To secure a network, it is important to identify the normal operating parameters so that you can recognize atypical variations from this baseline operational level. The first step toward minimizing the potential damage that may result from unauthorized access attempts is the detection and identification of an unauthorized intrusion. Intrusion detection requires a detailed understanding of all operational aspects of the network, along with a means to identify variations and bring these changes to the attention of the proper responsible parties. Auditing is done to protect the validity and reliability of organizational information and systems. As a security professional, you can audit a vast amount of data. Auditing can create a large repository of information that has to be filtered through. Monitoring can be as simple or complex as you want to make it. Many organizations monitor an extensive amount of information, whereas others may monitor little or nothing. As a prospective security professional, you should also take every opportunity you may find to expand your skill base beyond these basic foundational elements. The following list includes the key areas from Domain 4 that you need to master for the exam:
Conduct risk assessments and implement risk mitigation.
Carry out vulnerability assessments using common tools.
Use monitoring tools on systems and networks and detect security-related anomalies.
Compare and contrast various types of monitoring methodologies.
Execute proper logging procedures and evaluate the results.
Conduct periodic audits of system security settings.
1. Metrics for security baselines and hardening efforts rely on which of the following?
A. Mitigation of threats and attacks
B. Identification of security measures and policies
C. Identification of vulnerability and risk
D. Mitigation of vulnerability and risk
Quick Answer: 229
Detailed Answer: 232
2. When the risk of equipment loss is covered by a full-replacement insurance policy, which of the following best describes the risk?
A. Accepted
B. Transferred
C. Eliminated
D. Mitigated
Quick Answer: 229
Detailed Answer: 232
3. An organization removes legacy dial-up telephony modem devices to prevent war-dialing attacks. Which of the following best describes the risk?
A. Accepted
B. Transferred
C. Eliminated
D. Mitigated
Quick Answer: 229
Detailed Answer: 232
4. When an organization installs a firewall to prevent attacks, which of the following best describes the risk?
A. Accepted
B. Transferred
C. Eliminated
D. Mitigated
Quick Answer: 229
Detailed Answer: 232
5. When an organization decides the cost of an IDS is too expensive to implement, which of the following best describes the risk?
A. Accepted
B. Transferred
C. Eliminated
D. Mitigated
Quick Answer: 229
Detailed Answer: 232
6. Which of the following best describes the primary purpose of a risk assessment?
A. To collect user logins and passwords for administrative purposes
B. To scan the network to find and address vulnerabilities
C. To properly store and protect personally identifiable information
D. To identify existing threats and potential mitigation mechanisms
Quick Answer: 229
Detailed Answer: 233
7. Which of the following is the correct formula for calculating annual loss expectancy?
A. SLE × ARO
B. ALE × SLE
C. ALE × ARO
D. CLE × SLE
Quick Answer: 229
Detailed Answer: 233
8. Which of the following best describes how single loss expectancy is calculated?
A. Loss prevented minus the total cost of the solution
B. Asset value multiplied by the threat exposure factor
C. Threat factor multiplied by potential vulnerability
D. Annualized rate of occurrence multiplied by threat factor
Quick Answer: 229
Detailed Answer: 233
9. An organization has identified and reduced risk to a level that is comfortable and then implemented controls to maintain that level. Which of the following best describes this action?
A. Risk management
B. Risk acceptance
C. Risk analysis
D. Risk transference
Quick Answer: 229
Detailed Answer: 233
10. An organization identified risks, estimated the impact of potential threats, and identified ways to reduce the risk without the cost of the prevention outweighing the risk. Which of the following best describes this action?
A. Risk management
B. Risk acceptance
C. Risk analysis
D. Risk transference
Quick Answer: 229
Detailed Answer: 233
11. Which of the following best describes risk?
A. Probability of threat exposure
B. Cumulative loss expectancy
C. Possibility of loss or danger
D. Mitigation of loss or danger
Quick Answer: 229
Detailed Answer: 233
12. During the process of risk assessment, which of the following would be reviewed? (Select all correct answers.)
A. Audit policies
B. Access methods
C. Financial records
D. Hiring procedures
Quick Answer: 229
Detailed Answer: 234
13. Which of the following best describes return on investment?
A. Estimating the impact of potential threats and identifying ways to reduce the risk
B. Implemented controls to maintain a level of risk that is comfortable for the organization
C. A measure of how effectively a company uses the money invested in its operations
D. The ratio of money realized on an investment relative to the amount of money invested
Quick Answer: 229
Detailed Answer: 234
14. When the return on investment is calculated, if the result is a negative number, which of the following is true?
A. Less money was spent than the loss prevented.
B. More money was spent than the loss prevented.
C. The money spent was not a worthwhile investment.
D. The money spent was an excellent investment.
Quick Answer: 229
Detailed Answer: 234
15. Which of the following best describes exposure factor or probability?
A. The weakness that allows an attacker to violate the integrity of a system
B. The actual amount of loss prevented by implementing a total cost solution
C. The percentage of loss that a realized threat could have on a certain asset
D. The estimated possibility of a specific threat taking place in a one-year period
Quick Answer: 229
Detailed Answer: 234
1. Which of the following is a software utility that will scan a single machine or a range of IP addresses checking for a response on service connections?
A. Port scanner
B. Network mapper
C. Protocol analyzer
D. Vulnerability scanner
Quick Answer: 229
Detailed Answer: 234
2. Which of the following is a software utility that will scan a range of IP addresses testing for the present of known weaknesses in software configuration and accessible services?
A. Port scanner
B. Network mapper
C. Protocol analyzer
D. Vulnerability scanner
Quick Answer: 229
Detailed Answer: 234
3. Which of the following is a software utility that is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications?
A. Port scanner
B. Network mapper
C. Protocol analyzer
D. Vulnerability scanner
Quick Answer: 229
Detailed Answer: 235
4. Which of the following is a software utility that is used to conduct network assessments over a range of IP addresses and compiles a listing of all systems, devices, and hardware present within a network segment?
A. Port scanner
B. Network mapper
C. Protocol analyzer
D. Vulnerability scanner
Quick Answer: 229
Detailed Answer: 235
5. Which of the following best describes the purpose of OVAL?
A. An abstract description for layered communications and computer network protocol design
B. A family of standards dealing with local area networks and metropolitan area networks
C. An international standard setting body composed of representatives from various national standards organizations
D. An international language for representing vulnerability information allowing the development of vulnerability test tools
Quick Answer: 229
Detailed Answer: 235
6. An administrator working in the Department of Homeland Security needs to document standards for the assessment process of systems. Which of the following would be most useful to the administrator?
A. OVAL
B. IEEE
C. ISO
D. ISSA
Quick Answer: 229
Detailed Answer: 235
7. An organization wants to select an assessment tool for creating an inventory of services hosted on networked systems. Which of the following should the organization choose?
A. Port scanner
B. Network mapper
C. Protocol analyzer
D. Vulnerability scanner
Quick Answer: 229
Detailed Answer: 235
8. An organization wants to select an assessment tool that will examine individual protocols and specific endpoints. Which of the following should the organization choose?
A. Port scanner
B. Network mapper
C. Protocol analyzer
D. Vulnerability scanner
Quick Answer: 229
Detailed Answer: 236
9. An organization wants to select an assessment tool for checking particular versions and patch levels of a service. Which of the following should the organization choose?
A. Port scanner
B. Network mapper
C. Protocol analyzer
D. Vulnerability scanner
Quick Answer: 229
Detailed Answer: 236
10. An organization wants to select an assessment tool that will create graphical details suitable for reporting on network configurations. Which of the following should the organization choose?
A. Port scanner
B. Network mapper
C. Protocol analyzer
D. Vulnerability scanner
Quick Answer: 229
Detailed Answer: 236
11. An organization wants to select an assessment tool that will directly test user logon password strength. Which of the following should the organization choose?
A. Password Locker
B. Password generator
C. Password cracker
D. Password keychain
Quick Answer: 229
Detailed Answer: 236
12. Which of the following best describes the difference between a port scanner and a vulnerability scanner?
A. Port scanners only test for the availability of services; vulnerability scanners check for a particular version or patch level of a service.
B. Port scanners compile a listing of all hardware present within a network segment; vulnerability scanners check for the availability of services.
C. Vulnerability scanners only test for the availability of services; port scanners check for a particular version or patch level of a service.
D. Vulnerability scanners compile a listing of all hardware present within a network segment; port scanners test for the availability of services.
Quick Answer: 229
Detailed Answer: 236
13. When using a password cracker to test mandatory complexity guidelines, which of the following should the password cracker provide?
A. The password only
B. The password and hash value
C. The username and password
D. The strength of the password
Quick Answer: 229
Detailed Answer: 237
14. An organization wants to select an assessment tool that will report information used to identify single points of failure. Which of the following should the organization choose?
A. Port scanner
B. Network mapper
C. Protocol analyzer
D. Vulnerability scanner
Quick Answer: 229
Detailed Answer: 237
15. Which of the following tools is often referred to as a packet sniffer?
A. Port scanner
B. Network mapper
C. Protocol analyzer
D. Vulnerability scanner
Quick Answer: 229
Detailed Answer: 237
1. Which of the following is best described as a friendly attack against a network to test the security measures put into place?
A. Vulnerability assessment
B. Penetration test
C. Security assessment
D. Compliance test
Quick Answer: 229
Detailed Answer: 237
2. Which of the following are the most serious downsides to conducting a penetration test? (Select all correct answers.)
A. They can cause some disruption to network operations.
B. The help desk can be flooded by affected users.
C. They can generate false data in IDS systems.
D. External users can have difficulty accessing resources.
Quick Answer: 229
Detailed Answer: 237
3. Which of the following is true about inexperienced internal systems administrators performing penetration tests against the organizational network? (Select all correct answers.)
