heavy duty encryption purposes.

AES is largely considered impervious to all attacks, with the exception of brute force, which attempts to decipher messages using all possible combinations in the 128, 192, or 256-bit cipher. Still, security experts believe that AES will eventually be hailed the de facto standard for encrypting data in the private sector.

The Future of Encryption

Cyber attacks are constantly evolving, so security specialists must stay busy in the lab concocting new schemes to keep them at bay. Expert observers are hopeful that a new method called Honey Encryption will deter hackers by serving up fake data for every incorrect guess of the key code. This unique approach not only slows attackers down, but potentially buries the correct key in a haystack of false hopes. Then there are emerging methods like quantum key distribution, which shares keys embedded in photons over fiber optic, that might have viability now and many years into the future as well.

Whether it’s protecting your email communications or stored data, some type of encryption should be included in your lineup of security tools. Successful attacks on victims like Target show that it’s not 100 percent bulletproof, but without it, you’re offering up convenient access to your data. Find some tools that give you a piece of mind and stick with ’em!






Some fun facts on encryption. Modern encryption is based entirely on mathematics, none of that sub-standard ‘this enigma machine looks pretty complicated’ style security, encryption systems guaranteed to produce data which is indistinguishable from random bits.

Encryption comes in broadly two flavours (symmetric, asymmetric), Any good security system likely uses both kinds, since they do different things, and each flavour has a few algorithms:

  • DES, this symmetric cipher is the oldest, but variants of it are still in use today. Sadly it is known to be unsecure, even my smartphone could break the basic(56 bit) implementation of it
  • AES, This symmetric cipher is the modern defacto. Almost all encrypted messages appear in this form. It is considered strong because its key is large (128,256,512 bits), it relies on a very unpredictable hashing algorithm (SHA-2/3) and its keys cannot be shrunk by sneaky means (where DSA’s can be shrunk effectively to 48 bits). That said modern supercomputers can potentially brute force attack small keys (possibly using the less secure SHA-1), hence only 256/512 variants are considered ‘safe’
  • RSA, This asymmetric cipher is the most recognised and long standing. Being asymmetric, its keys are huge (1024-4096bits) but it relies on some tricky maths to keep safe. Researchers have recently been able to crack up to 768 bit keys effectively, with certain keys as large as 1024 being broken. Because keeping RSA secure requires having HUGE keys, this standard is on the way out.
  • ECC, This asymmetric cipher is the new kid on the block. Again it relies on tricky maths for its security, but its keys are smaller. The largest instance broken to date is only 112bits. As a side note this is the standard bitcoin and the NSA themselves use.

“But what about security protocols?” i hear you ask.

A security system is essentially a combination of ciphers and actions. No system was safe only because it appeared to be random, it must also use its cryptographic tools to prevent baddies from having their way.

  • Bitcoin is a secure protocol for anonymous cash exchange. It is ‘safe’ if and only if the vast majority of computing resources are working for the system’s benefit. Whilst bitcoin is clearly useful, no expert calls it safe since we cannot be sure precisely how many baddies are out there breaking it. Sadly some bitcoin nodes also have bugs


  • .
  • TLS/SSL is the security layer our websites use (https is just http built on top of it). It relies on a ‘chain of trust’ which connects the websites i visit to the trust authority. The news is full of bad links breaking the chain


  • .

“So when are you going to answer the question?” i hear you ask.

Moral of the story is, security protocols/ciphers come and go. Security is an arms race where the enemy’s power is never fully known, so we stay as far ahead as we practically can. Neither the NSA nor the combined computing power of the whole planet has a hope of breaking a 512bit AES key within your or my lifetime, so they really don’t bother.

tldr: Security is not about sticking with whatever protocol you think the enemy will take longest to break. Keep up to date with the best ciphers/protocols (they change constantly) and make sure there’s a juicier prize with worse security you can point the attackers to.