A. It is a safe practice.
B. It is a bad practice.
C. It may be a violation of privacy laws.
D. It does not violate any privacy laws.
Quick Answer: 229
Detailed Answer: 238
4. Which of the following is true about the relationship between vulnerability assessment and penetration testing?
A. They are inversely related.
B. They are contradictory.
C. They are separate functions.
D. They are complementary.
Quick Answer: 229
Detailed Answer: 238
5. Which of the following is the main security risk of penetration testing?
A. It can conceal aggression that is unrelated to the test.
B. It can affect user connectivity and resource access.
C. It can disrupt the normal business environment.
D. It can weaken the network’s security level.
Quick Answer: 229
Detailed Answer: 238
1. Which of the following would most likely be used as a troubleshooting tool to tell whether a route is available to a host?
A. tracert
B. netstat
C. nslookup
D. ping
Quick Answer: 230
Detailed Answer: 238
2. Which of the following would most likely be used as a troubleshooting tool in a Windows environment to test the connectivity path a packet takes to arrive at the destination?
A. tracert
B. netstat
C. nslookup
D. ping
Quick Answer: 230
Detailed Answer: 238
3. Which of the following would most likely be used to troubleshoot a Domain Name System (DNS) server database?
A. tracert
B. netstat
C. nslookup
D. ping
Quick Answer: 230
Detailed Answer: 238
4. Which of the following would most likely be used to display all the ports on which the computer is currently listening?
A. tracert
B. netstat
C. nslookup
D. ping
Quick Answer: 230
Detailed Answer: 239
5. Which of the following is used in a Windows environment to verify the Transmission Control Protocol/Internet Protocol (TCP/IP) configuration?
A. traceroute
B. ipconfig
C. netstat
D. ifconfig
Quick Answer: 230
Detailed Answer: 239
6. Which of the following is the most likely reason the ping
command returns a time out when trying to contact an external host?
A. The host is unavailable.
B. DNS traffic is blocked.
C. The host network is unavailable.
D. ICMP traffic is blocked.
Quick Answer: 230
Detailed Answer: 239
7. Which of the following best describes benchmarking?
A. A measuring of normal activity
B. The improving of system performance
C. Determining how much load a server can handle
D. Spreading work between two or more computers
Quick Answer: 230
Detailed Answer: 239
8. Which of the following best describes a baseline?
A. A measure of normal activity
B. The improvement of system performance
C. A comparison of how much load a server can handle
D. The distribution of work between two or more computers
Quick Answer: 230
Detailed Answer: 239
9. Which of the following protocols is used by the ping
utility?
A. ICMP
B. SNMP
C. SMTP
D. NNTP
Quick Answer: 230
Detailed Answer: 239
10. Which of the following is used for tracking and viewing the utilization of operating system resources?
A. Event Viewer
B. Performance console
C. Network Monitor
D. Task Manager
Quick Answer: 230
Detailed Answer: 239
11. Which of the following is used for system monitoring by allowing an administrator to view actions that occur on the system?
A. Event Viewer
B. Performance console
C. Network Monitor
D. Task Manager
Quick Answer: 230
Detailed Answer: 240
12. Which of the following is Microsoft’s version of a protocol analyzer that comes with Windows Server operating systems?
A. Event Viewer
B. Performance console
C. Network Monitor
D. Task Manager
Quick Answer: 230
Detailed Answer: 240
13. Which of the following gives you an instant history view of CPU and memory usage?
A. Event Viewer
B. Performance console
C. Network Monitor
D. Task Manager
Quick Answer: 230
Detailed Answer: 240
14. The network administrator for the organization attempts to access the security log in Event Viewer on the file server, but the log file does not contain any entries. Which of the following is the most likely reason the security log is missing?
A. Logging is not enabled.
B. The security log is not shared.
C. Auditing is not enabled.
D. The security log is not stored on the server.
Quick Answer: 230
Detailed Answer: 240
15. Which of the following is an application layer protocol used to collect statistics from TCP/IP devices?
A. ICMP
B. SNMP
C. SMTP
D. NNTP
Quick Answer: 230
Detailed Answer: 240
16. At which of the following levels should the operating system be monitored to detect rootkits?
A. Kernel
B. Network
C. Application
D. Shell
Quick Answer: 230
Detailed Answer: 240
17. An organization is concerned about unauthorized users attempting to access network resources. Which of the following tools will the organization use to monitor user access activity?
A. Event Viewer
B. Performance console
C. Network Monitor
D. Task Manager
Quick Answer: 230
Detailed Answer: 240
18. An organization is concerned about high I/O and CPU usage on the servers. Which of the following tools will the organization use to monitor resource activity?
A. Event Viewer
B. Performance console
C. Network Monitor
D. Task Manager
Quick Answer: 230
Detailed Answer: 241
19. An organization is concerned about high memory and CPU usage on the local user machines. Which of the following tools will the organization use to spot check resource activity?
A. Event Viewer
B. Performance console
C. Network Monitor
D. Task Manager
Quick Answer: 230
Detailed Answer: 241
20. An organization is having internal network connectivity issues and would like to implement a packet sniffer. Which of the following tools will the organization use to conduct this activity?
A. Event Viewer
B. Performance console
C. Network Monitor
D. Task Manager
Quick Answer: 230
Detailed Answer: 241
21. Several users appear to be having internal network connectivity issues. The systems administrator is not exactly sure where the problem lies. Upon going to a workstation and opening a command prompt, which of the following commands would most likely be typed first?
A. tracert
B. netstat
C. nslookup
D. ipconfig
Quick Answer: 230
Detailed Answer: 241
22. The users appear to be having connectivity issues to a vendor’s web hosted application. The systems administrator is not exactly sure where the problem lies. Upon going to a workstation and opening a command prompt, which of the following commands would most likely be typed first?
A. tracert
B. netstat
C. nslookup
D. ipconfig
Quick Answer: 230
Detailed Answer: 241
23. No one seems to be able to contact the intranet using DNS names but the intranet can be contacted by using the IP address. After opening a command prompt, which of the following commands would most likely be typed first?
A. tracert
B. netstat
C. nslookup
D. ipconfig
Quick Answer: 230
Detailed Answer: 241
24. A user reports slowness and intermittent odd activity on their workstation. After opening a command prompt, which of the following commands would most likely be typed first?
A. tracert
B. netstat
C. nslookup
D. ipconfig
Quick Answer: 230
Detailed Answer: 241
25. Which of the following is true about baselines? (Select all correct answers.)
A. An initial baseline should be done for the network but not applications.
B. Baselines must be updated on a regular basis.
C. Baselines do not need to be updated when new technology is added.
D. Baselines must be updated when the network has changed.
Quick Answer: 230
Detailed Answer: 242
1. Which of the following best describes behavior-based monitoring?
A. Looks at patterns of access that have been established
B. Looks at the way certain executable files make a computer act
C. Looks for specific byte sequences that appear in attack traffic
D. Looks for traffic behavior that is new or unusual
Quick Answer: 230
Detailed Answer: 242
2. Which of the following best describes anomaly-based monitoring?
A. Looks at patterns of access that have been established
B. Looks at the way certain executable files make a computer act
C. Looks for specific byte sequences that appear in attack traffic
D. Looks for traffic behavior that is new or unusual
Quick Answer: 230
Detailed Answer: 242
3. Which of the following best describes signature-based monitoring?
A. Looks at patterns of access that have been established
B. Looks at the way certain executable files make a computer act
C. Looks for specific byte sequences that appear in attack traffic
D. Looks for traffic behavior that is new or unusual principal
Quick Answer: 230
Detailed Answer: 242
4. An organization is concerned about buffer overflow attacks. Which of the following monitoring methods will best suit the organization?
A. Signature-based monitoring
B. Anomaly-based monitoring
C. Performance-based monitoring
D. Behavior-based monitoring
Quick Answer: 230
Detailed Answer: 242
5. An organization is concerned about internal misuse. Which of the following monitoring methods will best suit the organization?
A. Signature-based monitoring
B. Anomaly-based monitoring
C. Performance-based monitoring
D. Behavior-based monitoring
Quick Answer: 230
Detailed Answer: 243
6. An organization is concerned about system compromises from older known attacks on unpatched systems. Which of the following monitoring methods will best suit the organization?
A. Signature-based monitoring
B. Anomaly-based monitoring
C. Performance-based monitoring
D. Behavior-based monitoring
Quick Answer: 230
Detailed Answer: 243
7. An organization wants to implement a monitoring solution that returns few false positives and does not use a lot of system resources. Which of the following monitoring methods will best suit the organization?
A. Signature-based monitoring
B. Anomaly-based monitoring
C. Performance-based monitoring
D. Behavior-based monitoring up
Quick Answer: 230
Detailed Answer: 243
8. An organization wants to implement a monitoring solution that can be used in a mixed operating system environment and not dependent on OS-specific mechanisms. Which of the following monitoring methods will best suit the organization?
A. Signature-based monitoring
B. Anomaly-based monitoring
C. Performance-based monitoring
D. Behavior-based monitoring
Quick Answer: 230
Detailed Answer: 243
9. An organization wants to implement a monitoring solution that includes video surveillance. Which of the following monitoring methods will best suit the organization?
A. Signature-based monitoring
B. Anomaly-based monitoring
C. Performance-based monitoring
D. Behavior-based monitoring
Quick Answer: 230
Detailed Answer: 243
10. An organization wants to implement a monitoring solution that does not require a lot of software updating and can be self-learning. Which of the following monitoring methods will best suit the organization?
A. Signature-based monitoring
B. Anomaly-based monitoring
C. Performance-based monitoring
D. Behavior-based monitoring
Quick Answer: 230
Detailed Answer: 244
11. An organization wants to implement a monitoring solution that returns a low number of false positives. Which of the following monitoring methods will best suit the organization?
A. Signature-based monitoring
B. Anomaly-based monitoring
C. Performance-based monitoring
D. Behavior-based monitoring
Quick Answer: 230
Detailed Answer: 244
12. An organization that issues credit cards requires spending profiles for their customers. Which of the following monitoring methods will best suit the organization?
A. Signature-based monitoring
B. Anomaly-based monitoring
C. Performance-based monitoring
D. Behavior-based monitoring
Quick Answer: 230
Detailed Answer: 244
13. An organization requires a monitoring solution that determines if program is malicious by inspecting the stream of system calls that the program issues to the operating system. Which of the following monitoring method will best suit the organization?
A. Signature-based monitoring
B. Anomaly-based monitoring
C. Performance-based monitoring
D. Behavior-based monitoring
Quick Answer: 230
Detailed Answer: 244
14. Which of the following are disadvantages of using a behavior-based monitoring solution? (Select all correct answers.)
A. The rule sets need constant updating.
B. It can generate false positives.
C. File checking is quite slow.
D. It is based on passive monitoring.
Quick Answer: 230
Detailed Answer: 244
15. Which of the following are disadvantages of using a signature-based monitoring solution? (Select all correct answers.)
A. The rule sets need constant updating.
B. It can generate false positives.
C. File checking is quite slow.
D. It is based on passive monitoring.
Quick Answer: 230
Detailed Answer: 244
16. Which of the following are advantages of using a behavior-based monitoring solution? (Select all correct answers.)
A. Can monitor for malware activities
B. Triggers a low number of false positives
C. Can identify polymorphic viruses
D. Uses very few system resources
Quick Answer: 230
Detailed Answer: 245
17. Which of the following are advantages of using a signature-based monitoring solution? (Select all correct answers.)
A. Can monitor for malware activities
B. Triggers a low number of false positives
C. Can identify polymorphic viruses
D. Uses very few system resources
Quick Answer: 230
Detailed Answer: 245
18. An organization requires a monitoring solution for a highly secure environment in which the individual use patterns for each user profile can be identified. Which of the following monitoring method will best suit the organization?
A. Signature-based monitoring
B. Anomaly-based monitoring
C. Performance-based monitoring
D. Behavior-based monitoring
Quick Answer: 230
Detailed Answer: 245
19. Which of the following types of attacks are anomaly-based monitoring solutions best at detecting? (Select all correct answers.)
A. DoS attacks based on payloads
B. Protocol and port exploitation
C. Documented malicious software
D. Known intrusive activity
Quick Answer: 230
Detailed Answer: 245
20. Which of the following types of attacks are signature-based monitoring solutions best at detecting? (Select all correct answers.)
A. DoS attacks based on payloads or volume
B. Protocol and port exploitation
C. Documented malicious software
D. Known intrusive activity
Quick Answer: 230
Detailed Answer: 245
1. Which of the following best describes system logging?
A. The process of measuring the performance of a network
B. The process of collecting data to be used for monitoring
C. The process of tracking users and actions on the network
D. The process of observing of the state of a system
Quick Answer: 230
Detailed Answer: 245
2. To get an accurate view of a network, which of the following must precede logging?
A. Baselining
B. Auditing
C. Monitoring
D. Archiving
Quick Answer: 230
Detailed Answer: 245
3. Which of the following best describes the way logging should be implemented?
A. Only the user events should be logged.
B. Only pertinent events should be logged.
C. All events should be logged so nothing is missed.
D. Nothing should be logged until there is a need for it.
Quick Answer: 230
Detailed Answer: 245
4. Which of the following would be considered a best practice for improved server performance when deciding where to store log files?
A. Store in the system directory of a machine in the DMZ
B. Store in the system directory on the local machine
C. Store on a nonsystem striped or mirrored disk volume
D. Store on a nonsystem disk volume on the local machine
Quick Answer: 230
Detailed Answer: 246
5. Which of the following would be considered a best security practice when deciding where to store log files?
A. Stored in the system directory on the local machine
B. Stored in a data directory on a server in the Intranet
C. Stored in the system directory of a machine in the DMZ
D. Stored in a centralized repository of an offline volume
Quick Answer: 230
Detailed Answer: 246
6. An organization requires the implementation of an enterprise application logging strategy. Which of the following would be a critical analysis consideration when choosing a solution?
A. A proprietary custom-built solution
B. Already built-in application logging solutions
C. A solution that uses standard protocols and formats
D. A variety of solutions that each use different formats
Quick Answer: 230
Detailed Answer: 246
7. An organization chooses to implement a manual application logging strategy and desires to use a format that can readily be parsed. Which of the following formats will meet the organizational requirements?
A. CSV
B. HTML
C. TXT
D. SQL
Quick Answer: 230
Detailed Answer: 246
8. Application logging standards should be implemented for the types of events the organization logs based on which of the following? (Select all correct answers.)
A. User requirements
B. Vendor requirements
C. Business requirements
D. Regulatory requirements
Quick Answer: 230
Detailed Answer: 246
9. Which of the following is pertinent in addition to reading the log files?
A. Knowing how to correlate events
B. Knowing how to parse log files
C. Knowing how to delete events
D. Knowing how to export log files
Quick Answer: 230
Detailed Answer: 246
10. Internet Information Services (IIS) logs can be used for which of the following purposes? (Select all correct answers.)
A. Assess content
B. Identify bottlenecks
C. End processes
D. Investigate attacks
Quick Answer: 230
Detailed Answer: 246
11. Which of the following most accurately describes best practice for using Microsoft DNS logging?
A. Only the user events should be logged.
B. Only pertinent events should be logged.
C. All events should be logged so nothing is missed.
D. Nothing should be logged until there is a need for it.
Quick Answer: 230
Detailed Answer: 246
12. Which of the following would be the first place an administrator would look when troubleshooting Microsoft DNS-related issues?
A. The DNS debug log file
B. The Event Viewer DNS server log file
C. Syslog channel log.msgs
D. The Event Viewer Application log file
Quick Answer: 230
Detailed Answer: 246
13. Which of the following would be the first place an administrator would look when troubleshooting UNIX- or Linux-based systems?
A. Mtools.conf
B. Msconfig
C. Event Viewer
D. Syslogd
Quick Answer: 230
Detailed Answer: 247
14. Which of the following would be considered best practices for system logging? (Select all correct answers.)
A. For easy compilation, keep log files in plain text.
B. When permissible, encrypt the log files.
C. Store log files on a stand-alone system.
D. Store log files on individual system data partitions.
Quick Answer: 230
Detailed Answer: 247
15. Which of the following would an administrator use to end applications that get hung up without having to reboot the machine?
A. Network Monitor
B. Task Manager
C. Event Viewer
D. Performance Console
Quick Answer: 230
Detailed Answer: 247
16. Which of the following would provide information for troubleshooting remote-access policy issues?
A. Internet Information Services logging
B. Critical and error level logging
C. Authentication and accounting logging
D. Event Viewer Application logging
Quick Answer: 230
Detailed Answer: 247
17. Which of the following are events in the firewall log that require additional examination? (Select all correct answers.)
A. Traffic on port 25
B. HTTP traffic
C. Blocked attempts
D. Suspicious signatures
Quick Answer: 230
Detailed Answer: 247
18. The organizational firewall log shows repeated traffic to port 53. This could be an indication of which of the following types of attacks? (Select all correct answers.)
A. Cross-site scripting
B. Denial of service
C. Distributed denial of service
D. SQL injection
Quick Answer: 230
Detailed Answer: 247
19. Which of the following types of logging events are most commonly found in antivirus software? (Select all correct answers.)
A. Updates
B. Dropped packets
C. Quarantined viruses
D. Update history
Quick Answer: 230
Detailed Answer: 247
20. An organization primarily contracts workers and is concerned about remote-access usage and remote authentication attempts. Which of the following would the organization implement to track this type of activity?
A. Firewall logging
B. RRAS logging
C. IIS logging
D. System logging
Quick Answer: 230
Detailed Answer: 247
1. Which of the following best describes auditing?
A. The process of measuring the performance of a network
B. The process of collecting data to be used for monitoring
C. The process of tracking users and actions on the network
D. The process of observing the state of a system
Quick Answer: 231
Detailed Answer: 248
2. Which of the following are unintended consequences when auditing is not clear-cut or built around the organizational goals and policies? (Select all correct answers.)
A. Irrelevant information is gathered.
B. Important security events are deleted.
C. User hard drives quickly run out of space.
D. System administrators have reduced workloads.
Quick Answer: 231
Detailed Answer: 248
3. A systems administrator is tasked with auditing user privileges. Which of the following steps must be taken? (Select two correct answers.)
A. Enable logging within the operating system.
B. Enable auditing within the operating system.
C. Specify the resources to be audited.
D. Specify the audit file storage directory.
Quick Answer: 231
Detailed Answer: 248
4. An organization has primarily contract workers and is concerned about unauthorized and unintentional access on these accounts. Which of the following would the organization audit to track this type of activity?
A. Group policies
B. Retention polices
C. DHCP events and changes
D. Access use and rights changes
Quick Answer: 231
Detailed Answer: 248
5. Which of the following are user rights used by processes? (Select all correct answers.)
A. Process tracking
B. Create a token object
C. Bypass traverse checking
D. Account management
Quick Answer: 231
Detailed Answer: 248
6. Which of the following is true about the auditing of failed logon events and successful login events?
A. Only failed events should be audited.
B. Only successful events should be audited.
C. Both successful and failed events should be audited.
D. Neither one should be audited unless absolutely necessary.
Quick Answer: 231
Detailed Answer: 248
7. Which of the following best describes the activity that involves collecting information used for monitoring and reviewing purposes?
A. Auditing
B. Logging
C. Baselining
D. Inspecting
Quick Answer: 231
Detailed Answer: 248
8. Which of the following best describes the unintended consequence of turning on all auditing counters for all objects?
A. Reduced user productivity
B. Reduced I/O activity on user machines
C. Reduced administrative overhead
D. Reduced server performance
Quick Answer: 231
Detailed Answer: 248
9. Which of the following would an organization include in its retention and disposal policies? (Select all correct answers.)
A. Security evaluations
B. Commercial software manuals
C. Operational documentation
D. Vendor user manuals
Quick Answer: 231
Detailed Answer: 249
10. Which of the following most accurately describes the maintenance of data-retention and storage polices?
A. Once in place, they are good for many years.
B. They need to be updated on a monthly basis.
C. They need to be updated on a quarterly basis.
D. They need to be updated when business goals change.
Quick Answer: 231
Detailed Answer: 249
11. An organization does not have a data-retention policy in place when it becomes involved in a lawsuit. Many of the employees have kept emails for a period of up to ten years. As a general rule, which of the following is true about the discovery of these emails?
A. All are discoverable regardless of time frame or format.
B. None are discoverable because they are electronic format.
C. They are discoverable only going back three years.
D. Only the emails the organization deems necessary are discoverable.
Quick Answer: 231
Detailed Answer: 249
12. Which of the following are pertinent for an organization to review before formulating data-retention policy? (Select all correct answers.)
A. ISP requirements
B. Regulatory requirements
C. User requirements
D. Business requirements
Quick Answer: 231
Detailed Answer: 249
13. Which of the following best describes how settings will actually be applied to an object in a group policy?
A. Individually applied to the object and only from the last policy
B. A combination of all the settings that can affect the object
C. Only from settings within the domain where the object is located
D. A combination of only local group polices that affect the object
Quick Answer: 231
Detailed Answer: 249
14. An administrator is attempting to resolve some issue with multiple group policies on several computers. Which of the following tools would be used to script GPO troubleshooting of multiple computers?
A. Gpupdate
B. Gpresult
C. Resultant Set of Policy
D. Group Policy object
Quick Answer: 231
Detailed Answer: 249
15. Which of the following tools is used to review the effects of Group Policy settings on a particular computer?
A. Resultant Set of Policy
B. Group Policy object
C. Gpupdate
D. Local Security settings
Quick Answer: 231
Detailed Answer: 249
16. An organization is concerned with knowing about any unusual activity that would indicate modification to the local security authority (LSA). Which of the following event categories should be audited?
A. Audit success events in the account management
B. Success events in the policy change on domain controllers
C. Success and failure events in the system events
D. Audit success events in the logon event category
Quick Answer: 231
Detailed Answer: 250
17. An organization is concerned with unusual activity indicating that an intruder is attempting to gain access to the network. Which of the following event categories should be audited?
A. Audit success events in the account management
B. Success events in the policy change on domain controllers
C. Success and failure events in the system events
D. Audit success events in the logon event category
Quick Answer: 231
Detailed Answer: 250
18. An organization wants to verify changes that are made to user account and group properties. Which of the following event categories should be audited?
A. Audit success events in the account management
B. Success events in the policy change on domain controllers
C. Success and failure events in the system events
D. Audit success events in the logon event category
Quick Answer: 231
Detailed Answer: 250
19. An organization wants a record of when each user logs on to or logs off from any computer. Which of the following event categories should be audited?
A. Audit success events in the account management event
B. Success events in the policy change on domain controllers
C. Success and failure events in the system events
D. Audit success events in the logon event category
Quick Answer: 231
Detailed Answer: 250
20. An organization wants to verify when users log on to or log off from the domain. Which of the following event categories should be audited?
A. Audit success events in the account management event
B. Success events in the policy change on domain controllers
C. Success events in the account logon on domain controllers
D. Audit success events in the logon event category
Quick Answer: 231
Detailed Answer: 250
1. C
2. B
3. C
4. D
5. A
6. D
7. A
8. B
9. A
10. C
11. C
12. A, B, D
13. D
14. B
15. C
1. A
2. D
3. C
4. B
5. D
6. A
7. A
8. C
9. D
10. B
11. C
12. A
13. D
14. B
15. C
1. B
2. A, C
3. B, C
4. D
5. A
1. D
2. A
3. C
4. B
5. B
6. D
7. C
8. A
9. A
10. B
11. A
12. C
13. D
14. C
15. B
16. A
17. A
18. B
19. D
20. C
21. D
22. A
23. C
24. B
25. B, D
1. B
2. D
3. C
4. B
5. D
6. A
7. A
8. D
9. B
10. B
11. A
12. B
13. D
14. B, C
15. A, D
16. A, C
17. B, D
18. B
19. A, B
20. C, D
1. B
2. A
3. B
4. C
5. D
6. C
7. A
8. C, D
9. A
10. A, B, D
11. D
12. B
13. D
14. B, C
15. B
16. C
17. C, D
18. B, C
19. A, C, D
20. B
1. C
2. A, B
3. C
4. D
5. B, C
6. C
7. B
8. D
9. A, C
10. D
11. A
12. B, D
13. B
14. B
15. A
16. B
17. C
18. A
19. D
20. C
1. Answer: C. Metrics for security baselines and hardening efforts rely on identification of vulnerability and risk. It is necessary to have some mechanism for measuring vulnerability to determine whether a baseline has been met, or if a new security measure has been effective. Answer A is incorrect because mitigation of threats and attacks are not related to metrics. Answer B is incorrect because security policies are not related to metrics. Answer D is incorrect; mitigation of vulnerability and risk is not related to metrics.
2. Answer: B. A risk, once identified, can be dealt with in several ways. A risk may be transferred, such as when the risk of equipment loss is covered by a full-replacement insurance policy. Answer A is incorrect because some risks cannot be addressed within a reasonable time or cost constrained and may be accepted, with proper documentation as to the reasons why the risk is acceptable. Answer C is incorrect because some risks can be eliminated through a change in the technology, policy, or mechanism of employment. For example, the risk of “war-dialing” attacks can be eliminated by removing legacy dial-up telephony modem devices. Answer D is incorrect; most risks fall into the mitigated response area, where the application of additional effort may reduce the risk to a level documented as acceptable.
3. Answer: C. A risk, once identified, can be dealt with in several ways. Some risks can be eliminated through a change in the technology, policy, or mechanism of employment. For example, the risk of “war-dialing” attacks can be eliminated by removing legacy dial-up telephony modem devices. Answer A is incorrect because some risks cannot be addressed within a reasonable time or cost constrained and may be accepted, with proper documentation as to the reasons why the risk is acceptable. Answer B is incorrect; a risk may be transferred, such as when the risk of equipment loss is covered by a full-replacement insurance policy. Answer D is incorrect; most risks fall into the mitigated response area, where the application of additional effort may reduce the risk to a level documented as acceptable.
4. Answer: D. A risk, once identified, can be dealt with in several ways. Most risks fall into the mitigated response area, where the application of additional effort may reduce the risk to a level documented as acceptable. Answer A is incorrect because some risks cannot be addressed within a reasonable time or cost constrained and may be accepted, with proper documentation as to the reasons why the risk is acceptable. Answer B is incorrect; a risk may be transferred, such as when the risk of equipment loss is covered by a full-replacement insurance policy. Answer C is incorrect because some risks can be eliminated through a change in the technology, policy, or mechanism of employment. For example, the risk of “war-dialing” attacks can be eliminated by removing legacy dial-up telephony modem devices.
5. Answer: A. A risk, once identified, can be dealt with in several ways. Some risks cannot be addressed within a reasonable time or cost constrained and may be accepted, with proper documentation as to the reasons why the risk is acceptable. Answer B is incorrect; a risk may be transferred, such as when the risk of equipment loss is covered by a full-replacement insurance policy. Answer C is incorrect because some risks can be eliminated through a change in the technology, policy, or mechanism of employment. For example, the risk of “war-dialing” attacks can be eliminated by removing legacy dial-up telephony modem devices. Answer D is incorrect; most risks fall into the mitigated response area, where the application of additional effort may reduce the risk to a level documented as acceptable.
6. Answer: D. Before any baseline can be established, beyond those developed by regulatory bodies outside of the business entity, a risk assessment must be conducted to identify existing risks and potential mitigation mechanisms. Answer A is incorrect. This is not a good policy and is not included is a risk assessment. Answer B is incorrect; it describes a vulnerability assessment. Answer C is incorrect; personally identifiable information may be part of the risk assessment, but is it not the main purpose.
7. Answer: A. Annual loss expectancy (ALE) equals the single loss expectancy (SLE) times the annualized rate of occurrence (ARO): SLE × ARO = ALE. Based on the previous formula, answers B, C, and D are incorrect.
8. Answer: B. SLE equals asset value multiplied by the threat exposure factor or probability. Answer A is incorrect because it describes return on investment (ROI). Answer C is incorrect because it describes risk. Answer D is incorrect because it describes annualized rate of occurrence. The ARO is the estimated possibility of specific threat taking place in a one-year time frame.
9. Answer: A. Risk management is the process of identifying and reducing risk to a level that is comfortable, and then implementing controls to maintain that level. Answer B is incorrect because some risks cannot be addressed within a reasonable time or cost constrained and may be accepted, with proper documentation as to the reasons why the risk is acceptable. Answer C is incorrect because risk analysis helps align security objectives with business objectives. Answer D is incorrect; a risk may be transferred, such as when the risk of equipment loss is covered by a full-replacement insurance policy because risk is the possibility of loss or danger.
10. Answer: C. Risk analysis helps align security objectives with business objectives. Risk analysis identifies risks, estimates the impact of potential threats, and identifies ways to reduce the risk without the cost of the prevention outweighing the risk. Answer A is incorrect. Risk management is the process of identifying and reducing risk to a level that is comfortable, and then implementing controls to maintain that level. Answer B is incorrect because some risks cannot be addressed within a reasonable time or cost constrained and may be accepted, with proper documentation as to the reasons why the risk is acceptable. Answer D is incorrect; a risk may be transferred, such as when the risk of equipment loss is covered by a full-replacement insurance policy because risk is the possibility of loss or danger.
11. Answer: C. Risk is the possibility of loss or danger. Answer A is incorrect because the exposure factor or probability is the percentage of loss that a realized threat could have on a certain asset. Answer B is incorrect; the cumulative loss expectancy (CLE) is a risk model that calculates risk based on single systems. Answer D is incorrect because mitigation comes after risk is identified and assessed.
12. Answer: A, B, D. During the process of risk assessment, it is necessary to review many areas, such as the following: methods of access, authentication schemes, audit policies, hiring and release procedures, isolated services that may provide a single point of failure or avenue of compromise and data or services requiring special backup or automatic failover support. Answer C is incorrect. Financial records review is not a necessary part of risk assessment, but how well that data is protected may be.
13. Answer: D. Return on investment is the ratio of money realized or unrealized on an investment relative to the amount of money invested. Answer A is incorrect because it describes risk analysis. Answer B is incorrect because it describes risk management. Answer C is incorrect because it describes return on capital.
14. Answer: B. Return in investment is equal to the loss prevented minus the cost of solution. If the result of this formula is a negative number, you spent more than the loss prevented. Therefore, answer A is incorrect. Answers C and D are incorrect because depending on what the investment is, it may or may not be a good investment and might be necessary due to regulations.
15. Answer: C. The exposure factor or probability is the percentage of loss that a realized threat could have on a certain asset. Answer A is incorrect because it describes vulnerability. Answer B is incorrect because it describes reduced risk on investment. Answer D is incorrect because it describes annual rate of occurrence.
1. Answer: A. A port-scanning software utility will scan a single machine or a range of IP addresses, checking for a response on service ports. Answer B is incorrect. A network mapper is a software utility used to conduct network assessments over a range of IP addresses. The network mapper compiles a listing of all systems, devices, and network hardware present within a network segment. Answer C is incorrect because a protocol analyzer is a software utility is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications. Answer D is incorrect. A vulnerability scanner is a software utility that will scan a range of IP addresses, testing for the presence of known vulnerabilities in software configuration and accessible services.
2. Answer: D. A vulnerability scanner is a software utility that will scan a range of IP addresses, testing for the presence of known vulnerabilities in software configuration and accessible services. Answer A is incorrect. A port-scanning software utility will scan a single machine or a range of IP addresses, checking for a response on service ports. Answer B is incorrect. A network mapper is a software utility used to conduct network assessments over a range of IP addresses. The network mapper compiles a listing of all systems, devices, and network hardware present within a network segment. Answer C is incorrect because a protocol analyzer is a software utility is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications.
3. Answer: C. A protocol analyzer is a software utility is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications. Answer A is incorrect. A port-scanning software utility will scan a single machine or a range of IP addresses, checking for a response on service ports. Answer B is incorrect. A network mapper is a software utility used to conduct network assessments over a range of IP addresses. The network mapper compiles a listing of all systems, devices, and network hardware present within a network segment. Answer D is incorrect. A vulnerability scanner is a software utility that will scan a range of IP addresses, testing for the present of known vulnerabilities in software configuration and accessible services.
4. Answer: B. A network mapper is a software utility used to conduct network assessments over a range of IP addresses. The network mapper compiles a listing of all systems, devices, and network hardware present within a network segment. Answer A is incorrect. A port-scanning software utility will scan a single machine or a range of IP addresses, checking for a response on service ports. Answer C is incorrect because a protocol analyzer is a software utility is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications. Answer D is incorrect. A vulnerability scanner is a software utility that will scan a range of IP addresses testing for the present of known vulnerabilities in software configuration and accessible services.
5. Answer: D. Open Vulnerability Assessment Language (OVAL) is intended as an international language for representing vulnerability information using an XML schema for expression, allowing tools to be developed to test for identified vulnerabilities in the OVAL repository. Answer A is incorrect because it describes the Open Systems Interconnection reference model (OSI model). Answer B is incorrect because it describes IEEE 802 standards. Answer C is incorrect because it describes the International Organization for Standardization (ISO).
6. Answer: A. Within U.S. Governmental agencies, vulnerability may be discussed using the Open Vulnerability Assessment Language (OVAL) sponsored by the Department of Homeland Security’s National Cyber Security Division (NCSD). Answer B is incorrect because IEEE refers to a family of IEEE standards dealing with local area networks and metropolitan area networks. Answer C is incorrect because the International Organization for Standardization, widely known as ISO, is an international-standard-setting body composed of representatives from various national standards organizations. Answer D is incorrect because the Information Systems Security Association is a security-focused group.
7. Answer: A. A port-scanning software utility will scan a single machine or a range of IP addresses, checking for a response on service ports. Port scanners are useful in creating an inventory of services hosted on networked systems. Answer B is incorrect. A network mapper is a software utility used to conduct network assessments over a range of IP addresses. The network mapper compiles a listing of all systems, devices, and network hardware present within a network segment. Answer C is incorrect because a protocol analyzer is a software utility is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications. Answer D is incorrect. A vulnerability scanner is a software utility that will scan a range of IP addresses, testing for the present of known vulnerabilities in software configuration and accessible services.
8. Answer: C. A protocol analyzer is a software utility is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications. Individual protocols, specific endpoints, or sequential access attempts may be identified using this utility, which is often referred to as a packet sniffer. Answer A is incorrect. A port-scanning software utility will scan a single machine or a range of IP addresses, checking for a response on service ports. Answer B is incorrect. A network mapper is a software utility used to conduct network assessments over a range of IP addresses. The network mapper compiles a listing of all systems, devices, and network hardware present within a network segment. Answer D is incorrect. A vulnerability scanner is a software utility that will scan a range of IP addresses, testing for the present of known vulnerabilities in software configuration and accessible services.
9. Answer: D. A vulnerability scanner is a software utility that will scan a range of IP addresses, testing for the present of known vulnerabilities in software configuration and accessible services. Unlike port scanners, which only test for the availability of services, vulnerability scanners may check for the particular version or patch level of a service to determine its level of vulnerability. Answer A is incorrect. A port-scanning software utility will scan a single machine or a range of IP addresses, checking for a response on service ports. Answer B is incorrect. A network mapper is a software utility used to conduct network assessments over a range of IP addresses. The network mapper compiles a listing of all systems, devices, and network hardware present within a network segment. Answer C is incorrect because a protocol analyzer is a software utility is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications.
10. Answer: B. A network mapper is a software utility used to conduct network assessments over a range of IP addresses. The network mapper compiles a listing of all systems, devices, and network hardware present within a network segment. Answer A is incorrect. A port-scanning software utility will scan a single machine or a range of IP addresses, checking for a response on service ports. Answer C is incorrect because a protocol analyzer is a software utility is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications. Answer D is incorrect. A vulnerability scanner is a software utility that will scan a range of IP addresses, testing for the present of known vulnerabilities in software configuration and accessible services.
11. Answer: C. A password cracker is a software utility that allows direct testing of user logon password strength by conducting a brute-force password test using dictionary terms, specialized lexicons, or mandatory complexity guidelines. Answer A is incorrect. Password Locker is a commercial program that lets you save passwords, recover passwords, and manage and form-fill all your usernames and passwords. Answer B is incorrect because a password generator creates random passwords. Answer D is incorrect. A password keychain, most commonly found on Apple computers, keeps track of your passwords for any type of account.
12. Answer: A. Unlike port scanners, which only test for the availability of services, vulnerability scanners may check for the particular version or patch level of a service to determine its level of vulnerability. Answers B, C, and D are incorrect because they do not accurately describe port scanners or vulnerability scanners.
13. Answer: D. Password crackers should provide only the relative strength of a password, rather than the password itself, to avoid weakening logon responsibility under evidentiary discovery actions. Answers A, B, and C are incorrect because password crackers should not provide the password itself to avoid disclosure under e-discovery proceedings.
14. Answer: B. The network mapper compiles a listing of all systems, devices, and network hardware present within a network segment. This information can be used to identify single points of failure, conduct a network inventory, and create graphical details suitable for reporting on network configurations. Answer A is incorrect. A port-scanning software utility will scan a single machine or a range of IP addresses, checking for a response on service ports. Answer C is incorrect because a protocol analyzer is a software utility is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications. Answer D is incorrect. A vulnerability scanner is a software utility that will scan a range of IP addresses, testing for the present of known vulnerabilities in software configuration and accessible services.
15. Answer: C. A protocol analyzer is a software utility is used on a hub, a switch supervisory port, or in line with network connectivity to allow the analysis of network communications. Individual protocols, specific endpoints, or sequential access attempts may be identified using this utility, which is often referred to as a packet sniffer. Answer A is incorrect. A port-scanning software utility will scan a single machine or a range of IP addresses, checking for a response on service ports. Answer B is incorrect. A network mapper is a software utility used to conduct network assessments over a range of IP addresses. The network mapper compiles a listing of all systems, devices, and network hardware present within a network segment. Answer D is incorrect. A vulnerability scanner is a software utility that will scan a range of IP addresses, testing for the present of known vulnerabilities in software configuration and accessible services.
1. Answer: B. Friendly attacks against a network to test the security measures put into place. Such attacks are referred to as penetration tests or simply “pen tests.” Answer A and C are incorrect because a vulnerability assessment or a security assessment are not directed efforts to exploit vulnerabilities in an attempt to gain access to networked resources. Answer D is incorrect because a compliance test has nothing to do with penetration testing.
2. Answer: A, C. Penetration tests may cause some disruption to network operations as a result of the actual penetration efforts conducted. Penetration tests can also make legitimate attacks by generating false data in intrusion detection systems/intrusion prevention systems (IDS/IPS). Answers B and D are incorrect; although internal and external users may be affected, these are not the most serious downsides of penetration testing.
3. Answer: B, C. Some systems administrators may perform amateur pen tests against networks in an attempt to prove a particular vulnerability exists or to evaluate the overall security exposure of a network. This is a bad practice because it generates false intrusion data, may weaken the network’s security level, and may be a violation of privacy laws, regulatory mandates, or business entity guidelines. Answers A and D are incorrect because the statements are contrary to the correct answers.
4. Answer: D. Vulnerability assessments may be complemented by directed efforts to exploit vulnerabilities in an attempt to gain access to networked resources. Penetration testing includes all of the process in vulnerability assessment plus an important extra step, which is to exploit the vulnerabilities found in the discovery phase. Based in the previous information, answers A, B, and C are incorrect.
5. Answer: A. Penetration tests can also make legitimate attacks by generating false data in IDS systems, concealing aggression that is otherwise unrelated to the officially sanctioned penetration test. Answers B and C are incorrect; although they are both concerns, they are not the main security risk. Answer D is incorrect; penetration testing itself does not weaken the network’s security level; however amateur pen testing can.
1. Answer: D. Packet Internet Grouper (ping) is a utility that tests network connectivity by sending an Internet Control Message Protocol (ICMP) echo request to a host. It is a good troubleshooting tool to tell whether a route is available to a host. Answer A is incorrect because the traceroute
utility traces the route a packet takes and records the hops along the way. Answer B is incorrect because netstat
displays all the ports on which the computer is currently listening. Answer C is incorrect because nslookup
is a command-line utility used to troubleshoot a Domain Name System (DNS) server database.
2. Answer: A. The traceroute
utility traces the route a packet takes and records the hops along the way. This is a good tool to use to find out where a packet is getting hung up. Answer B is incorrect because netstat
displays all the ports on which the computer is currently listening. Answer C is incorrect because nslookup
is a command-line utility used to troubleshoot a Domain Name System (DNS) server database. Answer D is incorrect. Packet Internet Grouper (ping
) is a utility that tests network connectivity by sending an Internet Control Message Protocol (ICMP) echo request to a host.
3. Answer: C. nslookup
is a command-line utility used to troubleshoot a Domain Name System (DNS) server database. Answer A is incorrect because the traceroute
utility traces the route a packet takes and records the hops along the way. Answer B is incorrect because netstat
displays all the ports on which the computer is currently listening. Answer D is incorrect. Packet Internet Grouper (ping
) is a utility that tests network connectivity by sending an Internet Control Message Protocol (ICMP) echo request to a host.
4. Answer: B. netstat
displays all the ports on which the computer is currently listening. Answer A is incorrect because the traceroute
utility traces the route a packet takes and records the hops along the way. Answer C is incorrect because nslookup
is a command-line utility used to troubleshoot a Domain Name System (DNS) server database. Answer D is incorrect. Packet Internet Grouper (ping
) is a utility that tests network connectivity by sending an Internet Control Message Protocol (ICMP) echo request to a host.
5. Answer: B. ipconfig
is used to display the TCP/IP settings on a Windows machine. Answer A is incorrect; the traceroute
utility traces the route a packet takes and records the hops along the way. Answer C is incorrect because netstat
displays all the ports on which the computer is currently listening. Answer D is incorrect; ifconfig
is used to display the TCP/IP settings on a UNIX machine.
6. Answer: D. It is common practice to block ICMP traffic on routers and firewalls. The devices can be configured to block ICMP PING request packets. Answers A and C are incorrect because the host and the host network may be available. Answer B is incorrect because DNS traffic has nothing to do with ping.
7. Answer: C. Benchmarking determines how much of a load the server can handle by comparing two or more systems or components of a system. Answer A is incorrect because it describes a baseline. Answer B is incorrect because it describes performance tuning. Answer D is incorrect; load balancing is a technique to spread work between two or more computers, network links, CPUs, hard drives, or other resources.
8. Answer: A. The measure of normal activity is known as a baseline. Answer B is incorrect because it describes performance tuning. Answer C is incorrect because it describes a benchmark. Answer D is incorrect; load balancing is a technique to spread work between two or more computers, network links, CPUs, hard drives, or other resources.
9. Answer: A. Ping uses the Internet Control Message Protocol (ICMP) and is a network layer test of whether a remote host is alive. A small packet containing an ICMP echo request message is sent through the network to a particular IP address. Answer B is incorrect because Simple Network Management Protocol (SNMP) is an application layer protocol whose purpose is to collect statistics from TCP/IP devices. Answer C is incorrect because Simple Mail Transfer Protocol is used for email. Answer D is incorrect; Network News Transport Protocol is used for newsgroups.
10. Answer: B. Microsoft’s Performance console is used for tracking and viewing the utilization of operating system resources. Answer A is incorrect. Event Viewer enables you to view certain events that occur on the system. Answer C is incorrect. Windows Server operating systems come with a protocol analyzer called Network Monitor. Answer D is incorrect. Although Task Manager does not actually log performance, it gives you an instant history view of CPU and memory usage and can be extremely useful in determining where further investigation is needed.
11. Answer: A. Event Viewer enables you to view certain events that occur on the system. Answer B is incorrect. Microsoft’s Performance console is used for tracking and viewing the utilization of operating system resources. Answer C is incorrect. Windows Server operating systems come with a protocol analyzer called Network Monitor. Answer D is incorrect. Although Task Manager does not actually log performance, it gives you an instant history view of CPU and memory usage and can be extremely useful in determining where further investigation is needed.
12. Answer: C. Windows Server operating systems come with a protocol analyzer called Network Monitor. Answer A is incorrect. Event Viewer enables you to view certain events that occur on the system. Answer B is incorrect. Microsoft’s Performance console is used for tracking and viewing the utilization of operating system resources. Answer D is incorrect. Although Task Manager does not actually log performance, it gives you an instant history view of CPU and memory usage and can be extremely useful in determining where further investigation is needed.
13. Answer: D. Although Task Manager does not actually log performance, it gives you an instant history view of CPU and memory usage and can be extremely useful in determining where further investigation. Answer A is incorrect. Event Viewer enables you to view certain events that occur on the system. Answer B is incorrect. Microsoft’s Performance console is used for tracking and viewing the utilization of operating system resources. Answer C is incorrect. Windows Server operating systems come with a protocol analyzer called Network Monitor.
14. Answer: C. The security log records security events and is available for viewing only by administrators. For security events to be monitored, you must enable auditing. Based on this information, answers A, B, and D are incorrect.
15. Answer: B. Simple Network Management Protocol (SNMP) is an application layer protocol whose purpose is to collect statistics from TCP/IP devices. Answer A is incorrect Internet Control Message Protocol (ICMP) and is a network layer protocol used to test remote connectivity. Answer C is incorrect because Simple Mail Transfer Protocol is used for email. Answer D is incorrect; Network News Transport Protocol is used for newsgroups.
16. Answer: A. The kernel level is the execution profile. It is here that malicious software such as rootkits operate. Answer B is incorrect; the network-level profile consists of the assembly and transport of data packets. Answer C is incorrect because all applications generate a normal profile of behavior. Changes in the normal application behavior warrants further investigation for a compromise. Answer D is incorrect; at the shell level, each user generates a standard profile representing the normal activities that are routine for that person.
17. Answer: A. Event Viewer enables you to view certain events that occur on the system. Event Viewer maintains three log files: one for system processes, one for security information, and one for applications. Answer B is incorrect. Microsoft’s Performance console is used for tracking and viewing the utilization of system resources. Answer C is incorrect because Network Monitor is used to capture network traffic and generate statistics for creating reports. Answer D is incorrect because Task Manager gives you an instant history view of CPU and memory usage and can be extremely useful in determining where further investigation is needed.
18. Answer: B. Microsoft’s Performance console is used for tracking and viewing the utilization of system resources. Answer A is incorrect. Event Viewer enables you to view certain events that occur on the system. Answer C is incorrect because Network Monitor is used to capture network traffic and generate statistics for creating reports. Answer D is incorrect because Task Manager gives you an instant history view of CPU and memory usage and can be extremely useful in determining where further investigation is needed.
19. Answer: D. Although Task Manager does not actually log performance, it gives you an instant history view of CPU and memory usage and can be extremely useful in determining where further investigation. Answer A is incorrect. Event Viewer enables you to view certain events that occur on the system. Answer B is incorrect. Microsoft’s Performance console is used for tracking and viewing the utilization of operating system resources. Answer C is incorrect. Windows Server operating systems come with a protocol analyzer called Network Monitor.
20. Answer: C. Windows Server operating systems come with a protocol analyzer called Network Monitor. A protocol analyzer, otherwise known as a packet sniffer, is used to capture network traffic and generate statistics for creating reports. Answer A is incorrect. Event Viewer enables you to view certain events that occur on the system. Answer B is incorrect. Microsoft’s Performance console is used for tracking and viewing the utilization of operating system resources. Answer D is incorrect. Although Task Manager does not actually log performance, it gives you an instant history view of CPU and memory usage and can be extremely useful in determining where further investigation.
21. Answer: D. ipconfig
is used to display the TCP/IP settings on a Windows machine. Answer A is incorrect because the traceroute
utility traces the route a packet takes and records the hops along the way. Answer B is incorrect because netstat
displays all the ports on which the computer is currently listening. Answer C is incorrect because nslookup
is a command-line utility used to troubleshoot a Domain Name System (DNS) server database.
22. Answer: A. The traceroute
utility traces the route a packet takes and records the hops along the way. Answer B is incorrect because netstat
displays all the ports on which the computer is currently listening. Answer C is incorrect because nslookup
is a command-line utility used to troubleshoot a Domain Name System (DNS) server database. Answer D is incorrect. ipconfig
is used to display the TCP/IP settings on a Windows machine.
23. Answer: C. nslookup
is a command-line utility used to troubleshoot a Domain Name System (DNS) server database. Answer A is incorrect because the traceroute
utility traces the route a packet takes and records the hops along the way. Answer B is incorrect because netstat
displays all the ports on which the computer is currently listening. Answer D is incorrect. ipconfig
is used to display the TCP/IP settings on a Windows machine.
24. Answer: B. netstat
displays all the ports on which the computer is currently listening. Answer A is incorrect. The traceroute
utility traces the route a packet takes and records the hops along the way. Answer C is incorrect because nslookup
is a command-line utility used to troubleshoot a Domain Name System (DNS) server database. Answer D is incorrect. ipconfig
is used to display the TCP/IP settings on a Windows machine.
25. Answer: B, D. Baselines must be updated on a regular basis, and certainly when the network has changed or new technology has been deployed. An initial baseline should be done for both network and application processes so that you can tell whether you have a hardware or software issue. Based on the previous statement, answers A and C are incorrect.
1. Answer: B. Behavior-based scanning works by looking at the way certain executable files make your computer behave. Answer A is incorrect because it describes knowledge-based IDSs. These devices may monitor for patterns of access that have been established as never being appropriate within the monitored network. Answer C is incorrect because it describes signature-based monitoring. This type of monitoring method looks for specific byte sequences or signatures that are known to appear in attack traffic. Answer D is incorrect because it describes anomaly-based monitoring. Anomaly-based monitoring detects any traffic behavior that is new or unusual.
2. Answer: D. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Answer A is incorrect because it describes knowledge-based IDSs. These devices may monitor for patterns of access that have been established as never being appropriate within the monitored network. Answer B is incorrect. Behavior-based scanning works by looking at the way certain executable files make your computer behave. Answer C is incorrect because it describes signature-based monitoring. This type of monitoring method looks for specific byte sequences or signatures that are known to appear in attack traffic.
3. Answer: C. Signature-based monitoring looks for specific byte sequences or signatures that are known to appear in attack traffic. Answer A is incorrect because it describes knowledge-based IDSs. These devices may monitor for patterns of access that have been established as never being appropriate within the monitored network. Answer B is incorrect. Behavior-based scanning works by looking at the way certain executable files make your computer behave. Answer D is incorrect because it describes anomaly-based monitoring. Anomaly-based monitoring detects any traffic behavior that is new or unusual.
4. Answer: B. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Anomaly-based monitoring is useful for detecting these types of attacks: protocol and port exploitation, new exploits or buffer overflow attacks, and DoS attacks based on payloads or volume. Answer A is incorrect because it describes signature-based monitoring. This type of monitoring method looks for specific byte sequences or signatures that are known to appear in attack traffic. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system. Answer D is incorrect. Behavior-based scanning works by looking at the way certain executable files make your computer behave.
5. Answer: D. Behavior-based scanning works by looking at the way certain executable files make your computer behave. This monitoring method can be used to identify internal misuse by recognizing actions outside of normal access patterns or authorized events occurring outside of normal profile usage, such as the access of protected files during off-hours. Answer A is incorrect because it describes signature-based monitoring. This type of monitoring method looks for specific byte sequences or signatures that are known to appear in attack traffic. Answer B is incorrect because it describes anomaly-based monitoring. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system.
6. Answer: A. Signature-based monitoring looks for specific byte sequences or signatures that are known to appear in attack traffic. Signature-based systems have an advantage because of their simplicity and their ability to operate online in real time. The problem is that they can detect only known attacks with identified signatures. Answer B is incorrect because it describes anomaly-based monitoring. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system. Answer D is incorrect. Behavior-based scanning works by looking at the way certain executable files make your computer behave.
7. Answer: A. Signature-based systems have an advantage because of their simplicity and their ability to operate online in real time. The advantages for this type of monitoring include the following: low number of false positives, detailed text logs, and use of few system resources. Answer B is incorrect because it describes anomaly-based monitoring. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system. Answer D is incorrect. Behavior-based scanning works by looking at the way certain executable files make your computer behave.
8. Answer: D. Behavior-based scanning works by looking at the way certain executable files make your computer behave. It is not dependent on OS-specific mechanisms. Answer A is incorrect because it describes signature-based monitoring. This type of monitoring method looks for specific byte sequences or signatures that are known to appear in attack traffic. Answer B is incorrect because it describes anomaly-based monitoring. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system.
9. Answer: B. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Detection of anomalies is used in many security domains, ranging from video surveillance and security systems to intrusion detection and fraudulent transactions. Answer A is incorrect because it describes signature-based monitoring. This type of monitoring method looks for specific byte sequences or signatures that are known to appear in attack traffic. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system. Answer D is incorrect. Behavior-based scanning works by looking at the way certain executable files make your computer behave.
10. Answer: B. The classifications of anomaly detection techniques include statistical methods, rule-based methods, distance-based methods, profiling methods, and model-based approaches. For example, under the profiling method, normal behavior can be programmed based on offline research, or the system can learn behavior while processing network traffic. Answer A is incorrect because it describes signature-based monitoring. This type of monitoring method looks for specific byte sequences or signatures that are known to appear in attack traffic. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system. Answer D is incorrect. Behavior-based scanning works by looking at the way certain executable files make your computer behave.
11. Answer: A. Signature-based systems have an advantage because of their simplicity and their ability to operate online in real time. The advantages for this type of monitoring include the following: low number of false positives, detailed text logs, and use of few system resources. Answer B is incorrect because it describes anomaly-based monitoring. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system. Answer D is incorrect. Behavior-based scanning works by looking at the way certain executable files make your computer behave.
12. Answer: B. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Anomaly detection is analogous to credit card fraud detection. Credit card companies maintain “spending profiles” for their customers. Answer A is incorrect because it describes signature-based monitoring. This type of monitoring method looks for specific byte sequences or signatures that are known to appear in attack traffic. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system. Answer D is incorrect. Behavior-based scanning works by looking at the way certain executable files make your computer behave.
13. Answer: D. Behavior-based scanning works by looking at the way certain executable files make your computer behave. A behavior-based detector determines whether a program is malicious by inspecting the stream of system calls that the program issues to the operating system. Answer A is incorrect because it describes signature-based monitoring. This type of monitoring method looks for specific byte sequences or signatures that are known to appear in attack traffic. Answer B is incorrect because it describes anomaly-based monitoring. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system.
14. Answers: B, C. Behavior based detection has several limitations, including high incidence of false alarms and slow file checking. Answers A and D are incorrect because they are associated with signature-based monitoring solutions.
15. Answer: A, D. Signature-based detection has several limitations, including being based excessively on passive monitoring and the rule sets need constant updating. Answers B and C are incorrect because they are associated with behavior-based monitoring solutions.
16. Answer: A, C. Behavior-based monitoring advantages include the following: It can identify malware before it is added to signature files, monitor for malware activities, and learn about malware based on previous detection. Answers B and D are incorrect because they are advantages associated with signature-based monitoring.
17. Answer: B, D. Signature-based monitoring advantages include the following: It can identify malware before it is added to signature files, monitor for malware activities, and learn about malware based on previous detection. Answers A and C are incorrect because they are advantages associated with behavior-based monitoring.
18. Answer: B. Anomaly-based monitoring detects any traffic behavior that is new or unusual. Because this method detects anomalies, it is also called statistical anomaly detection. Highly secure environments might use complex patterns of behavior analysis, in some cases learning individual patterns of use common to each user profile, so that variations can be identified. Answer A is incorrect because it describes signature-based monitoring. This type of monitoring method looks for specific byte sequences or signatures that are known to appear in attack traffic. Answer C is incorrect because performance-based monitoring is an automated data system that reports annually on the performance of a system. Answer D is incorrect. Behavior-based scanning works by looking at the way certain executable files make your computer behave.
19. Answer: A, B. Anomaly-based monitoring is useful for detecting these types of attacks: protocol and port exploitation, new exploits or buffer overflow attacks, DoS attacks based on payloads or volume, normal network failures, and variants of existing attacks in new environments. Answers C and D are incorrect; they are associated with signature-based monitoring.
20. Answer: C, D. In signature-based monitoring, the user can examine the signature database, and quickly determine which intrusive activity the misuse detection system is programmed to alert on. Another benefit is that it can accurate detect know malicious software. Answers A and B are incorrect; they are associated with anomaly-based monitoring.
1. Answer: B. Logging is the process of collecting data to be used for monitoring and auditing purposes. Answer A is incorrect because it describes baselining. Answer C is incorrect because it describes auditing. Answer D is incorrect because it describes monitoring.
2. Answer: A. Logging procedures and evaluation are an important part of keeping your network safe. However, before you can configure logging, it is essential to identify what is typical behavior for your network. Answers B, C, and D are incorrect; all these functions are performed after logging is enabled.
3. Answer: B. When choosing what to log, be sure you choose carefully. Logs take up disk space and use system resources. They also have to be read; and if you log too much, will bog down the system, and it will take a long time to weed through the log files to determine what is important. Therefore, answers A, C, and D are incorrect.
4. Answer: C. To improve server performance, logs should be stored on a nonsystem striped or striped/mirrored disk volume. Answer A is incorrect. Storing the log files in the DMZ is poor practice as the servers located here are generally more vulnerable. Answers B and D are incorrect; storing the log files on the local machine will not improve performance.
5. Answer: D. Log files should be stored in a centralized repository of an offline volume or on a standalone computer. Answer A is incorrect; storing the log files on the local machine will not improve security. Answer B is incorrect. Storing the log files on the Intranet is poor practice as the information is visible and more vulnerable. Answer C is incorrect. Storing the log files in the DMZ is poor practice as the servers located here are generally more vulnerable.
6. Answer: C. When implementing an application logging strategy, look for a solution that uses standard protocols and formats so that analysis is simpler. Therefore, answers A, B, and D are incorrect.
7. Answer: A. Should you choose to use manual analysis, consider creating the logs in a format that is can readily be parsed, such as comma-separated value (CSV). Doing so will allow for more flexibility when importing the information into applications for analysis. Answers B, C, and D are incorrect because none of these formats are readily parsed.
8. Answer: C, D. Standards should be implemented for the types of events you want to log based on business, technical, and regulatory requirements, and the threats the organization faces. Answer A is incorrect because although user needs should be considered, logging standards should not be based on them. Answer B is incorrect; vendor requirements have nothing to do with organizational logging standards.
9. Answer: A. Not only do you need to read the logs, you may also have to know how to correlate events examining output. Answers B, C, and D are incorrect; they are not pertinent to being able to decipher log files.
10. Answer: A, B, D. IIS logs may include information about site visitors and their viewing habits. They can be used to assess content, identify bottlenecks, or investigate attacks. Answer C is incorrect. Task Manager is a tool that you can use to end processes.
11. Answer: D. DNS logging may cause performance degradation on the server. It should be used only for troubleshooting purposes. By enabling DNS debug logging, you can log all DNS-related information. Based on this information, answers A, B, and C are incorrect.
12. Answer: B. The DNS server log contains events logged by the DNS Server service. For example, when the DNS server starts or stops, a corresponding event message is written to this log. This should be the first place you look when troubleshooting DNS-related issues. Answer A is incorrect. By enabling DNS debug logging, you can log all DNS-related information. Answer C is incorrect. Syslog channels are used for BIND logging. Answer D is incorrect. The Event Viewer Application log will not provide enough detailed information.
13. Answer: D. In UNIX- or Linux-based systems, programs send log entries to the system logging daemon, syslogd. Answer A is incorrect because mtools.conf is a configuration file for all the operations. Answers B and C are incorrect; both Msconfig and Event Viewer are tools used on Windows-based systems.
14. Answer: B, C. You should employ strict access controls on all logging servers. If allowable, encrypt the log files and store log files on a stand-alone system. Answer A is incorrect; it is not good practice to store log files in plain text. Answer D is incorrect; log files should not be stored on data partitions of individual systems.
15. Answer: B. Task Manager is a tool that you can use to end processes or applications that get hung up or cause the operating system to become unstable, without having to reboot the machine. It also gives you an instant view of CPU and memory usage. Answer A is incorrect because Network Monitor is used to capture network traffic and generate statistics for creating reports. Answer C is incorrect because Event Viewer enables you to view certain events that occur on the system. Event Viewer maintains three log files: one for system processes, one for security information, and one for applications. Answer D is incorrect because Microsoft’s Performance console is used for tracking and viewing the utilization of system resources.
16. Answer: C. Authentication and accounting logging is particularly useful for troubleshooting remote-access policy issues. Answer A is incorrect because Internet Information Services (IIS) logging is designed to be more detailed than the event-logging or performance-monitoring features of Windows Server operating systems. The IIS logs can include information such as who has visited your site, what they viewed, and when the information was viewed last. Answer B is incorrect because critical and error level logging is one of the eight different logging levels available for Cisco logging devices. Answer D is incorrect because authentication and accounting logging information is used to track remote-access usage and authentication attempts. This logging is separate from the events recorded in the system event log.
17. Answer: C, D. The following are some events you should to take a closer look at: repeated traffic to particular ports, blocked attempts, and suspicious signatures. Answer A is incorrect because port 25 is used for SMTP traffic. Answer B is incorrect because HTTP traffic is used for web access.
18. Answer: B, C. If a firewall log shows repeated traffic to particular ports, this can indicate a DoS or distributed DoS (DDoS) attack. When there is repeated traffic on port 53, the attacker is probably trying to overwhelm the DNS service. Answers A and D are incorrect because these attacks are associated with web browsers and servers.
19. Answer: A, C, D. Antivirus software, just like other software applications, usually contain a folder within the application for logging events such as updates, quarantined viruses, and update history. Answer B is incorrect. Dropped packets are normally found in router logs.
20. Answer: B. Routing and remote access logging information is used to track remote-access usage and authentication attempts. This logging is separate from the events recorded in the system event log. Therefore, Answer D is incorrect. Answer A is incorrect; firewall logging will not log remote access and authentication. Answer C is incorrect; IIS logging will not log remote access and authentication.
1. Answer: C. Auditing is the process of tracking users and their actions on the network. Answer A is incorrect because it describes baselining. Answer B is incorrect because it describes logging. Answer D is incorrect because it describes monitoring.
2. Answer: A, B. Without proper planning and policies, you probably will quickly fill your log files and hard drives with useless or unused information. The more quickly you fill up your log files, the more frequently you need to check the logs; otherwise, important security events may get deleted unnoticed. Answer C is incorrect because log files should not be stored on user hard drives. Answer D is incorrect. When auditing is not clear-cut, the workload of the system administrator increases.
3. Answer: B, C. Auditing user privileges is generally a two-step process that involves enabling auditing within the operating system and then specifying the resources to be audited. Answer A is incorrect; auditing not logging needs to be enabled. Answer D is incorrect; the log file storage directory is specified not the audit file directory.
4. Answer: D. Auditing of access use and rights changes should be implemented to prevent unauthorized or unintentional access for a guest or restricted user account access to sensitive or protected resources. Answer A is incorrect; group policy controls access to resources. Answer B is incorrect; retention polices concern data not user access. Answer C is incorrect; DHCP deals with the issuing of IP addresses not access to accounts.
5. Answer: B, C. The following user rights are never audited, mainly because they are used by processes: bypass traverse checking, generate security audits, create a token object, debug programs and replace a process-level token. However, the assignment of these rights can be audited. Answers A and D are incorrect; these are audit polices set at a domain level. They are not user right assignments.
6. Answer: C. It is equally important to audit both failed and successful events because both may reveal unauthorized access or an unexpected escalation of access rights. Answers A and B are incorrect because it is important to audit both types of events. Answer D is incorrect because auditing is an important part of securing the network.
7. Answer: B. Logging is the process of collecting data to be used for monitoring and reviewing purposes. Auditing is the process of verification that normally involves going through log files; therefore, answer A is incorrect. Answer C is incorrect. Baselining is measuring and rating the performance of a network. Typically, the log files are frequently inspected, and inspection is not the process of collecting the data; therefore, answer D is incorrect.
8. Answer: D. Turning on all audit counters for all objects could significantly impact server performance. Answer A is incorrect; auditing is done in the background and does not affect user productivity. Answer B is incorrect; if the I/O activity were affected at all, it would be increased. Answer C is incorrect; as with I/O activity, if there were change, it would be an increase, not a decrease.
9. Answer: A, C. Log files, physical records, security evaluations, and other operational documentation should be managed within an organization’s retention and disposal policies. These should include specifications for access authorization, term of retention, and requirements for disposal. Answers B and D are incorrect; software and user manuals are readily available from the vendors website and are not required in a retention and disposal policy.
10. Answer: D. The organization should change and adjust a data-retention policy when and as needed (with emphasis on when and as needed). There may be a reason to make new classifications as business goals change, but make sure this gets into the documentation. Answer A is incorrect. Data-retention policies must be reviewed on a regular basis. Answers B and C are incorrect; these review cycles are too short a period of time.
11. Answer: A. If an organization is sued by a former employee for wrongful termination, the department may be compelled during the discovery phase of the suit to produce all documents related to that individual’s work performance. This used to mean the records and copies of any written correspondence (memos, letters, and so on) concerning the performance of that employee. All data is subject to discovery regardless of storage format or location. Therefore, answers B and C are incorrect. Answer D is incorrect because the organizations can never arbitrarily decide what is and what is not discoverable.
12. Answer: B and D. The organization should have a legal hold policy in place, have an understanding of statutory and regulatory document retention requirements, understand the varying statues of limitations, have a policy, and have a records-retention and destruction schedule. Answer A is incorrect because ISPs do not impose data-retention requirements on customers. Answer C is incorrect because user requirements may be a consideration, but it not pertinent.
13. Answer: B. In Group Policy, the settings that will actually be applied to an object will be a combination of all the settings that can affect the object. Answer A is incorrect because all group policies are applied to the object. Answer C is incorrect; in a universal group, the policies may be applied from different domains. Answer D is incorrect; this would only apply if there was not a domain environment.
14. Answer: B. You can use gpresult to see what policy is in effect and to troubleshoot problems. Answer A is incorrect; you can use gpupdate to refresh policy immediately and to specify certain options at the command line. Answer C is incorrect the Resultant Set of Policy (RSoP) tool is used to determine the effective settings on the computer that you are working from or any other computer in a Windows Server 2003 Active Directory domain. Answer D is incorrect; the Group Policy object is used to create group polices.
15. Answer: A. You can use the Resultant Set of Policy (RSoP) tool to determine the effective settings on the computer that you are working from or any other computer in a Windows Server 2003 Active Directory domain. Answer B is incorrect; the Group Policy object is used to create group polices. Answer C is incorrect; you can use gpupdate to refresh policy immediately and to specify certain options at the command line. Answer D is incorrect; the local security settings are used on the local machine only.
16. Answer: B. The organization should audit success events in the policy change event category on domain controllers. A logged event indicates someone has changed the local security authority (LSA). Answer A is incorrect. Auditing success events in the policy change event category will record success and failure events in the system events. Answer C is incorrect; auditing success events in the account management event category is used to verify changes that were made to account properties and group properties. Answer D is incorrect; auditing success events in the logon event category records when each user logs on to or logs off from the computer.
17. Answer: C. Auditing success events in the account management event category can be used to verify changes that were made to account properties and group properties. Answer A is incorrect. Auditing success events in the policy change event category will record success and failure events in the system events. Answer B is incorrect. Auditing success events in the policy change event category on domain controllers indicates someone has changed the local security authority (LSA). Answer D is incorrect; auditing success events in the logon event category records when each user logs on to or logs off from the computer.
18. Answer: A. Auditing success events in the policy change event category will record success and failure events in the system events. Answer B is incorrect. Auditing success events in the policy change event category on domain controllers indicates someone has changed the local security authority (LSA). Answer C is incorrect; auditing success events in the account management event category is used to verify changes that were made to account properties and group properties. Answer D is incorrect; auditing success events in the logon event category records when each user logs on to or logs off from the computer.
19. Answer: D. Auditing success events in the logon event category records when each user logs on to or logs off from the computer. Answer A is incorrect. Auditing success events in the policy change event category will record success and failure events in the system events. Answer B is incorrect. Auditing success events in the policy change event category on domain controllers indicates someone has changed the local security authority (LSA). Answer C is incorrect; auditing success events in the account management event category is used to verify changes that were made to account properties and group properties.
20. Answer: C. Auditing success events in the account logon event category on domain controllers is used to verify when users log on to or log off from the domain. Answer A is incorrect. Auditing success events in the policy change event category will record success and failure events in the system events. Answer B is incorrect. Auditing success events in the policy change event category on domain controllers indicates someone has changed the local security authority (LSA). Answer D is incorrect; auditing success events in the logon event category records when each user logs on to or logs off from the computer.
3.147.27.171